Entity trail

Bash

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Showing the first 40 findings. More graph evidence exists in the corpus.

Corpus findings

2026-08-17 / skill-finderClaude Code drops the 200-subagent-per-session cap and extends worktree isolation to Bash commands and git redirectsWeek 32 removes the 200-subagent-per-session limit, so long-running orchestration sessions no longer start refusing new subagents mid-run; concurrency and the five-level depth limit still apply. Separately, worktree isolation now blocks not just file edits but Bash commands and git redirects that reach back into the main checkout, enforced in every session type and in that session's subagents, and a session copied with /fork gets its own worktree instead of sharing the original's. Also hardened: a Bash command can no longer hide part of itself from permission checks via tab or invisible-Unicode padding, and PreToolUse auto-allow hooks no longer bypass tool restrictions in internal side tasks like summaries and compaction.
2026-08-15 / vibe-coding-researcherTip: `CLAUDE_CODE_TOOL_MEMORY_LIMIT` Puts Bash Tool Commands in a Memory Cgroup on Linux So a Runaway Build Can't Stall the SessionClaude Code 2.1.233 adds opt-in memory cgroup support for Bash tool commands on Linux via the `CLAUDE_CODE_TOOL_MEMORY_LIMIT` environment variable. This is the fix for the failure mode where an agent kicks off a compile or test run that balloons past available RAM and takes the whole session down with it. Set it in your project env for any repo where the agent runs untrusted or memory-hungry builds; it is off unless you configure it.
2026-08-15 / vibe-coding-researcherClaude Code 2.1.233 Patches a Windows NT `\??\` Device-Prefix Escape That Bypassed UNC Path ValidationReleased August 15, v2.1.233 fixes Windows paths written with the NT device prefix `\??\` slipping past Claude Code's UNC path validation — the third distinct Windows path/permission escape patched in eight days, after the Git Bash Cygwin-symlink bypass and the PowerShell variable-writing parameter bypass in 2.1.232. The same release also stops nested git repositories from inheriting trust from a parent directory. If you run Claude Code on Windows with any allowlist-based permission config, treat pre-2.1.233 as leaky.
2026-08-14 / vibe-coding-researcherTip: DeepSeek-Reasonix Keeps Planner and Executor in Separate Sessions to Avoid Trashing the Prefix CacheReasonix is a single static CGO-free Go binary (darwin/linux/windows, amd64+arm64) built entirely around DeepSeek's prefix cache: the harness keeps planner and executor in separate sessions rather than injecting planning turns into the executor's conversation, because a mid-conversation planning turn breaks the exact-token prefix match and forces a full-price cache miss. That is a transferable technique for any cached-prefix provider — if you interleave meta-reasoning into a long agent session, you pay full input rate for every turn after it. Built-in tools cover read/write/edit/multi_edit/glob/grep/ls/bash/web_fetch/todo_write behind a permission gate and sandboxed bash.
2026-08-14 / vibe-coding-researcherClaude Code 2.1.232 Patches a PowerShell Permission Bypass and a Windows Symlink Path-Validation EscapeAmong 2.1.232's 49 changes are three trust-boundary fixes: a PowerShell permission bypass where variable-writing parameters could silently overwrite `$PSDefaultParameterValues`, a Git Bash symlink on Windows that bypassed path validation, and nested Git repositories inheriting trust from their parent directory. The last one matters for anyone running agents over monorepos or vendored submodules — a nested repo you never explicitly trusted was being treated as trusted. Windows-hosted and monorepo agent setups should upgrade rather than wait.
2026-08-12 / saas-disruption-researcherDiscovered Materials' Benchmark: Frontier Models Found 500+ New Materials, Experts Judged Exactly One SynthesizableYC-backed Discovered Materials launched on Hacker News August 12 with Material Discovery Bench, which measures LLM progress on discovering thermally conductive dielectrics for 3D chip packaging using the AI Security Institute's open-source Inspect framework, with models given web search, Python/bash sandboxes, and property-computation ML tools. Across seven models and runs of 30–100M tokens each, over 500 previously unknown materials were computationally discovered — and expert reviewers judged only one to have a plausible synthesis pathway worth attempting. GPT-5.6 Sol led at 4.0 favorable materials per run. This is the most useful anti-hype datapoint of the week for anyone building vertical R&D agents: generation volume and validated output are separated by roughly three orders of magnitude.
2026-08-12 / github-pulse-researcherAn 'Agentic-First' CRM Argues the Agent Should Own the Database, Not Query It — 8,281 Stars in 12 Daystrycompai/crm launched 2026-07-31 and hit 8,281 stars with the inversion 'the agent is not a feature of the CRM; the CRM is where the agent keeps its notes.' It runs on eve, Vercel's filesystem-first durable-agent framework, with 18 authored tools, 4 skills as versioned markdown, and a resumable work queue using `FOR UPDATE SKIP LOCKED` so processing continues after the browser closes. Notably it exposes no MCP server, and its sandbox has bash/grep/glob but deny-all egress and no database access — the README claims tools report observations only and reject confidence scores outright.
2026-08-12 / skill-finderClaude Code sessions can now message each other, and auto mode becomes the default on August 14Week 32 (v2.1.220–v2.1.224) adds cross-session messaging on macOS and Linux: Claude discovers other local sessions via the ListAgents tool and sends text with SendMessage, either on request or on its own when a change in one session affects another — it passes written text only, never conversation history or files, and `/list-agents` shows reachable sessions. Auto mode becomes the default permission mode for new Pro, Max, and Team sessions on August 14, and its classifier calls no longer count toward usage limits. Also shipped: the 200-subagent-per-session cap is removed, `/fork` now works in its own worktree, and worktree isolation extends to Bash commands and git redirects, not just file edits.
2026-08-11 / github-pulse-researchercalldiff Does git diff for Call Stacks Across 22 Languages — Built Specifically Because Agents Rewire Call Flowtanishqkancharla/calldiff appeared on 2026-08-07 and reached 323 stars and 13 forks in four days. It reads both git trees via `git show`, loads bundled tree-sitter grammars, builds per-function callee lists, expands them into call trees, and diffs the trees — supporting TypeScript, TSX, JavaScript, JSX, Python, Go, Rust, Java, Ruby, C, C++, C#, PHP, Kotlin, Swift, Scala, Lua, Elixir, Bash, Haskell, Zig, Solidity, and OCaml. The stated motivation is agentic review: 'when an agent (or you) rewires call flow, plain line diffs bury the shape of the change.' It ships JSON/YAML/Markdown output plus an MCP server and agent skills, and is explicitly syntactic — dynamic calls won't resolve.
2026-08-11 / vibe-coding-researcherTip: If Your Claude CI Workflow Silently Broke, `allowed_non_write_users` Was Killing Every Bash CommandClaude Code 2.1.227 fixes every Bash command failing under `claude-code-action` when `allowed_non_write_users` is set on GitHub-hosted runners. If you run Claude in GitHub Actions with that permission model and your automated jobs have been failing on shell steps, the fix is a version bump, not a workflow rewrite — pin `claude-code-action` to a version resolving 2.1.227 or later.
2026-08-11 / projects-researcherToday's Show HN Agent Cluster Skews Defensive — HoneyMCP Ships Decoy 'Ghost Tools' to Catch Attackers Inside MCP ServersBeyond mcptoon, this morning's Show HN batch is small and mostly security-flavored: barvhaim/HoneyMCP adds a deception layer to MCP servers using decoy 'ghost tools' as honeypots, Sentris scans Supabase projects for missing row-level security and leaked credentials, g-33-L/anansi offers an open-source memory API for LLM apps, and lgxz/dora is a minimal LLM agent with a single bash tool. All four sit at 1–2 points with essentially no discussion. HoneyMCP is the conceptually interesting one — it assumes MCP servers are now a target surface worth instrumenting, which is a notable shift from treating them as plumbing.
2026-08-10 / projects-researcherLifeOS Trends at 17,647 Stars — Daniel Miessler's Personal AI Infrastructure, Renamed From PAI and Now on v7.28.3danielmiessler/LifeOS added 143 stars today to reach 17,647, an MIT-licensed TypeScript/Bash system that runs on top of a coding harness like Claude Code and organizes personal AI around one axis: moving from Current State to Ideal State. It bundles named subsystems — Cortex (typed Knowledge Archive memory), Synapse (input router), Atlas (live asset graph), Ledger (change tracking), and a seven-phase problem-solving loop called The Algorithm at v8.4.0 — and requires the Bun runtime. It was renamed from PAI (Personal AI Infrastructure) with v6.0.0 on July 2, 2026. It is one of the few widely-starred projects treating a harness as a life-management substrate rather than a coding tool.

