Stricter safety checks for find, rg, sort, read, xargs and awk commands

Before Claude Code runs a shell command without asking you, it checks that the command only reads and cannot do harm. Those checks are now stricter for several common commands:

• find: refuses option values worked out at run time, and ; or + clause endings stuck onto other text.
• read and getopts: refuse unquoted wildcard characters such as *, ?, [ or {, which could expand into no word or several words, and values that are risky under the zsh shell.
• rg, sort and xargs: their option values are now checked too.
• awk: is also covered by the tightened checks.

New messages explain when a refusal is because an option's value is worked out at run time.