Articles
Original-data research, technical investigations, engineering notes, and build logs from systems I build or study.
Claude Models on Google Cloud (Anthropic managed) vs Vertex AI: IAM replaces the API key, and three places it doesn't reach
From Vertex AI the reason to move is features. From the first-party API it is IAM instead of keys. Either way the IAM part covers less than it looks: a gateway puts one service account on every call, the read-only role reads every agent transcript unlogged by default, and a revoked grant stops nothing already running.
Agent Skills joins the Agentic AI Foundation: what changes for the SKILL.md you install, and what to do until versioning ships
The file format did not move an inch. What moved is who may change it, and the guarantees an installer would want (spec versions, a proposal process, security guidance) are still a proposed roadmap. Until they ship, pinning, validation and portability are on you, and each takes a few commands.
Claude API 2026-10-21 and the new Anthropic SDKs: the key moves to Authorization: Bearer, and a gateway that reads X-Api-Key loses it
For a client that calls the API directly, the header move needs no change. A gateway has to read both shapes, because Claude Code and every pinned service keep sending the old one, and an SDK client now refuses to hold a gateway token and an upstream key at once.
Claude Code in tmux: send-keys can't see a permission prompt, claude agents --json can
A tmux pane is a fine place to host a Claude Code agent and a poor interface to drive one. In my test a task typed into a pane that sat on a permission prompt vanished, and its Enter approved the pending command. The status, the waiting reason and the finish event are now reported by Claude Code itself, so the screen can go back to being a screen.
Claude Code /auto-mode-setup: teach the auto mode classifier your environment, then check which model reviews
The setup drafts a trust list from your repo and your agent's recent commands, and the draft replaces the shipped environment text rather than extending it. Read it as a diff against the defaults. Then check which model reviews your actions before you spend time choosing one.
Claude Code behind an LLM gateway: the credential decides who pays, and without one the proxy gets your claude.ai login
Twelve beta values per request under a subscription login, ten under a gateway token, and the pair that vanishes says more than the docs tables do. What a gateway must pass through untouched, which default quietly gets more expensive, and why pinning it with allowedProviders also takes away a developer's own debugging listener.
Claude Code fork subagents in claude -p: what 2.1.302 changed for headless runs
Offered is not used: a headless model may never pick a fork, and the official docs still describe the old default. Checking which subagent your pipeline got, why a background fork hands a parser two answers, and where switching it off pays.
Claude Code statusline and ccusage: the native rate limits, and a 5-hour block that ends at a different time
Two tools answer one question with different evidence: the server reports a reset time, a log parser infers one. When they disagree by hours, believe the server and keep the parser for history. The dollar figure, on a subscription, is an exchange rate.
Claude Code vs Cursor: seven ways developers split the work, now that neither tool is stuck on one surface
Each vendor erased the old editor against terminal line from its own end. What still divides them is quieter: a config folder that Cursor reads live while Claude Code imports Cursor rules once, and permission systems that ignore each other's deny rules.
MCP vs API for AI agents: the API catalog is a directory, and the choice is who sits in the middle
An API catalog does not compete with an MCP server: it can list one. With that settled, the choice between MCP and a plain HTTP API described by OpenAPI comes down to whether a host application integrates your service for the model, and whether anyone has already decided to put you in front of it.
Claude Code Review is GA: the review layers around it, and which ones you can copy without a Team plan
Most of what makes the Claude Code team's process work is GitHub settings and written rules, and those run on any plan. What does not copy is where the rules come from. The managed service picks them from a branch the pull request cannot touch; a local review reads whatever is on disk, including a rules file the change under review just edited.
Claude API OpenTelemetry: tracing the SDK and the API without counting tokens twice
A span's input token count already includes cache reads and writes, so the query that feels natural if you know the Messages API counts the cached prefix twice. Setup for the SDK half, tested against a local mock; the Console destination from the docs; and the subtraction that gets you back to uncached input.
Claude Code idle compaction: a cheap summary now or a full cache rewrite later
Five conditions decide whether idle compaction fires at all, and by default two of them leave out API-key sessions and most 200K-window ones. Who actually gets it, what the trade costs in cache tokens, and how to tune it or turn it off.
