Hey @Leland_Hepworth,
For now, in Settings → Agents → Approvals & Execution, avoid allowlisting bare block-taking cmdlets (ForEach-Object, Where-Object, Sort-Object, Select-Object, and similar) if those entries would wrap other work. Your beforeShellExecution hook that forces ask when braces appear is a solid extra check (with the race caveat you linked). Related sibling on the same matcher family: variable-assignment allowlist entry. More on the controls: Run Modes.
We’ve let the team know. I’ll post here if there’s something useful to share.