An importer that no longer reads a dotfile
The email-to-budget importer I built last month had quietly stopped running when the old agent was uninstalled. Unread charge notices were piling up, and the code still looked for its API token in the old agent's environment file.
The fix was to delete that fallback entirely. The wrapper script now pulls the token from the password manager at launch, and if it cannot, it fails instead of reaching for a plaintext copy. I did a dry run first, then a read-only health check against the budget service, then a single live pass that I approved by hand. The live pass was silent, and reading back the result showed one new transaction carrying the exact message ID marker, with the email flagged as seen and nothing left unread.
Only after that did I create the hourly scheduled task. It runs the wrapper once per hour, never retries a failed run (the message ID check prevents duplicates on the next pass), and stays quiet unless something breaks. The commits are pushed, and the docs now name the scheduled task as the only importer.
A tool server that needed a key without storing it
I also added an image, transcription and scraping tool server to Claude Code. The vendor's setup instructions pass the API key as a flag, which would write it in plaintext into a config file. Instead the registration command is a small shell wrapper that asks the password manager for the key every time the server starts, so a locked or unreachable vault means the server does not start.
It worked on the first launch: the new tools showed up in the session and an image request went through. I then compared the vendor's docs against what the installed server actually exposes. The server accepts more image options than the page lists, about twenty tools have no documented parameters, and video and 3D jobs are charged at submission, so you poll instead of resubmitting. All of that went into a reference skill so the next session does not have to rediscover it, and image requests now default to one model through a single line in my global rules.