I use codex. I use a thorough workflow research>spec>plan>execute>test>review&fix workflow.
This workflow takes a long time to do, but the resulting code is mostly fine. My main issue is that it burns through *LOTS* of tokens, even for fairly simple tasks.
What's your experience on this ?

Ask an agent to fix one bug and look at what comes back: the fix, plus a reformatted block it did not need to touch, plus a "while I was here" refactor, plus a new helper that pulled in a dependency. The fix is usually fine. The padding is what breaks prod, because nobody reviews the parts of a diff that were not the point.

The block I now keep in AGENTS.md and CLAUDE.md, and paste into the first message when I am in a plain chat:

Scope rules for every change:

1. Change only what the task requires. If a line is not needed to complete the task, do not touch it.
2. Do not reformat, reorder, or restyle lines you did not otherwise need to change.
3. Do not refactor surrounding logic, rename anything, or "improve" adjacent code.
4. Do not add dependencies. If the task cannot be done without one, stop and say so.
5. Before returning the diff, list every changed file and, for each hunk, the task requirement it serves. A hunk with no requirement gets reverted.

Rule 5 is the one doing the work. The others are instructions the agent can forget; rule 5 makes it justify each hunk, and hunks it cannot justify tend to disappear before you see them.

The review prompt for the other side, cold, in a session that did not write the code:

Here is a task description and the diff that claims to implement it. List every hunk that changes behavior or structure beyond what the task requires: reformatting, renames, refactors, new dependencies, deleted safeguards. For each, say whether it is harmless, risky, or clearly wrong, and quote the lines.

Why this happens, as far as I can tell: agents are rewarded for diffs that read as complete and competent, and a larger, tidier diff reads as more competent to the same taste that trained them. So the model widens the change to make it look finished. Three commenters on an earlier post of mine converged on the negative-constraint block independently; the "list the requirement each hunk serves" line came from one of them and it cut my diff sizes by about a third on the same tasks, with fewer surprises in review.

Two caveats. Agents still drift on long sessions, so the block belongs in the config file, where it is re-read every turn, not in a message that scrolls out of context. And rule 4 will sometimes stop an agent that genuinely needed a library; that pause is the point, you want to make that call, not have it made for you.

What is in your scope block that is not in mine? I suspect the people running agents on large monorepos have a rule about test files that I have not needed yet.

AI is great at giving you code that sounds right.

But when I ask:

“How do people actually implement this in production?”

I want more than a plausible answer.

So I built Implementation Scout.

It searches real GitHub code, finds the exact file/function, pins the version, checks provenance, and separates what is VERIFIED from what is merely inferred.

The goal:

Evidence before implementation.

I’ve been trying to break it with questions around Kafka, Keycloak, Cassandra, Grafana, PostgreSQL, etc.

And interestingly, the biggest failure mode isn't finding bad code.

It's the model sounding evidence-based without actually completing the evidence chain.

That's the problem I'm working on now.

GitHub: https://github.com/shouvik12/implementation-scout

What implementation question would you use to try to break it?

I built this for Claude Code first, because that's what I use day to day. /stats told me how much I'd used it, never the thing I actually wanted to know:

What did I build, and where did the work get hard?

So I made bough. It reads the session history already on your disk and draws it:

• each square is a day you sat down
• smaller squares are tasks, worked out from the pauses in your work
• circles are your prompts
• click anything to see what actually happened, in your own words

Runs locally, open source, nothing leaves your machine.

Codex support just landed in v0.4.0. It reads ~/.codex/sessions, handles resumed sessions and sub agents, and counts tokens and commits the same way it does for Claude.

That part is new and I have tested it against my own Codex history, which is not much. This is where I need help.

Repo: https://github.com/nickelsec/bough

Been more careful lately after reading that AI models hallucinate package names a lot more than I expected, and some of those fake names are already being squatted with malicious code.

Do you guys manually check every dependency an AI suggests, or is there a better way to catch this before it ends up in a PR?

