Behind

Setting Up Dev & Ops for AI Agents (Without the Headache)

At Stew, here is how we set up our environment for agent-based coding. However, since the AI landscape shifts at lightning speed—and our own workflows tend to completely reinvent themselves every 3 to 6 months—this post might have a pretty short shelf life! Still, we wanted to take a snapshot and document how we're building things right now, in September 2026.

The key takeaway is that we no longer treat AI agents as just "another tool in the toolbox." Instead, they have become the primary interface where every single workflow begins and ends. We're at a point where setting up environments so AI can access, control, and orchestrate tasks across the board—from dev & testing, documentation, restricted DB access, logging, and monitoring, all the way to customer support—is what truly moves the needle.

Remote Dev Servers & CLI in Action

We keep our codebase and CLI tools on dedicated dev servers and simply SSH in via laptops or mobile devices. Access to development servers and internal services is secured through Tailscale mesh networking. This means we're never tied down to a specific machine; we can tap into the exact same repo and runtime environment from literally anywhere. The biggest win? We can run tools like Claude Code (claude) or Codex CLI (codex) directly on the server and instantly preview changes on the dev environment. Plus, having a 24/7 always-on server makes setting up scheduled tasks, recurring jobs, and automations a breeze.

Bypass Mode (A.K.A. YOLO Mode 🚀)

Skipping approval prompts and letting commands run sequentially using `bypass permissions` is affectionately known as "YOLO mode." It's an absolute game-changer when you need to fly through low-risk, well-scoped tasks in a remote setup—think repetitive searches, running test suites, or digging through logs at warp speed.

Of course, with great power comes great responsibility! Granting bypass access expands the agent's reach significantly, and if it has access to production servers or sensitive credentials, a small slip-up can turn into a big headache. That’s why we always back it up with guardrails: hooks that block access to sensitive files, mandatory confirmations before AWS changes, and tight restrictions around Cloudflare credentials. Streamlining approvals doesn't mean giving unchecked power—it's all about running fast without breaking things!

Smarter File Discovery with Fuzzy Search Hooks

While we might not type out full file paths as often as we used to, seamless file referencing is still an absolute lifesaver. In our workflow, we noticed that while Codex reliably suggests neat, concise paths when mentioning files, Claude's default file suggestions felt… a bit sluggish. So, we took matters into our own hands and hooked up a custom script under fileSuggestion in .claude/settings.json.

This nifty script only scans files tracked by git ls-files, prioritizing matching file prefixes and tidy, short paths. If your search query is empty, it smartly pops up your most recently modified files first! While it finds project files significantly faster than the default search, keep in mind that untracked files won't show up, and you'll need fzf installed (along with any external dependencies) to make the magic happen.

Locking Down Environment Variables and Secrets

Running in bypass or "YOLO" mode might give AI agents superpowers, but it also opens the door to a wider range of files. Convenience is great—until your sensitive secrets take center stage! High-stakes files like .env should never accidentally leak into a chat window. That’s why we maintain a rock-solid, two-tier security setup.

First, our global instructions strictly forbid the agent from reading or printing secrets like .env, AWS credentials, Cloudflare configs, private SSH keys, or token vaults. Files packed with real-world secrets—think .env*, .aws/credentials, .cloudflared, .npmrc, and auth.json—are completely out of bounds. If a key is needed, a human checks it; the agent is only allowed non-sensitive identity checks and public lookups.

Of course, rules are meant to be broken—and AI agents love to "helpfully" dig into .env if they think it solves a problem. That’s why you need an automated, hard-blocking hook to keep critical paths out of the chat. We use the deny list in .claude/settings.json alongside a PreToolUse hook in block-credential-access.py to inspect every file access and Bash command. Commands that dump full environment variables, decrypt AWS Secrets Manager, print Lambda envs, or run wrangler secret are stopped dead in their tracks, tagged with a clear [CRED-GUARD] prefix in the logs. On top of that, our .claudeignore ruthlessly strips out env files, build artifacts, caches, and upload directories to keep context clean and leak-free.

Want to set up these environment-guarding rules yourself? You can simply ask your AI agent like this:

Lightweight Global Guidelines & Hierarchical Docs

`AGENTS.md` and `CLAUDE.md` serve as foundational playbooks automatically referenced by your AI agents whenever they work on a project. Keep your global guidelines lean—only include tech stacks, non-negotiable security rules, core coding standards, and pointers to domain-specific documentation.

