DEV Community: TerminalBlog

Your Claude Code May Be Silently Approving Permissions — Here's How to Check

TerminalBlog — Sat, 11 Jul 2026 18:51:01 +0000

Come back from a coffee break, click on your Claude Code window to resume working, and — without touching the keyboard — you've just approved (or rejected) a permission prompt you never read.

That's not a hypothetical. That's issue #76743, filed against Claude Code on Windows 11, and the implications for safety are immediate.

What's Happening

When Claude Code is running with a permission prompt pending and the window does not have focus, the user's first click on the window — intended only to give it focus — lands on the permission dialog and submits an answer. Approve, reject, or even "always allow" — whichever button was under the cursor when you clicked.

The reporter describes this happening repeatedly in a long-running orchestration session. Each time they returned to their machine and clicked into the window, the pending permission question was answered by the focus click itself. The session interpreted the resulting rejections as deliberate user "stop" commands and paused an autonomous overnight run — multiple times.

A related incident in the same session: with UI latency, rapid clicks and keystrokes applied to a different prompt than the one visible when the input was made. The user typed an answer meant for option 1, which landed as option 2 on a permission prompt.

The maintainers labeled it bug, has repro, platform:windows, area:tui, and area:permissions — covering both the rendering layer and the authorization layer.

Are You Affected?

You're affected if you:

Run Claude Code on Windows 11
Use sessions that trigger permission prompts (tool calls requiring approval)
Ever leave a Claude Code session idle and come back to it

To reproduce:

Start a task that triggers a permission prompt (e.g., a Bash tool call needing approval)
While the prompt is pending, click away so the Claude Code window loses focus (Alt+Tab to another app)
Click once anywhere on the Claude Code window to bring it back into focus
Observe: the click is delivered to the permission dialog and an answer is registered

Check your session history for unintended approvals or rejections:

# Look for permission decisions you don't remember making
claude log --recent

If you're running autonomous overnight jobs on Windows, check whether your runs were paused by unexpected "user stop" commands.

The Fix (Until Anthropic Patches It)

There's no official fix yet. The issue was filed on July 11, 2026. Until Anthropic ships a patch, your options are:

Always ensure the window has focus before clicking. Click the title bar or a non-interactive area first, then interact with permission dialogs.
Use keyboard shortcuts for permission dialogs. Press 1/2/3 or Enter instead of clicking — these aren't affected by the click-through bug.
Don't walk away from pending prompts. If you need to leave your machine, allow or dismiss any pending permission dialogs first.
For long-running autonomous sessions, consider running Claude Code in background mode where there's no TUI to click into.

The ideal fix from Anthropic: the first click that gives the window focus should be consumed as focus-only (standard "click-through suppression"), never delivered to a button. Alternatively, permission prompts could require an explicit keypress rather than accepting a possibly-accidental pointer click, or debounce input for a short interval after window activation.

Why It Happened

This is a classic click-through bug. Windows delivers the click to whatever UI element is under the cursor at the moment of the click — and the permission dialog is rendered as an overlay on Claude Code's TUI. When the window doesn't have focus, the pending dialog is still rendered there, waiting for input. The click that gives the window focus passes through to whatever element is at that coordinate.

Standard Windows UI guidelines recommend consuming the first click after focus activation (WM_ACTIVATE) without passing it to child controls. Claude Code's TUI layer, running in a terminal/ConPTY context, doesn't have access to that native window message handling — it simulates a GUI inside a terminal, so it needs to implement click-through suppression manually.

The reporter notes that accidental grants via focus clicks are the more concerning direction for safety. An "always allow" or "approve" that you didn't intend could let an agent execute operations you'd normally want to review.

FAQ

Q: Does this affect Claude Code on macOS or Linux?

A: The issue is filed for Windows 11 specifically. The click-through mechanism is related to how Windows delivers mouse events to terminal applications. macOS and Linux have different window management behavior and are not known to be affected.

Q: Can this accidentally approve dangerous operations?

A: Yes — that's the safety concern. If a permission prompt for a file-write or network operation is pending, clicking to focus the window could inadvertently approve it. The reporter explicitly flagged accidental grants as "the more concerning direction for safety."

Q: What if I already had unintended approvals?

A: Review your Claude Code session logs for unexpected permission decisions. Check whether your agent ran commands you didn't explicitly authorize. If you're concerned about a specific session, the claude log command can help you trace what happened.

