Enhanced Security: Path Resolution Bypass Protection / Claude Code v2.0.33

What: Three new security checks to prevent attacks using shell expansion and directory changes How to use: These protections are automatic. Commands that trigger them will prompt for approval:

# These patterns now require manual approval:
echo "data" > /tmp/$VAR/file.txt        # Variable expansion in redirect
cd /tmp && rm -rf important/            # Directory change with write operation
cat file > /etc/$(whoami)/config        # Command substitution in path

Details:

Shell expansion detection: Regex /(?:>>?)\s\S\$/ catches variable expansion with redirections
Dollar sign in paths: Any file path containing $ character now requires approval to prevent variable expansion bypass
CD with write operations: Compound commands using cd followed by write operations (rm, mv, cp, etc.) require approval since final working directory cannot be statically verified
All three checks use "ask" behavior (require approval) rather than "deny" to allow legitimate use cases
Evidence: Shell expansion check in tP1() at line 254131, dollar sign check in TYQ() at line 253932, cd detection in Fe8() at line 253997