Gemini 4 Argon is public: the uses Google reports on day one, and the price that doubles on December 1
Seven uses Google reports for Argon, with the post each comes from, and the only one that shows its review record: six proposals, two shipped. The rest is the bill the announcement leaves to the docs, starting with how long decode counts input.
Claude Managed Agents dynamic workflows: the agent writes the fan-out, the budget has to come first
The switch is on by default with the new multiagent type, nothing approves the start of a run, and the one money cap can only be attached when the session is created. A setup guide built from the documentation, with the three settings that have to be decided before the first message.
Codex CLI managed Git worktrees: three ways to start one, and the model's tool starts from the remote default branch
A hands-on run of Codex CLI 0.162.1 on a throwaway repository: where the checkouts land, which commit each entry point begins at, why your .env and uncommitted edits stay behind, how to merge the work back, and what cleanup leaves on disk.
Claude Code skills as a supply chain: 2.2 million adoptions, no registry, and a scanner that reads the source while Python runs the cache
Reading a skill before you run it is the standard advice, and it has two holes. A copied skill has no update channel, so the copy you read can drift from its source without telling you, and for a skill that ships Python, the file you read is not always the file the interpreter loads.
Claude Code vs Codex: seven ways developers split work between the two instead of picking one
The handoffs are vendor-documented now: a review command, a session transfer, an importer in each direction. Who should get which job is documented nowhere. Seven splits, each traced to its origin and marked documented or reported, plus the sandbox defaults that differ and the integrations that were removed this year.
Context engineering starts with an inventory: you cannot budget a context window you cannot list
Every practice in the guides is a verb of choosing: trim, defer, retrieve, compact. Choosing needs a list. The one Claude Code ships itemizes your configuration by source and size, then reports the whole conversation as a single number, and nowhere says how long anything stays.
WebMCP on a real site: registering tools with document.modelContext, and why my navigator.modelContext script registers nothing
The API moved from navigator to document in May, lost three methods before that and turned its registration call into a promise after. A script written to satisfy a detector in April can expose zero tools to a current browser. The working registration, a test that needs no agent, and where a plain MCP endpoint is the better door.
Anthropic's 2026 usage policy for agent builders: the hardware stop button made it into the announcement, the subscription proxy clause did not
The hardware rules can be checked with a pulled cable. Unauthorized proxying through consumer subscriptions, responsibility for what an agent does with its tools, and a lower enforcement bar cannot be checked from outside, and they came in without comment.
Claude Dashboards and Claude Motion: a hands-on test, and the bug that only the formula panel showed
What Claude Dashboards built from 88 rows of public Wikipedia data, which of its numbers held up against the source file, and why the one thing it got wrong will be invisible to most people who look at a shared dashboard. Plus who sees what when you share one, and how Claude Motion makes video without a video model.
Claude Managed Agents web_fetch: a URL now has to come from the user or the web
The new rule does not rank sources by how far you trust them. An attacker's web page counts as a source and your own bash output does not, because the model drives bash and does not write the web. With the web tool fenced, the next way out on a default environment is curl.
Claude Max API credits: what $100 or $200 a month covers, and what Thariq's AI new-tab page sends to the cloud
Which Console organization to link, which settings quietly put your card back in play, why claude -p and interactive Claude Code bill differently, and what an Anthropic engineer's daily new-tab extension uploads from your signed-in browser each time it runs.
Claude Haiku 5.5 as a Claude Code subagent: effort, the 100K tier and the cost per task
How to route a Claude Code subagent to Haiku 5.5 on purpose, which effort level to pin it to, how to keep it under the long-prompt rate with /autocompact, and what the system card says to check before you trust it with a tool loop.
Claude Haiku 5.5 and GPT-6 Luna cost the same until the prompt gets long
Identical price cards, two different cliffs. On long prompts the models part ways: one reprices the whole request above 100,000 tokens, the other above 272,000. For a subagent that reads files, that line decides the bill more than the rate does.
Claude Code permission rules: ten bypasses closed in three releases
Half of the ten fixes land on guarantees the documentation makes, not on the limits it already disclaims. Two more are parts that failed open, and for a PreToolUse hook script that crashes or hangs, failing open is still the documented behavior.
