{"version":"2.1.223","anchor":"destructive-command-warning-reads-the-tool-input","canonical_anchor":"destructive-command-warning-reads-the-tool-input","heading":"Destructive-command warning reads the tool input","tier":"soon","area":"Permissions","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.223\/e\/destructive-command-warning-reads-the-tool-input","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.223","markdown":"### Destructive-command warning reads the tool input\n\nThe destructive-command warning now reads the real command, but it stays off unless the feature flag is on.\n\n**What**\n\nThe Bash permission UI now checks the actual command being run rather than a rendered display string, so the destructive-command warning fires when it should.\n\n**Details**\n\n- two Bash permission surfaces take the command from `e.input.command` when it is a string\n- the memoization dependency list was widened to include the input, so the check re-evaluates when the input changes\n- gated on `tengu_destructive_command_warning`, fallback false\n\n**Evidence**\n\n`tengu_destructive_command_warning`\n\n- Flag `tengu_destructive_command_warning`: Off in both readings (read for one account on one subscription tier against v2.1.223; this account: off, anonymous baseline: off, compiled default: off) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release.\n- Area: Permissions\n- Names: `tengu_destructive_command_warning`\n- Tier: Nothing to try yet\n- Useful: 3\/5\n- Signal: 3\/5\n- Present in the build but not switched on"}