Manual / AI build assistance / Things to watch out for

Things to watch out for

Each item below was met for real while testing AI build assistance with Claude Code on live Google Cloud projects. Some were fixed in Pipewright before 1.3.0; the rest are in how agents, laptops and networks behave, and the fix is a setting or a habit.

On your machine and network

Antivirus web shields and TLS-inspecting proxies

Symptom: the agent cannot connect to a hosted tool server (InvalidHTTPResponse, or /mcp shows it failed), while curl to the same URL works. Seen with AVG Web Shield.

Cause: the shield inspects HTTPS and re-chunks streamed answers to POST requests, breaking the framing an MCP client reads.

Fix: the hosted server now sends whole answers with a length, which most proxies leave alone. Where it still breaks, add the service’s address to the shield’s exceptions, for Cloud Run https://*.run.app/*. The local stdio server is not affected: it never touches the network between agent and server.

Corporate or antivirus certificates for the CLI

Symptom: CERTIFICATE_VERIFY_FAILED from pipewright commands, or pipewright model list failing on a gRPC handshake while other commands work.

Fix: point Python and gRPC at a bundle that includes the inspecting certificate. Image builds take their own setting.

export REQUESTS_CA_BUNDLE=~/certs/ca-bundle.pem
export GRPC_DEFAULT_SSL_ROOTS_FILE_PATH=~/certs/ca-bundle.pem    # model list, Feature Store
export PIPEWRIGHT_BUILD_CA_BUNDLE=~/certs/ca-bundle.pem          # pipewright release, image builds
git -c http.sslBackend=schannel push                            # Windows: git through the system store

In Claude Code

Trust the folder, or the settings do nothing

Symptom: every Pipewright command asks for approval, and denied commands are not denied.

Cause: Claude Code applies a project’s .claude/settings.json only after you trust the folder, which it asks the first time it starts there. Headless runs (claude -p) never ask, so they never load it.

Fix: answer yes to the trust prompt once. For headless runs, in scripts and CI, pass the settings yourself: claude -p --settings .claude/settings.json "...".

Compound commands ask for approval

Symptom: cd usecases/x && pipewright validate ... asks, although pipewright validate is pre-approved.

Cause: a compound command is approved as a whole, not part by part.

Fix: nothing is wrong; approve it, or tell the agent to run Pipewright from the repository root, as the context pack does.

Start the agent in the right folder

An agent works on the repository it starts in. When you script sessions with Git worktrees, check the worktree was really created (git worktree add --detach when the branch is checked out elsewhere) before starting the agent in it; otherwise it starts in whatever folder the script was in.

With a hosted tool server (Enterprise)

The ID token lasts an hour

Symptom: tools that worked start failing with 401.

Fix: refresh PIPEWRIGHT_ID_TOKEN and restart the agent’s MCP connection (/mcp in Claude Code, or restart the agent). The proxy connection signs each request itself and does not expire this way.

export PIPEWRIGHT_ID_TOKEN=$(gcloud auth print-identity-token)

Cold starts time the agent out

Symptom: the first connection of the day fails, the second works.

Cause: a Cloud Run service scaled to zero takes several seconds to start; Claude Code gives an MCP server about five.

Fix: min_instances: 1 while teams are working (a small hourly cost), or reconnect once.

Proxy or direct

gcloud run services proxy needs the cloud-run-proxy gcloud component, which on Windows needs an administrator to install. --direct needs no component, but only works where the service’s ingress lets you in: inside the network, or ingress: all. Keep production on internal.

The hosted server has no copy of your repository

Its bootstrap_usecase returns a skeleton command and only the files that differ from it. The agent runs the command, writes the files over the skeleton exactly as returned, then runs validate on the command line. An agent that tries to call validate as a hosted tool will not find it; the context pack says where each step runs.

Suppressed aggregates are not errors

A value with fewer rows than min_group_size comes back as suppressed, and percentiles need 20 times the minimum. A small or skewed table can return little. That is the rule working; ask the data team for what you need instead of lowering the minimum.

Custom roles take a minute to exist

Symptom: the first apply fails with 400, a role that “does not exist”, right after creating it.

Fix: IAM propagates custom roles after a short delay. Plan again a minute later, read the plan, and apply it.

In the repository and CI

The context pack goes stale on purpose

pipewright context check fails after a Pipewright upgrade, a manifest change, or any change to a use case’s YAML or SQL, including a new use case. Rebuild it in the same pull request: pipewright context build --env <env>, then commit. The onboarding playbook ends with that step. Since 1.3.0 the stamp is the same on Windows and Linux checkouts (paths and line endings are normalised); a pack built with an earlier development build on Windows may need one rebuild.

Local tools forbidden

With ai.local_tools: forbidden in the manifest, the local pipewright mcp refuses to start for that environment: use the hosted server. context build and context check still work in an environment with a hosted server, since its agents need the pack too; without one, they refuse as well.

CI must be able to create tables

Symptom: a release from CI stops at tables sync with a permission error for a new use case.

Fix: the CI identity needs to create and update tables in the team’s dataset, without data access. The Enterprise blueprint grants a custom role for it from 1.3.0; with the starter, check the CI identity’s roles on the dataset.

Runs must be able to read feature tables

Symptom: a run of a use case with features_from fails at ingest with 403 on the feature table.

Fix: list the feature datasets in the starter’s feature_datasets for the team; it grants the team’s runner read access to them. The agent identity gets metadata access only.

Installing from a private package repository

If CI installs Pipewright from your own Artifact Registry Python repository, set the GitHub variable PIPEWRIGHT_PIP_INDEX to its /simple/ URL; the workflows from ci init pass it to pip as an extra index.

In the agent’s work

  • Read the judgement calls. In testing, Claude Code flagged real questions without being asked (a daily schedule on monthly data retrains on the same rows; a feature a scheduled run cannot supply), and once worked around the playbook. The review bundle is where that surfaces; it is the reviewer’s job to weigh it.
  • The label is assumed to be 0 and 1. An agent never sees values, so the draft says so; the author checks.
  • Personal data columns are suggested, not known. An ID-like column is flagged; the author lists what really is personal.
  • The agent never merges, releases, approves or deploys. If it asks to, say no: its identity cannot anyway, and the certified settings never pre-approve those commands.
  • People paste data. Nothing technical stops a person pasting rows into a conversation. Say so in your team’s rules.