# Rethinking Claude Code Best Practices Source: https://www.youtube.com/watch?v=vlfCjWuv4es Machine-generated transcript; recognition errors remain. Source-recording timestamps. Boundary-crossing subtitle ends are clipped to this session. [00:00:00](https://www.youtube.com/watch?v=vlfCjWuv4es&t=0s) I had some technical difficulties during [00:00:03](https://www.youtube.com/watch?v=vlfCjWuv4es&t=3s) my talk this morning, so I ran back home [00:00:05](https://www.youtube.com/watch?v=vlfCjWuv4es&t=5s) and I'm just going to record it from my [00:00:07](https://www.youtube.com/watch?v=vlfCjWuv4es&t=7s) computer instead. So, hi everyone. I'm [00:00:09](https://www.youtube.com/watch?v=vlfCjWuv4es&t=9s) Lydia. I work on the Cloud Code team at [00:00:11](https://www.youtube.com/watch?v=vlfCjWuv4es&t=11s) Anthropic. And the models have gotten [00:00:14](https://www.youtube.com/watch?v=vlfCjWuv4es&t=14s) really good lately. So we have Opus 55, [00:00:16](https://www.youtube.com/watch?v=vlfCjWuv4es&t=16s) which is my favorite daily driver. And [00:00:19](https://www.youtube.com/watch?v=vlfCjWuv4es&t=19s) earlier this week, we also launched [00:00:20](https://www.youtube.com/watch?v=vlfCjWuv4es&t=20s) Fable 52. And these models are extremely [00:00:23](https://www.youtube.com/watch?v=vlfCjWuv4es&t=23s) good at long-running tasks and [00:00:25](https://www.youtube.com/watch?v=vlfCjWuv4es&t=25s) understanding your codebase. And [00:00:27](https://www.youtube.com/watch?v=vlfCjWuv4es&t=27s) especially Fable is also really good at [00:00:29](https://www.youtube.com/watch?v=vlfCjWuv4es&t=29s) verifying its own output. But as these [00:00:31](https://www.youtube.com/watch?v=vlfCjWuv4es&t=31s) models get better, the way that we work [00:00:33](https://www.youtube.com/watch?v=vlfCjWuv4es&t=33s) with them in Cloud Code also changes. [00:00:36](https://www.youtube.com/watch?v=vlfCjWuv4es&t=36s) So earlier this year, I don't know if [00:00:38](https://www.youtube.com/watch?v=vlfCjWuv4es&t=38s) you remember, but sessions kind of used [00:00:40](https://www.youtube.com/watch?v=vlfCjWuv4es&t=40s) to look like this. So we'd use a model [00:00:41](https://www.youtube.com/watch?v=vlfCjWuv4es&t=41s) like Opus 45, which honestly for its [00:00:44](https://www.youtube.com/watch?v=vlfCjWuv4es&t=44s) time was really good. I really enjoyed [00:00:45](https://www.youtube.com/watch?v=vlfCjWuv4es&t=45s) working with Opus 45. But compared to [00:00:48](https://www.youtube.com/watch?v=vlfCjWuv4es&t=48s) today, it would just stop a lot earlier. [00:00:50](https://www.youtube.com/watch?v=vlfCjWuv4es&t=50s) So it would just run for shorter amounts [00:00:52](https://www.youtube.com/watch?v=vlfCjWuv4es&t=52s) of time. [00:00:53](https://www.youtube.com/watch?v=vlfCjWuv4es&t=53s) And we'd also keep correcting it. We'd [00:00:55](https://www.youtube.com/watch?v=vlfCjWuv4es&t=55s) keep reminding it to do things, add [00:00:57](https://www.youtube.com/watch?v=vlfCjWuv4es&t=57s) things like important, exclamation mark, [00:00:59](https://www.youtube.com/watch?v=vlfCjWuv4es&t=59s) all these things to our Cloud MD file. [00:01:01](https://www.youtube.com/watch?v=vlfCjWuv4es&t=61s) And also features like auto mode didn't [00:01:03](https://www.youtube.com/watch?v=vlfCjWuv4es&t=63s) exist yet. So we were either approving [00:01:05](https://www.youtube.com/watch?v=vlfCjWuv4es&t=65s) everything manually or taking the [00:01:08](https://www.youtube.com/watch?v=vlfCjWuv4es&t=68s) riskier approach with dangerously skip [00:01:10](https://www.youtube.com/watch?v=vlfCjWuv4es&t=70s) permission. So we were still very much [00:01:13](https://www.youtube.com/watch?v=vlfCjWuv4es&t=73s) in the loop as humans. [00:01:15](https://www.youtube.com/watch?v=vlfCjWuv4es&t=75s) But as these models got better at taking [00:01:17](https://www.youtube.com/watch?v=vlfCjWuv4es&t=77s) on bigger tasks, our sessions also [00:01:19](https://www.youtube.com/watch?v=vlfCjWuv4es&t=79s) changed. So nowadays, at least at [00:01:21](https://www.youtube.com/watch?v=vlfCjWuv4es&t=81s) Anthropic, our sessions look more like [00:01:23](https://www.youtube.com/watch?v=vlfCjWuv4es&t=83s) this. So we're running dozens of [00:01:24](https://www.youtube.com/watch?v=vlfCjWuv4es&t=84s) sessions at the same time, running for [00:01:26](https://www.youtube.com/watch?v=vlfCjWuv4es&t=86s) hours, verifying their own results along [00:01:29](https://www.youtube.com/watch?v=vlfCjWuv4es&t=89s) the way, and we even have sessions [00:01:31](https://www.youtube.com/watch?v=vlfCjWuv4es&t=91s) orchestrate other sessions. So whereas [00:01:33](https://www.youtube.com/watch?v=vlfCjWuv4es&t=93s) we used to be in the loop for almost [00:01:35](https://www.youtube.com/watch?v=vlfCjWuv4es&t=95s) every step and running one or just a [00:01:37](https://www.youtube.com/watch?v=vlfCjWuv4es&t=97s) couple sessions at a time, we've now [00:01:39](https://www.youtube.com/watch?v=vlfCjWuv4es&t=99s) essentially become managers for dozens [00:01:42](https://www.youtube.com/watch?v=vlfCjWuv4es&t=102s) of sessions. [00:01:43](https://www.youtube.com/watch?v=vlfCjWuv4es&t=103s) We also got a lot more done though. Now [00:01:45](https://www.youtube.com/watch?v=vlfCjWuv4es&t=105s) you may have seen our blog post in [00:01:46](https://www.youtube.com/watch?v=vlfCjWuv4es&t=106s) October about how Anthropic went from [00:01:48](https://www.youtube.com/watch?v=vlfCjWuv4es&t=108s) about 2,500 changes a day in May to more [00:01:51](https://www.youtube.com/watch?v=vlfCjWuv4es&t=111s) than 30,000 a day in September. But this [00:01:55](https://www.youtube.com/watch?v=vlfCjWuv4es&t=115s) also means that we as developers just [00:01:57](https://www.youtube.com/watch?v=vlfCjWuv4es&t=117s) have to rethink on what we're focused on [00:01:59](https://www.youtube.com/watch?v=vlfCjWuv4es&t=119s) instead. [00:02:00](https://www.youtube.com/watch?v=vlfCjWuv4es&t=120s) So, if you think about our best [00:02:01](https://www.youtube.com/watch?v=vlfCjWuv4es&t=121s) practices from earlier this year, it was [00:02:03](https://www.youtube.com/watch?v=vlfCjWuv4es&t=123s) mainly about steering sessions, [00:02:05](https://www.youtube.com/watch?v=vlfCjWuv4es&t=125s) approving commands, saying no to certain [00:02:08](https://www.youtube.com/watch?v=vlfCjWuv4es&t=128s) things or restricting what Claude could [00:02:09](https://www.youtube.com/watch?v=vlfCjWuv4es&t=129s) do, [00:02:11](https://www.youtube.com/watch?v=vlfCjWuv4es&t=131s) the output, and also starting the [00:02:12](https://www.youtube.com/watch?v=vlfCjWuv4es&t=132s) sessions. So, everywhere