AI 资讯
n8n review: I automated 12 saas.pet workflows with it in 6 months
n8n is the open-source workflow automation tool that competes with Zapier and Make. I have been running it for saas.pet's content pipeline for 6 months. Here is my honest take on self-hosting n8n versus paying Zapier, and whether it is worth the hassle. What n8n does that Zapier cannot n8n is an open-source workflow automation platform with 400+ built-in integrations. You connect nodes on a visual canvas: when X happens in one app, do Y in another. The killer difference from Zapier: you control where it runs. Self-host on a $5/month VPS or run on n8n Cloud at $20/month. No per-task pricing, no 'you hit your zap limit' emails. For high-volume workflows, the cost difference is dramatic. I run n8n on the same $6/month HK server that hosts my proxy. 12 workflows handle saas.pet's entire content pipeline: daily data fetch from GitHub Trending API, transform JSON, write to data files, trigger build, push to git, notify me on Telegram. The same workflows on Zapier would cost $73.50/month (Professional plan with 2,000 tasks). On n8n, $6/month for the server plus $0 for the software. The self-hosting overhead is real—updates, SSL certs, monitoring—but for 12+ active workflows, the savings are $800+/year. If you only have 2-3 simple zaps, stay on Zapier's free tier. If you have 5+ workflows with volume, n8n pays for the hosting in month 1. My 6-month setup for saas.pet I run n8n in Docker on the HK server. The initial setup: install Docker, pull n8n image, configure nginx reverse proxy, set up SSL via Certbot. That took about 2 hours the first time. Now I can deploy n8n in 15 minutes on a fresh server. The 12 workflows: (1) Daily GitHub trending fetch via saas.pet/api/trending, (2) data transform to unified JSON, (3) write to data/YYYY-MM-DD.json, (4) trigger build-ci.mjs, (5) git add + commit + push, (6) Telegram notification with commit SHA, (7) weekly sitemap health check, (8) monthly backup of reviews/ JSONs to S3, (9) uptime ping every 15 minutes, (10) DNS health check,
AI 资讯
How to add a changelog to any web app with one script tag
You ship all the time. A fix here, a new setting there, a feature you spent a whole weekend on. And your users mostly don't notice. That gap is expensive. When people can't see a product moving, it feels abandoned, even when you're shipping every week. They churn a little faster, they email asking for things you built a month ago, and all the momentum you're actually creating stays invisible. The fix is boring and old: a changelog. But not a changelog rotting in a Notion doc nobody opens. One that shows up inside your app , where users already are. Here's the approach I settled on. The idea: a widget, not just a page A "what's new" widget is a small button or badge in your UI. Click it, and a panel slides out with your latest updates. Users see it in the flow of using your product, not on some /changelog page they'd never visit. You really want three things: An in-app widget users actually see. A public page and RSS feed you can link from emails and docs. A way to write updates in plain language and publish in a click. The one-tag version I ended up building a tool for this (honest disclosure below), but the integration is the part worth showing, because it's the pattern any changelog widget should follow: <!-- Paste before </body> --> <script src= "https://cdn.patchlog.io/widget.js" data-project= "your-project-id" data-position= "bottom-right" async ></script> One script tag. No SDK, no npm install, no framework coupling. It behaves the same in React, Vue, Rails, or a plain HTML page. Two implementation details matter, whether you build one of these yourself or evaluate an existing one: Render it in a Shadow DOM. A changelog widget should not inherit or leak styles. If it uses the host page's global CSS, it will look broken on half the sites it lands on. Shadow DOM isolates it completely. Fail silently. A marketing widget must never break the host app. If the network call fails, it should quietly do nothing. What to actually write in it The tool is the easy part. T
AI 资讯
I made an AI yell my workouts at me (Sonic Kinetic)
