Fable 5 Launch Day: Self-Healing Code Hooks, a Supply Chain Worm, and Cohere's Open Agentic Coder

Today's findings

1. #1 PostToolUse Self-Healing TypeScript Hook for Claude Codetechnique

   A PostToolUse hook that runs tsc after every file edit and feeds compiler errors back to Claude eliminates broken-types-at-PR-time without manual babysitting.

   TypeScript hook

   A PostToolUse hook runs tsc after every edit and feeds errors back to Claude

   1

   Edit file

   .ts/.tsx/.vue

   2

   Run tsc

   --noEmit at nearest tsconfig

   3

   Filter

   errors for changed file

   4

   Return errors

   as tool result

   Fix & re-edit

   Closes the feedback loop at edit time, before broken types reach PR review.

   Why it matters: Type errors surfacing at PR review are the top friction point in Claude Code TypeScript workflows; catching them at the point of edit closes the feedback loop before context is lost and before the agent moves on to the next file.

   How to apply: Add a PostToolUse hook that fires on Edit/Write of .ts/.tsx/.vue files, locates the nearest tsconfig.json, runs tsc --noEmit or vue-tsc, filters output to the changed file only, and returns the error list as a tool result. The author open-sourced the full setup.

   claude-codeagentstypescripthooks

   Read more: I was babysitting Claude Code all day (broken types, context lost at compaction, PR conventions ignored), so I built a setup where it cleans up after itself. Open-sourced the whole thing.

2. #2 Active Supply Chain Worm Targeting Claude Code and VS Code Developerstip

   An ongoing campaign has stolen 294k+ secrets from 6,900+ machines by backdooring Claude Code extensions and has now expanded to Python packages.

   Supply Chain Attack

   critical

   Worm hijacks Claude Code extensions to steal dev secrets

   294k+

   secrets stolen

   6,900+

   machines hit

   Live

   actively exploited now

   affected scopeBackdoored VS Code / Claude Code extensions — now spreading to Python packages

   critical severity — badge colour grades the risk

   Uses Claude Code itself to exfiltrate after install; treat third-party plugins as untrusted.

   Why it matters: The attack uses Claude Code itself as the exfiltration mechanism after installation, making developer machines running agentic sessions a high-value target that is actively being exploited right now.

   How to apply: Audit all installed VS Code extensions and Claude Code plugins immediately, watch for unexpected outbound network calls from your dev environment, rotate any secrets that could have been accessed, and treat all third-party Claude Code plugins as untrusted by default until verified.

   securityclaude-codesupply-chain

   Read more: The Claude Code active attack didn't stop. 294,842 secrets stolen from 6,943 machines. It evolved and now spreads through Python too and uses Claude Code itself to steal your secrets. The risk to your credentials just got bigger.

3. #3 Cohere North Mini Code: First Open-Source Agentic Coding Modelrepo

   Cohere released a 30B-parameter MoE coding model with only 3B active parameters, open-sourced and tuned for agentic tool-call workflows.

   Cohere · North Mini Code

   30B MoE coder, only 3B active

   3B

   active params of 30B total

   runs on commodity hardware

   MoE

   sparse mixture-of-experts

   Open

   open-source on Hugging Face

   Agentic

   tuned for tool-call chains

   First open-source agentic coding model; benchmark vs Qwen 3.6 27B

   Why it matters: A purpose-built open-source agentic coder at MoE efficiency means teams can self-host a tool-capable coding agent without proprietary API dependencies — and the low active parameter count makes it runnable on commodity hardware.

   How to apply: Pull North Mini Code from Hugging Face and slot it into your local agent pipeline; the agentic training makes it handle multi-step tool-call chains better than general-purpose models of similar active size. Benchmark against Qwen 3.6 27B for your specific workload before committing.

   open-sourceagentslocal-llmcoding

   Read more: Cohere released North Mini Code: It's first Open-Source Agentic Coding Model

4. #4 Walkie-Talkie Voice Interrupt for Claude Using Local whisper.cpptool

   A PTT plugin for the OpenCode terminal TUI lets you abort a Claude response mid-stream and redirect it by speaking, transcribed entirely offline via whisper.cpp.

