Ribera Maxime

Developer Advocate @ Adeo

[Jamon @jamonholmgren]

I'm just going to dump my whole agentic setup out here, because I see too many people missing giant chunks of this and it's hurting them.

Here's what I have and recommend:

0. an AGENTS.md that is a router -- it sends the agent to the right skills, docs, tools

1. a standard workflow doc/skill customized to my needs ... (grab Matt Pocock skills if you don't already have something) ... I tag this in most sessions with `@/AGENT_WORKFLOW.md` and it pulls it in.

2. self-healing docs for every system, and agents are instructed to keep them updated ... I tag the ones I know I need, or let the agent find them through AGENTS.md ... I also provide a more detailed summary in the first 7 lines of every doc, so they're easily greppable to find the right thing, and this is documented in AGENTS.md

3. agents always run the app ... the agent should always actually run the app itself, and test its work and fix issues as it goes, especially if running autonomously / asynchronously

4. end-to-end tests and instructions to write more and keep up to date, and docs on how to write tests, what to avoid, and a list of all the tests and what they test in yet another markdown doc ... write and run targeted tests during implementation, improve and commit with work

5. custom linters at precommit hooks looking for any problems you run across, with `--fix` fixing the problems automatically, OR if that's not feasible, it shells out to a cheaper LLM like Composer 2.5 or Sonnet to fix the problems -- NOT just flagging them, but actually resulting in cleaned code

6. cross-agent review at each major point: research, plan, implementation, and wrap-up. I mean codex, claude, cursor, whatever -- but it shouldn't be the same model reviewing the same code. And specific docs for agent review, what to look for, how to approach it. Also, personas -- looking at the code from different perspectives, such as maintainability, code quality, security, performance, AI smells, domains (e.g. "financial services expert" or whatever) ... and each persona also "owns" a set of system docs too and keeps them up to date

7. agent traces / worksheets that track what the agent is doing each session. if the agent fails partway through, you should be able to hand this worksheet to another agent and it could finish the job. commit this worksheet with the work so it's all connected and easy to reference later (you will reference these later!!), also have the agent apply git tags that correspond to specific worksheet names so they're easy to find

8. automatic agent feedback to you at the end of the session, added to a doc that is also committed with the work, that you periodically ingest into an interactive session and improve your workflows

9. a tools or bin folder that contains python or bash scripts that the agent has skills to make to make its job easier (for example, I have an `agent_review` bash script that lets the agent kick off agent reviews via CLI without knowing each agent's particular incantations) ... docs on how to make scripts effectively, and instructions to constantly build these out more

10. periodic agent sweeps through recent commits, looking for problems / gotchas from a higher level across commits

11. a coding conventions doc that is just for specific coding conventions you want to see in the code base, your review agents use these a lot (but a lot of this should be in linters)

12. an agent loop / night shift skill for autonomous work, that lays out how the agent is to approach this, from an orchestration standpoint

13. a task queue that is accessible to the agent (mine is just a TODOS.md, but yours might be in Linear etc, with a CLI to fetch via API)

14. a periodic false-confidence test audit skill that looks for tests that aren't actually testing what you think they're testing, and that fix those

15. visual regression tests -- take screenshots, compare via tool and with agent visual review, commit with work (git lfs useful here) or at least push into the PR

16. automatic performance benchmark tests that notice when performance degrades

17. performance profiling tools that can be used by agents for targeted benchmarking, trying new techniques, comparing outputs, and comparing profiles

18. end-of-shift full validations, including running all tests, performance, agent reviews, sweeps, everything -- when you return, it's all as pristine as it can be

If you have all this, your agentic coding experience is going to be very different than dry prompting and manually guiding it toward the right thing every time.

[Ribera Maxime @RiberaMaxime]

@thsottiaux Discovering existing worktrees of a repo

[Ribera Maxime @RiberaMaxime]

@thsottiaux - Worktree management is terrible. We don't see the worktrees in the session list panel, and we can't even create new sessions for existing worktrees.
- Remote control is getting better, but there is still work to do
- loading / switching sessions is very slow

[Ribera Maxime @RiberaMaxime]

@thsottiaux Some MCPs are working in CLI but broken in App. Asked Codex to investigate, and it said the tools are not well exposed in the App

[Ribera Maxime @RiberaMaxime]

@jxnlco LSP pour CLI and App!

