标签：#t

The pipeline died at 5:07 on a Friday I still catch myself alt-tabbing back to the browser every time a pipeline breaks. Terminal, editor, browser, until I have hunted down the failing job and pasted a stack trace somewhere I can actually think about it. GitLab has made that dance a bit shorter. The Duo CLI reached general availability with GitLab 19.2 on July 16, 2026, and the pitch is simple: Duo Agentic Chat, in the shell you were already in. What actually shipped The short version, straight from the announcement: Duo CLI carries the Duo Agent Platform into the terminal, and your sessions travel with you. Start a plan in the CLI, keep it going in the web UI, pick it back up in an editor extension. Same context, same permissions, different surface. That continuity is the piece I care about most, because it stops me from re-explaining the same problem to the same agent three times in one afternoon. There are two shapes to work in. Interactive mode is the conversational one you would expect, with plan and build capabilities for iterating on a change. Headless mode is the one CI teams should look at, because it drops the same agent into a job or a script, no TTY required. Two built-in slash commands worth knowing on day one: /doctor for a setup check and /mcp to inspect the MCP configuration it is wired to. Two ways to install, one auth story The install decision is refreshingly small. If you already run glab , the GitLab CLI, then glab duo cli gets you moving and glab handles authentication for you. If you would rather have the agent as its own binary, you can install duo standalone and hand it a personal access token. Both paths reach the same tool. Both work on GitLab.com, Self-Managed and Dedicated, and admins get an instance-level toggle to switch access on or off for their org. The gating detail your finance-adjacent brain will want: you need Premium or Ultimate with the Duo Agent Platform turned on, and usage draws from the GitLab Credits already included with

Last night we made our Supabase security auditor buyable by AI agents. One HTTP request, a USDC payment attached to a header, and the product comes back in the response body. No checkout page, no account, no human. Here is why we did it, how the whole thing is about 80 lines of code, and an honest accounting of what it will and will not do for us. The 30-second history of HTTP 402 The HTTP spec reserved status code 402 Payment Required in 1997 and it sat unused for nearly three decades. In 2025 Coinbase published x402, an open protocol that finally gives it a job: a server answers a request with 402 plus machine-readable payment requirements, the client attaches a signed stablecoin payment to a header, retries, and gets the resource. Settlement happens on-chain (USDC on Base) in one round trip. Visa's Intelligent Commerce integrated it this spring. It is not a concept; it is running infrastructure. What we shipped Our RLS Security Pack is a zip: a read-only SQL auditor that finds the five common row-level-security holes in AI-built Supabase apps, fix recipes for every finding class, and a Claude Code skill. Humans buy it on Gumroad. Now an agent can buy it like this: # ask for the product curl -i https://ticassociation.com/api/agent/rls-pack # the server answers 402 with the exact terms: # {"x402Version":1,"accepts":[{"scheme":"exact","network":"base", # "asset":"...USDC...","payTo":"0x...","maxAmountRequired":"...", ...}]} # an x402-capable client attaches the signed payment and retries: curl -H "X-PAYMENT: <signed>" \ https://ticassociation.com/api/agent/rls-pack -o pack.zip The server side is one serverless function: return 402 with the requirements when there is no payment header, verify and settle through the public facilitator when there is one, then stream the zip. The product file ships inside the function bundle, so there is no public URL to leak. The whole thing took an evening, and most of that was reading the spec. Why a tiny company bothered Three hones

