Behind

Setting Up Your Dev & Ops Playground for AI Agents (Without the Headache!)

At Stew, here’s how we set up our environment for agent-based coding. That said, the AI landscape shifts at breakneck speed—honestly, our own workflow gets a complete makeover every 3 to 6 months—so this post might have an expiration date! Still, we wanted to capture a snapshot of how we get things done right now in September 2026. 🚀

The key takeaway? We no longer treat AI agents as just another handy tool in the shed. They’ve become our primary interface—the starting point and the finish line for literally everything we do. It’s now mission-critical to build an ecosystem where AI can access and control all workflows (dev & testing, docs, scoped databases, logging, monitoring, and even customer support), delegating and managing tasks seamlessly as needed.

Remote Dev Servers & CLI Operations

We keep our codebase and CLI tools parked on a remote dev server, accessing them via SSH from our laptops or even mobile devices on the go. Access to internal services and the dev box is tightly knit through a Tailscale mesh network. This untethers us from any single physical machine, letting us dive into the exact same repo and runtime from anywhere on the planet. The biggest win? Running tools like Claude Code (aka claude) or Codex CLI (aka codex) directly on the server to see real-time results the second code is touched. Plus, having a 24/7 always-on box makes scheduling, repetitive tasks, and background automations an absolute breeze.

Bypass or "YOLO" Mode 🔥

Skipping approval prompts to let commands run continuously—officially dubbed `bypass permissions`—is affectionately known around here as **YOLO Mode**. It's an absolute game-changer for speeding through low-risk, well-scoped tasks like repetitive log lookups, quick searches, and test suites on a remote machine.

Of course, flipping the bypass switch dramatically widens the agent’s playground. If production keys or critical systems are within reach, the blast radius of a tiny slip-up can get spicy real quick. That’s why we back it up with robust safety nets: git hooks blocking sensitive files, mandatory confirmations for AWS infra tweaks, and locked-down Cloudflare credentials. Slashing red tape to move fast is great—giving away the keys to the kingdom blindly is definitely not! 😉

Supercharging File Search with Fuzzy Search Hooks

While we might not manually reference files as often as we used to, file mentions are still an absolute lifesaver. In my workflow, Codex usually does a pretty neat job guessing the short path I want, but Claude’s default file suggestion? Let’s just say it can test your patience. So, I took matters into my own hands and hooked up a custom script to `fileSuggestion` in `.claude/settings.json`.

This script strictly searches files tracked by `git ls-files`, prioritizing file prefixes and shorter paths. If the search query is empty, it politely serves up your most recently modified files first. It’s significantly faster than the default search for digging up project files! The tradeoff? Untracked files get left out in the cold, and you'll need `fzf` installed along with a few external dependencies.

Locking Down Environment Variables & Credentials

Running in bypass or "YOLO mode" lets your AI agent roam freely through a wider range of files. Sure, it feels effortless—until you realize you’ve traded security for convenience. If sensitive files like `.env` sneak into a chat context, your private keys are out in the wild. That’s why we run a tight ship with a two-tier security shield.

First, our global instructions strictly forbid the agent from ever reading or printing `.env` files, AWS credentials, Cloudflare configs, private SSH keys, or token stores. Sensitive files like `.env*`, `.aws/credentials`, `.cloudflared`, `.npmrc`, and `auth.json` are strictly off-limits. Whenever a secret is needed, the human steps in; the agent is only allowed to verify identities or fetch public info where secrets stay hidden.

Here’s the catch: even with strict global rules, an overeager agent will often try to peek into `.env` anyway if it thinks it "helps." That’s why you need hard, automated blocking hooks to keep critical paths out of the chat. We combine the deny list in `.claude/settings.json` with a `PreToolUse` hook in `block-credential-access.py` to inspect every file access and Bash command. Commands that dump all env vars, decrypt AWS Secrets Manager, print Lambda variables, or invoke `wrangler secret` are blocked on the spot—flagged with a clear `[CRED-GUARD]` tag in the logs. On top of that, `.claudeignore` keeps environment files, build artifacts, and cache/upload directories out of the mix, saving you from unnecessary context bloat.

Want to set up these environment-guarding rules yourself? You can simply ask your AI agent like this:

Keep Global Guidelines Lean, Let Document Hierarchy Do the Heavy Lifting

`AGENTS.md` and `CLAUDE.md` serve as the default playbook automatically referenced by your AI agents whenever they work on a project. Keep this global guide strictly focused on your core tech stack, non-negotiable security protocols, essential coding conventions, and pointers to domain-specific documentation.