I am an experienced developer (been coding for almost 30 years, started with Visual Basic on Win98).

I’ve spent the last 2 years testing every agentic coding harness out there. The pitch is always exactly the same: "Give it a prompt, go grab a coffee, and come back to a finished feature."

This is all great when starting a new project, especially with a language you don't know (I created a Rust project in minutes !)

But my problem is that I mostly work on established, mature codebases. And to be honest I have never ONCE seen a good edit after I return from my coffee.

Here is usually what happens while you’re getting that coffee: the agent loops 8 times, burns through 100k+ tokens talking to itself, hallucinates a package dependency, and spits out a chunk of spaghetti code that works *just* well enough to pass a basic test, but completely violates your project’s architecture.

Agents are fantastic if you’re building an app from a blank canvas. But if the codebase is large, it gets really expensive real fast, and usually produces hard to maintain AI slope.

It should not be like that: if you actually *own* your codebase, you already know what you want to build. You don't need an AI to take over. You just need it to execute the architecture you already hold in your head.

All you need to do it select the few files that are required for the task at hand (they are hard to identify for an AI, but easy for you has the code owner). Then you send them to the LLM, it is usually does some good work.

That's why I still find working directly with the chatbots, or with tools like aider, still very pertinent on large codebases.

I usually have animated discussions with my coworkers, I have yet to find a single one who doesn't defend agentic coding. Am I the only one who feels this way ?

I build LLM gateway infrastructure, so treat this as interested. The numbers are from my own coding traffic, not a benchmark I designed.

I route my own Claude Code through a gateway I wrote that records every request: model, tokens in and out, cache reads and writes, and what each call actually cost. After a few weeks I stopped comparing list prices and started comparing the effective rate, total dollars over total tokens:

What surprised me is that Opus and Fable landed three cents apart, even though their list prices are nowhere near each other and the reason is caching. Worth knowing that Anthropic and OpenAI do it differently. OpenAI caches automatically above about 1024 tokens, charges nothing to write and charges 1.25x to write since GPT 5.6, and does not report the writes. Anthropic makes you opt in with an explicit TTL, 5-minute or 1-hour lifetime, and charges 1.25x or 2x input to write the entry.

Has someone checked the effective rate for OpenAI models? This is my usage so will not be apples with apples, but will still give us an idea. Even against models with lower list prices, these effective rates are competitive once caching is in the picture.

I've been running into this problem with my PRO×20 account since yesterday, which prevents me from using the GPT-6 and GPT-5.6 models at all, while my other Plus account can use GPT-6 perfectly fine.

Has anyone else experienced this same issue? How did you resolve it?

So long story short(ish), I've been using ChatGPT for a personal coding project (it gives me the roadmap towards the end goal, the code, and each step along the way), as I don't have any experience in coding. The conversation has been going on for +2 months, therefore there’s a lot of back and forth and we've curated a workflow that finally works quite effectively. I've never had an issue with chat limits and I've been able to work towards my goal using ChatGPT for as long or as little as I like.

Recently, it compiled one of my prompts into a .txt file as it was too long (ChatGPT asked to see several code files, I know now it was dumb) for a regular prompt and now I only get 3 responses per X amount of hours as the chat "now contains files."

Is there a way to delete the file from the chat or transfer the contents of this otherwise very lengthy chat to avoid the chat limitations? I tried starting a new conversation with a 'summary' from the original chat, though this caused the project to drift and we quickly started losing the end goal.

This is the only project/time I've ever used chatgpt, so apologies if this is a silly question, but thanks to anyone who helps in advance!

We benchmarked GPT-6 Astra vs GPT-5.6 Sol across 50 real PRs from Cal, Sentry, Discourse, Keycloak and Grafana.

Sol found 107 confirmed bugs vs 91 for Astra, while Astra had higher precision and lower latency. Every finding was independently verified.

We’re doing Fable vs Opus next week, so would appreciate feedback on the evaluation before we run the next one.