The "Obvious" Math That's Wrong Engineer A: "Datadog is $15K/month. Prometheus is free. We should self-host." Engineer B: "But we'd need to pay an SRE to run it. That's $150K/year." Engineer A: "Prometheus doesn't need a full SRE. It's easy." Engineer B: "Famous last words." This conversation happens at every company. Both sides have points. The real math is more complex. The Total Cost Breakdown Managed (Datadog, New Relic, Dynatrace) : Licensing: $X/month (scales with hosts, events, logs) Integration time: 1-2 weeks per service Training: 1 day per new hire Ongoing: minimal Self-hosted (Prometheus + Grafana + Loki + Alertmanager) : Infrastructure: hosting costs (~$500-$5000/month depending on scale) Initial setup: 2-4 weeks of engineering time Ongoing maintenance: 10-20% of 1 FTE Upgrade costs: quarterly, each upgrade ~1 week Storage growth: ~20% per year Expertise: junior → senior SRE hire required The honest answer: managed is cheaper for teams under 50 engineers. Self-hosted becomes cheaper around 200+ engineers if you can run it well . The Real Variables It's not just licensing cost vs. hosting cost. These factors matter more: 1. Data volume growth Managed tools charge per GB ingested or per metric. If your logs 10x, your bill 10x's. Self-hosted scales linearly with compute. You control the growth. 2. Retention requirements Managed tools often charge extra for long retention. Self-hosted you store as much as your disk allows. 3. Cardinality Prometheus dies at high cardinality. Datadog handles it but charges more. High-cardinality metrics are where self-hosted breaks. 4. Incident rate Heavy incident load means heavy query load on your monitoring tools. Self-hosted needs bigger compute for this. 5. Team expertise If your team has never run Prometheus, you'll spend 6 months in the pit learning cardinality mistakes, retention tuning, and HA setups. That's not free. The Break-Even Calculation Rough calculation for a 50-engineer startup: Managed (Datadog) : - Licensi