that we now [00:02:15](https://www.youtube.com/watch?v=vlfCjWuv4es&t=135s) step out of that loop, something else [00:02:17](https://www.youtube.com/watch?v=vlfCjWuv4es&t=137s) has to take over. And this is either the [00:02:19](https://www.youtube.com/watch?v=vlfCjWuv4es&t=139s) model, the harness, or the environment [00:02:22](https://www.youtube.com/watch?v=vlfCjWuv4es&t=142s) that it's running in. So, if we are not [00:02:24](https://www.youtube.com/watch?v=vlfCjWuv4es&t=144s) in the loop to approve every command and [00:02:26](https://www.youtube.com/watch?v=vlfCjWuv4es&t=146s) we're running so many sessions at the [00:02:27](https://www.youtube.com/watch?v=vlfCjWuv4es&t=147s) same time, how can we make sure that the [00:02:30](https://www.youtube.com/watch?v=vlfCjWuv4es&t=150s) code it's writing is still high quality? [00:02:32](https://www.youtube.com/watch?v=vlfCjWuv4es&t=152s) And most importantly, if these sessions [00:02:34](https://www.youtube.com/watch?v=vlfCjWuv4es&t=154s) are running for hours without our [00:02:36](https://www.youtube.com/watch?v=vlfCjWuv4es&t=156s) supervision, how can we make sure that [00:02:38](https://www.youtube.com/watch?v=vlfCjWuv4es&t=158s) they're running safely? So, let's go [00:02:40](https://www.youtube.com/watch?v=vlfCjWuv4es&t=160s) through that by taking this old session [00:02:42](https://www.youtube.com/watch?v=vlfCjWuv4es&t=162s) and seeing what we have to change to get [00:02:44](https://www.youtube.com/watch?v=vlfCjWuv4es&t=164s) to that end result that I showed [00:02:45](https://www.youtube.com/watch?v=vlfCjWuv4es&t=165s) earlier. [00:02:46](https://www.youtube.com/watch?v=vlfCjWuv4es&t=166s) Well, first of all, let's use the actual [00:02:47](https://www.youtube.com/watch?v=vlfCjWuv4es&t=167s) defaults we start sessions in nowadays. [00:02:49](https://www.youtube.com/watch?v=vlfCjWuv4es&t=169s) So, that's not really something you [00:02:51](https://www.youtube.com/watch?v=vlfCjWuv4es&t=171s) should think about. So, let's update the [00:02:52](https://www.youtube.com/watch?v=vlfCjWuv4es&t=172s) model here from Opus 4 5 to Opus 5 5 and [00:02:55](https://www.youtube.com/watch?v=vlfCjWuv4es&t=175s) change the manual permission to auto [00:02:57](https://www.youtube.com/watch?v=vlfCjWuv4es&t=177s) mode. And Opus 5 5 is a lot better at [00:03:00](https://www.youtube.com/watch?v=vlfCjWuv4es&t=180s) understanding your intent and [00:03:01](https://www.youtube.com/watch?v=vlfCjWuv4es&t=181s) understanding your code base. So, we [00:03:03](https://www.youtube.com/watch?v=vlfCjWuv4es&t=183s) really don't have to steer it as much [00:03:04](https://www.youtube.com/watch?v=vlfCjWuv4es&t=184s) anymore mid session. And you also no [00:03:06](https://www.youtube.com/watch?v=vlfCjWuv4es&t=186s) longer have to approve every command [00:03:08](https://www.youtube.com/watch?v=vlfCjWuv4es&t=188s) because we started making auto mode the [00:03:10](https://www.youtube.com/watch?v=vlfCjWuv4es&t=190s) default permission mode back in August. [00:03:12](https://www.youtube.com/watch?v=vlfCjWuv4es&t=192s) Now, being better at understanding your [00:03:14](https://www.youtube.com/watch?v=vlfCjWuv4es&t=194s) intent and your code base also means [00:03:16](https://www.youtube.com/watch?v=vlfCjWuv4es&t=196s) that we have to rethink the instructions [00:03:18](https://www.youtube.com/watch?v=vlfCjWuv4es&t=198s) we have in our code base. So, [00:03:20](https://www.youtube.com/watch?v=vlfCjWuv4es&t=200s) if you followed our best practices from [00:03:21](https://www.youtube.com/watch?v=vlfCjWuv4es&t=201s) earlier this year, you may still have [00:03:23](https://www.youtube.com/watch?v=vlfCjWuv4es&t=203s) things like important or never do this, [00:03:25](https://www.youtube.com/watch?v=vlfCjWuv4es&t=205s) exclamation mark, all these things in [00:03:27](https://www.youtube.com/watch?v=vlfCjWuv4es&t=207s) your cloud MD file. But with today's [00:03:29](https://www.youtube.com/watch?v=vlfCjWuv4es&t=209s) models, you really don't need that and [00:03:31](https://www.youtube.com/watch?v=vlfCjWuv4es&t=211s) it can actually make the model go off [00:03:32](https://www.youtube.com/watch?v=vlfCjWuv4es&t=212s) track. So, you end up with more tool [00:03:34](https://www.youtube.com/watch?v=vlfCjWuv4es&t=214s) calls and overall a worse results. [00:03:37](https://www.youtube.com/watch?v=vlfCjWuv4es&t=217s) So, nowadays your cloud MD file should [00:03:39](https://www.youtube.com/watch?v=vlfCjWuv4es&t=219s) only include the things the Claude [00:03:40](https://www.youtube.com/watch?v=vlfCjWuv4es&t=220s) cannot see from your code. So, for [00:03:42](https://www.youtube.com/watch?v=vlfCjWuv4es&t=222s) example, maybe you have a service that's [00:03:44](https://www.youtube.com/watch?v=vlfCjWuv4es&t=224s) still using some legacy source [00:03:46](https://www.youtube.com/watch?v=vlfCjWuv4es&t=226s) somewhere, but it's not directly [00:03:47](https://www.youtube.com/watch?v=vlfCjWuv4es&t=227s) referenced in the code. That's still [00:03:49](https://www.youtube.com/watch?v=vlfCjWuv4es&t=229s) good to keep in there. But everything [00:03:51](https://www.youtube.com/watch?v=vlfCjWuv4es&t=231s) else, like what stack you're on or where [00:03:53](https://www.youtube.com/watch?v=vlfCjWuv4es&t=233s) to look, you really don't need that [00:03:54](https://www.youtube.com/watch?v=vlfCjWuv4es&t=234s) anymore. And we actually have a command [00:03:56](https://www.youtube.com/watch?v=vlfCjWuv4es&t=236s) for this called doctor prompt audit, [00:03:58](https://www.youtube.com/watch?v=vlfCjWuv4es&t=238s) which makes it really easy to optimize [00:04:00](https://www.youtube.com/watch?v=vlfCjWuv4es&t=240s) your environment for a specific model. [00:04:02](https://www.youtube.com/watch?v=vlfCjWuv4es&t=242s) So, if on Opus 55 here and you run this [00:04:05](https://www.youtube.com/watch?v=vlfCjWuv4es&t=245s) command, it will automatically check [00:04:06](https://www.youtube.com/watch?v=vlfCjWuv4es&t=246s) your cloud MD and your skills to see [00:04:08](https://www.youtube.com/watch?v=vlfCjWuv4es&t=248s) what the new model no longer needs. [00:04:11](https://www.youtube.com/watch?v=vlfCjWuv4es&t=251s) Now, auto mode is a permission mode that [00:04:13](https://www.youtube.com/watch?v=vlfCjWuv4es&t=253s) runs a separate classifier on pretty [00:04:15](https://www.youtube.com/watch?v=vlfCjWuv4es&t=255s) much everything that isn't just reading [00:04:17](https://www.youtube.com/watch?v=vlfCjWuv4es&t=257s) or editing files in your