You'll notice
A new detector flags shell commands containing risky constructs like command substitution before auto-approving them
What
Claude Code now parses a shell command's structure (using a tree-sitter-based parser) to detect constructs considered unsafe to auto-approve without asking the user, including:
- brace and parameter expansions
$'...'/$"..."style quoting- command substitution (
$(...)) and backticks - process substitution (
<(...)and>(...)) - arithmetic expansion (
$[...]) - malformed or incomplete redirects
If any of these appear in a command, it's flagged as unsafe to auto-approve.
Why
These shell constructs can let a command do something other than what it appears to do at a glance, such as running hidden commands or reading unexpected input. Flagging them prevents Claude Code from auto-approving a command that looks safe but isn't.