Back in ye olde '17 to '18, when rumors of these large language models were filling the halls, a co-worker pulled me over to show me an early model. He got my attention with the claim that "...soon everyone will have a tutor!".

A BOLD claim, indeed!

I scurried to his desk excited and watched him paste in the most convoluted cli call I had ever seen. He hit enter, and after what felt like an awkward eternity, the response came back … and of course exhibiting that classic llm artifact where the model just repeats the same sentence over and over. His terminal filled up quickly and he had to ctrl+c out.

"I'm not sure what happened, it just worked before! WTH?"

I of course gave him some corporate words of assurance, but I quipped privately to myself: a personal tutor for everyone?! I'll believe it when I see it!

Alas, here we are…

That moment now feels like a fitting metaphor for where we are with rsi and intelligence. Regardless of someone's personal p(rsi) or exact timeline, it's clearly going to become reality soon, and it will impact all of our work and how we individually provide value to society and our community. Even with how unhelpful current models can still be at times :-).

However, I'm not really sure anyone can really guarantee anything of real substance about whether it will be good, bad, or what the effects will look like, even if their own efforts are pointed in a certain direction. I think the best we can do is to honestly point to the trend line itself, and that's about it?

For me, I think this is at the heart of why I find it quite unnerving.

• Claude Code has a lot of confusing options if you want to use cloud agents. --remote, --teleport, others?!
• You probably want just plain "Claude Code on the web" using their sandbox.
• The "Claude Code on the web" sandbox needs configuring.
• The same sandbox backs Claude on the web, the mobile app, and /ultraplan / /ultrareview runs from the CLI. Configure once, covered everywhere on any sandbox.
• Coding agents should check their own work using your real toolchain (type checker, linter, compiler), at the specific versions your team runs. Without that you may not be able to reproduce bugs or cause easily avoidable PR check failures, or even subject your code to supply chain attacks.

Probably wise words. Alas we proceed:

Ok, forget about claude --remote or claude --teleport or w/e shenanigans. I am calling it now, just invest the time for you and your team to set up your repo for a generic sandbox environment. Thank me later.

Anthropic generously right now provides a Ubuntu 24.04 box running as root with ~4 vCPUs, 16 GB RAM, and 30 GB disk and the price is ~right~ (free for now).

If you follow these steps you should get yourself a hermetic, reproducible sandbox environment that you can take anywhere, and I claim, on any harness.

Ok, hopefully I have you convinced, if yes and if you'd rather just hand this to a coding agent, jump to Hand this to your agent.

There is a problem though: the sandbox created by Claude Code will very likely not have the exact environment for your project.

Why bother?

If you need convincing: if you instructed your agent to actually use your project's type checker, linter, and compiler to verify its own work (run tests?), then these should mirror your local versions exactly. Pin the exact Python runtime you currently use. i.e. 3.12.12, not "3.12"; pin your linter and type checker to whatever your team runs. If the agent's runtime drifts from yours, bugs that depend on patch behavior won't reproduce. On the other hand, package managers like uv are the exception (unless you're building a docker image): those you want at the latest stable release.

I set this up for my python-based project, and there are a handful of non-obvious things that will make you scratch your head. This is the guide I wish existed:

The strategy

You'll need 3 things: an environment startup script, a SessionStart CC hook and a small script you paste into the environment:

1. Checked in cloud setup script (the textbox; references a script in your repo). Cached for ~7 days. Use it for what your current dev env already has — system libs, exact language runtimes, package managers, LSP server binaries, etc.
2. SessionStart hook (committed to .claude/settings.json). Runs every session startup/resume on cloud and local. Use it for project deps that move with the codebase — uv sync, npm install, etc.

For python, Warning: If you bake uv sync into the cached setup script and your cloud sessions keep resuming against the snapshot for a week while teammates bump uv.lock on main. Also: the hook running locally means the agent never starts on stale deps when you switch git branches.

Run /web-setup (if your admin enabled it)

If you haven't already, run /web-setup to share your local GH cli token w/ Claude :yikes_emoji or better yet install the Anthropic app in your GitHub repo or org.

SessionStart hook vs setup script

Anthropic's table covers the details. But the tl;dr is

• If my dev environment already has it, use the setup script to install the exact version.
• If it changes when teammates bump lockfiles, or other shenanigans, tell Claude to write you a SessionStart hook.

So the setup script gets apt, uv itself, mise, pinned runtimes (uv python install / mise install), and any LSP server binaries you build from source. Hook gets uv sync, mix deps.get, npm install. The hook also runs locally, so make it fast on no-op — these three commands all are by default, but if you bolt on mix compile or a slow build step, gate it behind a stamp file or your laptop will pay the cost on every claude startup.

