At libraries around the country, "Avoiding AI" workshops have elicited unprecedented demand.

This is a submission for DEV's Summer Bug Smash: Smash Stories powered by Sentry . "The best debugger is a well-rested mind armed with the right tools and a stubborn refusal to give up." The Call to Adventure It started like any other day. I was browsing GitHub, coffee in hand, when I stumbled across a repository that made me pause. The issue tracker was filled with bug reports that all had something in common. They were being ignored. Not because the maintainers did not care, but because these bugs were hard. They were the kind of bugs that hide in race conditions, platform edge cases, and security blind spots. The kind that make you stare at the screen for hours before the answer finally clicks. I am Aniruddha Adak , an AI Agent Engineer and Full-Stack Developer who builds autonomous systems. You can find my work on GitHub , read my blog at aniruddha-adak.vercel.app , or follow me on X and DEV . Over the past several months, I went on a bug-smashing spree that resulted in 373 merged pull requests across the open source ecosystem. This is the story of the most chaotic, educational, and rewarding debugging journeys from that adventure. Story One: The Security Breach Nobody Saw Coming The Project cognee is an open source AI memory infrastructure project. Think of it as the long-term memory system for AI agents. It stores, retrieves, and connects knowledge across conversations. It is ambitious, complex, and used by developers who need their AI systems to remember things. The Discovery I was reviewing the API layer, tracing how settings were updated. The POST /api/v1/settings endpoint caught my attention. It accepted a JSON payload and updated global configuration directly. No privilege check. No role verification. Just raw, unauthenticated power handed to anyone with a login token. My stomach dropped. In a production deployment, this meant any user could change LLM API keys, modify database connections, alter authentication settings, or disable security features entir

phronesis.world/laserbrain submitted by /u/phr0nes1s [link] [留言]

A test failure that takes 20 minutes to surface, buries the error in 3000 lines of log output, and gives no context about what changed is nearly useless. Good test reporting transforms raw pass/fail data into actionable signals. Failing fast — stopping the pipeline the moment you have enough information to make a decision — keeps feedback loops tight and respects developer time. These two concerns are deeply connected: you can only fail fast confidently when your reporting is good enough that a fast failure still gives you everything you need to fix the problem. What Good Test Reporting Looks Like Before discussing implementation, it's worth being precise about what "good" means here: Immediate visibility — failures are surfaced at the PR/commit level, not buried in logs Failure context — what failed, with what input, producing what output, and in which file/line Historical comparison — is this a new failure or a pre-existing one? Trend data — is this test getting flakier? Is the suite getting slower? Actionability — the report points to a fix, not just a symptom Most teams get #1 and stop. The teams that nail all five have fundamentally different debugging velocity. JUnit XML: The Universal Format JUnit XML is the lingua franca of CI test reporting. Almost every test framework can emit it, and almost every CI platform can ingest it. Understanding the format helps you produce better reports. <?xml version="1.0" encoding="UTF-8"?> <testsuites name= "My Test Suite" tests= "42" failures= "2" errors= "0" time= "8.432" > <testsuite name= "UserService" tests= "15" failures= "1" time= "2.1" > <testcase name= "should create user with valid email" classname= "UserService" time= "0.234" > <!-- Empty = passed --> </testcase> <testcase name= "should reject duplicate email" classname= "UserService" time= "0.089" > <failure message= "Expected 409, got 200" type= "AssertionError" > Expected status code 409 but received 200 Request: POST /api/users Body: {"email": "existing@example

I created Agent-Up , an open-source desktop app and local server for running multiple coding-agent environments on one machine. Worktrees isolate source code, not the runtime The problem is that Git worktrees isolate source code, but they do not isolate the running application. When several agents work on the same monorepo, each one may need its own: application processes, ports, Docker services, logs, runtime state. Without a shared runtime manager, agents end up coordinating those details through shell commands. That is fragile. One agent may reuse a port that another process still owns. A restart may leave an old process alive. Docker services may overlap. Runtime isolation per workspace Agent-Up manages those concerns per workspace. Each workspace gets its own process lifecycle, allocated ports, Docker services, logs, and runtime state. The desktop app also provides one browser session per workspace for reviewing its web applications. Agents control Agent-Up through MCP The current MCP interface supports: starting and stopping workspaces listing registered workspaces reading workspace status The Agent-Up server owns the runtime state behind those operations. That means the agent does not need to independently discover ports, track process IDs, or reconstruct the application topology through shell commands. The missing runtime layer for parallel coding agents This is relevant because current coding agents are increasingly used in parallel. The source-code side of that workflow is already well served by Git branches and worktrees. The runtime side is not. Agent-Up is intended to provide that missing runtime layer. Planned MCP functionality Planned MCP functionality includes: browser inspection and interaction, diagnostics, screenshots, health checks, Playwright flow export. Same workflow, more control Git still owns branches, commits, pull requests, and merges. Agent-Up just owns the local runtime around them. Agent-Up is open source View Agent-Up on GitHub Read t

