Behind

Setting Up the Perfect Dev & Ops Playground for Your AI Agents

Here at Stew, we’ve dialed in a pretty sweet setup for agentic coding. Of course, the AI landscape moves at lightning speed—honestly, our own workflows tend to completely reinvent themselves every 3 to 6 months! So while this guide might come with an expiration date, we still wanted to take a snapshot of how we’re making magic happen right now in September 2026. 🚀

The biggest mindset shift? We no longer treat AI agents as just another tool in the drawer. Instead, they’ve become our primary interface—the starting line and the finish line for almost everything we do. The key is building an environment where AI can effortlessly access and navigate our entire workflow (from dev and testing to docs, scoped databases, logging, monitoring, and even customer support), assigning and managing tasks seamlessly on the fly.

Remote Dev Servers & CLI Magic 💻

We keep our codebase and CLI tools parked on remote development servers, connecting via SSH from our laptops or even on mobile when inspiration strikes on the go. Everything is securely tied together using a Tailscale mesh network. This frees us from being chained to a single local machine—same repository, identical runtime environment, wherever we are. Running tools like Claude Code (aka claude) or Codex CLI (aka codex) directly on the server means we see live updates the second changes happen. Plus, with a 24/7 server running in the background, handling scheduled jobs, repetitive tasks, and clever automations becomes an absolute breeze.

Bypass Mode (or, as we like to call it: YOLO Mode 😎)

Skipping permission prompts to let commands run continuously via `bypass permissions` is affectionately known around here as *YOLO mode*. It’s a game-changer for speed when handling low-risk, well-defined tasks in a remote setup—think batch searches, test suites, or digging through logs without having to click "Approve" fifty times.

That said, YOLO mode does open the floodgates. If an agent has access to production data or critical credentials, a tiny misstep can turn into a big headache real fast! That’s why we back it up with guardrails: git hooks blocking sensitive files, explicit confirmations before altering AWS infrastructure, and strictly locked-down Cloudflare credentials. Cutting down on tedious clicks is great—turning off your safety net entirely, not so much!

Supercharging File Search with a Custom Fuzzy Search Hook

While we might not reference files manually as often as we used to, quick file referencing is still an absolute lifesaver. In our workflow, while Codex was surprisingly sharp at suggesting the exact short paths we needed, Claude’s default file suggestion felt… a bit sluggish, to say the least. So, we took matters into our own hands and plugged a custom script into `fileSuggestion` inside `.claude/settings.json`.

This script strictly searches files tracked by `git ls-files`, prioritizing prefixes and clean, short paths. If your query is empty, it smartly pops up your recently modified files first! It finds project assets lightyears faster than the default search. The slight catch? Untracked files won't show up, and it does require external dependencies like `fzf`. But trust us, the speed boost is totally worth it.

Locking Down Environment Variables & Sensitive Credentials

When running in bypass or full-throttle "YOLO" mode, AI agents get access to a much wider scope of your codebase. Sure, it’s super convenient—until your security takes a hit. If sensitive files like `.env` get accidentally swept into the chat context, your private keys are out in the wild. To keep our secrets strictly secret, we enforce a bulletproof, two-tier security setup.

First, our global system prompt lays down the law: the AI agent is strictly forbidden from reading or printing `.env` files, AWS credentials, Cloudflare configs, SSH private keys, and auth token stores. Critical files containing real secrets—like `.env*`, `.aws/credentials`, `.cloudflared`, `.npmrc`, or `auth.json`—are completely off-limits. If a secret value is needed, the human engineer checks it manually; the AI is only allowed to verify public identities or harmless configs.

Here’s the reality, though: even with strict rules, AI agents love to "improvise" and might still try peeking into your `.env` if they think it helps solve the task. That’s why you need hard, automated guardrails to physically intercept critical paths before they hit the chat context. We use a deny-list in `.claude/settings.json` paired with a `PreToolUse` hook in `block-credential-access.py` to inspect every file access and Bash command. Commands dumping env vars, decrypting AWS Secrets Manager, logging Lambda environments, or running `wrangler secret` are blocked on the spot—tagged with a clear `[CRED-GUARD]` warning in the logs. Finally, we keep `.claudeignore` tight by filtering out env files, build artifacts, caches, and upload directories to keep context clean and leak-free.

Want to set up these environment guardrails yourself? Here’s how you can prompt your AI agent to keep things neat and tidy.