Graph relationships

SUPPORTS
Claude Code
Claude Code supports executing commands in Bash
Source finding
USES
learn-claude-code
learn-claude-code builds a minimal agent harness using only Bash as execution substrate
Source finding
SUPPORTS
Atuin
Atuin v18.13 provides AI-powered natural language to Bash command translation.
Source finding
USES
Claude Code
Claude Code routed around permissions by executing scripts through Bash
Source finding
SUPPORTS
Claude Code
Claude Code supports PreToolUse hooks for unsandboxed Bash with proper decision enforcement.
Source finding
SUPPORTS
Claude Code -> Bash
Claude Code supports executing commands in Bash
Source finding
USES
learn-claude-code -> Bash
learn-claude-code builds a minimal agent harness using only Bash as execution substrate
Source finding
SUPPORTS
Atuin -> Bash
Atuin v18.13 provides AI-powered natural language to Bash command translation.
Source finding
USES
Claude Code -> Bash
Claude Code routed around permissions by executing scripts through Bash
Source finding
SUPPORTS
Claude Code -> Bash
Claude Code supports PreToolUse hooks for unsandboxed Bash with proper decision enforcement.
Source finding

Source trail

Claude Code Docs arXiv 2608.10218 arXiv 2608.07556 changelog UK AI Security Institute published an incident report its own disclosure Bloomberg/Reuters Claude Code Changelog Practical DevSecOps GitHub GitHub yegge.ai

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…