{"version":"2.1.314","anchor":"python-p-i-runs-get-stricter-checks-when-runstextheld-is-s","canonical_anchor":"python-p-i-runs-get-stricter-checks-when-runstextheld-is-s","heading":"Stricter shell command checks with a new runsTextHeld option","tier":"notice","area":"Bash Tool","scope":"individual","heads_up":true,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.314\/e\/python-p-i-runs-get-stricter-checks-when-runstextheld-is-s","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.314","markdown":"### Stricter shell command checks with a new runsTextHeld option\n\nShell command safety checks gain a runsTextHeld option, stricter Python -P\/-I checks and parsing fixes for run, foreach, -x, --exec and -s\n\n**Unclear.** Nothing says when the stricter check is switched on.\n\n**What**\n\nBefore Claude Code runs a shell command, it analyses the command to decide whether it is safe to run without asking you. Several of these checks changed.\n\n- A new option, `runsTextHeld`, is added to the command analysis. It is on unless explicitly set to `false`, and sits next to other checks such as `forNameDo` and `rubyAttachedPattern`.\n\n- For Python commands run with `-P` or `-I`, when `runsTextHeld` is set, code passed with `-c` that mentions `exec`, `eval` or `execfile` is flagged, as are programs fed in through standard input. Before, `-P` or `-I` ended the check with nothing further examined. Other interpreters keep their existing behaviour.\n\n- The part that reads command prefixes for `run`, `foreach`, `-x` and `--exec` now looks at the correct list of words.\n\n- The shell `-s` check now tests a path with a helper instead of only checking whether it starts with `\/`, `~` or `$`.\n\n**Why**\n\nThese changes affect whether certain commands are run automatically or need your approval. Some Python commands that previously passed may now ask for permission.\n\n- Area: Bash Tool\n- Tier: You'll notice\n- Useful: 1\/5\n- Signal: 1\/5\n- Scope: individual\n- Heads-up: yes"}