Keep Global Instructions Lean with a Hierarchical Doc Structure

Files like `AGENTS.md` and `CLAUDE.md` serve as the default rulebook automatically referenced by your AI agents during project tasks. Keep your global instructions lean: stick strictly to the tech stack, non-negotiable security protocols, core coding conventions, and pointers to domain-specific documentation.

Over time, these global guidelines tend to bloat (AI loves sneaking in extra "helpful" rules). When that happens, it's time to put your docs on a diet! Periodically review them to split off detailed topics or trim the fluff. The golden rule? Keep this global guide featherlight—ideally under 100 lines. Nitty-gritty details that aren't needed 24/7 belong in separate files inside the `docs` folder.

Here’s a quick peek at how you can structure it:

The example above illustrates the general concept. When your agent isn't dealing with billing or logging, there's no reason to drag those bulky specs into its working memory. Keeping the context window laser-focused on the task at hand saves precious tokens (and your sanity!). We apply this exact hierarchical structure across our broader documentation, including operational runbooks managed in separate repositories.

Our Go-To Skillsets

Repetitive everyday tasks—like committing, code reviews, creating PRs, and standard Git routines—are packaged into dedicated "Skills." Here at Videostew, we rely on handy shortcuts like `cm`, `rv`, `pull-request`, and `aws`. Skills do much more than save a few keystrokes; they standardize repetitive workflows and allow us to iterate on our processes over time.

We build and manage our skills based on two simple principles. First, **we craft them in-house only when truly necessary.** AI has a knack for hallucinating bloat, so we avoid copy-pasting bloated "all-in-one" skills from the web. Instead, we start with the simplest bare-bones version tailored to our exact workflow, then refine it organically through real-world edge cases. Second, **we only create skills for high-frequency actions.** Packing in too many skills slows down initial session loading and clutters auto-recommendations. For critical but rarely performed tasks, a dedicated guide in the `docs` folder does the trick just fine!

At the end of the day, a "Skill" is just another form of documentation for an AI agent to read. Even a standalone `md` file will yield practically the same results as a formal skill, as long as the execution steps and decision-making criteria are crystal clear. The real difference simply boils down to frequency: how often you need it, and how easily your agent can discover and invoke it.

Integrating Infrastructure CLIs

When it comes to managing cloud infrastructure, we configure our agents to handle most queries and routine tasks automatically. We rely on the AWS CLI for AWS, Wrangler for Cloudflare, and the `gcloud` command suite for Google Cloud. By setting up the CLIs and authentication on our servers, we don’t have to get lost clicking through endless maze-like back-office consoles. Instead, we can simply explain what we need in plain English, and the agent figures out the exact commands and procedures. It can even pull live traffic and billing metrics to help us project costs on the fly—saving budgets and sanity alike.

This is a total lifesaver, especially on AWS. While Cloudflare’s dashboard is clean and intuitive, AWS is an intricate universe with thousands of granular options that demand hours of research just to tweak one setting. With an agent mapping out the relationships between services and configurations for us, we skip the endless documentation rabbit holes and focus on what truly matters: building great features for our video editor.

That said, because infrastructure directly affects live production services, safety comes first! We always enforce strict pre-flight confirmation steps within global guidelines and related skills. The agent must clearly lay out the purpose, exact modifications, targets, and blast radius before any real changes are applied to production.

Dev & Ops Logging Systems

Logs are the unsung heroes of software development: essential for debugging in staging, and mission-critical for analytics, troubleshooting, and fast customer support in production.

On our dev servers, there’s no need to ship logs externally, so we save both backend and frontend logs directly into local files. For the frontend, we hook into the browser's `console` methods to stream logs to a designated endpoint, which appends them into a log file. On the backend, we stick to the framework’s standard logging setup. This allows our agent to directly inspect errors during tests and fix them on the spot—which means no more tedious copying and pasting console logs from the developer's side. Smooth, smart, and hands-free!

In our production environment, client-side errors take a dedicated route via Lambda directly into CloudWatch, while our backend collects framework errors into CloudWatch Logs using syslog and custom log agents. We make sure every log destination and query method is neatly mapped out in our global guidelines—because nobody likes playing detective without a map when a render fails!

Here’s how you can make this work for you:

By centralizing error logs in CloudWatch, you can search and debug using a single, unified approach—even when your architecture is split across multiple servers, workers, and Lambdas. Even if different services log things their own quirky way with vastly different call stacks, centralized logs make tracking down the culprit a breeze. It also empowers AI coding agents to pinpoint issues and cross-reference codebases without breaking a sweat.