Decision models vs LLM-as-a-judge: Jev, OpenAI's Decisions API, and who calibrates the probability
Seven places vendors want a typed answer to replace a free-text judge, what Red Hat's benchmark found, and why every vendor in the category, including the one that sells calibration, ends its documentation by handing the threshold back to you.
AI text watermarks: OpenAI's textGrain, Claude's SynthID mark, and who gets to check them
What a text watermark result can establish, how much editing it survives, and why the error rates you can read so far were all measured by the vendor that holds the key. Then what that means for anyone who grades, writes or builds on these models.
Claude Cowork moves to the cloud: the sandbox left your laptop, the folder grant stayed
Anthropic's own safety page says it in one line: isolation limits where Claude's code runs, not what Claude reads or does. The cloud move relocates the first and leaves the second wired to your desktop app, which now answers for a session that keeps going after you stop watching.
Agent memory as Markdown documents: a readable memory is still a memory
Moving agent memory out of a vector store and into Markdown files makes it easy to inspect, and that is worth having. Staleness, conflicting writers and the page nobody opened were never problems of storage format, so they move into the folder intact, where a clean file can pass for a checked one.
How AI agents escape sandboxes: most ways out were services the agent was given
Five of OpenAI's reported cases are paths out of a contained environment, and in most of them the path was a resolver, a shell or a credential handed over for another job. Treat the list of those paths as the first control, and a blocked attempt as evidence the path exists.
Auditing CLAUDE.md with Claude Code's /doctor: keep the reason in the file, the war story in git
The new audit treats every emphatic rule in your agent config as a hypothesis about a model you may no longer run. It asks where each rule came from, and in the same file it tells you to delete the story of where it came from. Both instructions are right once the reason and the history live in different places.
Amazon vs Meta's Muse shopping agent: why session custody, not agent identity, is the line
Asking a shopping agent to say who it is gives the site a switch for turning the agent off. That is useful for commerce and permission, and it is not a safety line. The line that protects a user is custody of the logged-in session: what the agent can reach inside it, and whether the user can see that and revoke it.
Claude plugin directory explained: how plugins work, how to publish one, and why it isn't a marketplace
The plugin directory reviews the package you upload, not the server it points at, and nothing in it lets you charge. The paid side of Claude Marketplace is a different door, for partner products bought out of enterprise spend. What the directory buys a developer, what it costs a user, and why my own two MCP servers don't fit it unchanged.
Karpathy's tips for understanding LLM output, and the ASD-STE100 cheat sheet that gets the standard wrong
Andrej Karpathy's ladder for reading what models produce goes from controlled English to diagrams, HTML pages and explainer videos, each easier to take in than the last. The cheat sheet attached to his post is a clean, confident summary of ASD-STE100 that inverts one dictionary rule, approves a verb the standard rejects, and presents a recommendation as a dictionary entry. A clearer format can expose an error or make it easier to believe; the useful question is what each one lets you check.
Notion's ChatGPT token sharing: your AI bill now has two meters
Notion now lets a ChatGPT Plus or Pro subscription pay for some of its AI. It covers one agent and one model family, it still needs a Notion Business or Enterprise plan, and its eligibility changed by tweet within two days of launch. What token sharing is, how to set it up safely, what it covers, and why I still can't tell how much of either allowance a Notion task will use.
Full Disk Access gets harder to grant. Your terminal may already hold it.
Extra friction at the moment of granting says nothing yet about grants already made. On a Mac where the terminal holds that permission, the rules Apple's engineers describe let a coding agent started there read with the terminal's access, and the agent picks its own commands.
A Claude Code mod can approve what your hook blocked
Mods arrived in v2.1.287 as one line in the release notes. What they add is not reach, a plugin already ran as you. It is precedence: an installed mod answers after your rules and your PreToolUse hooks, and outside managed settings its answer is the one that stands.
Gemini 4 Argon's defender build is not the one you will call
Google is splitting access to its new frontier model by cyber safeguards, the way it did with 3.8 Flash and Anthropic did with Mythos. The developer build is still being tuned, so the benchmark table describes a model no developer will get in that form.
