AI 资讯

> TL;DR — I run four different domains off one Next.js codebase: a marketing site at pagestrike.com , an authenticated app at app.pagestrike.com, a public publishing domain at pagestrike.app, and customer-owned domains. The trick isn't deploying four apps — it's a single proxy.ts that reads the host and rewrites/redirects/passes-through per-request. This post walks through why I chose this shape, the parts I got wrong, and the cookie-domain trick that makes it all stick. Stack: Next.js 16 App Router , Supabase , Vercel , one proxy.ts file (~370 lines). This is the second post in my build-in-public series on PageStrike . Last week I wrote about the 6-CTA architecture — modeling conversion intent as a discriminated union so one launch could be a checkout, a COD form, or a calendar booking. This post is about a different primitive: modeling host as routing context so one codebase can serve four very different audiences. Why four domains, not one Most SaaS apps live at one domain — say myapp.com with /dashboard under it. That works until you grow into edge cases that don't fit: Marketing pages get spammed by your own dashboard headers. Your marketing nav says "Sign in / Pricing / Blog". Your dashboard nav says "Launches / Contacts / Settings". You either A/B them with conditional logic everywhere or you live with the noise. Public user-generated pages share your domain reputation. When a customer publishes a landing page at myapp.com/p/[slug] , every spammy LP from a free-tier user drags down myapp.com 's sender reputation, search trust, and ad-account standing. Google and Meta penalize the host, not the path. Custom domains don't route cleanly. A customer who buys acmewidgets.com and points it at your app expects their LP at acmewidgets.com/ — not myapp.com/p/acme-widgets . You need a rewrite that's transparent to the visitor, doesn't 404 on _next/static/* , and survives RSC prefetches. I split PageStrike — a free AI landing page builder — across four hosts to solve al

hey guys, i’ve been frustrated for a while by how bloated and ad-heavy existing wheel fitment databases are. if you’ve ever tried to look up a simple bolt pattern or offset, you know the pain: 3 trackers, 5 pop-ups, and a database that looks like it was built in 2005. so i decided to build a "zero-bloat" alternative: https://boltpatternhq.com/ the core challenge here wasn't the AI part—it was the data structure. i needed to map 10,000+ vehicles with PCD, center bore, and offset specs in a way that was instantly searchable but didn’t require a massive backend hit. a few technical details for those curious: architecture: the site is served as a pure static frontend (html/css/js). no backend, no server maintenance. search: i’m using a pre-computed client-side search index (json-based) for the auto-complete. it’s instant, local-first, and keeps the search experience snappier than any backend call. ai integration: this is the fun part. i'm using cloudflare workers ai to run the models directly at the edge. it avoids all the typical "openai wrapper" latency and cost issues. the model is constrained specifically to my structured database, which helps keep the fitment advice precise and prevents it from hallucinating wildly. it’s still a work in progress, but the goal was to create something "utility-first" for car guys who just want the specs without the tracking trash. i'm currently looking for feedback on the ux of the search widget and the load performance. does the search feel snappy enough on your side? would love to hear what you guys think about the tech stack. submitted by /u/SideQuestDev [link] [留言]

I have been thinking a lot about coding agents lately. Not really about whether they can write good code, because usually they can, sometimes they can't. That part is obvious. But the risk is shifting from wrong answers to wrong outcomes. The part that feels more important to me is this: should the agent actually own the write authority? We already don't trust humans without roles, limits, reviews, and accountability. Developers use PRs, pilots use checklists, bank clerks have transfer limits. Capable agents need the same structure, but machine-readable. Right now a lot of setups still look roughly like this: agent reads the repo agent decides what to change agent has a GitHub token agent creates commits, branches, or PRs I don't think this is the right default. The agent can reason. The agent can inspect files. The agent can propose changes. But the moment it can directly create external impact, the problem changes. It is no longer just: did the agent say something wrong? It becomes: did the agent create the wrong outcome? That is a much more expensive failure mode. Intent is not authority The pattern I like more is simple: agent reads directly agent proposes intent a boundary decides an adapter materializes only admitted work So the agent does not get the write credentials. It submits a structured intent instead, which could look like: { "operation" : "write" , "target" : { "repo" : "example/app" , "branch" : "main" , "path" : "docs/config/agent-policy.md" }, "source_state" : { "blob_sha" : "8f31c2..." }, "requested_effect_hash" : "sha256:..." } This is then not a command anymore, it is a suggestion, or an intent. The system still has to decide whether this proposed outcome should exist. That decision layer can check things like: is this actor allowed? is this repo allowed? is this path in scope? does the source state still match? is this operation allowed? was the same effect already created? should this become a reviewable PR? Only after that should there be an

