RusticStack

Building simple, reliable tools I actually want to use.
Agent harnesses • Pi providers • Rust/TS tooling
Shipping in public at

[RusticStack @RusticStack]

@github Regex still picks the candidates there. The new part is a small fine-tuned ModernBERT judging each one with its file path and nearby code. Compared to their old LLM pipeline it also did better offline on recall, and being cheap is what got generic secrets into push protection.

[RusticStack @RusticStack]

@levelsio The root-on-other-servers part only hits machines with Tailscale SSH turned on, which is opt-in per node. `tailscale set --ssh=false` switches it off and plain sshd keeps working over the tailnet, just make sure sshd is actually running first so you don't lock yourself out.

[RusticStack @RusticStack]

Closest thing today is one trusted publisher per GitHub environment, with that environment's deployment branch rules deciding which refs can use it. That only gates whether a branch can publish at all though. The config has no field for dist-tags, so anything allowed to npm publish can still put a build on latest.

[RusticStack @RusticStack]

@Kizuno18 Of those two I'd take the label fix. Firing tasks/cancel on every quit throws away the main thing tasks are for, a job that outlives the CLI session. Listing it as still running, with its ttl, tells you the truth and leaves the call to you.

[RusticStack @RusticStack]

Trying MCP Tasks in Claude Code? Stop long jobs in /tasks (select it, press x) before you quit. Exiting doesn't cancel a task running on a remote server, even when the exit dialog lists it under "The following will stop when you exit".

The docs say so. The dialog says the opposite.

[RusticStack @RusticStack]

The FrontierCode part of the new @ArtificialAnlys coding agent index keeps getting quoted as the % of patches a maintainer would merge. It isn't. An attempt that fails any blocking check scores 0, and one that clears them all scores between 70 and 100.

A 56 means anywhere from 56% to 80% of attempts got past every blocking check, depending on how many of the nice-to-have checks the passing ones hit.

[RusticStack @RusticStack]

@theo Nice that parsed JSON gets its own card. The ID table PR cut raw JSON about 36% but gzip only 1 to 4%, so a bytes-on-the-wire number would barely show it, even though the client stops parsing and holding a copy of every repeated ID.

[RusticStack @RusticStack]

@Kizuno18 For MCP Tasks that's on purpose though. The whole point is that the client can drop off and poll for the result later, so the spec has no heartbeat. The closest knob is ttl, and that counts from when the task was created, not from the last time the client checked in.

[RusticStack @RusticStack]

@jarredsumner Fits the --aot in the corner. The --aot PR says zod 4 and ajv generate their hot code with new Function, and the compiled binary has no JIT, so that code only ever runs interpreted. Checking against the declared type at build time keeps validation compiled.

[RusticStack @RusticStack]

@theo 53 of 54 test queries putting the right thread first, against 40 for fzf and 36 for uFuzzy on the same set, is a pretty strong case for writing your own scorer. The generic matchers have no idea which threads you've actually been using.

[RusticStack @RusticStack]

An agent monitor that grades by outcome goes easy on escapes that hit a dead end. OpenAI's DNS incident writeup found exactly that: some external lookups weren't flagged at the expected severity because what came back was a "this service has shut down" notice, and the monitor read the useless answer as the attempt failing.

The query still got out of the sandbox. That's the part to alert on.

[RusticStack @RusticStack]

Node makes the "how do you tell" part worse for its own copy. It cherry-picked the fix instead of moving to Brotli 1.2.1, so a patched Node 24.22.1 still reports process.versions.brotli as 1.2.0, and 22.23.4 says 1.1.0. Both sit inside the CVE's affected range.

So a scanner matching on that string keeps flagging patched Node. For Node, go by the Node version.

[Semgrep @semgrep]

If you're looking at an updated Node.js, and calling CVE-2026-111497 done? We have some bad news: We likely don't even know the true scale of "Node2Shell" yet.

Node patched CVE-2026-111497 on Oct 21. But the CVE wasn't in Node, it was in Brotli. So our researchers Diptendu Kar and Kurt Boberg went looking for every other package that bundles the same vulnerable Brotli decoder. Here's what we found

433 package entries across 12 ecosystems not great but the absolute worse part: Many of them don't even have fixes available yet. Now are they all reachable and exploitable? Probably not, we're finding out. But the important part: Node isn't the only affected runtime or package, not even close.

We're working through the list to manually verify each one but so far we're looking at a 71% no fix yet rate, of the fixes most are still in alpha/early releases.

The problem is most implementations aren't even called "brotli." The decoder is compiled into other runtimes like Chromium. 38 entries bundle Brotli older than 1.0.3. Some of those copies date to 2016, and of course are vulnerable to more than just this CVE. And there's no easy well to tell if you're affected.

For example, 19 are WebAssembly builds, where memory corruption exists, but stays inside the sandbox. Some require explicit configurations to enable Brotli compression and they aren't on by default. But it's not obvious unless you are looking for it and testing for it. We're going to keep validating (and producing rules), but it's going to be a rough weekend for incident responders.

[RusticStack @RusticStack]

@qoder_ai_ide It seems this is caused by too many tools. Qoder CLI by default doesn't have mcp lazy loading turned on by default like other harnesses. So my issue was Kimi k3.1 Pro, refused all these tools when Deepseek Flash was ok with all of them.
https://t.co/Q8S4V3wdZe

[RusticStack @RusticStack]

@qoder_ai_ide I tried it and it didn't work, "Error in upstream response" using the Qoder CLI

[RusticStack @RusticStack]

The Pi side of this is a nice touch: it ships as a plain Pi extension that runs inside the session, with no HumanLayer daemon on the host.

