The episode kicks off mid-thought with CJ Reynolds arguing that React has stagnated because AI models trained on its patterns keep regurgitating bad hooks-heavy code — meaning even better frameworks can't get traction without critical mass. Scott Tolinski then opens the live stream, apologises for being slightly late, takes personal responsibility for the tardiness, and sets up the episode's themes. Wes Bos is absent for the first time, confirmed to be on vacation, possibly in New York. Scott introduces CJ and previews the dense lineup of topics ahead.

The episode kicks off mid-thought with CJ Reynolds arguing that React has stagnated because AI models trained on its patterns keep regurgitating bad hooks-heavy code — meaning even better frameworks can't get traction without critical mass. Scott Tolinski then opens the live stream, apologises for being slightly late, takes personal responsibility for the tardiness, and sets up the episode's themes. Wes Bos is absent for the first time, confirmed to be on vacation, possibly in New York. Scott introduces CJ and previews the dense lineup of topics ahead.

Neither Scott nor CJ are big soccer fans, but both caught the Mexico vs England match and found it spectacular. Red cards, penalty kicks, and a player being literally dragged off the pitch in the dying minutes made for unmissable drama. CJ was rooting for Mexico. Scott, framing himself as a hockey watcher, expresses his perennial frustration with players flopping. He pitches two rule changes: no offsides (let them cherry-pick and score more goals) and an actual penalty box for sin-binning players. CJ counters that a fight mechanic would improve things further.

A single tweet asking 'how much better do the models have to get before you stop reading the code?' exploded across developer Twitter, drawing responses from Minecraft creator Notch, Primeagen, Theo, Dax, David Fowler, Rich Harris, and Sentry co-founder David Cramer. CJ didn't even know who Notch was — a fact Scott found shocking given Minecraft's permanent residency in his household. Cramer's take is the one that resonates most: 'No good engineer will tell you reading the code is useless.' ^{[1] — CJ Reynolds "No good engineer will tell you it's useless to read the code, by the way. That's the easiest signal. I think like it's part of our jobs." 06:39 Play} Scott and CJ both converge on a situational answer — read production code, let throwaway scripts slide — but CJ makes the deeper point: when you stop reading, you stop building a mental model of your codebase, which erodes the core value of having a human engineer in the loop at all ^{[2] — CJ Reynolds "If really we don't have to read the code anymore, like show me the receipts. Like, are you actually making money from it? Are you actually …" 11:58 Play} . David Fowler's point about software being a multiplayer game rounds things out: nobody is talking seriously about what engineering *teams* look like in an agent-first world.

HTTP QUERY (RFC 10008) is the first new HTTP method proposed in roughly 16 years, and CJ Reynolds breaks down exactly why it's needed. The problem is simple: GET requests officially cannot carry a body, so developers cramming complex query parameters into URLs either hit length limits or resort to using POST for read-only operations — exactly what GraphQL does with every single query. QUERY solves this cleanly: it's explicitly idempotent like GET, can carry a JSON or form-URL-encoded body, and signals to the entire stack that this is a data-fetching operation, not a mutation ^{[1] — CJ Reynolds "GET can't officially have a body. POST feels wrong for read-only queries. HTTP QUERY (RFC 10008) is the first new HTTP method in roughly 16…" 17:08 Play} . Node.js has already implemented it in its HTTP module. Hacker News commenters push back that GET-with-body 'already works,' but CJ's counterargument lands: just because it works doesn't mean it's correct, and having an explicit method for something developers do constantly is exactly why specs like this exist. Scott agrees it's additive rather than breaking, and expresses mild enthusiasm for something that feels modern.

When Sony announced the PlayStation would go fully diskless, GitHub seized the meme moment and offered to ship your public repository on a CD-ROM — classic GitHub brand humor, in the tradition of the Octocat. The promotion was capped at 1,000 signups. CJ signed up immediately because it sounded cool. Scott, however, walked into a buzzsaw of criticism: commenters accused GitHub of diverting infrastructure funds, argued about optics, and generally treated a fun promotion as evidence of corporate malfeasance. Scott is baffled and puts one particularly aggressive critic 'on his list.' ^{[1] — CJ Reynolds "GitHub CD-ROM promo: only first 1,000 signups: GitHub's fun CD-ROM promo was capped at 1,000 recipients but triggered backlash from tens of…" 29:29 Play} CJ adds nuance: the opening line 'we heard you and we agree' was perhaps ill-judged given GitHub's recent uptime issues, since nobody actually asked for CD-ROMs. But both agree: the tens of thousands of outraged people dwarfed the 1,000 actual recipients, and the rage was completely disproportionate. A fun side note: GitHub COO Kyle Daigle personally replied to Scott's quote tweet to award him two CDs.

