Every "always allow" click quietly trades a little control for a little convenience — and after a few months of daily agent use, those clicks add up to a security posture nobody designed. Here's how to audit what your coding agent can already do without asking, which grants deserve scrutiny, and how to put deliberate guardrails back.

Claude Code skills have no requires: field, no imports, no dependency resolver — and yet you can build a real graph of skills that depend on each other. This post lays out the mental model, the three composition mechanisms that fall out of it, and a refactor of this blog's own skill folder as a case study in what happens when you skip them.

Your ~/.claude folder quietly accumulates two very different things: configuration you'd hate to lose, and private data you must never publish. Here's how to put the first under git without ever committing the second.

Most people's digital security is a single point of failure with extra steps. Locking it down — password manager, two-factor authentication, recovery codes, tested backups — is a weekend project, not a lifestyle.

Two fields in package.json both claim to pin your package manager. They can't both be satisfied, the tools that read them are moving in opposite directions, and picking wrong can lock you out of your own repo.

Every agent is, at heart, a loop: a model calling tools until the job is done. The interesting engineering question of 2026 is what happens when you wire many of those loops together into a graph — and when you shouldn't.

Chrome extensions are just web pages with superpowers — but the superpowers come with rules. This is the beginner's map: the parts, the permissions, why your popup can't see the page you're looking at, and the caveats that bite everyone exactly once.

You built the extension and it works with "Load unpacked". This is the map of everything between that and a public Chrome Web Store listing: the one-time $5 fee, the images the listing needs, the privacy paperwork, the review, and the maintenance that never quite ends.

Part 1 let the server reach the browser; Part 2 gave the browser an equal voice back. But in both, every byte still travels through a server. This final part is about the one browser technology that removes the server from the middle: WebRTC, which lets one browser talk straight to another — video, audio, and data, peer to peer.

In Part 1 the server learned to talk without being asked — but the browser could still only listen. A chat, a multiplayer game, a collaborative editor: these need both sides speaking freely over one connection. This is Part 2 of the series, and it's about the browser's true two-way channels — WebSockets, the workhorse, and WebTransport, its modern successor.