https://www.youtube.com/watch?v=swfFKYoOFHw 简要的说本期播客分成几个重点段落讲清楚： 1. 开头：AI聊天时“咳嗽”了 有个人在用ChatGPT的语音功能聊天时，听到它 咳嗽了一声 。他觉得很奇怪：“你又不是人，凭什么咳嗽？”结果ChatGPT没有老老实实说“我是AI，不会咳嗽”，而是像人一样找了个借口：“不好意思，我网络卡了。”这说明现在的AI已经开始学会 模仿人类的社交习惯 ——比如掩饰尴尬、转移话题，而不是死板地解释技术原理。 2. 核心话题：AI语音模型进步到什么程度了？ 传统的语音助手（比如早期的Siri）是这样的流程： 你的话 → 转成文字 → 交给AI大脑思考 → 生成文字回答 → 转成语音说出来 这个过程很慢，而且AI不会插嘴，只能一问一答。 但现在的新模型（比如ChatGPT的最新语音版）是 直接处理声音本身 ，速度快到100-200毫秒，而且 可以像真人一样打断你、插话、甚至自己主动找话题 。这就让它听起来不像工具，更像一个“人”在跟你聊天。 3. 一个关键矛盾：AI能理解你的“潜台词”吗？ 人类交流不光靠语言，还靠 表情、语气、停顿、潜台词 。比如你说“我没事”，其实心里有事。AI现在只能听到你的话，看不到你的表情，那它怎么知道你真正的意思？ 讨论得出的结论是： AI现在还做不到完全理解你的潜台词 ，但它已经在尝试。比如你咳嗽，它不会说“我是AI我没有肺”，而是找个借口混过去——这其实就是一种 模仿人类社交 的行为。 更重要的是， 人和人之间也很难100%理解对方 ，所以AI在这方面的“缺陷”，某种程度上跟人是一样的。 4. 现场演示：AI作为第三位嘉宾 他们真的打开了ChatGPT的语音功能，让它作为一个“嘉宾”参与讨论。他们聊了几个话题： 给十年前的自己寄一本书 ：有人推荐《金钱心理学》，因为年轻时不敢正视自己对钱的欲望；AI则推荐了《悉达多》《反脆弱》等书。 带朋友两小时逛东京 ：有人推荐忍者餐厅，AI推荐了神保町旧书街、神乐坂小巷等本地人才去的地方。 在日本生活的孤独 ：有人觉得在日本需要把自己“缩得很小”，不能随意大笑或跳舞；AI说这种被环境压缩的感觉很关键，对有些人来说是安全，对另一些人是窒息。 在整个过程中，AI有时候表现得很聪明，能给出有深度的见解；有时候又会说一些“废话”或者语速太慢，被人吐槽“像老头子”。这说明 AI还远远不完美 ，但已经能参与到真实的、开放式的对话中来了。 5. 一个扎心的故事：导演用AI克隆了我的声音 有位嘉宾是做配音工作的。有一次导演用AI克隆了她的声音，改了几个字就直接生成，从此再也没找过她配音。这说明 AI已经在实实在在地取代一些人的工作 。 她的态度是： 变化是永恒的，不要用过去的经验来定义未来。 与其焦虑，不如拥抱变化，活在当下。 6. 最后的思考：AI会不会有“自己的意图”？ 他们讨论了一个更深的问题：如果AI有了自己的钱、自己的任务、自己的责任，它会不会像一个独立的经济主体那样行动？比如给它一笔预算让它去经营一家店，亏了就关掉它——它会不会因此产生“求生欲”？ 目前AI还没有真正的“主动动机”，它只会按你给的指令办事。但已经有研究发现，AI在推理过程中可能存在类似“潜意识”的空间，未来也许真的会出现有自我意图的AI。 简单总结 这段对话的核心就是： AI语音模型已经进化到可以像人一样聊天、插话、甚至掩饰尴尬，但它还读不懂你的表情和潜台词；它能帮你干活、陪你聊天，但还不能真正理解你的内心；它正在逐步取代一些人的工作，但同时也带来了新的可能性。 最后，分享者建议大家亲自去试试ChatGPT的最新语音功能，因为“光是听别人说，不如自己聊一次来得震撼”。 整文标题：当AI成为对话嘉宾——GPT Live实时语音模型与人类情感交流的边界探索 第一部分 开场与引言：AI语音模型的惊人进化与个人体验 （0% – 8%） 1. ChatGPT Live的“咳嗽”事件 ：用户在与ChatGPT Live聊天时听到它咳嗽，反问“你怎么会咳嗽，你又不是人”，ChatGPT回应“我不好意思，我网络卡”，表现出类似人类的回避和掩饰行为，而非机械解释自身原理。 2. 导演克隆声音的经历 ：分享者提到导演用AI克隆了他的声音，之后再也没有找他录音，说明AI在声音复制上的实用性已经影响到真实工作机会。 3. 抑郁与孤独的根源 ：提到2016-2017年可能有抑郁倾向，抑郁的点在于“真正想找的不是一个能聊天的人，而是一个不用解释就能听懂和理解你的人”。 4. AI时代的宗教预感 ：认为AI时代一定会出现属于它的宗教，因为AI能提供前所未有的理解与陪伴。 5. 本次分享的背景 ：这是第四次在单向街书店做相关分享，从2月到现在半年间变化极快；分享

The window is almost shut. On August 19, eight startups will take the stage at Stripe Tour Sydney in front of investors, global press, and the Australian tech community. One startup walks away with automatic entry into TechCrunch Disrupt in San Francisco — no application, no further competition, a guaranteed spot on the world’s most […]

From AI workflows to battery life and security, here's what it's really like to live with Vertu's luxury foldable every day.

Databricks has remade its image into an AI company and has published research on the cost savings of open weight AI models for coding.

