A user pinged me on Slack today: he'd upgraded DDEV to 1.25.3 and the AI agents in his projects had lost SSH. DDEV had tightened the web container permissions in the new version (on purpose, and rightly so), and my add-on was leaning on a detail that was never guaranteed in the first place. That fix is already out in the latest version, but it's a good excuse to go over everything that's changed these past few weeks in ddev-ai-workspace, my ecosystem of add-ons for working with AI agents on Drupal projects.
Bad form to say it myself, but I think it's the best system out there right now in Drupal for code quality and token price/usage.
The orchestrator is no longer the smart kid in class
I used to think the right way to use agents was to have a main conversation with a "smart" model (Opus, say), and let that model hand work off to the "cheap" agents (haiku/sonnet) for everything else.
But I've realized that an agent's main conversation is the most expensive part of the whole thing: its context travels in full on every turn (and they charge you for it), and it was mostly busy reading search results and handing out work.
That's over. The orchestrator now runs on a specific model (MODEL_MAIN) that you can set to whatever model you want. It defaults to haiku, and so far it works just as well as before, only much cheaper. Its only job is to delegate to the right agent, where each specialist agent declares the tier it needs (CHEAP, SMART, GENIUS or VISION), and the expensive model only steps in when it's actually needed (reviewing code in depth, reading a screenshot, sorting out the cheap model's doubts).
And one more important thing: code searches are banned from the main conversation. The code-explorer agent takes care of that, acting as a context firewall. It explores whatever it needs and returns only the conclusion, not entire file dumps. Small context, small bill.
With all this, we've gone from having a "boss" model babysitting the interns to having an "intern project manager" who only asks the boss in the moments when it's not sure who to delegate the task to. And we all know a motivated intern pays off better than a boss's salary.
Every model you want to use in OpenCode or Claude Code can be configured in .env.agents. So you can, for example, put a "smart" model in as supervisor only on tasks where you need a SMART or GENIUS, and use local models or DeepSeek V4 flash or Haiku for the rest. And if you'd rather go back to how it was, it's as simple as setting a smart, expensive model as MODEL_MAIN.
Better, Drupal-tuned agents and skills
A good chunk of these changes to the skill and agent prompts came out of distilling Fable (Anthropic's smartest model right now). I've tried to distill some of its best ways of working into a set of Drupal-specific prompts, so that any other model (local ones included) gets better results from them.
The drupal-ai-agents package (11 agents, 15 rules and 34 skills as it stands) has matured too. Code review is no longer a single pass: it's a 7-judge panel with a plan → implement → verify cycle. And there's a new epistemic-discipline rule I'm especially fond of, because it goes after the most dangerous flaw in these agents: evidence beats plausibility, and every claim carries its confidence level. An agent that says "I don't know" is worth more than one that makes it up and lies with a straight face.
New skills have landed too (render pipeline, accessibility, prepping drupal.org contributions, and session-distill, which turns what you learned in a session into reusable guides), along with rules for translations and for conventional commits in English.
That said, the agents are still on a tight git leash: by default they can't commit or push, and now that lock is configurable per tool with the GIT_ALLOW_COMMIT and GIT_ALLOW_OPERATIONS flags. For now I still prefer a human to press the final button, though some of the tests I've run look promising.
July's bugs
On top of the sshd broken by DDEV 1.25.3, a few more went down:
- The SSH diagnostics command assumed the web container's home was
/home/ddev. bd init(Beads, the internal task manager) was leaving traces in the project's.git/config. It no longer touches anything in the project: that config now lives in the container's global gitconfig.- A race condition when creating the telemetry config.
- The agent CLIs were going stale inside the image. They now auto-update when the container boots, so you won't see the "OpenCode or Claude Code is out of date" message anymore.
- The AI containers now trust DDEV's mkcert CA, so they can call
https://project.ddev.sitewithout certificate errors.
Multica, Atlas and knowing what you're spending
The OpenCode and Claude Code containers can now connect to Multica, an orchestrated-agents platform: with a server token and url in ~/.ddev/multica/.env.multica, each container starts a daemon, registers as a runtime and can receive tasks from a Kanban-style web interface. Across all your DDEV projects at once. Without a token and URL, the integration stays completely dormant and never runs. The container behaves exactly as always.
In my case I don't use Multica: I hook them up to Atlas, my custom-built replacement based on Multica, which also tracks my token usage, human hours, deliverable-phase estimates and a few other things. I'll walk through everything I've built with Atlas in detail down the line, because other freelancers and agencies are surely going to want to put together something similar. There's plenty here for a few articles.
How to update
If you already use the add-ons, updating is one command:
ddev add-on get trebormc/ddev-ai-workspace
ddev restartIs it finished? No, and I suspect it never will be. AI moves every week, and keeping up is hard.
And if you try it and something breaks, tell me. The sshd fix came straight out of a user who complained earlier today.
Special thanks to Fable these past weeks. Without it, none of this would have been possible. xD