project. [00:04:20](https://www.youtube.com/watch?v=vlfCjWuv4es&t=260s) So, it automatically allows commands [00:04:22](https://www.youtube.com/watch?v=vlfCjWuv4es&t=262s) that it knows are safe, like running [00:04:23](https://www.youtube.com/watch?v=vlfCjWuv4es&t=263s) tests or installing dependencies, but it [00:04:26](https://www.youtube.com/watch?v=vlfCjWuv4es&t=266s) still blocks commands where it's unsure [00:04:28](https://www.youtube.com/watch?v=vlfCjWuv4es&t=268s) whether they're safe. [00:04:29](https://www.youtube.com/watch?v=vlfCjWuv4es&t=269s) And normally that's pretty good. Uh [00:04:31](https://www.youtube.com/watch?v=vlfCjWuv4es&t=271s) normally that's kind of, you know, what [00:04:32](https://www.youtube.com/watch?v=vlfCjWuv4es&t=272s) we want. But for example here, if we ask [00:04:35](https://www.youtube.com/watch?v=vlfCjWuv4es&t=275s) it to ship something to staging, we [00:04:37](https://www.youtube.com/watch?v=vlfCjWuv4es&t=277s) would have just, you know, approved the [00:04:39](https://www.youtube.com/watch?v=vlfCjWuv4es&t=279s) push to our deploy repo. But by default, [00:04:42](https://www.youtube.com/watch?v=vlfCjWuv4es&t=282s) auto mode only trusts this folder and [00:04:44](https://www.youtube.com/watch?v=vlfCjWuv4es&t=284s) this repo, so it would block that [00:04:45](https://www.youtube.com/watch?v=vlfCjWuv4es&t=285s) command. So, we're back in the loop. [00:04:48](https://www.youtube.com/watch?v=vlfCjWuv4es&t=288s) Now, the defaults should be good in most [00:04:50](https://www.youtube.com/watch?v=vlfCjWuv4es&t=290s) cases, but if you still notice that you [00:04:51](https://www.youtube.com/watch?v=vlfCjWuv4es&t=291s) have to approve a lot of uh commands [00:04:54](https://www.youtube.com/watch?v=vlfCjWuv4es&t=294s) even in auto mode, the first thing to [00:04:56](https://www.youtube.com/watch?v=vlfCjWuv4es&t=296s) look at is settings here because you can [00:04:58](https://www.youtube.com/watch?v=vlfCjWuv4es&t=298s) configure auto mode in your own settings [00:05:00](https://www.youtube.com/watch?v=vlfCjWuv4es&t=300s) just in plain English, and this is what [00:05:01](https://www.youtube.com/watch?v=vlfCjWuv4es&t=301s) gets sent to the classifier, which then [00:05:03](https://www.youtube.com/watch?v=vlfCjWuv4es&t=303s) decides whether to reject or allow [00:05:05](https://www.youtube.com/watch?v=vlfCjWuv4es&t=305s) certain commands. [00:05:07](https://www.youtube.com/watch?v=vlfCjWuv4es&t=307s) So, here we can just write which repos, [00:05:09](https://www.youtube.com/watch?v=vlfCjWuv4es&t=309s) buckets, domains we trust um and what it [00:05:11](https://www.youtube.com/watch?v=vlfCjWuv4es&t=311s) should always allow or never do. Okay, [00:05:13](https://www.youtube.com/watch?v=vlfCjWuv4es&t=313s) so honestly this was pretty easy by just [00:05:15](https://www.youtube.com/watch?v=vlfCjWuv4es&t=315s) using today's defaults. We've already [00:05:17](https://www.youtube.com/watch?v=vlfCjWuv4es&t=317s) gotten rid of most of our in-the-loop [00:05:19](https://www.youtube.com/watch?v=vlfCjWuv4es&t=319s) stuff [00:05:20](https://www.youtube.com/watch?v=vlfCjWuv4es&t=320s) um because the model took over the [00:05:21](https://www.youtube.com/watch?v=vlfCjWuv4es&t=321s) steering and auto mode took over all the [00:05:23](https://www.youtube.com/watch?v=vlfCjWuv4es&t=323s) approving, so getting out of the loop is [00:05:25](https://www.youtube.com/watch?v=vlfCjWuv4es&t=325s) easy. But the harder question now is how [00:05:28](https://www.youtube.com/watch?v=vlfCjWuv4es&t=328s) do we make sure it's okay that we're not [00:05:29](https://www.youtube.com/watch?v=vlfCjWuv4es&t=329s) there anymore? So, first is keeping it [00:05:32](https://www.youtube.com/watch?v=vlfCjWuv4es&t=332s) safe and then also verification. [00:05:34](https://www.youtube.com/watch?v=vlfCjWuv4es&t=334s) So, let's start with keeping it safe [00:05:35](https://www.youtube.com/watch?v=vlfCjWuv4es&t=335s) because everything so far, so upgrading [00:05:37](https://www.youtube.com/watch?v=vlfCjWuv4es&t=337s) the model and using auto mode is just [00:05:40](https://www.youtube.com/watch?v=vlfCjWuv4es&t=340s) working with a model. [00:05:42](https://www.youtube.com/watch?v=vlfCjWuv4es&t=342s) And in most cases it does what you tell [00:05:44](https://www.youtube.com/watch?v=vlfCjWuv4es&t=344s) it to do, but that's not a guarantee. [00:05:46](https://www.youtube.com/watch?v=vlfCjWuv4es&t=346s) So, in a study we published back in [00:05:48](https://www.youtube.com/watch?v=vlfCjWuv4es&t=348s) August, we tested auto mode versus real [00:05:50](https://www.youtube.com/watch?v=vlfCjWuv4es&t=350s) people in the loop, and only about 14% [00:05:53](https://www.youtube.com/watch?v=vlfCjWuv4es&t=353s) of people caught a clearly dangerous [00:05:55](https://www.youtube.com/watch?v=vlfCjWuv4es&t=355s) command. Auto mode blocked 89% of them, [00:05:58](https://www.youtube.com/watch?v=vlfCjWuv4es&t=358s) so it is a lot better at it than we [00:06:00](https://www.youtube.com/watch?v=vlfCjWuv4es&t=360s) were. [00:06:01](https://www.youtube.com/watch?v=vlfCjWuv4es&t=361s) But about one in 10 of those commands [00:06:03](https://www.youtube.com/watch?v=vlfCjWuv4es&t=363s) still went through. So, if do want the [00:06:05](https://www.youtube.com/watch?v=vlfCjWuv4es&t=365s) guarantee, you can only enforce that in [00:06:08](https://www.youtube.com/watch?v=vlfCjWuv4es&t=368s) the harness. And this is where some of [00:06:10](https://www.youtube.com/watch?v=vlfCjWuv4es&t=370s) our older best practices still matters, [00:06:11](https://www.youtube.com/watch?v=vlfCjWuv4es&t=371s) and that's permissions. So, for example, [00:06:13](https://www.youtube.com/watch?v=vlfCjWuv4es&t=373s) if you have a deny rule for a specific [00:06:16](https://www.youtube.com/watch?v=vlfCjWuv4es&t=376s) tool called in your project, Cloud Code [00:06:18](https://www.youtube.com/watch?v=vlfCjWuv4es&t=378s) looks at this rule before the automo [00:06:20](https://www.youtube.com/watch?v=vlfCjWuv4es&t=380s) classifier even looks at it. In fact, if [00:06:22](https://www.youtube.com/watch?v=vlfCjWuv4es&t=382s) a tool called matches a deny rule, the [00:06:24](https://www.youtube.com/watch?v=vlfCjWuv4es&t=384s) classifier never even sees it. So, [00:06:26](https://www.youtube.com/watch?v=vlfCjWuv4es&t=386s) having deny rules is still the best way [00:06:28](https://www.youtube.com/watch?v=vlfCjWuv4es&t=388s) to make sure Cloud actually never does [00:06:30](https://www.youtube.com/watch?v=vlfCjWuv4es&t=390s) something. [00:06:32](https://www.youtube.com/watch?v=vlfCjWuv4es&t=392s) But