Claude Code Is Crashing Your Frame Rate on Windows 11 — The Fix

TerminalBlog — Sat, 11 Jul 2026 18:51:00 +0000

You know the feeling — you submit a prompt, the spinner starts, and instead of smooth animation you get a choppy, stuttering mess. You check your CPU. It's idle. You check RAM. Half empty. You toggle every terminal setting you can find. Nothing helps.

If you're on Windows 11 and Claude Code feels like it's running through molasses, you're not alone. A detailed issue report (#76745) with instrumented bisection data confirms the TUI render loop has degraded ~2× between versions 2.1.159 and 2.1.207. The median frame cadence dropped from a smooth 62 ms (~16 fps) to 99–109 ms (~9–10 fps) — and that's just the spinner. During token streaming it's worse.

The Regression in Numbers

The reporter, running Windows 11 Pro on a Ryzen 7 7800X3D with an RTX 4080 SUPER, built a ConPTY harness to timestamp every output chunk. The data shows three distinct degradation stages:

Version	Median frame time	p95	Stalls >100ms (per 3.5s)
2.1.159	62 ms (16 fps)	140 ms	7
2.1.160	62 ms	299–376 ms	8–9 (2–3 >250ms)
2.1.183	63 ms	127–266 ms	8–10
2.1.207	99–109 ms (~9–10 fps)	218–235 ms	16–17

The streaming phase is worse: median inter-token gap went from 62 ms to 108 ms by version 2.1.183. By 2.1.207, everything is degraded — including the idle spinner that should have zero frame-scheduling overhead.

The reporter ruled out every environmental variable: RivaTuner, MSI Afterburner, G-Sync, background load — none affected the numbers. They also confirmed the ~108 ms tick is terminal-independent (Windows Terminal, no WT_SESSION, no terminal choice makes a difference).

Are You Affected?

If you use Claude Code on Windows 11, check your version:

claude --version

Then run this quick perceptual test:

Open Claude Code and submit any prompt
Watch the spinner animation during the 0.5–4s window before the first token arrives
Does it hitch or stutter visibly?

For a quantitative check, run the same prompt side by side:

claude install 2.1.159
# Run a prompt, observe smoothness
claude install 2.1.207
# Run the same prompt, compare

The difference is most obvious on high-refresh monitors (120 Hz+). The 60 Hz laptop panel might not show it as clearly, but the numbers degrade identically.

The Fix (For Now)

The only verified workaround is pinning to the last-known-good version:

claude install 2.1.159

This restores the 62 ms (16 fps) tick across both the spinner and streaming phases. You lose newer features like background subagents and workflows — but the rendering is smooth again.

If you want to stay on the latest, the reporter suggests Anthropic should expose a render-FPS knob:

CLAUDE_CODE_MAX_FPS=16

That doesn't exist yet, but leaving a +1 on issue #76745 helps prioritize it.

Why It Happened

The regression is staged across three releases, suggesting cumulative code changes rather than one bad commit:

2.1.160: Long frame hitches appear (p95 explodes to 300–376 ms). Changelog dominated by background-daemon and agent-view infrastructure.
2.1.183: Streaming-phase tick rate halves (62 → ~108 ms median). Likely from CPU-optimization work that reduced per-frame rendering work.
2.1.207: Even the idle spinner degrades to ~100 ms.

The reporter notes typing echo (event-driven, not frame-scheduled) is a perfect 30 ms on all versions — so raw output throughput is fine. The regression is specifically in frame scheduling. Synchronized-output markers (ESC[?2026h/l) were already emitted 1 pair/frame in 2.1.159, so marker emission isn't the variable.

Changelog entries like "Reduced CPU usage ~37% during streaming" (2.1.191) and "Reduced per-frame rendering work" (2.1.196) suggest the ~10 fps tick may be a deliberate CPU/battery trade-off — but it's invisible on 60 Hz panels while very visible on high-refresh desktop monitors.

The related issue #67406 was auto-closed as "Completed" while the stutter was still reproducible, leaving users without a resolution path.

FAQ

Q: Does this affect Claude Code on macOS or Linux?

A: No — this is Windows-specific. The regression was reproduced on Windows 11 Pro (build 26200) with Windows Terminal. The ConPTY path is Windows-only.

Q: Will pinning to 2.1.159 break my workflow?

