But hey! At least these four AI components made it in, so the important stuff is okay...

I simply forbid or force Claude Code to ask for permission to run a dangerous command. Here are my command validation rules:

    (
        r"\bbfs.*-exec",
        decision("deny", reason="NEVER run commands with bfs"),
    ),
    (
        r"\bbfs.*-delete",
        decision("deny", reason="NEVER delete files with bfs."),
    ),
    (
        r"\bsudo\b",
        decision("ask"),
    ),
    (
        r"\brm.*--no-preserve-root",
        decision("deny"),
    ),
    (
        r"\brm.*(-[rRf]+|--recursive|--force)",
        decision("ask"),
    ),

find and bfs -exec is forbidden, because when the model notices it can't delete, it works around with very creative solutions :)

This feels a lot like trying to sanitize database inputs instead of using prepared statements.

What's the equivalent of prepared statements when using AI agents?

Don't have the AI run the commands. You read them, consider them, and then run them yourself.

Why is that a good thing?

I don't think that the whole ecosystem should be dominated by a single VC backed startup.

I want my tools to be interchangeable and to play well with other choices.

Having multiple big players helps with that.

Maybe I'm wrong on this, but I rather have 1 tool everyone else is using. Cargo in Rust ecosystem works really well, everyone loves it.

Imagine if Cargo was not first-party, but a third-party tool belonging to a vc startup with zero revenue.

Then that startup makes rustup, rustfmt and rust-analyzer. Great, but I would be more comfortable with the ecosystem if at least the rust-analyzer and rustfmt parts had competitive alternatives.

I strongly disagree with the author not using /init. It takes a minute to run and Claude provides surprisingly good results.

If you find it works for you, then that’s great! This post is mostly from our learnings from getting it to solve hard problems in complex brownfield codebases where auto generation is almost never sufficient.

/init has evolved since the early day; it's more concise than it used to be.

I think (hope) it's meant to be a joke.

Scott Hanselman have a good blog post about this suggesting you should detach yourself from your code: https://www.hanselman.com/blog/you-are-not-your-code

Especially true when working as an employee where you don't own your code.

This prompt: "What do you have in User Interaction Metadata about me?"

reveals that your approximate location is included in the system prompt.

I asked it this in a conversation where it referenced my city (I never mentioned it) and it conveniently left out the location in the metadata response, which was shrewd. I started a new conversation and asked the same thing and this time it did include approximate location as "United States" (no mention of city though).

I just tried it out and docling finished in 20s (with pretty good results) the same document which in Tensorlake is still pending for 10 minutes. I won't even wait for the results.

There was an unusual traffic spike around that time, if you try now it should be a lot faster. We were calling up but there was not enough GPU capacity at that time.

There is also the llm tool written by simonwillison: https://github.com/simonw/llm

I personally use "claude -p" for this

Compared to the llm tool, qqqa is as lightweight as it gets. In the Ruby world it would be Sinatra, not Rails.

I have no interest in adding too many complex features. It is supposed to be fast and get out of your way.

Different philosophies.

I was excited because it looks really good. I looked into the backend code and it's vibe coded with Claude. All the terrible exception handling patterns, all the useless comments and psychopancy is left there. I can't trust this codebase. :(

You're absolutely right and I appreciate the honest feedback.

Yes, a lot of this was AI-assisted coding (Claude/Cursor), and I didn't clean up all the patterns. The exception handling is inconsistent, there are useless comments, and the code quality varies.

I'm the first to admit the codebase needs a lot of work. I was learning and experimenting, and it shows.

If you (or anyone) wants to improve it, I'd welcome PRs! The architecture/approach might be useful even if the implementation is rough.

Thanks for looking at the code and giving honest feedback - this is exactly the kind of thing I needed to hear.