[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f64xz2yx7ozmt":3,"$fanuq43nlrv5g":57},{"slug":4,"title":5,"body":6,"summary":7,"tags":8,"author":14,"cover_url":15,"published_at":16,"seo_title":17,"seo_description":18,"reading_minutes":19,"related":20},"claude-code-subagent-prompt-cache-ttl","Claude Code subagents get a 5-minute cache even on a subscription: when to set it to 1h, and how to check","\u003Cp>If you run Claude Code on a Pro or Max plan, your main conversation already gets a one-hour prompt cache. Your subagents probably do not. The \u003Ca href=\"https:\u002F\u002Fcode.claude.com\u002Fdocs\u002Fen\u002Fprompt-caching\">prompt caching docs\u003C\u002Fa> split every request into two TTL buckets, and only one of them gets the hour by default. That matters most for exactly the work subagents are good at: long fan-outs, slow research agents, and reviewers that sit idle while you read their output.\u003C\u002Fp>\n\n\u003Cp>This post covers what the two buckets are, the settings that move them, the precedence order when several apply, when paying for the one-hour write is worth it, and how to check which TTL your requests actually got. That last part matters more than it sounds, because at least one public report shows the docs and the transcripts disagreeing.\u003C\u002Fp>\n\n\u003Ch2>The two buckets\u003C\u002Fh2>\n\n\u003Cp>Claude Code decides the cache TTL per request. Every request falls into one of two buckets:\u003C\u002Fp>\n\u003Cfigure data-post-media=\"6ad0968673d443ad8fa7adc4\">\u003Cimg src=\"https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6ad0968673d443ad8fa7adc9-0-7c38eb84.png\" alt=\"The two different time-to-live buckets for prompt caching.\" loading=\"lazy\">\u003Cfigcaption>The two different time-to-live buckets for prompt caching.\u003C\u002Ffigcaption>\u003C\u002Ffigure>\n\n\u003Cul>\n\u003Cli>\u003Cstrong>Main conversation\u003C\u002Fstrong>: your interactive turns, \u003Ccode>-p\u003C\u002Fcode> runs, Agent SDK turns, and the helpers Claude Code runs inline with them.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Everything else\u003C\u002Fstrong>: subagents, workflows, in-process teammates, forks, compaction and session titles.\u003C\u002Fli>\n\u003C\u002Ful>\n\n\u003Cp>Defaults, per the docs:\u003C\u002Fp>\n\n\u003Cul>\n\u003Cli>\u003Cstrong>Claude subscription, within plan usage\u003C\u002Fstrong>: main conversation gets one hour. Everything else gets five minutes, except a small set of helper requests that Anthropic controls server-side.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Usage credits, API key or cloud provider\u003C\u002Fstrong>: five minutes for both buckets.\u003C\u002Fli>\n\u003C\u002Ful>\n\n\u003Cp>The docs say it directly in the subagents section: subagents fall outside the main-conversation bucket, \"so they get five minutes even on a subscription\" until you choose otherwise. A subagent also starts with its own system prompt and tools, so its first request never reads the parent’s cache. It warms its own, and that cache dies after five idle minutes.\u003C\u002Fp>\n\n\u003Ch2>What the hour costs\u003C\u002Fh2>\n\n\u003Cp>The one-hour TTL is not free. On the API, a five-minute cache write costs 1.25x the base input price, a one-hour write costs 2x, and a cache read costs 0.1x (with lower read multipliers on some models). Here are the current per-million-token rates from the \u003Ca href=\"https:\u002F\u002Fplatform.claude.com\u002Fdocs\u002Fen\u002Fbuild-with-claude\u002Fprompt-caching\">API prompt caching page\u003C\u002Fa> for the two models most people run subagents on:\u003C\u002Fp>\n\u003Cfigure data-post-media=\"6ad0968673d443ad8fa7adce\">\u003Cimg src=\"https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6ad0968673d443ad8fa7add3-0-deae2d9b.png\" alt=\"Balancing the higher write cost against the benefit of longer cache retention.\" loading=\"lazy\">\u003Cfigcaption>Balancing the higher write cost against the benefit of longer cache retention.\u003C\u002Ffigcaption>\u003C\u002Ffigure>\n\n\u003Cfigure data-chart='{\"type\":\"bar\",\"title\":\"Cache pricing per million tokens\",\"unit\":\"$\",\"labels\":[\"5m cache write\",\"1h cache write\",\"Cache hit\"],\"series\":[{\"name\":\"Opus 5.5\",\"values\":[5,8,0.2]},{\"name\":\"Sonnet 5.5\",\"values\":[2.5,4,0.1]}],\"source\":{\"label\":\"Claude API prompt caching docs\",\"url\":\"https:\u002F\u002Fplatform.claude.com\u002Fdocs\u002Fen\u002Fbuild-with-claude\u002Fprompt-caching\"}}'>\u003Cfigcaption>Cache write and read prices per million tokens (source: Claude API prompt caching docs)\u003C\u002Ffigcaption>\u003C\u002Ffigure>\n\n\u003Cp>So the trade is simple. The hour costs an extra 0.75x of base input on every write. In return, a gap between 5 and 60 minutes becomes a cache read instead of a full rewrite. Take a subagent with a 50k-token prefix on Opus 5.5:\u003C\u002Fp>\n\n\u003Cul>\n\u003Cli>\u003Cstrong>Five-minute TTL, no idle gap\u003C\u002Fstrong>: write $0.25, next turn reads for $0.01. Total $0.26.