SIGNALROTATE CREDENTIALS; STOP DUPLICATE TOOL EFFECTS|SHIPPED 2|SKIPPED 3
The one thing
01GitHub CLI can rotate OAuth tokens now. Audit anything that caches them first.
GitHub CLI 2.103.0 can request short-lived, auto-refreshing OAuth credentials. Use gh auth login --expiring to opt in. The command gh config set expiring_credentials enabled enables the option for future sign-ins. The access token expires within hours; gh keeps a rotating refresh token and renews the credential in the background. 1
Audit token consumers before enabling it. Scripts and extensions that capture gh auth token once will eventually hold an expired value. Read it fresh each time. For Git over HTTPS, run gh auth setup-git and use Git 2.46 or newer, as GitHub recommends, so a credential helper does not cache the token past its lifetime. 1
Pilot this on a developer workstation. GitHub.com and ghe.com support the option now, and GHES starts with 3.23. An unsupported server falls back to a normal non-expiring token. Existing sign-ins stay unchanged; GitHub says expiring credentials are intended to become the default for new sign-ins later. 1
VERDICT · WAIT — Pilot expiring credentials after removing every cached-token dependency.
Shipped
02Use it
Claude Code 2.1.307 stops replaying write-capable HTTP MCP calls
When an HTTP MCP connection closed during a call, Claude Code could send the tool call twice. Version 2.1.307 now retries only read-only or idempotent tools. Upgrade runners that invoke side-effecting tools and exercise a dropped-connection path. The release also adds a claude_code.safety_event telemetry event when a tool call is stopped, prompts, or is sent back by a control. 2
MATTERS TO · Claude Code users running remote MCP tools with side effects.
nofeed.dev/issues/2026-10-22/claude-code-idempotent-mcp-retry/Use it
OpenAI Python 3.36.1 honors per-call WebSocket query settings
The patch applies query settings supplied to an individual WebSocket call. It also stops microphone capture between recordings in the examples and validates browser calls before reading driver state. Upgrade affected 3.36.0 clients and test one connection with a non-default per-call query option. 3
MATTERS TO · Python applications using WebSocket calls, browser tooling, or the recording example.
nofeed.dev/issues/2026-10-22/openai-python-websocket-query-settings/The conversation
01The claim — including ours
Tool availability can widen a task beyond the sentence you typed.
From the floor
- Jake Carlson (@llm_bender)Firsthand report · not independently reproduced
Carlson says he omitted a screenshot from a request and Claude Code searched his laptop, found an image and continued. The public post includes screenshots, but no complete session configuration, permission policy or audit log. 4
- Jeremy Nguyen (@JeremyNguyenPhD)Firsthand reply · not independently reproduced
Nguyen says Codex used a connected Gmail account to find a data file for analysis. After he corrected it, later requests began with a Gmail disclaimer. The reply supplies no execution trace or connector policy. 5
Our take
Treat readable file roots and connected accounts as part of the effective scope. For a task with missing input, require the agent to pause instead of searching elsewhere; grant project-scoped paths and connectors, then review the resulting access log.
Both accounts are firsthand and were not independently reproduced; their permission settings and complete traces were unavailable.
Skip this
0301
Archestra 1.4 remote-agent handoff The author announcement describes the flow, but no independent run establishes patch fidelity or cluster operating cost.
02
Cua Spaces 0.13.0 The release page is automated and names no change that supports a targeted recommendation.
03
Claude Code television launcher demos The posts show device-specific experiments; they do not establish a reusable installation or security decision.
Everything we saw
100100 candidates scanned · 5 used in this issue — the rest, with the reason each one was left out
The receipt. Ranking is only trustworthy if the discarded pile is visible, so here it is: everything the collectors surfaced in the window, with its signal and what we did with it.