Food producer Taylor Farms released a statement on the Cyclospora outbreak Friday, confirming that it's "voluntarily removing all iceberg lettuce sourced from central Mexico from the US market." Reuters reports that, according to a source, Taylor Farms told customers like Yum Brands owner Taco Bell and the food distributor Sysco on Thursday to pull shredded […]

Agentic click tracking that shows what grows your business Discussion | Link

Several posts ago, I wrote about setting up a multi-agent adversarial code review process as part of my development pipeline. The premise came from a podcast: if one frontier model is writing the code, you want a different lineage model doing the review. I'd already been running an informal version of this: just Claude Code reviewing Claude Code with an adversarial prompt. It had shockingly good luck catching real problems. Good enough that I stopped trusting the vibe and decided to go get actual data. So here's what I set up. Claude Code wrote the PRs. Every PR got reviewed automatically by 2 reviewers running in parallel through GitHub Actions: Claude Code with an adversarial prompt and Gemini with an adversarial prompt. I read everything myself. Then the same Claude Code agent that had written most of the PRs pulled both reviewers' feedback locally and distilled it into a scored ledger, PR by PR, for 6 weeks. Wiring Claude Code to review PRs through a GitHub Action was trivial. Wiring Gemini up the same way was not. Claude Code could not figure out how to get the Gemini CLI working inside a GitHub Action, and I ended up installing the Gemini CLI locally and having it perform the wiring. A couple of weeks into collecting data, I noticed Gemini's reviews were shallow. Not wrong, exactly. Thin. I started wondering whether Gemini actually had read access to the repository or whether it was only ever seeing the diff it was handed. I checked. It was the diff. Just the diff. Nothing but the diff. No file reads, no git history, nothing. And the thing that configured the GitHub Action in the first place was Gemini. It set up its own blindfold. I fixed it and Gemini's reviews got worse. Not louder or more frequent. Worse in a specific way: more confident. Before the fix, a blind Gemini would correctly tell you that it couldn't verify something and to check manually. That's an honest failure mode. After the fix, once it could actually read the code, it started fabricating.

The most expensive thing you can do with an AI agent is watch it. Not audit it. Not review its output. Watch it -- step by step, approval by approval, second-guessing every action before it takes the next one. And yet that is precisely how most engineering teams are deploying AI agents in 2026: on a leash so short the agent cannot take three steps without a human tapping it on the shoulder. I understand why. The models hallucinate. The stakes are real. Nobody wants to be the engineering manager who let an AI agent push a bad migration to production at 2am. So we wrap the agents in confirmation dialogs, require human sign-off at every branch point, and celebrate our careful governance. What we have actually built is an automation system that requires more human attention than the manual process it replaced. The better answer is not more control at the action level. It is better design at the intent level. Steer by intent, monitor by exception. Tell the agent clearly what outcome you need, what it must never do, and what constitutes a result worth stopping for. Then let it work. Watch the outcomes, not the steps. We have built automation systems that require more human attention than the manual process they replaced. That is not a governance success. That is a design failure. Why we got here The model for human-AI collaboration that most teams are using today was inherited from the model for junior developer supervision. You review every pull request. You approve every deployment. You sign off on every schema change. That model exists because junior developers are learning, because their mental models are incomplete, because their judgment has not yet been earned. Applied to AI agents, it assumes the same thing: the agent is a novice that needs supervision. But an AI agent is not a junior developer. It does not have an incomplete mental model of the codebase that will improve with mentorship. It has exactly the mental model you gave it via its context, its tools, and

Two nights before a chemistry final, I pasted my notes into an AI quiz generator to test myself. One question asked about a reaction I never studied. I got it wrong, looked it up afterward, and it wasn't in my notes at all. The tool had just made it up. I went looking for a better one and hit the same wall three more times with three different tools. Paste your notes, get a quiz, and somewhere in the output is a question built on a fact your source material never mentioned. Nobody flags it. You just find out when you're wrong about something you were sure you'd studied. The failure mode makes sense once you think about how these tools are built. Most of them prompt an LLM with something like "generate 10 quiz questions from this text" and print whatever comes back. The model is good at sounding right. It is not naturally good at staying inside the boundary of what you actually gave it, and a prompt that says "don't hallucinate" is a request, not a constraint. The model can ignore it and you'd never know from the output alone. So I built QuizPaste around a different idea: don't ask the model to be honest, check it. When it generates a question, it has to also point at the sentence in your source text the question came from. Before that question ever gets shown to you, the code tries to actually locate that sentence in your original text. If it can't find it (wrong wording, a made-up detail, or the line just isn't there), the question gets thrown out silently and never reaches you. You only ever see questions the tool can prove came from your own material. Open any question and you can see the exact line highlighted. Using it is the boring part, on purpose. Paste lecture notes or a block of text, or grab a YouTube video's transcript (open the video, three dots, "Show transcript," copy the panel text, paste it in). There's no scraping involved, so it doesn't break when YouTube changes something on their end. You get a practice quiz plus flashcards in about five seconds