[Ribera Maxime @RiberaMaxime]

@simpsoka Codex App doesn't automatically detects worktrees created outside Codex App and having Codex CLI sessions. Would be great if it would!

[Ribera Maxime @RiberaMaxime]

@thsottiaux Regarding Codex App, it would be great to be able to configure reusable prompts, and to have access to experimental commands.

[Ribera Maxime @RiberaMaxime]

@thsottiaux Some Codex CLI sessions get lost. It happens everyday and this is really annoying. When I restart my terminal or my machine and I try to resume previous sessions in worktrees, there is nothing to resume.

[TANSTACK @tan_stack]

SECURITY ADVISORY — TanStack npm packages
A supply-chain compromise affecting 42 @tanstack/* packages (84 versions total) was published to npm earlier today at approximately 19:20 and 19:26 UTC. Two malicious versions per package.
Status: ACTIVE — packages are deprecated, npm security engaged, publish path being shut down.
Severity: HIGH — payload exfiltrates AWS, GCP, Kubernetes, and Vault credentials, GitHub tokens, .npmrc contents, and SSH keys.
If you installed any @tanstack/* package between 19:20 and 19:30 UTC today, treat the host as potentially compromised:
• Rotate cloud, GitHub, and SSH credentials immediately
• Audit cloud audit logs for the last several hours
• Pin to a prior known-good version and reinstall from a clean lockfile
Detection — the malicious manifest contains:
"optionalDependencies": {
"@tanstack/setup": "github:tanstack/router#79ac49ee..."
}
Any version with this entry is compromised. The payload is delivered via a git-resolved optionalDependency whose prepare script runs router_init.js (~2.3 MB, smuggled into each tarball at the package root).
Unpublish is blocked by npm policy for most affected packages due to existing third-party dependents. All 84 versions are being deprecated with a SECURITY warning, and npm security has been engaged to pull tarballs at the registry level.
Full technical breakdown, complete package and version list, and rolling status updates:
https://t.co/Zy8qG7PA9f
Credit to the security researcher for responsible disclosure.

[Ribera Maxime @RiberaMaxime]

@ryanvogel @opencode You're saving my life! I always paste text and want to edit, but can't because of this!

[Ribera Maxime @RiberaMaxime]

@thdxr I'm building it a bit differently with OpenDucktor
https://t.co/q6Q5eDqgtA

[Ribera Maxime @RiberaMaxime]

@zeddotdev - Autocomplete in package.json for easier dependency upgrade
- File git history

[Vercel @vercel]

We’ve identified a security incident that involved unauthorized access to certain internal Vercel systems, impacting a limited subset of customers. Please see our security bulletin:
https://t.co/0S939n3qHC

[Ribera Maxime @RiberaMaxime]

@MilksandMatcha I'm building an AI agent orchestrator named OpenDucktor (https://t.co/q6Q5eDqgtA). For now it supports only Opencode, but the next one is Codex.
A Codex Pro subscription would be super helpful ☺️

[Tibo @thsottiaux]

Our Codex dashboards are showing increased rate of users hitting rate limits and since we don't fully understand why I have made the cautious decision of resetting the usage limits for all plans. Enjoy.

I also wanted to celebrate us finding a pocket of fraudulent accounts that we banned and have helped us regain some compute. The fight against abuse never stops, but it's important to mark the moment and make it a little shared victory.

[Gerome Grignon 🅰️ @AngularDevsFr @GeromeDEV]

The @angular team released their own official Agent skills.

You can install them with this command:

npx skills add https://t.co/aAWKdP5GU2

#angular #agentskills #ai

[Ribera Maxime @RiberaMaxime]

@thsottiaux I wish Codex had slash commands, I hate having to turn them into skills to invoke them.
Also, having to use /skills, then select list skills, and finally select a skill is a pain when I want to invoke one. Would be great to be able to directly use skills as slash commands.

[David K 🎹 @DavidKPiano]

This is what it feels like when Claude is also writing all the code

[Tibo @thsottiaux]

This codex issue is now fully resolved and stable for the last couple of hours.

You have come to expect it, but yes, that means we will be reseting rate limits in a bit. Enjoy.

[Mitchell Hashimoto @mitchellh]

Ghostty 1.3 is now out! Scrollback search, native scrollbars, click-to-move cursor, rich clipboard copy, AppleScript, split drag/drop, Unicode 17 and international text improvements, massive performance improvements, and hundreds more changes. https://t.co/IMk3i6528t