14 posts tagged #hooks.
Taking the human out of the loop is the real unlock — but headless plus loose permissions plus production access is how you wake up to a wiped repo. Automate only what's tested, sandboxed, and scoped.
A deterministic check on the agent's output, with one retry, kills a class of wrong answers that no prompt rewrite ever reaches — and gives you a number instead of a vibe.
A git pre-commit hook turns 'the agent should run the tests' into 'the agent cannot commit broken code' — a deterministic gate that self-corrects from its own error output and ships with every clone.
Scatter feature-gating logic inline and consistency depends on luck. Collapse the policy into one named helper and make 'call this gate' a rule, and uniform enforcement becomes the default across every endpoint the agent writes.
The dangerous MCP server isn't the malicious one — it's the convenient all-in-one that reads untrusted data and holds privileged access to a second system. Scope it, gate the writes, and you close the confused-deputy attack.
An agent that waits for you to remember to ask it is a toy. Wire a deterministic event to a headless run that reads your rules, and the routine context work fires on its own — with your conventions already baked in.
The fix for slow, flaky agent evals isn't a faster suite — it's two loops. A cheap deterministic gate on every PR, and a slow judge suite headless on a schedule. One blocks regressions; the other discovers them.
Every failed agent session is a labeled example of where your context falls short. Capture them, cluster them, and fix the top category once in your rules file instead of re-correcting it forever.
A rules file is write-once and rots; auto-memory saves corrections but on its own judgment, in its own store. Add the human-gated curation layer the vendors leave open: a command that counts corrections and proposes durable edits, a hook that resolves conflicts, so corrections compound instead of contradicting.
An agent reviewing its own plan shares its own blind spots. Wire a different vendor's model in as a deterministic gate, and a fail verdict re-engages planning before a line of code exists.
Reviewing irreversible actions after the fact is too late. Split tools by reversibility in permissions, force a plan, and gate the destructive step behind a human interrupt — autonomy on reads, a hard stop on anything you can't undo.
Your rules file is necessary but not sufficient. Persistent context degrades as the window fills — so move the rule that keeps getting ignored into a hook that fires at the exact moment it matters.
Prompt injection isn't an unsolvable model problem — it's a context-engineering one. Fence untrusted tool output as data in your rules, run a parallel guardrail hook that cancels on a hit, and cap the blast radius with a permissions allowlist.
Treat prompts and rules like code: a golden dataset of inputs with known-good outputs, run headless on every change, gated by a hook that fails the build below baseline. The eval that blocks the merge is the one that prevents regressions.