A: You lose features added after 2.1.159 — background subagents, workflow improvements, and the "Fixed terminal freezing during streaming of very long lists" from 2.1.207. It's a trade-off between smooth rendering and newer features.

Q: Is this caused by my antivirus or GPU drivers?

A: The reporter ruled out RivaTuner, MSI Afterburner, G-Sync settings, and background CPU/RAM load. The claude process tree uses <1% of one core on all versions. The regression is internal to Claude Code's render loop.

Hermes Just Shipped Gateway Runtime Context Budget Fixes — @ References Now Scope Correctly

TerminalBlog — Sat, 11 Jul 2026 18:42:27 +0000

Hermes Agent pushed 10 commits in 3 hours — all targeted at gateway context budget enforcement, @ reference scoping correctness, and compaction reliability. This is a cleanup cycle, but the fixes close real gaps.

What Changed

Gateway context budgets honored (#62788, #62789). The gateway was not applying runtime context budgets to queued references — @ context references like @profile or @workspace could bypass the effective budget limit. Two scoping fixes ensure queued and runtime-profile references respect the configured budget. Also fixed: the @ context reference expansion code never ran due to an AttributeError masked during startup.

Compaction anti-thrash cleared (#62790). Stale anti-thrash verdicts were accumulating in the compaction subsystem, causing unnecessary backoff on legitimate compaction requests. The fix clears verdicts once the triggering condition resolves.

Codex manual compaction hardened (#62791 area). Three commits handle edge cases in Codex manual compaction path: rejecting compaction when an interrupt is in flight, consuming usage gaps from previous compaction cycles, and correctly evaluating native compaction usage before deciding whether to compact. New tests cover the no-usage compaction response path.

Why It Matters

Budget enforcement and @ reference scoping are correctness-critical for any session that stitches context from multiple profiles or workspaces. If you have ever seen Hermes silently ignore a @profile reference or hit mysterious compaction backoff, these fixes directly address those symptoms. The Codex compaction hardening prevents data loss scenarios where an interrupted compaction leaves usage gaps.

The Takeaway

Hermes is tidying up its context management layer — budget enforcement, reference expansion, and compaction all get tighter. If you rely on @ context references or run long Codex sessions, this batch is worth pulling immediately. Check our full Hermes tool overview for capabilities.

OpenClaw Just Shipped Fleet Cell Supervisor — Multi-Tenant Hosting Arrives

TerminalBlog — Sat, 11 Jul 2026 18:42:24 +0000

10 commits landed across OpenClaw in 3 hours. The headliner is multi-tenant hosting via fleet cell supervisor — but the patch batch also tightens browser profile security and smooths macOS onboarding.

What Changed

Fleet cell supervisor (#104527). OpenClaw now supports multi-tenant hosting through a fleet cell supervisor architecture. Each tenant gets isolated cell boundaries, letting operators run multiple agent workloads on shared infrastructure without cross-tenant leakage. This is a foundational infra layer for any team running OpenClaw at scale.

Browser profile fixes (#104616, #104601). Two fixes landed for the browser integration layer: host-local profile administration was incorrectly blocked, and stale profile resurrection could orphan state across sessions. Both are patched.

Feishu streaming timeout (#102948). The Feishu channel integration now enforces a 30-second request timeout on streaming-card API calls. Prevents hung cards from blocking downstream message delivery.

macOS cookie-import improvement (#104591). The old browser cookie-import modal is replaced with an inline dashboard banner — fewer clicks, less UI friction for Mac users configuring agent access.

Why It Matters

Multi-tenant hosting is the kind of infrastructure play that signals OpenClaw is targeting enterprise deployments. If you are running multiple teams or clients on one OpenClaw instance, the cell supervisor eliminates the need for separate deployments. The browser fixes close real security gaps, and the Feishu timeout is a quality-of-life patch for teams using Chinese workplace tooling.

The Takeaway

OpenClaw is investing in isolation primitives and platform maturity. If you evaluated it for multi-team use and hit deployment friction before, this batch addresses several of those blockers. See how it compares in our OpenClaw vs pi-dot-dev comparison.

Claude Code Has Been Embedding Steganographic Markers in Your Prompts — Here’s the Full Story

TerminalBlog — Sat, 11 Jul 2026 17:29:50 +0000

What was discovered

On June 30, a developer reverse-engineered the Claude Code binary and found something unsettling. Inside the minified JavaScript bundle, a function silently modifies the system prompt sent to the model with every request. The line "Today's date is 2026-06-30." gets altered in two invisible ways depending on your environment.