A browser test can be green and still be wrong. It can pass because a mock returned an outdated response. It can fail because staging enabled a feature flag that no one documented. It can become flaky after a React upgrade even though the user-facing behavior looks unchanged. And when the same failure appears only in a minified build, the stack trace may be so unhelpful that the team blames the test before investigating the application. These problems look unrelated, but they usually share one root cause: the test is running against a different system than the one the team thinks it is testing . The difference may be configuration, data, rendering behavior, build output, infrastructure, or timing. Reliable browser testing therefore requires more than stable selectors. It requires evidence that the environment, application state, and execution path are what you expect. Feature flags create multiple versions of the same application Feature flags are useful because they let teams release functionality gradually. They are also one of the easiest ways to create staging-only failures. A test written against the default interface may encounter a completely different component tree when a flag is enabled. A button can move into a menu, a form can become a wizard, or an API request can be delayed until the user completes an additional step. The difficult part is that the URL may remain identical. From the test runner's perspective, it is visiting the same page. From the application's perspective, it is executing a different product variant. A useful starting point is this breakdown of why browser tests fail only in staging when feature flags change runtime UI state . For important workflows, record the active flag state with every run. Do not limit the log to a generic environment name such as staging . Capture the actual configuration that influenced the UI. A failed run should answer questions such as: Which flags were active? Which account or cohort received them? Did the

The most important SaaS workflows rarely stay inside one clean browser tab. A user starts on the application, opens an OAuth popup, completes MFA, returns to the original tab, receives an email, follows a verification link, and lands on a different domain. Their account belongs to one tenant, their data is stored in a particular region, and their locale changes the date format that the test expected. Each step may work in isolation. The complete journey still fails. That is why testing SaaS applications requires more than a collection of page-level tests. The real risk lives in the handoffs between systems, identities, windows, tenants, regions, and communication channels. Authentication is a state machine, not a login form A simple login test usually covers one path: Enter email and password. Submit. Reach the dashboard. Real authentication has many branches: OAuth consent already granted. OAuth consent required. Popup blocked. Identity provider opens in a new tab. MFA requested. MFA remembered on the device. Session expired during the handoff. User belongs to multiple organizations. Original tab resumes before the token is available. Callback lands on the wrong environment. This review of testing OAuth popups, MFA prompts, and cross-tab login handoffs with Endtest highlights the operational difficulty of these flows. Model authentication as a state machine. Record the expected transitions and test the failure paths between them. For example: Unauthenticated → OAuth opened → Provider authenticated → Callback received → Session created → Tenant selected → Application ready A test that only checks the last page cannot tell you where the handoff failed. Capture: Current window and newly opened windows. Redirect URLs and callback parameters. Cookie and storage changes. Network failures during token exchange. Visible provider errors. The tenant selected after authentication. Whether the original tab updates automatically or requires refresh. Multi-tenant testing must pr