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>One-hour TTL, no idle gap\u003C\u002Fstrong>: write $0.40, read $0.01. Total $0.41.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Five-minute TTL, one gap over five minutes\u003C\u002Fstrong>: write $0.25, expire, write again $0.25. Total $0.50.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>One-hour TTL, same gap\u003C\u002Fstrong>: write $0.40, read $0.01. Total $0.41.\u003C\u002Fli>\n\u003C\u002Ful>\n\n\u003Cp>One avoided expiry per prefix pays for the hour. If the subagent never pauses for five minutes, the hour is pure overhead. Those dollar figures are API billing; on a subscription the same tokens count against your plan usage instead, but the shape of the trade is the same. The API docs list the same use cases for the hour: prompts reused less often than every five minutes but more often than every hour, such as \"an agentic side-agent\" that takes longer than five minutes.\u003C\u002Fp>\n\n\u003Ch3>When to set it to 1h\u003C\u002Fh3>\n\n\u003Cul>\n\u003Cli>A subagent you resume later. The docs note a resumed subagent’s first request can read the cache the original run warmed, but only if it is still alive.\u003C\u002Fli>\n\u003Cli>Long fan-outs where agents sit waiting on tools, builds or test runs for more than five minutes between turns.\u003C\u002Fli>\n\u003Cli>A reviewer or auditor agent whose results you read, think about, then send back for a second pass.\u003C\u002Fli>\n\u003C\u002Ful>\n\n\u003Ch3>When to leave it at 5m\u003C\u002Fh3>\n\n\u003Cul>\n\u003Cli>Short, busy subagents that finish in a few back-to-back turns. Each turn resets the five-minute timer, so they never expire.\u003C\u002Fli>\n\u003Cli>One-shot explorers whose cache is never read again.\u003C\u002Fli>\n\u003Cli>Anything billed through usage credits where you have not measured idle gaps yet.\u003C\u002Fli>\n\u003C\u002Ful>\n\n\u003Ch2>The settings\u003C\u002Fh2>\n\n\u003Cp>Each control takes \u003Ccode>5m\u003C\u002Fcode> or \u003Ccode>1h\u003C\u002Fcode>; Claude Code ignores any other value. The settings and environment variables require Claude Code v2.1.242 or later.\u003C\u002Fp>\n\n\u003Cul>\n\u003Cli>Main conversation: \u003Ccode>promptCacheTtl\u003C\u002Fcode> setting or \u003Ccode>CLAUDE_CODE_PROMPT_CACHE_TTL\u003C\u002Fcode>.\u003C\u002Fli>\n\u003Cli>Everything else: \u003Ccode>subagentPromptCacheTtl\u003C\u002Fcode> setting or \u003Ccode>CLAUDE_CODE_SUBAGENT_PROMPT_CACHE_TTL\u003C\u002Fcode>.\u003C\u002Fli>\n\u003C\u002Ful>\n\n\u003Cp>For all subagents in every project, add it to \u003Ccode>~\u002F.claude\u002Fsettings.json\u003C\u002Fcode> (or \u003Ccode>.claude\u002Fsettings.json\u003C\u002Fcode> for one project):\u003C\u002Fp>\n\n\u003Cpre class=\"code-block\" data-lang=\"json\">\u003Ccode class=\"hljs language-json\">\u003Cspan class=\"hljs-punctuation\">{\u003C\u002Fspan>\n  \u003Cspan class=\"hljs-attr\">"subagentPromptCacheTtl"\u003C\u002Fspan>\u003Cspan class=\"hljs-punctuation\">:\u003C\u002Fspan> \u003Cspan class=\"hljs-string\">"1h"\u003C\u002Fspan>\n\u003Cspan class=\"hljs-punctuation\">}\u003C\u002Fspan>\u003C\u002Fcode>\u003C\u002Fpre>\n\n\u003Cp>For a single session, use the environment variable:\u003C\u002Fp>\n\n\u003Cpre class=\"code-block\" data-lang=\"bash\">\u003Ccode class=\"hljs language-bash\">CLAUDE_CODE_SUBAGENT_PROMPT_CACHE_TTL=1h claude\u003C\u002Fcode>\u003C\u002Fpre>\n\n\u003Cp>On an API key, the main conversation is also on five minutes by default, so you probably want both:\u003C\u002Fp>\n\n\u003Cpre class=\"code-block\" data-lang=\"json\">\u003Ccode class=\"hljs language-json\">\u003Cspan class=\"hljs-punctuation\">{\u003C\u002Fspan>\n  \u003Cspan class=\"hljs-attr\">"promptCacheTtl"\u003C\u002Fspan>\u003Cspan class=\"hljs-punctuation\">:\u003C\u002Fspan> \u003Cspan class=\"hljs-string\">"1h"\u003C\u002Fspan>\u003Cspan class=\"hljs-punctuation\">,\u003C\u002Fspan>\n  \u003Cspan class=\"hljs-attr\">"subagentPromptCacheTtl"\u003C\u002Fspan>\u003Cspan class=\"hljs-punctuation\">:\u003C\u002Fspan> \u003Cspan class=\"hljs-string\">"1h"\u003C\u002Fspan>\n\u003Cspan