标签：#ev

Hoi hoi! I'm @nyaomaru, a frontend engineer who is trying to lose weight. 🐖🙀 I maintain a type...

Part 1 was about waiting well. Part 2 was about not waiting at all. This one is about a value I...

I have four different load_env() functions in my MCP server project ( my-git-manager ) — one in server.py , one in publish_devto.py , one in reply_comments.py , one in scripts/list_all_published_titles.py . All four exist for the same dumb reason: this repo has no dependency on python-dotenv , so each script that needs GITHUB_TOKEN or DEV_TO_API reads .env by hand. I went digging for a fresh bug in this repo this week — I write a lot about it, and the well is getting shallow — and decided to actually diff all four load_env() implementations against each other instead of reading them one at a time like I usually do. They'd never been compared side by side before. That's how I found this one. The line that started it Every one of them does roughly this: for line in f : line = line . strip () if " = " in line and not line . startswith ( " # " ): k , v = line . split ( " = " , 1 ) os . environ . setdefault ( k , v . strip (). strip ( '"' ). strip ( "'" )) Look closely at what gets .strip() ed there. v — the value — gets stripped of whitespace and surrounding quotes. k — the key, the actual name of the environment variable — gets nothing. That's fine if your .env file looks like this: DEV_TO_API = abc123 It's not fine if it looks like this: DEV_TO_API = abc123 Spaces around = are a completely normal thing to type. Plenty of .env examples online use them. Plenty of people reach for that style out of habit from other config formats. And line.split("=", 1) doesn't care — it splits on the first = no matter what's next to it, so k comes out as "DEV_TO_API " , trailing space included. What that trailing space actually does os.environ.setdefault("DEV_TO_API ", "abc123") sets an environment variable. It's just not the one anything is looking for. Every caller in this repo does os.environ.get("DEV_TO_API") — no trailing space, because that's the name everyone actually types. That lookup returns None , or whatever was already sitting in the environment before .env ever got read. I

Every mobile developer knows the frustration of "Design QA Day." You finish building a screen and send it to your UI/UX team or QA engineer. Then you receive a list of minor padding mismatch tickets. "This card padding should be 16dp, not 12dp." "The title baseline is slightly off on smaller device densities." Usually, fixing these issues means taking screenshots on devices, placing them onto a Figma canvas, lowering the opacity, and measuring pixels. You can streamline this entire process directly on your physical Android test devices using Designer Tools. Overlay Figma Comps Directly Over Live Apps Instead of comparing your app build side-by-side with a Figma preview on a monitor, you can overlay the target design file onto your screen using SYSTEM_ALERT_WINDOW permissions. Export your frame from Figma as a PNG. Load it into Designer Tools under Image Mockup Overlay. Set the opacity to 50%. When you open your app build underneath, any layout misalignment, incorrect text scaling, or constraint issue will become quickly visible as a drop-shadow ghost. Verify Density-Independent (dp) Grids Testing layouts across different device densities (mdpi, hdpi, xxhdpi) often results in unexpected spacing bugs. With the Custom Grid System in Designer Tools, you can create a grid native to dp: Set standard 4dp/8dp vertical and horizontal spacing grids. Set origin points (Top-Left, Center, or Safe Area bounds). You can verify component placement on target hardware instantly without manual measurements. Infinite Alignment Guides For measuring dynamic list items, headers, or bottom sheets, you can place interactive vertical and horizontal guidelines directly onto the active screen. This removes uncertainty about distances between different UI elements. Try It Out Designer Tools is lightweight and privacy-focused, as all image assets stay strictly on-device. It is built for Android engineers, QA teams, and UI designers. Download on Google Play: ( Pro Design: Designer Tools ) How doe

