Claude Code shell classifier routing: v2.1.193 turns every command into policy

Claude Code shell classifier routing became the headline operator issue in v2.1.193. The release adds autoMode.classifyAllShell, a setting that can send every Bash and PowerShell command through the auto-mode classifier instead of only arbitrary-code-execution patterns. It also exposes denial reasons in transcripts and permission history, while adding a claude_code.assistant_response OpenTelemetry event that may include model response text depending on logging variables. For teams running coding agents through an AI gateway, Claude Code shell classifier routing is now both a command-safety lane and a telemetry-governance decision.

What happened in Claude Code shell classifier routing

Anthropic's official Claude Code v2.1.193 release is a compact but important control-plane update. The key changes for operators are:

• autoMode.classifyAllShell can route all Bash and PowerShell commands through the auto-mode classifier, not just commands that already match arbitrary-code-execution patterns.
• Auto-mode denial reasons now appear in the transcript, denial toast, and /permissions recent denials.
• claude_code.assistant_response is a new OpenTelemetry log event containing the model's response text. It is redacted unless OTEL_LOG_ASSISTANT_RESPONSES=1; if unset, it follows OTEL_LOG_USER_PROMPTS, so deployments that already log prompt content may start receiving response content after upgrade unless they set OTEL_LOG_ASSISTANT_RESPONSES=0.
• Bash mode gains live file path autocomplete, which is useful but also expands the local-context surface operators should review.
• MCP servers that need authentication now trigger a startup notice pointing users to /mcp.
• Idle background shell commands can be reaped automatically under memory pressure, unless CLAUDE_CODE_DISABLE_BG_SHELL_PRESSURE_REAP=1 is set.
• Background-agent behavior was tightened so carried-over tasks are not spuriously abandoned, pinned agents are not repeatedly re-prompted after auto-update, and the main turn no longer spawns a phantom resumed subagent.

The release is therefore not just a UX update. It moves shell command classification, denial evidence, observability content, MCP auth visibility, and background-agent lifecycle closer to the same operator policy surface.

Why Claude Code shell classifier routing matters

The old routing question was often, "Which model should handle this coding task?" The better question is now, "Which execution lane should this command, transcript, and background process use?" Claude Code shell classifier routing makes that shift visible. A harmless-looking shell command can still reveal secrets, mutate a workspace, or create deployment drift. Routing every Bash and PowerShell command through the classifier gives enterprises a stricter default, but it also increases the importance of review latency, denial quality, and false-positive handling.

The OpenTelemetry change is just as important. Observability helps teams debug agent behavior, but response text can contain generated secrets, customer data, repository context, or copied prompt material. If a deployment already enables prompt logging, v2.1.193 can make response logging follow that setting unless the team explicitly disables it. That is a routing policy problem: sensitive projects may need a no-response-log lane, while internal sandbox projects may allow richer traces for debugging.

For TheRouter users, the broader pattern fits the TheRouter docs approach: agent workloads should carry policy metadata for command risk, credential exposure, telemetry scope, and session lifecycle. Claude Code shell classifier routing is not a single toggle; it is the point where execution safety and observability privacy meet.

The Claude Code shell classifier routing policy

Start by splitting coding-agent sessions into three lanes.

1. Strict command lane: enable autoMode.classifyAllShell for repositories with production credentials, deployment scripts, regulated data, or destructive infrastructure commands. Treat denial reasons as audit evidence, not just UI feedback.
2. Standard developer lane: keep normal command classification but require sampling and review for denied commands, repeated approval prompts, and high-risk directories.
3. Sandbox experimentation lane: allow broader command execution only in disposable workspaces with short-lived credentials, limited egress, and no response logging by default.

Then bind telemetry to those lanes. Do not let OTEL_LOG_ASSISTANT_RESPONSES inherit behavior accidentally. Set it explicitly in every managed environment. For most production coding-agent fleets, OTEL_LOG_ASSISTANT_RESPONSES=0 is the safer default; teams can still keep metrics, spans, and redacted denial events without retaining full model responses.

Finally, route background agents as long-lived processes. Automatic memory-pressure reaping is useful, but operators still need session IDs, owner IDs, workspace paths, active commands, and last-output timestamps. A background agent that survives update boundaries should be visible to the same policy engine that reviews shell commands.

What TheRouter users should watch or try

Treat the v2.1.193 upgrade as a policy migration, not a routine CLI bump. Before enabling Claude Code shell classifier routing everywhere, run a staged test on a representative repository with scripts, package managers, MCP tools, and background agents.

Use this checklist:

• Decide which workspaces require autoMode.classifyAllShell and document the exception path.
• Confirm denial reasons are captured in transcripts and exported in a form security reviewers can search.
• Set OTEL_LOG_ASSISTANT_RESPONSES explicitly; do not rely on inherited prompt-logging behavior.
• Test Bash and PowerShell commands that read files, mutate git state, install packages, and call deployment tools.
• Verify MCP auth startup notices produce a recoverable path rather than silent tool disappearance.
• Watch background shell reaping during memory pressure and confirm no active deployment or migration task is killed without operator evidence.
• Compare with the prior Claude Code MCP reliability routing analysis, because v2.1.193 builds on the same control-plane theme.

The practical takeaway: Claude Code shell classifier routing turns shell execution into a first-class gateway decision. The winning setup is not the most permissive one; it is the one that can prove every command, denial, response log, MCP auth prompt, and background agent used the right lane before the agent touches production-like code.