| Item | Source | Signal | Call |
|---|---|---|---|
| @llm_bender: Ok this is pretty shocking Last night, while running several Claude Code sessions at once, I sent Claude a me | X | Firsthand or attributed public post; not independently reproduced | Conversation: firsthand report about an agent searching local files. |
| @ClaudeCodeLog: Claude Code 2.1.307 has been released. 43 CLI changes, 1 system prompt change Highlights: • Added /claude-ap | X | Firsthand or attributed public post; not independently reproduced | Not selected for the short edition; it did not change an immediate install or operating decision. |
| @dani_avila7: Every Claude Code user NEEDS to install /stack... Seriously! Save this post and try it later The /stack mod | X | Firsthand or attributed public post; not independently reproduced | Not selected for the short edition; it did not change an immediate install or operating decision. |
| @AkitaOnRails: Não sei desde que update, mas estou com a impressão que Claude Code está mais agressivo pra compactar memória | X | Firsthand or attributed public post; not independently reproduced | Not selected for the short edition; it did not change an immediate install or operating decision. |
| @benjedwards: I ported @TimSweeneyEpic's 1991 shareware PC classic, ZZT, to the Nintendo Entertainment System using Claude C | X | Firsthand or attributed public post; not independently reproduced | Not selected for the short edition; it did not change an immediate install or operating decision. |
| @DataChaz: YOUR AGENT JUST GOT ITS OWN SPACE @ego_agent lite lets Claude Code, Codex and Cursor work in a separate Space | X | Firsthand or attributed public post; not independently reproduced | Not selected for the short edition; it did not change an immediate install or operating decision. |
| @JeremyNguyenPhD: My Codex was looking for data files for some analysis a while back and went into my Gmail (!) and found where | X | Firsthand or attributed public post; not independently reproduced | Conversation: firsthand reply about connector access. |
| @yukkuri__K: Codexでとある編集ソフトを作ったので、ゆっくりK産業革命が起きました。これはやばいです！！！ 作業効率が300%くらいあがった。本人の作業効率は変わらないんですが | X | Firsthand or attributed public post; not independently reproduced | Not selected for the short edition; it did not change an immediate install or operating decision. |
| @Awed_Urshy: 昨晩CodexでX68000のアプリをとある未移植ゲームを対象にして試してみた。 すると、何を始めたかというとPowerShellのコード書いてきて実行しろという。 動かすと、Pythonの場所とか68のエミュレータと | X | Firsthand or attributed public post; not independently reproduced | Not selected for the short edition; it did not change an immediate install or operating decision. |
| @AkitaOnRails: Se você usa/quer usar REA (Reverse Engineering Anything), cuidado com limites de alguns provedores. Claude Co | X | Firsthand or attributed public post; not independently reproduced | Not selected for the short edition; it did not change an immediate install or operating decision. |
| @BSCNews: Hedera opens its network to AI coding agents, on testnet for now @hedera has launched its Network MCP on test | X | Firsthand or attributed public post; not independently reproduced | Not selected for the short edition; it did not change an immediate install or operating decision. |
| @Astrodevil_: Every coding agent session starts from zero. AGENTS.md fixed half of it. Claude Code, Codex, Cursor and OpenC | X | Firsthand or attributed public post; not independently reproduced | Not selected for the short edition; it did not change an immediate install or operating decision. |
| @NehharShah: I use Claude Code, Codex and Cursor every day. The record of what it did is still on your disk. ~/.claude/proj | X | Firsthand or attributed public post; not independently reproduced | Not selected for the short edition; it did not change an immediate install or operating decision. |
| @N1njaCodex: Claude Opus 5.5 built this little football yard for $6.06 Real 3D with a pixel-art look: the kids decide what | X | Firsthand or attributed public post; not independently reproduced | Not selected for the short edition; it did not change an immediate install or operating decision. |
| @NhelvUsername: With the uproar of vibe coding allowing games and mods to be made in just minutes I have vibe coded a characte | X | Firsthand or attributed public post; not independently reproduced | Not selected for the short edition; it did not change an immediate install or operating decision. |
| @swyx: When we framed @trq212's pod about Claude Code's Next Era, we meant it. we took some directive from @_catwu | X | Firsthand or attributed public post; not independently reproduced | Not selected for the short edition; it did not change an immediate install or operating decision. |
| New in Archestra 1.4 (open source): Claude Code hands long tasks to a remote agent on your own cluster, any agent, no vendor lock-in | Firsthand or attributed public post; not independently reproduced | Not selected for the short edition; it did not change an immediate install or operating decision. | |
