How I Built The Daily Sort

Before I make a guess in Connections, I like to sort all sixteen words into groups first. While I sort, I’m looking for the red HERRING, the DECOY word that fits two groups. It usually shows up as an OVERLAP: five words that seem to fit one group, where the FIFTH one belongs somewhere else.

I wanted a place to work that out before guessing, so I asked Claude Code for a scratch pad. The Daily Sort loads the day’s board and lets you paint each word a color. If five tiles end up the same color, the counter shows 5/4 in red.

It doesn’t have the answers. It only has the sixteen words.

Before any of the daily-board code, I asked Claude for a write-up of how it would work, the same way I start every Shark Thief depth in plan mode. The write-up caught the hard parts early: where the key lives, how to make sure the lookup only happens once, and what to do when two people click at the same time.

Claude finds the board with web search. That costs money and takes 10 to 40 seconds, so it only happens once a day and everyone shares the result.

When you load the page, it checks the CACHE for today’s board. If it’s there, you get it in about a second. If not, the site takes a LOCK for the day, so two people clicking at once still make one lookup. It starts the lookup in a background function, and your browser starts to POLL, asking again every 3 seconds. When the lookup finishes, the site will SAVE the board for everyone else that day.

I also set up a job that runs just after midnight Eastern and does the first lookup itself. Connections resets at midnight in your own time zone, and most people who’ll see this are in the US, so most days nobody waits at all.

I wanted the page to show its work, too. Under the board it lists every request it made, the steps the server says it took, and a plain-English line on what that means.

All the code that talks to Claude lives in one file: netlify/connections/claude-source.mjs. Nothing else calls the API. The rest of the code decides when to ask, and what to do with the answer.

It’s the same habit as keeping every Shark Thief setting in one config file. When I want to change how the lookup works, I know where to look, and so does Claude.

The PROMPT

It names the exact date, asks for JSON and nothing else, and says what to send back when the board isn’t online yet. The last line is there so Claude sends an empty list instead of guessing.

const prompt = (date) => `Find the 16 words on the New York Times Connections puzzle for ${date}.

Search for that exact date and make sure the board you report is for ${date}, not a neighbouring day.
Spell each word exactly as it appears on the board.

Reply with only this JSON and nothing else:
{"words": ["WORD1", "WORD2", "..."]}

If you can't find the board for ${date}, reply with {"words": []}.`

The MODEL

This job is just finding sixteen words, so the cheapest model goes first. If the API rejects the request, the next one runs. Each model only gets the settings it accepts.

export const MODEL_CHAIN = [
  {
    model: 'claude-haiku-5-5',
    // Basic search: results go straight into context, which is cheap here
    tool: { type: 'web_search_20250305', name: 'web_search', max_uses: 3 },
    extra: {},
  },
  {
    model: 'claude-sonnet-5-5',
    tool: { type: 'web_search_20260209', name: 'web_search', max_uses: 3 },
    // If a safety filter declines, the API retries on another model
    extra: { betas: ['server-side-fallback-2026-07-01'], fallbacks: 'default' },
  },
]

The SEARCH

This is the actual call. The search tool comes from the list above, capped at three searches, and effort is set to low.

response = await client.beta.messages.create({
  model,
  max_tokens: 4000,
  output_config: { effort: 'low' },
  tools: [tool],
  ...extra,
  messages,
})

There’s no list of allowed sites. My first version had one, and the first real lookup failed. Two of those sites block Anthropic’s crawler, and the API rejects the whole request instead of skipping them.

The PARSE

Claude’s answer comes back as text mixed in with search results. This pulls the JSON out. If it isn’t JSON, the first 300 characters go into the error, so the logs show what Claude actually said.

export function parseWordsReply(content) {
  const text = content.filter((b) => b.type === 'text').map((b) => b.text).join('')
  const json = text.slice(text.indexOf('{'), text.lastIndexOf('}') + 1)
  try {
    const { words } = JSON.parse(json)
    return Array.isArray(words) ? words : []
  } catch {
    throw new SourceError('bad-reply', `Reply wasn’t the JSON we asked for: ${text.slice(0, 300)}`)
  }
}

Once it worked, I asked Claude for a security audit. The biggest problem it found: the lookup runs at a public URL, and anyone could call it directly for a date with no board yet. Every call would spend money. In a local test, fifty calls made fifty lookups.

Now the page’s own server has to SIGN every request with a key only it has, and the lookup refuses anything unsigned.

export function signDate(date, secret) {
  if (!secret) return null
  return createHmac('sha256', `connections-fetch:${secret}`).update(String(date)).digest('hex')
}

Both sides also enforce a CAP: a 10-minute wait after any lookup that didn’t save a board, and at most six lookups per date. The same fifty calls now make one.

It also flagged that Claude reads whatever pages the search turns up, and a page could try to steer it. So a FILTER checks the answer before anything is saved: sixteen unique words, short, plain characters, no web addresses and no bad words.

export function checkWords(words) {
  if (!Array.isArray(words)) return null
  const clean = words.map((w) => (typeof w === 'string' ? w.trim() : '')).filter(Boolean)
  if (clean.length !== BOARD_SIZE || !clean.every(isCleanWord)) return null
  const unique = new Set(clean.map((w) => w.toLowerCase()))
  return unique.size === BOARD_SIZE ? clean : null
}

I also checked the cost. The first real lookup ran on Opus, which this job doesn’t need. It runs on HAIKU now, with Sonnet as the fallback.