Staff Engineer @ Cdiscount | Creator of OpenDucktor

Bordeaux, France
Joined May 2012
Ribera Maxime retweeted
I'm just going to dump my whole agentic setup out here, because I see too many people missing giant chunks of this and it's hurting them. Here's what I have and recommend: 0. an AGENTS.md that is a router -- it sends the agent to the right skills, docs, tools 1. a standard workflow doc/skill customized to my needs ... (grab Matt Pocock skills if you don't already have something) ... I tag this in most sessions with `@/AGENT_WORKFLOW.md` and it pulls it in. 2. self-healing docs for every system, and agents are instructed to keep them updated ... I tag the ones I know I need, or let the agent find them through AGENTS.md ... I also provide a more detailed summary in the first 7 lines of every doc, so they're easily greppable to find the right thing, and this is documented in AGENTS.md 3. agents always run the app ... the agent should always actually run the app itself, and test its work and fix issues as it goes, especially if running autonomously / asynchronously 4. end-to-end tests and instructions to write more and keep up to date, and docs on how to write tests, what to avoid, and a list of all the tests and what they test in yet another markdown doc ... write and run targeted tests during implementation, improve and commit with work 5. custom linters at precommit hooks looking for any problems you run across, with `--fix` fixing the problems automatically, OR if that's not feasible, it shells out to a cheaper LLM like Composer 2.5 or Sonnet to fix the problems -- NOT just flagging them, but actually resulting in cleaned code 6. cross-agent review at each major point: research, plan, implementation, and wrap-up. I mean codex, claude, cursor, whatever -- but it shouldn't be the same model reviewing the same code. And specific docs for agent review, what to look for, how to approach it. Also, personas -- looking at the code from different perspectives, such as maintainability, code quality, security, performance, AI smells, domains (e.g. "financial services expert" or whatever) ... and each persona also "owns" a set of system docs too and keeps them up to date 7. agent traces / worksheets that track what the agent is doing each session. if the agent fails partway through, you should be able to hand this worksheet to another agent and it could finish the job. commit this worksheet with the work so it's all connected and easy to reference later (you will reference these later!!), also have the agent apply git tags that correspond to specific worksheet names so they're easy to find 8. automatic agent feedback to you at the end of the session, added to a doc that is also committed with the work, that you periodically ingest into an interactive session and improve your workflows 9. a tools or bin folder that contains python or bash scripts that the agent has skills to make to make its job easier (for example, I have an `agent_review` bash script that lets the agent kick off agent reviews via CLI without knowing each agent's particular incantations) ... docs on how to make scripts effectively, and instructions to constantly build these out more 10. periodic agent sweeps through recent commits, looking for problems / gotchas from a higher level across commits 11. a coding conventions doc that is just for specific coding conventions you want to see in the code base, your review agents use these a lot (but a lot of this should be in linters) 12. an agent loop / night shift skill for autonomous work, that lays out how the agent is to approach this, from an orchestration standpoint 13. a task queue that is accessible to the agent (mine is just a TODOS.md, but yours might be in Linear etc, with a CLI to fetch via API) 14. a periodic false-confidence test audit skill that looks for tests that aren't actually testing what you think they're testing, and that fix those 15. visual regression tests -- take screenshots, compare via tool and with agent visual review, commit with work (git lfs useful here) or at least push into the PR 16. automatic performance benchmark tests that notice when performance degrades 17. performance profiling tools that can be used by agents for targeted benchmarking, trying new techniques, comparing outputs, and comparing profiles 18. end-of-shift full validations, including running all tests, performance, agent reviews, sweeps, everything -- when you return, it's all as pristine as it can be If you have all this, your agentic coding experience is going to be very different than dry prompting and manually guiding it toward the right thing every time.