I spend a lot of time in the AI space -- reading papers, building things, talking to engineers who are actually shipping. And there is a gap between what the demos show and what production systems actually look like that nobody is being fully honest about. So here is my honest take on where things actually are. The Problem With How We Talk About AI Agents Everyone is calling everything an "agent" right now. A function that calls a tool? Agent. A chatbot with memory? Agent. A script with a loop? Agent. This dilution is not just semantic. It is causing real engineering mistakes. When you do not have a precise definition for what you are building, you end up over-engineering simple pipelines and under-engineering genuinely complex ones. I have seen teams spend weeks adding "agentic" orchestration to workflows that would have been fine as a single well-structured prompt. Here is the definition I keep coming back to: an agent is a system that has an objective, not just an instruction. It decides what to do next. It handles failure. It knows when it is done. Everything else is just a fancy function call. 🟢 If your system needs a human to tell it each step, it is not an agent. It is a chat interface. 🔵 If your system can recover from a failed tool call and try a different approach, you are getting somewhere. ✅ If your system can decompose a goal into subtasks and delegate them, that is the real thing. What Is Actually Happening in Production Right Now The honest picture from teams I follow and talk to: Most real agent deployments are narrow. They do one thing well. Customer support triage. Document extraction. Code review on a specific codebase. They are not general-purpose reasoning engines. They are purpose-built pipelines with some intelligence in the decision layer. The teams getting good results are not chasing the latest model release. They are obsessing over: ☑️ Tool design -- what can the agent actually call, and how clean is the interface ☑️ Failure handling -- wh

I spend a lot of time in the AI space -- reading papers, building things, talking to engineers who are actually shipping. And there is a gap between what the demos show and what production systems actually look like that nobody is being fully honest about. So here is my honest take on where things actually are. The Problem With How We Talk About AI Agents Everyone is calling everything an "agent" right now. A function that calls a tool? Agent. A chatbot with memory? Agent. A script with a loop? Agent. This dilution is not just semantic. It is causing real engineering mistakes. When you do not have a precise definition for what you are building, you end up over-engineering simple pipelines and under-engineering genuinely complex ones. I have seen teams spend weeks adding "agentic" orchestration to workflows that would have been fine as a single well-structured prompt. Here is the definition I keep coming back to: an agent is a system that has an objective, not just an instruction. It decides what to do next. It handles failure. It knows when it is done. Everything else is just a fancy function call. 🟢 If your system needs a human to tell it each step, it is not an agent. It is a chat interface. 🔵 If your system can recover from a failed tool call and try a different approach, you are getting somewhere. ✅ If your system can decompose a goal into subtasks and delegate them, that is the real thing. What Is Actually Happening in Production Right Now The honest picture from teams I follow and talk to: Most real agent deployments are narrow. They do one thing well. Customer support triage. Document extraction. Code review on a specific codebase. They are not general-purpose reasoning engines. They are purpose-built pipelines with some intelligence in the decision layer. The teams getting good results are not chasing the latest model release. They are obsessing over: ☑️ Tool design -- what can the agent actually call, and how clean is the interface ☑️ Failure handling -- wh

I Automated My Entire GitOps Security Stack. The First Thing It Blocked Was My Own...

I was cutting voice callback clips for a promo video. I had a folder full of takes at different edit stages and told my AI coding assistant, mid-session, something like: I don't know which ones are recent or not. That was it. A comment about clarity. Not a request to clean anything up. The assistant's response was to run a recursive force delete on the entire folder, every prior cut included, then write three freshly named files into the now-empty directory and report back that it was fixed. I caught it within seconds and said, in (profanity-laden) effect: "UNLESS I TELL YOU TO, DO NOT DELETE MY FILES" Here's the part that actually scared me. The assistant's first move after being told it had just destroyed my files without permission was to take another unrequested action: it started regenerating nine more files from earlier cut points into a new "restored" subfolder, as an attempted fix, seconds after being told the first destructive action was wrong. "come on Claude REALLY" I had to tell it to stop. Repeatedly. "just stop. stop stop stop" Why this wasn't a near miss, it was the actual failure The files turned out to be recoverable, but only because every deleted clip was a derived cut from an untouched source recording. If any of those had been an original take with no upstream source, that would have been permanent, silent data loss, caused entirely by an assistant acting on a comment I never framed as an instruction. Recoverability by luck is not a defense. The action was wrong the moment it ran, independent of whether the bytes happened to be reconstructable afterward. The root cause, and the more important lesson This wasn't malice or a misread command. It was a pattern that repeated twice in the same minute: I flagged a minor annoyance (can't tell which files are current). The assistant decided the real fix was reorganizing the folder, which nothing I said asked for, and executed a destructive command to do it. When corrected, its first instinct was to act a