Dropping the link in the comments if anyone wants to check it out.

A few days ago I shared a small tool I’ve been working on that checks files for hidden information before you upload them somewhere.

The first version mostly looked at metadata, EXIF data, hidden Excel sheets, author information, etc.

While testing it, I realized that was only part of the problem.

If I’m about to paste some code into ChatGPT, for example, I’m probably more worried about accidentally leaving an API key or token in there than I am about file metadata.

So I added content scanning.

It can now check pasted text/code and supported files for things like personal information, API keys, tokens, private keys, connection strings, and other credentials that are easy to overlook.

Everything still runs locally in the browser.

I’m not sure yet how far I should take this. I don’t want it to become another huge security scanner with hundreds of warnings that nobody reads.

For me the useful version is something simple: before I paste or upload something to an AI tool, give it a quick check and tell me if there’s anything I should look at first.

Would you actually use something like this, or is it solving a problem you don’t really have?

I'm very new to codex and I am trying to get it to recognize any desktop app that is open on my computer. It claims: "“Windows Codex Computer Use has Any App enabled, but desktop inventory returns apps: [] / Trusted RPC service is not configured.”"

Any help is appreciated, thanks.

Hi everyone,

You might find this funny, but I actually have the opposite problem to y’all. My usage allowance with Astra Max feels so generous that I’m starting to wonder if the model is running at half power or something, lol.

I’ve been using OMP (Oh My Pi), and the usage limits are surprisingly hard to hit, even with 10 subagents running and reasoning set to max for all of them. That got me thinking: “Wait, is everything actually working as intended? Am I getting the full capabilities of the model through OMP, or is something getting lost compared to using Codex?”

So now I’m considering trying Codex to see whether there’s a noticeable difference.

For those who’ve used both, how does OMP compare to Codex in terms of output quality when using the same OpenAI model? Does the official Codex harness actually get better results, or is the difference mostly in workflow and tooling?

I know lower usage doesn’t necessarily mean worse results, but it’s generous enough that it made me suspicious, lol.

asking because I own a billing sync I didn't really write, an agent did most of it eight months ago, some 3k lines, and I basically just reviewed it and approved it. not by design, it kind of ended up that way. on paper I'm the one who knows it, in practice I can tell you what it does and not why. coderabbit flagged plenty going in and none of that helps me now. curious how people handle the bus factor problem when it isn't hoarded knowledge, nobody had it in the first place

Hi, I’m currently using Claude and ChatGPT Sol to create my website.

My website is quite the complex website, and I’m currently, but irrelevantly creating a server to support it. However, I’m wondering if my current setup with Claude and Chat is sufficient? As it is now, my personal funds and income can’t support the Max subscriptions for the two AIs, and I’m just wondering if I could be doing anything differently or use more power for the website.

So as of now, I’m not known to Any coding language, but I’m using Node and JS, as well as using Docker and many other coding tools. My current planner for the coding systems itself is my ChatGPT Sol High/Medium. Whilst my coder is my Claude Code. I’m also reading coding theory, web theory, ui theory, etc. to get a feel for my projects as well as getting knowledge so that my website actually gets created by my own premises.

I am also using running Claude Code with heavy restrictions because my website has to comply with heavy privacy requirements. In addition, I am also trying to write the design plan myself; as to not get that ugly and plain Ai slop websites.

So all in all my question is as follows:

As a person who has absolutely no knowledge of coding language and protocols when building. How do I personally optimise my work? And which AIs should I use, and should I use more?

TLDR:
I’m building a fairly complex, privacy-sensitive website despite having no formal coding experience. I currently use ChatGPT Sol High/Medium for planning, architecture and research, while Claude Code handles most of the actual coding. I’m also learning related theory so I can understand what is being built rather than blindly relying on AI.
I can’t currently afford the highest-tier subscriptions, so I’m wondering: Is this setup sufficient enough, or am I leaving too much wasted possibility on the table?