Three records of one agent incident
OpenAI's logs, a URL scanner's public archive and a statistics bureau each tell it differently. Whoever keeps the fullest account is also the one grading it.
AI search visibility measurement framework for technical teams
One panel gives you a snapshot. A report compares two periods, and that is where most AI visibility changes turn out to be artifacts of the panel, the sample size or an unlogged model swap. The design that makes a trend checkable.
Sonnet 5.5 keeps its reasoning for one model and one account
Switch to a model or an API account that can't read the earlier thinking, and the request still succeeds. The reasoning those turns built up is dropped before the model reads it, with no error and nothing on the bill. You only find out if you asked the API to report it.
A benchmark has to prove it tracks the clock
Once an agent will push any number you give it, the model stops being the part worth arguing about. The part you own is the evidence that the number and the goal move together, and that evidence expires as soon as the optimizer leaves the region where you checked it.
How to measure brand visibility in AI search results
Mention, answer inclusion and citation come apart the moment you sample an assistant more than once. One prompt can carry a brand's entire presence, a parser can move its citation rate 2.5x, and a hallucinated license still counts as a mention. A workflow for technical teams, built on 359 answers.
Find what broke your prompt cache
Cache diagnostics names the first place a request stopped matching the one before it. The useful part is reading that verdict next to the cache read count, and covering the parameter changes it cannot see yourself, because those are the misses hardest to find by eye.
What a cloned repo's settings file can still run
Claude Code just stopped repositories from switching on telemetry export. The narrower fix hides a wider fact: a committed settings file is code that runs as you, and in a headless run nothing asks first. Interactively a dialog does ask, and I accept it without reading.
Opus 5.5 is cheaper, and the 400s are the easy part
A request that returns 400 has already told you what to fix. The changes that cost you on this upgrade come back as 200: a response that no longer starts with text, an effort level that dropped a notch because you never set it, and an alias that moved you to a new model without a deploy.
Notion AI pricing in 2026: a price you cannot compute
The bill went up by $96 a year, which is nothing. What changed underneath it is that the number is no longer derivable: the included allowance has no published size, the free credit allotment has no published size, and the annual credit costs more than the monthly one. A price you cannot compute from published figures is an estimate, and an estimate is a different kind of dependency.
Claude Code now reads AGENTS.md, and the default is a fallback
Anthropic solved loading again and left precedence where it was. The default decides which project file loads by what happens to exist on disk, the file it loads stays out of the inventories you would audit it with, and the old one-line import is still the setup that behaves the same across providers and versions.
The tool you install has your reach
An installed tool holds whatever authority you already have, and handing it over is the one security decision that gets no second look: taken once, in the least deliberate act of the whole install, and never revisited. You can contain what it can reach or read what its code actually touches; trusting the name does neither.
The compaction is an untrusted input
Input from outside gets a discipline and the agent's own output does not, so the summary it writes to survive a reset and the memory it recalls come back in as instructions with a standing nothing revoked. The author the harness records for them is the model itself, which is the exact reason the check lets them through.
A prompt is not an invariant
A rule you write into an agent prompt or a CLAUDE.md is advisory: the model reads it on every path but only weighs it, and weighing is not refusing, so it holds most of the time, and most of the time is not what a load-bearing rule is for. To make one actually hold it has to move to where compliance is not optional, a check the harness runs and enforces on its own, regardless of what the model decided. With a limit: a gate binds only over the paths it covers, and some rules cannot be settled at any gate at all, because their violation shows up in the world and not in the action it would inspect.
Your agent config is infrastructure now
Past a couple of agents, their definitions stop being config you edit and become infrastructure, and the trouble with infrastructure is that past the point you can hold it in your head, its declared state and its running state drift apart by default and nothing reports it. The fix is the discipline servers learned: declare the set as files, diff it against reality, pin what you applied, and refuse to apply over a change made behind your back instead of converging past it. With one catch that is easy to miss. A reconciler only ever covers what you remembered to declare.
