Notes from the studio.

Turn an intermittent API failure into a reproducible report using Chrome 152 request resending, payload inspection, and controlled experiments.

npm packages can now trust multiple CI workflows. Use this seven-check preflight to separate stable, prerelease, and staged releases without restoring long-lived tokens.

OpenAI's newest model crossed a cyber capability threshold no broadly deployed model had reached. Here is what that means for builders, defenders, and agent operations.

Two late-August releases changed how coding agents persist and where they execute. Here’s the practical split between Cursor’s self-hosted workers and VS Code’s Agent Host.

Cloudflare changed `/crawl` on August 31, 2026: it now enforces `use` from Content Signals. This playbook shows how to stop 400s without fighting a site's robots.txt.

Vercel’s late-August releases were not just more agent features. They packaged identity, scoped access, sandboxed execution, and human approval into a clearer production stack.

Next.js 16.3 makes SPA-like navigation practical in App Router apps, but the real work is choosing what to cache, what to stream, and how to invalidate it safely.

Mistral's August 20 launch matters because it treats retrieval as a navigable workflow, not a better chunking trick. That changes where teams should spend effort in enterprise AI stacks.

OpenAI’s August GPT-5.6 updates made model routing a practical cost lever. Here’s a simple playbook for splitting coding-agent work across Sol, Terra, and Luna.

Anthropic's August 27 MHS preview is less about flashy robots and more about a standard driver layer that could make lab and factory agents usable sooner.

Google's August 2026 Gemini updates point to a tighter agent loop: a cheaper workhorse model, broader connected apps, and usage numbers that show consumers are already taking action through AI.

Vercel’s recent ACP-compatible harness update makes HarnessAgent the right seam to standardize now. Here is the smallest safe setup for swapping coding runtimes without rebuilding your app.

Between August 11 and August 18, 2026, GitHub shipped a tight sequence of Copilot changes that made one strategy obvious: model choice, plugin portability, and admin controls now ship together.

This week's AI news was not another model leaderboard jump. OpenAI and Mistral both moved the market toward data control, regional control, and capacity guarantees.

Hugging Face's August open-model data points to a near-term shift: agent traffic, local multimodal models, and calibrated memory are becoming the real battleground.

OpenAI's August 2026 cyber updates were really one story: capability crossed a threshold, access narrowed, monitoring expanded, and frontier training slowed to let safeguards catch up.

Agent Plugins 1.0 turns skills and MCP servers into one portable package. Here are the eight questions that matter before you adopt it.

Vercel's August 12, 2026 CLI update makes AI Gateway setup for coding agents much simpler. Here's the shortest safe path for routing Codex and Claude Code through one gateway.

Cloudflare's August Agents Week turned agent infrastructure into a concrete stack: runtime, browser, tracing, and guardrails. Here's what actually shipped and what is still preview-only.

GitHub's stacked PR preview and new `$/` Actions syntax landed on July 30, 2026. Here's a practical rollout plan for smaller reviews without breaking CI.

Google’s latest Gemini updates show a clear shift: the product race is no longer just about better models, but about managed runtimes, guardrails, scheduling, and connected apps.

GitHub's July 17, 27, and 28 changes finally make the Copilot app governable and measurable. Here is a practical rollout audit loop for engineering teams.

A practical AI News comparison of how Google and OpenAI turned agents into scheduled, budgeted systems in late July 2026.

GitHub quietly rewired Copilot reporting in July 2026. This field guide shows which new dashboards and API reports matter, what each one answers, and the fastest way to spot waste or adoption gaps.

Cloudflare's July 27 MCP update looks bigger than it is. This guide separates the real migration work from the legacy baggage you can drop.

Between August 10 and 11, Vercel removed three setup bottlenecks: sandbox bootstrapping, connector creation, and token debugging. Here's the engineering impact.

GitHub’s August 2026 Copilot app docs make one thing clear: the fastest workflow is usually a slash command, not a longer prompt. Here are seven worth learning now.

Hugging Face, OpenAI, and CSA have now published enough detail to turn July's agent intrusion into an engineering checklist. Here are the five changes that matter.

GitHub’s July 27 Copilot policy split changed rollout strategy. These six guardrails help you enable the app and cloud agent without opening every repo to ad hoc automation.