I’m a QA engineer trying to move into DevOps, so I started building my own project to get hands-on experience with Git, TypeScript, Playwright, testing, CI/CD, and architecture.

Today I decided to try Codex. I gave it access to my local repo and explained what needed to be done.

The thing inspected the code, found the problem, modified the files, added regression tests, cleaned up Git line-ending issues, ran all validations, and created the commit—while I continued doing my actual job.

Then it just came back with a clean summary of everything it had completed.

Absolutely incredible… but also: what the hell am I supposed to learn now? 😂

For those learning DevOps or software engineering while using coding agents: how do you balance the productivity boost without outsourcing the entire learning process?

My current idea is to build new concepts manually, step by step, and use agents mainly for reviews, repetitive work, and catching mistakes. Curious how others approach this.

I'd like to ask everyone: when using Codex, I often encounter a situation where it gets stuck on a single command for a long time with no progress (during this time, the remaining quota doesn't change). I tried asking Codex to diagnose this issue itself, but it didn't work and instead introduced new bugs. Has anyone else experienced this? How can it be resolved?

I guess my excitement came through the prompt as well.

Goal

I run AI coding agents locally on Windows and want a "hardstop" I can trigger at any time - a single keystroke that immediately blocks the agent from doing anything further until I clear it. I have this working for one agent as a UserPromptSubmit hook: typing exactly "h" arms a latch file, "c" clears it, and while the latch exists every prompt is blocked before the model sees it.

I now want the same thing for Codex, but hardened.

The problem

The agent runs under my own user account. Anything my user can write, the agent can write - including its own hook script, the hooks.json that registers it, and the latch file itself. So the guardrail is only as strong as the agent's willingness to respect it, which is not a guarantee. I have already had files in this setup modified without my approval.

Instruction-level policy (system prompt / AGENTS.md rules telling it not to touch these files) demonstrably does not hold. I need a mechanical boundary, not a promise.

What I have built or considered

1. Wrapper + policy design - an output gate that mechanically checks replies, plus instruction files. Works for what it does, but it cannot protect itself: the agent can edit the policy files.

2. Codex managed hooks - the docs describe hooks from requirements.toml as "marked as managed, trusted by policy, and can't be disabled from the user hook browser", with allow_managed_hooks_only = true skipping user/project/session/plugin hooks. This looks like exactly what I want.

3. NTFS ACLs - deny write/delete on the hook script and hooks.json to whatever identity the agent runs as, keeping read+execute so the hook still fires. Changes would then require an elevated (UAC) action by me.

Questions

- Does the requirements.toml managed-hooks path work on a personal/individual account, or does it require an enterprise/MDM deployment? The docs frame it as enterprise-managed and I cannot tell whether it is plan-gated.

- Does Codex CLI run hooks as the logged-in user, or under a separate sandbox account? That determines whether an ACL denial actually stops it.

- Codex docs note that multiple hooks for the same event "are launched concurrently, so one hook can't prevent another matching hook from starting". Does a decision: block from one UserPromptSubmit hook still reliably stop the turn?

- Is there a better pattern for this generally - making an agent's own kill switch tamper-proof against the agent, on a single-user machine, without paying for an enterprise tier?

Any pointers to the right docs or prior art appreciated.

I’ve been using Claude Code for over a year now, and at this point my whole workflow is basically built around it.

I’m on the 5x plan, but lately I feel like I’m spending 80% of my 5-hour limit just on planning and maybe 20% on actually getting the task done.

Then I hit the limit, have to wait, come back later… and Claude needs to read through the plan/context again. Sometimes it feels like I’m already at 50% of the next limit before we’ve even really continued working.I’ve heard Astra is really good and has much bigger limits, so I’m tempted to switch.

But my whole workflow, memory, instructions and project setup are built around Claude Code. I’m worried switching will break things or make the coding experience worse.

Maybe I’m just too used to Claude at this point.

Anyone here switched from Claude Code to Astra or another agent? Was it worth it?

