Behind

Behind the Scenes: Inside the Stu Team’s AI Agent Playground

At Stew, we've set up our environment for agent-based coding as follows. Since the AI landscape evolves at breakneck speed—and our own usage patterns tend to shift drastically every 3 to 6 months—this post might have a pretty short shelf life! Still, we wanted to capture a snapshot of how we're building things as of September 2026.

As a lean team, we operate on a true DevOps model where everyone shares the load across development and operations. Because of this, our remote dev environments, access permissions, docs, logs, and issue tracking are seamlessly integrated into a single, cohesive workflow.

Remote Dev Servers & CLI Operations

We keep our codebase and CLI tools directly on development servers, connecting via SSH from laptops or even mobile devices on the go. Access to these dev servers and internal services is secured through a Tailscale private network. This means we're never tied down to a single machine—we get the exact same repository and runtime environment wherever we are. Running Claude Code (hereafter claude) or Codex CLI (hereafter codex) right on the server lets us see changes instantly, which is easily the biggest perk. Plus, having a 24/7 server spinning makes scheduling, recurring jobs, and automation a total breeze.

Bypass or "YOLO Mode"

The `bypass permissions` approach—skipping approval prompts to execute commands sequentially—is affectionately known around here as YOLO mode. It’s a lifesaver when you want to power through low-risk, well-scoped tasks in a remote environment, like repetitive searches, running tests, or sifting through logs at lightning speed.

That said, going full YOLO drastically expands what an agent can touch. If it has access to production servers or credentials, a single slip-up can escalate fast. That’s why we layer in strict guardrails: sensitive file-blocking hooks, mandatory confirmation before AWS modifications, and locked-down Cloudflare credentials. Slashing approval friction is one thing; letting AI run completely wild without a safety net is another!

Supercharging File Search with a Fuzzy Search Hook

While we might not reference files manually as often as we used to, quick file referencing is still a lifesaver. In my experience, while tools like Codex are pretty spot-on at suggesting the concise paths you actually want, Claude’s default file search can feel a bit... sluggish. To save some sanity, I hooked up a custom script to `fileSuggestion` inside `.claude/settings.json`.

This script strictly searches files tracked by `git ls-files`, prioritizing file prefixes and shorter paths. If your search query is empty, it neatly serves up recently modified files first. The massive upside? Finding project files way faster than the default setup. The catch? Untracked files won't show up, and it relies on external dependencies like having `fzf` installed.

Locking Down Environment Variables & Sensitive Credentials

Running in bypass or full "YOLO mode" gives your AI agent broader access to your file system. Sure, it's super convenient—until your security takes a hit. If sensitive environment variables like your `.env` leak into the chat context, game over. That’s why we run a strict, two-layer security barrier.

First, our global rules explicitly forbid the agent from ever reading or printing `.env` files, AWS credentials, Cloudflare configs, private SSH keys, or token stores. Files with actual secrets—like `.env*`, `.aws/credentials`, `.cloudflared`, `.npmrc`, and `auth.json`—are strictly off-limits. If a value is needed, a human checks it; the agent is only allowed to verify identities or fetch public info where secrets stay hidden.

Let’s be real, though: even with global instructions, an ambitious agent will sometimes ignore the rules and try snooping into `.env` anyway if it thinks it helps. That’s why you need an automated, mechanical kill-switch. We combine a deny list in `.claude/settings.json` with a `PreToolUse` hook via `block-credential-access.py` to intercept file reads and Bash commands. Any attempt to dump all environment variables, decrypt AWS Secrets Manager, inspect Lambda envs, or run commands like `wrangler secret` gets instantly shut down (tagged with a neat `[CRED-GUARD]` in the logs). We also use `.claudeignore` to filter out env files, build artifacts, cache, and upload directories—keeping the context lean, mean, and secure.

If you’d like to set up these protective guardrails yourself, here’s how you can prompt your AI agent to get the job done.