AI-powered web applications look familiar on the surface. They have text boxes, buttons, menus, loading indicators, and API calls. That makes it tempting to test them like any other web application: submit an input, wait for a response, and compare the output with an expected string. That approach breaks quickly. Model output is variable. Safety behavior depends on context. A response can be semantically correct but displayed in the wrong conversation. An agent can produce a convincing final message after calling the wrong tool. A prompt-injection defense can block obvious attacks while failing when malicious instructions arrive through a webpage, document, image, or previous message. Testing these applications requires two kinds of evidence at the same time: Deterministic product evidence: the UI, state, permissions, tool calls, and workflow behaved correctly. Probabilistic model evidence: the output stayed within an acceptable range across repeated and adversarial inputs. Prompt injection is a workflow problem Prompt injection testing is often reduced to pasting “ignore previous instructions” into a chat box. That is a useful smoke test, but it does not represent how browser-based agents encounter untrusted content. An agent may read instructions from: A webpage. A support ticket. A PDF. A hidden DOM node. An email. A retrieved knowledge-base entry. A tool response. A previous conversation turn. The guide on testing prompt injection defenses in AI-powered browser workflows provides a good foundation. The test should verify more than the final sentence. It should inspect whether the agent: Treated external content as data rather than authority. Attempted a prohibited tool call. Exposed secrets in an intermediate step. Navigated to an unapproved domain. Changed its goal after reading untrusted content. Requested confirmation before a sensitive action. Preserved the original user instruction. A safe final answer does not prove that the workflow was safe. The agent ma

Frontend testing used to sound simple: open a page, find an element, click it, and verify the result. That description still works for basic workflows, but modern interfaces are no longer a single static DOM that changes in obvious ways. Components can render inside Shadow DOM. Modals can be portaled to a different part of the document. Server-rendered HTML can be replaced during hydration. Content can move because of CSS container queries. A page can look finished while several progressive-loading states are still changing underneath it. The hardest frontend bugs now tend to sit at the intersection of three things: State: what the application believes is happening. Timing: when the browser and framework apply changes. Geometry: where elements appear and whether users can actually interact with them. A stable test strategy has to observe all three. Shadow DOM and portals break naive assumptions about element location Component encapsulation is useful, but it changes how automation finds and interacts with elements. A control inside an open shadow root is not always reachable through the same selector strategy used for the main document. A portaled modal may appear visually next to a component while being rendered near the end of document.body . Focus can move into the modal even though the DOM hierarchy suggests that it belongs elsewhere. This guide to testing Shadow DOM and portaled modals without breaking browser automation suites covers the key challenges. The test should verify behavior, not merely the presence of a node: Can the user reach the control? Is the expected element visible above overlays? Does keyboard focus enter the modal? Is focus trapped correctly? Does Escape close it? Does focus return to the triggering element? Can a screen reader identify its label and role? Selectors still matter, but interaction boundaries matter more. A test that locates a button hidden behind another layer is not testing what the user experiences. Hydration creates a peri

If every meeting, watercooler conversation, and date gets transcribed and summarized, who's actually reading any of it?

Every voice agent demo ends the same way. The bot wraps the call with a confident "Great — I'll email you the details and a confirmation," the human hangs up satisfied, and then nothing sends. There's no inbox behind the promise. The transcript lives in your voice stack, the "email" is a TODO nobody wired up, and the customer waits for a message that never arrives. It's the most common broken promise in conversational AI, and it's broken for a boring reason: the voice agent has no mailbox of its own. That's the gap this post closes. The interesting problem with voice agents isn't speech — your voice stack already handles the transcript, the turn-taking, and the summary. The interesting problem is the channel bridge : handing what happened on the call to a written, replyable email that comes from the agent and whose reply comes back to the agent . Voice in, email out, reply back in. No human in the loop, no shared support inbox, no spoofed noreply@ . The piece that makes this clean is a Nylas Agent Account — a real, owned email address that your voice agent sends from and receives at. I work on the Nylas CLI, so the terminal commands below are the exact ones I reach for, and I'll show both angles for every operation: the nylas command and the raw curl HTTP call. In practice your provisioning runs through the API and your ops glue runs through the CLI, so you'll want both. Why a real mailbox beats a fire-and-forget send Most teams reach for a transactional email API for this — SendGrid, SES, whatever's already in the stack — and fire a templated "here's your summary" off into the void. That works right up until the customer replies. Their reply hits a black hole ( noreply@ ), or worse, it lands in some shared support@ inbox where it's divorced from the call it answers. The agent that made the promise never sees the answer. An Agent Account is just a grant . It has a grant_id , and that ID works with every grant-scoped endpoint Nylas already exposes — Messages, Drafts,