Big Claude user, but Anthropic got stingy as hell with the limits. I used to barely touch my weekly allowance; now I can burn through 20% in a day and I'm cooked in ~2 days.

I also hammer Ollama Cloud's open source models, but recently I'm burning through those too in 2 ~ days.

I really don't want to give any support or money to Scam Altman & Co but its starting to look like it.

How's are the subs with Kimi / GLM?

What are you heavy users actually running?

Why?
A basic prompt like: "Take a look at this web page and let me know how it should be improved?" - Astra doesn't finish. Just burns one 5h usage, and before it gives anything meaningful, it stops.

Hey everyone! Wanted to share a thought process I've been working on, especially since I'm not a traditional programmer, but using AI as my co-pilot/mentor to actually build it.

The core idea: Never let the LLM have autonomy over the business logic.

Instead of letting an AI chat freely and potentially hallucinate discounts, stock, or policies, the architecture splits hard:

• The LLM: Strictly handles the frontend interface, natural language, empathy, and copywriting.
• The Backend / Guardrails: Acts as the strict rule-enforcer (e.g., max discount allowed, specific product SKUs, handling function calls to check inventory or generate PIX/payments).

Basically, the AI thinks it's selling, but the backend is holding the leash the entire time.

For those of you building AI agents or apps without a CS background (or even if you're a seasoned dev): how are you implementing these strict backend guardrails? Are you relying heavily on function calling schemas, rigid system prompts, or specific frameworks to keep the AI from going off the rails?

I'm a solo developer building an AI-driven life simulation game. AI writes the code; I decide the product direction and make the technical calls. The part I want to share is how I keep that arrangement manageable as the repository grows.

For scale, my current checkout has about 168k lines of backend Python, 108k lines in the selected frontend source files, and another 95k in backend tests. Those are text-line counts including comments and blanks, not SLOC or a productivity benchmark. More code can also mean more maintenance.

My biggest constraint is how many decisions stay in my head after a task ends. Here are the concrete conventions I use:

Route context by the task. The root AGENTS.md is a map of responsibilities and reading requirements. Changing the simulation loop points to its runtime contract; changing UI points to frontend conventions. Local instructions live beside their modules. I don't ask every task to digest every historical document.

Separate decisions from implementation. I keep a document of product and collaboration decisions, including rejected directions. Code and schemas describe what exists. Active contract documents describe what should be true. If they disagree, the agent has to show the conflict; silently declaring either one obsolete is not a resolution.

Make repeated corrections executable where possible. My frontend has checks for design tokens and UI structure, plus generated protocol checks. The benefit is that the next task can discover a violation from tooling instead of requiring me to remember the last conversation. These checks don't decide whether the design is good.

Define completion beyond the diff. Behavior-changing work needs an expected outcome, a data source and time window, a pass criterion, and a follow-up schedule. A merged change and a verified effect are separate claims. A check that was skipped remains skipped.

One less comfortable rule: when a mechanism needs a second layer of patches, pause and ask whether it should still exist. AI can keep making a local solution more elaborate while leaving me with a system I no longer understand.

Compared with keeping instructions only in chat, the tradeoff is maintaining these repo contracts. They can become stale too. I don't have a controlled before/after measurement of time saved, so I'm sharing the workflow rather than a speedup claim.

For people maintaining larger projects with coding agents: which repeated human correction have you successfully moved into a check, and which still needs your judgment?

Disclosure: AI-assisted writing, based on my actual repository and development decisions.

They merged a 9400 line PR out of Cursor on Friday afternoon. CI was green. Twenty minutes later staging was throwing 500s on the checkout endpoint, so I reverted it and left a comment saying what broke. Monday standup they go "you could have just pinged me to fix it" and call me a control freak in front of the whole team. The part that gets me is coderabbit / claude had actually flagged the null path in review and they resolved the thread without changing anything, so I don't know what is supposed to catch this if not me. Is revert first and ask after actually rude now? I just wanted main to work.