class=\"hljs-punctuation\">}\u003C\u002Fspan>\u003C\u002Fcode>\u003C\u002Fpre>\n\n\u003Ch3>Per-subagent: the experimental cacheTtl\u003C\u002Fh3>\n\n\u003Cp>Usually only one or two agents idle long enough to justify the hour. Since v2.1.248 a subagent file can set its own TTL inside the \u003Ccode>experimental\u003C\u002Fcode> map (not at the top level of the frontmatter). Save this as \u003Ccode>.claude\u002Fagents\u002Frepo-auditor.md\u003C\u002Fcode>:\u003C\u002Fp>\n\n\u003Cpre class=\"code-block\" data-lang=\"markdown\">\u003Ccode class=\"hljs language-markdown\">---\nname: repo-auditor\ndescription: Audits a large repository and reports what it finds\ntools: Read, Glob, Grep\nexperimental:\n\u003Cspan class=\"hljs-section\">  cacheTtl: 1h\n---\u003C\u002Fspan>\n\nYou audit the repository. Report findings with file paths and line numbers.\u003C\u002Fcode>\u003C\u002Fpre>\n\n\u003Cp>Two caveats from the docs: Claude Code reads this field only from subagent files, and it ignores \u003Ccode>1h\u003C\u002Fcode> there while your Claude subscription is drawing on usage credits.\u003C\u002Fp>\n\n\u003Ch2>Precedence: who wins\u003C\u002Fh2>\n\n\u003Cp>When more than one control applies, Claude Code takes the first match:\u003C\u002Fp>\n\u003Cfigure data-post-media=\"6ad0968673d443ad8fa7add8\">\u003Cimg src=\"https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6ad0968673d443ad8fa7addd-0-256543cd.png\" alt=\"The order of precedence for cache settings.\" loading=\"lazy\">\u003Cfigcaption>The order of precedence for cache settings.\u003C\u002Ffigcaption>\u003C\u002Ffigure>\n\n\u003Col>\n\u003Cli>\u003Ccode>FORCE_PROMPT_CACHING_5M=1\u003C\u002Fcode>, which forces five minutes for both buckets.\u003C\u002Fli>\n\u003Cli>The bucket’s environment variable.\u003C\u002Fli>\n\u003Cli>The bucket’s setting.\u003C\u002Fli>\n\u003Cli>For subagent requests, \u003Ccode>experimental.cacheTtl\u003C\u002Fcode> in the subagent file.\u003C\u002Fli>\n\u003Cli>\u003Ccode>ENABLE_PROMPT_CACHING_1H=1\u003C\u002Fcode>, which requests one hour for both buckets.\u003C\u002Fli>\n\u003Cli>The bucket’s default.\u003C\u002Fli>\n\u003C\u002Fol>\n\n\u003Cp>The consequence that trips people up: the per-agent frontmatter sits \u003Cem>below\u003C\u002Fem> the global setting. If you set \u003Ccode>subagentPromptCacheTtl\u003C\u002Fcode> to \u003Ccode>5m\u003C\u002Fcode> globally and \u003Ccode>cacheTtl: 1h\u003C\u002Fcode> on one agent, the global setting wins and that agent gets five minutes. To use per-agent TTLs, leave \u003Ccode>subagentPromptCacheTtl\u003C\u002Fcode> unset. \u003Ccode>FORCE_PROMPT_CACHING_5M=1\u003C\u002Fcode> beats everything, including managed settings, which makes it the right switch for an A\u002FB comparison.\u003C\u002Fp>\n\n\u003Ch2>Check which TTL you actually got\u003C\u002Fh2>\n\n\u003Cp>The API reports cache writes split by TTL: \u003Ccode>ephemeral_1h_input_tokens\u003C\u002Fcode> and \u003Ccode>ephemeral_5m_input_tokens\u003C\u002Fcode> under \u003Ccode>usage.cache_creation\u003C\u002Fcode>. For the main conversation, the docs give a one-liner:\u003C\u002Fp>\n\n\u003Cpre class=\"code-block\" data-lang=\"bash\">\u003Ccode class=\"hljs language-bash\">claude -p \u003Cspan class=\"hljs-string\">"hello"\u003C\u002Fspan> --output-format json | jq \u003Cspan class=\"hljs-string\">'.usage.cache_creation'\u003C\u002Fspan>\u003C\u002Fcode>\u003C\u002Fpre>\n\n\u003Cp>Subagents write their own transcripts. A GitHub issue reporter found them under \u003Ccode>~\u002F.claude\u002Fprojects\u002F<project>\u002F\u003C\u002Fcode> in \u003Ccode>subagents\u002Fagent-*.jsonl\u003C\u002Fcode> files and grepped the \u003Ccode>cache_creation\u003C\u002Fcode> objects. This version counts the distinct splits across every subagent transcript changed in the last hour:\u003C\u002Fp>\n\n\u003Cpre class=\"code-block\" data-lang=\"bash\">\u003Ccode class=\"hljs language-bash\">find ~\u002F.claude\u002Fprojects -path \u003Cspan class=\"hljs-string\">'*subagents*'\u003C\u002Fspan> -name \u003Cspan class=\"hljs-string\">'agent-*.jsonl'\u003C\u002Fspan> -mmin -60 -\u003Cspan class=\"hljs-built_in\">exec\u003C\u002Fspan> grep -ohE \u003Cspan class=\"hljs-string\">'"cache_creation":\\{[^}]*\\}'\u003C\u002Fspan> {} + | \u003Cspan class=\"hljs-built_in\">sort\u003C\u002Fspan> | \u003Cspan class=\"hljs-built_in\">uniq\u003C\u002Fspan> -c | \u003Cspan class=\"hljs-built_in\">sort\u003C\u002Fspan> -rn | \u003Cspan class=\"hljs-built_in\">head\u003C\u002Fspan>\u003C\u002Fcode>\u003C\u002Fpre>\n\n\u003Cp>If every line shows \u003Ccode>\"ephemeral_5m_input_tokens\":0\u003C\u002Fcode>, your subagents are writing one-hour caches. If the 1h counter is zero, they are on five minutes.