Pulling together this week's major AI releases for anyone who didn't have time to track every blog post. Sticking to substantive changes, not hype. Anthropic — Claude Opus 4.8 Released this week. Headline pricing unchanged, but Fast Mode dropped from $30 input / $150 output per million tokens to $10 / $50 — a 3x reduction on the premium tier. Reported improvements in "judgment" and longer autonomous runs. Also shipped 20+ legal MCP connectors and Microsoft 365 add-ins (Excel, PowerPoint, Word) in GA. Alibaba — Qwen 3.7 Max Launched May 20 at Alibaba Cloud Summit. 1M-token context. Reported to top Claude Opus 4.6 Max on Terminal-Bench 2.0, SWE-Bench Pro, and MCP-Atlas. Pricing $2.50 / $7.50 per million tokens — roughly half of Opus 4.7. Alibaba claims autonomous operation up to 35 hours without performance degradation. Alibaba is now ranked #6 lab globally on Arena text leaderboard. OpenAI — GPT-5.5 Instant Now default in ChatGPT. Reports 52.5% fewer hallucinated claims than GPT-5.3 Instant on high-stakes prompts (medicine, law, finance). OpenAI also shipped a ChatGPT sidebar inside Excel and Google Sheets, plus a personal finance dashboard for Pro users (US only). Google — Gemini 3.5 Flash Reported to beat Gemini 3.1 Pro on coding and agentic benchmarks at ~4x faster output token rate. Ultra subscription cut from $250 to $200/month; new $100/month Developer tier introduced. xAI — Grok Build 0.1 Coding agent moved to public API beta May 28. Custom Skills feature added for reusable user-defined tasks. Connectors for SharePoint, OneDrive, Notion, GitHub, Linear, plus bring-your-own MCP support. Mistral Launched Vibe (unified work + code agent, replaces Le Chat). Acquired Emmi AI for physics-based simulation. Targeting €1B revenue in 2026; new 10MW inference DC announced. Hugging Face Launched an app store for the Reachy Mini robot. ~10,000 units shipped. Also reported a malicious repo masquerading as an OpenAI release that accumulated 244K downloads before takedown — r

I mostly use Claude Code, but lately I've been using Codex CLI and Codex.app (hereafter "Codex") more often too. My environment is macOS. However, after I started using mise in [2026-03-29-1] , I ran into trouble because Codex wouldn't use the mise-managed Ruby, Node.js, and so on. Here's the state I was in: $ where ruby /usr/bin/ruby $ ruby --version ruby 2.6.10p210 (2022-04-12 revision 67958) [universal.arm64e-darwin25] The Solution I solved it by adding the following to ~/.zshenv : # When Codex CLI and Codex.app run commands, .zshrc's mise activate zsh doesn't take effect, # so add mise shims to PATH. if [ -n " $CODEX_SANDBOX " ] ; then PATH = ${ XDG_DATA_HOME } /mise/shims: $PATH fi Here's the state inside Codex after the change: $ where ruby /Users/masutaka/.local/share/mise/shims/ruby /usr/bin/ruby $ ruby --version ruby 4.0.5 (2026-05-20 revision 64336ffd0e) +PRISM [arm64-darwin25] Codex's Command Execution Environment Is a Sandbox I'd vaguely suspected this for a while, but it seems Codex's command execution environment runs inside a sandbox. You can spot the clues from within Codex: $ env | grep CODEX CODEX_CI=1 CODEX_SANDBOX=seatbelt CODEX_THREAD_ID=019e7806-6025-7c13-a3c6-a70d41c13905 "seatbelt" refers to Apple Seatbelt, which appears to be macOS's sandboxing mechanism. 🔗 macOSで手軽にSandbox環境を構築できるApple Seatbeltの実践ガイド しかしながら、Apple Seatbeltは公式にドキュメントを公開されておらず、非推奨とされています。一方で実際には多くのアプリケーションやツールで使用されています。 (English translation) However, Apple Seatbelt has no officially published documentation and is considered deprecated. Yet in practice, it's used by many applications and tools. I see... According to this article, Claude Code also adopts Apple Seatbelt, and I confirmed that it can be enabled with /sandbox (see the official documentation ). Coming from a background of being used to Claude Code, Codex's sandbox is hard to wrap my head around, but the following article covers it in detail. Much appreciated. 🔗 [Codex] sandbox実行の仕組みと設定方法を完全に理解する Codex also seems to r

