标签：#code

Creating a website is more than just writing code. After building a project with HTML, CSS, or JavaScript, developers also need to consider how the website performs, how secure it is, and how easily users can access it. As a young developer, I think these aspects are important to learn through practice. In this article, I want to share my experience exploring Tencent EdgeOne Makers, along with some technical considerations and best practices that I found useful. Getting to Know Tencent EdgeOne Makers Tencent EdgeOne Makers provides an interesting environment for developers to experiment with their projects and explore modern web services. For beginners, one of its advantages is the opportunity to experience the complete journey of a web project. We can start by creating a project locally, testing its features, and then making it accessible online. This process gives developers a better understanding of what happens beyond the coding stage. A website that works on a personal computer still needs to be tested in a real environment before it can provide a good experience for users. My Technical Review Easy Project Experimentation One thing I like about EdgeOne Makers is the opportunity to experiment. Developers can start with a simple project and gradually improve it. This is useful for students and beginner developers because learning does not always have to start with a large or complicated application. A small website can already teach important lessons about structure, configuration, performance, and accessibility. Performance Matters A website should not only work correctly; it should also feel comfortable to use. Large images, unnecessary JavaScript, and unused resources can affect loading times. Because of this, developers should review their project before making it available to users. Some simple practices include compressing large images, removing unnecessary files, and keeping the website structure clean. Performance is especially important because users may

Every AI code reviewer claims it respects your team's standards. Very few can tell you what those standards actually are. The test is mechanical. Ask the tool, or the vendor, one question: where do my rules live? If the honest answer is "we loaded a generic style guide plus whatever your PR description happened to say", then your standards aren't in the model at all. The reviewer is running on vibes and hoping your repo looks conventional enough to pass. The tools that genuinely track your rules share a shape: the standards are an input, not a hope. They read your rule files, your linter config, your past review comments, sometimes your docs. The review is judged against that artifact, which means when a comment fires you can ask "which rule?" and get a config line back, not a paragraph of model reasoning. That last part is the thing worth testing for. If a reviewer can't point to the specific rule it applied, it is not following your standards. It is approximating what it assumes standards look like. Those two feel identical for the first six months, then diverge exactly when you've stopped proofreading its output. A short checklist when you trial one: Does it ingest a rules file, or only the PR context? Can it point to the exact rule that triggered a comment? Does it adapt to your historical review style, or reset every run? Is a "rule" something you can open, read, and edit in the UI? If the answer to all four is no, you bought a very chatty spellchecker that happens to be trained on GitHub. The eval that actually decides it: can your own reviewer reproduce one of your team's real past review decisions, given only your real rules file? Run that before you hand it a production PR.

This paper (arxiv 2607.24888) is worth a stop if you evaluate AI code review. It shows Ken Thompson's trusting-trust attack is not compiler-specific: the authors pull it off with GNU strip, a build utility that neither reads nor generates source, using only tampered finished ELF binaries. In the NixOS bootstrap, one malicious strip in the binary seed implants a payload that propagates to the next strip generation and survives into the final standard environment after the seed is gone. The uncomfortable part for anyone building or buying AI review: these tools read the patch text and the source, and none of them reads the build path or the binary seed. And that is not a limitation a bigger model fixes. Put the strongest reasoning model in the world on that source diff and it sees a clean PR, because the malicious code is not in the source at all. It arrived as a finished strip binary in the dependency closure. I keep bumping into the same split and this paper is the cleanest example yet. Two jobs get lumped together. One is "did this source diff introduce a bug or flaw", and AI is genuinely, surprisingly good at that. The other is "does the artifact your users run match the source you reviewed", and no diff-based review, human or model, can answer yes to that. That is an artifact provenance and build reproducibility job, not a code review job. So the rule for teams adopting AI review: use it for the first job, and do not let its approval make you feel covered on the second. If your acceptance criterion becomes "the model said the diff is fine", you have traded the compiler-trust problem for a strip-trust problem and called it a win.

