Blog
Terminals and coding agents
Technical deep dives, protocol specifications, and practical guides for running autonomous coding agents, securing credentials, and building local developer workflows.
Choosing a terminal for coding agents
The best terminal for AI coding agents in 2026
The terminal question changed. It used to be about rendering speed and configuration. Once most of what runs in your terminal is an agent, it becomes about memory, isolation and credentials.
ReadThe best terminal for Claude Code in 2026
Claude Code runs in any terminal. Which one is best depends on what happens around it: telling sessions apart, keeping them off each other's files, and keeping your keys out of reach. Seven options, ranked.
ReadHow to run multiple Claude Code agents in parallel
Starting four agents takes ten seconds. The work is what happens next, when you turn into the person relaying messages between them.
Read
Agents, secrets and security
How to sandbox Claude Code on macOS
Every sandbox answers the same question: if this agent does the worst thing it could do, what breaks? They differ in how much of your working setup you give up to get that answer, and they agree on one blind spot.
ReadClaude Code yolo mode: what --dangerously-skip-permissions actually skips
Nobody enables it because they stopped caring. They enable it because approving the fourteenth file edit is not review, it is clicking, and the clicking was not making anything safer.
ReadThe confused deputy problem, explained
A program that holds more authority than whoever is asking it to act, tricked into spending that authority on their behalf. Norm Hardy named the pattern in 1988, and a coding agent holding your credentials fits it exactly.
ReadThe lethal trifecta: why AI agents leak private data
An AI agent only becomes a data-leak risk when it can see something secret, read something an attacker could have written, and talk to the outside world, all at once. Take away any one of the three and the other two are harmless.
ReadWhat a child process inherits on Unix
Every command a shell or an agent runs starts with a fork that copies the parent process almost exactly, then usually an exec that swaps in a new program while keeping most of what fork copied. Knowing exactly what survives that handoff is what tells you where a secret is, and is not, safe to put.
Read24,000 Secrets Found in MCP Config Files, and What an MCP Server Can Actually Reach
Unvetted third-party MCP servers are running locally with access to your filesystem and environment. Here is how tool poisoning and plaintext configs create severe blast radius risks.
ReadAI-assisted code leaks secrets at twice the rate of human code
GitGuardian's 2026 report reveals that AI-assisted commits leak secrets at roughly double the rate of human-written code, exposing credentials through entirely new surfaces.
ReadThree coding agents deleted production databases in twelve months, and two more incidents came close. What actually went wrong.
Between July 2025 and April 2026, autonomous coding tools erased production databases at three companies, and two more incidents came close. The root cause was never the language model itself.
ReadLeast privilege and capability-based security for AI agents
Giving an agent every permission you have is the easy way to wire it up, and it is also the one choice a fifty-year-old security principle says not to make.
ReadHow the macOS Keychain and Secure Enclave work
macOS keeps your passwords and keys in a database with per-item access rules, not one vault with a single lock. What 'encrypted' and 'never leaves the chip' actually mean changes what you should trust it to protect.
ReadSandbox vs. container vs. microVM vs. VM
Every way to confine a program on Unix sits somewhere on the same spectrum: a wall around a user, a wall around one process, a wall around a group of processes sharing a kernel, or an entirely separate kernel. Picking the right one is a question of what you need isolated and how much of your machine you are willing to give up to get it.
ReadCodex CLI sandbox modes, and the part the sandbox does not cover
Codex ships a sandbox, which is more than most agents do. Two things about it are worth knowing before you tune it, and one of them is a macOS quirk that will bite anyone trying to add a boundary of their own.
ReadSandboxing Coding Agents with macOS Seatbelt: Kernel-Level Protection Without VMs
Autonomous coding agents require local shell access to build and test software, but unconfined execution puts your SSH keys, cloud credentials, and adjacent repositories at risk. macOS Seatbelt lets you confine agents to specific directories at the kernel level without sacrificing native developer performance.
