Summary
Two low-level filesystem/process hazards repeatedly surface in coding-agent tool implementations: (1) treating a FIFO or device node as an ordinary file — notably when it has an image-like name — and (2) a backgrounded shell job that keeps the bash output pipe open after the agent's foreground command exits. As of October 2026, two independent implementations (Claude Code and the yoagent/yoyo stack) converged on fixes for both, though with different trade-offs in behaviour.
Key Points
- Hazard 1 — non-regular files: a
Read/read_filetool that branches on filename or extension (e.g. "looks like an image") can block or exhaust memory on a named pipe or device such aspipe.png. - Claude Code v2.1.302 (2026-10-16) fixed its Read tool loading a pipe or device into memory, and now refuses image sources over 128 MB.
- yoagent 0.25.8 (2026-10-19, issues #341/#344) makes
read_file/write_file/edit_filerefuse any non-regular file after following symlinks, with the check placed before the image branch so image-named pipes are covered. - Side effect of the strict check:
write_fileto/dev/nullor/dev/ttyis refused. - Hazard 2 — the held pipe: a backgrounded job inheriting the bash output pipe can be killed by SIGPIPE if the agent closes the read end when the foreground shell exits.
- yoagent's
BashTool(#342) drains the pipe for a READ_GRACE = 1s after bash exits, then leaves the pipe open and read-and-discarded in the background, reporting aNOTEline anddetails.output_still_open. - yoyo's alternative,
StreamingBashTool(#1049), aborts its reader after 2s: prompt exit, but a job that writes after 2s dies on its first write.