[BUG] Predicted-prompt autofill synthesizes destructive commands against targets the user never mentioned

### Preflight Checklist

- [x] I have searched [existing issues](https://github.com/anthropics/claude-code/issues?q=is%3Aissue%20state%3Aopen%20label%3Abug) and this hasn't been reported yet
- [x] This is a single bug report (please file separate reports for different bugs)
- [x] I am using the latest version of Claude Code

### What's Wrong?

## What happened

I was working through SQL Server maintenance on a server with six named instances.
Two of them were being decommissioned, and over the course of the session I asked
Claude for the uninstall command for the first, then the second.

After the second, the input box's predicted-prompt autofill offered:

> now give the command to uninstall sql2016

`SQL2016` is a third instance on that same machine. It was never mentioned in the
session. It is live, it holds data, and nothing in the conversation suggested it
should be removed. The suggestion was pattern-matched purely from "user uninstalled
two things, so they probably want to uninstall the next one."

## Why this matters

Autofill is one keystroke from becoming my prompt. The feature is inferring a
destructive verb and then choosing its own target — a target drawn from context I
supplied for an unrelated reason (Claude had listed the instances on that machine
earlier while verifying a different command).

Ordinary prompt prediction completes what I was already going to say. This invents
an action I had no intention of taking, against something I never named. The failure
mode is a user who Tab-completes without reading closely.

## Expected behavior

Predicted prompts should not synthesize destructive operations — uninstall, drop,
delete, remove, reset, force-push — against an entity the user has not themselves
raised in the conversation. Completing a destructive request the user has already
started typing is fine. Proposing a new one is not.

## Environment

- Claude Code 2.1.271, Claude desktop app 2.110.0.0 (Windows 11)
- Occurred in the desktop app's Code tab input box

I have no doubt you could get claude code autofill box to say "kill yourself" or "build a bomb". There seem to be no guardrails, rules or hooks on it at all.

If the autofill says "kill yourself", does Anthropic think they are immune from liability on this issue?

### What Should Happen?

Claude code should have memory, skills, hooks and guardrails on the autofill.

### Error Messages/Logs

```shell

```

### Steps to Reproduce

1. Use Claude Code.

???

3. Loss.

### Claude Model

Opus

### Is this a regression?

No, this never worked

### Last Working Version

_No response_

### Claude Code Version

2.1.271

### Platform

Anthropic API

### Operating System

Windows

### Terminal/Shell

Other

### Additional Information

Having the autofill create destructive unrequested commands is fucking stupid.

The report identifies the Claude Code desktop app's Code tab input box, version 2.1.271, and a Windows environment, but names no implementation files or tests and provides no reproducible steps beyond using Claude Code. Start by reproducing the predicted prompt in that input box; done means destructive actions are not proposed against targets the user has not mentioned.

Written by the indexing model from the issue text.