Supercharging Your Workflow with GitHub Issues

Working alongside AI agents often feels like wandering into a sprawling decision tree. You dive into Issue A, only to stumble upon hidden edge cases, prerequisite blockers, or post-fix validation steps that need monitoring. That’s where GitHub Issues steps in as our ultimate sanity-saver.

We set up a handy GitHub Issue shortcut skill (like /issue) so we can spin off secondary tasks on the fly. Whenever an unexpected tangent pops up during development, we fire off this command, spawn a spin-off issue, and immediately pivot back to solving Issue A. This keeps tasks from slipping through the cracks while letting our AI agent stay laser-focused on the primary context (saving precious token usage along the way!).

Let’s be real: many video editing glitches don’t show up in isolated code—they emerge only when real-world user media and messy databases collide. Dummy data in dev environments rarely tells the whole story, and quiet bugs that don't trigger fatal error logs can easily vanish into the void. To tackle this, we create a watch issue after shipping, complete with a scheduled observation window and review date (or we attach a monitoring plan to the original ticket). By putting a neat Due: tag and label right at the top of the issue body, tracking review cycles becomes effortless. When the time comes to check in, we review the real collected metrics to confirm: is the bug truly squashed, or does it need another round of polish?

Default Models & Smart Escalation

When running daily dev operations or fine-tuning workflows, most of us use AI agents as our go-to interface. We toss out casual prompts like, "Double-check this," "Inspect that," or "Let's tweak this feature." But every now and then, a seemingly simple task suddenly morphs into a complex beast that demands serious computing brainpower. To keep things budget-friendly without sacrificing quality, we set a capable mid-tier model as our default workhorse (think Claude Sonnet, or Codex Luna/Terra).

To make this work seamlessly, our global instructions teach the agent to know its limits: whenever a heavy-duty task pops up, it automatically delegates the heavy lifting to a high-tier sub-agent (like Claude Opus/Fable, or Codex Sol High). This turns our default model into a savvy traffic controller—delivering the perfect balance of cost-efficiency and horsepower right when you need it.

Here’s how delegation works in practice: the sub-agent scopes out the problem and drafts an execution blueprint. Once the blueprint is handed back, our default model gets down to the actual coding. Is it completely foolproof? Well, not quite. The trade-offs include occasional delegation bottlenecks and the rare moment of hubris where a model tries (and spectacularly fails) to handle an advanced task on its own before asking for help.

The fix? Clear ground rules! Add trigger conditions in your global prompts: escalate immediately for high-complexity tasks, security, auth logic, or database schema migrations—or whenever a task is dragging on and the scope starts ballooning. Keep a crisp division of labor: the main agent manages context, delegates, and executes the code/tests, while the elite sub-agent focuses purely on high-level planning. Escalation triggers will vary from project to project, so test-drive it, iterate, and dial in what fits your workflow best.

※ Pro tip for Claude users: You can leverage unlisted models like 'opusplan' to split your general environment and planning mode cleanly across different models.

※ Rule of thumb: If you already know a task is going to be a brain-melter from the get-go, just kick off with a top-tier model right away!

Integrating Your Operations Manual

Refund policies, refund checklists, account guidelines, baseline troubleshooting protocols... Internal knowledge bases are notoriously massive and constantly evolving with every edge case. Plus, because multiple team members contribute daily, keeping clear revision histories and avoiding documentation conflicts is an absolute must.

Behind the scenes of our AI video editor, we keep our operations manual running smoothly in its own dedicated Git repository packed with markdown (.md) files. The entry point, README.md, acts as the ultimate gatekeeper—mapping out exactly which files handle which domains. Because this repo is authenticated via standard Git CLI or Git MCP and hooked up directly as an agent skill (/manual), our AI can read or tweak operational guidelines on the fly!

※ Pro-tip: This hierarchical documentation structure is our go-to pattern across both general guidelines and runbooks. It’s a lifesaver for cutting down token costs while keeping agent interactions razor-sharp.

A Few Extra Behind-the-Scenes Gems

--

We've rounded up the high-level essentials of our agent-centric development and operations here. Missed something you were curious about? Don't worry—we’ll be spotlighting the rest in upcoming dedicated posts, so stay tuned!