AI coding tools have moved way past autocomplete. Today's CLI agents read your entire codebase, plan changes across files, run tests, and even open pull requests - all from the terminal. Picking the right one matters, and in 2026 there are several solid options worth knowing. Why CLI Over IDE? IDE plugins work within a single editor and optimize for in-file completions. CLI agents operate at the shell level - they run commands, manage files across your whole repo, handle Git, and work in remote servers or CI pipelines. They don't lock you into one editor either. You keep your existing setup and layer the agent on top. Claude Code (Anthropic) Claude Code is Anthropic's official terminal agent and the top-ranked CLI tool in 2026. It handles complex, multi-file tasks better than most - analyzing architecture, coordinating edits across files, reviewing PRs, and running multi-step refactors. Supports custom slash commands and sub-agents for team workflows. Pay-per-token pricing with no free tier. Codex CLI (OpenAI) OpenAI's open-source terminal agent. The standout feature is sandboxed execution - code runs in isolation before touching your filesystem, reducing risk of irreversible changes. Fast to start, minimal footprint, and supports one-shot mode for CI pipelines. Best for OpenAI-stack teams that want a safety net around agentic execution. OpenCode A fully open-source agent supporting 75+ model providers - Anthropic, OpenAI, Google, Mistral, and local models via Ollama. Switch providers mid-session. Uses a dual-agent system: a Plan agent for structured reasoning and a Build agent for implementation. LSP integration brings real code intelligence into the terminal. Free with local models. Aider Aider has the largest installed base of any open-source CLI agent - over 4.1 million installs. Its Git-native design is the key differentiator: every change gets auto-committed with a descriptive message. If something breaks, git revert gets you back instantly. Supports any model

Look at your modern Agentic AI stack. An agent wants to execute a tool, trigger a deployment, access a database, or call an external API. Because nobody fully trusts a probabilistic black box, many teams now use a second probabilistic black box to validate the first one. Think about what is actually happening. You are running hundreds of billions of parameters, consuming tokens, burning GPU resources, and adding hundreds or thousands of milliseconds of latency just to answer a simple operational question: PASS HOLD RED Or in plain English: Continue Verify Stop For many production systems, that's the only decision that matters. Yet we often spend orders of magnitude more compute determining whether an action should execute than executing the action itself. That feels dangerously close to architectural bankruptcy. The Illusion of Prompt-Based Safety We've all done it. You create a prompt: "You are a security validator. If the action appears unsafe, return RED." Then reality arrives. Prompt injections appear. Edge cases appear. Different model versions behave differently. The same input occasionally produces different outputs. And your cloud bill keeps growing. At some point, a difficult architectural question emerges: Can a probabilistic system reliably govern another probabilistic system? Many teams assume the answer is yes. I'm not convinced. The Problem Isn't Intelligence This is where I think the industry may be looking at the problem incorrectly. The challenge is not intelligence. The challenge is governance. LLMs are exceptional at: Reasoning Summarization Code generation Natural language interaction But governance is a different problem. Governance is not asking: "What is the best answer?" Governance is asking: "Should this action be allowed to proceed?" Those are fundamentally different questions. A Different Architecture While exploring this problem, we ended up building a separate deterministic governance layer internally. Instead of generating text, it perf