The setup script

The "Update cloud environment" dialog with Name, Network access, Environment variables, and Setup script fields You might feel the urge to paste your script straight into this textbox. Don't!

The docs hint that environment configs and scripts can be visible to anyone who can edit that environment. This might be an unreleased feature since I haven't been able to share them on either my Team or personal Max account, and the env isn't even linked to a specific GitHub repo, so each engineer ends up re-deriving the same setup from scratch.

The trick: the repo gets cloned first, then the setup script runs from the repo root, and only then does Claude Code launch. So you can keep your script in the repo, reference it from the textbox, and let it double as a local onboarding script for new engineers.

Put this in scripts/onboard.sh (toolchain only — no uv sync etc., that goes in the hook):

#!/usr/bin/env bash
set -euo pipefail

REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
cd "$REPO_ROOT"

# Drop pre-installed Launchpad PPAs that 403 in the sandbox.
rm -f /etc/apt/sources.list.d/deadsnakes*.list \
      /etc/apt/sources.list.d/ondrej*.list 2>/dev/null || true

# Install or upgrade uv. The pre-installed version tends to lag.
if ! command -v uv >/dev/null 2>&1; then
  curl -LsSf https://astral.sh/uv/install.sh | sh
  export PATH="$HOME/.local/bin:$PATH"
else
  uv self update --quiet || true
fi

uv python install   # reads .python-version, pins exactly

Then, in the setup script textbox, paste:

bash "$(find /home /root -maxdepth 4 -name "onboard.sh" 2>/dev/null | head -1)"

The form above isn't project-specific: anyone on your team can use the same one-liner, every repo just needs an onboard.sh. Multi-repo sessions work too; find returns the first match (only that one runs).

(Hint to the Claude Code team: these env configs really ought to be shareable at the org level. No good reason every engineer has to hand-paste the same setup textbox.)

Project deps go in a SessionStart hook. Drop this into .claude/settings.json:

{
  "hooks": {
    "SessionStart": [{
      "matcher": "startup|resume",
      "hooks": [{
        "type": "command",
        "command": "uv sync --all-groups"
      }]
    }]
  }
}

For multi-runtime projects, point the hook at a scripts/dev-setup.sh instead and put your uv sync && mix deps.get && npm install in there — easier to read, easier to test locally.

A few smaller things

• The default Trusted network preset covers what you need (npm, PyPI, Docker Hub, GitHub releases, Ubuntu archives). Leave it.
• Tools shipping their own CA bundles trip on the TLS proxy. We hit this with Erlang/Hex; the fix is SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt and HEX_CACERTS_PATH=/etc/ssl/certs/ca-certificates.crt in the env vars box.
• rm -f the deadsnakes and ondrej PPAs from /etc/apt/sources.list.d/ in your onboard.sh before apt-get update. Those specific PPAs 403 in the sandbox even though Launchpad itself is in the Trusted allowlist; uv python install covers what deadsnakes would have given you anyway.
• The env vars box is plaintext. No secrets. Fine for things like LANG=en_US.UTF-8 (sandboxes sometimes start with latin1, which breaks tools expecting UTF-8).
• gh is not pre-installed (the docs say so, though I'd swear I've seen it on the image at some point). Add apt install -y gh to your onboard.sh if you need it, and set GH_TOKEN in the env vars box for authenticated calls. For public release assets, plain curl skips the install entirely.

LSPs

Claude Code can use language servers in remote sessions, but only if every eng has them installed or they're declared in .claude/settings.json checked into your repo.

For pyright (CC's official Python LSP):

{
  "enabledPlugins": {
    "python-lsp@claude-plugins-official": true
  }
}

For ty (Astral's type checker, faster than pyright on large codebases): ty ships through the Astral marketplace, which isn't registered by default:

{
  "extraKnownMarketplaces": {
    "astral-sh": {
      "source": {
        "source": "github",
        "repo": "astral-sh/claude-code-plugins"
      },
      "autoUpdate": true
    }
  },
  "enabledPlugins": {
    "astral@astral-sh": true
  }
}

For both LSPs you still need the pyright-langserver or ty dependencies installed first on the local machine/sandbox, hence to ensure you have the script correct.

Honesty note: I've confirmed this pattern works in remote sessions for Python, TypeScript and Elixir LSPs but haven't verified others. Spot-check before relying on it.