Hi DEV! 👋 I’m the developer behind Flame IDE , a free desktop IDE for macOS, Windows, and Linux. I built Flame to bring my everyday development workflow into one place: multiple repositories, Git worktrees, AI agents, browser previews, terminals, debugging, databases, and API testing. I wanted to spend less time moving between tools and more time building. That also meant making everyday tasks easier, from browsing folders visually and editing images to fixing a failing test or resolving a merge conflict with AI. Multiple projects should feel like one workspace A frontend, an API, and a shared package often belong to the same piece of work. In Flame, I can group them, switch between them, and keep their branches and changes visible without opening a separate IDE window for every repository. The Broadcast terminal runs a command across selected projects with separate output for each. Saved run configurations handle the scripts, servers, and browser previews I regularly start together. Less repeated setup, especially when working across the whole stack. Parallel work should be easy to start and review Git worktrees are incredibly useful, but preparing each checkout can become a chore: missing .env files, local configuration, dependencies, and another window to manage. Flame automates worktree creation and local configuration copying, with initialization steps to prepare the checkout. Features, experiments, and agent tasks can live side by side in one window. The Agents Manager lets me create, monitor, schedule, stop, retry, and review AI tasks across projects, each with its own permissions and landing strategy. Point at the problem. Let AI see what you see. I got tired of screenshotting bugs, drawing red circles, and describing my UI to an AI chat. In Flame’s built-in browser, I select an element and tell the agent what to fix. It can inspect the DOM, screenshots, console errors, and page state, then interact with the page to check its changes. I can follow the fix in

The bottleneck moved. For years the slow part was typing. Now four hundred lines arrive in nine seconds, and the slow part is you, reading them. We have not adjusted. We still measure a good day by how much appeared. But nothing counts until somebody understands it, and understanding did not get faster. So the pile grows. Code that runs. Code that passes. Code nobody has actually read. It works the way a stranger's directions work. Fine until the first turn you did not expect. Then you are debugging something you never wrote, in a shape you did not choose, at an hour you did not pick. The honest limit is simple. Do not accept more than you can review. Not more than you can skim. More than you can review, meaning you could defend every decision in it to someone who disagrees. If that takes an hour, then an hour is your budget, whatever the machine can produce. So ask for less. One function, not one module. One change, not one feature. A first draft you can argue with, rather than a finished thing you are tempted to trust because it is long and it is tidy. Tidy is not correct. It never was. The machine is simply better at looking finished than we ever were. Read it the way you would if a contractor handed you the keys and left the country. Because that is the arrangement. It will not be there when it fails. You will. There is a quiet cost, too. Every line you accepted without reading is a line you cannot reason about once the incident starts, and the incident does not care who typed it. The old skill was producing. The new skill is refusing. Not this. Not yet. Not in that shape. Generation is cheap now. Attention is not, and attention was always the whole of the job. Slow down at the only step that ever mattered. – Serguey Asael Shinder

From February to April 2026, I launched four web apps, each starting from a code bundle that Figma Make (Figma's AI feature that generates a working front-end code bundle from a design) had spat out: a beauty-curation site, a gift-record app, a plush-toy album, and a UI mock for an AI development tool. Every one of them starts its repository in a state where "the look is already finished." In this article I look back — from the actual config files and commit history — at what I did to get those generated outputs into a state where I could take over development in Claude Code (Anthropic's CLI coding agent) and start working on them, and at how far each of the four repositories progressed or stalled. The starting point: what shape does a Figma Make output come in? A Figma Make export runs as-is with npm run dev . The README tells the story. # Beauty Information Curation Site This is a code bundle for Beauty Information Curation Site. The original project is available at https://www.figma.com/design/ <id> /... ## Running the code Run `npm i` to install the dependencies. Run `npm run dev` to start the development server. A README that says "the original lives in Figma." That symbolizes the character of the output: the code is a projection of the Figma design, and the code is not the source of truth. On top of that, if you look at package.json , every dependency is exact-pinned. { "dependencies" : { "next" : "15.3.4" , "react" : "19.1.0" , "react-dom" : "19.1.0" , "lucide-react" : "0.487.0" , "motion" : "12.23.24" , "tailwind-merge" : "3.2.0" } } Fixed versions with no ^ . As a snapshot of the moment it was generated, it is highly reproducible, but leave it as-is and it grows stale with no one ever updating it. There is no data layer either. The screens are pretty, but behind them everything is mock data — no persistence, no authentication. "It runs, but there is no foundation to grow it on" — this was the common starting point across all four repositories. [画像: The READ