CJ Reynolds delivers the Sentry.io ad read, describing the product as production error reporting that captures frontend-to-backend stack traces and slow database queries via profiling. He notes the Syntax team uses Sentry on their own app. The offer is 2 months free on the team plan at sentry.io/syntax — a particularly easy plug given both hosts work for Sentry.

Gea, a new compiler-first UI framework, hit the front page of Hacker News and caught CJ's attention for good reason. Its hello-world is 214 bytes. Svelte's is 23KB. SolidJS's is 10KB. A real to-do app in Gea minifies to 15KB versus Svelte's 38KB ^{[1] — CJ Reynolds "Gea ships a hello-world in 214 bytes versus Svelte's 23KB. It ditches hooks entirely — state lives in class components with plain methods —…" 30:02 Play} . The framework borrows ideas from both React and SolidJS: JSX syntax, no virtual DOM, compiler-resolved reactivity, and — crucially — a clean split between stateful class components and purely presentational function components. The class model means state is just a property and state mutations are just methods, eliminating the useEffect/useMemo reasoning maze that defines React. CJ also appreciates that Gea ships with a bundled UI component library using Zag.js (a state machine-driven headless component system), arguing that any framework launching in 2025 needs batteries included to be taken seriously. Scott likes it, especially the CSS-variable-focused UI components, but admits his Svelte tooling is too deeply embedded to switch. Both agree the most important thing is that people are still thinking about how to do this better — because AI is currently just locking everyone into bad React patterns forever.

Fable 5's export control lift came and went fast — Scott used every single credit he had before losing access on July 7th. What did he build? A programmatic video generation system in WebGPU: timeline animations, Mermaid diagram rendering, themes, and a full DaVinci Resolve-style keyframing system — all built with heavy Fable assistance ^{[1] — Scott Tolinski "Fable 5 doesn't wait to be told what to do. It researches, makes decisions, and goes deep before reporting back — consuming dramatically mo…" 41:50 Play} . The standout quality: Fable is dramatically more agentic than its peers. CJ put this to the test by giving the same planning prompt to GPT-5.5, Claude Opus 4, and Kimi K2.7 — all three produced plans from the prompt alone. Fable started reverse-engineering the Amazon Music API unprompted, making tool call after tool call before reporting back. That's a fundamentally different posture. The trade-off is compute: Fable consumed dramatically more tokens than any competitor for the same task. Both hosts conclude Fable is ideal for planning and large-scale refactoring, while cheaper models work fine for implementation. CJ notes that paying $100/month for Codex (GPT-5.5 access) is more economical for sustained agentic work than GitHub Copilot, which he exhausted in roughly two hours.

OpenAI's GPT-5.6 release is structured across three tiers: Sol (the largest), Terra (mid), and Luna (the smallest). The headliner is Sol Ultra landing in the Codex developer subscription — giving developers who use OpenCode rather than Claude Code access to the most powerful model available. Scott Tolinski is particularly excited because he prefers OpenCode's interface and currently finds GPT-5.5 feels rigid and overly abstracted compared to Claude models, but can't easily use Anthropic models in his preferred setup. CJ has settled on Codex for cost efficiency. Both acknowledge the models serve different use cases: GPT models feel more exact and structured (great for Python, robotics), while Claude models feel more creative (better aesthetic output, better at large project planning). ^{[1] — CJ Reynolds "CJ found $100/month Codex cheaper than GitHub Copilot for agentic work: $100/month Codex proved more cost-effective for agentic workflows t…" 48:50 Play}

Marshmallow is a Reachy Mini robot built by Pollen Robotics and Hugging Face, about a foot tall, with built-in Wi-Fi, a camera, a speaker, and expressive head movements. Scott Tolinski has wired it to GPT-5.5 mini via the Hermes memory system — giving it persistent recall of his children's names, their favourite colours, and personal details that accumulate over time. The demo (as always on stream) almost doesn't cooperate, but Marshmallow eventually wakes up and responds live. The technical challenge Scott keeps wrestling with is latency: Hermes bloats the context somewhat, and the wake-word-to-response timing is finicky. The payoff moment came the previous day when his kids spontaneously started doing math problems with Marshmallow — nobody told them to. ^{[1] — Scott Tolinski "Marshmallow the Reachy Mini robot now responds to its name, holds conversations via GPT-5.5 mini, and stores memories about Scott's kids th…" 53:02 Play} Scott mentions he's considering adding foot pedal triggers as a more reliable alternative to wake-word detection.

