Study reveals which CLAUDE.md files load at launch versus on demand in Claude Code

·1 views

Researchers tested six CLAUDE.md files placed at different directory levels in Claude Code v2.1.273 to determine exactly when each file is loaded into the model's context. Files in the parent directory, working directory, and CLAUDE.local.md were all present in the very first request, each costing around 1,600 tokens. Subdirectory files were not loaded at launch but appeared later when Claude read files within those directories, at zero initial token cost. Files from directories passed via the --add-dir flag never reached the model at all unless a specific environment variable was set. The findings confirm and quantify the documented loading behavior: hierarchy-above files load at launch, subdirectory files load on demand, and --add-dir files are excluded by default.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Why Database Schema Diagrams Become Outdated and How to Fix It

Schema diagrams frequently fall out of sync with actual databases because they are static files that no one updates after migrations run. When a developer adds or renames a column, the diagram stored in Confluence, Figma, or a repo image remains unchanged, creating a misleading source of reference. Responsibility for updating diagrams typically falls between teams, so updates are perpetually deferred. The recommended fix is to auto-generate diagrams directly from the live database on every deployment or pull request, rather than maintaining them manually. For teams wanting version control, the generated output can be committed as an SVG or Markdown file and enforced via CI checks that fail if the diagram does not match the current schema.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Builds Custom Geo-fencing Engine After Google API Proved Too Imprecise

A developer building an app called Muffle — designed to automate phone sound profiles based on location and context — initially used Google's Geofencing API but abandoned it due to poor precision and unpredictable latency. The API failed to detect zone transitions accurately, sometimes delaying exit events until the user had moved several blocks away. To gain finer control, the developer switched to a custom engine built on Android's FusedLocationProviderClient, using the Haversine formula for distance calculations within a persistent Foreground Service. An adaptive polling system was implemented, reducing location update frequency when stationary and increasing it upon detected movement to conserve battery. The shift away from Google's high-level API introduced new challenges around Android's fragmented power management behavior across device manufacturers.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Framework Proposes Five Autonomy Levels to Govern AI Agents Safely in Production

A developer has published an open-source framework for governing AI agent autonomy, inspired by Garry Kasparov's 2005 observation that process quality determines outcomes more than raw capability. The framework defines five autonomy levels with sixteen controls mapped to OWASP Agentic and ISO/IEC 42001 standards, along with a scoring worksheet and promotion rules requiring evidence before granting greater autonomy. The project was motivated by a Harvard and BCG study of 758 consultants showing the same AI tool produced 40% better results within its competency range but 19 points worse results just outside it. The author argues the key question for AI deployment is no longer human versus no human, but rather how much human involvement each specific use case requires and how safety can be verified. The draft framework is publicly available on GitHub under a CC BY 4.0 license, and the author is seeking feedback from teams running agents in production to help calibrate its thresholds.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why Organizations Must Switch to Phishing-Resistant MFA Now

Traditional multi-factor authentication methods such as SMS codes and push notifications have proven vulnerable to real-time relay and man-in-the-middle attacks, rendering them insufficient for modern security needs. Attackers can intercept or manipulate these legacy MFA mechanisms without requiring users to click a malicious link, creating a false sense of security. Phishing-resistant MFA addresses these weaknesses by cryptographically binding authentication sessions to specific domains, preventing credential reuse on spoofed sites. The two leading standards for phishing-resistant MFA are FIDO2/WebAuthn, which uses public-key cryptography and hardware or biometric authenticators, and certificate-based authentication, commonly deployed in enterprise environments. Security experts now consider migrating to these stronger protocols a critical imperative rather than an optional upgrade for organizations handling sensitive data.

0 comments Read more at DEV Community