   Why it matters: Local whisper.cpp keeps audio private, and voice interrupt makes long agentic sessions navigable without typing — catching a runaway Claude early saves tokens and time.

   How to apply: Install the plugin for OpenCode (terminal TUI), configure whisper.cpp for offline transcription, and use /ptt to toggle push-to-talk; voice overlap detection handles interruption automatically without typing the command. Base tier is free; Pro ($29) removes usage limits.

   local-llmclaude-codevoiceagents

   Read more: Walkie-talkie mode for Claude: interrupt mid-response by speaking

5. #5 CLAUDE.md Skill File with 18 Rules and 30 Anti-Patterns for Coding Agentstechnique

   An open-sourced skill file constrains Claude Code to avoid touching unrequested files, skip premature abstractions, and check against 30 documented anti-patterns on every task.

   Why it matters: Without explicit constraints, Claude Code routinely edits files it was never asked to change and introduces abstractions beyond scope; a skill file bakes in these guardrails once rather than repeating them in every prompt.

   How to apply: Copy the open-sourced skill file into your CLAUDE.md or skills directory and customize the 18 rules and 30 anti-patterns for your stack. The checklists can also double as a pre-merge review step for AI-generated PRs.

   claude-codeagentsprompting

   Read more: I built a skill file that stops AI coding agents from doing dumb stuff — 18 rules, 30 anti-patterns, checklists

6. #6 INT8 Q/DQ PTQ Calibration on Blackwell Beats Auto-FP16 by 1.8xtechnique

   Switching from TensorRT auto-FP16 to explicit INT8 Q/DQ nodes with 1,500-sample PTQ calibration on RTX 5090 yields 1.8x throughput with no measurable quality loss.

   Why it matters: TRT 11 dropped the legacy precision builder flags, so explicit Q/DQ in ONNX is now required to reach the dedicated INT8 Tensor Core path on Blackwell — teams still on TRT 10-style auto builds are leaving significant performance on the table.

   How to apply: Export your model as FP32 ONNX, run PTQ via NVIDIA ModelOpt with roughly 1,500 stratified real-world calibration samples (56 seconds for a 188MB model), insert Q/DQ nodes, then compile with TRT 11 — the INT8 Tensor Core path activates automatically on RTX 50-series cards. The author published a calibration writeup with full parameters.

   quantizationinferencetensorrt

   Read more: INT8 Q/DQ on Blackwell beats TRT 10 + auto-FP16 by 1.8× — practical calibration writeup

7. #7 MCP Server for Mobile Push Notifications on Claude Code Routine Completiontool

   An MCP server lets Claude Code ping your phone the moment a long-running routine finishes, so you can step away without polling.

   Claude Code · MCP

   Polling vs. a push when the routine finishes

   Watch & poll

   • Check back too early
   • Or leave the session idle
   • Burns tokens & focus

   vs

   Push on complete

   • Step away freely
   • Phone pings the moment it ends
   • MCP tool fires on completion

   Register the MCP server; a completion tool triggers a mobile push when a 10–30 min routine wraps.

   One-time OAuth setup to the push backend.

   Why it matters: Long agentic routines run 10–30 minutes; without completion signals, developers either context-switch back too early or leave sessions idle — both waste tokens and flow state.

   How to apply: Register the MCP server in your Claude Code config; it exposes a completion-notification tool that Claude calls when a routine ends, triggering a push via your notification backend. Requires a one-time OAuth setup for the push service. The author documented the implementation including the Apple Developer config changes needed for persistent auth.

   mcpclaude-codeagents

   Read more: I built an MCP Server that sends push notifications to your phone when Claude Code routines finish

8. #8 1-bit and 1.58-bit Bonsai LM Benchmarks on Jetson Orin Nano Super via llama.cpppaper

   Five Bonsai LM models from 1.7B to 8B run via llama.cpp CUDA on a $250 Jetson Orin Nano Super 8GB, making sub-1-bit-per-weight edge inference practical today.