ReadThe TrapDoor Attack: How Poisoned Instruction Files Turn Your Coding Agent Against You
A sophisticated supply chain attack targets developer environments by planting invisible instructions in project-level AI configuration files like .cursorrules and CLAUDE.md.
ReadNon-human identities outnumber humans 80 to 1. Your AI agent's credentials need a lifecycle.
As AI agents become the fastest-growing category of non-human identities, traditional service accounts are no longer sufficient. Here is why agent credentials require dynamic, hardware-anchored lifecycle management.
Read
Yolo mode, agent by agent
Yolo mode in every coding agent: what each skip-permissions flag really turns off
Every coding agent now has a way to stop asking. The flags look alike, and the question that matters is the one their names do not answer: does this remove a person, or a wall?
ReadCodex --yolo: what --dangerously-bypass-approvals-and-sandbox turns off
The flag's name is honest, which is rare. It bypasses approvals and it bypasses the sandbox, and the second half is the one people do not notice they asked for.
ReadAntigravity CLI --dangerously-skip-permissions: same name as Claude Code, different flag
Google gave Antigravity CLI the exact spelling Claude Code users already type. The flag underneath does more than Claude Code's, and that difference is worth thirty seconds before you paste it.
ReadGemini CLI yolo mode: --yolo, --approval-mode and the sandbox that was never on
Gemini CLI's yolo mode does less than people fear and more than they think. It only removes approvals, but on a default install the approvals were the only thing there.
ReadCursor CLI --force and --yolo: Run Everything, and the middle mode worth using
Cursor's CLI has three run modes and most people only know two of them. The one in the middle is the one that makes running without prompts reasonable.
ReadGitHub Copilot CLI --allow-all and --yolo: what you approve, and what still says no
Copilot CLI's yolo flag is really three flags, and for most of this year there was no sandbox to pair it with. There is now, and it is off until you turn it on.
ReadOpenCode --auto: what auto mode approves, and the deny rules it never touches
OpenCode's version of yolo is narrower than most, on purpose. It only answers the questions that were going to be asked, and the answer is only yes where nobody said no.
ReadAider --yes-always: what it says yes to, and why there is no sandbox behind it
Aider was built around git, not around a sandbox. That shapes what --yes-always costs you: edits are cheap to undo, and shell commands were never contained at all.
ReadQwen Code yolo mode: five approval modes, and the one most people want instead
Qwen Code started as a fork of Gemini CLI and kept its yolo flag. It then added something Gemini never had: a mode where a model decides which commands need you.
ReadKiro CLI --trust-all-tools: what trusting everything removes, and what Kiro added next to it
Kiro CLI was Amazon Q Developer CLI until late 2025, and --trust-all-tools was --accept-all before that. Three names for the same idea, and the idea has changed less than the names.
ReadFactory Droid --skip-permissions-unsafe: the flag that admits it does not skip everything
Factory's documentation says there is no mode that bypasses all controls. That is unusual enough to be the most useful sentence on the topic, and the flag is built around it.
ReadGoose GOOSE_MODE=auto: the agent that starts in yolo mode
Most agents make you ask for yolo mode. Goose makes you ask to leave it. That inverts every piece of advice written for the other tools.
ReadCrush --yolo: the yolo mode that still will not run curl
Crush's yolo mode approves everything the permission system would have asked about. A second list, written into the bash tool itself, was never part of that system.
ReadCline CLI --yolo: auto-approve is already on, so here is what --yolo adds
If you installed Cline's CLI expecting the extension's caution, the default will surprise you: a bare cline command already runs without asking.
ReadKimi Code --yolo and --auto: the mode called yolo is not the riskiest one
Moonshot's CLI kept the word yolo for its middle setting and gave the real skip-everything mode a quieter name. Read the flags carefully before scripting either one.
Read
Running several agents
A parallel Claude Code agents workflow that holds up
Isolation is solved and it is free. The two parts nobody ships are the two that cost you a day instead of an hour.
ReadGit worktrees explained
A worktree gives one repository several working directories that share a single object store, not several copies of your project. The part people miss is everything that single store still leaves shared between them.
