Main Branch: The One Where the Screenshot Ships With the Bug 📎 - Issue #39

Leer en Español • 阅读中文版

Hiya friends,

It's been a busy week for AI. Whether we like it or not, the genie's not going back in the bottle. News of these models is like Thanos: inevitable. This week's additions: Claude Fable 5.1, GPT-6 Astra, Gemini 3.8 Flash, Meta's Muse Spark 1.3, and Qwen's open-weight Qwen3.8. And the companies working to enable developers to use those models are also in the rat race. GitHub announced Project HydraFusion, a research preview in Copilot CLI. IMO the premise here is that the model is not going to matter so much, as there will always be a new model. It's more about the way the model is orchestrated by a coding harness or something else, and how the planning, the tool calls, and the execution matter more.

I've been testing it with some experiments for a few days. Of course this is my experience and not an official GitHub analysis; as far as the orchestration approach goes, it is phenomenal. It does help make a clearer path for resolving issues. As far as cost, I'm not too convinced that is a major improvement, but I haven't run a deeper analysis on what the token consumption really looks like. Let me know if you try it.

You can now attach images and small videos to issues, PRs, and comments right from gh. Pass the local path, and you can also pass alt text for accessibility. Available on all plans with gh 2.99.0, but you need write access, and it hasn't landed on GitHub Enterprise Server yet. Size limits match github.com.

When you're writing descriptions, especially when working with agents and describing errors, that basically costs twice the spend if you're using tokens for this. You pay once to write it, again for the agent to review. Vision tokens aren't free either, but the accuracy improves and it kills the subsequent clarification rounds. Some things are better shown than said.

One npm package can now hold several OIDC (OpenID Connect) configurations, up to ten. Each configuration can have its own repository, own workflow, and environment. Stable and prerelease no longer share a single binding or rely on a long-lived token. New configurations all start as stage-only, but you can set each one up for a direct npm publish. When you stage the packages, they stay behind an approval button, and they are not going to publish until the malware scan finishes. The versions tab now shows whether the packages are approved, rejected, or still staged.

It's been a horrific year for npm worms. Long-lived tokens got phished and wormed (Shai-Hulud and friends). Then we moved to trusted publishing with short-lived OIDC, but that wasn't enough either. Mini Shai-Hulud managed to poison the runner, scrape the OIDC token, and still publish with valid provenance. Scoping the configs and adding human stage approval after the scan won't fix everything, but it shrinks the blast radius.

Connecting every app to every other app by Steve Krouse (Val Town)

Zapier has been the one-plug-fits-all for platforms, especially for one-click authentication. Krouse's article is promoting his own product, but it also lays out a clean problem: registering an OAuth client for every single destination. With MCP now, Dynamic Client Registration lets clients provision themselves, and Client ID Metadata Documents go further by hosting client metadata at a URL and skipping the portal altogether. He's built a remix of 3,000+ connectors without collecting a single client ID by hand. Challenges remain, but this might unlock MCP without the REST API most dashboards need.

Worth your time if: you're wiring agents to tools, or you're sick and tired of creating another OAuth app form.

This week I changed the plumbing behind Main Branch's subscribe button. I replaced my old signup integration with a Cloudflare Worker that basically just calls the Beehiiv API. Beehiiv is the newsletter platform I'm using for now. I will be migrating from there soon.

That was a small job, and it stayed a small job because Cloudflare Wrangler is so good, and Cloudflare is just absolutely cracked. I gave them a shout-out on Twitter on a post that went a little bit viral.

I've been writing and thinking a lot about setting guardrails in automation, and this is one way that I can do this. I had this nagging feeling that I was missing subscribers because of that handshake between my previous form, my website, and the Beehiiv API. Now I'm sure that I'm not, because I have a dedicated piece of code I can inspect and maintain. And if you're connecting a static website to an API that needs a secret, Cloudflare makes this easy, because you don't need to build a whole backend for that one endpoint.

I'll be busy on my Universe talk outline. I've been attending for years, but this is my first as a speaker 🎉.

If you're in the Bay Area or can get yourself there, I’m running a ticket giveaway for GitHub: gh.io/win. LOVE for one of my favorite folks to win it. I hope you enter, and that you're having a good start to September.

With gratitude,

I'll see you next week,

Andrea