Claude Code can finally show which loop ate the budget. Now, can the rest of the toolchain survive its own edge cases? How we got here: coding-agent harness security is already a live reliability issue. Novee Security showed that default setups around Claude Code, Gemini CLI, and Codex could be abused through low-privilege GitHub issue input. Since then, Claude Code has shipped follow-on hardening and reliability releases, reaching v2.1.239 with cost accounting, API migration tooling, and fixes around proxies, credentials, memory, and sessions. This is AI Coding Daily. We’re starting with the bill, then hitting pricing aliases, a Remote SSH stall, and two provider-boundary bugs. Claude Code v2.1.243 adds a Loops breakdown to help cut usage. Per-loop token counts give operators real telemetry, not just another agent demo. This one's from Anthropic:
What's changed Added a Loops breakdown to /usage: per-loop run count, total tokens, tokens per run, and last run, so runaway or chatty /loop tasks are easy to spot Added modelPicker setting: curate the /model picker with an ordered, labeled list of models (any id spelling, including Vertex/Bedrock ids), appended to or replacing the built-in lineup
Claude Code 2.1.243 now brings loop usage, managed pricing, keyless login, and MCP reconnect fixes. The /usage details are what I care about: run count, total tokens, tokens per run, last run. You can finally spot the loop that ate the budget instead of staring at a monthly total. Anthropic says weekly ceilings have turned quota visibility into a product risk for heavy users. Good. A runaway loop should be visible before finance asks why one ticket consumed a small yacht’s worth of tokens. What still doesn’t line up is attribution. /tasks now shows the model and effort level for each subagent, while /usage shows loop totals—but without per-loop model selection, a loop count can still hide the expensive decision. Managed modelPricing actually fixes something: contracted rates and discounts now flow into /cost, the status line, and telemetry instead of list price. But keyless Console sign-in needs a serious audit trail in regulated shops; convenience isn’t an identity report. Here's GitHub:
The v0.87.4 line of releases focused on compiler robustness, safe-output validation, and internal tooling and observability improvements across the agentic workflow pipeline. - Pre-create pull request steering (#55171):safe-outputs.create-pull-request.steer: true pre-creates a PR and lets agents read user feedback left in PR comments and review comments — without silently expanding workflow permissions.
GitHub Agentic Workflows v0.87.4 pre-creates a PR for steering, but you have to explicitly declare pull-requests: read. Good. A bot reading review comments is a permission boundary, not a cute workflow checkbox. GitHub says agents are prompted to look for the steer keyword, and permissions don’t expand silently. That’s the right default when a system is allowed to act on a repository. The less flashy change is gh aw models. It puts catalog pricing, alias resolution, and observed automation models in one CLI surface—finally enough of the routing decision is exposed to budget for it. Alias resolution is especially welcome. If my CI ran a model behind a friendly nickname, I need to know which one before explaining the bill—or the PR—to compliance. Also, startup stderr from the Copilot SDK now surfaces instead of a pre-ready crash becoming a black box. Not glamorous, but it’s the work that decides whether an agent survives a real pipeline. They also fixed daily workflow and merge-window metrics drifting apart, plus a lockfile report that silently returned zero discussion categories. Internal observability needs validation too; a dashboard doesn’t become true just because it compiles. caretor, writing in GitHub:
Both carry the same exception text. On the calling side, tools/web_tools.py never inspects the provider's envelope. It builds its own "success": False dicts (l.708, 718, 810, 817, 891, 913, 926) but never reads that field on what a provider returns; the only error reads (l.992, 1018) are on the extraction side.
Hermes Agent has this tagged P3, while v0.20.3 passes caught exception text from all eight bundled web providers straight into model context. Twenty-one call sites. A backend error can carry internal hostnames, service details, even credentials—and the agent gets to read it. The implementation failure is pretty plain: web_tools.py serializes the provider return unchanged. It constructs its own failure envelopes elsewhere, but never normalizes the provider’s error field before handing it to the model. Whether it’s Brave, Exa, Tavily, or Parallel, Hermes can turn the vendor’s exception message into prompt material. Calling that a plugin bug understates it; this is a boundary where an agent should be aggressively boring. Credit where it’s due: issue #93697 was found by code reading, not after a production disclosure. Open code let someone trace the same raw str(exc) pattern across providers—and now the fix can be a single, testable error contract. Here's Nils Hjelte at Cursor:
In a Remote SSH window, every agent eventually sits on “running” / git-related work and never returns. The same git commands in the normal integrated terminal on that remote return in well under a second. There is no .git/index.lock.
Cursor over Remote SSH is hanging its agent on a Mac-to-Mac git repo, while the identical git status in the integrated terminal finishes in under a second. In an enterprise setup, your code lives somewhere else—and it’s the AI path that stops dead. The report tried GIT_TERMINAL_PROMPT=0 and GIT_ASKPASS=echo, found no index lock, and still saw Shell, Read, and Glob freeze together for six to fourteen minutes. That points to an agent subprocess environment that can’t survive a credential helper or askpass boundary, not repository load. Once Shell is wedged, Read and Glob go with it. A git auth failure takes the whole tool loop hostage. The Loops telemetry we just covered can show a costly stall—Cursor still has to make the remote execution layer actually return. GitHub writes:
When a model finishes a turn with a tool call, the stream emits a trailing EMPTY text block: { type: "text", text: "" } convertResponsesMessages in src/api/openai-responses-shared.ts serializes every text block unconditionally into an assistant "message" item with output_text: "":
Pi 0.82.1 sends an empty assistant text block after a tool call; LiteLLM turns it into Anthropic prefill, and Claude Opus 5 returns a 400 on the next step. The happy-path tool demo works—then the second request falls over. The irritating part is that pi’s OpenAI Chat Completions serializer already strips blank text with a trim filter. The Responses serializer still serializes every block. Same product, two message encoders, and materially different behavior in a multi-step tool chain. And it hits any Anthropic model behind LiteLLM’s Responses API, not one obscure configuration. A cross-provider route that dies after calling a tool is exactly the sort of defect CI finds after your agent has burned half the job. It’s the same family of bug as Hermes passing raw provider errors into model context. Provider-specific envelopes are crossing an adapter boundary without normalization, and Anthropic’s stricter empty-prefill validation exposes it immediately. Have feedback, story ideas, or a correction for AI Coding Daily? Email us at aicodingdaily at lantern podcasts dot com. We’d love to hear from you.
Links to every story we covered are in the show notes. Take a look at the ones that caught your attention. That’s AI Coding Daily for today. This is a Lantern Podcast.