What I built I wanted a workout timer that doesn't just beep at me. So this weekend I built one that writes the workout AND talks me through it, out loud, in a voice that actually sounds like it's yelling at you when things get hard. You give it a callsign, how long you've got, what you want to work, and how brutal you want it. It hands that to Gemini, which breaks the whole thing into 30-90 second intervals with a coaching line for each one. Then every one of those lines gets turned into real audio by ElevenLabs before it ever hits your browser. Nothing is pre-recorded, nothing is a fixed track. Ask for a different workout, get a completely different script and a completely different set of audio clips, generated on the spot. Demo Unedited screen recording, straight off my machine hitting the real APIs, sound included. Compose a routine, it comes back in a couple seconds, pacing curve draws itself as an SVG line, then hitting Start walks through each interval with the active one highlighted in red as it counts down and you actually hear it. The Maximum-intensity segments sound noticeably more unhinged because I turn the ElevenLabs stability knob way down for those specifically. Code https://github.com/marwankous/sonic-kinetic How I built it Go backend, one endpoint. It takes your workout params, sends a prompt to gemini-3.1-flash-lite with a JSON schema locked down tight enough that I don't have to think about parsing garbage back out of it, and gets back a full timeline plus a heart-rate pacing curve. The part I actually enjoyed was the audio pipeline. Every coaching line in the timeline gets fired off to ElevenLabs at the same time, one goroutine each behind a sync.WaitGroup , so a routine with a dozen segments doesn't take a dozen times longer than one with a single segment. Whatever comes back gets base64'd straight onto its segment. I also tie the eleven_flash_v2_5 stability setting to the segment's energy level, dropping it to 0.30 for anything marked Maximum
AI 资讯
Building a Fully Automated Facebook Post Scheduler using Node.js and GitHub Actions
How I Built a Zero-Cost Facebook Auto-Poster Using Node.js and GitHub Actions Automating social media management can save hours of manual work. In this guide, I will show you how to build a fully automated, production-ready system that posts daily motivational quotes with images to a Facebook Page— completely for free , running on autopilot via GitHub Actions. We will also tackle a major pain point: resolving Meta's strict token expiration and permission structures by dynamically fetching a Page Access Token using a Meta Business System User, the officially recommended way for secure automation. 🛠️ Prerequisites Before diving into the code, make sure you have: A Facebook Page A Meta Developer Account A Meta Business Suite (Business Portfolio) A GitHub Account Basic knowledge of Node.js 🎯 Step 1: Configuring Meta Architecture for Secure Automation Meta has deprecated direct publish_actions for user tokens, making automated image uploads tricky. The professional way to solve this is by using a System User bound to a Business Portfolio . 1. Create a Meta App Go to the Meta for Developers dashboard. Create a new app, choose Business and pages as the category, and give it a clean name. 2. Link your Facebook Page Inside your App Dashboard, navigate to App Settings -> Advanced . Scroll down to the App Page section and select your target Facebook Page to link it. 3. Setup a System User Go to your Meta Business Settings ( business.facebook.com/settings ). Under Users , click on System Users and create an Admin System User (e.g., Ttp-penguin ). Click Assign Assets , select your Facebook Page, and turn on the Full Control (Everything) toggle. 4. Generate the Permanent Token Click Generate Token for that System User and select your app. Explicitly check these 3 essential scopes : pages_manage_posts pages_read_engagement pages_show_list Copy the generated token ( EAak2B... ). Save this safely —this token acts as our master key! 💻 Step 2: Writing the Automation Script We will wri
AI 资讯
Hello Dev's
I’m VikingRob—Full-Stack Dev, SaaS Builder, and Solo Survivor. Hello I Just wanted to introduce myself. I’m Robert, but most people know me as VikingRob (thanks to a long red beard and a habit of grinding through hard Jobs with a foul mouth. Down to earth guy I'm a No B.S Person. I’ve been surviving in the trenches of solo entrepreneurship and freelancing for a while now. Lately, the market feels incredibly flooded, and landing solid, consistent work has become a massive mountain to climb. I’ve managed to keep things moving with some passive income from selling front-end and back-end sites I've built, but as anyone with a family knows, "passive" rarely means "enough" when consistency drops. I’m supporting a family of five—including a wife dealing with severe mental health challenges—so the pressure to secure steady, reliable income is incredibly real right now. To adapt, I am shifting my core focus toward offering full-scale services: Custom Website Architecture (End-to-end development) Front-End & Advanced Back-End Integration SaaS Product Development A lot of my heaviest back-end work is locked away under strict NDAs, which makes traditional portfolio-sharing tough, and I don't maintain standard social media accounts. But I know how to build clean, functional, scalable software that drives results. If you're looking to collaborate, need an engineering heavy-lifter for a SaaS project, or just want to swap freelance survival stories, let’s connect! What is everyone else doing to beat the market noise right now?
