{"version":"2.1.311","anchor":"bash-command-safety-checks-broadened-for-zsh-and-rubyphp-pa","canonical_anchor":"bash-command-safety-checks-broadened-for-zsh-and-rubyphp-pa","heading":"Bash and sandbox hardening: zsh null commands, Ruby and PHP patterns, home-folder grants and git config.lock","tier":"notice","area":"Bash Safety","scope":"individual","heads_up":true,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.311\/e\/bash-command-safety-checks-broadened-for-zsh-and-rubyphp-pa","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.311","markdown":"### Bash and sandbox hardening: zsh null commands, Ruby and PHP patterns, home-folder grants and git config.lock\n\nShell command checks cover more zsh, Ruby and PHP constructs, and the sandbox blocks more home-folder grants and git config.lock tampering\n\n**Unclear.** It is not clear whether the new checks are switched on by default.\n\n**What**\n\nClaude Code checks shell commands before running them. The sandbox is a restricted environment that limits which files and folders commands can reach. Both are tighter:\n\n- The command analysis now carries `zshNullCommandHeld`, `rubyAttachedPattern` and `forNameDo`. Before, only `quotedBackslashKept` was passed. Each is read through a safety-flag helper, and their defaults were not resolved.\n\n- `NULLCMD` and `READNULLCMD` join the list of dangerous environment variables.\n\n- The zsh builtin list now takes in a separate set in place of the removed `zformat`, `zparseopts`, `zstyle`, `zregexparse`, `getln` and `vared` entries.\n\n- The Ruby attached pattern is passed to the `rscript` and `php` checks.\n\n- A `javaHook` entry is added to a fixed-binary table.\n\n- On Windows, the sandbox tags paths that may be read as a folder name. It refuses grants whose resolved path leads to the home folder or a Claude config folder, and explains why. Before, it only refused a path that is or contains the home folder.\n\n- Symlinks (entries that point to another path) that are relinked late are checked again against the same rules.\n\n- On macOS, the sandbox denies `.git\/**\/config.lock` in case-insensitive spellings. This is tracked by a new `nestedGitConfigLockDenyApplied` state and can be turned off remotely through a kill switch.\n\n**Why**\n\nShell commands that use these zsh, Ruby or PHP constructs may now ask for permission or be blocked. The sandbox is also harder to escape through symlinks, home-folder grants or tampering with git's `config.lock` file.\n\n- Area: Bash Safety\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 1\/5\n- Scope: individual\n- Heads-up: yes"}