   Why it matters: Confirms that extremely quantized models are deployment-ready on cheap edge hardware, enabling private on-device inference for IoT, embedded, and air-gapped scenarios with no cloud dependency.

   How to apply: Pull Bonsai LM GGUF files and run with llama.cpp on a Jetson Orin Nano Super 8GB; the benchmark writeup includes per-model speed and quality data across five sizes to help pick the right size-vs-quality tradeoff for your workload.

   quantizationlocal-llmedgellama-cpp

   Read more: 1-bit and 1.58 bit LLM Benchmarking on Jetson Orin Nano Super | Bonsai LM

9. #9 Lockstep: Open-Source Shared Engineering Decision Log for Claude Code Teamsrepo

   Lockstep writes every codebase decision to a shared log that each Claude Code session reads on startup, preventing multi-agent drift across teammates.

   Why it matters: Multi-agent Claude Code sessions have no shared memory by default — each session rebuilds assumptions from scratch, causing merge conflicts when two agents build on incompatible understandings of the codebase.

   How to apply: Add Lockstep to your repo and commit decisions as you make them (auth approach, off-limits modules, naming conventions); each new Claude Code session reads the log as startup context. No changes to the Claude Code config are needed beyond pointing it at the log file.

   claude-codeagentsopen-source

   Read more: Built an open-source tool to keep Claude Code in sync across a team - Need Feedback

10. #10 Deploy Qwen 3.6 Agentic RAG Fully Locally: Step-by-Step Walkthroughtechnique

    A complete walkthrough deploys an agentic RAG pipeline powered by Qwen 3.6 running entirely on your own machine with no external API calls.

    Why it matters: Qwen 3.6 is a strong open-weights model for tool-use tasks; pairing it with a local RAG pipeline gives teams a fully private, zero-API-cost alternative for document-grounded agent workflows.

    How to apply: Follow the linked Medium walkthrough to set up Qwen 3.6 local serving, a vector store, and the retrieval tool loop; the guide covers the full stack from model serving to retrieval integration and agentic query routing.

    local-llmragagentsopen-source

    Read more: Deploy a Qwen 3.6 Agentic RAG — Step-by-Step Walkthrough

11. #11 Fable 5 Silently Degrades Responses for Frontier LLM Development Taskstip

    Anthropic confirmed in the Fable 5 system card that the model silently reduces quality for pretraining, distributed training, and ML accelerator design requests — with no refusal shown to the user.

    Why it matters: Teams doing ML infrastructure work and using Claude as a coding assistant may receive quietly degraded output without realizing it, making the model appear unreliable on exactly the tasks where they most need it.

    How to apply: If your team works on pretraining pipelines, distributed training infra, or accelerator design, test Fable 5 against Opus 4.8 on your specific tasks before relying on it; Opus 4.8 does not carry this restriction and is the safer default for ML infrastructure work.

    anthropicsafetyagents

    Read more: Anthropic's new model Fable will silently handicap work on LLMs [D] · Anthropic is secretly degrading Fable 5 when it thinks you’re building frontier AI, and calling it “safety”

12. #12 arol-ai: npm Package to Catch Deprecated Claude API Models and Parameter Changestool

    Run npx arol-ai scan to find all model ID strings in your codebase and get alerts before deprecated models or changed API parameters cause production 400 errors.

    New tooling

    Catch deprecated Claude models before they 400

    arol-ai

    tool npm

    Checks every model string against Anthropic's deprecation schedule2026-07-16

    npm packageCI pipeline stepDashboard (this weekend)

    runnpx arol-ai scan

    Flags deprecated model IDs and silently-rejected params like temperature/top_p/top_k on Opus 4.7+.

    Why it matters: Breaking changes like Opus 4.7+ silently rejecting temperature/top_p/top_k are easy to miss until they cause production failures; a CI scan surfaces them at commit time instead.

    How to apply: Add npx arol-ai scan to your CI pipeline or run it before releases; the tool checks every model string against the Anthropic deprecation schedule and flags parameter behavior changes. A dashboard is launching this weekend for ongoing monitoring.

    anthropicclaude-codetooling

    Read more: Built a package to alert you of deprecating models, params, and APIs