{"version":"2.1.275","anchor":"sandboxed-shebanginterpreter-reach-checking-now-understands","canonical_anchor":"sandboxed-shebanginterpreter-reach-checking-now-understands","heading":"Sandboxed shebang\/interpreter reach-checking now understands per-interpreter safe-flag grammars","tier":"notice","area":"Sandbox","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.275\/e\/sandboxed-shebanginterpreter-reach-checking-now-understands","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.275","markdown":"### Sandboxed shebang\/interpreter reach-checking now understands per-interpreter safe-flag grammars\n\nSandbox checks now recognize safe argument flags for many more scripting-language interpreters\n\n**What**\n\nWhen Claude Code's sandbox checks whether a script invoked via a shebang line (the `#!\/usr\/bin\/...` line that names an interpreter) is safe to run, it now uses a large table of argument grammars specific to each interpreter, including bash, dash, zsh, node, Rscript, osascript, fish, tclsh, wish, python, perl, ruby, awk, sed, php, csh, expect, and make. Previously this check was simpler and less permissive.\n\n**Why**\n\nScripts that invoke a recognized interpreter with known-safe flags can now be judged safe more accurately, rather than being treated conservatively across the board.\n\n- Area: Sandbox\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 2\/5"}