claude code does indeed run a call to haiku every single time it uses Bash() patched version normal claude

its obvious this is a safety measure, but is interesting to see compared to other harnesses like cursors' which flies with fast models like composer-1 doing tons of tools per second since it doesn't have as many safety interrupts also is a possible thing that *could* be turned off when running in a sandbox/safe environment anyway

@bcherny @trq212 please let us disable this with an env var, I have some sdk automations that run in ephemeral sandboxes with strict networking rules and I really don’t benefit from the haiku safety step

probably a dumb question - but how do you see that it's doing that in the video?

the one on the left is a version of claude code where i've patched out the haiku call mainly you can see once the model has generated all the parallel tools (they start running at the same time) then it does them all basically instantly (plus or minus some latency of the TUI rendering) whereas the right side (normal claude code), basic commands like expr and whatever are taking some N hundreds of ms extra because there are calls to haiku to check the security of each command normally it would use this haiku call to match the command to a permission, but with --skip-permissions you can just see the time between generate → check via 2nd model → command actually runs

It’s always shown this in the usage stats - tokens going to multiple models, is this different?

This is one of the main reasons why I switch to Pi. ftw.

from my reverse engg - back in prev versions, they used to pass the bash tool command to a Haiku model for safety reasons. It would specifically filter dangerous commands apart from having a general allow and deny list that it maintains

I saw this Bash agent is using an inherit model. Are you testing with the Haiku? If the user chooses Opus, will Bash tool execution be slower?

Yes, it's doing it since a long time ago, last time I checked about June or mid-year of 2025. I know because I looked into bash bypass for command injection :)

this seems... silly?

i just told it, set model:opus

sounds like you’re diving deep into some interesting code behavior. the way these systems interact can be so quirky. have you tried running your app through First100 yet? might be a good way to find users who appreciate those kinds of intricacies.

I created a hook to prevent claude code from running my skills, slash commands, and agent with a model option. I define all models in the frontmatter, and I got tired of Claude Code trying to use Haiku for everything. Not sure if my hook effects the behavior you show here.

good work. this also counts towards session usage, right? w/ the changes you've made, how much was the reduction in costs in API calls?

What is the prompt?

Lil bro haiku at work finally

haiku in every Bash() call? that’s a lot of poetry per script. my logs would be a haiku anthology at this rate.

how did you patch it?

its called generic code because i modified the CC bundled JS file to allow claude code to work on such a thing without it being seen as a policy violation you can change the env variables back to claude_code_something instead if you'd like it may not work on the bun-bundled version of cc, you need an npm-based install where realpath claude = <path>/cli.js

funny side effect