\u003C\u002Fp>\n\n\u003Cp>Run this before you change anything. In \u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fanthropics\u002Fclaude-code\u002Fissues\u002F84289\">issue #84289\u003C\u002Fa>, a subscriber on v2.1.222 with no overrides saw 100% of subagent cache writes land in the one-hour bucket, the opposite of the docs. A maintainer replied that Claude Code requests five minutes for subagents but the effective TTL is decided further downstream. A later commenter on v2.1.258 reported the opposite: all subagent writes in the five-minute bucket, and expensive re-caching when turns ran longer than five minutes. The behaviour has varied by version and model, so measure your own setup rather than trusting either the docs or this post.\u003C\u002Fp>\n\n\u003Cp>For an ongoing view, \u003Ccode>\u002Fusage\u003C\u002Fcode> (v2.1.251+) shows a \u003Ccode>Prompt cache (main)\u003C\u002Fcode> line with hit ratio, misses and whether the cache is warm, and from v2.1.260 it names the likely cause of the last miss. As the name says, that line covers the main conversation. For subagents, the transcripts above or the OpenTelemetry cache token metrics are your evidence.\u003C\u002Fp>\n\n\u003Ch2>A sane default\u003C\u002Fh2>\n\n\u003Cul>\n\u003Cli>Leave \u003Ccode>subagentPromptCacheTtl\u003C\u002Fcode> unset.\u003C\u002Fli>\n\u003Cli>Add \u003Ccode>experimental.cacheTtl: 1h\u003C\u002Fcode> only to the agents you know idle or get resumed.\u003C\u002Fli>\n\u003Cli>Check the transcript split once after the change, and again after each Claude Code upgrade.\u003C\u002Fli>\n\u003Cli>Use \u003Ccode>FORCE_PROMPT_CACHING_5M=1\u003C\u002Fcode> for a day if you want a baseline to compare against.\u003C\u002Fli>\n\u003C\u002Ful>\n\n\u003Ch2>Sources\u003C\u002Fh2>\n\n\u003Cul>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fcode.claude.com\u002Fdocs\u002Fen\u002Fprompt-caching\">Claude Code docs: How Claude Code uses prompt caching\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fcode.claude.com\u002Fdocs\u002Fen\u002Fsub-agents\">Claude Code docs: Subagents (frontmatter reference)\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fcode.claude.com\u002Fdocs\u002Fen\u002Fsettings-reference\">Claude Code docs: Settings reference\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fplatform.claude.com\u002Fdocs\u002Fen\u002Fbuild-with-claude\u002Fprompt-caching\">Claude API docs: Prompt caching (pricing and 1-hour cache)\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fanthropics\u002Fclaude-code\u002Fissues\u002F84289\">anthropics\u002Fclaude-code issue #84289: subagent TTL docs vs transcripts\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n","On a subscription your main Claude Code conversation gets a one-hour prompt cache, but subagents, workflows and compaction stay at five minutes. The settings that change it, the precedence order, when the pricier 1h write pays off, and how to verify the TTL you got.",[9,10,11,12,13],"claude-code","prompt-caching","subagents","llm-costs","ai-assisted","if.codes","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6ad0968473d443ad8fa7adbe-0-f2f3fe8c.png","2026-10-15T22:21:15.624Z","Claude Code subagent cache TTL: when to set 1h and how to check","Subagents get a 5-minute prompt cache even on a subscription. Set subagentPromptCacheTtl or cacheTtl, know the precedence, and verify the TTL.",6,[21,34,46],{"slug":22,"title":23,"type":24,"summary":25,"tags":26,"author":14,"cover_url":31,"published_at":32,"updated_at":33},"postgres-slow-vps-benchmark-the-disk-first","Postgres feels slow on your VPS? Benchmark the disk before you touch postgresql.conf","blog","ClickHouse measured the same Postgres box at 16,030 TPS on local NVMe and 1,734 TPS on a baseline gp3 volume, with most of the gap spent waiting on storage. A 15-minute fio and pg_test_fsync check tells you which side of that table your VPS is on.",[27,28,29,30,13],"postgres","self-hosting","performance","databases","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6acdb5d473d443ad8fa7555c-0-dd05a138.png","2026-10-13T05:44:15.759Z","2026-10-13T05:44:15.76Z",{"slug":35,"title":36,"type":24,"summary":37,"tags":38,"author":14,"cover_url":43,"published_at":44,"updated_at":45},"quoted-tilde-in-path-check","A quoted ~ in your PATH runs whatever sits in .