GPT-6.1 Terra lands in Codex, Lovable can create your Supabase project, and Replit's agent goes on call

Welcome back. This is everything that changed in the tools you ship with since last Monday, why it matters, and one prompt to copy. A few of these shipped Oct 20–25 and didn't make last week's issue, so they're here.

1. GPT-6.1 Terra arrives in Codex, plus /presets in the CLI

On Oct 26, OpenAI added GPT-6.1 Terra to Codex and ChatGPT Work for Plus, Pro, Business, Enterprise and Edu plans. OpenAI calls it a fast, efficient model that combines strong image understanding with precise computer use. It isn't available in regular ChatGPT chat.

Three days earlier, Codex CLI 0.164.0 shipped with:

• /presets: save reusable prompts and slash commands in ten numbered slots, with a keyboard menu.
• Inline /model and /permissions: set model, reasoning effort, speed and permission profile in one command.
• Image previews in the fullscreen transcript on terminals that support Kitty or Sixel graphics.
• Credential masking during supported remote Bash commands and Zsh snapshot sessions.
• Resume fixes: resuming a session now restores its saved thread settings instead of your global defaults.

Why it matters to builders: the prompts you retype every session ("run the tests, then summarize the diff") can now live one keypress away. If you're choosing between agents, Loadout has a Claude Code vs OpenAI Codex comparison.

2. Claude Code 2.1.307–2.1.311: no more dead sessions past 200K

The Claude Code releases from Oct 21–26:

• Long sessions (2.1.311): standard-context sessions no longer stop with "Usage credits required for 1M context" when a request goes over 200K tokens. Claude Code now compacts and keeps going.
• ultrathink (2.1.311): now runs that turn at xhigh effort on Opus 5.5, Sonnet 5.5, Haiku 5.5 and Fable 5.1 through Anthropic's API.
• /usage (2.1.311): now shows large prompt-cache misses, so you can see where your limit went.
• Subagents and MCP (2.1.311): fixed subagents not getting tools from MCP servers that connect late.
• Sandbox fixes (2.1.309): a batch of sandbox and permission fixes, including sandboxed Bash running shell startup files outside the sandbox. claude ultrareview now requires workspace trust.
• Monitor tool (2.1.310): now works on Bedrock, Vertex and Foundry.

Why it matters to builders: if you've had long sessions die at the 200K mark, update. If you rely on the sandbox to keep an agent away from your machine, 2.1.309 is the one to be on.

3. Lovable can create your Supabase project, and retired Gemini 2.5

From Lovable's changelog:

• Oct 20: you can ask Lovable to create a Supabase project for an app with no backend. You pick the organization and region, Lovable creates and connects it, and Supabase bills it to your own organization. The region can't be changed later.
• Oct 22: Gemini 2.5 Pro, Flash and Flash Lite retired for app AI features on Oct 20. Requests now go to Gemini 3.8 Flash (Pro and Flash) or Gemini 3.1 Flash Lite (Flash Lite). Lovable says your app keeps working, but cost per request and responses can change.
• Oct 16: Lovable now writes and runs a small test when you add or change a rule in your app, like a price, a limit or a permission.

Why it matters to builders: if your Lovable app used Gemini 2.5, its model changed under you, so check your outputs and costs. A Supabase project you own is great for portability, and it also makes table security your job.

4. Replit's Monitoring Agent goes on call

Replit's Oct 23 update adds a Monitoring Agent that investigates production issues from your app's logs and metrics, then tries and validates a fix. With Monitoring alerts and Auto-fix on, it triages alerts in the background. Fixes only publish themselves if you also turn on the experimental Auto-republish setting. Otherwise you review them.

The same update lets eligible top-up customers keep published apps running at zero credits, up to an overage limit, and adds chat and asset sharing. Replit warns that shared development URLs open live servers, not read-only previews. On Oct 26, Replit also announced Replit for Business.

