What
The function that screens bash commands for dangerous rm/rmdir patterns (like recursive deletes) now accepts an extra callback function as a parameter. This callback runs early, and if it returns a denial, that denial is used immediately.
Why
This makes the dangerous-rm check pluggable, allowing additional deny rules to be layered in without changing the core check itself.