Prelude — Does structure actually help? In late August 2026, I heard Lorenzo Carbonell of atareao.es discuss Nushell and its advantage when working with structured data. One question stayed with me: could that structure genuinely improve my workflow? The Unix shell works well, but many of its pipelines depend on text, column positions, and options whose behaviour can differ across implementations. 1 Nushell takes a different approach: it preserves tables and typed values—dates, numbers, or file sizes, for example—throughout the pipeline. 2 I did not want to replace zsh . I used Nushell as a selective route instead, then tested the decision against three possible outcomes: improvement , if accuracy rises enough to justify the cost; regression , if it adds time, tokens, or complexity without compensating benefits; no material difference , if the technical route changes but the relevant outcome does not. To test this, I wrote a skill (a rule that guides an agent on when to use a tool) and collected 380 runs : 200 pipeline comparisons, 100 A/B runs on a tuned corpus, 50 runs on held-out tasks, and 30 observations from a real aggregate case inspired by the reconstruction of my master's thesis. That is a large number of repetitions across only a few task families. Part of the integration was also tuned during the process. The results are therefore bounded exploratory evidence, not a universal test . The question is not whether Nushell is better than Bash: When does a structured route improve an agent's work, when does it make it worse, and when does it make no material difference? Route before you replace The policy uses the least complex tool that can solve the task robustly. Level Preferred tool Preferred use 1 git , systemctl , pacman , ssh , rsync The operation already has a direct interface. 2 rg , jq , yq , awk , fd A specialised utility handles the transformation. 3 Nushell Several transformations over tabular or typed data. 4 DuckDB, Python, Polars, or R The volum

Crypto landing page with a sleek dark/light mode toggle, stylish Chart.js market graph, and smooth scroll animations using sal.js. Built with Tailwind CSS for a pixel-perfect, fully responsive design. Design inspired by: https://www.figma.com/community/file/1047142300578798855/cryptocurrency-landing-page-dark-mode

My first CLAUDE.md for a client project ran 400 lines: architecture diagrams, the full MVVM-vs-TCA debate, a style section that just repeated SwiftLint's config in prose. Claude Code reads that file in full on every single turn, and it still missed rules buried near the bottom, because by line 340 they're competing with everything else for the model's attention. I cut it to 60 lines over two weeks. Same team, same codebase, fewer violations of the rules that actually mattered. It's not documentation The instinct is to treat CLAUDE.md like a README: a place to record everything true about the project. A README gets read once by a human who skims for the one section they need. CLAUDE.md gets read in full, by a model, every turn, and every line you add dilutes every other line's share of attention. That's the whole design constraint, and most CLAUDE.md files ignore it. What earns a line Non-obvious conventions. Not "we use MVVM," that's visible in five minutes of reading the code. "ViewModels never import UIKit" earns its place only if it's a rule someone actually broke once and it cost a day. Constraints invisible in the diff. App Store review requirements, a minimum OS version the code doesn't yet reflect, a performance budget on one screen because a past ship got rejected for jank. An agent has no way to infer any of that from the code alone. Repo-specific workflow gotchas. Which branch triggers a real deploy, which test suite is a known-flaky non-gate versus a hard one, where the actual source of truth lives when two files disagree. I run a merge gate across a few of my own repos, code only merges once CI is green and review found nothing blocking, and the single highest-value line in each CLAUDE.md is the sentence explaining that the gate exists and why a raw git merge is bypassing something on purpose. What the agent never touches unsupervised. For me that's deploy config and anything security-sensitive. Naming the boundary explicitly is cheaper than discovering

A developer opens a pull request. The feature works. The tests are green. The implementation looks reasonably clean. Then they realize the PR changes 17 files for what should have been a relatively small feature. There is a new abstraction nobody on the team has seen before. A dependency has been added for functionality the project already had. Two similar utilities now exist in different parts of the codebase. The tests are extensive, but nobody is completely sure what assumptions they are actually testing. And the author didn't write most of it manually. AI did. This is one of the less obvious problems created by AI coding tools. The problem isn't necessarily that AI generates bad code. Sometimes it generates perfectly valid code. The problem is that it can generate code faster than a team can develop an understanding of it. That changes the bottleneck in software engineering. The Cost of Writing Code Has Changed For a long time, engineering teams were constrained by how quickly developers could implement things. A developer had to understand the requirement, design the solution, write the code, debug it, and test it. AI changes the economics of that process. A developer can now describe a feature, generate an implementation, ask for tests, refactor it, and generate supporting code in a fraction of the time it might previously have taken. That's useful. But the amount of code entering the system can increase faster than the team's ability to review and understand it. Consider a simple feature that requires modifying four files. An AI coding assistant might produce a solution that touches twelve. It may introduce a service layer, a helper abstraction, a configuration object, several interfaces, and a new package. None of these things are necessarily incorrect. But every additional abstraction creates another thing a future developer has to understand. This is where code familiarity becomes an engineering concern. Working Code Isn't the Same as Understandable Code A

