Note by @fastfinge

Aha. So Claude's going to start leaking random remote access URLs to people's Claude Code sessions now, I see we're playing that game. Nope nope. Not sure what prompted this new behavior all of a sudden, but every single release or document it writes gets stamped with the "generated with Claude Code" ending, and that slug link points to directly someone's session ID they used for the coding session itself. Just wow.

I mean, If a government entity subpoenas Anthropic for information on a specific session ID found in a repository, Anthropic can instantly pull up the exact prompts, system context, and chat history that created that code. I don't ccare that people can't take control or see the history of the session and there's security. You are taking a secret token (the session ID) and treating it like public metadata. Hackers love public identifiers. An attacker doesn't need to break into your specific computer today. Instead, they can write a simple script to scrape GitHub for any link matching claude.ai/code/session_*. They can build a massive database of active or historical session IDs. If an attacker finds a zero-day exploit (an unpatched vulnerability) in Anthropic’s session routing, web authentication, or cross-origin headers in the future, they don't have to guess random session tokens. Anthropic already gave them that data as a free gift.

@Tamasg And while I'm ranting, I kind of wish all AI commits were forced to include the complete contents of the session that generated them, anyway. It would be useful both to preserve reasoning for the next AI that works on it, and so I as the maintainer can tell the difference between someone who engaged, made reasonable decisions and suggestions, etc, and someone who said "fix teh problem ok dont make mistakes thx bye"

@fastfinge see, I wouldn't want another engineer judging me on that. That feels like it's something that would be on their whim of judgment: Just because Claude understood, say, more about assembly language or how CPU instructions got adopted to work on X86 than I ever could or will (though have certainly learned a lot), a more experienced engineer can go: This loser jerk, he doesn't even read full assembly language like I can, why should I trust him. And that alone to me is why it being an optional, or filtered on the basis of written docs in the repo's docs folder co-written with the AI at the end of the session holds more value.

@Tamasg I think it's more judging someone on how they engaged and the effort they put in. Even with AI, you still need a base-level understanding of how computers work, and, like, what oppcodes are. A session transcript lets me quickly determine if you put in enough effort and understanding to know if your PR actually works, and if so, if it does what you intended it to do. If you don't have a certain base level of understanding, accepting your pull requests is more trouble than it's worth. I say this as someone who knows far less than you do about all of the above. There's a reason I don't submit PR's to your various emulation projects: I'm well aware that I don't have the knowledge needed to make sure the PR does what it says it does. Unfortunately, most people are not that self aware. I regularly get AI generated PR's from people who don't even really know what Python is. Too often these PR's break the build process on any machine but the submitter's. But these people have no idea what a build process is, and have never heard of CI/CD. So explaining the problem or getting them to fix it is just not possible. They don't even have the needed vocabulary. If I saw the session transcript I would know that up front, and it would save a lot of time.

@fastfinge wow hahahaha I wish I got PRs from Python-ILLITERATE folks! (no, no I really don't.) But yeah I think your experience there makes sense, and we're genuinely coming onto it from two different roads: The people who have sent in PRs to my project generally were technical enough to be helpful, and even if they didn't know how to say, tune a language's formant frequencies or get a feature done to 100% working state, their PRs definitely were not that bad.
But I think I'm just lucky, and now that I said that, who knows, maybe a floodgate of badly written PRs will pop up. But for a scenario like that, where I know it's a focused session, only on this one PR thing, gets recorded as a ledger alongside it and I say "start recording" and "stop" at the end, i'd do it. That's the thing. It's just that a general session can have me talking about Monster coffee to code to like, Slack distractions at work as I work on that repo or code, that I wouldn't Necessarily want all that public unless I had a choice to decide what's in the log.

@Tamasg Interesting. I'm way too cheap to add any distractions into the context. I count every token like Scrooge LOL. And I think it's probably just a "I work on eloquence for NVDA" thing. The one project like every blind person cares about, no matter how little or much they know about computers.