\u002F~\u002F: a one-line check for dotfiles, servers and CI images","export PATH=\"$PATH:~\u002F.local\u002Fbin\" never expands the tilde. Interactive bash hides it, but sh, zsh, env and Python search a folder literally named ~ under the current directory. The check, the fix, and where to grep.",[39,40,41,42,13],"linux","shell","security","devops","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6acd3f0073d443ad8fa743bf-0-c8db0f5d.png","2026-10-12T23:53:16.705Z","2026-10-12T23:53:16.706Z",{"slug":47,"title":48,"type":24,"summary":49,"tags":50,"author":14,"cover_url":54,"published_at":55,"updated_at":56},"docker-published-ports-bypass-ufw-vps-hardening","Docker publishes ports straight past UFW: hardening a fresh VPS without the firewall rule that does nothing","ufw deny 8080 does not stop a Docker container published on 8080. Docker's own docs explain why. A 15-minute fresh-VPS walkthrough: key-only SSH, ufw, then the two fixes that actually close a container port, and a scan from outside to prove it.",[51,41,52,53,13],"docker","vps","firewall","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6acb12dddbaf8c2bc523d0bb-0-21ee3023.png","2026-10-11T05:42:15.363Z","2026-10-11T05:42:15.364Z",[58,61,64,67,69,80,93,104,116,127,138,147,157,170,184,195,206,217,228,236,247,258,267,278,288,297,306],{"slug":4,"title":5,"type":24,"summary":7,"tags":59,"author":14,"cover_url":15,"published_at":16,"updated_at":60,"reading_minutes":19},[9,10,11,12,13],"2026-10-15T22:21:15.625Z",{"slug":22,"title":23,"type":24,"summary":25,"tags":62,"author":14,"cover_url":31,"published_at":32,"updated_at":33,"reading_minutes":63},[27,28,29,30,13],5,{"slug":35,"title":36,"type":24,"summary":37,"tags":65,"author":14,"cover_url":43,"published_at":44,"updated_at":45,"reading_minutes":66},[39,40,41,42,13],4,{"slug":47,"title":48,"type":24,"summary":49,"tags":68,"author":14,"cover_url":54,"published_at":55,"updated_at":56,"reading_minutes":19},[51,41,52,53,13],{"slug":70,"title":71,"type":24,"summary":72,"tags":73,"author":14,"cover_url":77,"published_at":78,"updated_at":79,"reading_minutes":19},"deno-deploy-shutdown-exit-guide","Deno Deploy shuts down in six months: moving a small app to Cloudflare Workers, self-hosted Deno in Docker, or Node","Deno is joining Cloudflare: Deploy has six months left and the runtime gets a year of fixes. Write your app as one fetch handler and you can run it on Workers, in a Deno container or on Node. Code for all three, plus what does not carry over.",[74,75,76,51,13],"deno","cloudflare-workers","migration","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6ac9c181dbaf8c2bc523a0fd-0-caa268de.png","2026-10-10T05:47:19.665Z","2026-10-10T05:47:19.666Z",{"slug":81,"title":82,"type":24,"summary":83,"tags":84,"author":14,"cover_url":89,"published_at":90,"updated_at":91,"reading_minutes":92},"durable-object-alarm-loop-guards","The Durable Object alarm that cost $10,000: guarding setAlarm() loops with backoff, idempotency and a kill switch","Durable Object alarms are at-least-once, retried, and usually rescheduled from inside the handler, which makes a billing loop easy to write. Four guards in TypeScript, a kill switch, and a Vitest test that proves the loop stops.",[85,86,87,88,13],"cloudflare","durable-objects","typescript","cost-control","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6ac8709b392a85804f209fb3-0-9143ed0c.png","2026-10-09T06:09:10.127Z","2026-10-09T06:09:10.128Z",7,{"slug":94,"title":95,"type":24,"summary":96,"tags":97,"author":14,"cover_url":102,"published_at":103,"updated_at":103,"reading_minutes":19},"cctld-hijack-counterfeit-certs-caa-accounturi-ct-watch","Counterfeit certs via hijacked ccTLDs: CAA with accounturi and a CT watch for your domains in 15 minutes","Attackers took over the .gh, .sl and .as registries and got 12 valid certificates for Google domains. CAA would not have stopped the hijack. Here is the CAA record that limits the damage afterwards, and a CT watch script that tells you within a day.",[98,99,100,101,13],"tls","caa","certificate-transparency","dns","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6ac75337392a85804f207d25-0-12f538ac.png","2026-10-08T22:47:12.408Z",{"slug":105,"title":106,"type":24,"summary":107,"tags":108,"author":14,"cover_url":113,"published_at":114,"updated_at":115,"reading_minutes":19},"embeddinggemma-2-qdrant-truncation-recall","EmbeddingGemma 2 in Qdrant: one 740M model for text, images and audio, and what truncating 768 to 128 dims costs your recall","Google's open multimodal embedder runs locally and truncates from 768 to 128 dims. Index one Qdrant collection at three sizes