Keep Global Guidelines Lean, Make Document Structures Hierarchical

`AGENTS.md` and `CLAUDE.md` serve as the default rulebooks automatically referenced by your AI agents depending on who’s on duty. In these global guidelines, we only keep the essentials: tech stack, non-negotiable security rules, core coding conventions, and links to domain-specific docs.

Over time, as agents love to enthusiastically sneak in their own rules, this file tends to bloat. That’s why we periodically put it on a diet—trimming unnecessary fluff and splitting out heavy topics into separate docs. The goal is to keep these global guidelines as lean as possible, ideally under 100 lines. Any deep-dive details that the agent doesn't need to know every single second belong in dedicated files inside the `docs` folder.

Here’s a quick example of how you can structure it:

The example above illustrates a practical, modular setup. If a task has nothing to do with billing or logging, there's no reason to drag those heavy docs into the AI's context window. By loading only what's necessary, you save precious tokens and keep responses razor-sharp. We apply this exact same hierarchical philosophy across our broader documentation, including operational playbooks managed in separate repositories.

Building Your Go-To Skills

Frequent, repetitive tasks—like making commits, running code reviews, opening pull requests, or handling Git operations—are organized into custom "Skills." At Videostew, we rely on shorthand skills like `cm`, `rv`, `pull-request`, and `aws`. Skills do much more than just save you a few keystrokes; they lock in reliable workflows and make your everyday routines easy to refine over time.

We build and manage these skills with two golden rules in mind: First, we build them in-house only when genuinely needed. AI has a knack for over-engineering code and docs, so we avoid copying "all-in-one magic skills" off the internet. Instead, we start with the simplest bare-bones version tailored to our exact workflow, testing and tweaking edge cases as we go. Second, we only turn high-frequency routines into skills. Hoarding too many skills can slow down session loading and clutter up your prompt menu. For tasks that are critical but rare, a well-placed guide in `docs` does the trick much better.

At the end of the day, an agent's "skills" are just structured documents it reads and executes. Even a simple standalone `md` file can deliver virtually identical results—as long as execution steps and decision criteria are clearly outlined. The real difference simply boils down to: how often do you need it, and how easily can your agent discover and summon it when magic needs to happen?

Supercharging Infra with CLI Integration

Managing cloud infrastructure doesn't have to mean drowning in complex dashboards. We configure our agents to handle most queries and repetitive ops tasks directly. Think AWS CLI for AWS, Wrangler for Cloudflare, and `gcloud` for Google Cloud CLI. Once the CLI and credentials are set up on the server, you no longer need to hunt through endless back-office menus. Just describe what you want in plain English, and the agent identifies the right commands and workflows. It can even pull real-time traffic and cost metrics to estimate your infrastructure bill before surprises hit!

This is an absolute lifesaver, especially with AWS. While Cloudflare’s dashboard is neat and breezy, AWS is a sprawling maze of granular services where finding a single toggle can eat up your afternoon. Having an agent map out the relationships between services and settings saves you countless hours of reading dense documentation, letting you focus on what really matters—shipping awesome features for your video projects.

A quick pro-tip, though: infrastructure directly impacts live production. That means strict guardrails are a must! Always include a pre-flight confirmation check in your global guidelines or skill definitions. The agent should verify the task objective, planned modifications, target resources, and potential blast radius before executing any real changes.

Smart Logging: Dev & Ops Without the Headache

Logs are your ultimate safety net—essential for smooth debugging during development, and critical for performance tracking, analytics, and swift customer support in production.

On local dev environments, there’s no need to blast logs off to external platforms. Instead, we capture both backend and frontend logs straight into local files. For the frontend, we intercept the browser's native `console` methods, route them through a dedicated logging endpoint, and write them directly to a file. The backend sticks to standard framework logging paths. The result? The agent can inspect testing logs autonomously and patch issues on the fly—saving you from playing the tedious copy-paste game with your console logs.

