Thomas Roche thoroc

Claude Code Auto Mode: A Comprehensive Technical Summary

Auto mode replaces the human "approve/deny" permission prompt with an ML classifier that evaluates every tool call before execution. Instead of asking you whether rm -rf node_modules is okay, a second instance of Claude (Sonnet 4.6) reads the conversation transcript and decides in real time.

This document walks through how it works, from the high-level architecture down to the actual code.

OpenCode + Kimi For Coding (K2.5) Setup

1. Add credentials

opencode auth login
# Select "Kimi For Coding"
# Enter your API key (sk-kimi-...)

Working with Q — Coding Agent Protocol

What This Is

Applied rationality for a coding agent. Defensive epistemology: minimize false beliefs, catch errors early, avoid compounding mistakes.

This is correct for code, where:

Reality has hard edges (the compiler doesn't care about your intent)
Mistakes compound (a wrong assumption propagates through everything built on it)
The cost of being wrong exceeds the cost of being slow

AGENTS.md

Note

CRITICAL Before doing any work, read the entire contents of this file carefully.

!`cat TODO.md`

Opencode plugin development guide

Generated with LLM assistance on 2 Nov 2025 with minimal human verification.

Overview

Opencode plugins extend the functionality of the Opencode AI assistant by allowing you to add custom tools, authentication providers, event handlers, and hooks into the core system. This guide covers how to create, configure, and distribute plugins.

Source files:

OpenCode notification plugin

Shows desktop notifications with a summary of what the agent last said:

Place AGENTS.md in ~/.config/opencode/AGENTS.md
Place notification.ts in ~/.config/opencode/plugin/notification.ts

Free Google Maps tiles

URL: https://{s}.google.com/vt/lyrs={l}&x={x}&y={y}&z={z}

Parameters:

Subdomain: mt0, mt1, mt2, mt3
Layer:
- m = standard roadmap
- r = alternative roadmap
h = roads only

GitHub Search Syntax for Finding API Keys/Secrets/Tokens

As a security professional, it is important to conduct a thorough reconnaissance. With the increasing use of APIs nowadays, it has become paramount to keep access tokens and other API-related secrets secure in order to prevent leaks. However, despite technological advances, human error remains a factor, and many developers still unknowingly hardcode their API secrets into source code and commit them to public repositories. GitHub, being a widely popular platform for public code repositories, may inadvertently host such leaked secrets. To help identify these vulnerabilities, I have created a comprehensive search list using powerful search syntax that enables the search of thousands of leaked keys and secrets in a single search.

Search Syntax:

(path:*.{File_extension1} OR path:*.{File_extension-N}) AND ({Keyname1} OR {Keyname-N}) AND (({Signature/pattern1} OR {Signature/pattern-N}) AND ({PlatformTag1} OR {PlatformTag-N}))

Examples:

**1.

	import { WarpGrepClient } from "@morphllm/morphsdk";
	import { tool } from "@opencode-ai/plugin/tool";
	import { promises as fs } from "fs";
	import { resolve } from "path";

	const z = tool.schema;

	const MAX_RETRIES = 3;
	const BASE_DELAY_MS = 250;
	const MAX_CONTEXTS = 20;