The session left the laptop

01Five ships, one direction

Monday through Friday of this week, the desk printed five product moves that look unrelated until you put them on one timeline. Cursor opened Origin, a host for repos and pull requests inside the editor most of this desk already runs.¹ Anthropic put Claude Cowork on web and mobile for every paid plan, still in beta, with sessions that keep running when the laptop is closed.²³ The next day the same vendor took Files and Agent Skills out of beta on the Claude API — no more beta headers on new code.⁴ Codex, two releases apart, added thread cost, session fork, an agents dashboard and a queue into existing sessions.⁵⁶ On Friday the anthropic Python SDK hit 1.0 and pydantic-ai had to ship an emergency pin the same window.⁷⁸

Each item got a one-line verdict in its issue. Taken together they are one argument: the unit of agent work is no longer a terminal on your machine. It is a session that lives on someone else's servers, may outlast your screen, may hold files other tenants of the same workspace can reach, and may write through connectors you enabled once.

02Origin: the forge moves next to the agent

Cursor's changelog is plain. Origin begins rolling out in early beta on all paid plans, except enterprise orgs whose admins opt out. The first surface is the essentials: repos, pull requests, code browsing and GitHub sync. Agent-native features "ship soon."¹

Synced GitHub repos update in real time inside Cursor. Pushes still go to GitHub, which stays the source of truth for anything started there. Origin-hosted repos live at cursor.com/codebase/<name>. Pull requests on synced repos move both ways: a comment in Cursor posts to GitHub, a review on GitHub appears in Cursor. Agents can answer, edit, update PRs or push a branch from the same surface. Vercel, Depot and Buildkite are listed as integrations.¹

Staff on the HN thread said the beta is GitHub parity first, with agent differentiators over the coming weeks, and that Origin-only repos are private to the Cursor team for now — field colour, not a bench.⁹ The product claim that matters for this piece is already on the changelog: code, PRs and agents are in one place, and the host is no longer only the forge you open in a browser.

Code, PRs and agents share one surface; GitHub stays the source of truth only for what started there.

03The same window the forge was down

On 17 August, from 13:28 to 21:15 UTC — 7 hours 47 minutes — GitHub.com ran elevated errors and latency across Issues, Pull Requests, APIs, Actions and Copilot. At peak, web and API error rates were about 20 percent; archive and raw-content downloads about 50 percent. SAML, OIDC, SCIM and Team Sync were hit. Most services recovered by 16:36 UTC; Actions stayed degraded until about 18:03; Copilot Token Service recovered by 21:02.¹⁰

Cursor's status page logged a related major: Automations, Cloud Agents, Review Agents, Codebase and Origin, tied to the GitHub degradation.¹¹ Issue 011 measured that Cursor window at 6.1 hours from the status sweep; the public postmortem text we reopened on Saturday names the affected products without reprinting a separate duration figure, so we keep the 6.1-hour figure as the desk's prior measurement rather than a fresh vendor number.

The coincidence is the point. The week that put a second host next to GitHub was the week GitHub spent nearly eight hours at critical. A mirror that still depends on GitHub for pushes and auth does not remove that dependency; it adds a second surface that fails when the first one does. Origin is early beta. Treating it as an escape hatch from GitHub availability is a claim the status pages of that day do not support.

04Cowork: the session follows the account

Anthropic's help center: Claude Cowork is in beta on web and mobile for Pro, Max and Team, and on Enterprise where an admin has enabled it. Sessions and files live with the Claude account and move across desktop, web and phone. Cloud tasks keep running with the laptop closed. Scheduled tasks run with no device online.²³

Local folders, local connectors, browser use that drives the machine, and computer use still need the desktop app open on that computer. A cloud session can reach connected folders only while the app is up; if the app is closed, the session keeps running but cannot touch local files.² Live artifacts stay desktop-only on the surface matrix.²

The safety page states the boundary in one pair of conditions. Prompt injection needs two things at once: Claude can read outside your trust boundary, and Claude can act in a way that compromises you. Isolation limits where Claude's code runs. It does not limit what Claude reads or does through the access you granted — mail, Drive, connected folders, the open browser tab.¹² Scheduled tasks run when you are not watching. Deletion still needs an explicit Allow; everything else depends on the approval mode you chose.¹²

So the product that expanded to the $20 plan this week is a cloud session with optional write connectors, not a chat box with a nicer UI. The durable controls are which folders and connectors you attach, which approval mode you leave on, and whether Enterprise admins flipped the toggle — not whether you are looking at the screen.

Isolation limits where the code runs. It does not limit what the session can read or write through the access you granted.