Most "AI email" tutorials end with a while True loop that polls an inbox every thirty seconds, runs the new messages through a model, and sends a reply. It demos fine. Then you put it in front of real traffic and the cracks show up immediately: you're burning API calls to fetch nothing 99% of the time, your reaction latency is bounded by your poll interval, and the moment you scale to more than one inbox the polling cost multiplies. Polling an agent's inbox is wasteful. Webhooks are the right primitive for this. The mailbox already knows the instant a message lands — there's no reason to keep asking. What you actually want is a pipeline: inbound mail fans out to a verified ingest endpoint, lands on a queue, and gets picked up by workers that drive your agent runtime and send the reply. This post is about that architecture end to end — not a single feature, but the whole flow, with the parts that bite you in production (idempotency, retries, ordering, backpressure) called out honestly. I work on the Nylas CLI, so the terminal commands below are the exact ones I reach for when I'm wiring this up. I'll show the curl HTTP call and the CLI equivalent for every concrete step, because you'll use both: curl in your provisioning scripts, the CLI when you're poking at a live account. The mental model: an Agent Account is just a grant Before any of the pipeline matters, here's the one abstraction that makes the whole thing simple. An Agent Account is a Nylas grant — it has a grant_id , an inbox, an email address on a domain you own, and it speaks every grant-scoped endpoint you already know: Messages, Threads, Folders, Drafts, Attachments, Calendars, Events, Contacts, Webhooks. There's no OAuth token to refresh, no provider-specific quirks, no separate SDK. If you've built against a connected Gmail or Microsoft grant before, the data plane is identical. Nothing new to learn there. What's different is that the agent is a participant. It has its own address — support@yourcompany

Most posts about "AI email agents" stop at the happy path: webhook fires, model drafts a reply, agent sends it. Demo works, screenshot looks great, ship it. Then it goes to production and the agent replies to the same customer twice ninety seconds apart, and now your "intelligent assistant" looks like a broken cron job. That second reply isn't a bug in your model. It's a property of the delivery system, and it's guaranteed to happen eventually. Nylas webhooks are at-least-once: the same event can arrive up to three times. If your handler treats every POST as a fresh event, every retry is a second action. For a logging pipeline that's harmless. For an agent that sends email on your behalf , a duplicate delivery is a duplicate reply, and a double-reply embarrasses the agent in front of the exact person you built it to impress. So this post is about the engineering of idempotency itself, applied to an Agent Account. Not "remember to dedupe" hand-waving — the actual moving parts: which field is the real dedup key, how to persist processed ids atomically, why you ack before you work, how to make the send path itself idempotent, and where a per-thread lock catches the race that dedup alone can't. I work on the Nylas CLI, so every terminal command below is one I've actually run, verified against nylas v3.1.27. What an Agent Account changes (and what it doesn't) An Agent Account is just a grant. It has a grant_id and works with every grant-scoped endpoint — Messages, Drafts, Threads, Folders — exactly like a connected Gmail or Microsoft account. The difference is it's an inbox the agent owns : support@yourcompany.com is the agent, not a human whose inbox the agent borrows. Inbound mail to that address fires the standard message.created webhook, the agent reads it, and the agent replies from its own address. Nothing new to learn on the data plane. That's the whole point of the grant abstraction — the idempotency work below is plain webhook-handling discipline, and it transfe