标签：#EV

Bash is the easiest language for AI to write and the easiest language to get devastating output from. A 20-line script that "just cleans up old files" can recursively delete a home directory because the model assumed a variable would always be set. A "simple log shipper" can write your secrets to a remote server because the model used set -x for debugging and forgot to remove it. I have run AI-generated bash that I should not have. Most engineers I know have too. After enough close calls, there's a short checklist that catches the worst of it. This is that checklist. The five things to check before running any AI-generated bash 1. Does it start with a strict pragma? The first lines of any non-trivial bash script should be: #!/usr/bin/env bash set -euo pipefail IFS = $' \n\t ' What each does: set -e — exit on any command failure. Without this, a failure in line 5 doesn't stop the script from happily running lines 6-50. set -u — error on undefined variables. This is the one that saves you from rm -rf $UNDEFINED/ . set -o pipefail — propagate failures through pipes. Without it, failing-command | grep something succeeds because grep succeeds. IFS=$'\n\t' — sane field splitting. Defends against word-splitting bugs in filenames. If the AI-generated script doesn't have these, add them and re-read the script. You'll often discover bugs the pragma now flags. 2. Is every variable expansion quoted? # Wrong rm -rf $TARGET_DIR # Right rm -rf " $TARGET_DIR " The wrong version is what causes the "I deleted the root directory" stories. If $TARGET_DIR is empty or contains a space, the command becomes rm -rf (delete current directory) or rm -rf foo bar (delete two unintended things). Models default to the wrong version about half the time because the right version is harder to write in chat ("escape the quotes!") and the wrong version is what most blogs show. Fix: When reading AI bash, mentally check every $VAR for quotes. Add them if missing. This is the single biggest source of bas

# EnvForge BETA v1.1 ⚡ Structured .env scaffolding for modern applications. Generate, validate, and protect environment variables for 14+ services – without ever opening a docs page. Github repo [ https://github.com/Jos3456/envforge ] NPM version (https://img.shields.io/npm/v/envforge-dev) MIT License (https://img.shields.io/badge/License-MIT-yellow.svg) ## Installation bash npm install envforge-dev **Requirements:** Node.js 18 or later. --- **## Quick Start** bash # 1. Generate an .env file and choose your providers envforge init # 2. Fill in your actual credentials envforge fill # 3. Check everything is set correctly envforge validate ## All Commands ### Scaffolding Command What it does envforge init Create a new .env by selecting providers interactively envforge add <provider> Add variables from a specific provider to your existing .env envforge preset Generate a .env from a popular stack preset envforge example Create a safe‑to‑commit .env.example file envforge fill Interactively enter values (secret keys are masked) envforge list Show all built‑in and custom providers ### Guardrails Command What it does envforge validate Check that all required variables are filled in envforge scan Detect secret keys accidentally exposed in frontend code envforge hook install Install a pre‑commit hook that runs validate + scan ### Customisation Command What it does envforge provider add Create a custom provider template envforge registry update Download the latest providers from the community registry ## Built‑in Providers Category Providers Database Supabase, Neon, MongoDB Atlas Auth Clerk, Auth0, Firebase AI OpenAI, Anthropic (Claude) Payments Stripe Email Resend, SendGrid Storage Cloudinary, AWS S3 / Cloudflare R2 Other Vercel Missing a provider? Add your own with envforge provider add or contribute one to the community. ## Framework‑Aware Scanning Use --framework for smarter detection: # Next.js specific rules (app/ vs pages/, "use client") envforge scan --framework next Th