151
263
36
4,011
353,012
Ribera Maxime retweeted
SECURITY ADVISORY — TanStack npm packages A supply-chain compromise affecting 42 @tanstack/* packages (84 versions total) was published to npm earlier today at approximately 19:20 and 19:26 UTC. Two malicious versions per package. Status: ACTIVE — packages are deprecated, npm security engaged, publish path being shut down. Severity: HIGH — payload exfiltrates AWS, GCP, Kubernetes, and Vault credentials, GitHub tokens, .npmrc contents, and SSH keys. If you installed any @tanstack/* package between 19:20 and 19:30 UTC today, treat the host as potentially compromised: • Rotate cloud, GitHub, and SSH credentials immediately • Audit cloud audit logs for the last several hours • Pin to a prior known-good version and reinstall from a clean lockfile Detection — the malicious manifest contains: "optionalDependencies": { "@tanstack/setup": "github:tanstack/router#79ac49ee..." } Any version with this entry is compromised. The payload is delivered via a git-resolved optionalDependency whose prepare script runs router_init.js (~2.3 MB, smuggled into each tarball at the package root). Unpublish is blocked by npm policy for most affected packages due to existing third-party dependents. All 84 versions are being deprecated with a SECURITY warning, and npm security has been engaged to pull tarballs at the registry level. Full technical breakdown, complete package and version list, and rolling status updates: github.com/TanStack/router/i… Credit to the security researcher for responsible disclosure.
135
965
468
3,802
3,923,069
Ribera Maxime retweeted
We’ve identified a security incident that involved unauthorized access to certain internal Vercel systems, impacting a limited subset of customers. Please see our security bulletin: vercel.com/kb/bulletin/verce…
679
2,305
1,925
8,617
10,667,619
Ribera Maxime retweeted
Our Codex dashboards are showing increased rate of users hitting rate limits and since we don't fully understand why I have made the cautious decision of resetting the usage limits for all plans. Enjoy. I also wanted to celebrate us finding a pocket of fraudulent accounts that we banned and have helped us regain some compute. The fight against abuse never stops, but it's important to mark the moment and make it a little shared victory.
1,104
541
614
11,940
1,401,653
The @angular team released their own official Agent skills. You can install them with this command: npx skills add github.com/angular/angular/t… #angular #agentskills #ai
3
53
3
250
27,131
Ribera Maxime retweeted
This is what it feels like when Claude is also writing all the code
Replying to @claudeai
Code Review optimizes for depth and may be more expensive than other solutions, like our open source GitHub Action. Reviews generally average $15–25, billed on token usage, and they scale based on PR complexity.
48
213
22
4,474
348,619
Ribera Maxime retweeted
This codex issue is now fully resolved and stable for the last couple of hours. You have come to expect it, but yes, that means we will be reseting rate limits in a bit. Enjoy.
Happy Monday, there are reports of codex hanging for some users where it is not responsive after sending a request and the team is investigating.
368
79
171
2,773
392,368
Ribera Maxime retweeted
Ghostty 1.3 is now out! Scrollback search, native scrollbars, click-to-move cursor, rich clipboard copy, AppleScript, split drag/drop, Unicode 17 and international text improvements, massive performance improvements, and hundreds more changes. ghostty.org/docs/install/rel…
167
383
94
4,283
333,196
Ribera Maxime retweeted
Today we’re announcing Open Responses: an open-source spec for building multi-provider, interoperable LLM interfaces built on top of the original OpenAI Responses API. ✅ Multi-provider by default ✅ Useful for real-world workflows ✅ Extensible without fragmentation Build agentic systems without rewriting your stack for every model: openresponses.org
125
469
192
4,144
914,974
J'ai rédigé cet article pour résumer mon Devoxx France 2024 et les conférences qui m'ont le plus plu. Bonne lecture ! @DevoxxFR olivierthierry.com/devoxx-fr…
1
7
3
24
5,062
Ribera Maxime retweeted
Great blog post on using @ksqlDB for intrusion detection. cnfl.io/intrusion-detection-…
11
31
Dernière #Nightclazz avant la pause estivale 🏖️, rejoignez nous chez @ZenikaBordeaux pour une soirée autour de #Kafka animée par @geraudster et @RiberaMaxime les inscriptions c'est par ici: meetup.com/fr-FR/NightClazz-…
4
1
Vidéo instructive : quand les deadlines tuent la créativité - parlonscom.over-blog.com ow.ly/qejzw
1
1