
Mastering AI Agent Tools: Commands, Permissions, Testing, and Production Operations
Three coding CLIs, three permission models. Cursor agent 2026.01.28, Claude Code 2.1.296, and Codex from OpenAI's docs. Checked 11 October 2026.
Tagged

Three coding CLIs, three permission models. Cursor agent 2026.01.28, Claude Code 2.1.296, and Codex from OpenAI's docs. Checked 11 October 2026.

One identity check, aws sts get-caller-identity, before any command that can create a billable resource. AWS CLI 2.37.12 on 11 October 2026.

Four inspections before you delete a failing container: ps, logs, inspect, and port. Docker client 29.8.2 and Compose v5.5.1 on 11 October 2026.

Five read-only checks before you keep an agent commit: status, diff, diff --cached, log -1, and show. Git 2.54.0 on 11 October 2026.

Six reads before you delete a crash-looping pod: context, namespace, get, describe, logs, and events. kubectl client v1.36.1 on 11 October 2026.

Eight reads before you restart a slow API: load, memory, disk, inodes, listeners, DNS, one request, and the log tail.

This Mac runs Zsh 5.9. Upstream published the next patch on 12 July 2026. A minimal zshrc took 48.2 ms median over 20 warm starts, against 4.2 ms with no rc files.

EKS Kubernetes 1.36 is available with user namespaces GA and mutating admission policies. Since July 2026 you can roll back an in-place control-plane upgrade within 7 days at no extra charge — but only N→N-1, and Fargate or strict PDBs can block you.

On July 31, 2026 AWS shipped CloudWatch managed Prometheus collectors. For the AWS Example 22 shape (100 hosts x 50 metrics @ 60s), OTLP ingestion is $54/mo vs $1,500 classic custom metrics if you do not double-ingest.

Synthetics canaries catch user-journey failures before customers tweet — but a 1-minute canary fleet can quietly dominate the CloudWatch bill. Runtime, VPC, alarm wiring to Application Signals SLOs, and a reproducible checklist.

Monitoring is visibility; alerting is interruption. Teams with 40+ CloudWatch alarms and an actionable page rate under 50% are monitoring loudly and alerting poorly — fix ownership, SLO burn, and canaries before adding another metric.

Amazon Managed Grafana waste is rarely the $9 Editor seat itself — it is ten Editors who only view dashboards, orphan service accounts, and workspaces still on Grafana 9 while AWS shipped create + in-place upgrade to 12.4 in April/May 2026. Here is the workspace ops playbook: seats, IAM Identity Center, NAC/VPC, CMK, and a checklist you can run this week.