safe-coding-agent-workflow - The LGTM

The LGTM

Sign in Subscribe

safe-coding-agent-workflow

A collection of 12 posts

Claude Code 2.1.191 Fixes the Background-Agent Zombie Problem

Claude Code 2.1.191 Fixes the Background-Agent Zombie Problem

Claude Code 2.1.191 is a patch release, but the lead fix deserves a much louder headline: stopped background agents no longer resurrect. That is the kind of sentence that sounds funny until you remember that background agents are not browser tabs. They are delegated coding sessions with tools,

Qwen Code 0.19.2 Makes Permission Policy a Remote API, Not a Slash Command

Qwen Code 0.19.2 Makes Permission Policy a Remote API, Not a Slash Command

Qwen Code 0.19.2 is not really about a new command. It is about admitting that a local coding agent is no longer just a terminal process with a chat loop attached. Once the same agent can be reached through a daemon, an ACP client, a browser surface, and

OpenClaw’s Inline-Eval Patch Is the Boring Guardrail Vibe Coding Needs

The boring parts of agent security keep doing the real work. OpenClaw PR #96216 is not glamorous: it teaches strict inline-eval detection that python3.13 -c, /usr/bin/pypy3.10 -c, PHP -B/-E/-R, and R/Rscript -e/--exec are still inline code execution. That sounds obvious. It was

OpenClaw Is Closing the Policy Gap Between Who Asked and What Tool Runs

OpenClaw Is Closing the Policy Gap Between Who Asked and What Tool Runs

Approval gates have a branding problem: they look like security controls, but too often they are just modal dialogs with incomplete context. OpenClaw PR #96211 is interesting because it goes after the field most agent platforms quietly hand-wave: requester origin. Not just “what tool is about to run,” but who

Claude Code’s Prompt-Injection False Memory Bug Is How Safety Heuristics Become Superstitions

Claude Code’s Prompt-Injection False Memory Bug Is How Safety Heuristics Become Superstitions

Claude Code’s latest prompt-injection report is not alarming because the model saw hostile text. It is alarming because, according to the reporter, the model invented the hostile text, diagnosed it as a prompt injection, and then wrote that diagnosis into memory where future sessions could inherit it. That is

OpenClaw’s Approval Flow Has a Routing Bug, Which Is Exactly Why Approval Gates Need End-to-End Semantics

OpenClaw’s Approval Flow Has a Routing Bug, Which Is Exactly Why Approval Gates Need End-to-End Semantics

Approval gates are supposed to be the part of an agent platform where everyone can finally relax. The model wants to run something risky, the runtime pauses, the human approves or denies, and the system continues under supervision. OpenClaw issue #96103 is a useful reminder that this picture is too

Grok Build’s /goal Mode Is xAI’s Agent Handoff Primitive — and Its Next Safety Test

Grok Build’s /goal Mode Is xAI’s Agent Handoff Primitive — and Its Next Safety Test

xAI’s new /goal mode for Grok Build looks small if you squint: one more slash command in a terminal coding agent. That is the wrong read. The interesting part is not the syntax. It is the contract change. Grok Build is no longer only asking developers to supervise a

Task Guard’s NO_REPLY Bug Shows Why Agent Safety Instructions Need Exit Conditions

Task Guard’s NO_REPLY Bug Shows Why Agent Safety Instructions Need Exit Conditions

The uncomfortable thing about prompt-based safety is that the model keeps reading the prompt after the moment you meant it to apply. OpenClaw issue #95773 is a clean example: Task Guard tells the model that the final reply for the turn “must be and can only be NO_REPLY,” then