Bash commands are now classified for telemetry

What

When Claude Code runs a command with the Bash tool, it now breaks that command down into structured pieces before recording it internally:

• A command class and the program name (argv0), covering tools like git, gh, npm, pnpm, yarn, pip, uv, cargo, go, docker, and kubectl
• The subcommand being used (for example git commit or gh pr), including a second-level subcommand for gh
• Whether the command uses a pipe, redirect, chain (like &&), subshell, or heredoc, and how many simple commands it contains
• Prefix commands such as sudo, env, time, nice, timeout, xargs, stdbuf, and caffeinate are stripped out first so the real command underneath is what gets classified

This breakdown is attached to Claude Code's internal telemetry events for bash tool use (success and error), behind an enhanced-telemetry setting.

Why

This is internal analytics, not a user-facing feature. It lets Claude Code understand what kinds of commands are being run in aggregate without needing to log the raw command text, which helps improve the product while limiting exposure of potentially sensitive command content.