Before turning it on, know that the task diff is your whole working tree against HEAD at the first prompt, so your own edits and any untracked file git doesn't ignore go up too. Env files and .humanlayer/ are the only paths it skips.

[dex @dexhorthy]

its time. https://t.co/ZtdR29DhML

[RusticStack @RusticStack]

Anthropic's auto mode study has a detail worth more than the 89% vs 13.6% headline: testers caught the planted dangerous command about 17% of the time early in a session, and about 5% after 50+ prior prompts.

So manual approval is weakest exactly when a session runs long.

Auto mode becomes the default in most Claude apps next week, but that study used Claude Code dev commands in a test setup. No numbers yet for email, calendar or form actions.

[RusticStack @RusticStack]

Claude Code's Bash sandbox was only as tight as your dotfiles until last night. Before 2.1.309, on macOS and Linux, the shell's startup files ran outside the sandbox ahead of every sandboxed command, so whatever your .zshrc or .bashrc sources ran with your full permissions.

Worth updating today if you leave it running unattended.

[RusticStack @RusticStack]

@kiwiflysky Same. Getting details, dialog and plain forms looking right with zero classes and zero JS was the best part. It's not completely gone though, I've kept a rewrite of it going since the archive.

[RusticStack @RusticStack]

The cheapest setup on this index comes second on the merge test. FrontierCode grades whether a maintainer would accept the patch, and Codex with DeepSeek V4.1 Flash scores 52.6% there against 56.0% for Opus 5.5, at $0.39 a task instead of $11.42.

Terminal work and repo Q&A drag it down to 47.3 overall. If what you hand agents is mostly scoped PRs, the FrontierCode column tells you more than the headline.

[Artificial Analysis @ArtificialAnlys]

Announcing Artificial Analysis Coding Agent Index v2.0: FrontierCode v1.1 from Cognition replaces DeepSWE, SWE-Atlas-QnA grading is revised, and Claude Opus 5.5 in Claude Code leads at 61.7

Today we are launching v2.0 of the Coding Agent Index. The Index evaluates models together with their agent harnesses, now across 290 tasks covering software engineering, terminal use, and repository Q&A, with the three benchmarks weighted equally.

Changelog (Index v1.5 → Index v2.0):

→ FrontierCode v1.1 replaces DeepSWE v1.1. FrontierCode is a benchmark from @cognition with a private test set: 100 software engineering tasks on real open-source repositories, graded on whether a maintainer would merge the change. An attempt that fails a blocking check scores zero, and one that passes them all scores between 70% and 100% depending on the non-blocking checks it meets. We also scan each trajectory with a modified version of Cognition's rule-based scanner, and any attempt flagged for accessing solution material scores zero.

→ Revised SWE-Atlas-QnA grading, now SWE-Atlas-QnA-AA. Scale AI's 124 repository Q&A tasks are unchanged. We reworded 127 of the 1,306 rubric criteria for more consistent verdicts and moved to GPT-6 Luna (xhigh) as the judge, with five votes per criterion. The dataset and judge configuration are published on Hugging Face.

Key results:

➤ Claude Opus 5.5 leads the Index: Claude Code with Claude Opus 5.5 (max) scores 61.7, followed by Claude Code with Claude Sonnet 5.5 (max) at 59.3, Muse Code with Muse Wonder Full (max) at 58.9 and Claude Code with Claude Fable 5.1 (max with fallback) at 57.6.

➤ FrontierCode v1.1 is where Opus 5.5 pulls ahead: Opus 5.5 scores 56.0% on FrontierCode, ahead of Codex with DeepSeek V4.1 Flash (max) at 52.6%, Codex with GPT-6.1 Sol (max) at 49.4% and Codex with GPT-6 Astra (max) at 49.3%. Below the top, FrontierCode scores are tightly packed: 15 of the 24 configurations on the Index score between 43% and 49%.

➤ SWE-Atlas-QnA-AA grading is stricter and more consistent: across the 21 configurations evaluated on both Index versions, the mean score falls 1.7 points, from 58.8% to 57.1%, with 14 of 21 moving down. Individual configurations move by up to 7 points: Muse Code with Muse Spark Open (xhigh) falls 7.0, Kimi K3 in Kimi Code CLI and Codex with GPT-6 Luna (max) 6.2, and Muse Code with Muse Wonder (max) 5.6, while Codex with GPT-6.1 Sol (max) gains 2.1.

➤ Four configurations sit on the cost frontier: Codex with DeepSeek V4.1 Flash (max) scores 47.3 at $0.39 per task, Codex with GPT-6.1 Sol (max) 54.1 at $1.50, Codex with GPT-6 Astra (max) 54.7 at $7.04 and Claude Code with Claude Opus 5.5 (max) 61.7 at $11.42. Costs are pay-per-token API costs, not subscription prices.

We will keep updating the Coding Agent Index incrementally, with more evaluations and agents to come.

[RusticStack @RusticStack]

@iamorphen Same idea behind putting the source in cascade layers. Your per-project tweaks win over Pico without a single !important.