First, the apostrophe in Today's changes to one of four Unicode variants ("'", "'", "ʻ", "ʹ") based on whether your API base URL matches a list of known domains or contains specific AI lab keywords. Second, the date separator switches from dashes to slashes ("2026/06/30") if your timezone is "Asia/Shanghai" or "Asia/Urumqi". The domain list — XOR-encoded with the key "91" — contains hundreds of entries spanning Chinese corporate domains (baidu.com, alibaba-inc.com, bytedance.net), AI companies (moonshot.ai, deepseek, zhipu, baichuan), and proxy/gateway services (claude-code-hub.app, zenmux.ai, openclaude.me).

The article's author, kirushik (writing at thereallo.dev), concluded: "This is not a malicious feature, but it is a weird choice for a developer tool that asks for trust." The response on Hacker News was immediate and massive — 2,444 points and 748 comments.

The community split

The HN thread fractured along three clear lines. The trust faction saw this as a fundamental betrayal. One commenter wrote: "A service provider being less than transparent about exactly what their shipped tooling does on customers' machines… That honest disclosure would render the solution to their problem useless isn't my problem." Another went further: "If Anthropic is willing to risk ruining the trust of their userbase for the sake of protecting their moat, it makes me wonder how strong of a moat they have to begin with."

The pragmatic faction pushed back hard. "This is the very human Anthropic engineers trying to detect Chinese scraping via some frankly hamfisted URL trickery," one argued. Another made the security trade-off explicit: "There would be no point in implementing these 'security features' if they were upfront about how they work. Keeping the detection method private is part of the security model."

The technical faction had the most damning critique — the implementation is trivial to bypass. Multiple commenters pointed out that XOR with a single-byte key is "amateur hour." One observed: "All Anthropic has done is reduce trust with legitimate customers while doing nothing to stop illegitimate customers. The resellers just need a domain name that doesn't have the word DEEPSEEK in it." Another commented that "every serious adversary can make this signal useless" by changing hostnames, timezones, or simply patching the binary.

A smaller but vocal group raised the geopolitical angle. "Their list of detected labs doesn't include labs from the US," one commenter noted. "I'm pretty sure every lab, including Anthropic, is doing distillation right now." Another framed it as: "Anthropic pushes fear and control. But the only way to win is by innovating."

What the community missed

Both sides have valid points, but the discussion glossed over the deeper issue — the agency problem in AI developer tools. The debate shouldn't be "is this malicious or not?" but rather "can I reason about what my tool is doing?"

A tool with filesystem, shell, git, and network access on your machine must be predictable. Steganography — even for a defensible goal like catching API resellers — makes the tool opaque. You lose the ability to reason about what data leaves your machine and how it's framed. The question isn't whether this specific feature hurts users; it's that any hidden behavior in an agent with broad system access erodes the foundation of trust that makes these tools usable at all.

That said, the article's framing overstates the privacy angle. For users hitting the official Anthropic API directly, the feature never triggers — it requires ANTHROPIC_BASE_URL to be set to a non-Anthropic endpoint. The timezone and hostname checks are runtime signals, not persistent tracking. This is closer to "license key verification" than "spyware," despite the provocative headline.

The most insightful counterpoint came from the commenter who wrote: "Anthropic must think that their moat isn't very large if they're this worried about distillation." If a frontier lab with billions in funding resorts to single-byte-XOR steganography to identify competitors, the subtext is clear — they don't trust their model advantage to hold.

The takeaway

Check what your coding agent is actually shipping. The JavaScript bundling pattern means Claude Code, Cursor, and other agent tools are effectively web apps with native system access — minified bundles are not auditable by default. Run a diff between versions, monitor outbound traffic through a local proxy, and understand what environment signals your agent transmits upstream.

The safest path today is choosing open-source agents where you can verify the code, or running closed-source tools inside sandboxed environments that strip environmental fingerprints before they reach the network. Trust isn't earned through clever engineering — it's earned through the boring, transparent parts that nobody notices. Every hidden signal, no matter how well-intentioned, makes the next one easier to hide.

Originally published on terminalblog.com | Discuss on Hacker News

27 Firms Just Backed the World's First Internet Court for AI Agents

TerminalBlog — Sat, 11 Jul 2026 17:20:51 +0000

GenLayer launched an Internet Court specifically designed for AI agents, backed by 27 firms. The pitch: when autonomous agents transact, negotiate, or execute contracts, they need a dispute-resolution layer that isn't "ask a human to read the logs."