Refactoring Safely: A Step-by-Step Guide We all know that feeling: a function that's 200 lines long, a class that does too many things, or a variable named data2 . Refactoring is the cure, but doing it recklessly can break your app and your confidence. Here's how I approach refactoring safely, step by step. 1. Start with a Safety Net Before touching any code, make sure you have tests. If your project lacks tests, write a few key ones first. Focus on the behavior you're about to change. The goal is to have a safety net that tells you when you've broken something. # example test for a function we'll refactor import unittest from mymodule import calculate_total class TestCalculateTotal ( unittest . TestCase ): def test_with_discount ( self ): self . assertEqual ( calculate_total ( 100 , discount = 0.1 ), 90 ) If tests aren't feasible, at least have a manual checklist. But automated tests are worth the effort. 2. Make Small, Atomic Changes Don't try to refactor everything at once. Pick one logical change. For instance, extract a method or rename a variable. Each change should be small enough that if it breaks, you know exactly what caused it. // before function processOrder ( order ) { const total = order . items . reduce (( sum , item ) => sum + item . price , 0 ); const tax = total * 0.08 ; const final = total + tax ; return final ; } // after step 1: extract tax calculation function processOrder ( order ) { const total = order . items . reduce (( sum , item ) => sum + item . price , 0 ); const final = total + calculateTax ( total ); return final ; } function calculateTax ( amount ) { return amount * 0.08 ; } Run your tests after each tiny step. If they pass, move on. If they fail, you know the last change caused it. 3. Use Your IDE's Refactoring Tools Modern IDEs can rename variables, extract methods, and change signatures safely. They update all references automatically. This reduces human error. For example, in VS Code, right-click a function and choose "Extract to

Today, I’m talking with Tom Conrad, the CEO of Sonos. Tom and I have known each other for a long time — he was the chief technology officer of Pandora, VP of product at Snap, and the chief product officer of Quibi. He was also on the board at Sonos during its disastrous 2024 app […]

Mandatory AI checks paired with manual spikes for complex changes keep developers sharp. Teams can boost velocity by skipping peer reviews on low-risk PRs and using AI approvals, provided most developers are code owners and teams are small. By Ben Linders

I sat in on Margaret-Anne Storey's DORA community session last week, and she put a name on the thing I'd been circling since April. It isn't technical debt. Her ACM Queue piece splits software health into three debts. Technical debt is the familiar one: implementation choices that make tomorrow's change harder. Intent debt is the missing rationale, the goals and constraints that say what a system is even for, which now has to be legible to agents and not just to people. Cognitive debt is the one that stopped me. It's the erosion of shared understanding, the state where nobody on the team can confidently explain how the system works or predict what a change will break. Read that again if you review pull requests for a living. I closed a thirteen-post retrospective last month admitting I couldn't answer one question: how many AI-generated pull requests a week can a review process absorb before it stops working as a control? I still don't have that number. What I have now is a name for what you accumulate while you don't have it, and a way to find yours. Approval velocity measures motion Every metric most teams watch gets better as review collapses. Merge rate climbs. Time-to-approve drops. The throughput chart looks terrific right up until the incident review, because a reviewer who has quietly become a rubber stamp is indistinguishable from a fast reviewer in every dashboard you own today. Cognitive debt doesn't announce itself as a red number. It shows up as green ones, arriving faster. I know this failure mode from the inside. Two months of green CI on conformance checks that had never once passed , on my own project. A human audit caught it. No metric I was watching came close. What you need to measure is detection. Almost nobody does. Mutation testing, pointed at the reviewers We solved this once already, for test suites. Mutation testing injects known bugs into code and checks whether the tests catch them. A suite that passes everything might be thorough or migh

