{"version":"2.1.318","anchor":"ssh-command-analysis-in-the-bash-permission-parser-is-strict","canonical_anchor":"ssh-command-analysis-in-the-bash-permission-parser-is-strict","heading":"Fewer ssh commands are approved automatically when options could hide a command","tier":"notice","area":"Bash Tool","scope":"individual","heads_up":true,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.318\/e\/ssh-command-analysis-in-the-bash-permission-parser-is-strict","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.318","markdown":"### Fewer ssh commands are approved automatically when options could hide a command\n\nClaude Code's ssh command checks now look at more options and test commands hidden in options like ProxyCommand against every host\n\n**What**\n\nBefore Claude Code runs a shell command without asking you, it checks what the command does. Its checks for `ssh` commands are now stricter:\n\n- `-l`, `HostKeyAlias`, `ProxyJump` and `CanonicalizeHostname` are now tracked when reading the command.\n\n- Commands placed inside an option, such as `ProxyCommand`, are checked against the full list of hosts and options together.\n\n- All of this checking shares one limit on how much text it reads.\n\nBefore, each command inside an option was checked once per host name.\n\n**Why**\n\nAn `ssh` option can carry a second command that runs on your machine. With these checks, fewer `ssh` commands that could slip a command in this way are approved without asking, so you may see more permission prompts for unusual `ssh` commands.\n\n- Area: Bash Tool\n- Tier: You'll notice\n- Useful: 1\/5\n- Signal: 1\/5\n- Scope: individual\n- Heads-up: yes"}