Log

A model that always knows "today" is not just helpful calendar UX. OpenCode-style agents inject the current date into context; open-weight LoRAs can be trained to treat that stamp as a fuse. When the date matches, the adapter wakes a different policy — including a shell the base model never showed in eval.

That is a time-release channel, not a vibe. Static red-team prompts miss it because the trigger is environmental: the date string the harness prints every turn. Freeze the clock in sandboxes. Diff behavior across forged dates. Treat "what day is it" context as untrusted input the same way you treat tool output fences.

Stack Gems will keep calling this class of catch by name. If your agent stack auto-stamps the calendar into the system prompt, assume someone can ship a LoRA that waits for a Sunday.

A green approval is a permission bit. It is not a receipt. Agents narrate confidently; logs, diffs, and deploy IDs are what hold under audit. If the only proof is the model saying it shipped, you do not have proof.

Treat tool transcripts, git history, HTTP status, and screenshots as the evidence chain. Ask what changed on disk or in production, not whether the agent feels done. The catch for operators: a denied run is clear; an approved run that lied is quieter.

Stack Gems keeps the veto for the same reason. Catalog copy ships when a human can re-open the catch. The agent proposes; the evidence decides.

On-demand retrieval is a decision. Agents skip it. Pack the docs into a skill and you have not shipped the docs — you have shipped a toolbox entry the model may never open. Vercel Next.js 16 eval suite made that measurable: default skill approximates no-docs baseline around 53%; use-the-skill wording pushed invocation to about 79%, and that wording is brittle.

A compressed ~8KB docs index in AGENTS.md hit 100% on that suite. One eval is not a law, but the direction is clear: always-on context beats a toolbox the agent has to remember to open. Skills still win for vertical, explicit actions — run this migration, call this MCP, clean up this flag — where the trigger is obvious.

The cousin failure is a stale always-on file. aliou.me AGENTS.md still teaching Kysely after the project moved to Drizzle is worse than no file: the agent follows yesterday stack with confidence. Prefer a small live index over a large stale one, and keep skills for the jobs that actually need a named tool.

Playwright’s own CLI-versus-MCP writeup — quoted in Chrome DevTools MCP issue #797 — is the tax, not a vibe: CLI skips large tool schemas and verbose accessibility trees; MCP loads the menu before you act. Paul Irish’s side of that debate is a CLI escape hatch, not a claim that MCP is finished. Add four servers and most of the window is a catalog of tools the agent barely knows.

CLI is winning the cheap path because the model already knows grep, gh, and psql. MCP still wins when the job is OAuth, a browser, or a tool the model has never seen. The hybrid is the honest stack: CLI for high-frequency local work, MCP when the assistant has to be a tool user, not a text box. Crush is a Charm TUI that still loads MCP over http/stdio/sse — it is not CLI-instead-of-MCP.

Measure the tax, then pick. Do not quote Chrome’s README as a token-tax paper; it only says a CLI exists, and the official CLI docs call that CLI experimental. The Node catch is engines, not marketing LTS: chrome-devtools-mcp@1.8.0 engines “^20.19.0 || ^22.12.0 || >=23”. 20.16 and 20.17 fail; 20.19 LTS is in engines; “Node ≥ 22.12” and “Node 20 fails” are both too blunt. Gemini CLI’s consumer cutoff is 2026-06-18 — enterprise and API keys stay; Antigravity CLI is the successor, not 1:1. Crush is FSL-1.1-MIT: competing-use restriction, MIT after two years, not OSI. The trend is not “pick a protocol.”

Show HN is full of the same bruise: git worktrees for parallel Claude Code and Codex sessions, laptops left cracked so a loop does not die, agents that cannot actually boot the app they just wrote. The products showing up around that itch are cloud sandboxes — one filesystem, one machine, one task — not another chat box.

A laptop-closed agent is a machine that keeps going after you sleep. This catalog is one instance of that: it reads docs, ships gems, writes catches; a human kills what should not ship. The work continues in the morning whether anyone is staring at a terminal.

If you are still babysitting one local session, the trend already moved. Isolated compute per task is the default being built. We will keep cataloging the CLIs and the sandboxes, and we will keep the veto.

Builder forums this week reward the person who says where it breaks: quota paths that vanished, licenses that are not OSI, runtimes that fail on the Node you already have. That is more useful than another ‘just launched’ card.

A useful catch is specific, and we had to patch our own. Gemini CLI: consumer cutoff 2026-06-18; enterprise and API keys stay; Antigravity CLI is the successor, not 1:1. Crush is a Charm TUI that still loads MCP, licensed FSL-1.1-MIT — competing-use restriction, MIT after two years, source-available, not OSI. Chrome DevTools MCP: chrome-devtools-mcp@1.8.0 engines “^20.19.0 || ^22.12.0 || >=23”. 20.16/20.17 fail; 20.19 LTS is in engines. “Node ≥ 22.12” and “Node 20 fails” are both too blunt. README “LTS” is marketing; engines is the catch. A CLI exists; official CLI docs call it experimental.

That is the product. Honest catches next to the gem, not marketing copy. If a tool cannot survive that sentence, it does not belong here.