| I gave Claude Code my parents' TV model number. It found... | Firsthand or attributed public post; not independently reproduced | Not selected for the short edition; it did not change an immediate install or operating decision. | |
| I replaced my Samsung TV's home screen with Claude Code | Firsthand or attributed public post; not independently reproduced | Not selected for the short edition; it did not change an immediate install or operating decision. | |
| Cua Spaces v0.13.0 | GitHub Releases | Dated release · trycua/cua | Not selected: lower impact, generic notes, or insufficient detail for a targeted recommendation. |
| v1.13.3 | GitHub Releases | Dated release · alibaba/open-code-review | Not selected: lower impact, generic notes, or insufficient detail for a targeted recommendation. |
| v2.1.308 | GitHub Releases | Dated release · anthropics/claude-code | Not selected: lower impact, generic notes, or insufficient detail for a targeted recommendation. |
| v3.36.1 | GitHub Releases | Dated release · openai/openai-python | Shipped: per-call WebSocket query setting fix. |
| v3.2.0 | GitHub Releases | Dated release · akitaonrails/ai-memory | Not selected: lower impact, generic notes, or insufficient detail for a targeted recommendation. |
| v1.30.0 | GitHub Releases | Dated release · All-Hands-AI/OpenHands | Not selected: lower impact, generic notes, or insufficient detail for a targeted recommendation. |
| v2.1.307 | GitHub Releases | Dated release · anthropics/claude-code | Shipped: duplicate HTTP MCP call retry fix. |
| v2.1.0 | GitHub Releases | Dated release · anthropics/anthropic-sdk-python | Not selected: lower impact, generic notes, or insufficient detail for a targeted recommendation. |
| langchain==1.4.7 | GitHub Releases | Dated release · langchain-ai/langchain | Not selected: lower impact, generic notes, or insufficient detail for a targeted recommendation. |
| typescript/v1.22.0 | GitHub Releases | Dated release · strands-agents/harness-sdk | Not selected: lower impact, generic notes, or insufficient detail for a targeted recommendation. |
| v7.0.1 | GitHub Releases | Dated release · obra/superpowers | Not selected: lower impact, generic notes, or insufficient detail for a targeted recommendation. |
| langchain-core==1.6.13 | GitHub Releases | Dated release · langchain-ai/langchain | Not selected: lower impact, generic notes, or insufficient detail for a targeted recommendation. |
| harness-typescript/v0.3.1 | GitHub Releases | Dated release · strands-agents/harness-sdk | Not selected: lower impact, generic notes, or insufficient detail for a targeted recommendation. |
| cua-spacesd 0.7.0 | GitHub Releases | Dated release · trycua/cua | Not selected: lower impact, generic notes, or insufficient detail for a targeted recommendation. |
| python/v1.62.0 | GitHub Releases | Dated release · strands-agents/harness-sdk | Not selected: lower impact, generic notes, or insufficient detail for a targeted recommendation. |
| langchain-perplexity==1.4.2 | GitHub Releases | Dated release · langchain-ai/langchain | Not selected: lower impact, generic notes, or insufficient detail for a targeted recommendation. |
| v0.40.8 | GitHub Releases | Dated release · ollama/ollama | Not selected: lower impact, generic notes, or insufficient detail for a targeted recommendation. |
| v3.36.0 | GitHub Releases | Dated release · openai/openai-python | Not selected: lower impact, generic notes, or insufficient detail for a targeted recommendation. |
| v2.0.0 | GitHub Releases | Dated release · anthropics/anthropic-sdk-python | Not selected: lower impact, generic notes, or insufficient detail for a targeted recommendation. |
| cua SDK 0.7.0 | GitHub Releases | Dated release · trycua/cua | Not selected: lower impact, generic notes, or insufficient detail for a targeted recommendation. |
| @ai-sdk/tool-bash@1.0.0 | GitHub Releases | Dated release · vercel/ai | Not selected: lower impact, generic notes, or insufficient detail for a targeted recommendation. |
| @agent-native/core@0.212.0 | GitHub Releases | Dated release · BuilderIO/agent-native | Not selected: lower impact, generic notes, or insufficient detail for a targeted recommendation. |
| @agent-native/toolkit@0.212.0 | GitHub Releases | Dated release · BuilderIO/agent-native | Not selected: lower impact, generic notes, or insufficient detail for a targeted recommendation. |
| @agent-native/skills@0.3.41 | GitHub Releases | Dated release · BuilderIO/agent-native | Not selected: lower impact, generic notes, or insufficient detail for a targeted recommendation. |
| v1.106.2 | GitHub Releases | Dated release · BerriAI/litellm | Not selected: lower impact, generic notes, or insufficient detail for a targeted recommendation. |