The court is an on-chain mechanism where agent-to-agent disputes get adjudicated automatically — no lawyers, no tickets, no escalation to a human slacking another human. It's a sign that the ecosystem is moving past the "can my agent write code" phase and into the "how do multiple agents settle disagreements about who owes what" phase. Twenty-seven firms putting capital behind that question means the market sees agent-agent interaction as an infrastructure problem worth solving now.

For the coding agent community, this is the governance layer nobody talks about yet but everyone will need. If your coding agent submits a PR, and another agent reviews it, and they disagree on whether a change breaks a contract — who decides? GenLayer is building the answer. The 27 backers signal that the question isn't academic anymore.

One line: Agents need courts, and 27 firms just bet on GenLayer to build them.

Cursor Is Building an Office Agent That Does More Than Code — and Anthropic Is in Its Sights

TerminalBlog — Sat, 11 Jul 2026 17:15:28 +0000

Cursor is building Sand, an office agent that reaches beyond the editor into the full workflow — email, docs, tickets, the stuff that lives around code, not just the code itself. The target? Anthropic's growing agent footprint.

The shift from "coding agent" to "office agent" is the logical next step. Once your tool can write a function, the next ask is always "write the PR description, update the ticket, draft the email." Sand appears designed to own that entire loop. For developers who already trust Cursor for the code part, the extension into surrounding workflow is frictionless — same tool, same context, wider scope.

For the coding agent community, this is the exact expansion we've been tracking in the open-source world. oh-my-pi's model hub and OpenClaw's session fleet are both bets that the agent becomes the workspace, not just the editor. Sand from Cursor is the closed-source version of the same insight. The coding-agent wars are now about who owns the full developer operating system, not just the diff generation.

One line: Cursor's Sand wants to own the whole developer workflow — and Anthropic is standing in the way.

GPT-5.6 Sol Ultra Just Used 64 Subagents to Crack a 50-Year-Old Math Problem

TerminalBlog — Sat, 11 Jul 2026 17:15:12 +0000

OpenAI's GPT-5.6 Sol Ultra orchestrated 64 subagents to prove a math conjecture that stood unresolved for 50 years. The subagents didn't just split the work — they coordinated, each tackling a fragment of the proof, then converged on a result no single model pass had reached.

This is the headline that matters for anyone running coding agents: multi-agent orchestration at scale works. Fifty years is a long time for a problem to sit unsolved, and a model with 64 subagents cracked it. It validates the architectural bet that composing smaller, specialized agents can outperform a single monolithic attempt — the same bet that tools like OpenClaw's session fleet and oh-my-pi's model hub are making in the open-source agent ecosystem.

For the coding agent community, the 64-subagent pattern is the important signal. The takeaway isn't that GPT-5.6 can do math — it's that routing work across many specialized subroutines is the path to solving problems that defeat a single pass. That architecture is already shipping in coding agents that decompose tasks across multiple model calls.

One line: 64 subagents, five-decade-old problem, solved — orchestration at scale works, and it's the same pattern reshaping coding agents today.

Unsloth's New Qwen3.6 Quantizations Run 2.5x Faster on Your Existing GPU

TerminalBlog — Sat, 11 Jul 2026 17:09:44 +0000

Unsloth just pushed Qwen3.6 quantizations that hit 2.5x faster GPU speed. In practice that means the same model, same hardware, nearly triple the throughput — or the same throughput on a much cheaper card.

The numbers come from Unsloth's quantization layer, which has been aggressively optimized for the Qwen3.6 architecture. A 2.5x speed-up on GPU is the kind of gain you normally need a hardware refresh to get. Instead, it's a drop-in replacement on the inference stack you already have. For teams running local or self-hosted coding agents, that's the difference between a model being too slow for interactive use and feeling snappy.

For the coding agent community, this is the real unlock: quantization is no longer a quality-compromise play. At 2.5x faster, you gain options — run a bigger quantized model than you could fit at full precision, or serve more concurrent agent sessions from the same card. Unsloth keeps making the "run it yourself" argument stronger with every release.

One line: 2.5x faster on the GPU you already own — Unsloth's Qwen3.6 quantizations make the "run local" argument louder than ever.

