{"version":"2.1.63","anchor":"enhanced-shell-security-checks","canonical_anchor":"enhanced-shell-security-checks","heading":"Enhanced Shell Security Checks","tier":null,"area":null,"scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.63\/e\/enhanced-shell-security-checks","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.63","markdown":"### Enhanced Shell Security Checks\n\nNew Zsh-specific and general shell security checks for the Bash tool:\n\n- **Zsh process substitution** `=()` \u2014 detected and flagged\n- **Zsh glob qualifiers** with command execution `(+` \u2014 detected and flagged\n- **Zsh `try\/always` constructs** `} always {` \u2014 detected and flagged\n- **Dangerous Zsh builtins** (`zmodload`, `zpty`, `ztcp`, `zsocket`, `zf_rm`, etc.) \u2014 blocked\n- **`fc -e`** command detection \u2014 prevents arbitrary command execution via editor\n- **Backslash-escaped operators** \u2014 detects `\\;`, `\\|`, `\\&`, `\\<`, `\\>` outside quotes that can hide command structure\n- **Comment quote desync** \u2014 detects quote characters inside `#` comments that can confuse quote tracking\n- **Tilde expansion variants** (`~user`, `~+`, `~-`) \u2014 require manual approval\n- **Compound `cd` + `git`** commands \u2014 flagged to prevent bare repository attacks\n\n**Evidence**\n\nSecurity check functions (search for `\"Zsh process substitution\"`, `\"backslash-escaped operators\"`, `\"comment quote desync\"`, `\"fc -e\"`)"}