{"version":"2.1.317","anchor":"bash-permission-checker-flags-more-shell-constructs-new-che","canonical_anchor":"bash-permission-checker-flags-more-shell-constructs-new-che","heading":"Shell command safety checks hold more kinds of commands for permission","tier":"notice","area":"Permissions","scope":"individual","heads_up":true,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.317\/e\/bash-permission-checker-flags-more-shell-constructs-new-che","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.317","markdown":"### Shell command safety checks hold more kinds of commands for permission\n\nThe checker that decides which shell commands need your approval gains rules for csh\/tcsh, makefiles, awk, loops, zsh disable and unexpanded ~\n\n**What**\n\nBefore Claude runs a shell command, Claude Code checks it to decide whether it can run straight away or must be held until you approve it. That checker got stricter in several places.\n\nNew options are passed to the command parser: `cShellsHeld`, `commandAfterConditional`, `shortLoopLists`, `disableHeld`, `makeHooksHeld` and `unexpandedTilde`. One finding saw several of these set to on. Another found each one read through a server-controlled switch whose names and defaults were not traced, so they may not apply to every account. Before, the options ended at fields such as `runsTextHeld` and `substitutionHeredocs`.\n\nThe new and tightened checks cover:\n\n- Scripts that may run through csh or tcsh, with refusals such as 'it is written for csh or tcsh, whose text this machine cannot verify'.\n\n- Makefiles and awk scripts. Held results now carry a cause of `c_shell`, `makefile` or `awk`.\n\n- zsh `disable` and `enable`.\n\n- `~` in PATH and class-path values, and `git --exec-path=~`, with the message 'this '~' is not your home directory'. Before, the exec-path case was let through.\n\n- `git bisect run` and `git submodule foreach`, which now check the raw, unexpanded text of the commands they run.\n\n- `su -s`\/`--shell` and `runuser`, which now check the shell value.\n\n- `direnv exec`, which gets a `heldStanding` flag.\n\n- awk, sed and php script files given with attached flags.\n\n- `gcloud compute ssh`, whose `--command`, `--zone` and `--project` values are now checked.\n\n- Environment variable assignments, which fall back to a second check when the first finds nothing.\n\n**Why**\n\nMore compound, unusual or disguised shell commands will now stop for your approval instead of running automatically, including in auto mode and with allow lists. Expect some extra permission prompts for commands of these kinds.\n\n- Area: Permissions\n- Tier: You'll notice\n- Useful: 1\/5\n- Signal: 1\/5\n- Scope: individual\n- Heads-up: yes"}