oam.js enters public beta - plus Claude Code auto mode becomes the default, sessions that message each other, and Sonnet 5's 50% price rise

oam.js is in public beta at v0.9.0, and it is the thing we have been building quietly for a while. It is a JavaScript and TypeScript runtime on Rust and V8, and it is not trying to be the fastest runtime -- it is aimed at one workload the big runtimes are not tuned for. An MCP server is a small process that spawns constantly, does a little work, and then sits idle holding memory. A broker that starts a dozen of them pays the cold-start cost twelve times and then carries twelve idle footprints for as long as they live. That is the axis oam is built on: 35.00ms MCP cold start against Node's 250.87ms and Bun's 483.19ms, 25.23MB idle RSS against 61.34MB and 98.43MB, and 0.34ms first-call latency against 2.40ms and 5.04ms. Twelve idle sidecars is about 303MB of resident memory on oam, against roughly 736MB on Node and 1.18GB on Bun.

The launch post is the one I would actually point you at, because it publishes the losses. Bun beats oam on url-parse, on http-throughput, and on crypto-hash -- the last one not close, 38.99ms against oam's 223.89ms -- and Node edges it on fs-read. The framing is the part worth stealing regardless of whether you ever run this: "A percentage without a denominator is a marketing asset, not a measurement." The post also concedes that some of the cold-start gap exists because the MCP protocol surface ships inside the binary rather than being installed from npm, which is exactly the caveat a vendor benchmark normally leaves out.

The week's other story is that Claude Code flips to auto mode by default on Aug 14, and the case Anthropic makes for it is not that the classifier is safe -- it is that the classifier is less bad than you are and degrades more slowly. Across 1,053 paid testers the classifier caught 89% of dangerous commands and the humans caught 13.6%, but the number that decides it is the decay curve underneath: humans caught roughly 17% early in a session and about 5% after 50-plus prompts, while the classifier held flat. The pitch is attention over time, not a safety ceiling, which concedes the thing the permission prompt was supposed to be providing all along.

Also this week: Claude Code sessions can now message each other, self-hosted runners went to public beta, two sandbox settings turned out not to be enforcing what they looked like they enforced, and Sonnet 5's introductory pricing expires at the end of the month with a flat 50% rise behind it. Put that last one in your calendar rather than your inbox.

From us: Yaw Terminal shipped six releases, v2.0.18 through v2.0.23, and MCP Weekly is live at mcpweekly.com.