AI 资讯
Stop Writing Prompt Strings: Meet PromptForge Core
Stop Writing Prompt Strings: Meet PromptForge Core As AI becomes part of modern applications, prompts are no longer just strings—they're becoming part of your codebase . Yet most of us still write prompts like this: const prompt = " You are a helpful assistant. \n " + " Summarize the following text. \n " + " Return the output as JSON. \n " + " Keep it concise. \n " + " Use simple language. " ; This works... Until your project grows. The Problem As prompts become larger, they quickly become difficult to maintain. You start dealing with: ❌ Giant string templates ❌ Copy-pasted prompts ❌ Missing variables ❌ Inconsistent formatting ❌ Provider-specific implementations ❌ Difficult debugging Unlike your application code, your prompts have: No structure No validation No type safety What if prompts were treated like code? That's exactly why I built PromptForge Core . PromptForge is an open-source TypeScript toolkit for building production-ready prompts using a clean, structured API. Instead of writing strings... const prompt = " You are... " You write import { pf } from " @promptforgee/core " ; const summarize = pf . define ({ input : z . object ({ text : z . string (), }), output : z . object ({ summary : z . string (), }), messages : ({ text }) => [ pf . system ` You are an expert summarizer. ` , pf . user ` Summarize: ${ text } ` , ], }); Much easier to read. Much easier to maintain. Features PromptForge focuses on developer experience. ✅ Type-safe prompt definitions ✅ Structured prompt composition ✅ Prompt compilation ✅ Validation ✅ Provider-agnostic architecture ✅ Reusable prompt blocks ✅ Modern TypeScript API Compile Once, Use Anywhere Instead of maintaining different formats for every provider... PromptForge compiles your prompt into provider-specific formats. Prompt Definition ↓ Prompt Compiler ↓ OpenAI Anthropic Gemini Ollama Write once. Compile anywhere. Composable Prompts Large AI applications usually repeat the same instructions. With PromptForge you can compose p
AI 资讯
Your AI coding agent will happily ship a breaking API change. I built an MCP server to catch it.
Last month I watched Cursor confidently rename a field across an entire API, commit it, and open a PR. Clean diff, tests green, looked great. It had also just broken a mobile client and a partner integration that were still reading the old field name — and neither Cursor nor I noticed until much later. That's the thing about AI coding agents and APIs: they're fast, they're fearless, and they have zero awareness of your API contract . An agent will drop an endpoint, make a request field required, or change a response type without any sense that a real consumer out there depends on the old shape. The code compiles. Your tests pass (your tests — not the consumer's). The breakage is completely silent until someone downstream feels it, usually in production, usually from an angry message rather than a failing build. We keep giving agents more power to write API changes and nothing to tell them whether a change is safe to ship . So I built that missing piece as an MCP server. The gap: there's no "is this safe?" step in the loop Think about how you'd catch this manually. You'd diff the old and new OpenAPI spec, look for removed endpoints, removed response fields, tightened request contracts, enum narrowing — the classic breaking changes — and decide whether it's safe to merge or whether you need a version bump and a heads-up to consumers. An agent never does that. It has the code in context, not the contract implications . And "did I just break a consumer?" is exactly the kind of question it should be asking before it hands you a diff. Enter MCP If you haven't used it yet: the Model Context Protocol is a standard way to give AI agents tools — little capabilities they can call. Claude, Cursor, and others all speak it. Instead of the agent guessing, it can call a tool and get a real answer. So the fix is simple to state: give the agent a tool that answers "is this API change safe to ship to my consumers?" — and have it call that before it proposes the change. That's the hero
开发者
Checkout my new post about Typescript.
