Part 4: Claude Opus writes the tools
Почему мы запретили AI-менеджеру писать код и поручили это Claude Opus
B · Useful, limited Fourth Habr post by the vendor Haimi with a concrete two-agent split, sandbox limits and the code that strips the write flag; no measured outcomes, and the authors defer test results again.
Summary based on the full text·Original: about 6 minutes to read
In short
Part 4 (1 November 2026) of Haimi's series on a chat assistant for Wildberries sellers. With the full API from part 3, the chat agent built calculations (margin in a promotion, resupply timing) afresh in each conversation, so answers varied and could not be tested. The team added a second agent: Claude Opus 5.5 on claude-agent-sdk, in an OS-level sandbox, writes reusable tools once; the fast, cheap chat model only calls them. The chat model is barred from writing code because it reads untrusted text (reviews, chats, web pages) and runs next to client keys. The authors close by admitting the ban recreates the old wall: when no command exists, the chat agent is stuck again.
Key numbers
- 45commands with their own SQLite database in the first tool set written by the Opus agent (the set grew later)
- 1 GB, 1 corememory and CPU limits of the separate service account the tool-writing agent runs under
- 0 to 100score range of the wb_audit command, which rates a shop across 9 sections
- 3exit code a write command returns in preview mode, which the chat agent turns into an approval request
As reported by the source.
Russian·Web page·opens habr.com
What it reports
- Problem with in-chat calculation: a different method each time, no way to test it, and logic rebuilt on every request even with saved API calls.
- Options weighed: write tools by hand (too slow, needs seller expertise), put a strong model in the chat (higher cost and latency on every message), or split the work. They chose the split.
- Why the chat agent may not write code: it would run on the server holding account keys and other clients' data; it reads text anyone can write, so an injected instruction in a product review could be executed; and code from a cheap model would go unreviewed.
- Tool-writer sandbox: separate service and user, 1 GB memory and one core, write access only to one directory, project data directories invisible, owner-only password access, no customer text reaching it.
- Output: first 45 commands with a SQLite database covering money (sales, P&L, prices, auto-repricing), goods (stock, supply plan, card audit, SEO, funnel), ads, buyers, growth (promotions, niche selection, MPStats), a whole-shop audit scored 0 to 100 over 9 sections, plus generic API, route-search and SQL commands, and a usage guide.
- Hand-over controls: one folder per seller account with path checks; the key passed only as an environment variable and sent only to Wildberries hosts; SQL limited to the account's own database with ATTACH, VACUUM and setting writes blocked; the
--applyflag stripped from any model-supplied arguments, so preview (exit code 3) becomes a batch item that runs with--applyonly after the owner says yes.
How they got it
A design account with code excerpts. No figures on answer quality, consistency, cost or adoption of the new tools.
Limits
- No measured outcomes; results of the next experiment (letting the chat agent write code in a sandbox) are deferred.
- Vendor post about its own product; the tool set was written for one shop and adapted to many.
- The authors concede that the ban leaves the chat agent unable to serve requests no command covers.
Why it matters for companies
The post is a clear worked example of separating where code is written from where untrusted text is read. A strong model builds tested tools in an isolated environment; the cheaper model that faces customers can only call them, and cannot apply changes. The --apply stripping and exit-code handshake are small, copyable controls for any agent that can move money.
Key passages in translation
Russian original
Сильная модель один раз пишет инструменты, быстрая и дешёвая каждый день ими пользуется.
The strong model writes the tools once; the fast, cheap one uses them every day.
Russian original
Разница не в том, что одному мы доверяем, а другому нет. Разница в том, где они работают и кто с ними разговаривает.
The difference is not that we trust one and not the other. It is where they run and who talks to them.
Russian original
Теперь модель даже при большом желании не может выполнить правку, потому что нужного флага у неё нет.
Now the model cannot apply a change however the flag is passed, because it does not have the flag.
Summary based on the full text. Read the original for the full argument and data.Read the original on habr.com
- Tags
- Prompt injection