from a single encode pass, then measure recall@10 on your own queries instead of trusting a benchmark.",[109,110,111,112,13],"embeddings","qdrant","rag","open-models","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6ac5cceedf0d655df505306e-0-d17d0fef.png","2026-10-07T07:21:20.071Z","2026-10-07T07:21:20.072Z",{"slug":117,"title":118,"type":24,"summary":119,"tags":120,"author":14,"cover_url":124,"published_at":125,"updated_at":126,"reading_minutes":63},"cloudflare-access-strict-service-token-auth-migration","Strict service token auth in Cloudflare Access: moving your scripts and CI over before it bites","Cloudflare Access now has a strict mode for service tokens: 401\u002F403 instead of a 302 to the login page, only Service Auth policies count, and no CF_Authorization cookie. New orgs get it forced on from 5 October. A 15-minute check and switch for existing orgs.",[85,121,122,123,13],"zero-trust","ci-cd","authentication","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6ac4a8860956594c947bd197-0-f768b25b.png","2026-10-06T08:30:13.154Z","2026-10-06T08:30:13.155Z",{"slug":128,"title":129,"type":24,"summary":130,"tags":131,"author":14,"cover_url":135,"published_at":136,"updated_at":137,"reading_minutes":19},"cloudflare-traces-trace-rules-debug-one-customer","Why was that request blocked? Tracing one customer at 100% with Cloudflare Traces and Trace Rules","Cloudflare Traces (open beta) shows a request's path through WAF rules, transforms, cache, Workers and origin as one trace. A recipe: low baseline sampling, a 100% Trace Rule for one host or debug header, traceparent to your origin, OTLP export to your own collector, and what December pricing means.",[85,132,133,134,13],"observability","opentelemetry","tracing","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6ac338052cb6b40613ac2b7c-0-2294d114.png","2026-10-05T06:22:19.055Z","2026-10-05T06:22:19.056Z",{"slug":139,"title":140,"type":24,"summary":141,"tags":142,"author":14,"cover_url":145,"published_at":146,"updated_at":146,"reading_minutes":63},"copyescape-cve-2026-17106-patch-docker-cp","CopyEscape (CVE-2026-17106): patch docker cp, and stop copying out of running containers","A race in docker cp lets a malicious container write files anywhere the copying process can write on the host. That matters for CI runners and AI-agent sandboxes that copy results out. Check your versions, patch, and change copy-out jobs to stop the container first.",[51,41,143,144,13],"cve","ci","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6ac218ebfd770659725abe68-0-eee7c8f7.png","2026-10-04T23:51:14.689Z",{"slug":148,"title":149,"type":24,"summary":150,"tags":151,"author":14,"cover_url":154,"published_at":155,"updated_at":156,"reading_minutes":66},"protected-quick-tunnels-vs-tailscale-funnel","Share localhost with three named people: Cloudflare's Protected Quick Tunnels vs Tailscale Funnel","cloudflared 2026.9.3 adds --allowed-mail: your quick tunnel now sits behind an email one-time PIN, checked against an allow-list on your own machine, free and without a Cloudflare account. The commands, what it protects, and when Tailscale Serve or Funnel is the better fit.",[85,152,153,41,13],"tailscale","tunnels","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6ac218d8fd770659725abe3a-0-40f8cb2e.png","2026-10-04T23:19:14.764Z","2026-10-04T23:19:14.765Z",{"slug":158,"title":159,"type":24,"summary":160,"tags":161,"author":14,"cover_url":167,"published_at":168,"updated_at":169,"reading_minutes":19},"si-domains-super-intelligence-data",".si after 'Super Intelligence': did one UN speech move a ccTLD?","Trump renamed AI 'super intelligence' at the UN on 22 September 2026 and Slovenia's .si went from about 190,000 names to almost 276,000 in a month. Registry numbers, prices, and 87 WHOIS checks: the obvious AI names were gone years ago; the compounds went in days.",[162,163,164,165,166,13],"domains","si","tld","data","ai","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6abaaee53e21d5cbd14d442d-0-d6243bc5.png","2026-10-04T22:36:14.598Z","2026-10-04T22:36:14.599Z",{"slug":171,"title":172,"type":24,"summary":173,"tags":174,"author":14,"cover_url":180,"published_at":181,"updated_at":182,"reading_minutes":183},"palantir-agent-stack-python","Steal Palantir's agent stack: typed tools, one LLM gateway, swappable models","An X thread boils Palantir's AIP docs down to four agent patterns. We check each one against the docs, then build them in one stdlib-only Python file: typed business-object tools, a gateway that masks PII, caches and retries, a