Enhanced Security: Path Resolution Bypass Protection

What: Three new security checks to prevent attacks using shell expansion and directory changes How to use: These protections are automatic. Commands that trigger them will prompt for approval:

# These patterns now require manual approval:
echo "data" > /tmp/$VAR/file.txt        # Variable expansion in redirect
cd /tmp && rm -rf important/            # Directory change with write operation
cat file > /etc/$(whoami)/config        # Command substitution in path

Details:

• Shell expansion detection: Regex /(?:>>?)\s\S\$/ catches variable expansion with redirections
• Dollar sign in paths: Any file path containing $ character now requires approval to prevent variable expansion bypass
• CD with write operations: Compound commands using cd followed by write operations (rm, mv, cp, etc.) require approval since final working directory cannot be statically verified
• All three checks use "ask" behavior (require approval) rather than "deny" to allow legitimate use cases
• Evidence: Shell expansion check in tP1() at line 254131, dollar sign check in TYQ() at line 253932, cd detection in Fe8() at line 253997