Quick update to anyone interested in upcoming changes to the PAGI project (spiritual successor to Plack/PSGI). 1) Distribution split up: when we released PAGI, we initially released everything as one distribution. PAGI ( https://metacpan.org/pod/PAGI ) currently has a) the PAGI specification; b) the reference server and c) a bunch of ease of use tools, similar to the role that the Plack distribution played for PSGI. Putting everything into one place was just to make my life easier as in the early bunch of releases there was a lot of fixes and updates, most of which cut across all three parts of PAGI. Also I wanted to make it easy for people getting into PAGI to be able to explore the ecosystem. However now that code seems to be settling down having these in independent repos and releases makes more sense. Going forward the PAGI repo will only update if the spec itself changes; PAGI::Server and PAGI::Tools (where all the utilities and helpers now go) likewise. I think this will start to bring some stability to the ecosystem, especially now that PAGI::Server is functionally complete based on the goal chart I had for it initially. So I will only update it to fix bugs and security issues. PAGI::Tools will probably continue to see evolution over the summer as I start to nail down more common use cases and identify patterns worth encapsulating. 2) Specification clarifications and updates: The PAGI specification itself will move to v0.3 in the next release and it contains mostly clarifications and fixes. Biggest change will be a more detailed mechanism for controlling streaming output, especially around handling back pressure as well as new callbacks to notice when the output buffer is getting full and when it clears. Hopefully these changes will make it easier and more reliable to do streaming in PAGI. PAGI::Server has been updated to match, and the response helper in PAGI::Tools has some updates around that as well. Currently all this sits on Github: https://github.com/j

AI agents are getting very good at writing final reports. The problem is not only that they make mistakes. The problem is that sometimes they make mistakes with excellent presentation. Proofline is a 5-skill Markdown pack that catches fake-ready output before it turns into a release, handoff, public post, or "yeah, looks done". What Proofline does It is not trying to be another giant agent. It works as a review route after the agent produces a result: Reference Gap Ready Gate Reality QA Lean Pass Repair Report Compiler Each step asks an annoying but useful question: what is missing from the references, what was not checked, where did the agent pretend everything was fine, and what actually needs to be fixed? Who it is for Builders working with Codex-style agent chats, AI coding workflows, Markdown handoffs, and any process where "done" needs to mean more than a confident paragraph. Release: https://github.com/aisflows/proofline/releases/tag/v0.2.0-rc5

Disclosure up front: I'm affiliated with diagram.now — I'm connected to the product. I'm posting this to get developer feedback on diagram import/export interoperability, not to pitch an install. Most teams I've worked with don't have one source of truth for their diagrams. They have: a few Mermaid blocks living in READMEs and Markdown docs, an old Visio ( .vsdx ) or Lucidchart file someone made two reorgs ago, a SQL schema that is secretly the "real" ERD, and a pile of screenshots pasted into docs and tickets. The diagram is rarely the hard part. The hard part is that the same diagram lives in five formats and none of them stay in sync with the docs they're supposed to explain. I've been working on diagram.now , a browser-based editor for technical diagrams — flowcharts, UML, ERD, BPMN, cloud/network architecture, mind maps, wireframes. It's a free browser editor with no signup to start. There's an optional Confluence app for teams that want diagrams editable inside Confluence pages, but that's intentionally not what I want to talk about here. I want feedback on the editor itself, and specifically on the interoperability story. What it does today Import/insert from Mermaid and SQL — paste a Mermaid graph or a CREATE TABLE block to start an editable diagram instead of a static render. Import Lucidchart and Visio .vsdx files — this is migration-oriented, and honestly the part I most want real-world files to stress-test. Export to PNG, SVG, PDF, or a URL. Templates/shapes for the diagram categories above. I'm deliberately keeping the Confluence side secondary. The thing I actually want to learn is whether the browser editor plus import/export is useful on its own. Where I'd love feedback Imports: Which format matters most to you — Mermaid, SQL→ERD, .vsdx , Lucidchart, or something else (PlantUML, draw.io XML, Graphviz)? If you've ever tried to migrate diagrams between tools, where did it break? URL export: Is a shareable diagram URL genuinely useful in your workflow (

Two expeditions, two spacewalks, 322 days in space.

We are thrilled to announce the winners of the Hermes Agent Challenge! Over the past few weeks, the...

The company's latest recall of 3,871 vehicles follows incidents of its autonomous cars prioritizing other hazards or failing to recognize closed construction zones altogether.