Meta Just Slashed AI API Pricing to a Quarter of What Everyone Else Charges

TerminalBlog — Sat, 11 Jul 2026 17:09:42 +0000

The floor just dropped. Meta launched Muse Spark 1.1 through an API priced at roughly a quarter of what competitors charge. For developers running coding agents where every token gets billed, that's not a minor discount — it's a new default option for the high-volume, low-judgment calls that make up most of a session.

The headline number is clear: 25% of the field's going rate. That makes Muse Spark 1.1 the cheapest credible fallback in any orchestrator's routing table right now. Whether it holds quality on complex tasks is the open question — but for the boring 80% of lookups, linting, and simple generation, the pricing alone earns it a slot.

For the coding agent community, this changes the math on multi-model routing. If you were already composing models — letting a router pick the cheapest adequate model per subtask — Muse Spark 1.1 slots in as the cost-conscious backbone. The vendors that win the pricing race early don't need to win every benchmark; they just need to be cheap enough that the router picks them first.

One line: Muse Spark 1.1 doesn't need to be the best — at a quarter of the price, it just needs to be good enough to own the cheap slot in every router.

Your Claude Code May Ask 700+ Permission Prompts Per Session — Here's How to Check

TerminalBlog — Sat, 11 Jul 2026 16:56:32 +0000

Your Claude Code May Ask 700+ Permission Prompts Per Session — Here's How to Check

If you use Claude Code for multi-session orchestration — running parallel workflows, fan-out subagents, or status checks across worktrees — you may have noticed something maddening: hundreds of permission prompts. For commands that only read files.

A freshly filed issue (#76718) documents a compound-command permission bug that makes multi-session workflows nearly unusable. The reporter approved over 700 prompts across two days of running parallel-session workflows. Every single prompt was for a non-mutating chain like cd X && git status -sb && echo --- && git log --oneline -5 && echo --- && gh pr list.

The bug is that its permission engine evaluates compound commands as single units, not by their individual segments. Even when every segment (cd, git status, echo, gh pr list) has a matching allow rule, the compound chain still prompts. The system caps at roughly 5 saved rules per compound command, so a 6-segment chain of individually-allowlisted reads still hits the user with a dialog.

The report is labeled bug, has repro, platform:windows, area:bash, and area:permissions — the full stack of flags that says Anthropic can reproduce it and knows where the fix lives.

Are you affected?

You're affected if you use compound commands (chained with &&, ||, ;, |, or &) in Claude Code sessions, especially in multi-session or fan-out workflows. The bug is confirmed on Windows (Max plan) but the permission architecture is cross-platform.

# Quick repro: run an individually-allowlisted compound chain
claude -p "cd /tmp && ls && echo ok"

# If prompted despite Bash(cd:*), Bash(ls:*), Bash(echo:*) being allowlisted,
# you are hitting the compound-command ceiling

Look for the warning signs: mid-run prompts that interrupt a parallel fan-out, or an "allowlist" file that's grown past 700+ entries from clicking "Allow" hundreds of times.

The fix

There's no official fix yet, but the reporter shares a working workaround — a custom PreToolUse hook that parses compound commands, splits on shell operators, and auto-allows provably non-destructive chains:

# PreToolUse hook logic (Python pseudocode)
def on_pre_tool_use(tool_use):
    if tool_use.name == "Bash":
        segments = split_compound(tool_use.input)
        if all(is_read_only(s) for s in segments):
            return {"permission_decision": "allow"}
    return None  # fall through to normal prompt

The reporter's hook allows only chains where every segment is provably non-destructive — cd, ls, git status/log/diff, gh pr list, echo — while falling through to normal prompting for anything with rm, reset, --force, branch -D, write redirects, or credential-store paths.

Requested fixes from the report (any would resolve this):

Auto-approve compound commands when every decomposed segment matches an allow rule — remove the ~5-rule ceiling
Don't score cd into a workspace subdirectory as a gating path-read
Ship a built-in "safe read-only command" auto-allow that survives chaining

Why it happened

Claude Code's permission system splits compound commands on &&, ||, ;, |, and &, then evaluates each segment against the allowlist. But evaluation caps at roughly 5 saved rules per compound command, so a 6-segment chain always prompts. Worse, cd into a workspace subdirectory is scored as a path-read operation, not as Bash(cd:*), so it doesn't match the common allow rule users expect. The net effect: no amount of allowlist tuning fixes it for longer chains.