Hand this to your agent

<task>
Configure this repository to work cleanly with Claude Code on the web by creating a toolchain onboarding script, a project-hydration SessionStart hook, and an LSP configuration. Output the exact one-liner the user should paste into the Claude Code on the web "Setup script" textbox.
</task>

<context>
Claude Code on the web runs in an Ubuntu 24.04 sandbox. Setup scripts run as root, and the repo lands at $HOME/{repo-name}. Outbound traffic goes through a TLS-inspecting proxy. The setup script runs from the repo root, before Claude Code launches, and its filesystem result is snapshotted and reused for ~7 days — so it's the right home for heavy toolchain installs. SessionStart hooks (declared in .claude/settings.json) fire on every session startup/resume in cloud AND local, so they're the right home for project hydration that needs to track lockfile changes (uv sync, mix deps.get, npm install).
</context>

<steps>
1. Detect the project's languages and package managers by inspecting files at the repo root (.python-version, pyproject.toml, package.json, mix.exs, Cargo.toml, go.mod, etc.). State what you found before proceeding.

2. Create scripts/onboard.sh — TOOLCHAIN ONLY, no project hydration:
   - Shebang: #!/usr/bin/env bash
   - set -euo pipefail
   - Resolve REPO_ROOT from BASH_SOURCE[0] and cd into it.
   - Remove pre-installed Launchpad PPAs (deadsnakes, ondrej) from /etc/apt/sources.list.d/ before any apt-get call. Use 2>/dev/null || true so missing files don't abort.
   - Install or upgrade each *package manager* (uv, mise, nvm, etc.). Check for existing installation first; if present, run the tool's self-update with || true to swallow network errors.
   - Install each *runtime* (Python, Node, Elixir, etc.) at the exact version pinned by the project. Read pin files like .python-version, .tool-versions, .nvmrc, package.json's "engines". Do not install "latest" unless the project has no pin at all.
   - DO NOT include uv sync / mix deps.get / npm install / mix compile here — those go in the SessionStart hook in step 5.
   - Make every step idempotent.

3. If the project uses Erlang or Elixir, add these exports after the cd and before anything that fetches Hex packages:
   export SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt
   export HEX_CACERTS_PATH=/etc/ssl/certs/ca-certificates.crt
   These point Erlang's TLS layer at the system CA bundle, which trusts the sandbox's TLS proxy.

4. chmod +x scripts/onboard.sh.

5. Create or update .claude/settings.json with:
   - The LSP plugin(s) for the project's languages (python-lsp@claude-plugins-official for pyright, astral@astral-sh for ty — register the astral-sh marketplace under extraKnownMarketplaces — and analogues for other languages).
   - A hooks.SessionStart entry with matcher "startup|resume", running the project's hydration commands. Inline the command if it's a single line (e.g., uv sync --all-groups); for multi-runtime projects create scripts/dev-setup.sh that calls uv sync, mix deps.get, npm install in sequence and have the hook invoke that. Hook commands fire on every claude startup — keep them fast on no-op (uv sync, npm install, and mix deps.get all are by default).

6. Run scripts/onboard.sh, then run the hydration command from the hook, both locally. Verify both exit 0. If either fails, fix and re-run until they succeed.

7. Commit scripts/onboard.sh, .claude/settings.json, and any new hydration script.

8. Print a summary with three sections:
   - Detected toolchain
   - Paths of files created or modified
   - The exact one-liner the user should paste into the Claude Code on the web "Setup script" textbox: bash "$(find /home /root -maxdepth 4 -name "onboard.sh" 2>/dev/null | head -1)"
</steps>

<constraints>
- Do not paste script contents into the textbox. Reference scripts/onboard.sh by path so it lives in version control and BASH_SOURCE[0] resolves correctly.
- Do not hardcode the repo name or $HOME into the textbox content. Use a `find`-based lookup so the one-liner stays portable across repos.
- Do not assume gh is authenticated. Use curl for public release downloads. For authenticated calls, instruct the user to set GH_TOKEN as an environment variable in the cloud environment.
- For Python versions, use uv python install rather than the deadsnakes PPA. The deadsnakes/ondrej PPA hosts return 403 in the sandbox even though Launchpad itself is in the Trusted allowlist.
- Always install the exact runtime version the project pins (.python-version, .tool-versions, .nvmrc, etc.). The agent and the team must run the same patch version for bug reports to reproduce.
- Project hydration commands (uv sync, mix deps.get, npm install) MUST go in the SessionStart hook, not in scripts/onboard.sh. The setup script is cloud-only and cached for ~7 days; baking hydration into it leaves resumed cloud sessions running against stale deps after teammates bump lockfiles.
</constraints>

Co-written with Claude Opus 4.7.