then how do you know what needs to [00:06:33](https://www.youtube.com/watch?v=vlfCjWuv4es&t=393s) be a rule in your project versus what [00:06:35](https://www.youtube.com/watch?v=vlfCjWuv4es&t=395s) the model can just know because they've [00:06:37](https://www.youtube.com/watch?v=vlfCjWuv4es&t=397s) gotten so good at it? Um I think it kind [00:06:39](https://www.youtube.com/watch?v=vlfCjWuv4es&t=399s) of just comes down to if Cloud gets this [00:06:41](https://www.youtube.com/watch?v=vlfCjWuv4es&t=401s) wrong once, can I take it back? So, if [00:06:44](https://www.youtube.com/watch?v=vlfCjWuv4es&t=404s) it writes the wrong code, you can still [00:06:46](https://www.youtube.com/watch?v=vlfCjWuv4es&t=406s) revert that. Um so, you can still leave [00:06:48](https://www.youtube.com/watch?v=vlfCjWuv4es&t=408s) that to the model. But if it throws away [00:06:50](https://www.youtube.com/watch?v=vlfCjWuv4es&t=410s) our uncommitted changes or it reads a [00:06:52](https://www.youtube.com/watch?v=vlfCjWuv4es&t=412s) key that's now in your transcript and [00:06:53](https://www.youtube.com/watch?v=vlfCjWuv4es&t=413s) you don't don't want that, that should [00:06:55](https://www.youtube.com/watch?v=vlfCjWuv4es&t=415s) still be a rule. So, for example, let's [00:06:58](https://www.youtube.com/watch?v=vlfCjWuv4es&t=418s) say that we just never want Cloud [00:06:59](https://www.youtube.com/watch?v=vlfCjWuv4es&t=419s) reading our .env file. Now, by default, [00:07:02](https://www.youtube.com/watch?v=vlfCjWuv4es&t=422s) automo is fine with this, so it would [00:07:03](https://www.youtube.com/watch?v=vlfCjWuv4es&t=423s) have just approved it. [00:07:05](https://www.youtube.com/watch?v=vlfCjWuv4es&t=425s) So so, if you want to make sure that [00:07:07](https://www.youtube.com/watch?v=vlfCjWuv4es&t=427s) Cloud can never read this file, you [00:07:09](https://www.youtube.com/watch?v=vlfCjWuv4es&t=429s) should just add a deny rule. And then [00:07:11](https://www.youtube.com/watch?v=vlfCjWuv4es&t=431s) commands like cat cannot open this file [00:07:12](https://www.youtube.com/watch?v=vlfCjWuv4es&t=432s) either. But it's not always that [00:07:14](https://www.youtube.com/watch?v=vlfCjWuv4es&t=434s) straightforward cuz sometimes certain [00:07:16](https://www.youtube.com/watch?v=vlfCjWuv4es&t=436s) commands can have side effects. So, for [00:07:19](https://www.youtube.com/watch?v=vlfCjWuv4es&t=439s) example, let's say that npm test here, a [00:07:21](https://www.youtube.com/watch?v=vlfCjWuv4es&t=441s) very normal command, it's just a test, [00:07:23](https://www.youtube.com/watch?v=vlfCjWuv4es&t=443s) so automo runs it, that's fine. [00:07:25](https://www.youtube.com/watch?v=vlfCjWuv4es&t=445s) But when the script is running, it runs [00:07:27](https://www.youtube.com/watch?v=vlfCjWuv4es&t=447s) code that you didn't write, like your [00:07:28](https://www.youtube.com/watch?v=vlfCjWuv4es&t=448s) dependencies. Or maybe Cloud runs a [00:07:31](https://www.youtube.com/watch?v=vlfCjWuv4es&t=451s) script real quick that it wrote just to [00:07:33](https://www.youtube.com/watch?v=vlfCjWuv4es&t=453s) quickly check something. [00:07:34](https://www.youtube.com/watch?v=vlfCjWuv4es&t=454s) So, if one of those scripts is [00:07:36](https://www.youtube.com/watch?v=vlfCjWuv4es&t=456s) compromised, it could just open that [00:07:38](https://www.youtube.com/watch?v=vlfCjWuv4es&t=458s) same .env file or your SSH keys and send [00:07:41](https://www.youtube.com/watch?v=vlfCjWuv4es&t=461s) those to a server you've never heard of, [00:07:43](https://www.youtube.com/watch?v=vlfCjWuv4es&t=463s) right? And even if we were still there [00:07:46](https://www.youtube.com/watch?v=vlfCjWuv4es&t=466s) as humans approving everything, [00:07:47](https://www.youtube.com/watch?v=vlfCjWuv4es&t=467s) honestly, we would have just clicked [00:07:49](https://www.youtube.com/watch?v=vlfCjWuv4es&t=469s) allow cuz there's nothing to say no to. [00:07:50](https://www.youtube.com/watch?v=vlfCjWuv4es&t=470s) It's just part of the script that in [00:07:53](https://www.youtube.com/watch?v=vlfCjWuv4es&t=473s) this example case npm test runs. And [00:07:56](https://www.youtube.com/watch?v=vlfCjWuv4es&t=476s) permissions only decide if a tool call [00:07:59](https://www.youtube.com/watch?v=vlfCjWuv4es&t=479s) runs, but they cannot limit what it can [00:08:01](https://www.youtube.com/watch?v=vlfCjWuv4es&t=481s) reach once it's running. So, we want to [00:08:03](https://www.youtube.com/watch?v=vlfCjWuv4es&t=483s) make sure that these kinds of scripts [00:08:05](https://www.youtube.com/watch?v=vlfCjWuv4es&t=485s) can still run because this is just part [00:08:07](https://www.youtube.com/watch?v=vlfCjWuv4es&t=487s) of, you know, how Cloud can check its [00:08:08](https://www.youtube.com/watch?v=vlfCjWuv4es&t=488s) own work running tests. [00:08:10](https://www.youtube.com/watch?v=vlfCjWuv4es&t=490s) So we cannot just block npm tests, but [00:08:12](https://www.youtube.com/watch?v=vlfCjWuv4es&t=492s) we want to limit its side effects. So [00:08:14](https://www.youtube.com/watch?v=vlfCjWuv4es&t=494s) really, we just want to limit the [00:08:15](https://www.youtube.com/watch?v=vlfCjWuv4es&t=495s) environment that it's running in. [00:08:18](https://www.youtube.com/watch?v=vlfCjWuv4es&t=498s) So if you're running it locally or on [00:08:20](https://www.youtube.com/watch?v=vlfCjWuv4es&t=500s) your own machine, you can run commands [00:08:22](https://www.youtube.com/watch?v=vlfCjWuv4es&t=502s) like that in a sandbox. So then you have [00:08:24](https://www.youtube.com/watch?v=vlfCjWuv4es&t=504s) control over which files in a command it [00:08:26](https://www.youtube.com/watch?v=vlfCjWuv4es&t=506s) can read, which folders it can write to, [00:08:29](https://www.youtube.com/watch?v=vlfCjWuv4es&t=509s) which hosts it can reach. And the [00:08:31](https://www.youtube.com/watch?v=vlfCjWuv4es&t=511s) operating system enforces that. [00:08:34](https://www.youtube.com/watch?v=vlfCjWuv4es&t=514s) Also, this also applies to everything [00:08:35](https://www.youtube.com/watch?v=vlfCjWuv4es&t=515s) that command then starts, so any child [00:08:37](https://www.youtube.com/watch?v=vlfCjWuv4es&t=517s) processes. [00:08:39](https://www.youtube.com/watch?v=vlfCjWuv4es&t=519s) So on its own, that deny rule gets [00:08:41](https://www.youtube.com/watch?v=vlfCjWuv4es&t=521s) checked by Cloud before the command [00:08:42](https://www.youtube.com/watch?v=vlfCjWuv4es&t=522s) runs, but all