A few months ago I started building small tools as single HTML files - no npm, no React, no backend. Just one file that opens in a browser and works offline. I built 4 real products this way: DarkenAmber IT Tools - 17+ developer tools in 194KB ZeroOffice - PDF, image, AI tools in one file PrivacyKit - Photo privacy tools, no upload required ElectroKit - Electrical calculator + cost estimates for CIS market Every single one: one .html file. Works offline. Opens instantly. No server. The problem with AI coding assistants Every time I asked Claude or Copilot to build something simple, I got: A React project with src/ folder package.json with 12 dependencies webpack config TypeScript setup ...before writing a single line of actual logic. I kept manually correcting it. "No, one file. No npm. Vanilla JS." Then I realized - I should just teach it once and reuse that knowledge. What is a Claude Skill? A skill is a Markdown file with YAML frontmatter that changes how Claude thinks for a specific context. It is not a prompt. It is not a system message. It is a reusable set of rules that shapes how Claude reasons, what it prioritizes, and what it avoids. yaml--- name: single-file-app description: "Build complete web tools as a single HTML file - vanilla JS, inline CSS, localStorage, offline-first." tags: html vanilla-js offline version: 1.2 --- The two skills I built single-file-app Teaches Claude to build complete web tools in one HTML file. What changes: No React, no npm, no build tools unless truly justified Vanilla JS first, always localStorage for data persistence Dark/light theme with system preference detection Accessibility built in (labels, aria, keyboard nav) XSS prevention for user input Export/import for user data Anti-patterns it prevents: ❌ "Let me set up a React project" ❌ Creating src/ folder for a simple tool ❌ Suggesting npm install for a calculator ✅ "Here is your complete HTML file" ship-it Teaches Claude to bias toward shipping over planning for early-stag

Most AI coding assistants do not really remember your project . They remember just enough to be dangerous . They see the latest prompt, skim a few files, improvise, and then forget the reasoning that made the answer useful five minutes ago. That is fine for toy demos. It breaks down fast inside a real software codebase. In Knotic I take an harder line . Instead of treating memory like a chat log with extra lipstick, I treat memory as infrastructure . Project knowledge is separated from session knowledge. Source material is separated from condensed understanding . Old context is compressed instead of blindly dragged forward. The result is a system that feels less like autocomplete with a caffeine habit and more like an AI engineering partner that can stay oriented over time. If you care about AI coding assistant memory , context engineering , persistent project memory , or long-term memory for software development , this is the part worth paying attention to. The Real Problem With AI Memory in Coding Tools The average AI IDE has the same failure mode . It looks smart on the first turn and shaky on the fifth . Why? Because software work is not just about answering the latest question. It is about carrying forward constraints, architecture, naming conventions, decisions, tradeoffs, dead ends, file relationships , and the exact context of the change in progress. When an assistant does not separate those layers, everything gets mixed together . Stable project facts sit next to temporary tool output. Important decisions compete with random noise. The model burns tokens re-reading the same files, or worse, works from partial memory and starts making up the missing pieces . Knotic solves this by splitting memory into distinct layers , each with a clear job. That design choice sounds simple. In practice, it changes everything . Knotic Does Not Use One Memory. It Uses Three. Knotic's memory model is built around three different kinds of context . The first is long-term projec

The Frame Pro 2026 benefits from meaningful tweaks. AI audio and picture tuning work in tandem with a new anti-glare coating to deliver impressive benefits.

Anime collaborations are everywhere, from Gundam watches and Naruto nights at Major League ballparks to just about anything Evangelion. But these Ghost in the Shell keyboards from Iqunix are some of the coolest examples I've seen of anime-inspired everyday tech. They look sick and they type and play great. At $249 they're a hefty upcharge […]

Ky 2.0 is an open-source JavaScript HTTP client built on the Fetch API, featuring significant updates such as consolidated hook handling, enhanced timeout management, and improved URL processing. The release includes response validation through schema validation libraries and addresses migration from earlier versions. It aims to provide a lightweight alternative to axios. By Daniel Curtis

Waymo is recalling over 3,800 of its self-driving taxis due to a software issue that could cause them to enter closed freeway construction zones at speed.

We are so excited to announce the winners of the Gemma 4 Challenge! This is officially our most...