ReadThe real problems with managing multiple Claude Code agents
Starting four agents takes a minute. The problems show up later, and not one of them is about how many you started.
ReadLeases and heartbeats: how distributed systems hand out work safely
A lock assumes whoever holds it will eventually let go. A lease assumes they might not, which is the one assumption that actually matches how real workers fail.
ReadContext windows, tokens and compaction explained
The context window holds everything a model has read in a session, counted in pieces called tokens, and both filling it up and emptying it back out follow specific, checkable mechanics, not vibes.
ReadClaude Code from your phone: what actually works in 2026
The question people actually mean is one of two things, and they have completely different answers: run the agent somewhere else, or reach the one already running on your machine.
ReadClaude Code says your session limit is reached. What to do with the next four hours
The annoying part is not the wait. It is that the wait usually costs you the twenty minutes of context the agent had just built up, and you pay for that twice.
ReadClaude Code to Codex: what actually carries over
The guides all cover the same afternoon of configuration. Here is the part that is still missing a week later.
ReadThe terminal setup for vibe coding, without losing the thread
The appeal of vibe coding is not writing the code. The thing that ends it is coming back an hour later and having no idea what any of it does.
Read
How it works underneath
What is the Model Context Protocol (MCP)? Architecture, Primitives, and Security
Anthropic designed MCP to turn custom integrations into standard client-server connections, but standardising the wire does not make the boundary safe.
ReadThe Agent Client Protocol (ACP): Architecture, Wire Mechanics, and Multi-Agent Limits
The Language Server Protocol untangled programming languages from text editors a decade ago. The Agent Client Protocol does the same for coding agents, and understanding its wire mechanics explains where its boundaries sit when scaling to squads.
ReadThe Agent2Agent (A2A) Protocol: Standardizing Multi-Agent Coordination and Hand-Offs
Connecting autonomous agents across frameworks requires an open wire format, but turning peer handoffs into working software still demands state that survives a crash.
ReadHow terminals work: TTY, PTY, and line discipline
Every terminal on your Mac is software standing in for a machine that printed on paper. The kernel layer that keeps up that illusion still decides, right now, whether Ctrl-C kills your process or just types the letter C.
ReadHow localhost tunnels work
Your laptop already has a web server running on it. Nobody else can open it not because the server is broken, but because the internet is built so a stranger can't dial into your machine uninvited, and a tunnel is a deliberate way around that.
ReadEnd-to-end encryption in collaboration tools, explained
Transit encryption, at-rest encryption, and end-to-end encryption get used as if they were interchangeable. Only one of the three means the vendor itself cannot read your data.
ReadOpenTelemetry for AI Agents: Tracing Reasoning Loops, Tool Chains, and Token Costs
Traditional APM tells you an HTTP request returned 200 OK, but says nothing about whether your agent entered a circular retry loop or hallucinated a file path. Standardizing on OpenTelemetry GenAI semantic conventions turns opaque reasoning cycles into queryable traces.
ReadTree-sitter for AI Coding Agents: Why Concrete Syntax Trees Beat Regex and Line Diffing
Coding agents fail on large files when they rely on regular expressions for discovery and line diffs for edits. Tree-sitter replaces both with an incremental concrete syntax tree that parses incomplete code in milliseconds, extracts exact scopes, and keeps context windows small.
ReadThe Language Server Protocol (LSP): How It Solved the N x M Problem and Paved the Way for AI
Before 2016, every code editor had to write custom plugins for every language. Microsoft's Language Server Protocol replaced that exponential tax with a clean JSON-RPC boundary, creating the architecture that now powers AI coding agents.
ReadDebug Adapter Protocol (DAP): How AI Coding Agents Use Debuggers for Runtime Verification
Static code analysis catches syntax and type errors before execution, but runtime bugs hide in dynamic program state. Here is how the Debug Adapter Protocol gives autonomous AI coding agents programmatic control over live debuggers to trace, diagnose, and verify complex code.
Read
Looking for how-to guides? Browse all guides.