05Files GA: the file is a workspace object

Platform release notes dated 19 August: /v1/files and Messages requests that reference an uploaded file no longer need the files-api-2025-04-14 header. The GA response shape adds expires_in_seconds / expires_at, page / next_page list pagination, and an ids[] filter. Beta-header callers keep the old response format.⁴

Agent Skills and /v1/skills left beta the same day, including Messages that load Skills through container. Admin API user-management for Claude Enterprise (members, invites, groups, custom roles) is GA; the ce-user-management-2026-07-13 header is optional. Managed Agents gained allowed_domains / blocked_domains on web_search and web_fetch, and self-hosted sandbox sessions can attach memory stores at a mount path.⁴

The Files guide is the part that rearranges a multi-tenant design. Uploaded files are accessible to the entire workspace, not scoped to an end user, conversation or session. Any API key in the same workspace can reach any file uploaded there. The docs say never accept file_id values from end users; treat them as server-side references; for multi-tenant apps, create a separate workspace per tenant. Cap: 100 workspaces per organisation unless you ask for more. Storage: 500 MB per file, 1 TB per organisation. Expiration is set once at upload, between one hour and ninety days.¹³

A beta header you can drop is a client chore. A file object that is workspace-global is an isolation model. Shipping both on the same day is how an API becomes production infrastructure: the wire format stabilises, and the tenancy rule becomes the thing you design around.

06Codex: multi-session is now a product surface

rust-v0.148.0, 18 August: /export writes a full TUI conversation to Markdown. codex exec fork plus archive and restore in the resume picker. /status and status lines show estimated thread credits or cost where the workspace allows. Amazon Bedrock Runtime is a built-in provider. Hooks may run async and call MCP tools. Sandbox path denials fail closed on Linux and Windows.⁵

rust-v0.149.0, 20 August: an interactive codex agents dashboard searches, starts, opens, renames and stops tasks. codex queue sends messages into existing local or remote sessions. TUI gains /cd, /pwd, /cwd. codex doctor covers endpoint protection, proxy failures, desktop app state and update connectivity. SDK callers can pass exact CLI config overrides and select max or ultra reasoning effort. Resumed and forked threads restore their permission profile instead of silently resetting to current defaults.⁶

That last fix is the editorial detail. A multi-session control surface that forgets the permission profile on resume is a safety regression dressed as a convenience bug. Shipping restore-on-resume in the same release as the agents dashboard is the product admitting that the unit of work is now a fleet of threads, not one terminal.

07The Python major that broke the pin

anthropic 1.0.0 published 20 August. The HTTP layer moves from unmaintained httpx to Pydantic's httpx2 fork. Minimum Python rises from 3.9 to 3.10. Legacy Text Completions are removed. .with_raw_response returns the same response classes as streaming; async parse / read / text / json are coroutines; .text and .content are methods. Bedrock clients raise if no AWS region resolves instead of falling back to us-east-1. Tracing and mock libraries that patch httpx silently miss SDK traffic until pointed at httpx2.⁷¹⁴

pydantic-ai 2.33.0, cut after the break: every earlier release, including 2.32.2 hours before, allowed anthropic 1.0.0 without supporting it. A fresh pydantic-ai[anthropic] install could resolve 1.0.0 and fail at runtime. The fix requires and supports anthropic>=1.0.0; staying on older pydantic-ai needs anthropic<1. A custom http_client on AnthropicProvider must be httpx2.AsyncClient.⁸

This is the dependency half of the same week. The application layer is standardising on cloud sessions and workspace files; the client layer is standardising on a new HTTP stack with a one-day breakage window for anyone who left anthropic unpinned. Remote sessions do not remove pin discipline. They make a bad pin fail farther from the keyboard that caused it.

08What the local click no longer covers

Last Saturday's long read argued that human approval under load is not a safety layer for agent CLIs: the vendor study blocked a planted dangerous command 13.6 percent of the time, and about 5 percent after fifty prompts.¹⁵ This week is the sequel in product form.

A Cowork scheduled task runs with no device online.² A Files file_id is reachable by every key in the workspace.¹³ An Origin agent can update a PR from the codebase tab.¹ A Codex queue can wake an idle remote session.⁶ None of those actions waits for a human who happens to be looking at a terminal. The controls that still work are the ones declared before the session starts: connector scope, folder grants, workspace tenancy, domain allowlists on Managed Agents, ask rules on git push, permission profiles that survive resume, and pins that keep a major SDK off an unsupported resolver.

The industry will keep selling the residual click as a comfort. The ships of 17–21 August already assume you are not there.