It was the summer of '07, and this was Fort Polk, Louisiana. It was a hot, humid, horrible feeling to just exist outside! The area has this type of weather where the air has a soupy texture and where it takes twice as many breaths as it should to extract one satisfying inhale.

A few of us were sitting over by a small military shop on-base, waiting to get picked up. We had finished our final training (JRTC) before getting our final deployment orders and were heading to our stationed base in Kentucky.

There were four of us from the same infantry company, sitting on a bench. We had just gotten word of our Area of Operations (AO) for our upcoming fifteen-month combat rotation. It was to be somewhere in Baghdad.

As you might imagine, some of us were feeling nervous, but didn't want to show it for fear of being seen as weak-minded.

I remember they had some benches and soft-serve ice cream. There were only two flavors, vanilla and chocolate, but that was more than enough for me. I remember wolfing it down; I had opted for the cone and it was glorious (still the way I prefer to enjoy my ice cream).

One of the younger sergeants, Sergeant Craig, came over and checked up on us. Craig couldn't have been older than twenty-one, just barely old enough to drink.

However, he and others had already been on multiple combat deployments and we really looked up to him. He was also goofy, and he had this warm, friendly smirk on his face. He was one of those people who didn't take life too seriously; The net effect of being around him was that he made you feel safe.

He must have noticed our nervousness, perhaps even misguided excitement, about deploying. All of this training and we were going to do this for real!

It was pretty obvious that at least some of us might not be coming back. I guess that it was a real possibility, but it wasn't something that I allowed myself to consider.

Craig sized us up and in his own goofy way wanted to lay some words of wisdom.

"Ohh, it's not going to be a big deal. I bet you we will be on a very big base with Burger King and all of that," he said. He noted that Baghdad seemed a step down from his previous deployment in the area which, at the time, was lovingly known as the Triangle of Death.

"On our last deployment, we had so much free time that I binge-watched shows and played video games most of the time. When we would patrol, we would just drive up and down this road the entire time," he continued.

One of the guys quipped, "Well what if we get blown up or something? Won't that hurt?"

"If it hurts, then you're likely going to make it; otherwise, you're not going to know what fucking hit you!" Craig quipped back.

I guess it all just fades to black.

"Also, when someone dies, it's totally not a big fucking deal. We will line everybody up and do our ceremony thing. We did our military funeral in shorts and flip-flops during our last deployment!" He said this while holding onto his ice cream cone.

I remember us giving each other incredulous looks, but Craig's words resonated. This deployment just might end up not being a big deal.

Craig's description of the deployment was nothing like what I experienced.

For starters, we had no free time. We were not on a large base; we were on a super small base (a COP) where the ~70 or so of us were pulling our own security while doing patrols and raids in between. We were too sleep-deprived and barely had time to play video games or anything of that sort. Most of our meals came in the form of MREs - no Burger King in sight.

If we got lucky, we would get the chance to ferry some captives to the Green Zone, in which case, there was indeed ice cream!

Then, eight months into the deployment, we found ourselves at Craig's funeral.

He had gotten shot in the head. How it happened is a story for another time.

For his funeral, military command decided to make a real dog and pony show out of it. Instead of doing the funeral at our small COP, they dragged our small company out to the main base so that all of the command leadership could attend.

I was told my uniform needed to be clean and crisp, which was a challenge on such short notice given the conditions at our tiny outpost.

It was a traditional military funeral and it was nice, but it was clear from the get-go that there were political undertones. Members of the press were there and so were high-ranking military officers with very little dirt on their uniforms.

As the ceremony was over, we all got into our trucks and headed back to our base.

I asked my Team Sergeant, Jarden, since we were at the main base, if we were going to stop for ice cream on our way back.

He turned slowly at me, "What the fuck is wrong with you, Cocu?! Ice cream at a time like this?! You have got to be fucking kidding me! …There is something wrong with you!"

He hadn't been there when Craig told us his story. There was simply too much to explain. We left and convoyed back to our COP.

It was nighttime by now and I leaned back in the gunner's seat and stared out of the open-air top, looking up at the sky with my night vision goggles on. I expected to spot at least some stars but I couldn't spot any. It must have been overcast.

The truck was silent.

Rest In Peace, Staff Sergeant Clay A. Craig, Sergeant First Class Robert C. Jarden.

Thank you to my wife Mary, friends, and family for encouraging me to write this down, and for the feedback along the way.