Shell command safety checks hold more kinds of commands for permission

What

Before Claude runs a shell command, Claude Code checks it to decide whether it can run straight away or must be held until you approve it. That checker got stricter in several places.

New options are passed to the command parser: cShellsHeld, commandAfterConditional, shortLoopLists, disableHeld, makeHooksHeld and unexpandedTilde. One finding saw several of these set to on. Another found each one read through a server-controlled switch whose names and defaults were not traced, so they may not apply to every account. Before, the options ended at fields such as runsTextHeld and substitutionHeredocs.

The new and tightened checks cover:

• Scripts that may run through csh or tcsh, with refusals such as 'it is written for csh or tcsh, whose text this machine cannot verify'.
• Makefiles and awk scripts. Held results now carry a cause of c_shell, makefile or awk.
• zsh disable and enable.
• ~ in PATH and class-path values, and git --exec-path=~, with the message 'this '~' is not your home directory'. Before, the exec-path case was let through.
• git bisect run and git submodule foreach, which now check the raw, unexpanded text of the commands they run.
• su -s/--shell and runuser, which now check the shell value.
• direnv exec, which gets a heldStanding flag.
• awk, sed and php script files given with attached flags.
• gcloud compute ssh, whose --command, --zone and --project values are now checked.
• Environment variable assignments, which fall back to a second check when the first finds nothing.

Why

More compound, unusual or disguised shell commands will now stop for your approval instead of running automatically, including in auto mode and with allow lists. Expect some extra permission prompts for commands of these kinds.