{"version":"2.1.311","anchor":"bash-permission-analysis-stricter-handling-of-redirects-tha","canonical_anchor":"bash-permission-analysis-stricter-handling-of-redirects-tha","heading":"Bash permission analysis is stricter about read and same-command variables","tier":"notice","area":"Bash Safety","scope":"individual","heads_up":true,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.311\/e\/bash-permission-analysis-stricter-handling-of-redirects-tha","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.311","markdown":"### Bash permission analysis is stricter about read and same-command variables\n\nShell command safety checks now validate read arguments and treat redirects that read variables set in the same command as too complex\n\n**What**\n\nBefore Claude Code runs a shell command without asking you, it reads the command and decides whether it is safe. This analysis is stricter in several places:\n\n- A redirect is the `>` or `<` part of a command that writes output to a file or reads input from one. A redirect that may read a variable set in the same command is now treated as too complex, because shells can differ on which value it gets.\n\n- Loops in the analysis are now bounded.\n\n- `read` is a built-in shell command that reads input into variables. Its arguments are now checked, including the `-a` array name and flag values, and any of these checks can stop the analysis early. Before, its flags were skipped and only the variable names were collected. This happens in the same path-checking function that already handled other built-in commands.\n\n- A new check handles `read` first. When it applies, the older handling that assigns the default `REPLY` variable is skipped.\n\n- There is a new zsh `read` check for cases where zsh behaves differently from bash.\n\n**Why**\n\nSome compound commands, and commands that use `read`, may now ask for permission where they used to run automatically.\n\n- Area: Bash Safety\n- Tier: You'll notice\n- Useful: 1\/5\n- Signal: 1\/5\n- Scope: individual\n- Heads-up: yes"}