- Background job operator (
&) detection: PowerShell commands using the&operator now trigger a security prompt with the message "Command uses the background job operator (&) which spawns a child PowerShell process" (search for"background job operator"). Remove-Item -Recursesafety: Deleting the working directory (including.gitand.claude) viaRemove-Item -Recursenow requires manual approval (search for"Remove-Item -Recurse targeting").- Action parameter validation: PowerShell common parameters like
-ErrorAction,-WarningAction(and their aliases-ea,-wa, etc.) are now validated to ensure they use expected values (SilentlyContinue,Stop,Continue,Ignore), preventing abuse of these parameters.
Evidence
PowerShell AST parser (search for "hasBackgroundJob" and "background job operator")
Strings lifted out of the shipped bundle, so the claim above can be checked against them.