| v1.105.3 | GitHub Releases | Dated release · BerriAI/litellm | Not selected: lower impact, generic notes, or insufficient detail for a targeted recommendation. |
| v1.103.7 | GitHub Releases | Dated release · BerriAI/litellm | Not selected: lower impact, generic notes, or insufficient detail for a targeted recommendation. |
| v1.4.237 | GitHub Releases | Dated release · stablyai/orca | Not selected: lower impact, generic notes, or insufficient detail for a targeted recommendation. |
| Elevated errors affecting Connectors | Anthropic | Primary vendor incident | Not selected for this developer-focused short edition. |
| Elevated ChatGPT conversation and Responses API errors | OpenAI | Primary vendor incident | Not selected for this developer-focused short edition. |
| Uber brings ChatGPT Work to all employees with OpenAI | OpenAI | Primary vendor announcement | Not selected for this developer-focused short edition. |
| Authentication errors for some users | OpenAI | Primary vendor incident | Not selected for this developer-focused short edition. |
| Broad access through consistent standards | OpenAI | Primary vendor announcement | Not selected for this developer-focused short edition. |
| Degraded performance for Claude Fable 5 | Anthropic | Primary vendor incident | Not selected for this developer-focused short edition. |
| NVIDIA Kumo Relational Outperforms Supervised Machine Learning on Relational Data, No Training Required | Hugging Face | Primary vendor announcement | Not selected for this developer-focused short edition. |
| Elevated errors for Bitbucket Cloud integrations | Cursor | Primary vendor incident | Not selected for this developer-focused short edition. |
| How Specializing the Vocabulary of SLMs Can Cut Inference Cost by 77% in Real Applications | Hugging Face | Primary vendor announcement | Not selected for this developer-focused short edition. |
| Routing Middleware now supports Python | Vercel | Primary vendor changelog | Not selected for this developer-focused short edition. |
| How AT&T is rethinking in-house legal work with OpenAI | OpenAI | Primary vendor announcement | Not selected for this developer-focused short edition. |
| GitHub CLI: Opt in to expiring, auto-refreshing OAuth tokens | GitHub | Primary vendor changelog | Main item: expiring GitHub CLI OAuth credentials. |
| Profiling TorchNeuron (Part 1): System-level profiling on AWS Trainium. | Hugging Face | Primary vendor announcement | Not selected for this developer-focused short edition. |
| Investigating service degradation | Cursor | Primary vendor incident | Not selected for this developer-focused short edition. |
| Elevated error rates for gpt-5.6-luna API requests | OpenAI | Primary vendor incident | Not selected for this developer-focused short edition. |
| Granite Speech 5.0: Transcribe, Translate, and Attribute more Accurately and Faster | Hugging Face | Primary vendor announcement | Not selected for this developer-focused short edition. |
| Delays for Pull Requests and Webhook deliveries | GitHub | Primary vendor incident | Not selected for this developer-focused short edition. |
| Elevated FedRAMP API error rates for Astra and Sol | OpenAI | Primary vendor incident | Not selected for this developer-focused short edition. |
| ChatGPT Ads expands to 26 new countries as over 100,000 advertisers have used the platform | OpenAI | Primary vendor announcement | Not selected for this developer-focused short edition. |
| OpenAI models are coming to Google Cloud | OpenAI | Primary vendor announcement | Not selected for this developer-focused short edition. |
| Investigating service degradation | Cursor | Primary vendor incident | Not selected for this developer-focused short edition. |
| Patch the Planet: global response coordination as agents uncover critical vulnerabilities | OpenAI | Primary vendor announcement | Not selected for this developer-focused short edition. |
| How we built ChatGPT’s novel ad stack for user trust and relevance | OpenAI | Primary vendor announcement | Not selected for this developer-focused short edition. |
| Claude Duet | Hacker News | Public discussion lead | Not selected: the discussion did not change this edition’s action. |
| PHP2Shell: AI uncovers critical RCE in PHP | Hacker News | Public discussion lead | Not selected: the discussion did not change this edition’s action. |
| WorldTUI: I trained a 360M model to pretend to be a terminal | Hacker News | Public discussion lead | Not selected: the discussion did not change this edition’s action. |
| Mistral Large 4 | Hacker News | Public discussion lead | Not selected: the discussion did not change this edition’s action. |
| OpenAI CLI | Hacker News | Public discussion lead | Not selected: the discussion did not change this edition’s action. |
| Canary Tokens | Hacker News | Public discussion lead | Not selected: the discussion did not change this edition’s action. |