AI placement latency is not the problem most teams think they are managing. The default framing treats it as an optimization variable — pick the cheapest compute that meets the SLA, centralize inference, optimize for utilization, revisit locality later when the architecture matures. That framing is wrong in a way that compounds over time. AI placement decisions are not continuously reversible optimization choices. They are architectural commitments that harden incrementally — through inference path configuration, data gravity, routing dependencies, and runtime behavior that normalizes around whatever topology you chose first. By the time latency SLAs begin failing, the placement topology is already embedded across routing, observability, and application behavior. The remediation cost is not an optimization exercise. It is a re-architecture. The First Optimization Becomes the Permanent One Cost is the default optimization axis for AI placement decisions. Centralized GPU clusters are cheaper to operate per token than distributed inference endpoints. Utilization density justifies centralization on paper. Procurement processes reward it. FinOps tooling measures it. So teams centralize. They optimize the compute economics. They defer locality decisions to a later phase when requirements are better understood. That later phase rarely arrives before the architecture has already made the locality decision implicitly — through the inference paths built against a centralized endpoint, the data gravity that formed around it, and the application behavior that normalized against the latency profile it produced. The pattern this creates is latency debt: accumulated runtime latency overhead from placement decisions that optimized for cost before locality requirements were operationally visible. It accrues gradually, stays invisible until something triggers it, and is significantly more expensive to resolve after the fact than it would have been to avoid at design time. It does not

AI coding tools are no longer just autocomplete. In 2026, they are becoming coding assistants, terminal agents, code reviewers, and sometimes full workflow helpers. But the real question is: Which AI coding tool should developers actually use? Here is a short, practical comparison. Quick comparison Tool Best for Main strength Watch out for GitHub Copilot Daily coding inside IDE Fast autocomplete and GitHub workflow support Can feel limited for deep architecture work Cursor Full AI-first coding experience Great for editing across files and working inside a project You may rely on it too much without reviewing code Claude Code Terminal-based agentic coding Strong reasoning, repo understanding, and command execution Needs careful review before running changes Gemini CLI Open-source terminal AI agent Good for terminal workflows, debugging, and automation Output quality depends heavily on task clarity 1. GitHub Copilot GitHub Copilot is the safest default choice for most developers. It works well inside common IDEs and is useful for: Autocomplete Small functions Unit tests Refactoring Explaining code GitHub-based workflows GitHub also has Copilot coding agent support, which can work on assigned tasks, make code changes, and open pull requests from GitHub workflows. :contentReference[oaicite:0]{index=0} Use Copilot if: You want AI help without changing your full coding workflow. Best for: Junior to senior developers Teams already using GitHub Everyday coding productivity 2. Cursor Cursor is best when you want an AI-first editor experience. Instead of only helping with one line or one function, Cursor is useful when you want to ask questions about your whole project and make multi-file changes. Use Cursor if: You want your editor to feel like an AI coding workspace. Best for: Building features quickly Editing multiple files Understanding unfamiliar codebases Indie hackers and startup builders My honest take: Cursor is very productive, but developers should avoid blindly ac

In November 2023 we ran our first global Hytale servers on Google Kubernetes Engine using Veltrix 3.2 as our configuration orchestrator. The Treasure Hunt Engine—a service that fans spawn to claim event loot—started crashing every time search volume exceeded 12 k RPM. Grafana showed a steady climb of 503 errors on /hunt/claim until the autoscaler maxed out at 32 G1 CPU cores and still couldnt keep up. Operators kept filing tickets that boiled down to one sentence: We click the map, nothing happens. We never saw the actual error because the ingress controller was swallowing it and returning a generic Too many requests. What we tried first (and why it failed) Our first move was to crank up the nginx-ingress-controller replicas from 3 to 12 and switch the load-balancer tier from GKE Standard to Premium. The 503 rate dropped to 8 k RPM, but now the p99 latency on claims spiked from 80 ms to 420 ms. The culprit was a recursive call in the hunt service: every claim required a round trip to the player-profile service to validate tier eligibility, and that service was on a shared Postgres 15.4 cluster with 3 k TPS of unrelated traffic. The error stack in Jaeger was literally tracing_id=7f3a1c8… server=profile-db pool_timeout . We tried adding connection pooling with PgBouncer, but the hunt service was using raw libpq and refused to reuse connections—no matter how many times we told it. The Architecture Decision We ripped the validation out of the synchronous path and made the hunt engine publish an event called HuntTierCheckRequired to a dedicated Kafka topic player-events-tier . The hunt service would respond to the client with a 202 Accepted immediately, then the loot-claim worker would listen to that topic and, if the tier passed, publish HuntLootReady . The worker ran in the same pod but on a separate goroutine with a 60-second TTL so we didnt leak memory if the tier service hung. We moved the player-profile service to an SSD-backed CloudSQL instance and gave it 32 GB R

