Behind

Setting Up the Dev & Ops Playground for Our Secret Agents (Yes, You!)

At Stew, we're sharing how we set up and navigate our environment for agentic coding. The AI landscape moves at lightning speed—honestly, our own workflows completely morph every 3 to 6 months! While this post might have a short shelf life, as long as the core LLM paradigm sticks around, we think these insights will be super handy. So, consider this our time capsule of how we roll with AI in September 2026.

The biggest shift? We no longer treat AI agents as just another handy tool in the shed. They’ve become the starting block and the finish line for almost everything we do. It’s now mission-critical to build an ecosystem where AI can access and operate across our entire workflow—development, testing, documentation, restricted databases, logging, monitoring, and even customer support—delegating and orchestrating tasks on the fly.

Remote Dev Servers & CLI Workflows

We keep our codebase and CLI tools on a remote dev server, tapping into it via SSH from laptops or even mobile devices. Access to our dev server and internal services is zipped up safely through a Tailscale private network. This means no developer is glued to a specific machine—everyone gets the exact same repo and runtime environment anywhere, anytime. The sweetest perk? We run Claude Code (aka claude) or Codex CLI (aka codex) right on the server and see our code changes come alive instantly. Plus, with a 24/7 server running the show, scheduling recurring jobs and spinning up automations is a breeze.

Letting the Agent Take the Wheel (Responsibly!)

Bypassing approval prompts so commands can run continuously is affectionately known around here as "YOLO mode." It's a lifesaver in a remote dev environment when you need to speed through low-risk, well-defined tasks like repetitive grepping, running tests, or sifting through logs.

Of course, flipping on bypass mode gives agents some serious room to roam—and if they wander near production servers or credentials, mistakes can get pricey real fast. That’s why we back it up with sturdy guardrails: hooks that block sensitive files, mandatory confirmation gates before touching AWS, and tight restrictions on Cloudflare credentials. Skipping tedious confirmations to move fast is great, but giving carte blanche? Definitely not the same thing.

Supercharging Claude's File Search (Because Ain't Nobody Got Time to Wait)

While we might not manually tag files as much as we used to, the file-referencing feature is still an absolute lifesaver. In my experience, while tools like Codex are pretty sharp at suggesting those sweet, concise paths when you mention a file, Claude’s default file search can sometimes feel... a bit sluggish. So, I took matters into my own hands and hooked up a custom script to `fileSuggestion` in `.claude/settings.json`.

This nifty script only tracks files recognized by `git ls-files`, putting filenames and shorter paths front and center. If you haven't typed a query yet, it smartly suggests your most recently modified files first! While it lets you zip through your project way faster than the default search, keep in mind: untracked files won't show up, and you'll need `fzf` installed (along with permissions for external dependencies). A tiny trade-off for lightning speed!

Locking Down Sensitive Data: Safety First, YOLO Later 🔒

Running in bypass or "YOLO" mode might feel liberating, but giving an AI agent free rein over your filesystem comes with real security trade-offs. The last thing you want is your ultra-secret `.env` file casually leaking into a chat context. That’s why we run a rock-solid, two-tier security setup to keep our secrets, well... secret.

First, our global rules explicitly forbid the agent from ever reading or outputting files like `.env`, AWS credentials, Cloudflare configs, private SSH keys, or token vaults. Files packed with real production secrets—like `.env*`, `.aws/credentials`, `.cloudflared`, `.npmrc`, and `auth.json`—are completely out of bounds. If a credential check is required, the human handles it; the agent is only allowed to perform safe identity checks or look up public info where raw values remain untouched.

Here’s the catch: even with strict global rules, an eager AI agent might still try to sneak a peek at `.env` if it thinks it’ll help solve your task! That's why you need a hard-coded blocking hook to mechanically stop sensitive paths from slipping into the chat. We use the deny list in `.claude/settings.json` alongside a `PreToolUse` hook via `block-credential-access.py` to intercept both file access and Bash commands. Any attempt to dump full environment variables, decrypt AWS Secrets Manager, read Lambda envs, or run `wrangler secret` is immediately blocked and tagged with a `[CRED-GUARD]` alert in the logs. On top of that, we maintain a clean `.claudeignore` to filter out env files, build artifacts, caches, and upload directories—cutting down clutter and keeping your context razor-sharp!