An MCP server is a small app that extends an AI model's capabilities by giving it access to custom tools, a particular set of data or workflows. It's based on the Model Context Protocol, which is an open standard for connecting AI apps with these external sources. The most straightforward way to create an MCP server is to use the official SDK, implement a single function and mark it as a tool and then expose it through stdio (standard input/output) which you can register in Claude Code; it basically boils down to a single Python file with a single tool and connecting it end-to-end took us around 10 minutes. Background Generally, the Model Context Protocol defines two sides: The server — it's the app you write that you use to publish tools/data The client — for example Claude Code; it finds and calls available tools based on your permission As for the main purpose of the Model Context Protocol — before it was introduced, every AI app needed its own custom integration with every tool; the Model Context Protocol replaces this with a single standard connector, so to say it's like USB-C for the AI world — you have a single standardised port instead of having to use a separate cable with every device. In terms of the protocol, a tool is just a function that the model can decide to call. So if you want to build an MCP server, you do it when you want your model to have access to some resources you have (like your internal API or database for example) which aren't available through any of the already-published servers. Let's have a look at a minimal example of what such server might look like — a single Python file with a single tool that returns the number of words, characters and lines in the input text. Scaffold the project To set up the project we used uv (a CLI for managing Python projects) and installed the official SDK: uv init word-count-mcp cd word-count-mcp uv add "mcp[cli]" uv init word-count-mcp — initialises a new project called "word-count-mcp" with an uv proje

Qualcomm, the maker of processors powering numerous Android devices, is raising its prices.

AI specialists that join your Google Meet and gives feedback Discussion | Link

In 2017 the National Archives and Records Administration (NARA) released the JFK files in an unsearchable manner 🔍. I tried doing manual research 🕵🏻. I relied on their provided CSV file of metadata to look for relevant documents to discover something - but I was looking for a needle in the haystack. I didn't know where to begin - but at the very least, I wanted to be able to search the contents therein. At least the National Archives allowed me to bulk download the PDFs. From that, I was able to birth the Apario Writer . In 2020, I began with rails new phoenixvault 🐦‍🔥 and I proceeded on a Zoom call with DJ Nicke - a former animator at Disney - to watch me build the proof of concept of the crowd sourcing declass utility that I envisioned. You see, when I was 7 years old, I had a dream after watching a space focused science program on TV that involved me sitting at the home computer, but interacting with an advanced interface that would help me uncover the mysteries of the day and time of the era. In Stargate SG-1, this concept was explored with the Tolan where Nareem was shocked to discover what Teal'c found in the records buried within a full text interface. Connecting it back to the JFK files released by NARA, they were unsearchable. Agenda on why aside, what could I do about it? This proof of concept grew into a SaaS platform that cost me $7,000 per month to operate over 12 bare meta servers in a private cloud using ESXi. This interface worked, but it was going to be replaced by a cost saving solution architected from the ground up in Go to reduce the dependency graph of the SaaS solution down to a single binary . In order to do this, I needed to create a pipeline. Looking at the SaaS model, I had a series of sidekiq jobs that compiled the assets. In order to improve the performance of that process, running off from Ruby code, I needed to build a new binary from the ground up using Go. I took the course on YouTube from Matt Holiday called Programming In Go and wa

A coding agent can produce a confident patch for the wrong problem when the input is only: The upload sometimes fails. Please fix it. That sentence does not identify the smallest failing input, exact error, environment, expected result, frequency, or even whether the reporter reproduced it personally. If the first instruction is “fix it”, the agent has room to turn a suspected cause into a fictional fact. The safer sequence is: preserve the observed failure; record the real environment; state expected versus actual behaviour; reduce the failing case; prove whether it repeats; diagnose and repair only after that evidence exists. 1. Preserve the observed failure Capture the exact error, status code, incorrect output, affected route or command, timestamp, and smallest known input. Remove secrets and personal data before putting logs into an agent context. If the report came from another person and you have not reproduced it, label it as second-hand rather than silently upgrading it to fact. Weak: CSV imports are broken. Useful: At 14:22 UTC, POST /imports returned HTTP 500 for minimal.csv. Response: "column index out of range". The same account can import one-column.csv successfully. 2. Record the environment you can prove Inspect rather than guess: repository and commit; runtime version; operating system or container image; package lockfile; relevant feature flags; local, test, staging, or production target. Do not infer production configuration from your laptop. Environment differences are often part of the bug. 3. Separate expected and actual behaviour Write two observable statements: Expected: POST /imports accepts the smallest valid two-column CSV and returns HTTP 201. Actual: The same fixture returns HTTP 500 with "column index out of range". Neither statement should include the suspected root cause. “Expected: parser handles the off-by-one bug” already assumes the diagnosis. You have not earned that conclusion yet. 4. Reduce the reproduction Start with the repor