Google turned Flash into a three-lane lineup in late July 2026. This field guide explains which model to route to for default agents, cheap fan-out work, and security-heavy scans.

Cloudflare open-sourced `pvcli` on July 27, 2026. Here’s when plain `curl` is still enough, and when the new CLI saves hours once OHTTP and MASQUE enter the picture.

Vercel quietly shipped two useful AI Gateway upgrades on July 27: WebSocket transport for OpenAI Responses and regional inference. Here is the lowest-risk way to adopt both.

GitHub spent late July turning supply-chain hardening into defaults: a three-day Dependabot cooldown, broader malware alerts, and held Actions runs.

VS Code 1.130 shipped on July 22, 2026 with agent-host upgrades, assisted approvals, and faster review flows. Here are the five switches worth trying first.

Between July 16 and July 21, 2026, Hugging Face and OpenAI turned an unusual breach into a concrete playbook for teams building long-running AI systems.

Cloudflare's new `createTestHarness()` API lets you run integration tests against real Worker builds. Here is the fastest migration path from `unstable_dev` without losing Playwright or MSW coverage.

Between July 16 and July 21, 2026, Hugging Face and OpenAI turned an unusual breach into a concrete playbook for teams building long-running AI systems.

A Thursday field guide for turning Supabase's July observability releases into a practical logs-plus-metrics incident workflow.

From stateless MCP to held workflow runs, GitHub tightened its automation stack between July 23 and July 28, 2026. Here are the five layers engineering teams should actually care about.

OpenAI added organization and project spend limits on July 20, 2026. Here is the practical rollout order that keeps alerts useful and production failures intentional.

OpenAI Presence and Google’s latest enterprise numbers point to the same shift: AI agents are being judged less by demos and more by governed work completed in production.

Next.js now has a scheduled security cadence. Here are the six assumptions that will slow your patch response, and the checks to run before you ship.

This week's clearest AI story was not a faster benchmark. It was vendors packaging models into tightly scoped jobs with connectors, policies, and role-specific workflows.

A practical incident-response workflow for tracing Vercel feature-flag revisions, semantic diffs, environment changes, and rule ordering from the CLI.

Supabase Pipelines hit public alpha on July 21. This playbook shows how to ship a low-risk BigQuery pipeline, what the new schema support covers, and where the sharp edges still are.

Go's July 7 dual patch release looked routine, but it quietly tested two of the platform's newer security promises: safer file access and more private TLS handshakes.

Google's July LiteRT.js launch makes browser AI more practical, but the real wins come from six setup rules around Wasm hosting, backend choice, testing, fallback, and memory cleanup.

In 9 days, Anthropic, Google, and OpenAI each added a different trust layer: public scrutiny, grounded retrieval, and outcome economics. Here’s the stack taking shape.

VS Code's new instruction-file stack is powerful, but easy to overcomplicate. This playbook shows a minimal rollout for AGENTS.md, CLAUDE.md, and scoped instructions.

From Google’s agentic June recap to GPT-Live, ChatGPT Work, and Meta’s Muse Image rollback, this was the week AI interfaces stopped looking like plain chat boxes.

Google moved Conductor from a Gemini CLI extension toward a portable plugin on July 16. Here’s what that changes now, what stays the same, and where the rollout is still transitional.

MCP’s July 2026 release candidate changes state, auth, and scaling assumptions. This playbook shows how to rehearse the upgrade with Inspector, tighter scopes, and safer remote permissions.

Node's July release cadence created a real fork: move to `26.5.0` for new platform features, or stay on `24.18.0` and `22.23.1` for steadier production upgrades.

VS Code 1.128 shipped on July 8, 2026 with stronger agent workflows. This FAQ breaks down which features are actually worth rolling out this week.

Meta did more than ship another model on July 9. It turned Muse Spark 1.1 into a pricing, distribution, and platform move that signals a new phase in the AI race.

Gemini CLI, Codex, and Copilot CLI all shipped updates on July 8-10. Here’s a practical seven-rule playbook for keeping fast-moving coding agents stable in real teams.

Ecma approved ECMAScript 2026 on June 30. A copy-paste cheat sheet of all seven new features, from Array.fromAsync to Math.sumPrecise, with the utility code each one deletes.

Anthropic's new Reflect dashboard is more than a recap screen. It turns AI usage into a product surface, with real implications for memory, privacy, and healthier defaults.

