Follow Discord
Sweep 22 Sep 2026 · 17:19Z Build v2.1.280 501 read Stable v2.1.267 Latest v2.1.280 Next v2.1.280 Feeds RSS JSON llms.txt Unofficial
Claude Code v2.1.268 ·

Bash static-analysis results now flag whether argv came purely from literals

Bash permission checks now note whether a command's arguments came purely from literal text

TierUnder the hoodhow much it should matter to you
Useful1my rating, 1 to 5
Signal1worth watching, 1 to 5
AreaElsewherewhat it touches
KindInternal Changesin v2.1.268,
Under the hood

Bash permission checks now note whether a command's arguments came purely from literal text

What

When Claude Code statically analyzes a bash command to decide on permissions, its 'simple command' parsing result now includes two new fields: argvSourceLiteral, which indicates whether all the command's arguments came purely from literal text, and carveOutMayDesyncQuoteScan. Both are computed from counters that increase whenever the parser encounters arithmetic expansion, simple expansion, or herestring redirects (shell features that compute or substitute values rather than using plain text).

Why

This gives the permission-checking logic more precise information about whether a command's arguments are trustworthy literal text or come from potentially dynamic shell expansions, which affects how safely the command's permissions can be evaluated.

See this entry in the whole of v2.1.268 →

Feedback