oam.js is in public beta

• oam.js v0.9.0 moved from pre-alpha to beta this week, and the site is up with install scripts for macOS, Linux, and Windows that drop a binary into ~/.oam/bin with no admin rights required. What it is: a single dependency-free binary that runs .ts, .tsx, and .jsx directly with no build step, Node-compatible down to node: builtins and CommonJS interop, purpose-built for MCP servers deployed as sidecars. What it is not, and the docs say so plainly: a general-purpose replacement for Node or Bun. Breaking changes are still possible before 1.0 -- v0.9.0 itself is a minor rather than a patch precisely because several child_process behaviors changed, including stdio being honored at all ('inherit' and 'ignore' used to quietly behave as 'pipe') and exec/execFile now enforcing timeout, so a child that used to run forever gets killed. The binaries are unsigned and verified against published SHA-256 checksums, and there is no linux-arm64 build yet
• "Oam.js: a runtime for TypeScript and MCP servers, with the denominators attached" is the launch post and the benchmark table in it is the whole argument, wins and losses in the same grid. oam takes cold-start (59.58ms vs Node 113.42ms vs Bun 307.97ms) and every MCP-specific measure by a wide margin. Bun takes url-parse, http-throughput, and crypto-hash; Node ties on fs-read. The recommendations at the end name competitors without hedging: Node if you need native addons, Bun if single-process throughput is the axis you are optimising. Provenance is attached too, which is the other thing these tables usually omit: cargo run -p xtask -- bench --release --compare at a named commit, release profile, one windows-aarch64 machine, oam 0.9.0 against Node v22.22.2 and Bun 1.3.14. The post also flags that this table replaced an earlier one that was wrong twice over, including a harness bug that split tasklist output on its own thousands separator and reported 40.65MB where the real idle RSS was 25.23MB -- an error that had been understating oam's advantage
• "MCP servers as sidecars: what a runtime owes a fleet of small processes" is the thesis post, and it is the one to read if you are deciding whether any of this applies to you. The claim is that sidecar fleets invert the assumption every general-purpose runtime is tuned around: a web service amortizes startup across hours of traffic, while a broker spawning a dozen mostly-idle servers pays cold start every time the fleet restarts and holds all twelve idle footprints in between. It works the three rows that matter off the same table as the launch post -- mcp-cold-start, mcp-idle-rss, mcp-first-call-latency -- and then multiplies out: twelve idle sidecars hold about 303MB on oam, 736MB on Node, and 1.18GB on Bun. The plain cold-start row is the useful control, 59.58ms against Node's 113.42ms, because the gap there is roughly 2x where the MCP row is over 7x, and the difference between those two ratios is the protocol stack rather than the runtime. It states that caveat directly, that the protocol surface shipping in the binary is part of why the cold-start gap is as wide as it is
• "Running TypeScript without a build step (and where the types actually go)" is the most broadly useful of the six, because the answer to "where do the types go" is the part these pitches usually skip -- oam executes the file immediately and streams type diagnostics rather than blocking on them, which is a real tradeoff and not a free lunch. The post is also honest about ESM interop edges. Three more went up the same day, on why the binaries ship unsigned and checksummed, why there is no linux-arm64 build yet (V8 startup snapshots do not cross-compile), and the v0.9.0 release notes

Auto mode becomes the default

• Auto mode is the default in Claude Code starting Aug 14 for new sessions on Pro, Max, and Team. Enterprise, the Claude API, Bedrock, Google Cloud's Agent Platform, and Microsoft Foundry stay opt-in for now, with Anthropic saying auto mode becomes standard across deployments within a month. If you have already set a default permission mode you get a one-time prompt rather than a silent switch, and a default pinned through managed settings does not move at all. Shift+Tab still changes mode in the CLI, and admins can disable auto mode outright. The operational detail most worth knowing is the escalation rule: a blocked action returns to the model as a tool result telling it to find a safer path rather than route around the block, and after three consecutive blocks or twenty in a session the system stops and hands control back to you. In headless mode it terminates instead, which is the behavior to plan for if you run Claude Code in CI. Separately, and effective immediately, the classifier's own token overhead no longer counts against usage limits on Pro, Max, and Team

Claude Code this week

• Claude Code sessions can message each other as of v2.1.224 on Aug 7, on macOS and Linux. Two tools do it: ListAgents to discover reachable sessions and SendMessage to deliver text to one by name. Three properties matter. Sessions on the same machine talk directly without going through Anthropic's servers. Only text crosses -- not conversation history, not files, not permissions -- so the receiving session gets a summary and picks it up mid-task rather than inheriting your context. And a message sent to a session running with bypassed permissions is held for your approval, governed by the new crossSessionInbound and dialogExpiry settings. The docs call the result "loosely coupled agent teams," which is a fair description of the difference from subagents: those live inside one session's scope, these cross machines. v2.1.225 extended it so you can start a conversation with a Remote Control session on another machine by name instead of only replying once it has messaged you first
• Self-hosted environments went to public beta on Aug 6, landing in the CLI at v2.1.224 as claude self-hosted-runner. It turns your own machines or containers into a place Claude Code web, mobile, and desktop sessions can run, on Team and Enterprise, which is the answer for anyone who wanted the hosted surfaces but could not send the code off-premises. The following release fixed the failure mode you would actually hit -- a runner registering successfully and then failing every session because --base-dir could not be created or written now exits at startup with a real error
• Two sandbox fixes in v2.1.224 are worth reading as security items rather than changelog entries. Filesystem deny entries written with a trailing slash, denyRead: "~/.aws/" being the example in the changelog itself, were silently bypassable on Linux and macOS -- if you wrote your deny list that way, it was not enforcing what you thought. And sandbox violation details never made it into Bash tool results, so the model could not see which file or network access was denied or why, and would retry blindly. New in the same release: credential masking gained extract and onExtractNoMatch for structured env values, decode: "jwt" with maskClaims for JWT-aware masking, and awsPairs/sigv4 for AWS SigV4 re-signing. These require network.tlsTerminate and are honored only from user, managed, or --settings settings
• The rest of v2.1.224 through v2.1.226, briefly. The 200-subagent-per-session spawn cap is gone, so long-running sessions stop refusing new agents, with concurrency and depth limits still in force. Project paths longer than 200 characters could resolve into another project's session directory under a shared sanitized prefix, which meant session list, rename, fork, delete, and /resume could cross projects -- fixed, and worth a look if you work in deeply nested paths. SendMessage reporting "Message sent" when the write to a teammate's inbox had actually failed is fixed. A new archive plugin source installs plugins from a zip over HTTPS with optional SHA-256 pinning, no git or npm required. And v2.1.225 fixed auto mode counting a safety-filter refusal of its own permission check toward the consecutive-block limit, which is a neat illustration of how many edges that escalation rule has

