Bash permission checks read heredocs and Gradle's exclude-task option differently

Before running a shell command, Claude Code analyzes it to decide whether it can run without asking you or needs your permission. Three things changed in that analysis:

• Heredocs inside substitutions: a new option for handling them is switched on by default. A heredoc is a block of text fed into a command, and a substitution is a command nested inside another, such as $( ... ).
• Nested shells: relative values carried through a command are now passed along when Claude Code checks a shell started inside another shell.
• Gradle: -x and --exclude-task are now known to take a value, the name of the task to skip.