The Bash destructive-command warning is fixed to inspect real input, but sits behind tengu_destructive_command_warning, which falls back to false.
The Bash permission UI now checks the actual command being run rather than a rendered display string, so the destructive-command warning fires when it should.
- two Bash permission surfaces take the command from
e.input.commandwhen it is a string - the memoization dependency list was widened to include the input, so the check re-evaluates when the input changes
- gated on
tengu_destructive_command_warning, fallback false
tengu_destructive_command_warning
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
tengu_destructive_command_warning Off in both readingsThe flag server returned off for the account this site reads and for the anonymous baseline. A reading of off cannot rule out a rollout these two readings sit outside of.
This account: off · anonymous baseline: off · compiled default in v2.1.223: off
These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release.
Read once, for one account on one subscription tier, against v2.1.223. It isn't a statement about your account. What a flag value here can and cannot tell you
A reading is one sample. Claude Code evaluates its flags remotely, so no client sees the targeting rule behind a value and this says nothing about your account.
A reading is one sample. Claude Code evaluates its flags remotely, so no client sees the targeting rule behind a value and this says nothing about your account.