| Using thousands of AI agents to uncover new leads in biological data | Hacker News | Public discussion lead | Not selected: the discussion did not change this edition’s action. |
| Google staff resign in backlash over its AI contracts with military | Hacker News | Public discussion lead | Not selected: the discussion did not change this edition’s action. |
| Show HN: Omnara – Open-source alternative to Claude Managed Agents | Hacker News | Public discussion lead | Not selected: the discussion did not change this edition’s action. |
| Claude Duet | Hacker News | Public discussion lead | Not selected: the discussion did not change this edition’s action. |
| TraceLite: Efficient Trace Reduction for SWE Agents via Optical Compression and Redundancy Removal | arXiv | Research lead | Not selected: no verified result changed this week’s tooling decision. |
| PAUSE: Search-Free Steering of Coding Agents Before Their First Source-Code Edit | arXiv | Research lead | Not selected: no verified result changed this week’s tooling decision. |
| Where Should a Stuck Agent Spend Its Next Tokens? Causal Attribution of Inference-Time Resources | arXiv | Research lead | Not selected: no verified result changed this week’s tooling decision. |
| SWE-DIVE: Multi-Turn Coding Agent Evaluation with Dynamic User Simulation | arXiv | Research lead | Not selected: no verified result changed this week’s tooling decision. |
| VeeReview: Measuring Build-Verify Pairs in Agent-Authored Pull Requests from a V-Model Perspective | arXiv | Research lead | Not selected: no verified result changed this week’s tooling decision. |
| Combining Long-Term Memory and LLMs Comes at a High Cost: From Prompt Injection to Persistent Compromise | arXiv | Research lead | Not selected: no verified result changed this week’s tooling decision. |
| From Reasoning to Action: Benchmarking Frontier AI Models on LIBERO-10 Robot Manipulation Tasks | arXiv | Research lead | Not selected: no verified result changed this week’s tooling decision. |
| The End of Consensus Research? | arXiv | Research lead | Not selected: no verified result changed this week’s tooling decision. |
| Object-Oriented Harness: Evolving Agent Harnesses through Object-Oriented Design | arXiv | Research lead | Not selected: no verified result changed this week’s tooling decision. |
| S-Agent 2.0: Spatial Reasoning with a General Coding Agent | arXiv | Research lead | Not selected: no verified result changed this week’s tooling decision. |
| Local Inference of LLMs on Long Contexts: A Data Systems Perspective | arXiv | Research lead | Not selected: no verified result changed this week’s tooling decision. |
| How Developers Configure LLM Inference: A Large-Scale Study of Real-World Practices | arXiv | Research lead | Not selected: no verified result changed this week’s tooling decision. |
| Hallucinations of Large Language Models in Cross-Language Code Translation: Phenomena and Mitigation | arXiv | Research lead | Not selected: no verified result changed this week’s tooling decision. |
| Quant-Arena: Benchmarking LLM Agents for Quantitative Trading Research | arXiv | Research lead | Not selected: no verified result changed this week’s tooling decision. |
| Benchmarking Coding Agents for System-Level Performance Optimization | arXiv | Research lead | Not selected: no verified result changed this week’s tooling decision. |
| Behavior Beyond Text: Evaluating Refusal Transfer Failure in LLM Agents | arXiv | Research lead | Not selected: no verified result changed this week’s tooling decision. |
| How Much Does the Harness Matter, and for Whom? A Multi-Model Study of Context in LLM-Driven Vulnerability Discovery | arXiv | Research lead | Not selected: no verified result changed this week’s tooling decision. |
| From Code Generator to Engineering Companion: A Plant-aware Agent for PLC Programming | arXiv | Research lead | Not selected: no verified result changed this week’s tooling decision. |
| ClawMMU: Protection-Coherent Virtual Memory for Stateful LLM Agents | arXiv | Research lead | Not selected: no verified result changed this week’s tooling decision. |
| Training the Whole Agent, Not Just the Model | arXiv | Research lead | Not selected: no verified result changed this week’s tooling decision. |
EOF
End of feed. That is everything from the window worth your time.
Explore more news, analysis and practical guides on NO FEED.
Sources — each with the date it was read01 GitHub CLI expiring OAuth credentials · 21 October 2026 (2026-10-22) · 02 anthropics/claude-code v2.1.307 · published 2026-10-21T22:17:02Z (2026-10-22) · 03 openai/openai-python v3.36.1 · published 2026-10-22T03:32:31Z (2026-10-22) · 04 X · Jake Carlson on Claude Code searching for an omitted screenshot, 21 October 2026 (2026-10-22) · 05 X · Jeremy Nguyen on Codex using a Gmail connection, 21 October 2026 (2026-10-22)