Building thoughtful software with AI.Notes from the systems behind the work.
Login emails can't be sent from the dev box, so I gave myself a short PIN that never expires or locks, then fenced it with repeated dev checks, a stamp only my script writes and a reset route that hides itself, and chased down a correct PIN that failed because a secret was read too early.
Read moreThe day I taught my assistant-telemetry installer a second assistant, it switched on prompt logging without asking, merged settings in two opposite directions, wrote a token in plain text, and the same commit removed the server cap on stored conversation content. An editor extension from the same day sent full file paths on every edit.
The agent gave my chore app a test runner that saves the config and puts it back after every test, then wired it to an admin button on the live server. It looks clean at the end of a run, but reading the code, visitors could get test settings mid-run, two overlapping runs could delete the real config and still report green, and a killed run loses the only saved copy.
With no key to sign login tokens, my scheduling app just threw. The agent's three tries ended with a plain false and a notice on the login page, which is friendlier and also one forgotten check away from signing tokens with an empty key.
Rereading the commits that gave the little chat tool an online mode showed that the key check decides nothing: a failed key still gets saved over a good one, the online switch only asks whether any key exists, and the periodic recheck can only ever say yes.