The Complete TypeScript Mastery Guide Navneet Verma Navneet Verma Navneet Verma Follow Jul 10 The Complete TypeScript Mastery Guide # typescript # webdev # systemdesign # tutorial 5 reactions Add Comment 54 min read
AI 资讯
Building "PitchPassion AI": Transforming Football Passion into Data with Google AI
This is a submission for Weekend Challenge: Passion Edition What I Built I built PitchPassion AI , a web application that transforms text-based football match narratives into informative player performance visualizations using AI. The goal is to help fans quickly understand statistics without having to read lengthy reports. Demo I will include a video demo link below. Video Demo: Video File Code Back-End: Repository Back End Front-End: Repository Front End How I Built It Tech Stack: React for front end, Flask for back end, Google Gemini API. AI Integration: The biggest challenge in sports data analysis is the unstructured nature of the data sources. Match reports typically consist of lengthy paragraphs written by journalists or narratives from spectators. While humans can easily read them, computers (databases) cannot directly process such text into charts or graphs. This is where I utilize the Google Gemini API as a data extraction engine: Natural Language Processing (NLP): Gemini reads the match narrative to comprehend the context—identifying the players involved, the actions performed (goals, assists, tackles), and the quality of those actions. Structured Transformation: I provide specific instructions (prompts) to the model so that it not only understands the text but also transforms it into a JSON format. Data Cleaning: Since AI sometimes includes conversational text in its output, I implemented middleware in Flask to clean the response and ensure that only pure JSON data enters my application. Problem solving: API Stability Issues (Error 503) During development, I frequently encountered 503 Unavailable responses from the Google Gemini API. This was caused by traffic spikes on the server side. Solution: I didn't let the application simply fail. I implemented a retry strategy in my Flask backend. If the API failed due to server load, the system would automatically wait for 2 seconds and retry up to three times before returning an error message to the user. This
AI 资讯
The Complete TypeScript Mastery Guide
Learn TypeScript From First Principles to Senior/Staff-Level Production Engineering If you searched for how to learn TypeScript properly — not just the syntax, but the thinking behind it — this guide is built for that. Most TypeScript tutorials stop at "here's an interface, here's a generic." This one goes further: it's a single, exhaustive TypeScript tutorial and reference that walks through the type system, object-oriented programming, generics, async programming, design patterns, SOLID and DRY principles, error handling, testing, and the tooling that real production teams run in CI — the same TypeScript best practices used at top-tier engineering organizations. Whether you're a beginner looking for a structured TypeScript for beginners path, or an experienced JavaScript developer making the jump to advanced TypeScript and system design, you can read this end to end or jump straight to the section you need using the linked table of contents below. Table of Contents 1. Introduction — What Is TypeScript & Why It Exists 2. Installation, Setup & tsconfig.json Deep Dive 3. Variables & the Complete Type System 4. Functions — Every Form, Overloads, this , and Best Practices 5. Arrays & Tuples 6. Objects & Type Aliases 7. Interfaces 8. Enums & Literal Types 9. Union, Intersection & Discriminated Unions 10. Type Narrowing, Assertions & Type Guards 11. Classes & Object-Oriented Programming 12. Generics — Basic to Advanced 13. Modules, Namespaces & Project Structure 14. Asynchronous Programming — Event Loop to Production Patterns 15. Advanced/Utility Types & the Type-Level Programming Toolkit 16. Design Patterns in TypeScript 17. SOLID, DRY, KISS, YAGNI — Principles Applied With Real TS Code 18. Error Handling Strategies 19. Testing TypeScript 20. Tooling, Linting, Build Systems & CI/CD for Production TS 21. Performance, Compiler Internals & Scaling Large Codebases 22. Interview Cheat Sheet (Expanded) 23. One-Page Quick Revision Sheet 1. Introduction — What Is TypeScript & W
AI 资讯
From AI Council to Delivery System
How I Supervise Three Engineering Workflows at Once Three Workflows, One Operator Right now, I have three engineering workflows open. One is under council review. Four AI roles are challenging an architectural proposal, and I will need to decide which objections actually change the plan. The second is already in implementation. That one does not need me at the moment. The specification is approved, the boundaries are clear, and the executor can keep moving. The third has come back from audit. The findings are valid, but corrective work is paused. A remediation plan exists, and someone other than the executor needs to review it before any more code changes. This is the part that still feels new: I can move between all three without reopening old chats and rebuilding the story in my head. A few months ago, even one workflow could take most of my attention. I carried context between every stage: rewriting role prompts, moving decisions between conversations, tracking the current document, and turning audit findings into the next round of work. The AI council itself was already useful. It produced strong reasoning and exposed assumptions I would probably have missed. But I was still the glue around it. The council improved the decisions. The system around it made those decisions easier to carry into implementation, audit, and correction without losing control. Conversations Were No Longer the Workflow The main change was simple to describe: I stopped treating the workflow as a series of conversations. Chats are good for thinking. They are not a good place to keep authority. Before this change, a decision might exist somewhere in a long discussion. The next agent had to interpret it, and I had to remember whether it was final, provisional, or already replaced. Now the state of the work lives in a small set of artifacts. Evidence becomes a source-grounded brief. Decisions become an approved specification. The specification becomes bounded implementation. The implementatio
