Before running a shell command, Claude Code checks whether it is safe to run without asking you. Some commands can be read in more than one way, so the shell might run something different from what Claude Code checked. Claude Code now checks such a command both ways and uses the stricter result.
Other changes:
- A command that changes directory more than once is only treated as staying within allowed folders if it contains no
(, backtick or!characters and does not start by setting an environment variable. - Commands Claude Code cannot check for dangerous
rm(file deletion) operations now always ask for your approval, with the message "This command could not be checked for dangerous rm operations: the shell may read it differently than it was parsed."
This replaces the earlier prompt that offered to run the command outside the sandbox (the restricted environment Claude Code uses to limit what commands can touch) because a reserved word followed an assignment or redirect.
You may be asked to approve more commands. In return, a command can no longer slip past the safety check by being written so that Claude Code and the shell read it differently.
tengu_amber_larch On for this account, and not off by defaultThe flag server returned on for the one account this site reads, and nothing in this release compiles it off by default. The compiled default is shown below, and says which it is when we cannot read one: a fifth of gates compile in a string or a number rather than on or off, and most published releases have no gate table behind them at all. No client can see what the server returns for your account.
This account: on · anonymous baseline: on · compiled default in v2.1.309: on
These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release.
Read once, for one account on one subscription tier, against v2.1.309. It isn't a statement about your account. What a flag value here can and cannot tell you