Originally published at pilothouse.dev/blog/vibe-coding-stack-2026.
I don't write most of my code by hand anymore. On a normal day I have three to six agents going: Claude Code on the main feature, Codex reviewing a diff, OpenCode or Grok Build poking at something on the side. That stopped feeling like magic months ago. Now it feels like running a small team, and the hard part isn't the prompting. It's everything around it: where the agents live, how I know which one is stuck, and what they're allowed to do when I'm not looking.
This is the stack I've settled on and what each piece is for. Full disclosure: I build one of these tools (Pilothouse).
| Layer | What I use | Job |
|---|---|---|
| Agents | Claude Code, Codex CLI, OpenCode, Grok Build | Do the work |
| Where they live | herdr | Terminals that keep running when I close the window, one sidebar for every agent |
| Editor | Whatever I'm reviewing in | Read diffs, fix the last 10% |
| Network | Tailscale | My laptop, desktop and phone on one private network |
| Rules and approvals | Pilothouse | A rule check before every tool call, and approvals that reach my phone when I'm away |
Desk machine (in herdr) Laptop (linked)
┌──────────────────────────────────────────────┠┌──────────────────────â”
│ Claude Code ─hooks─┠│ │ Claude Code ─hooks─┠│
│ Codex CLI ─hooks──┤ │ │ ▼ │
│ OpenCode ─plugin─┼─▶ Pilothouse daemon ──▶ policy.yaml (allow/ask/deny) │
│ Grok Build ─hooks──┘ ▲ │ │ Pilothouse daemon │
└───────────────────────────────┼──────────────┘ └──────────┬───────────┘
└──── pilothouse link (Tailscale) ─┘
away? the request is pushed to your phone ─▶ hold to Allow / Deny
Each agent is good at different things, and using two of them on the same problem catches mistakes. My split right now:
The downside of using several agents is that each one has its own permission prompts, its own settings file and its own idea of what's safe.
herdr is a terminal workspace built for coding agents. Your agents run in real terminal panes inside a background server, so closing the client (or losing SSH) doesn't kill them. It sorts panes into workspaces and tabs, and it marks every agent as working, blocked, done or idle so you can see which one needs you. It also recognizes Claude Code, Codex, OpenCode, Grok and a long list of other CLIs, and it can add remote machines over SSH to the same sidebar.
curl -fsSL https://herdr.dev/install.sh | sh # or: brew install herdr
herdr # start or attach in your project folder
herdr answers the question "which of my agents needs me?" It doesn't try to decide what an agent is allowed to do, and it isn't built around answering a permission prompt from your phone with your own rules behind it. That's the gap Pilothouse fills, so the two fit together well.
Pilothouse is a single open-source Go binary. It installs the agents' official hooks (a small plugin for OpenCode) and runs a local daemon. Every tool call an agent is about to make goes past your rules first, and every session shows up in one inbox.
brew install sabr-software/tap/pilothouse # or: curl -fsSL https://pilothouse.dev/install.sh | sh
pilothouse demo # optional: try the phone app with pretend agents
pilothouse setup # shows the hook diff first, starts the daemon, pairs your phone
Three things it adds to the stack:
version: 1
rules:
- name: no-force-push
match: { kind: shell, command: "git push*" }
when: 'command.matches("(--force|-f)\\b")'
action: deny
message: Force-push is blocked. Open a PR instead.
- name: ask-before-pushing-main
match: { kind: shell, command: "git push*{main,master}*" }
action: ask
- name: no-secrets
match: { path: "**/.env*" }
action: deny
Any deny wins. If you don't want to write YAML, the presets cover the common cases: pilothouse policy preset guarded-autopilot on lets routine work in a repo run without prompts, blocks destructive commands and asks before pushes, deploys, secrets and sudo.
Approvals that follow you. At the desk, the agent's own prompt shows up as usual. When the keyboard goes idle, approval requests from Claude Code, Codex and OpenCode are held and pushed to your paired phone with the command, a diff for edits and risk labels. Allowing takes a one-second press and hold, so a stray tap can't approve anything.
One inbox for every machine. Since 0.4, pilothouse link lets one machine (the hub) show every machine's sessions in the same app, labelled by machine.
pilothouse task new "fix the flaky checkout test" starts an agent in its own git worktree. Tap
desktop:
open: auto # a herdr tab when herdr is running, else a Terminal window on macOS
open_tasks: true
Pilothouse has no account and no cloud relay. Your phone reaches the web app your own machine serves, over your tailnet:
pilothouse remote tailscale # HTTPS on your tailnet via Tailscale Serve, nothing public
pilothouse pair # scan the code; on iOS add it to the Home Screen first
No Tailscale? pilothouse notify telegram lets you answer from a Telegram bot you create, and pilothouse notify ntfy works too.
curl -fsSL https://herdr.dev/install.sh | sh
brew install sabr-software/tap/pilothouse
pilothouse setup
pilothouse policy preset guarded-autopilot on
pilothouse policy preset no-secrets on
pilothouse remote tailscale && pilothouse pair
herdr # then, in a pane:
claude # hooks apply either way
pilothouse run claude
If you want to see how I run Codex, Claude Code and Grok side by side, that's the next post. The rules I actually use are in Guardrails for vibe coders.
Pilothouse is Apache-2.0 on GitHub. Issues and "this broke my setup" reports are very welcome.