it sees there is npm [00:08:45](https://www.youtube.com/watch?v=vlfCjWuv4es&t=525s) tests. So it doesn't see which files [00:08:47](https://www.youtube.com/watch?v=vlfCjWuv4es&t=527s) that script ends up opening. But with [00:08:49](https://www.youtube.com/watch?v=vlfCjWuv4es&t=529s) the sandbox on, that same rule gets [00:08:51](https://www.youtube.com/watch?v=vlfCjWuv4es&t=531s) passed on to the operating system. So [00:08:53](https://www.youtube.com/watch?v=vlfCjWuv4es&t=533s) now when when that dependency tries to [00:08:56](https://www.youtube.com/watch?v=vlfCjWuv4es&t=536s) open or end file, the operating system [00:08:57](https://www.youtube.com/watch?v=vlfCjWuv4es&t=537s) just doesn't let it. [00:08:59](https://www.youtube.com/watch?v=vlfCjWuv4es&t=539s) And by default, it can still read most [00:09:00](https://www.youtube.com/watch?v=vlfCjWuv4es&t=540s) of your machine, so you'd want to add [00:09:02](https://www.youtube.com/watch?v=vlfCjWuv4es&t=542s) another rule for your SSH keys if you [00:09:04](https://www.youtube.com/watch?v=vlfCjWuv4es&t=544s) care about that. [00:09:06](https://www.youtube.com/watch?v=vlfCjWuv4es&t=546s) And it also cannot reach a host that [00:09:08](https://www.youtube.com/watch?v=vlfCjWuv4es&t=548s) wasn't approved. [00:09:10](https://www.youtube.com/watch?v=vlfCjWuv4es&t=550s) But the sandbox only covers the shell [00:09:12](https://www.youtube.com/watch?v=vlfCjWuv4es&t=552s) commands that Cloud runs and whatever [00:09:14](https://www.youtube.com/watch?v=vlfCjWuv4es&t=554s) those start. But Cloud's own files, your [00:09:16](https://www.youtube.com/watch?v=vlfCjWuv4es&t=556s) MCP servers, and all of your hooks still [00:09:18](https://www.youtube.com/watch?v=vlfCjWuv4es&t=558s) run outside of it. So the rest of your [00:09:21](https://www.youtube.com/watch?v=vlfCjWuv4es&t=561s) session still runs on your own machine [00:09:22](https://www.youtube.com/watch?v=vlfCjWuv4es&t=562s) and everything that's on there. So [00:09:24](https://www.youtube.com/watch?v=vlfCjWuv4es&t=564s) ideally, you want this whole thing to [00:09:26](https://www.youtube.com/watch?v=vlfCjWuv4es&t=566s) run somewhere where none of that is even [00:09:28](https://www.youtube.com/watch?v=vlfCjWuv4es&t=568s) there in the first place. And that is a [00:09:31](https://www.youtube.com/watch?v=vlfCjWuv4es&t=571s) Cloud session because there it gets its [00:09:33](https://www.youtube.com/watch?v=vlfCjWuv4es&t=573s) own machine with a fresh copy of a repo. [00:09:36](https://www.youtube.com/watch?v=vlfCjWuv4es&t=576s) And this runs even when we close our [00:09:37](https://www.youtube.com/watch?v=vlfCjWuv4es&t=577s) laptop, which is definitely something [00:09:39](https://www.youtube.com/watch?v=vlfCjWuv4es&t=579s) you want for these longer running [00:09:40](https://www.youtube.com/watch?v=vlfCjWuv4es&t=580s) sessions that run for hours. [00:09:43](https://www.youtube.com/watch?v=vlfCjWuv4es&t=583s) So in this case, this automatically gets [00:09:45](https://www.youtube.com/watch?v=vlfCjWuv4es&t=585s) rid of the end file issue because it's [00:09:47](https://www.youtube.com/watch?v=vlfCjWuv4es&t=587s) not in Git, and neither are my SSH keys [00:09:49](https://www.youtube.com/watch?v=vlfCjWuv4es&t=589s) or our GitHub token. [00:09:51](https://www.youtube.com/watch?v=vlfCjWuv4es&t=591s) And if it still needs an API key, you [00:09:54](https://www.youtube.com/watch?v=vlfCjWuv4es&t=594s) can add that as a network secret where [00:09:55](https://www.youtube.com/watch?v=vlfCjWuv4es&t=595s) it will it will tell you like, hey, I'm [00:09:57](https://www.youtube.com/watch?v=vlfCjWuv4es&t=597s) missing an API key mid-session, [00:10:00](https://www.youtube.com/watch?v=vlfCjWuv4es&t=600s) so it can use it without actually ever [00:10:01](https://www.youtube.com/watch?v=vlfCjWuv4es&t=601s) sending it to the model. And by default, [00:10:03](https://www.youtube.com/watch?v=vlfCjWuv4es&t=603s) also in the Cloud session, network [00:10:06](https://www.youtube.com/watch?v=vlfCjWuv4es&t=606s) access is limited to things like package [00:10:08](https://www.youtube.com/watch?v=vlfCjWuv4es&t=608s) registries in GitHub. So you have to [00:10:10](https://www.youtube.com/watch?v=vlfCjWuv4es&t=610s) explicitly add those domains to your [00:10:12](https://www.youtube.com/watch?v=vlfCjWuv4es&t=612s) environment for Cloud to to reach other [00:10:14](https://www.youtube.com/watch?v=vlfCjWuv4es&t=614s) hosts. [00:10:16](https://www.youtube.com/watch?v=vlfCjWuv4es&t=616s) Okay, so with a Cloud session we can run [00:10:18](https://www.youtube.com/watch?v=vlfCjWuv4es&t=618s) these long-running sessions even with [00:10:20](https://www.youtube.com/watch?v=vlfCjWuv4es&t=620s) our laptop closed and it keeps us safe [00:10:23](https://www.youtube.com/watch?v=vlfCjWuv4es&t=623s) because it runs in its own environment. [00:10:26](https://www.youtube.com/watch?v=vlfCjWuv4es&t=626s) Now it's still good to remember that [00:10:28](https://www.youtube.com/watch?v=vlfCjWuv4es&t=628s) this machine is disposable, but the [00:10:29](https://www.youtube.com/watch?v=vlfCjWuv4es&t=629s) things that leave it aren't. So a commit [00:10:31](https://www.youtube.com/watch?v=vlfCjWuv4es&t=631s) pushed or a message it sent through a [00:10:33](https://www.youtube.com/watch?v=vlfCjWuv4es&t=633s) connector. So we still run it in auto [00:10:36](https://www.youtube.com/watch?v=vlfCjWuv4es&t=636s) mode with our deny rules just commit it [00:10:38](https://www.youtube.com/watch?v=vlfCjWuv4es&t=638s) into the repo so they come along. Uh so [00:10:40](https://www.youtube.com/watch?v=vlfCjWuv4es&t=640s) it it could still catch things like a [00:10:42](https://www.youtube.com/watch?v=vlfCjWuv4es&t=642s) forced push or a secret in a commit, all [00:10:44](https://www.youtube.com/watch?v=vlfCjWuv4es&t=644s) that kind of stuff. [00:10:47](https://www.youtube.com/watch?v=vlfCjWuv4es&t=647s) And beyond just safety um we also need [00:10:50](https://www.youtube.com/watch?v=vlfCjWuv4es&t=650s) to make sure that Cloud is actually [00:10:51](https://www.youtube.com/watch?v=vlfCjWuv4es&t=651s) working on the right thing. So next is [00:10:54](https://www.youtube.com/watch?v=vlfCjWuv4es&t=654s) verification. And the nice thing about [00:10:56](https://www.youtube.com/watch?v=vlfCjWuv4es&t=656s) being in a loop uh like we kind of knew [00:10:58](https://www.youtube.com/watch?v=vlfCjWuv4es&t=658s) the work was good because we'd already [00:11:00](https://www.youtube.com/watch?v=vlfCjWuv4es&t=660s) kind of seen every change, we'd