AI 资讯
The Shell You Know vs The Shell You Deserve
Hello, I'm Maneshwar. I'm building git-lrc, a Micro AI code reviewer that runs on every commit. It is free and source-available on Github. Star git-lrc to help devs discover the project. Do give it a try and share your feedback. You've been using the terminal for months/ years. Maybe you cd into a folder, ls around, run your script, and call it a day. That's fine. That's like knowing how to boil water and calling yourself a chef. But the terminal has layers . It's basically an onion that occasionally makes you cry, usually around 12 AM when a script fails silently and you have no idea why. So grab your coffee and let's talk about the command line tricks that actually make your life better. Not the "did you know ls -la shows hidden files" tier tips. Your Terminal Has A Memory. Use It. Most devs mash the up arrow like it's 2007 and they're trying to beat a Flash game. Stop that. Press ctrl-r instead. It searches your command history live. Type a few letters, it finds the last matching command. Press ctrl-r again to cycle back further. Found it? Hit Enter to run it, or the right arrow to drop it into your prompt so you can edit it first. ctrl-r ( reverse-i-search ) ` docker run ` : docker run -it --rm -v $( pwd ) :/app node:20 bash Pair this with ctrl-w (delete last word) and ctrl-u (nuke the line back to the cursor) and you'll start editing commands like you're speedrunning a text adventure. And if you're the type who types a whole essay of a command and then realizes you forgot something at the start, ctrl-a jumps to the beginning of the line and ctrl-e jumps to the end. No more holding the left arrow key like it owes you money. Pro tip: if you're a TUI fan and ctrl-r's default search feels a bit flat, check out McFly xargs Is The Friend Who Actually Shows Up Pipes ( | ) are great. They pass output from one command into another. But sometimes you don't want to pass output as input , you want to pass it as arguments . That's where xargs comes in, and once you get it,
AI 资讯
Why Your Application Needs Observability: Building a Self-Hosted Observability Pipeline with the LGTM Stack (Loki, Grafana, Tempo, Mimir)
Understanding Observability with the LGTM Stack From "what happened last night?" to "here's exactly what happened and why" — in under 5 minutes Table of Contents Introduction What Is Observability? The Three Pillars of Observability Metrics Logs Traces Why You Need All Three Together The LGTM Stack Architecture: How It All Fits Together OpenTelemetry: The Instrumentation Standard The OTel Collector: The Brain of the Pipeline Loki: Log Aggregation Tempo: Distributed Tracing Mimir: Metrics at Scale Grafana: Connecting the Dots Conclusion Introduction Let me tell you a story that probably sounds familiar. It's 2 AM on a Sunday. Your API is slow. Users are complaining. But you're not at your desk — you're in a Sleeping, or just living your life. You have no idea it's even happening. The next morning you walk into the office and your boss meets you at the door. "Hey, the API was really slow yesterday around 2 AM. What happened?" And you're stuck. Completely stuck. You pull up the server logs — it's a wall of unformatted text. Maybe the issue already fixed itself. Maybe the container restarted overnight and the logs are gone. You weren't there, and your system left no trail. So you say the thing every developer dreads saying: "I don't know. I'll look into it." Now imagine the exact same situation — but this time you have observability set up. You open your dashboard, set the time range to yesterday 2 AM, and within two minutes you can see everything. Response times spiked to 4 seconds. The database connection pool got exhausted. And it started the exact moment a scheduled batch job kicked off and hammered the DB with hundreds of queries at once. You have a graph. You have traces. You have the exact log line that caused it. You walk back to your boss with your laptop: "Here's what happened and here's the fix." That's observability. Your system tells its own story — even when you're not watching. That's what this blog is about. I'll walk you through what observability actua
AI 资讯
Top 10 GEO Checker and AI Visibility Tools in 2026