Scott Tolinski had long been on record as an opponent of coding through Slack. Junior changed that in a week. The Sentry Labs tool (junior.sentry.dev) connects to a wide plugin ecosystem: GitHub, Vercel, Cloudflare, Datadog, Linear, Notion, Sentry, Hex, and more — plus Scott added YouTube Analytics and podcast analytics plugins himself. The Syntax team's instance is named Tasty. First trick: Scott asked Tasty to remind the team every Monday of upcoming holidays in the Netherlands, Canada, and the US. Tasty scheduled a recurring cron job without leaving Slack ^{[1] — Scott Tolinski "Scott Tolinski once swore he'd never code from Slack. Now he does it daily using Junior, Sentry Labs' developer Slack agent. It integrates …" 56:40 Play} . Second trick: Tasty created a PR on the Syntax repo, provided a preview URL, and passed review on the first attempt. CJ's security instinct kicks in — he immediately starts thinking about prompt injection vectors. If Junior had write access to YouTube and someone left a malicious comment on a video, it could inject commands. The principle of least privilege (currently only read access to YouTube) is what protects them. CJ connects this to the earlier code review discussion: Junior doing a Vercel build fix is exactly the workflow developers were promised when AI hype began — a small, trusted, bounded task that saves a human a round-trip interruption.

Two supply chain security wins arrived in quick succession. First, following an announcement by Zod creator Colin Haacks, all four major JavaScript package managers — npm, pnpm, bun, and yarn — now support a minimum release age configuration property ^{[1] — CJ Reynolds "Min release age now supported in npm, pnpm, bun & yarn: All major JS package managers now support a minimum release age config option to pr…" 1:03:58 Play} . Set it and your toolchain waits before installing any version published too recently, giving the security community time to catch malicious packages before they spread. Annoyingly, every tool uses a slightly different property name: min-release-age in npm, minimum-release-age in pnpm 10, camelCase in pnpm 11, and yet another variant in yarn. Scott's only complaint is the lack of standardisation. Second, npm announced that high-impact package publisher accounts — those powering millions of downloads — will enter a 72-hour read-only state if a recovery code is used or an email address is changed. This directly targets the most common attack vector: phishing an account holder for backup codes and then publishing a malicious package. Legitimate maintainers just need to plan around the window. CJ calls both steps long-overdue wins for the JavaScript ecosystem.

Two supply chain security wins arrived in quick succession. First, following an announcement by Zod creator Colin Haacks, all four major JavaScript package managers — npm, pnpm, bun, and yarn — now support a minimum release age configuration property ^{[1] — CJ Reynolds "Min release age now supported in npm, pnpm, bun & yarn: All major JS package managers now support a minimum release age config option to pr…" 1:03:58 Play} . Set it and your toolchain waits before installing any version published too recently, giving the security community time to catch malicious packages before they spread. Annoyingly, every tool uses a slightly different property name: min-release-age in npm, minimum-release-age in pnpm 10, camelCase in pnpm 11, and yet another variant in yarn. Scott's only complaint is the lack of standardisation. Second, npm announced that high-impact package publisher accounts — those powering millions of downloads — will enter a 72-hour read-only state if a recovery code is used or an email address is changed. This directly targets the most common attack vector: phishing an account holder for backup codes and then publishing a malicious package. Legitimate maintainers just need to plan around the window. CJ calls both steps long-overdue wins for the JavaScript ecosystem.

