[BUG] Bug: Pasted `!` prefix not recognized as bash command — causes credential exposure risk

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

## Summary

When Claude instructs a user to run a shell command using the ! prefix, and the user copies and pastes the
command (including the leading !), the UI does NOT recognize the pasted ! as a bash trigger. It submits as a plain chat message instead.

## Steps to Reproduce

1. Claude suggests: ! export ANTHROPIC_API_KEY=sk-ant-...
2. User copies the full command including ! and pastes into the Claude Code prompt
3. Presses Enter
4. Expected: executes as shell command (pink !, runs in terminal)
5. Actual: submitted as a chat message — ! not recognized when pasted

## Workaround

User must: paste → manually delete ! → retype ! by hand. Only a typed ! triggers bash mode (turns
pink). A pasted ! does not.

## Security Impact

If the command contains a credential (e.g., an API key), the user believes it's executing as shell. Instead
the key lands in the chat transcript, exposing it in conversation history and terminal display. This caused an unintentional API key exposure during normal usage.

## Environment

• Windows 10 Pro (10.0.19045)
• Claude Code desktop/CLI

What Should Happen?

## Suggested Fix

Detect ! prefix based on the input string value, not a keypress event. Paste and type should behave
identically. At minimum, warn the user when a message starting with ! is submitted as chat (not shell) so
they can catch it before the credential is exposed.

Error Messages/Logs

Depends on the bash command

Steps to Reproduce

1. Claude suggests: ! export ANTHROPIC_API_KEY=sk-ant-...
2. User copies the full command including ! and pastes into the Claude Code prompt
3. Presses Enter
4. Expected: executes as shell command (pink !, runs in terminal)
5. Actual: submitted as a chat message — ! not recognized when pasted

Claude Model

Sonnet (default)

Is this a regression?

No, this never worked

Last Working Version

_No response_

Claude Code Version

Claude Code v2.1.83

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

Windows Terminal

Additional Information

_No response_