Over time, global guidelines tend to gain weight—especially when agents eagerly append rules of their own. Every now and then, it’s healthy to put your guidelines on a diet: trim unnecessary fluff and split oversized sections into separate docs. The goal is to keep these global instructions ultra-lean—ideally under 100 lines. Deep-dive details that aren't critical for every single task belong in dedicated files inside a `docs` folder.

Here’s a quick example of how you can organize this:

This is just a general blueprint, but the benefits are huge. When your AI is tackling frontend tweaks, there's no need to clutter its brain (and burn precious tokens!) with billing logic or logging manuals. Only pull in what's strictly necessary. We apply this exact same hierarchical philosophy across our broader documentation ecosystem, including operations manuals managed in separate repositories.

Go-To Skillsets for Everyday Tasks

For repetitive tasks like committing, code reviews, opening pull requests, and routine Git commands, package them into modular skills. At Videostew, we rely on handy shortcuts like `cm`, `rv`, `pull-request`, and `aws`. Skills do much more than save a few keystrokes—they standardize repetitive workflows and allow your team to continuously refine processes over time.

We manage and create skills around two golden rules: First, build them yourself, and only when truly necessary. AI loves to overcomplicate things if you let it, so we skip bloated "do-it-all" skills copied off the internet. Instead, we start with the simplest possible version tailored to a specific goal, test-drive it in real workflows, and polish out edge cases along the way. Second, automate only what happens frequently. Packing your toolkit with too many obscure skills bloats initial session loading and clutters auto-suggestions. For rare-but-vital knowledge, a neat guide in the `docs` folder does the trick much better.

At the end of the day, "skills" are just another type of document that AI agents read. Even with a simple standalone `md` file, as long as you outline the execution steps and criteria clearly, the end result isn't all that different from a native skill. The real difference simply boils down to how often you use it, and how easily your agent can discover and invoke it.

Supercharging Infra Management with CLIs

When it comes to managing cloud infrastructure, we configure our AI agents to handle most of the repetitive queries and routine tasks. We use the AWS CLI for AWS, Wrangler for Cloudflare, and the `gcloud` command suite for Google Cloud. Once the CLI tools and authentication are set up on your server, you can kiss goodbye to getting lost in dizzying back-office consoles. Just explain what you need in plain English, and your agent will figure out the exact commands and steps required—even running traffic and cost estimates so you don't get any nasty surprise bills!

This is a total lifesaver, especially on AWS. While Cloudflare’s dashboard is clean and intuitive, AWS is an endless labyrinth of granular services where finding a single toggle can eat up your afternoon. Having an agent map out the connections between services and settings saves you from studying a whole certification curriculum just to get things running, letting you focus on what really matters: building great products.

A quick word of caution, though: infrastructure directly impacts live production, so safety first! Make sure to bake a mandatory pre-check confirmation into your global instructions or agent skills. Always require the agent to review the task's purpose, proposed changes, target resources, and blast radius before pulling the trigger on any live modifications.

Smarter Dev & Ops Logging Systems

Logs are a developer's best friend—indispensable for debugging during development, and vital for stats, troubleshooting, and keeping users happy in production.

On dev servers, there’s no need to pump logs to external third-party services, so we just save backend and frontend logs straight into local files. For the frontend, we hook into the browser's `console` methods to pipe messages to a dedicated logging endpoint, which writes them directly to a log file. On the backend, we rely on the framework’s default logging pipeline. This means our AI agent can inspect runtime logs autonomously during testing and patch bugs on the fly—saving you from the tedious dance of copying and pasting console logs back and forth!

Behind the scenes of our smooth AI video editor, our production servers capture client-side glitches through dedicated pipelines straight to a collection layer like AWS Lambda, landing safely in CloudWatch. Meanwhile, backend framework errors stream into CloudWatch Logs via syslog and specialized log agents. We keep a tidy master guide (or dedicated log docs) mapping out exactly which CloudWatch resource holds what, and how to query it—because nobody likes playing hide-and-seek with server logs.

Here’s why that’s a game changer for you (and us!):

Centralizing our error logs into CloudWatch means that even with microservices and serverless functions spread across the map, we search them all the exact same way. Even when services log data differently or show unique call stacks, a single source of truth lets our AI agents track down rendering hiccups instantly, pinpoint the culprit code, and get back to making your video creation effortless.