Sonnet 5's introductory pricing ends Aug 31

• Sonnet 5 moves to standard pricing on Sept 1: $2/$10 per million input/output tokens becomes $3/$15, a flat 50% rise, across the Claude Platform, Claude Code, and Bedrock. Nothing about this is a surprise -- it was published as introductory pricing at launch -- but "we knew it was coming" and "the forecast was updated" are different states. If you sized a budget, a margin, or a per-seat price against $2/$10, that assumption expires in three weeks. This is also the item that makes the caching argument from last week's Manifest post concrete: when the floor moves under you, cache-hit rate is the lever you still control

The platform side

• Managed Agents sessions can carry a hard budget as of Aug 7 -- a spend cap on the session that pauses it when exhausted, rather than a dashboard you check afterward. The same release added advisor model support for mid-turn consultation, inference geo controls for data residency, and automatic skill discovery from GitHub repositories. The CLI side of this showed up in v2.1.225, where a gateway spend limit now names the cap, its reset time, and the operator's message in the usage warning instead of failing opaquely
• Two Enterprise controls landed either side of it: inference hooks in beta on Aug 5, which enforce real-time DLP across chat, Claude Code, and Cowork through a compliance server, and security scanning in beta on Aug 6 for detecting malicious content in skills and plugins. Read the second one next to the archive plugin source above -- installing plugins from a zip over HTTPS and scanning plugins for malicious content shipped the same week, which is not a coincidence
• Also on Aug 7, a Fable 5 safeguards update cut biology-related fallbacks by roughly 85% across product surfaces. Refusals on benign biology, health, and educational questions have been a real complaint, and this is a classifier precision fix rather than a policy change -- dual-use content stays blocked

From us

• Yaw Terminal shipped six releases this week, v2.0.18 on Aug 2 through v2.0.23 today. The MCP panel got a guard on the local-servers pull and a working Clear affordance for env values, connections gained bulk import/export with atomic multi-save and keybinding hardening, and the ultracode path stopped losing launch writes on slow or type-ahead launches. The release now bundles the oam JS/TS runtime the same way it bundles the micro editor, which is the first place the runtime above shows up in a shipping product. Underneath that, most of the week's commits were tests -- MCP invariant coverage, ultracode pool and overlay gates, and the yaw-mode hook diagnostics now delivered through context instead of stderr. typed is at v1.2.35
• MCP Weekly is live, and it is the second publication out of Yaw Labs. The premise is one MCP server per issue, wired into real work start to finish -- the config that worked, the parts that broke, and whether it was worth reaching for. It is deliberately not a changelog digest or a server ranking, which are the two shapes this space already has plenty of. The site is up and the first real issue lands shortly; if that is your kind of thing, subscribing now means you get it when it does