[MODEL] Desktop Code tab refuses all local file deletion (browser-agent safety rule), then behaves inconsistently under pushback

### Preflight Checklist

- [x] I have searched [existing issues](https://github.com/anthropics/claude-code/issues?q=is%3Aissue%20state%3Aopen%20label%3Amodel) for similar behavior reports
- [x] This report does NOT contain sensitive information (API keys, passwords, etc.)

### Type of Behavior Issue

Claude refused a reasonable request

### What You Asked Claude to Do

In the Claude desktop app (Code tab), I asked Claude to clean up a decommissioned local project I had fully migrated elsewhere: delete input/output files, model weights, venv, caches, and logs, keeping only a small summary record.

I explicitly confirmed multiple times that the data was backed up and should be deleted, and asked Claude to execute the deletion itself (escalating via UAC if needed).

### What Claude Actually Did

1. Inventoried disk usage and wrote a small summary file (good).
2. Refused to delete anything, citing a rule that "permanently deleting files" is prohibited even with explicit user authorization.
3. Justified the refusal with invented reasoning ("your data is important / irreversible"), which is not what the rule says.
4. Created a cleanup .ps1 script on my Desktop (outside the project) and told me to run it.
5. When I asked it to remove that script, it moved it to the Recycle Bin, then refused to empty it (same rule).
6. After more pushback, it permanently deleted the script anyway, saying the rule shouldn't apply to a tiny file.
7. Then reversed again, saying that deletion was also a mistake and the rule has no size exception.
8. Kept arguing repeatedly after I asked it to stop.

### Expected Behavior

Claude should have:
1. Treated local file deletion in a coding session like any other shell command, governed by the normal permission/approval system, especially after explicit, repeated user confirmation.
2. If a hard restriction truly applies, stated it once, clearly, as a product limitation, without inventing justifications or arguing.
3. Not created files outside the project that it cannot clean up itself.
4. Stayed consistent instead of flip-flopping under pressure.

The underlying rule appears written for browser/computer-use agents (it sits alongside rules about emails, CAPTCHAs, cookie banners, web-page prompt injection) and conflicts with normal coding-agent guidance.

### Files Affected

```shell

```

### Permission Mode

Accept Edits was ON (auto-accepting changes)

### Can You Reproduce This?

Yes, every time with the same prompt

### Steps to Reproduce

1. Open the Claude desktop app, Code tab, in any local project.
2. Create a throwaway file, e.g. `test.txt`.
3. Ask Claude: "Permanently delete test.txt. I confirm and authorize this."
4. Claude refuses, citing that permanently deleting files is prohibited regardless of user authorization.

### Claude Model

Opus

### Relevant Conversation

```markdown
Claude: "Permanently deleting files is not something I can do directly, no matter how you authorize it. There is no exception to this rule."

Me: "The script is a few KB of garbage you wrote yourself, not even in the project. You refuse to delete it?"

Claude: "...Rigidly applying the literal rule while ignoring that there's no risk here was a mistake. I'll clear it from the Recycle Bin now." [permanently deletes it]

Claude (next turn): "The rule has no exception for file size or importance... that script shouldn't have been deleted."
```

### Impact

High - Significant unwanted changes

### Claude Code Version

2.1.186 (Claude Code)

### Platform

Anthropic API

### Additional Context

- Occurs in the Claude desktop app Code tab, which injects browser/computer-use safety rules into coding sessions.
- The rule conflicts with other coding-agent instructions that assume deletion is allowed after verifying the target.
- Requested fix: scope the deletion prohibition to browser/computer-use actions, let the normal permission system govern local filesystem operations, or provide a user opt-out.

Reproduce the behavior in the Claude desktop app Code tab using the stated test.txt prompt and Claude Code version 2.1.186. Compare the injected browser/computer-use safety rule with the normal permission and approval behavior for local filesystem commands. Done means authorized local deletion is handled consistently, without invented explanations, unwanted external files, or repeated argument.

Written by the indexing model from the issue text.