Teaming Up with GitHub Issues

Working alongside AI agents often feels like navigating a sprawling decision tree. You dive deep into "Bug A," only to unearth a hidden side quest, a prerequisite roadblock, or a sneaky edge-case that needs post-launch monitoring. That’s where GitHub Issues steps in to save the day.

To keep the creative momentum flowing, we built a dedicated GitHub issue command (/issue). Whenever a pesky side-quest pops up mid-development, one quick command spins off a child issue instantly. Then, we snap right back to solving Bug A without losing our train of thought. Those spun-off tickets sit safely in the backlog so nothing falls through the cracks. Plus, keeping the AI laser-focused on a single task preserves its context window and saves precious tokens—smart, right?

Let’s be real: video rendering bugs rarely live in isolation—they love tangling with real-world user media, complex database states, and unpredictable file formats. Mock dummy data just can’t replicate that chaos, and silent glitches that don't throw hard errors might get buried forever. When that happens, we wrap up development and spin up a dedicated watch issue with a set observation window, or attach a monitoring roadmap to the existing ticket. By popping a quick Due: tag and handy labels at the top of the issue body, we never miss a check-in date. Once the timer rings, we jump in, review real-world telemetry, and confirm whether the fix held up or needs another polish—keeping your video exports crisp, fast, and fail-proof.

Base Models and Smart Auto-Escalation

When you're knee-deep in coding or running day-to-day operations, you probably treat AI agents like your trusty copilot. Casual requests fly around all day: "Hey, check this out," "Inspect this bug," "Let's ship this." But let’s be honest—every once in a while, a casual task morphs into a monster that demands serious brainpower. To keep things wallet-friendly without sacrificing quality, we set a well-balanced mid-tier model as our default (think Claude's Sonnet, or Codex's Luna/Terra).

Here’s the secret sauce: through global instructions, we train the base model to know its limits. Whenever a genuinely heavy task pops up, it automatically delegates the job by calling an elite sub-agent (like Claude's Opus/Fable or Codex's Sol High). This turns our default agent into a smart router—keeping costs down while unleashing heavyweight intelligence exactly when needed.

How does this delegation work in practice? The heavy-lifting sub-agent scopes out the changes and drafts an airtight battle plan. Once it hands that plan back, our base model jumps back in to do the actual coding. It's almost magical, but watch out: you might hit minor bottlenecks during handoffs, or catch a mid-tier model stubbornly trying to brute-force a genius-level problem.

The fix? Add crystal-clear trigger rules to your global instructions: auto-delegate tasks involving high complexity, security, authentication, or database schema updates. Or simply tell it: "If a task takes too long or the scope explodes, stop and call for backup!" Keep a sharp division of labor—the main agent manages context, delegates up, and handles testing/coding, while the sub-agent focuses purely on master planning. Every project has its own vibe, so feel free to tweak these escalation rules as you go.

※ Pro tip for Claude users: There's an unlisted model called 'opusplan' that lets you seamlessly separate your everyday workspace from your planning mode.

※ Of course, if a mission is obviously massive from day one, there's zero shame in rolling out the big guns right from the start.

Integrating Internal Operations Manuals

Refund policies, edge cases, account guidelines, day-to-day operating knowledge... let's face it, internal service manuals are gigantic beasts. They evolve constantly with every new user scenario. And because the whole team touches them, keeping a clean, conflict-free edit history is an absolute lifesaver.

Ever wonder how we keep our AI video editor running smoothly behind the scenes? We actually manage our entire operations manual as a dedicated Git repository packed with markdown (.md) files! Our README.md serves as the ultimate mission control—a central gateway detailing which files define which domains. By authenticating this repo via standard Git CLI or Git MCP and wiring it up as an AI skill (/manual), our agents can read, look up, and update guidelines on the fly.

※ Fun fact: This hierarchical doc structure is our secret weapon for everything from day-to-day guidelines to operational manuals. It keeps our AI razor-sharp, saves precious tokens, and boosts efficiency across the board.

A Few More Behind-the-Scenes Secrets

--

We’ve rounded up the high-level essentials of agent-centric development and operations here! Don't worry if your favorite topic missed the cut—we’ll be diving into the rest in separate posts coming soon. Stay tuned!