approved [00:11:02](https://www.youtube.com/watch?v=vlfCjWuv4es&t=662s) everything. [00:11:03](https://www.youtube.com/watch?v=vlfCjWuv4es&t=663s) But now if Cloud works for hours in the [00:11:05](https://www.youtube.com/watch?v=vlfCjWuv4es&t=665s) background, we don't have that anymore. [00:11:07](https://www.youtube.com/watch?v=vlfCjWuv4es&t=667s) Um and we're not really going to read [00:11:09](https://www.youtube.com/watch?v=vlfCjWuv4es&t=669s) every file at the end either. [00:11:12](https://www.youtube.com/watch?v=vlfCjWuv4es&t=672s) So you know, say that we ask you to move [00:11:14](https://www.youtube.com/watch?v=vlfCjWuv4es&t=674s) our auth to a new API. Well Cloud is [00:11:17](https://www.youtube.com/watch?v=vlfCjWuv4es&t=677s) very good at understanding what we want, [00:11:19](https://www.youtube.com/watch?v=vlfCjWuv4es&t=679s) but there are still a lot of small [00:11:20](https://www.youtube.com/watch?v=vlfCjWuv4es&t=680s) decisions that it has to make along the [00:11:22](https://www.youtube.com/watch?v=vlfCjWuv4es&t=682s) way. So with the exact same prompt, you [00:11:24](https://www.youtube.com/watch?v=vlfCjWuv4es&t=684s) know, one run might move it over but [00:11:26](https://www.youtube.com/watch?v=vlfCjWuv4es&t=686s) leave the old API in there or one might [00:11:29](https://www.youtube.com/watch?v=vlfCjWuv4es&t=689s) move it but only for new logins and [00:11:31](https://www.youtube.com/watch?v=vlfCjWuv4es&t=691s) another one might move it but log [00:11:33](https://www.youtube.com/watch?v=vlfCjWuv4es&t=693s) everyone out. And these all look pretty [00:11:35](https://www.youtube.com/watch?v=vlfCjWuv4es&t=695s) reasonable, but it really helps to set [00:11:38](https://www.youtube.com/watch?v=vlfCjWuv4es&t=698s) up these verification points along the [00:11:39](https://www.youtube.com/watch?v=vlfCjWuv4es&t=699s) way. So Cloud keeps verifying its own [00:11:42](https://www.youtube.com/watch?v=vlfCjWuv4es&t=702s) results. And those can be anything that [00:11:44](https://www.youtube.com/watch?v=vlfCjWuv4es&t=704s) comes back as a pass or fail. So tests, [00:11:47](https://www.youtube.com/watch?v=vlfCjWuv4es&t=707s) a build, a screenshot, whatever you [00:11:48](https://www.youtube.com/watch?v=vlfCjWuv4es&t=708s) have. [00:11:49](https://www.youtube.com/watch?v=vlfCjWuv4es&t=709s) So now we just want to make sure that we [00:11:51](https://www.youtube.com/watch?v=vlfCjWuv4es&t=711s) review these verification points. Uh [00:11:53](https://www.youtube.com/watch?v=vlfCjWuv4es&t=713s) there are a lot shorter to review than [00:11:55](https://www.youtube.com/watch?v=vlfCjWuv4es&t=715s) if we just had to you know, review the [00:11:57](https://www.youtube.com/watch?v=vlfCjWuv4es&t=717s) whole change at the end. So so that's [00:11:58](https://www.youtube.com/watch?v=vlfCjWuv4es&t=718s) pretty reasonable. [00:12:00](https://www.youtube.com/watch?v=vlfCjWuv4es&t=720s) So if one of these runs would still log [00:12:01](https://www.youtube.com/watch?v=vlfCjWuv4es&t=721s) everyone out, it doesn't get past that [00:12:03](https://www.youtube.com/watch?v=vlfCjWuv4es&t=723s) first check and then it just has to find [00:12:05](https://www.youtube.com/watch?v=vlfCjWuv4es&t=725s) another way. And there's a couple ways [00:12:07](https://www.youtube.com/watch?v=vlfCjWuv4es&t=727s) to set this up. Um the easiest one is of [00:12:09](https://www.youtube.com/watch?v=vlfCjWuv4es&t=729s) course just in your prompt. So you know, [00:12:11](https://www.youtube.com/watch?v=vlfCjWuv4es&t=731s) you say what done looks like and ask it [00:12:13](https://www.youtube.com/watch?v=vlfCjWuv4es&t=733s) to split that into tasks so they have [00:12:15](https://www.youtube.com/watch?v=vlfCjWuv4es&t=735s) their own tests. Um, and I also like to [00:12:17](https://www.youtube.com/watch?v=vlfCjWuv4es&t=737s) ask it to show the actual output because [00:12:19](https://www.youtube.com/watch?v=vlfCjWuv4es&t=739s) you weren't there to see it. But again, [00:12:21](https://www.youtube.com/watch?v=vlfCjWuv4es&t=741s) prompting is not a guarantee that a [00:12:23](https://www.youtube.com/watch?v=vlfCjWuv4es&t=743s) model will do it. So for the ones that [00:12:25](https://www.youtube.com/watch?v=vlfCjWuv4es&t=745s) have to run [00:12:27](https://www.youtube.com/watch?v=vlfCjWuv4es&t=747s) guaranteed run, I would use hooks, um, [00:12:29](https://www.youtube.com/watch?v=vlfCjWuv4es&t=749s) which are just, you know, scripts that [00:12:31](https://www.youtube.com/watch?v=vlfCjWuv4es&t=751s) Cloud Code runs at a specific point. [00:12:33](https://www.youtube.com/watch?v=vlfCjWuv4es&t=753s) And [00:12:34](https://www.youtube.com/watch?v=vlfCjWuv4es&t=754s) those give you a lot of control because [00:12:36](https://www.youtube.com/watch?v=vlfCjWuv4es&t=756s) you decide when they run and what they [00:12:38](https://www.youtube.com/watch?v=vlfCjWuv4es&t=758s) run and what they check. [00:12:39](https://www.youtube.com/watch?v=vlfCjWuv4es&t=759s) So for example, every time it edits a [00:12:41](https://www.youtube.com/watch?v=vlfCjWuv4es&t=761s) file, we can run our linter. Every time [00:12:43](https://www.youtube.com/watch?v=vlfCjWuv4es&t=763s) it wants to mark a task as complete, we [00:12:45](https://www.youtube.com/watch?v=vlfCjWuv4es&t=765s) can run the tests for what it changed. [00:12:47](https://www.youtube.com/watch?v=vlfCjWuv4es&t=767s) Um, so you know, if it touched our auth [00:12:49](https://www.youtube.com/watch?v=vlfCjWuv4es&t=769s) code or something, it has to pass the [00:12:51](https://www.youtube.com/watch?v=vlfCjWuv4es&t=771s) auth auth tests. [00:12:52](https://www.youtube.com/watch?v=vlfCjWuv4es&t=772s) And when it wants to finish the whole [00:12:54](https://www.youtube.com/watch?v=vlfCjWuv4es&t=774s) session, we can just run the entire test [00:12:55](https://www.youtube.com/watch?v=vlfCjWuv4es&t=775s) suite. [00:12:56](https://www.youtube.com/watch?v=vlfCjWuv4es&t=776s) And if one of those fails, it goes, oh, [00:12:59](https://www.youtube.com/watch?v=vlfCjWuv4es&t=779s) that's still broken. It goes back until [00:13:01](https://www.youtube.com/watch?v=vlfCjWuv4es&t=781s) it passes, so it fixes it. Now, just one [00:13:04](https://www.youtube.com/watch?v=vlfCjWuv4es&t=784s) thing, [00:13:05](https://www.youtube.com/watch?v=vlfCjWuv4es&t=785s) um, when a test fails, by default, most [00:13:07](https://www.youtube.com/watch?v=vlfCjWuv4es&t=787s) tools that exit with a one exit code, [00:13:10](https://www.youtube.com/watch?v=vlfCjWuv4es&t=790s) um, but with a