By focusing on sleep, ScreenZen’s app-blocking Halo gadget is downright dreamy compared to the rest.

VS Code 1.123 adds a two-hour delay before auto-updating extensions to newly published versions, creating a revocation window against supply chain attacks. The delay does not apply to trusted publishers like Microsoft, GitHub, and OpenAI. Similar cooldown mechanisms have now spread across pip, RubyGems, npm, pnpm, Yarn, and Bun. By Steef-Jan Wiggers

I joined DEV at the start of January, but it's only really been in the past week or so that things clicked into place — and looking back, it's been a lot more eventful than I expected for "week one." What I Set Out to Do My original plan was simple: write a structured series covering iOS development with Swift and SwiftUI, one topic at a time, with anime examples thrown in to keep things fun. Strings, arrays, loops, functions — the building blocks. What I didn't plan for was everything else that happened alongside it. The June Solstice Game Jam Happened I saw the announcement for DEV's June Solstice Game Jam and, on a whim, decided to build something for it. A few hours later I had a fully working SwiftUI trivia game — Pride Trivia & Alan Turing Edition — with ten questions covering LGBTQIA+ history and Alan Turing's legacy, a rainbow progress bar, and a results screen with score-based messages. I'd never built and shipped something end-to-end like that before, let alone submitted it to a community challenge. Going from "let's see if this works in the simulator" to "this is live on GitHub with a demo video and a published writeup" in one sitting was honestly a bit of a blur. Then I Detoured Into Google AI Studio A few days later, I worked through the DEV Education Track for Google AI Studio and built MascotCraft Studio — an app that generates coding mascots using Gemini and Imagen. One prompt later, I had a fully deployed web app and a mascot named Octo-Byte , a cheerful deep-sea developer with eight arms and a talent for multitasking. That post sparked one of my favorite discussions so far — a few comments turned into a genuinely interesting conversation about how AI is shifting the bottleneck from "can I build this" to "what should I build, and how do I know if it's good." Not at all what I expected from a post about a cartoon octopus. The Badges Somewhere in all of this, I picked up: A 1 Week Community Wellness Streak badge, just from commenting on other people's

A while back I was building a side project that needed public data from a few social platforms. Nothing crazy — profiles, posts, some engagement numbers. I figured I'd just grab each platform's official API. Reader, I did not "just grab each platform's official API." Here's what that road actually looked like, and how I ended up consolidating everything down to one key and roughly ten lines of shared code. The five-API nightmare Instagram (Meta Graph API). Great if you own the account. Useless for pulling public data about accounts you don't. Endless app review. TikTok. The research API is academics-only with a long application. For commercial use, basically nothing. X (Twitter). Used to be wonderful. Now $100/month to start, more for anything serious. YouTube. Honestly the best of the bunch — generous and well-documented. Credit where due. LinkedIn. Partner-only. For most people, no useful public access at all. So to cover five platforms I was looking at: five sets of credentials, five auth flows, five rate-limit models, five totally different response shapes, two flat-out rejections, and a monthly bill. For a side project. What I actually wanted getProfile ( " tiktok " , " someuser " ) getProfile ( " instagram " , " someuser " ) getProfile ( " twitter " , " someuser " ) Same call shape, same auth, same error handling. That's it. I don't care that each platform structures things differently internally — I want one boundary that hides that from me. The consolidation I switched to SociaVault , which puts public data from all of these behind one API and one key. My entire client became this: const API_KEY = process . env . SOCIAVAULT_API_KEY ; const BASE = " https://api.sociavault.com " ; async function sv ( path , params = {}) { const url = new URL ( BASE + path ); Object . entries ( params ). forEach (([ k , v ]) => url . searchParams . set ( k , v )); const res = await fetch ( url , { headers : { " X-API-Key " : API_KEY } }); if ( ! res . ok ) throw new Error ( ` $

Cybersecurity firm Chainguard has announced the launch of Athena, an industry coalition to use artificial intelligence to find and fix vulnerabilities in widely-used open-source software before attackers can exploit them. The coalition focuses on libraries, containers and other components that underpin web browsers, data centres, smartphones and payment systems. By Matt Saunders