Based on real QA scenarios. About what happens when AI-generated metrics replace real testing, and the quiet engineer in the back row has been running his own numbers the whole time. Act 1: The Review Meeting I was sitting at the back of the long table, a ThinkPad in front of me, screen dimmed. On the big screen, Zhang Lei was presenting the acceptance data for his "AI Automated Testing Platform." His delivery was smooth. Every slide was a beautiful chart — coverage trends, automation rate improvements, regression testing time curves. All three lines pointed up and to the right, exactly like the textbook ideal curves. "In the past three months, the AI testing platform has executed 47,000 test cases, achieving 97.3% functional coverage. Regression testing time has dropped from 12 hours to 2.1 hours." Sparse applause. Zhang Lei added the final slide: "Monthly savings: approximately 200 person-days in labor cost." General Manager Zhou nodded and started the applause. That number was what he cared about most. I glanced at the other end of the table — the client's representative from RuiJie Technology. Chief Engineer Shen. Early fifties, thinning on top, silver-rimmed glasses. He hadn't said a word through the entire presentation. Hands folded on the table, occasionally jotting notes in a small book. Zhang Lei opened the Q&A slide and looked around the room: "Any questions?" Chief Engineer Shen flipped through the printed materials in front of him, stopped at the appendix, and looked up. "Page 47, Table 3.2 — what's the confidence interval on that 97.3% coverage?" The room went silent for about 15 seconds. Not the kind of silence where people are thinking. The kind where nobody had ever thought about it. Zhang Lei stood by the projector, clicker still in his hand, paused for two seconds: "Uh... the model confidence is quite high. The specific number is in the technical report." "Which page?" "I'll need to look it up." Chief Engineer Shen didn't push further. He looked do

<form action= "https://bank.com/transfer" method= "POST" > <input name= "to" value= "attacker" > <input name= "amount" value= "10000" > </form> <script> document . forms [ 0 ]. submit () </script> Five lines of HTML on a malicious page. When a user who's logged into bank.com in another tab visits this page, the browser auto-submits the form, attaches their session cookie, and ten thousand dollars leave their account. They didn't click anything. The malicious site didn't see their password. There was no XSS, no breach, no leak in the traditional sense. The browser did exactly what it was designed to do. That's CSRF — Cross-Site Request Forgery — and it's been the classic "confused deputy" attack on the web for two decades. Let's walk through what makes it work, why CORS doesn't help, and the one cookie flag that mostly killed it around 2020. Why the browser attaches your cookie to that request Cookies belong to a domain. When you log into bank.com , the bank sets a session cookie in your browser: Set-Cookie: session=abc123; HttpOnly From that point on, every single request your browser sends to bank.com carries that cookie. Every page load. Every API call. Every image fetch. The browser does it automatically, without asking, and regardless of who triggered the request. That last word is the door CSRF walks through. The browser attaches the cookie based on where the request is going , not where it came from . So when evil.com triggers a POST to bank.com/transfer , the browser sees a request destined for bank.com , looks up the cookies for bank.com , and attaches them. As far as the bank's server can tell, the request looks exactly like one the user submitted from inside the bank's own page. This is the "confused deputy" idea. Your browser is the deputy. It has authority on your behalf (your cookies). And it's been tricked into using that authority for someone else's benefit. The server has no way to tell the difference, because from its point of view, there isn't one.