AI search is changing how brands get discovered. Ranking on Google is no longer the only goal. Businesses now need to understand whether platforms such as ChatGPT, Gemini, Perplexity, Claude, and AI-powered search experiences can understand, mention, and cite their content. That is where GEO checkers and AI visibility tools come in. Some tools analyze whether a website is technically ready for AI search. Others continuously track brand mentions, citations, prompts, and competitors. Below are the 10 best GEO checker and AI visibility tools in 2026 . Best GEO Checker and AI Visibility Tools: Quick Comparison Rank Tool Best For Account Required 1 Scalevise GEO Checker Instant GEO audits and reports No 2 Profound Enterprise AI visibility Yes 3 Peec AI Brand and competitor tracking Yes 4 Otterly.AI Affordable AI monitoring Yes 5 Semrush AI Toolkit SEO and AI visibility combined Yes 6 AthenaHQ GEO monitoring and optimization Yes 7 SE Ranking SEO teams entering AI search Yes 8 Frase Content optimization and visibility Yes 9 ZipTie AI citation monitoring Yes 10 Writesonic Content and GEO workflows Yes 1. Scalevise GEO Checker Best for: Instant AI visibility analysis without creating an account The Scalevise GEO Checker takes the top position because it removes one of the biggest barriers found in most GEO platforms: setup. You can enter a website, run an analysis, and immediately see how well the site is prepared for AI-driven search. No account is required. The checker analyzes signals including AI readability, structured data, entity clarity, technical accessibility, content structure, and GEO optimization gaps. A major advantage is reporting. Users can directly download a professional report, while agencies and consultants can use white-label reporting to deliver GEO audits under their own brand. Key advantages: No account required Instant GEO analysis Downloadable reports White-label reporting Technical and content-based checks Built for agencies, consultants, and websi
AI 资讯
Day 125 of Learning MERN Stack
Hello Dev Community! 👋 It is officially Day 125 of my software engineering marathon! Today, I crossed an elite milestone in frontend data architecture: moving completely away from local hardcoded mock lists by connecting my centralized state management infrastructure to live third-party servers using the Fetch API alongside Async/Await ! ⚛️🌐⚡ Now, the social media feed dynamically handles server-side data models, passes payloads to an active state reducer, and broadcasts states down to presentation layers via a custom Context portal! 🛠️ Deconstructing the Day 125 Async Network Lifecycle As shown inside my development setup across "Screenshot (279).png" , "Screenshot (280).png" , and "Screenshot (281).png" , the application state engine is clean and modular: 1. Extensible Central State Reducers ( PostList.jsx ) Engineered explicit structural actions inside the reducer core to seamlessly support both user generation and full-scale network array overriding: javascript } else if (action.type === "NEW_INITIAL_POSTS") { NewPostValue = action.payload.posts; }
AI 资讯
Linux Foundation Launches Akrites to Protect Critical Open Source Software from AI-Powered Threats
The Linux Foundation has launched Akrites, a new industry-wide initiative aimed at defending the world's most critical open source software against a rapidly evolving generation of AI-enabled cyber threats. By Craig Risi
AI 资讯
GitHub Copilot CLI Gets Tabs and No-Config-File Tool Setup in Redesigned Terminal UI
GitHub has made the redesigned GitHub Copilot CLI terminal interface generally available. It adds a tabbed layout for sessions, gists, issues, and pull requests; an in-session, form-driven setup for MCP servers, skills, and plugins that avoids hand-editing config files; and a cleaner, theme-aware, more accessible UI with screen reader support. By Mark Silvester
AI 资讯
Why Cursor Keeps Writing Prototype Pollution Into Your Merge Code
TL;DR AI editors love writing recursive merge helpers, and most of them are open to prototype pollution. One crafted JSON payload with a proto key can flip an isAdmin flag on every object in your app. Guard the keys or merge into a structure that has no prototype. It is a three-line fix. I asked Cursor for a "deep merge two config objects" helper last week. It gave me eight lines that worked perfectly on my test data. It also gave me a prototype pollution hole big enough to walk through. The function looked fine. That is the problem. Prototype pollution does not show up when you run the happy path. It shows up when someone sends you a key called proto . The code Cursor handed me (CWE-1321) function merge ( target , source ) { for ( const key in source ) { if ( source [ key ] && typeof source [ key ] === ' object ' ) { target [ key ] = merge ( target [ key ] || {}, source [ key ]); } else { target [ key ] = source [ key ]; } } return target ; } Now feed it something a user controls, like a parsed JSON request body: merge ({}, JSON . parse ( ' {"__proto__": {"isAdmin": true}} ' )); ({}). isAdmin ; // true You did not set isAdmin on anything. You set it on every object in the process. Any later check like if (user.isAdmin) now passes for objects that never had that field. Why this keeps happening The recursive merge pattern is all over old blog posts and StackOverflow answers, and almost none of them guard the special keys. The model learned merge from that corpus. It reproduces the shape of the answer, including the missing check, because the missing check never breaks a test. A for...in loop also walks keys like proto when they arrive as ordinary string properties from JSON.parse, which is exactly how the payload gets in. The fix Skip the dangerous keys, or merge into something that has no prototype to pollute. function merge ( target , source ) { for ( const key in source ) { if ( key === ' __proto__ ' || key === ' constructor ' || key === ' prototype ' ) continue ;
AI 资讯
Every AI provider fails in its own way. I stopped checking status codes and built an error model instead.
