{"version":"2.1.309","anchor":"bash-permission-check-re-evaluates-divergent-shape-commands","canonical_anchor":"bash-permission-check-re-evaluates-divergent-shape-commands","heading":"Stricter permission checks for shell commands that could be read two ways","tier":"notice","area":"Bash Safety","scope":"individual","heads_up":true,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.309\/e\/bash-permission-check-re-evaluates-divergent-shape-commands","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.309","markdown":"### Stricter permission checks for shell commands that could be read two ways\n\nShell commands that could be read two ways are now checked both ways, and more of them ask for your approval\n\n**What**\n\nBefore running a shell command, Claude Code checks whether it is safe to run without asking you. Some commands can be read in more than one way, so the shell might run something different from what Claude Code checked. Claude Code now checks such a command both ways and uses the stricter result.\n\nOther changes:\n\n- A command that changes directory more than once is only treated as staying within allowed folders if it contains no `(`, backtick or `!` characters and does not start by setting an environment variable.\n\n- Commands Claude Code cannot check for dangerous `rm` (file deletion) operations now always ask for your approval, with the message \"This command could not be checked for dangerous rm operations: the shell may read it differently than it was parsed.\"\n\nThis replaces the earlier prompt that offered to run the command outside the sandbox (the restricted environment Claude Code uses to limit what commands can touch) because a reserved word followed an assignment or redirect.\n\n**Why**\n\nYou may be asked to approve more commands. In return, a command can no longer slip past the safety check by being written so that Claude Code and the shell read it differently.\n\n- Flag `tengu_amber_larch`: On for this account, and not off by default (read for one account on one subscription tier against v2.1.309; this account: on, anonymous baseline: on, compiled default: on) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release.\n- Area: Bash Safety\n- Tier: You'll notice\n- Useful: 1\/5\n- Signal: 2\/5\n- Scope: individual\n- Heads-up: yes"}