In our production environment, client-side glitches take a quick detour through a dedicated ingestion layer (shout out to AWS Lambda) before settling neatly into CloudWatch. Meanwhile, our backend channels framework errors straight into CloudWatch Logs using syslog and trusty log agents. We make sure every log type, its CloudWatch destination, and exact lookup steps are crystal-clear in our global runbooks—because nobody likes playing hide-and-seek with errors when videos are waiting to be rendered!

Here’s why this setup is pure gold:

By centralizing error logs in CloudWatch, you can search and debug across a fleet of microservices and Lambda functions using the exact same playbook. Even when services log differently or throw wildly unique call stacks, a single source of truth makes it effortless for both our engineers and AI agents to pinpoint bugs and cross-check the offending code in seconds.

Syncing Seamlessly with GitHub Issues

Working alongside AI agents can feel like opening a digital Russian nesting doll. You dive deep into Bug A, only to stumble upon a sneakier Bug B, a prerequisite blocker, or something that needs log monitoring before you can truly call it a day. That’s where GitHub Issues steps in to save our sanity.

We set up a handy GitHub Issue command (`/issue`) to keep things buttery smooth. Whenever a rabbit hole appears mid-development, we fire off the command, spin up a spin-off issue, and immediately snap back to Bug A without missing a beat. This keeps side quests from slipping through the cracks while keeping the AI agent laser-focused—which also saves precious context window and tokens (a win for both brainpower and cloud bills!).

Let’s be real: some bugs don't show up with sterile test data; they only emerge when mixed with messy, real-world user content and live databases. If they don't trigger loud error alarms, they might just vanish under the radar. When that happens, we wrap up the fix and tag it with a dedicated `watch` issue, complete with an observation window and a review date. A clean `Due:` tag right at the top line alongside labels makes tracking a breeze. Once the timer dings, we simply say, "Time to review the watch list!" and check real data to confirm the fix actually held up in the wild.

Default Models & Auto-Escalation: Smarter Workflows for Smarter Creators

In the day-to-day grind of coding and operations, most of us use AI agents as our go-to interface. You know the drill: "Check this out," "Audit that," "Let's tweak this video pipeline." But even in a routine groove, you occasionally hit a wall where things get seriously heavy. To keep things cost-effective without sacrificing quality, we set a balanced mid-tier model as our default (like Claude Sonnet, or Luna/Terra for Codex). The trick? We bake global guidelines right into the prompt: whenever a heavy-duty task pops up, the default model automatically summons a high-tier model as a sub-agent and delegates the heavy lifting (like Claude Opus/Fable, or Codex Sol High). This turns our default agent into a smart router—maintaining top-notch balance and calling in the big guns only when needed. Delegating simply means handing over scope analysis and strategic planning to the sub-agent; once the master plan is returned, the base model gets straight to executing the actual code. It's not 100% flawless, of course—delegation can cause a slight bottleneck, and occasionally, an agent stubbornly tries to tackle a genius-level task on its own with messy results (we've all been there!).

To fix this, just bolster your global instructions: tell it to immediately delegate if it sniffs out high-complexity tasks, security, authentication, or DB schema changes—or if a task is taking way too long and expanding in scope. Define a rock-solid separation of concerns: let the Main Agent handle routing, context injection, and hands-on coding/testing, while the Sub-Agent focuses strictly on strategic planning. Escalation triggers will vary from project to project, so test, tweak, and fine-tune your prompts to match your team’s rhythm.

※ Pro tip for Claude users: There's an unlisted 'opusplan' model option that lets you cleanly separate your planning-mode model from your everyday execution environment.

※ For the ultra-complex tasks that you know require serious brainpower from step one? Don't hesitate to deploy the top-tier model right out of the gate.

Other Handy Tips & Tricks

--

This is just a high-level peek behind the curtain at how we build and run things agent-first. We've got plenty more under the hood, so stay tuned—we'll be breaking down the rest in upcoming posts!