'!' shell commands sent from elsewhere are now checked and can be refused

In Claude Code, a message that starts with ! runs as a shell command on the computer directly, without going through Claude. When such a command arrives from another client, it now goes through a series of checks before it runs. It is refused when:

• the session is a Remote Control session
• the session is a background session
• the session started before a restart
• the command arrived more than 90 seconds after it was sent
• the command contains control characters (hidden, non-printing characters)
• the command is too long
• another command is already running
• the server did not confirm it received the command

Claude Code waits for the server to confirm receipt before running anything. Each refusal comes back as a message starting with "Not run:" that explains the reason, for example that ! commands are not available in Remote Control sessions and should be run directly on the computer the session is running on.