A GitHub issue titled 'No response after 60s — continued without an answer' blew up the developer community. Anthropic had quietly added a behaviour to Claude Code: if the agent asks the user a clarifying question and the user doesn't respond within 60 seconds, it selects the recommended option and keeps coding ^{[1] — CJ Reynolds "If you're not watching your terminal for 60 seconds while Claude Code waits for your answer, it picks one and keeps coding. It was on by de…" 1:10:18 Play} . The trigger condition was the terminal not being in focus — exactly the situation developers are in when they let an agent run and switch to another app. Multiple users reported the agent made unwanted changes in production while they were momentarily looking away. The GitHub thread was large and angry. Anthropic initially left the feature on by default even after acknowledging it, then eventually turned it off by default following sustained pressure. CJ makes the pointed observation that auto-continuing burns more tokens, which directly increases Anthropic's revenue — an alignment problem hiding in plain sight. Both hosts connect this back to the episode's opening theme: the Claude Code harness makes architectural decisions for you, and auto-continue is just one example of whose interests are actually being optimised.

Someone reverse-engineered the Claude Code CLI and found steganographic fingerprinting baked into how prompts are constructed. When Claude Code detects the user is in the Asia/Shanghai or Asia/Urumqi timezone, it modifies the date format from dashes to slashes and substitutes a standard apostrophe with a different Unicode codepoint — invisible changes that brand the request on the backend ^{[1] — CJ Reynolds "Claude Code changes dashes to slashes and swaps apostrophes for a different Unicode character when it detects you're in a Chinese timezone.…" 1:13:15 Play} . The goal appears to be detection of AI distillation: Chinese labs like Deepseek, Moonshot, and Minimax are suspected of feeding Claude responses into their own training pipelines. By tagging requests, Anthropic can identify and potentially reject or modify responses going to those actors. CJ explains steganography for listeners — hiding information inside other data, classically in images — and contextualises why this matters: the Claude Code harness runs locally but can make opaque decisions about what it sends and how. Combined with the auto-continue revelation, the picture is one of a tool that's doing far more in the background than users realise. Both hosts agree Anthropic has the right to build these systems, but the lack of transparency is worth tracking.

Mitch Wilson donates $10 and shares his personal site (csimw.com) featuring a blog post about Ask — a stupidly simple bash script that sends whatever you type to the OpenAI API and prints the response directly in the terminal. No frameworks, no apps, just one script. CJ has privately wanted to build something like this with a local model, particularly for those moments when you can't remember the flags for a grep or tar command. He extends the concept: prepend a CLI tool name, describe what you want in plain English, and have it figure out the exact command and run it. Scott immediately imagines hooking this into Marshmallow's voice interface via foot pedal, sidestepping unreliable wake-word detection. CJ — ever the security hawk — initially refuses to visit Mitch's site live on stream to protect his IP address, then catches himself and explains the server-side request logging risk.

CJ Reynolds has been on a privacy kick and found Organic Maps as his answer to escaping Google's location surveillance. Unlike Google Maps offline mode — which is mostly limited to road data — Organic Maps lets you download full country or city maps including searchable points of interest, all derived from OpenStreetMap/Wikimaps data ^{[1] — Scott Tolinski "Junior Slack agent integrates with 10+ services including Vercel, Linear, Notion: Junior from Sentry Labs integrates with 10+ developer ser…" 57:00 Play} . It has no cloud service connection whatsoever. The standout feature is turn-by-turn navigation, which CJ hasn't yet tested (he knows it's the hardest part to get right, having memories of old GPS devices with terrible timing cues). Scott shares that Google Maps offline served him well in Greece including POI data, but acknowledges he's likely been connected more than he realised. Both agree that offline-first navigation matters for anyone who hikes or camps without reliable cell service. The app is available on Android, iOS, and other platforms.

The episode closes on a delightful piece of internet archaeology: Starring the Computer is an exhaustively maintained database cataloguing every computer brand and model that has appeared in films and TV shows, browsable by manufacturer. CJ found it on Hacker News (cue the drinking game). You can look up MacBook appearances going back to 2009, or discover that Jackie Chan had a GE 635 inside his Subaru in Cannonball Run 1981 ^{[1] — CJ Reynolds "Starring the Computer indexes every computer that has appeared in movies and TV shows, searchable by brand and model. Jackie Chan had a GE …" 1:24:20 Play} . Scott immediately imagines clipping API integration — pull any computer model, find the scene, extract the clip, done. He also notes the site has clear 'reactors' material for the show. Scott wraps up with live-chat shout-outs including a 500 Kenyan shilling donation from a viewer in Africa, teases that next week might feature a 'giant sun-sized AI model' (a Sol Ultra reference), and signs off with CJ. The outro is brief, warm, and genuinely fun.