OpenAI's GPT-5.6 family hit GA on July 9. We check six launch-day claims about Sol, Terra, and Luna against the pricing, benchmarks, and early hands-on reports.

Kiro packed budget controls, MCP auth fixes, and agent hooks into one July release window. Here is what actually matters before your team pilots it.

The open-source terminal agent just took the top spot in July's dev-tool rankings. We score it against Claude Code on model choice, pricing, DX, ecosystem, momentum, and lock-in.

Mozilla's 0din showed how a clean-looking repo can trick a coding agent into opening a shell. Here are seven concrete guardrails to keep the speed without the blind trust.

Deno 2.9 turns a single TypeScript file into a native desktop app with no Electron and no Rust. Here is the whole build-and-ship workflow, step by step.

Cloudflare spent July 1, 2026 turning the AI crawl fight into product surface area. Here are the four launches developers and publishers should actually watch.

Chrome 149 shipped an origin trial for WebMCP, the API that lets sites hand AI agents typed tools instead of buttons to guess at. A plain-English FAQ.

GitHub shipped a dense set of Copilot controls on July 1-2, 2026. Here is the practical rollout sequence for teams that want better cost, browser, and governance guardrails.

Git 2.55 landed June 29 with fsmonitor on Linux, parallel hooks, multi-remote push, and a fixup command that finally matches intent. The eight changes worth knowing, ranked.

TypeScript 7.0 RC now installs as plain typescript from npm. A step-by-step playbook for moving a real project onto the Go-native, ~10x-faster compiler before stable lands.

Anthropic’s last two weeks show where AI competition is heading: safer defaults for everyone, frontier models under tighter controls, and a race to ship agents, not just chat.

One benchmark, one name, and at least four different top scores. Six coding models ranked by their loudest SWE-Bench Pro number, with the asterisk each deserves.

WSL Containers hit public preview on July 1, 2026. This field guide breaks down which new Windows developer tools are worth piloting first and why.

CSS anchor positioning is Baseline in 2026 across Chrome, Firefox 147, and Safari 26. Here are seven outdated reasons devs still reach for Floating UI, debunked.

In late June 2026, the biggest AI story was not just stronger models. It was who could actually ship them, to whom, and under what constraints.

Two Chinese labs shipped frontier-class open-weight coding models a day apart in June. Here's the head-to-head on benchmarks, context, price, and license.

Fresh studies and GitHub's June surge point to a new rule for coding agents: track spend, review load, and output together or your rollout will drift fast.

A five-round head-to-head between Pi's sub-1K-token minimal harness and OpenCode's 160k-star platform — philosophy, extensibility, models, sessions, and ecosystem.

Next.js 16.3 Preview adds Instant Navigations and Partial Prefetching. This field guide shows which flags to flip, when to Stream, Cache, or Block, and how to test the result.

Mobbin is one of the highest-leverage tools we recommend for anyone building software. It's a huge library of real app UI, now searchable straight from your AI editor via its MCP. Here's how it helps, and how to save on Pro.

A new June 24 study shows why deleting a malicious Go module from GitHub is not the same as removing it from the ecosystem.

After Shai-Hulud and the June @redhat-cloud-services hijack, npm finally has real guardrails. Six concrete moves to kill your publish token and lock down your packages.

Coding agents are moving from autocomplete to autonomous repo setup. This playbook keeps first-run productivity high without turning a fresh clone into a secret-exfil path.

Node.js 26.4 adds experimental package maps. Here is what they solve, how the JSON works, and how to test them without betting production on an unstable flag.

Node 24 runs .ts files with no build step, but it strips types instead of compiling them. Here is what survives and what throws.

Z.ai's GLM-5.2 is the first MIT-licensed open-weight model to beat GPT-5.5 on agentic coding benchmarks at a sixth of the cost. The key questions, answered.

Microsoft shipped its own model family, Apple opened Siri to Claude and Gemini, and OpenAI snuck out GPT-5.6. A ranked rundown of what changes your stack.

Two AI agents in one repo folder will step on each other. Git worktrees—a decade-old built-in—are the boring fix that went load-bearing in 2026.

Node 24 runs .ts files directly by stripping types, not compiling them. Set up your project so you keep type safety while you delete the build step.

Every major coding agent now reads AGENTS.md first. Auto-generated ones make agents worse; here is how to write one that earns its tokens.