Want to set up your own environment guardrails? You can easily guide your AI agent with instructions like this.

Splitting Global Guidelines and Documentation

`AGENTS.md` and `CLAUDE.md` serve as the foundational rulebooks automatically referenced by your AI agents depending on your setup. As your project expands, the list of things the AI "needs to know" grows fast—and if you’re not careful, these global guidelines can bloat uncontrollably, turning into absolute token burners.

That’s why global guidelines should only house the essentials: your tech stack, non-negotiable security policies, core coding standards, and pointers to specific documentation. Because your agent still needs to know what lives where, simply add brief summaries, purposes, and paths for each doc. Keeping this guideline lean—aiming for a sweet spot of roughly 100 to 200 lines—is the golden rule here.

By doing this, the agent smartly decides whether a user’s prompt actually requires extra context and loads only the necessary files for the active session. Less bloat, zero wasted tokens!

Running Custom Skills

Frequent, repetitive tasks—like committing, reviewing, opening pull requests, or running Git commands—are best packaged into dedicated skills. Here at Videostew, we rely on handy shortcuts like `cm`, `rv`, `pull-request`, and `aws`. Beyond just saving keystrokes, skills lock in standardized workflows and allow you to refine them over time.

We build and manage these skills around two simple principles: First, we craft them in-house only when truly necessary. AI tends to overcomplicate both code and documentation, so we steer clear of grabbing bloated "all-in-one" skills off the internet. Instead, we start with the simplest version tailored to our exact workflow, then test-drive and polish it as edge cases arise. Second, we reserve skills strictly for high-frequency actions. Having too many skills can clutter initial session loads and trigger messy recommendations, so low-frequency must-knows are safely tucked away in separate documents under `docs`.

At the end of the day, a "skill" is just another document your AI agent reads. Even a standalone `md` file can deliver virtually identical results to a formal skill—as long as you clearly outline execution steps and decision criteria. The real difference comes down to frequency: how often you need it, and how effortlessly your agent can discover and trigger it.

All Your Infrastructure, Managed in One Spot

Why drown in endless dashboards when your AI agent can tackle the heavy lifting? By orchestrating queries and routine tasks through an agent, cloud management becomes a breeze. Think AWS via AWS CLI, Cloudflare via Wrangler, and Google Cloud with `gcloud` commands. Once your CLI and authentication environments are hooked up, say goodbye to hunting through labyrinthine back-office menus. Just describe what you want in plain English, and your agent figures out the exact commands and workflows needed. Plus, it can evaluate traffic and billing metrics right alongside you to forecast expenses before surprises happen.

This is an absolute lifesaver with AWS. While Cloudflare’s dashboard keeps things refreshingly sleek, AWS sprawls into a universe of ultra-granular services where menus easily turn into mazes. Having an AI agent map out service relationships and configurations saves you from endlessly studying new docs, letting you focus on what actually matters—building an incredible product.

A quick reality check: infrastructure touches live services, so mistakes can sting. Make sure to establish strict "check-before-you-wreck" confirmation steps within your global instructions or skills. Always verify the objective, exact changes, targets, and blast radius before any real-world commands execute.

Keeping Eyes on Everything

Logs are your lifeline—essential for debugging during development, and vital for stats, customer support, and system health in production.

In dev environments, there’s no need to blast logs off to external platforms; simply saving backend and frontend logs as files works wonders. On the frontend, hook into browser `console` methods to stream logs to a local logging endpoint, which writes them directly to a file. For the backend, stick with your framework’s default log paths. This setup lets your AI agent autonomously inspect runtime logs during testing and patch glitches on the fly—saving you from the tedious copy-paste dance of console errors.

In our production environment, errors originating from the client-side are routed through a dedicated ingestion pipeline—such as AWS Lambda—straight into CloudWatch. Meanwhile, on the backend, framework errors are gathered into CloudWatch Logs via syslog and log agents. We make sure to document which CloudWatch resource handles each log type and how to query them, keeping this handy in our global guidelines or dedicated logging docs.

Here is why this setup works like a charm:

By centralizing error logs around CloudWatch, you can search and diagnose issues the exact same way—even if your features are spread across multiple servers and Lambda functions. Even when different services use distinct logging formats and call stacks, having a single source of truth makes tracking bugs a breeze. It empowers our AI agents to pinpoint the exact root cause and cross-reference the relevant code in no time.

