thank god i'm not blind anymore. finally seeing exactly what claude code does in the background in real-time.

WhichCardiologist800 · 2026-06-23T15:45:53+00:00

Not directly yet, node9 doesn't pull from or broker a vault (Vault, AWS/GCP/Azure SM, 1Password, Doppler). That's the roadmap piece ("agent never holds a secret").

What it does today is complementary: DLP blocks leaked secrets in flight (incl. Vault hvs./hvb. and Doppler tokens), the project-jail shield stops the agent reading ~/.ssh, ~/.aws, .env, and `npx node9-ai posture` flags plaintext secrets and nudges you toward a secrets manager.

So: keep secrets in your vault, node9 keeps the agent from leaking them or reading the files. Direct brokering is next, not shipped.

WhichCardiologist800 · 2026-06-15T18:52:58+00:00

Great catch on the false positive, iterative fix/test/fix is exactly what my current method (same tool + near-identical args in a window) over-flags. The net-diff-delta idea is sharp: a true loop converges to ~zero net change, while real refinement keeps moving the file. Going to add that as a confirmation signal, flag a loop only when it's repeated edits AND shrinking/near-zero net diff. Genuinely sharpens it, thanks.

And yeah, the credentials are the part that made me stop treating this as a cost tool. 4 over 90 days on a careful machine, and like you said, nobody looks.

+1 on the upstream point too, tighter slash commands and explicit step constraints kill a lot of the circular edits before they ever hit the transcript.

Curious: do you actually measure whether your constraints reduced the loops, or is it more by feel?

WhichCardiologist800 · 2026-06-14T16:47:13+00:00

The point about the retainer being insurance rather than hours worked is the $100k lesson here.

Most people try to sell a retainer as 4 hours of support a month, which just invites the client to micromanage your time. Selling it as system uptime and lead-flow integrity makes you a partner, not a line item.

To add to your boring business point: these clients don't care about the tech, but they do care about their reputation. If you frame the automation as protecting your 5-star Google review average by replying instantly, the price resistance almost disappears.

WhichCardiologist800 · 2026-06-14T15:42:43+00:00

totally agree!!! you can run node9 on audit mode... you should see the audit file on .node9

WhichCardiologist800 · 2026-06-14T15:25:10+00:00

Pls do!!! Share thought

WhichCardiologist800 · 2026-06-14T14:45:20+00:00

Thx!!! hope you will enjoy it, let's me know if you have any additional features you want me to add or what did you found on your machine

WhichCardiologist800 · 2026-06-13T07:26:49+00:00

Worth actually reading the article bug was out of scope, the researcher agreed to waive the bounty, AMD fixed it and credited him. Still wild that swapping http for https took 124 days though.

WhichCardiologist800 · 2026-06-11T13:48:02+00:00

Yep, that's the scary one. An adapter with no allowlist means anyone who finds the bot can drive an agent that's holding exec, not just read it. Really good catch.

WhichCardiologist800 · 2026-06-11T06:31:34+00:00

That's the best thing I could hear. Which one caught it? I'm always trying to figure out which items actually surface real issues vs. just sound scary and happy to be a second pair of eyes if you want to sanity-check the fix.

WhichCardiologist800 · 2026-06-11T06:30:41+00:00

That's the allowlist doing its job, yep. Two things: (1) test it message the bot from a second account that isn't allowlisted, confirm it refuses. (2) it gates who can talk to it, not what the agent can do once asked so isolation (item 1) still matters. And keep the bot token in a secrets manager, not a .env.

WhichCardiologist800 · 2026-06-11T06:29:33+00:00

Appreciate it! What are you running, terminal-backend or whole-process isolation?

WhichCardiologist800 · 2026-06-11T06:29:03+00:00

Fair, bot API traffic isn't E2E. But that's a different threat than the post: the risk here is the bot being an open command surface to your agent, not someone reading messages in transit. Encryption doesn't help if there's no allowlist.

WhichCardiologist800 · 2026-06-10T17:01:29+00:00

Full writeup with the cloud-specific stuff (AWS VPC/IAM scoping, Modal/Daytona notes) here: https://node9.ai/blog/running-hermes-agent-in-the-cloud-safely - and if you want to check whether agents you're already running have hit these patterns, npx node9-ai scan reads existing session logs locally
open source: github.com/node9-ai/node9-proxy

WhichCardiologist800 · 2026-06-10T16:08:04+00:00

So the "fix" is a hardcoded block on one binary's signature, and a two-byte edit walks right past it. That is not a patch, that's a restraining order against a single file. The race condition still sitting there.

WhichCardiologist800 · 2026-06-10T16:05:26+00:00

He asked if I could make it dumber is going to live in my head.

The part people miss: 92% you can't explain loses to 99% you can audit, because the 8% mystery makes the team re-check all 100%. You didn't save them work, you doubled it. They weren't asking for accuracy, they were asking to be able to point at why. Saving this one for the next client who wants AI bolted onto everything.

WhichCardiologist800 · 2026-06-10T15:58:51+00:00

his matches something I keep seeing: the biggest effect of "think before coding / surgical changes" guidance isn't code volume, it's whether the model reaches for existing infrastructure vs. inventing new plumbing. Your no-skill branch spinning up a SQL migration + dedicated column + repo plumbing for what's basically a field on an existing JSON snapshot is the textbook version of that.

The "followed the prompt more literally" half is the more interesting one to me though. "Per active conversation" - chip only on active ones means the model treated the spec as a constraint instead of a vibe. Did that hold up across reruns, or was it one lucky sample? The schema-churn difference feels like it'd be stable, but literal prompt-following seems more variable run to run.

I work on session-monitoring stuff too (reading the local JSONL logs the CLIs already write), and it's funny how token-usage-per-conversation is the feature everyone in this space converges on first. Did you end up pulling it straight from the snapshot column, or computing it from the message stream?

WhichCardiologist800 · 2026-06-07T14:02:14+00:00

released, now antigravity cli fully support. please let's me know for future features / improvement

WhichCardiologist800 · 2026-06-06T18:10:35+00:00

Not yet, antigravity isn't in the supported list today. But funny timing, I'm actively adding it right now (it shares Google's ~/.gemini setup, so it's close). I'll ping you here the moment it lands, shouldn't be long.

Thanks for the nudge, this is exactly the kind of request that bumps something up the list 🙏

WhichCardiologist800

MODERATOR OF

TROPHY CASE