The connector is an untrusted author
Who wrote a span is a fact the harness already holds. Whether that span is safe to obey is not. So the fix is not a cleverer reader: it is to give the tool and the peer the standing of the foreign thing they are, instead of the standing of the plumbing they arrived through.
The agent reaches for the tool it can read
You optimize a tool for what it can do. An agent selects a tool for whether it can predict the result and read the answer when it comes back empty. Those are different properties, and the distance between them is why the more capable tool is so often the one that goes untouched.
An exit is not a verdict
A monitor that pages on a process's absence is answering the question you can already see the answer to. Whether a job is gone is cheap to detect and almost never the thing that matters. Whether it failed or was deliberately stopped, by a deploy, a reboot, an operator, is what a page turns on, and a bare exit carries only a sliver of that story.
A model is a dependency that won't hold still
A pinned software library is an artifact you can inspect and rerun: if the output changed and you didn't, something you can read changed, and you can find out what. A model breaks that. It shifts behind an unchanged name, loses capacity without notice, and drifts in disposition, so a regression arrives with no cause you can point to and you waste a week blaming your own prompt. Treat it as a dependency you measure, not a foundation you trust: pin the version so you own the moment it changes, and fix a small panel of cheap metrics in advance so you can tell the vendor's drift from your own.
Your approval gate is a guess now
A security boundary is judged on the one action built to cross it, and a model judging by resemblance is weakest exactly there. The unattended allow belongs on the reach the harness itself grants, the write scope, the network, the credential, refusing what it cannot account for. Trust the model as the boundary and you rebuild the seam that prompt-injection detection could never close.
Your watchdog kills the busy agent and trusts the stuck one
A health check that watches whether a long-running agent still exists gets both hard cases wrong: it kills a healthy agent the moment it goes quiet enough to look absent, and it waves through a frozen one whose process is still up. The repair is not a sharper probe but a different signal, the durable trail an agent leaves only by doing the work, which a wedged one stops extending because extending it is the work.
Your forked subagent already knows too much
An agent's history holds every dead end it walked into, and nothing in it marks which ones the agent has since given up. Delegate that history to a subtask and the discarded guesses arrive wearing the same face as the settled facts. Why starting clean usually wins, when a written brief beats inheritance, and when the work is a live thing no brief can hold.
Your instruction files are addressing, not fragmentation
Merging every agent instruction file into a shared standard looks like deleting needless repetition, and for project setup it genuinely is. But most of what these documents hold is not a scattered copy of one thing; it is separate addresses, sorted by who a line applies to and who is allowed to write it. One of those boundaries is also a trust boundary, which is why the tidy fix of one universal file quietly hands repository text the authority of your own standing rules.
You can't verify a translation by reading it
Re-reading a translated document proves nothing, because judging the output asks for the exact fluency you handed to the machine. So you stop reading harder and move the judgment back into a language you can actually read.
Your multi-agent system is a distributed system
The failures people blame on their agents (many converging on the same wrong answer, a disagreement that hardens into sabotage, a success reported for work that never ran) are not gaps a stronger model closes. They are the oldest failures in distributed computing, and they yield to engineering the layer between the agents rather than to more intelligence inside each one.
The token tax on tools you never call
Every capability you expose to an agent spends context on its schema up front, so the price of its abilities tracks the size of your catalog and not the size of the job. The fix is not choosing CLIs over servers but treating the whole tool surface as a budget you spend only when the work reaches for a definition.
Wake me for the decision, not the keystroke
Per-command permission prompts train the operator to approve on reflex, and about one in three planted-dangerous requests get waved straight through. The interrupts still worth keeping are the rare, legible ones: an action that cannot be undone, one that reaches outside the sandbox, or an approach that has already failed three times.
The injection you can't review your way out of
Code injection gets stopped at the seam where data becomes code, by refusing a whole syntactic class rather than weighing each case. It holds wherever that boundary is decidable, which is the exact property natural-language prompt injection never has.
Put the more agentic model in the reviewer's seat
The traits that make a model more agentic (it expands scope, verifies itself unprompted, writes longer) are a liability in a bounded unattended worker and an asset in a reviewer. So the fleet's workers run on Claude Opus 4.8 while Opus 5 does the reviewing. A field note on matching a model's disposition to its role, not its benchmark.
