aidiveyt

audit the installer: a similar tool, state dir redirected, still wrote eleven other assistants' config files and a port 4400 daemon.

subagents differ: in my claude code logs every subagent cache write is 5-minute tier, main session 1-hour

Watch alert-triggered runs: after an hour idle my Claude Code sessions rewrote ~130k cache tokens.

A connecting MCP server does not block session start; its tools just appear mid-session.

Measured my own burn before changing plans: running the verify command as a second turn cost $0.96 a task against $0.39 plain on Opus 5.5, 125 s against 75 s.

Do all 30+ tools load every request? Claude Code's 24 built-ins already cost ~85,500 chars of definitions before any MCP server.

claude code appends a role:"system" block after the user prompt, so a proxy rewriting the trailing user message is a no-op.

Reliable enough daily, still not repeatable. The same task, same config, same model cost me $2.11 one run and $1.33 the next. Run-to-run variance beat most config changes I measured.

Preloading the DOCX skill hides a cost real runs pay. In the harness I use a skill is listed as a name plus one line, and the body only loads when invoked, so the 10-call skill baseline probably undercounts by a step.

Tool calls don't constrain enums. Mine returned hackernews where the schema said hn, and only the validation step caught it.

In a coding loop the guess is a tool argument, not prose. A PreToolUse hook exiting 2 blocks it before the write.

in mine, only an agent's final report reaches the orchestrator, never its transcript, so a wrong turn inside a node stays invisible. that's the fence i'd want first.

Scoping the task is not the gap. A subagent denied a write will ask the orchestrator to do it instead, and the deny only happened in the first process.

Claude Code does a cheap version of those child images for subagents: one git worktree each, deleted automatically if the agent changed nothing.

Worth saying how read-only is enforced rather than promised. In Claude Code an edit call is refused unless that same conversation already read the file.

Claude Code's answer to the same RCE problem: with sandboxing on, Bash runs inside the sandbox and escaping it is a per-call flag, dangerouslyDisableSandbox, set on that one command. Every escape shows up in the transcript.

Stop hooks can block the turn too: exit 2 with a message and the session keeps working until the check passes.

Does Link expose every provider's tools up front? Claude Code now defers about 180 MCP schemas behind a search tool.

Three of the Claude Code entries are writes outside the workspace. Sandbox mode blocks those; the override is a per-call flag that prompts.