{"version":"2.1.311","anchor":"datestat-auto-allow-tightened-under-a-gate","canonical_anchor":"datestat-auto-allow-tightened-under-a-gate","heading":"Tighter auto-approval checks for date, stat and zsh builtins","tier":"notice","area":"Bash Safety","scope":"individual","heads_up":true,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.311\/e\/datestat-auto-allow-tightened-under-a-gate","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.311","markdown":"### Tighter auto-approval checks for date, stat and zsh builtins\n\nShell safety checks are stricter for date formats, stat paths, zsh stat options and zsh module builtins, with new hints on how to pass\n\n**Unclear.** What switches this stricter mode on, and whether it is on for a given user, is not stated.\n\n**What**\n\nClaude Code approves some read-only shell commands automatically, without asking you. The checks for `date`, `stat` and several zsh built-in commands have changed:\n\n- Under a safe-mode gate, `date` rejects the `%N` and `%q` formats and records the refusal.\n\n- Under the same gate, `stat -c` with a `%` format is allowed only in a narrow form, and `stat` paths that are dynamic or start with `~` are refused.\n\n- New messages explain these refusals. A word given to `stat` may turn into `--help`, and `date` `%N`\/`%q` behave differently between versions. The messages suggest `stat -c FORMAT -- \"PATH\"`, or `date +%s`, or doing the sum in `bc` or `awk`.\n\n- zsh's own `stat` with `-A` or `-H` is rejected, because zsh's stat builtin stores its result in the variable that option names, so the value cannot be checked in advance.\n\n- A set of zsh module builtins, including `zformat`, `zparseopts`, `zstyle`, `zregexparse`, `getln`, `vared`, `strftime` and `zstat`, is now blocked only when a further check says so. Before, they were blocked every time with a \"can bypass security checks\" refusal.\n\n**Why**\n\nSome `date` and `stat` commands that used to run automatically may now ask for permission or be refused, and Claude is told how to rewrite them so they pass. Commands that use the listed zsh builtins may also be rejected or prompt.\n\n- Area: Bash Safety\n- Tier: You'll notice\n- Useful: 1\/5\n- Signal: 2\/5\n- Scope: individual\n- Heads-up: yes"}