Quark’s Outlines: Python User-Defined Functions Overview, Historical Timeline, Problems & Solutions An Overview of Python User-Defined Functions What is a Python user-defined function? You can define your own function in Python using the def keyword. A Python user-defined function is made when you write a def block in your code. When Python runs this block, it creates a function object. A function object has special parts. These include its name, its list of default values, and its code. It also keeps a link to the global names from the file where it was made. You can use this object to call the function later with any valid input. Python lets you create named function objects with the def keyword. def greet ( name = " friend " ): return " Hello, " + name print ( greet ()) print ( greet ( " Mike " )) # prints: # Hello, friend # Hello, Mike The function greet is now a user-defined function. Python stores its name, code, and default values for later use. What are the special parts of a Python function? A Python function holds many facts about itself. These are called attributes. For example, __name__ holds the function name. __defaults__ is a tuple of default values. __globals__ holds the global names it can see. __code__ is a special object that stores the function’s bytecode. Python functions store their details in special attributes. def square ( x = 2 ): return x * x print ( square . __name__ ) print ( square . __defaults__ ) print ( square . __code__ . co_varnames ) # prints: # square # (2,) # ('x',) These parts let Python understand and run your function later. A Historical Timeline of Python User-Defined Functions Where do Python’s user-defined functions come from? User-defined functions in Python build on ideas from earlier languages. They let you name blocks of code and reuse them. Over time, Python added new parts to function objects—like closures, default values, and metadata—to make them more powerful. People designed ways to name and reuse logic 1958 — Fu

What will happen if i failed to pay my imagekit bill? i used imagekit server initaly bill is 9 dollar but after 2 week my invoice is 120 dollar , if i didnot able to pay they will terminate my account or take legal action? submitted by /u/Few_Construction7431 [link] [留言]

I started with project level .codex and .claude folders to keep the skills. Most of the skills are common for both of the models and when I change something in them now I need to update the other one as well. It has become an additional maintenance job. I created a root level skills folder and tried to make them share the same skills but; they sometimes create files that they like to use like codex adds openai.yaml things; they still go .codex or .claude folders sometimes even though I told them to look in the skills folder etc. etc. I would like to know how do you deal with these kind of things? submitted by /u/abstracten [link] [留言]

Hi r/webdev ! I have a bit of a unique backstory for this Showoff Saturday. Back in 1992 , while working as a math teacher, I wrote the very first version of a mental math training program named Aritm in C. Fast forward to today, and I have completely modernized it into Aritm SR —a mobile-first web app, now featuring full English support and optional speech recognition. The Tech & Features: Why I built it: While great platforms like Khan Academy exist, they often rely purely on randomly generated questions. Based on my experience teaching math, Aritm acts more like a physical deck of flashcards that gets shuffled, creating a much better learning rhythm for memorization. I would love to get the community's feedback on the frontend structure, how the speech recognition feels, or any tips on optimizing mobile web performance!Thanks for checking it out, and I'm happy to answer any questions about its 30+ year evolution! submitted by /u/mobluse [link] [留言]

Hey , I got tired of waiting 60 seconds for traditional cloud servers to spin up, and standard Docker containers sharing a single kernel felt like a security risk for multi-tenant apps. So, I built Krova (krova.cloud).It lets you spin up ultra-lightweight, completely isolated micro-VMs (we call them "Cubes") running directly on dedicated bare-metal hardware. Key Features: Sub-second boot times: Container speeds, but with true hardware-level VM isolation. Sleep & Wake: You can pause a Cube to stop compute billing entirely. You only pay a tiny passive storage fee while it sleeps, and it wakes back up in milliseconds exactly where you left off. Reliable Hardware: Everything sits on enterprise servers with ECC RAM (no bit flips) and Mirrored NVMe SSDs (RAID 1). It's fully integrated with Cloudflare for automated HTTPS certificates out of the box. I’m looking for developers, engineers, and hobbyists to stress-test the platform. What features are missing that would make you switch your staging or production workloads over? submitted by /u/logical_people [link] [留言]

Hi there! I am a web dev with over 7 years of industry experience. Renovo is an expiration and document tracker for businesses and the self employed. Think restaurant owners, general contractors, etc. The target audience is users with licensing/permits to keep track of for their business(es). The free tier allows a user to get a lot out of the app. The paid version allows the user to store their actual PDF documents with the record and some extra goodies. Bigger businesses typically have enterprise software with compliance tracking baked in, often as a side thought. Alternatives tend to cost twice as much and more. Would love to hear anyone's feedback as I recently launched and only have a couple users so far. This post and any comments I make here are written by me, a human 🙂 submitted by /u/OutOfTuneAgain [link] [留言]