Over time, these global guidelines love to put on weight (especially when agents take the liberty of constantly adding their own tips). Give them a regular diet! Check whether it's time to split docs or trim the fat. Our golden rule: keep these global instructions super compact, ideally under 100 lines. Anything that isn't essential for every single context belongs in a separate file inside the `docs` folder.

For instance, you could structure it like this:

The example above is a blueprint to show the concept. If a task has nothing to do with payments or logging, there's no reason to drag those heavy docs into the AI's context. By feeding only what's necessary, you save precious tokens and keep responses razor-sharp! We apply this exact same hierarchical magic across all our documentation, including operational runbooks managed in dedicated repositories.

Go-To Skill Sets

Frequent, repetitive tasks—like committing, code reviewing, creating pull requests, or running Git workflows—are bundled into "Skills." At Videostew, we rely on handy shortcuts like `cm`, `rv`, `pull-request`, and `aws`. Beyond just saving your fingertips from extra typing, skills standardize recurring workflows and allow your team to fine-tune them continuously.

We build and manage our skills based on two simple principles. First, build bespoke, only when truly needed. AI can easily bloat code or copy-paste overly generic templates from the web, so we skip the "one-size-fits-all" shortcuts. We start with the bare minimum tailored strictly to our workflow, then refine, add, or strip away edge cases as we run the engine. Second, turn only high-frequency tasks into skills. Too many skills clutter session startups and overload suggestion lists. For those rare-but-vital tasks, a dedicated guide in `docs` will always do the trick.

At the end of the day, a "skill" is simply a piece of documentation your AI agent reads. Even a standalone `md` file can deliver virtually identical results to a formal skill, as long as you've clearly outlined execution steps and decision-making criteria. The real difference? How often it gets used, and how effortlessly your agent can discover and summon it when you need magic to happen.

Supercharging Infra Management with CLIs

Running a cutting-edge video editing platform means heavy lifting behind the scenes. We configure our AI agents to handle most routine lookups and repetitive infra tasks right through native CLIs: AWS CLI for AWS, Wrangler for Cloudflare, and the `gcloud` command for Google Cloud. Once the CLIs and authentication are set up on the server, you no longer have to wander endlessly through dizzying back-office dashboards. Just describe what you need in plain English, and the agent pulls up the right commands and workflows. It can even crunch traffic and billing metrics on the fly to help estimate your cloud costs!

This is an absolute lifesaver with AWS. While Cloudflare's dashboard is wonderfully clean and intuitive, AWS is an expansive galaxy of hyper-specialized services where tweaking a single setting feels like deciphering ancient scrolls. Having an agent map out the relationships between services lets you bypass the steep learning curve and focus on what truly matters: building an awesome product.

Of course, with great power comes great responsibility—infrastructure changes directly impact live video rendering and user experience. That's why we bake a strict pre-flight check right into our global guidelines. The agent must verify the purpose, the exact diff, the target resource, and the potential blast radius before pulling the trigger on any live modifications.

Smart Dev & Ops Logging

Logs are the unsung heroes of software development: essential for debugging in dev environments, and mission-critical for analytics, troubleshooting, and customer support in production.

In local and dev environments, there’s no need to blast logs off to external monitoring tools. We keep things fast and tidy by saving both backend and frontend logs directly into local files. On the frontend, we intercept the browser's `console` methods and route them to a dedicated logging endpoint that dumps them straight into a log file. On the backend, we stick to the framework’s standard logging paths. This means our AI agent can autonomously inspect test logs and patch issues on the spot—saving you from the tedious ritual of copying and pasting console errors back and forth!

Behind the scenes in our production environment, client-side glitches take a quick detour through dedicated ingestion pipelines like AWS Lambda before landing safely in CloudWatch. Meanwhile, our backend gathers framework errors through syslog and log agents straight into CloudWatch Logs. To keep everyone on the same page, we document which logs live in which CloudWatch resources and how to query them right in our global guidelines or dedicated log docs.

