[BUG] Windows: the PowerShell command-safety parser's encoded launch trips antivirus heuristics (6 alerts per affected command)

What's wrong

Before a PowerShell tool call runs, Claude Code parses the command in a separate process:

"C:\Program Files\PowerShell\7\pwsh.exe" -NoProfile -NonInteractive -NoLogo -EncodedCommand <base64>

The base64 holds the fixed parser script with the command embedded. On this machine Bitdefender's
AMSI heuristic CMD:Heur.BZC.ZFV.Boxter.957.<8 hex> blocks that parser launch for some commands,
and each block raises a "Suspicious activity blocked" pop-up. A failed parse is retried, and every
affected command produced exactly 6 blocked launches, so 6 pop-ups per command.

The command itself still runs: execution goes through cmd.exe /d /s /c and pwsh -Command, whose
command line does not carry the command (261 characters on every call measured), and that launch
has never drawn this detection. In the four cases matched to the session transcript, the tool call
returned without error, taking 7 to 34 seconds where calls of that size usually take 2 to 5.

Only commands of roughly 750 to 1030 characters are affected. For those, the encoded parser
command line is 31,400 to 32,300 characters, close to the 32,767 limit, and longer commands skip
the parser ("Command too long for parsing"). No shorter command has been flagged. Length alone
does not decide it: by mid-afternoon on 2026-09-29, 4 of about 140 PowerShell calls in that range
were blocked.

Over 10 days: 17 affected commands, 95 alerts.

This is the same launch reported in #62348 (closed as stale, locked).

What should happen

Hand the command to the parser the way execution already does, over stdin or through a temporary
file, rather than as a ~32,000-character encoded command line. A very long encoded PowerShell
command line is a classic malware trait, so antivirus and EDR heuristics will keep flagging it.
If that is not possible soon, a documented setting to choose the parser's launch method would
help.

Environment

• Claude Code 2.1.284, VS Code extension
• Windows 11 Pro 10.0.26200, PowerShell 7 (C:\Program Files\PowerShell\7\pwsh.exe)
• Bitdefender consumer product, detection class "Antimalware Scan Interface"