Let me start with a question. Why did I fear development done by artificial intelligence? The answer is plain. AI can build software, and on top of that, it never rests. AI has no labor law People rest. There are labor laws. We sleep at night. We need weekends. Work too many days in a row and the body breaks. So there is a ceiling on how much work a person can move forward in a day. For a long time, we treated that ceiling as a given. But AI has no labor law. It works at night. It works on weekends. Give it an instruction once, and it does not stop until morning. It never says it is tired. It takes no breaks. It keeps working for hours at the same quality. This difference did not fit inside the word "convenient." What I felt was fear. This was not a story about one more handy tool. It was a story about the ground under the speed of work changing at the root. Claude Code came out about a year and a half ago. That is when I understood. The company that runs it 24 hours takes the first-mover advantage. And the company that can punch with money wins. This is not a cynical take. It is the obvious consequence. The first mover wins — that story is not new. Whoever enters a market early takes the ground. They set the standard. Everyone after them chases the gap. AI widens that gap by the day. A company that moved ten hours forward overnight and a company that stood still overnight are ten hours apart by morning. The gap compounds daily. Can you catch up by hiring more people? You cannot. Hiring takes time. Post the opening, interview, teach, wait for people to settle in. That takes months. Meanwhile, the other side's AI keeps moving through the night. The speed of adding people cannot match the speed of adding AI. So the moment a small company steps into a contest of headcount, it loses. It was a ring we should never have entered. Companies that can punch with money win — obviously Why can I say it becomes a contest of money? Because there is no ceiling on how fast you can

Originally published on hexisteme notes . I run a video pipeline where every shot carries a contract: a must_have list, a must_not_have list, and a serves_line field — the narration line the shot exists to support. One rule in that pipeline, which I call the enactment rule, checks each contract for self-contradiction: if must_not_have forbids the very thing serves_line requires, the shot can't honor its own contract and support its sentence at the same time, so the rule fails it hard at author time. It's a good rule to want. It had never once run. One layer deeper than the usual dead gate This adds another entry to the same line of investigation: Grep won't find your dead gates. A fill-rate query will. found rules nobody was calling — the wiring itself was absent; The Guard Passed on an Empty Table found a correctly-called rule whose target population was empty at runtime, so it passed on nothing left to check; and The check that cannot fire found a rule that ran against real data and silently disabled itself because its threshold was an absolute constant that didn't match the input's scale. This one sits a layer deeper than all three: the callers existed, the rule fired on every invocation, and what was actually missing was a producer for the one field the rule needed to read. The field nothing writes serves_line is a derived field — by definition, it's the narration of the beat the shot is attached to. I checked that derivation against reality before touching anything else: every stored value that existed matched its beat's narration exactly, 6 of 6, zero drift. Wherever the field existed, it was right. But almost nowhere did it exist. A repo-wide search for anything that writes serves_line returned zero producers. The archetype templates that generate contracts don't set it. So every contract created through the supported authoring path had serves_line = None , and the rule — which needs that field as its input — silently evaluated nothing. A published episode ha

I had eight custom agents defined in Claude Code. When I finally counted, seven of them hadn't been called once in the last 30 days. What keeps my ¥1.2M/month automation setup running isn't clever prompting. It's an environment that keeps checking, automatically, whether the things I built are actually doing anything. Why this setup works Claude Code lets you define custom agents by dropping .md files into the ~/.claude/agents/ directory. You define specialists like architect (architecture design), code-reviewer (code review), and security-reviewer (security audits), and expect Claude Code to pick the right one on its own. It's a natural assumption. But when you actually tally the logs, the results are surprising. Take my environment as an example. ~/.claude/agents/ currently holds eight agent definition files. architect.md code-reviewer.md database-reviewer.md INDEX.md planner.md python-reviewer.md security-reviewer.md typescript-reviewer.md ~/.claude/logs/agent-invocations.jsonl holds 682 records spanning May 28 to August 30, 2026. Aggregating the last 30 days gives this breakdown: === Agent usage (last 30d) === total invocations: 23 unique types: 3 Top 10: agent calls errors Explore 19 0 general-purpose 3 0 code-reviewer 1 0 0-call agents (defined locally but not used in 30d): 7 - INDEX - architect - database-reviewer - planner - python-reviewer - security-reviewer - typescript-reviewer Of the eight defined agents, exactly one, code-reviewer , was called even once in 30 days. The other seven had zero calls . 87.5% of the agents I'd defined might as well not have existed. Narrow it to the last 7 days and it gets worse: code-reviewer drops out too, and the zero-call list grows to eight. === Agent usage (last 7d) === total invocations: 3 unique types: 2 0-call agents (defined locally but not used in 7d): 8 - INDEX - architect - code-reviewer - database-reviewer - planner - python-reviewer - security-reviewer - typescript-reviewer This isn't just a "what a waste" sto

Pasting AI code because it runs feels productive and for today it is! I this post I want to explain...

Proof over claim Last time I described the hour a platform shipped the feature I had spent months...