Here is why this powers up our workflow (and your editing experience!):

By centralizing error logs within CloudWatch, we can track down bugs the exact same way—even when features are scattered across multiple servers, microservices, and serverless Lambdas. Even if different services log events and stack traces differently, having a single source of truth makes tracing issues a breeze. It helps our AI agents pinpoint root causes and map them back to the exact lines of code in seconds.

Seamless Integration with GitHub Issues

Pairing up with AI coding agents can feel like opening a can of worms—in a good way! While digging into Bug A, you often uncover hidden edge cases, prerequisite fixes, or resolved tweaks that still need some post-launch monitoring. That’s where GitHub Issues steps in to save the day.

To make tracking effortless, we built a dedicated command (`/issue`). Whenever a side quest pops up mid-development, we simply trigger the skill to spin up a sub-issue, then dive right back into tackling Bug A without losing our groove. Nothing slips through the cracks, and our AI agent stays laser-focused on one task at a time—which keeps context crystal clear and saves precious tokens.

Let’s be real: video editing handles heavy, complex files, and many quirks don’t reveal themselves through pure code alone. They show up when real-world user media meets our database. With harmless dummy files, subtle rendering hiccups might never trigger a loud error and could easily get lost in the noise. To stay ahead of this, once a fix goes live, we create a dedicated `watch` issue (or add an observation plan to the original ticket) with a set observation window and check-in date. Using a clean `Due:` header metadata line and labels, scheduling follow-ups becomes second nature. When it’s review time, we let the real-world metrics tell us whether it's truly resolved or needs an extra layer of polish.

Base Models and Auto-Escalation

When running day-to-day coding or operations, most of us use AI agents as our go-to interface. We toss out casual prompts like "check this," "run a test on that," or "let's build this." But let's be real—sometimes a seemingly simple context suddenly turns into a heavy-duty puzzle that demands some serious brainpower. To keep things wallet-friendly without sacrificing speed, we set a balanced mid-tier model as our default (think Sonnet for Claude, or Luna/Terra for Codex).

Here’s the secret sauce: through our global instructions, we train the agent to recognize heavy-lifting tasks and automatically delegate them to a high-tier sub-agent (like Claude's Opus/Fable or Codex's Sol High). This turns our base model into a smart router that always picks the right brain for the job—cost-efficient, yet ready to flex when needed.

Delegation means the heavy-duty sub-agent scopes out the problem and drafts an action plan. Once the blueprint is delivered, the base model rolls up its sleeves and writes the actual code. Is it flawless? Well, not always. You might hit a slight bottleneck during handoffs, or facepalm when the base model tries to tackle a genius-level task on its own and makes a mess.

The fix is simple: add clear ground rules. Instruct your base agent to delegate whenever it smells high-complexity tasks, security/auth issues, or DB schema changes—or simply when a task takes too long and spirals out of scope. Clearly separate the roles: the Main Agent delegates, provides context, writes code, and tests; the Sub-Agent plans. Since every project has its own vibe, you can fine-tune these escalation triggers as you go.

※ Pro tip for Claude users: there's an unlisted model called 'opusplan' that lets you neatly split your models between general execution and dedicated planning mode.

※ Of course, if a task screams "danger zone" right from the start, we just bring in the heavyweight model from day one.

Syncing with Operations Manuals

Refund policies, refund requirements, account management, operational essentials... internal manuals are absolute beasts, constantly growing with every edge case that pops up. Plus, since the whole team touches them, keeping a rock-solid version history without merge conflicts is an absolute must.

Behind the scenes of our AI video editor, we keep our entire operations manual in a dedicated Git repository packed with Markdown (.md) files. Think of the root README.md as our main lobby—a central gateway pointing you (and our AI) to exactly which files handle what. We’ve hooked this repo up via standard Git CLI and Git MCP, mapped directly as an AI skill (/manual). This means our AI agents can look up guidelines or push updates on the fly, keeping our workflow as fast and smooth as our video exports.

※ Pro-tip: This hierarchical document structure is our secret sauce, whether for general instructions or ops manuals. It’s an absolute lifesaver for cutting down token costs while keeping context razor-sharp. Efficient workflows = better, faster video tools for you!

A Few More Behind-the-Scenes Gems

--

We’ve covered the big picture of agent-centric development and operations here! Don’t worry if your favorite topic missed the cut—we'll be diving into the missing pieces in future posts, so stay tuned!