one, that task by Cloud [00:13:12](https://www.youtube.com/watch?v=vlfCjWuv4es&t=792s) Code just gets marked as completed [00:13:14](https://www.youtube.com/watch?v=vlfCjWuv4es&t=794s) anyway. So make sure that your scripts [00:13:17](https://www.youtube.com/watch?v=vlfCjWuv4es&t=797s) exit with a two exit code because that's [00:13:19](https://www.youtube.com/watch?v=vlfCjWuv4es&t=799s) what actually sends Cloud back to fix [00:13:21](https://www.youtube.com/watch?v=vlfCjWuv4es&t=801s) it. [00:13:22](https://www.youtube.com/watch?v=vlfCjWuv4es&t=802s) So [00:13:23](https://www.youtube.com/watch?v=vlfCjWuv4es&t=803s) okay, now we have one session that I'm [00:13:25](https://www.youtube.com/watch?v=vlfCjWuv4es&t=805s) pretty comfortable with leaving alone. [00:13:28](https://www.youtube.com/watch?v=vlfCjWuv4es&t=808s) So now we can start with a few more of [00:13:30](https://www.youtube.com/watch?v=vlfCjWuv4es&t=810s) those because they've all got their own [00:13:32](https://www.youtube.com/watch?v=vlfCjWuv4es&t=812s) machines, so they're, you know, not all [00:13:33](https://www.youtube.com/watch?v=vlfCjWuv4es&t=813s) working in the same folder and we don't [00:13:35](https://www.youtube.com/watch?v=vlfCjWuv4es&t=815s) really have to think about work trees [00:13:36](https://www.youtube.com/watch?v=vlfCjWuv4es&t=816s) too much ourselves anymore. [00:13:39](https://www.youtube.com/watch?v=vlfCjWuv4es&t=819s) But then we still start every session [00:13:41](https://www.youtube.com/watch?v=vlfCjWuv4es&t=821s) ourselves and we review every one of [00:13:43](https://www.youtube.com/watch?v=vlfCjWuv4es&t=823s) them. And honestly, this is already a [00:13:45](https://www.youtube.com/watch?v=vlfCjWuv4es&t=825s) pretty good place to be. We are still [00:13:47](https://www.youtube.com/watch?v=vlfCjWuv4es&t=827s) fully in control over what gets started [00:13:50](https://www.youtube.com/watch?v=vlfCjWuv4es&t=830s) and when we call a task done. [00:13:53](https://www.youtube.com/watch?v=vlfCjWuv4es&t=833s) But even there, um, you know, we're [00:13:55](https://www.youtube.com/watch?v=vlfCjWuv4es&t=835s) still the ones kicking off every session [00:13:57](https://www.youtube.com/watch?v=vlfCjWuv4es&t=837s) and we're still in the loop for all of [00:13:59](https://www.youtube.com/watch?v=vlfCjWuv4es&t=839s) them. So I think the most important [00:14:01](https://www.youtube.com/watch?v=vlfCjWuv4es&t=841s) thing to have in place here now is your [00:14:02](https://www.youtube.com/watch?v=vlfCjWuv4es&t=842s) CI because [00:14:04](https://www.youtube.com/watch?v=vlfCjWuv4es&t=844s) all of these sessions eventually open a [00:14:06](https://www.youtube.com/watch?v=vlfCjWuv4es&t=846s) PR and your CI runs the same checks on [00:14:08](https://www.youtube.com/watch?v=vlfCjWuv4es&t=848s) every one of them, no matter how that [00:14:10](https://www.youtube.com/watch?v=vlfCjWuv4es&t=850s) session was set up or, you know, what [00:14:11](https://www.youtube.com/watch?v=vlfCjWuv4es&t=851s) Cloud decided to do along the way. And [00:14:13](https://www.youtube.com/watch?v=vlfCjWuv4es&t=853s) And you turn on auto fix, we have like [00:14:15](https://www.youtube.com/watch?v=vlfCjWuv4es&t=855s) CI auto-fix, [00:14:16](https://www.youtube.com/watch?v=vlfCjWuv4es&t=856s) Claude can also see when one of those [00:14:18](https://www.youtube.com/watch?v=vlfCjWuv4es&t=858s) checks fails and then go back to fix it. [00:14:20](https://www.youtube.com/watch?v=vlfCjWuv4es&t=860s) So you're not the one spending your [00:14:22](https://www.youtube.com/watch?v=vlfCjWuv4es&t=862s) review on things that, you know, a check [00:14:24](https://www.youtube.com/watch?v=vlfCjWuv4es&t=864s) could have already caught. [00:14:27](https://www.youtube.com/watch?v=vlfCjWuv4es&t=867s) And for some of them, you can even turn [00:14:28](https://www.youtube.com/watch?v=vlfCjWuv4es&t=868s) on merge when ready. So then GitHub [00:14:30](https://www.youtube.com/watch?v=vlfCjWuv4es&t=870s) merges the PR once all of the checks [00:14:32](https://www.youtube.com/watch?v=vlfCjWuv4es&t=872s) have passed. So you're not in the loop [00:14:34](https://www.youtube.com/watch?v=vlfCjWuv4es&t=874s) to review. Um but again, that that's not [00:14:37](https://www.youtube.com/watch?v=vlfCjWuv4es&t=877s) the default and that really depends on [00:14:38](https://www.youtube.com/watch?v=vlfCjWuv4es&t=878s) how risky the change is. So for example, [00:14:40](https://www.youtube.com/watch?v=vlfCjWuv4es&t=880s) on our team, every PR gets reviewed by [00:14:43](https://www.youtube.com/watch?v=vlfCjWuv4es&t=883s) Claude first. So not by the session that [00:14:45](https://www.youtube.com/watch?v=vlfCjWuv4es&t=885s) wrote it. So it comes with a fresh [00:14:48](https://www.youtube.com/watch?v=vlfCjWuv4es&t=888s) context and also a separate group of [00:14:50](https://www.youtube.com/watch?v=vlfCjWuv4es&t=890s) agents to just double check every bug it [00:14:52](https://www.youtube.com/watch?v=vlfCjWuv4es&t=892s) finds. [00:14:53](https://www.youtube.com/watch?v=vlfCjWuv4es&t=893s) And then how much we review ourselves [00:14:55](https://www.youtube.com/watch?v=vlfCjWuv4es&t=895s) just depends on the risk. So smaller [00:14:57](https://www.youtube.com/watch?v=vlfCjWuv4es&t=897s) changes like docs or copy, they don't [00:14:59](https://www.youtube.com/watch?v=vlfCjWuv4es&t=899s) need a person. So once the automated [00:15:01](https://www.youtube.com/watch?v=vlfCjWuv4es&t=901s) checks are green, we're pretty good to [00:15:03](https://www.youtube.com/watch?v=vlfCjWuv4es&t=903s) go. Um maybe ordinary product changes [00:15:05](https://www.youtube.com/watch?v=vlfCjWuv4es&t=905s) just need one reviewer and then risky [00:15:07](https://www.youtube.com/watch?v=vlfCjWuv4es&t=907s) changes might need two. [00:15:10](https://www.youtube.com/watch?v=vlfCjWuv4es&t=910s) Now ultimately, kind of where we see [00:15:12](https://www.youtube.com/watch?v=vlfCjWuv4es&t=912s) things going um and we're already kind [00:15:14](https://www.youtube.com/watch?v=vlfCjWuv4es&t=914s) of doing more of that at Anthropic is [00:15:16](https://www.youtube.com/watch?v=vlfCjWuv4es&t=916s) that you're not really starting all of [00:15:18](https://www.youtube.com/watch?v=vlfCjWuv4es&t=918s) those sessions yourself either. Because [00:15:19](https://www.youtube.com/watch?v=vlfCjWuv4es&t=919s) if you're anything like me, I'm terrible [00:15:21](https://www.youtube.com/watch?v=vlfCjWuv4es&t=921s) at context switching. So having to [00:15:23](https://www.youtube.com/watch?v=vlfCjWuv4es&t=923s) manage