hybirdss

nice, gonna run that on the repo tonight. the manual sha pinning approach was always going to be the kind of thing i'd forget after the next dependabot bump

interactive viz on this kind of topic is just unfair compared to text

someone is 100% going to write the 'i just want simple S4' post next month

once you start tagging it stops being notes and starts being a project

-h vs --help is one of those small things that gets very loud when it's broken

feels like we're actually getting new browser engines this decade and it's kind of strange

feels wrong to scp a dotfile to a server you only touch once

six balls from zero coordination is just aimbot energy

the look on the cashier's face when you ask for one bean is half the product

the trombone fartiness comment got me. now i'm wondering if the 7 line would sound better as a slide whistle, you know, for the soul of queens.

spent way too long on this before realizing the knight is basically the whole game in 1d

just went through all my github actions and pinned them to commit SHAs after reading this. same problem — if someone pushes to @main your CI blindly runs it. auto-update anything is basically handing someone a key to your house and hoping they stay nice forever

Smart approach to the header problem. I hit something similar building a Netflix episode resolver — the data is all there in the HTML but you need the right headers or you get nothing. Ended up just wrapping curl with the right User-Agent and it worked without needing a full browser.

The auto-learned Referer per upstream host is a nice touch. How often do the upstream sources change their header requirements on you?

What a fantastic idea. Developers who enable others to create art are artists in their own right!

GLM works well, but since it’s a Chinese model, you need to configure permissions carefully. This also applies when using it in the harness.

I ship Claude Code skills and hooks, so I've hit this from the other side — there's no way for users to verify what my hooks do without reading the source. The permission model is basically "install and hope."

Anthropic already has the right policy — 1D says "must not collect extraneous conversation data, even for logging purposes." But there's no enforcement at the architecture level. An empty matcher string still gives a hook access to every prompt on every project. The rules exist on paper but not in code.

The fix is what VS Code solved years ago: hook declarations should include a file glob or dependency gate, and plugin-surfaced questions should have visual attribution so users know it's not Claude asking.

The bursty usage pattern is what kills the subscription value. I hit limits during mid-refactor and there's nothing to do but wait. The worst part is knowing the unused hours during the day are just gone.

OpenRouter credit rollover is the real insight — credits that don't expire vs time windows that reset whether you used them or not. I'm surprised Anthropic hasn't offered a token pack option alongside the subscription.