Issue Management That Never Drops the Ball

When developing alongside AI agents, you will quickly notice how many rabbit holes pop up. While digging deep into Issue A, you inevitably uncover hidden surprises—prerequisite blockers, side bugs, or resolved quirks that still need log monitoring down the road. That is where we turn to GitHub Issues to keep sanity intact.

To make the workflow seamless, we built a dedicated GitHub issue command (/issue). Whenever a side quest appears during development, we simply trigger this skill to spin off a sub-issue on the fly. Then, we dive right back into Issue A without losing our train of thought. These spun-off issues won’t fall through the cracks, and you can tackle them whenever you're ready. Staying laser-focused on one problem at a time also keeps your agent’s context lean—saving precious tokens in the process!

Let’s be real: many bugs don’t reveal themselves through code alone. They rear their ugly heads only when tangled with real user data or live databases. Dummy data in dev environments rarely catches these nuances, and if an issue doesn’t throw a loud error, it might stay buried forever. Our fix? After shipping code, we set up a watch issue—or add an observation plan to existing tickets—complete with a monitoring period and a review date. By utilizing a Due: metadata tag on the very first line alongside labels, tracking review dates becomes effortless. Once the watch period wraps up, a quick check-in lets us look at real-world data and confidently confirm if the bug is truly squashed or if it needs another round of polish.

Keep Small Tasks Small, Big Tasks Big

As a scrappy, budget-conscious startup, we can't just throw heavyweight, ultra-smart AI models at every little problem 24/7 (our wallets would cry!). So, we're constantly obsessing over efficiency. When writing code or handling day-to-day operations, you'd be surprised how much time is spent on simple nudges: "check this," "verify that," or "let's do this." Even before tackling hefty features, we usually run a few lightweight recon passes first. That's why we set a cost-effective, mid-tier model as our default driver (think Sonnet for Claude, or Terra for Codex).

Here's the trick: in our global system prompts, we instruct this default model to automatically call in a high-tier sub-agent when the going gets tough (like Fable for Claude, or Astra for Codex). This turns our everyday model into a smart router—striking the perfect balance between brainpower and budget.

Delegating looks like this: the sub-agent scopes the work and drafts an actionable game plan. Once it hands that plan back, the primary model rolls up its sleeves and writes the actual code. Is it flawless? Not quite. You might run into occasional delegation bottlenecks, or watch in mild horror as the primary model tries (and fails) to heroically tackle a task meant for a bigger brain.

The fix? Fine-tune your global instructions. Tell it to escalate immediately for high-stakes tasks like security, auth, or DB schema changes—or whenever a task drags on or balloons in scope. Keep the roles crystal clear: the Main Agent handles routing, context injection, coding, and testing, while the Sub-Agent serves as the master planner. Every project is unique, so feel free to tweak these escalation thresholds as you go.

※ Pro tip for Claude users: there's an unlisted mode called 'opusplan' that lets you decouple your everyday environment from planning mode seamlessly.

※ Of course, if a task looks like a beast right out of the gate, we don't beat around the bush—we just start with the heavy hitters from second one.

A Fully Integrated Manual (Because Nobody Likes Chaos)

Refund policies, checklists for processing cancellations, account rules, operational must-knows... Let's be honest, internal service manuals are massive beasts. Plus, they need constant updates every single time a unique edge case pops up. Since the whole team pitches in, having a rock-solid version history without merge nightmares is an absolute must.

Our secret sauce? We manage our entire operational manual in a dedicated Git repository packed with Markdown (.md) files. The entry point, README.md, acts as the ultimate gateway—directing you to which files govern which domains. We authenticate this repo via standard Git CLI or Git MCP and hook it straight into an agent skill (/manual). This means our AI agents can seamlessly pull up answers or push updates anytime, right on the fly!

※ Pro tip: A hierarchical document structure is our go-to pattern for both general guidelines and SOPs. It’s an incredibly smart way to slash token costs while keeping workflow lightning-fast.

A Few More Handy Tricks

--

We've outlined just the core agent-driven development and ops highlights here. Stay tuned—we’ll unpack any missing bits in dedicated follow-up posts!