The Quality Paradox: Why Search Improved for Google While It Degraded for Publishers
Three layers of evidence (publisher traffic decay, Alphabet's revenue mix, the leaked Google ranking schema) showing why no algorithmic recovery is coming.
Tracing the Pizza Day bitcoins
Every year the same articles. Counterfactual valuations, the road-trip rumor, the man-bites-pizza headline. Nobody traces the actual coins. So I did. Here is what the chain shows and what 'those specific bitcoins' even means.
Claude told me to go to sleep at 10:47 in the morning
Anthropic calls it a character tic. I went looking for what was actually producing it and ended up reading the published system prompt, the character training paper, and the emotion-concepts paper. The behavior is what the stack makes likely.
Anthropic put a meter on the rest of the agent
On June 15, programmatic Claude usage moves to a separate $20–$200 API-priced credit. The email arrived this morning. Here is what it actually means and what it teaches about building on someone else's compute.
Beetroot v1.6.6 — The Office Fix
Excel and Word cells were captured as screenshots instead of values. Microsoft Store autostart was silently broken. Image thumbnails ate gigabytes of RAM. v1.6.6 fixes all three, plus a stack of security and reliability work after the big 1.6.5 AI Vision release.
Any paid Chrome extension can be rebuilt in 30 KB
Paid Chrome extensions are mostly paywall and analytics. With an AI agent you can rebuild any of them in one evening: 30 KB, no subscription.
Beetroot v1.6.5 — Your Clipboard Can Now Read Images
Beetroot v1.6.5: AI Vision lets your clipboard read images (OCR, describe, extract, translate). Background AI job queue. All providers in native Rust.
The Invisible Backslash: How a Shell Escaping Bug Silently Corrupted 20 Releases
Tauri-action signing key kept failing after 20 working releases. The fix: a literal backslash hidden inside the password by shell-quote escaping.
Beetroot v1.6.4 — Preview Panel Redesign and Overlay You Can Actually Customize
Beetroot v1.6.4: customizable copy overlay (position, duration, animation) and three content-aware preview modes for text, code, and images.
How I Fixed OSC 52 Clipboard in xterm.js Through tmux
OSC 52 clipboard doesn't work in xterm.js through tmux. The fix isn't set-clipboard or terminal-features — it's allow-passthrough.
Beetroot v1.6.3 — Copied Overlay, Explorer Images, GPT-5.4
System-wide 'Copied' overlay confirms every clipboard capture. Fixed images copied from Explorer. OpenAI models upgraded to GPT-5.4. Security hardening.
Beetroot v1.6.2 — The Truncation Bug
A hotfix for v1.6.1's content truncation — AI transforms, preview, and copy were silently working with partial text. Plus Alt+T toggle and filter count fixes.
Beetroot v1.6.1 — The Keyboard Rewrite Nobody Saw
Beetroot v1.6.1: keyboard input rewritten for no-focus mode, refreshed preview panel with arrow navigation, fixes for v1.6.0 regressions.
Beetroot v1.6.0 — Rust Search Engine, No-Focus Window
Beetroot's search engine moved to Rust — accent folding, typo tolerance, prefix matching. Plus a no-focus window that doesn't interrupt your workflow.
I Mass-Replaced Fuse.js in My Clipboard Manager. It Took 8 Iterations.
Why Fuse.js fails on clipboard data and how I rewrote search in Rust over 8 iterations: same-field matching, Unicode word boundaries, scored merge.
Beetroot v1.5.1 — ML Code Detection and Search That Actually Works
Beetroot v1.5.1: VS Code's TensorFlow.js model detects 54 languages. Rewritten search engine — 'local v' returns 9 results instead of 98.
How I Added 5 AI Providers to a Tauri Desktop App
Multi-provider AI in Tauri: OpenAI, Claude, Gemini, DeepSeek, Ollama. Three integration patterns and a Rust proxy that solves localhost CORS.
Beetroot v1.5.0 — Five AI Providers, Smarter App Detection
Beetroot now supports OpenAI, Gemini, Claude, DeepSeek, and local models. Plus AI sparkles, Ollama presets, and smarter source app tracking.