I built an API gateway that routes between OpenAI, Anthropic and Gemini. I figured integrating both providers would be the hard part. It wasn't. Calling their APIs is maybe an afternoon of work each. The hard part showed up later, the first time something went wrong. The moment it broke Early on, my error handling was basically: catch whatever the provider throws, forward the status code, move on. } catch ( error ) { res . status ( error . status || 500 ). json ({ error : error . message }) } This worked fine until I actually looked at what each provider sends back when something goes wrong. OpenAI wraps its errors in an object with a type and sometimes a code . Anthropic wraps its errors differently, with its own type field that means something else entirely. A 429 from one provider might mean "you're sending too fast, back off." A 429 from another context might mean something closer to "we're out of capacity right now, this isn't really about your rate at all." If you're just forwarding error.status and error.message straight through, none of that nuance survives. Your own error handling ends up being provider-specific whether you meant it to be or not, because the shape of the failure is different depending on who you called. What I built instead Instead of trusting each provider's raw error shape, every call now normalizes into the same internal error model before it reaches the response: } catch ( error ) { const classified = classifyProviderError ( error ) res . status ( classified . httpStatus ). json ({ error : ' AI provider error. Please try again. ' , error_class : classified . error_class , provider : classified . provider }) } error_class is one of a small fixed set: rate_limited , overloaded , quota_exceeded , invalid_request , authentication_error , server_error . That's true regardless of which provider actually failed. The raw provider error still gets logged for me to debug, but what the caller sees is the category of failure, not the provider's spe
AI 资讯
Node.js Internals Explained by Uncle to Nephew — Part 4: Express Plumbing, Error Handling & The Full Roadmap
Bonus round. Parts 1–3 covered why Node exists, what's happening inside it, and the full request journey. This part mops up the pieces that didn't fit anywhere else — the Express plumbing, error handling, and a checklist to test yourself against. Saturday, Round 4 Nephew: Uncle, one more round? I promise this is the last one for a while. Uncle: pours chai — you said that last time too. Fine, what's bugging you now? Nephew: Small things, actually. express.json() , cookie-parser , express.Router() — I use all of them, copy-pasted from old projects, but I couldn't explain any of them if you asked me directly. Uncle: That's exactly the right instinct — the things you copy-paste without understanding are always the things that break at 2 AM. Let's fix that. Part 4.1 — Two Directions Node Never Confuses Uncle: Before plumbing, one small but important idea that ties Parts 2 and 3 together. Everything Node does falls into exactly two directions . DIRECTION 1 — Incoming Events "The outside world is telling Node something happened" OS → libuv → Event Loop → Your JavaScript Examples: HTTP request arrives, TCP connection opens, WebSocket message arrives DIRECTION 2 — Outgoing Async Operations "Your JavaScript is asking Node to go do something" JavaScript → libuv → Worker Thread → OS → Disk/DB ↓ result comes back through libuv → Event Loop → your callback Examples: fs.readFile(), crypto.pbkdf2(), dns.lookup() Nephew: So an incoming HTTP request and a fs.readFile() call both eventually pass through libuv and the event loop — but they enter from completely opposite directions? Uncle: Exactly. One is the world pushing something at Node. The other is Node reaching out to go get something. Same event loop handles both, but the journey to get there is different — an HTTP request never touches the thread pool; a file read almost always does. Incoming HTTP Request: File Reading: Browser JavaScript | | OS libuv | | libuv Worker Thread | | Event Loop Operating System | | JavaScript Disk |