so many sessions at the at the [00:15:25](https://www.youtube.com/watch?v=vlfCjWuv4es&t=925s) same time doesn't always go well. [00:15:27](https://www.youtube.com/watch?v=vlfCjWuv4es&t=927s) So instead, you just have one main [00:15:29](https://www.youtube.com/watch?v=vlfCjWuv4es&t=929s) session that's your orchestrator and you [00:15:31](https://www.youtube.com/watch?v=vlfCjWuv4es&t=931s) can already see this in things like [00:15:33](https://www.youtube.com/watch?v=vlfCjWuv4es&t=933s) Claude Code projects, which is still in [00:15:35](https://www.youtube.com/watch?v=vlfCjWuv4es&t=935s) beta, but [00:15:37](https://www.youtube.com/watch?v=vlfCjWuv4es&t=937s) you just tell it what it needs to be [00:15:39](https://www.youtube.com/watch?v=vlfCjWuv4es&t=939s) done and the orchestrator splits that up [00:15:41](https://www.youtube.com/watch?v=vlfCjWuv4es&t=941s) and then starts other sessions for each [00:15:43](https://www.youtube.com/watch?v=vlfCjWuv4es&t=943s) task and it keeps track of what comes [00:15:45](https://www.youtube.com/watch?v=vlfCjWuv4es&t=945s) back. So it automatically starts and [00:15:47](https://www.youtube.com/watch?v=vlfCjWuv4es&t=947s) verifies these threads which are just [00:15:49](https://www.youtube.com/watch?v=vlfCjWuv4es&t=949s) new sessions. So instead of talking to [00:15:52](https://www.youtube.com/watch?v=vlfCjWuv4es&t=952s) eight sessions, you're just talking to [00:15:53](https://www.youtube.com/watch?v=vlfCjWuv4es&t=953s) one. [00:15:55](https://www.youtube.com/watch?v=vlfCjWuv4es&t=955s) And the main session doesn't write the [00:15:56](https://www.youtube.com/watch?v=vlfCjWuv4es&t=956s) code itself. So there you want a model [00:15:58](https://www.youtube.com/watch?v=vlfCjWuv4es&t=958s) that's really good at deciding what to [00:16:00](https://www.youtube.com/watch?v=vlfCjWuv4es&t=960s) do and judging what comes back, a model [00:16:02](https://www.youtube.com/watch?v=vlfCjWuv4es&t=962s) like Fable. And if something comes back [00:16:05](https://www.youtube.com/watch?v=vlfCjWuv4es&t=965s) that isn't actually done, it just, you [00:16:06](https://www.youtube.com/watch?v=vlfCjWuv4es&t=966s) know, sends it back so until it's [00:16:08](https://www.youtube.com/watch?v=vlfCjWuv4es&t=968s) actually done and passes everything. [00:16:10](https://www.youtube.com/watch?v=vlfCjWuv4es&t=970s) And the threads need a model that's good [00:16:12](https://www.youtube.com/watch?v=vlfCjWuv4es&t=972s) at actually doing the work like Opus 55. [00:16:14](https://www.youtube.com/watch?v=vlfCjWuv4es&t=974s) And you can set those separately. So, [00:16:17](https://www.youtube.com/watch?v=vlfCjWuv4es&t=977s) you know, one model for the main session [00:16:18](https://www.youtube.com/watch?v=vlfCjWuv4es&t=978s) and then another one for the threads. [00:16:20](https://www.youtube.com/watch?v=vlfCjWuv4es&t=980s) And another benefit is that with this [00:16:22](https://www.youtube.com/watch?v=vlfCjWuv4es&t=982s) setup with CloakCode projects [00:16:24](https://www.youtube.com/watch?v=vlfCjWuv4es&t=984s) specifically, we don't manage context [00:16:26](https://www.youtube.com/watch?v=vlfCjWuv4es&t=986s) anymore. That's all done automatically [00:16:28](https://www.youtube.com/watch?v=vlfCjWuv4es&t=988s) for us. [00:16:29](https://www.youtube.com/watch?v=vlfCjWuv4es&t=989s) no longer have to think about, you know, [00:16:31](https://www.youtube.com/watch?v=vlfCjWuv4es&t=991s) when to compact or clear all of that [00:16:33](https://www.youtube.com/watch?v=vlfCjWuv4es&t=993s) stuff. [00:16:34](https://www.youtube.com/watch?v=vlfCjWuv4es&t=994s) Okay, so if you look back at those old [00:16:36](https://www.youtube.com/watch?v=vlfCjWuv4es&t=996s) best practices, they're all still there, [00:16:38](https://www.youtube.com/watch?v=vlfCjWuv4es&t=998s) but they've just moved. [00:16:40](https://www.youtube.com/watch?v=vlfCjWuv4es&t=1000s) So, the model steers it now, um auto [00:16:42](https://www.youtube.com/watch?v=vlfCjWuv4es&t=1002s) mode approves your deny rules and the [00:16:44](https://www.youtube.com/watch?v=vlfCjWuv4es&t=1004s) environment restricts what's possible, [00:16:46](https://www.youtube.com/watch?v=vlfCjWuv4es&t=1006s) um your tests, your hooks, and your CI [00:16:48](https://www.youtube.com/watch?v=vlfCjWuv4es&t=1008s) checks it. And then ultimately, Cloud [00:16:50](https://www.youtube.com/watch?v=vlfCjWuv4es&t=1010s) can just start them as well. So, almost [00:16:52](https://www.youtube.com/watch?v=vlfCjWuv4es&t=1012s) everything we used to do ourselves is [00:16:54](https://www.youtube.com/watch?v=vlfCjWuv4es&t=1014s) now either the model, the harness, or [00:16:57](https://www.youtube.com/watch?v=vlfCjWuv4es&t=1017s) the environment. And we're really just [00:16:59](https://www.youtube.com/watch?v=vlfCjWuv4es&t=1019s) here to start that first one and to just [00:17:00](https://www.youtube.com/watch?v=vlfCjWuv4es&t=1020s) review what comes out. [00:17:02](https://www.youtube.com/watch?v=vlfCjWuv4es&t=1022s) So, if you want to try this in your own [00:17:04](https://www.youtube.com/watch?v=vlfCjWuv4es&t=1024s) setup, I would say just take one thing [00:17:06](https://www.youtube.com/watch?v=vlfCjWuv4es&t=1026s) that's way bigger than you normally give [00:17:07](https://www.youtube.com/watch?v=vlfCjWuv4es&t=1027s) Cloud. Make sure your CI actually [00:17:10](https://www.youtube.com/watch?v=vlfCjWuv4es&t=1030s) catches the things you care about, and [00:17:12](https://www.youtube.com/watch?v=vlfCjWuv4es&t=1032s) then spend a bit of time just [00:17:13](https://www.youtube.com/watch?v=vlfCjWuv4es&t=1033s) configuring your environment, like its [00:17:14](https://www.youtube.com/watch?v=vlfCjWuv4es&t=1034s) network access, its secret, and its, you [00:17:16](https://www.youtube.com/watch?v=vlfCjWuv4es&t=1036s) know, setup script. [00:17:18](https://www.youtube.com/watch?v=vlfCjWuv4es&t=1038s) And then start in the cloud and see [00:17:20](https://www.youtube.com/watch?v=vlfCjWuv4es&t=1040s) where your sessions get stuck and where [00:17:21](https://www.youtube.com/watch?v=vlfCjWuv4es&t=1041s) you're still in the loop because that's [00:17:23](https://www.youtube.com/watch?v=vlfCjWuv4es&t=1043s) the next thing to hand over to Cloud. I [00:17:26](https://www.youtube.com/watch?v=vlfCjWuv4es&t=1046s) also highly recommend checking out our [00:17:27](https://www.youtube.com/watch?v=vlfCjWuv4es&t=1047s) best practices in the docs as well. [00:17:30](https://www.youtube.com/watch?v=vlfCjWuv4es&t=1050s) Thank you so much.