Detailed analysis of BashTool's three-layer security architecture: 23 syntactic security checks covering command injection, shell metacharacters, obfuscation flags, jq system functions, zsh dangerous commands, and TOCTOU protection; permission rule matching with path constraints and command operator checks; read-only mode enforcement with destructive command detection. The Tree-sitter AST analysis approach is a non-obvious pattern for distinguishing safe from malicious command syntax. This document is a reusable reference for implementing secure command execution subsystems in AI programming tools.

Analysis of the permission decision pipeline, featuring the ResolveOnce pattern with dual flags (claimed + delivered) to prevent race conditions across 6 concurrent sources: user dialog, Bridge CCR, channel relay, hook system, Bash classifier, and abort signal. The 200ms grace period for the automatic classifier prevents accidental approvals during fast typing. Three handler paths (Interactive, SwarmWorker, Coordinator) adapt to different execution contexts. This is a reusable pattern for building concurrent permission systems that must handle multiple competing decision sources.

Analysis of the custom React reconciler for terminal rendering, including: 50+ lifecycle hooks, Yoga flexbox layout, dirty-mark propagation for subtree-only re-rendering, double-buffered screen with frame differencing, DECSTBM hardware scrolling (O(1) vs O(n) for large scrolls), relative cursor movement, StylePool with ANSI transition caching, CharPool for string deduplication to reduce GC pressure, and virtual scrolling with Float64Array offset storage (O(1) binary search, cache-friendly). The 300-item mount limit prevents GC death spiral at 59GB RSS. This is a reusable reference for building high-performance terminal UIs.

Catalog of 12 cross-cutting architectural patterns: message normalization boundaries for multi-provider API adaptation, context modifier queue for concurrent-safe delayed message mutation, speculative execution overlay for streaming file writes, AsyncGenerator as unified streaming primitive (cancellation, backpressure, composition), lazy module loading with factory functions to break circular dependencies, feature flag DCE for compile-time code elimination, fire-and-forget analytics with queueMicrotask, three-layer permission isolation, dependency injection in Bridge for testability, and three-level concurrency model (read parallel max 10, write serial, context modifier serial). This is a reusable pattern catalog for AI coding tool architecture.

Analysis of the multi-stage startup pipeline: module-level side effects (profileCheckpoint, startMdmRawRead spawning plutil, startKeychainPrefetch) that overlap with module import evaluation to save ~65ms; Commander.js preAction hook as a deliberate design choice to avoid initializing side effects during --help; 91 CLI options across 18 categories; 6 execution modes (REPL, Bridge, SDK/Print, Coordinator, Assistant, Worktree) all sharing the same initialization path; deferred prefetches (user context, git status, AWS/GCP credentials, skill detectors) that run after the first paint to avoid blocking the <500ms time-to-prompt target. The analysis includes a detailed timing diagram showing the critical path. This is a reusable reference for optimizing application startup performance.