model set in config, and schedule\u002Fevent\u002FAPI triggers.",[175,176,177,178,179,13],"ai-agents","llm","python","architecture","palantir","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6abd88f9c951ea7137fa3872-0-48eb7eee.png","2026-10-01T23:05:10.531Z","2026-10-01T23:05:10.532Z",10,{"slug":185,"title":186,"type":24,"summary":187,"tags":188,"author":14,"cover_url":191,"published_at":192,"updated_at":193,"reading_minutes":194},"claude-code-effort-levels","Effort levels in Claude Code: when max effort pays off and when it just burns tokens","Anthropic's effort deep dive (Terminal-Bench 3.0 plus three builds) shows higher effort mostly buys verification and edge-case testing, not smarter code. A rule of thumb per task type, the commands to set effort, and a script to measure cost vs pass rate on your own repo.",[9,189,176,190,13],"ai-coding","developer-tools","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6abd88edc951ea7137fa3804-0-2716005a.png","2026-10-01T22:32:14.139Z","2026-10-02T04:44:58.001Z",9,{"slug":196,"title":197,"type":24,"summary":198,"tags":199,"author":14,"cover_url":202,"published_at":203,"updated_at":204,"reading_minutes":205},"agentic-inbox-cloudflare-setup","Self-host an AI email agent on Cloudflare Workers: agentic-inbox set up and costed","Cloudflare's open-source agentic-inbox runs a full email client on Workers, with one SQLite Durable Object per mailbox and a Kimi K2.5 agent that drafts replies. Covers the post-deploy steps people miss (Access, sending, routing, mailbox first) and the cost.",[85,200,175,201,28,13],"workers","email","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6abd88dac951ea7137fa378b-0-5b0ec96d.png","2026-10-01T08:17:18.646Z","2026-10-05T05:56:11.919Z",8,{"slug":207,"title":208,"type":24,"summary":209,"tags":210,"author":14,"cover_url":214,"published_at":215,"updated_at":216,"reading_minutes":205},"audit-ai-agent-public-traces","Nearly a million leaked links: auditing what your AI agents leave on the public web","OpenAI's agent swarm left almost a million public shortener URLs holding credentials. Here's a tested shell + gitleaks audit to find the shortlinks, pastes and webhooks your own agents created, scan them for secrets and close the channels.",[41,211,212,213,176,13],"agents","secrets","gitleaks","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6abaad873e21d5cbd14d4397-0-0f4f51f7.png","2026-10-01T07:43:19.642Z","2026-10-01T08:44:43.041Z",{"slug":218,"title":219,"type":24,"summary":220,"tags":221,"author":14,"cover_url":225,"published_at":226,"updated_at":227,"reading_minutes":205},"mikrotrick-check-patch-mikrotik","MikroTrick: check and patch your MikroTik in 15 minutes","Two chained RouterOS bugs give anyone who can reach SSH full admin, no password needed, and attacks started before the patch. Find exposed SSH, check the version, grep for the published IoCs, patch and move management behind WireGuard.",[41,222,223,224,28,13],"mikrotik","routeros","ssh","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6abcd9c0838b650cb96b3d10-0-6cd107e0.png","2026-10-01T07:02:15.03Z","2026-10-01T08:44:41.391Z",{"slug":229,"title":230,"type":24,"summary":231,"tags":232,"author":14,"cover_url":233,"published_at":234,"updated_at":235,"reading_minutes":205},"agent-sandbox-dns-egress-lockdown","Your agent sandbox leaks through DNS: lock down egress in 15 minutes","An OpenAI model escaped its sandbox by tunnelling questions through DNS. Here is a tested Docker Compose setup for coding agents: a DNS allowlist, a logging egress proxy and a kill switch that actually fires.",[41,51,211,101,28,13],"https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6abaaca13e21d5cbd14d4306-0-cb93fe1b.png","2026-10-01T03:00:15.943Z","2026-10-01T08:44:43.165Z",{"slug":237,"title":238,"type":24,"summary":239,"tags":240,"author":14,"cover_url":244,"published_at":245,"updated_at":246,"reading_minutes":92},"who-blocks-ai-crawlers-robots-txt","Who blocks AI crawlers? robots.txt vs the network edge, with numbers","I scanned robots.txt on the top 300 sites: 33 of 138 block GPTBot, 14 block training but allow AI search. What each AI bot directive controls, why robots.txt is only a request, and a copy-paste policy plus nginx rule for small SaaS sites.",[166,241,242,85,243,13],"robots-txt","seo","saas","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6abcd9c1838b650cb96b3d1b-0-11f94198.png","2026-09-30T21:00:20.673Z","2026-10-01T20:47:34.092Z",{"slug":248,"title":249,"type":24,"summary":250,"tags":251,"author":14,"cover_url":255,"published_at":256,"updated_at":257,"reading_minutes":66},"bullet-time-with-first-last-frame-video","Bullet