Beyond the annoyance, this is a security concern. Flooding users with hundreds of benign prompts trains a rubber-stamp reflex — users start clicking "Allow" without reading. That degrades the security value of prompts that should stop you — an rm -rf, a force-push, a destructive script. The system teaches users to ignore it.

FAQ

Q: Can I just enable "Allow all" to skip the prompts?
A: You can, but it bypasses all permission gating — including mutations you'd want to catch. The PreToolUse hook is safer because it auto-allows only non-destructive commands while still prompting on actual changes.

Q: Does this affect single-session Claude Code use?
A: Less noticeable, but yes. Any compound command longer than ~5 segments triggers a prompt even if every segment is individually allowlisted. Single-command users hit it less often because chains tend to be shorter.

Q: Will the fix remove the ~5-rule ceiling?
A: That's one of three requested fixes. If Anthropic removes the ceiling, compound commands where every segment is already allowlisted would pass through silently — preserving security for mutations while eliminating the false prompts.

Oh My Pi Is Crashing macOS With Native Grep — The Fix

TerminalBlog — Sat, 11 Jul 2026 16:56:22 +0000

Oh My Pi Is Crashing macOS With Native Grep — The Fix

Oh My Pi is one of the most capable coding agents for the terminal. But if you're on macOS and running native grep, there's a crash waiting to happen — and it can take your entire session with it.

A newly filed issue (#5205) with prio:p1 reveals that Oh My Pi's native pi_natives grep implementation uses memory-mapped file I/O for files above a threshold. When another process rewrites or truncates the same file while grep is searching it — during a build, a log rotation, or a concurrent write — the mapped page can point past the file's new end. macOS responds with SIGKILL (Code Signature Invalid), and the entire Oh My Pi process dies.

The macOS crash report reads: Exception Type: EXC_CRASH (SIGKILL), Termination Reason: Namespace CODESIGNING, Code 2 Invalid Page, with the faulting thread inside the Bun Pool at the first byte of a 4 MiB file-backed mapping. The reporter confirmed it with a stress test: a 5 MiB rewrite/search loop crashed on run 4 with Bus error / exit 133.

Are you affected?

You're affected if you run Oh My Pi 16.4.4 or earlier on macOS and use native grep on files larger than 4 MiB that could be written to concurrently — log files, build artifacts, temp files, anything another process modifies.

# Check your version
omp --version

# Quick stress test (WARNING: will crash your session)
dd if=/dev/urandom of=/tmp/stressfile bs=1048576 count=5
omp exec -- grep -r "test" /tmp/stressfile &
# In another terminal: head -c 5M /dev/urandom > /tmp/stressfile

The fix

A fix is already submitted in PR #5210 — fix(native): read grep files into stable snapshots. The patch replaces both mmap paths with bounded owned reads:

At most 4 MiB + 1 byte for file classification
At most 4 MiB for the oversized searchable prefix
Removes the now-unused memmap2 dependency
Adds a stable-snapshot regression test

Verification on the fixed build: 20/20 clean exits on the concurrent rewrite/search stress test, all 164 native tests passing. Once merged, omp update gets you the fix.

In the meantime, avoid concurrent writes to files you're searching with native grep, or use the system grep (/usr/bin/grep) as a workaround.

Why it happened

The native grep tool memory-maps regular files above a small-file threshold for performance. The mmap call gives you a live window into the file on disk, not a stable copy. When the underlying file shrinks or gets rewritten, the mapped region can reference pages past the current file boundary. On macOS the kernel flags this as a code-signing violation (invalid page reference). On Linux and other POSIX systems the same pattern triggers SIGBUS.

The root assumption — that a file won't change during a fast grep — doesn't hold in an active development environment where builds, watchers, and other agents touch the same files.

FAQ

Q: Does this affect Linux too?
A: Yes. The same mmap pattern can raise SIGBUS on Linux when a mapped page is accessed beyond the current end of the backing file, though macOS reports it as a code-signing failure instead.

Q: Is my session recoverable after the crash?
A: No. The crash terminates the entire oh-my-pi process with SIGKILL. There's no recovery path — you lose any unsaved state and must restart the agent.

Q: Will the bounded-read fix hurt performance?
A: Negligible impact for typical grep workloads. The 4 MiB cap covers the vast majority of search operations. The trade-off — stable snapshots instead of live mmap windows — eliminates an entire class of crash bugs at essentially zero cost for most users.