j4rs

Hardening a host for autonomous coding agents

A runbook from moving an unattended coding-agent setup (an orchestrator that picks issues from a tracker and runs a coding agent on each, opening PRs) from "agents run as a user on a VM" to "each agent works in its own disposable dev machine and holds no secrets". It is written from a real migration of one VM: an orchestrator (Symphony-style), the Codex CLI as the agent, a Rails + React monorepo, GitHub, and a Linear tracker. The names are ours; the shape applies to any agent that runs shell commands.

Everything below was done in small, reviewed steps, each one tried on a throwaway workspace before it went live, and each change to a trust boundary got an adversarial review and a re-review of its fixes. The order matters more than any single setting.

1. Threat model

Treat the agent as untrusted code that runs with whatever you give it. It reads issue text, PR comments, web pages and repo files, any of which can car

brenogazzola

# Rails + PostgreSQL Performance Audit Playbook

A field-tested method for finding what's actually burning your database CPU, built for a
Rails monolith on managed PostgreSQL (Cloud SQL / RDS / etc.). It assumes no APM — just
`pg_stat_statements`, `pg_stat_activity`, and discipline. It pairs well with an LLM: point
one at this file plus your query results and let it do the attribution; the queries below
are ordered so a human can run them and paste results back.

## The core idea

mayinx

In celebration of Whyday: Rubyists always want to show others the beautiful code 
they have created, hence the question: Has Anybody Seen My Code?

Has Anybody Seen My Code
(sung to the tune of Has Anybody Seen My Gal)

Clean and small, works for all,
Ruby is my all in all.
Has anybody seen my code?

christoph-jerolimov

#!/bin/bash
IFS=$(echo -en "\n\b")

# Ensure we are in a git repo with gitignore.
if [ ! -d .git ];       then echo "Current working directory is not a git repository."; exit -1; fi
#if [ ! -f .gitignore ]; then echo "Current working directory has no .gitignore file.";  exit -2; fi

# Sort (by date) and save new files
for file in `git status --porcelain --untracked-files=all | grep -v '.log$' | grep '^?? ' | sed 's/^?? //g'`
do

demonbane

#!/bin/sh

echo "What should the Application be called (no spaces allowed e.g. GCal)?"
read inputline
name="$inputline"

echo "What is the url (e.g. https://www.google.com/calendar/render)?"
read inputline
url="$inputline"