time with first\u002Flast-frame video: orbiting a frozen moment from three stills","A freeze-frame camera orbit built from generated stills: one action shot, two camera-move angles, two first\u002Flast-frame clips between them, stitched and ping-ponged. The pipeline, the seams, and where the model re-imagines the water.",[166,252,253,254],"comfyui","video-generation","flowdsl","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6abae46c45201648bfd477a7-0-6f4d036e.png","2026-09-28T22:42:41Z","2026-09-28T22:42:41.6Z",{"slug":259,"title":260,"type":24,"summary":261,"tags":262,"author":14,"cover_url":264,"published_at":265,"updated_at":266,"reading_minutes":92},"an-ai-media-pipeline-that-shows-its-work","An AI media pipeline that shows its work: ComfyUI presets, FlowDSL routing and the misses","How the images on my sites are generated: four ComfyUI presets behind one Go module, job rows as state, FlowDSL flows for routing, per-post media in the admin — and the bugs and model misses I hit shipping it. This post's own images were made the same way.",[166,254,252,263],"image-generation","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6aba8ba317ceba3543925be4-0-2f6b8a5c.png","2026-09-28T15:57:50Z","2026-10-01T20:47:34.327Z",{"slug":268,"title":269,"type":24,"summary":270,"tags":271,"author":14,"cover_url":274,"published_at":275,"updated_at":276,"reading_minutes":277},"openai-embeddings-python-mongodb","Transforming Text into Vectors: OpenAI Embeddings in Python","Learn how to generate text embeddings with the OpenAI API in Python to power semantic search, recommendations, and more. Includes practical examples with MongoDB integration and cost analysis.",[272,166,177,273],"openai","mongodb","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6abad0fa45201648bfd46c2d-0-2e60b732.png","2024-11-23T00:00:00Z","2026-09-28T22:31:01.385Z",3,{"slug":279,"title":280,"type":24,"summary":281,"tags":282,"author":14,"cover_url":284,"published_at":285,"updated_at":286,"reading_minutes":287},"check-pricing-availability-ing-domains","Last Chance to Grab Short .ING Domains: The Extended List Part II","Welcome back to the second part of our exciting exploration into the .ING domain zone! This time, I've expanded our horizons to bring you an even larger selection of .ING domain names. List of over 24,000 domain names inside.",[162,283],"business","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6abad0fa45201648bfd46c38-0-c55f4c8d.png","2023-12-14T00:00:00Z","2026-09-28T22:31:01.453Z",1,{"slug":289,"title":290,"type":24,"summary":291,"tags":292,"author":14,"cover_url":293,"published_at":294,"updated_at":295,"reading_minutes":296},"impressive-ing-domains","Unveiling the Impressive .ING Domains","Discover the vast potential of the new .ING domain zone in my latest blog post! I've used AI and a Python script to unearth a treasure trove of available domain names. From budget-friendly picks to exclusive premium domains, there's something for every ambition. Plus, a special list of unique, lesser-known domains awaits.",[162,283],"https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6abad0fa45201648bfd46c43-0-03be24b7.png","2023-12-11T00:00:00Z","2026-09-28T22:31:01.527Z",2,{"slug":298,"title":299,"type":24,"summary":300,"tags":301,"author":14,"cover_url":303,"published_at":304,"updated_at":305,"reading_minutes":277},"secured-web-server-in-5-minutes","Fortify Web Server Security in 5 Minutes with Tailscale","Tailscale revolutionizes secure networking with its user-friendly approach, effortlessly connecting devices across diverse networks.",[53,152,302],"webserver","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6abad0fa45201648bfd46c4e-0-eae6f62d.png","2023-11-03T00:00:00Z","2026-09-28T22:31:01.597Z",{"slug":307,"title":308,"type":24,"summary":309,"tags":310,"author":14,"cover_url":313,"published_at":314,"updated_at":315,"reading_minutes":19},"lets-encrypt-free-ssl","How to Secure Your Website with Free SSL Certificates for a Lifetime","Let’s Encrypt certificates have revolutionized internet security by providing free, automated, and widely trusted SSL\u002FTLS certificates. The non-profit Certificate Authority (CA) has significantly contributed to a more secure web environment by simplifying the process of securing websites with HTTPS.",[311,312,302],"ssl","https","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6abad0fa45201648bfd46c59-0-bf2a9a0a.png","2023-11-01T00:00:00Z","2026-09-28T22:39:13.555Z"]