Source Intelligence

DisclaimerUnofficial, and not affiliated with Anthropic. Nearly all of this is read straight out of what ships: npm bundles, captured prompts, published docs. Anthropic's own notes go in verbatim, marked as theirs. The rest is my reading, and every entry carries the strings behind it. If one looks wrong, vote it down and say why.

All of v2.1.232 Home All releases olderv2.1.231 v2.1.233newer
Claude Code v2.1.232

Windows: approved commands that hide shell code, or that are too long to analyze, get asked again

You'll notice
Useful3 Signal2
Windows

On Windows, previously approved commands that wrap a shell, run long or use many redirects get asked again.

What

Also on Windows only, a previously-approved command is bumped back to an approval prompt when its first word is a shell such as bash, sh, zsh, dash, ksh, mksh or busybox, because the security scan cannot see into the code that shell will run from a string. Over-long commands and commands packed with redirects are re-asked for the same reason.

Details
  • Message shown: This previously-approved command runs shell code from a string its security scan cannot see into; on Windows its writes cannot be checked for Cygwin symlink redirection and need human review.
  • New pattern matching pulls redirect targets (<, >, >>, &>, >|, >&) straight out of raw command text when the command could not be parsed into a syntax tree.
  • Existing interpreter sets still apply; the shell list above is new.
  • The cd-compound case gets its own separate explanation.
Evidence

This previously-approved command runs shell code from a string its security scan cannot see into; on Windows its writes cannot be checked for Cygwin symlink redirection and need human review.

Strings lifted out of the shipped bundle, so the claim above can be checked against them.

Related

Other releases about the same thing. Found by shared names or similar wording; neither means one caused the other.

See this entry in the whole of v2.1.232 →