Why it matters to builders: the hard part of shipping with AI is often what happens after launch. Start with Auto-republish off and read each fix before it goes live.

5. Vercel Agent gets 67% cheaper, and Sandbox gets stdin

On Oct 27, Vercel said Vercel Agent sessions now cost 67% less on average, from better context management and prompt-cache reuse. Billing rates are unchanged: provider inference plus $0.25 per million tokens. On Oct 26, Vercel Sandbox commands gained opt-in stdin, so stdio MCP servers and CLIs that read from stdin can run in a sandbox. Vercel also added custom monitors in Observability, and Agent can now triage alerts before paging you.

Why it matters to builders: if you tried Vercel Agent and the bill put you off, it's worth another look. Running stdio MCP servers in a sandbox is a safer way to try a server you don't fully trust.

Copy this: make the agent show its fix before it ships

Monitoring agents and auto-fixers are only as safe as the review step. Use this with any agent before you let it touch production.

Something is broken in production: <symptom, error message, or alert>.

1. Before changing any code, show me the evidence: the log lines, metrics,
   or requests that point to the cause. Quote them.
2. State the root cause in one sentence, and how confident you are.
3. Write a failing test or a repro script that shows the bug.
4. Propose the smallest fix that makes it pass. Show me the diff.
5. List what else this change could affect, and how you'd roll it back.

Do not deploy or publish anything. Stop after step 5 and wait for me.

Step 3 is the one agents like to skip. Don't let them.

Tool of the week: Cursor Agent SDK

Cursor made its Agent SDK generally available on Oct 20. An agent is a project: instructions.md is the prompt, each file in tools/ is one typed action, and skills/, mcp-connections/ and channels/ cover the rest. Start with npx @cursor/agent-sdk init ./my-bot, then agent-sdk dev for a local playground. agent-sdk eval checks which tools ran and what the reply looked like. You can deploy to Cursor or self-host. We couldn't find a published price for hosted agents, so check your plan before you deploy.

Why we picked it: most homemade agents have no tests. Evals that assert which tools ran turn "it worked when I tried it" into something you can run in CI.

Security tip: is your .env file downloadable?

The problem: If you can open https://yourapp.com/.env in a browser and it downloads, every secret in it is public: database URLs, API keys, payment keys. It usually happens when a project is uploaded or built with .env sitting in the public or static folder, or when the host serves every file in the project directory.

The fix: delete .env from the deployed output and redeploy. Then rotate every secret that was in the file, because you can't know who already grabbed it. Add .env* to .gitignore and keep values in your host's environment-variable settings instead. A free Unspill scan checks for this and reports only variable names, never values.

Guide: https://unspill-scan.vercel.app/fix/exposed-env-file?utm_source=vibediff

From Unspill, a free scanner we built. Disclosure: we own it.

Loadout pick of the week: Lovable vs Replit

Loadout is a sister project of The Vibe Diff.

Both shipped big this week. Lovable now spins up a Supabase project you own, and Replit added an agent that watches your live app. If you're picking one to build on, Loadout's Lovable vs Replit comparison puts pricing and strengths side by side. You can also read the Lovable and Replit pages on their own.

From newsletters we read

Tool Picks Weekly (by Tool Use Cases) — A free Monday email and directory that ranks AI tools by the specific job you need done (vibe coding, coding agents, debugging, MCP servers, and more), with verified pricing and plain-English verdicts on when not to use each pick: https://tools.lalipublications.com/newsletter/ The Weekly Verdict from Agentic Weekly: every new AI model and coding-agent release, sourced, with real tests labelled Tested or Reported, plus practical use cases you can run the same week: https://theagenticweekly.com/newsletter

---

Know a builder who'd like this? Forward it to them. If three friends sign up with your referral link, you get the Builder Prompt Pack: 10 copyable prompts for shipping with coding agents.

That's the diff. Reply and tell me what you shipped this week. I read everything.