{"version":"2.1.321","anchor":"bash-permission-checks-cpmv-flag-parsing-home-rm-and","canonical_anchor":"bash-permission-checks-cpmv-flag-parsing-home-rm-and","heading":"Shell permission checks now cover more cp, mv and rm cases","tier":"notice","area":"Permissions","scope":"individual","heads_up":false,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.321\/e\/bash-permission-checks-cpmv-flag-parsing-home-rm-and","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.321","markdown":"### Shell permission checks now cover more cp, mv and rm cases\n\nClaude Code now checks where cp and mv really write, looks inside ${HOME} in rm targets, and lets deny rules override rm checks\n\n**What**\n\nBefore Claude runs a shell command, Claude Code checks whether it may run it without asking you. These checks change:\n\n- `cp` and `mv` now understand the `-t`, `-S`, `-b` and `--backup` options and work out where files will actually land\n\n- `cp` and `mv` now ask you when a backup file's name depends on your environment\n\n- `rm` and `rmdir` targets written with `${HOME...}` are now expanded and checked\n\n- a matching deny rule, a rule you set to block a command, can now override the check for dangerous `rm` deletions\n\nThese checks also read the `CLAUDE_CODE_DISABLE_SUBSTITUTION_RM_PROMPT` environment variable. One gate involved is on by default in the code unless it is switched off remotely.\n\n**Why**\n\nThese close gaps where a command that changes files could get past the permission check.\n\n- Flag `tengu_iridescent_boot`: Not enough to say (read for one account on one subscription tier against v2.1.321; this account: no value returned, anonymous baseline: no value returned, compiled default: on) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release.\n- Area: Permissions\n- Tier: You'll notice\n- Useful: 1\/5\n- Signal: 1\/5\n- Scope: individual\n- Heads-up: no"}