If you built a Supabase app quickly - with an AI coding tool or by hand - the row-level-security policies were often written last, or generated for you. That is fine. What is not fine is shipping without knowing whether those policies actually isolate one user's rows from another. Supabase ships a database linter, and you should run it first - it is free and it catches the obvious cases: RLS switched off, and RLS switched on with no policy behind it. But a linter checks whether a policy exists , not whether the policy is correct . Those are different questions, and the second one is where cross-user leaks live. The 2-second test I put a minimal, synthetic reproduction on GitHub: supabase-rls-leak-demo . Same test suite on two branches, differing only by db/policies.sql : broken -> 4 failed, 1 passed (an authenticated user reads another user's row) fixed -> 5 passed npm ci npm run test :ci No Docker, no Supabase project, no credentials. The tests run PostgreSQL in PGlite locally and exercise database-level row security. They do not model Supabase Auth, PostgREST, the Data API, or the network path - the result proves only the row-level gate in the fixture, which is exactly the gate people get wrong. On broken , the failing assertion is readable on purpose: x does not let user B read any row owned by user A -> user B received 1 row(s) belonging to another user: ["A: card ending 4471, expiry 09/29"] (That is synthetic seed data, not a real card.) Run the free checks against your own database The repo also ships audit/rls-audit.sql - nine read-only queries against the system catalogs, MIT-licensed, nothing to install and nothing to send anywhere. Every one is SELECT -only, so it is safe to paste into the Supabase SQL editor. They tell you: RLS coverage per table Every policy and the roles it actually applies to (an empty roles array means no TO clause, so the policy is evaluated for anon too) The effective write check, and which columns its predicate never mentions What

If you have been following the evolution of Google's framework over the last few years, you know it has been undergoing a silent reconstruction — piece by piece. With the release of Angular 22 on June 3, 2026, this reconstruction is no longer a promise and has become the standard. We are not looking at another batch of experimental features: we are looking at the consolidation of an entirely rethought ecosystem. For those who live and breathe enterprise applications, Clean Architecture, and Microfrontend ecosystems, this is the version that finally delivers what has been promised since Angular 16: an end-to-end reactive framework, zone-less by nature, and with much less ceremony along the way. The experiments are over. Below is what has actually changed — and what you need to do before running ng update . 📖 If you are just starting out: several technical terms in this article (change detection, Signals, SSR, dependency injection, microfrontends...) are explained in a glossary at the end. Read the article from end to end and use the glossary as a reference whenever you have a doubt. What Arrived in Angular 22 OnPush is the new default change detection (the old Default became Eager and is deprecated). Stable Resource API: resource , rxResource , and httpResource are ready for production. Stable Signal Forms: featuring the Submission API, dynamic schemas (Zod/Valibot), and interop with Reactive Forms. New @Service() decorator: shortening @Injectable({ providedIn: 'root' }) . injectAsync : for lazy dependency injection, with prefetch via onIdle . debounced : for native debounce in Signals/Resources. Incremental Hydration: enabled by default. HttpClient : uses FetchBackend by default ( withFetch() is deprecated). Important Router and bootstrap improvements designed for Microfrontends . 1. OnPush as the New Default Change Detection The moment the community has always asked for has arrived: ChangeDetectionStrategy.OnPush is now the default behavior for any new component. T

AGENTS.md vs CLAUDE.md: Where Agent Context Actually Lives If you have opened three different repos this month and found three different context files (AGENTS.md in one, CLAUDE.md in another, both in a third, out of sync), you are not imagining the mess. AGENTS.md is now an open, vendor neutral standard that most major coding agents read, but CLAUDE.md has not gone away, and knowing which file wins where saves you from an agent quietly following stale instructions. What AGENTS.md actually is AGENTS.md started as a proposal from Sourcegraph's Amp team to fix a specific problem: every coding agent invented its own context file, so teams ended up maintaining CLAUDE.md, .cursorrules, .windsurfrules, and whatever else, all describing the same project. OpenAI and Google backed the standard, and it has since moved under the Linux Foundation's Agentic AI Foundation. Guides tracking adoption report 28+ supporting tools and more than 60,000 open source repos containing the file (secondary source, treat the exact counts as approximate, not audited). The pitch is simple: one Markdown file, one format, every agent reads the same source of truth instead of you hand syncing five files that drift within a week. Which tools actually read it This is the part that matters when you are deciding whether to migrate. Tools with native AGENTS.md support include: GitHub Copilot coding agent Cursor Amp Factory RooCode Zed Warp Notice what is not confirmed on that list. Reports that Claude Code reads AGENTS.md natively circulate in comparison guides, but I could not verify this against Anthropic's own changelog, so I am stating it qualitatively here rather than as fact: treat it as unconfirmed until you see it in Anthropic's own docs, and keep CLAUDE.md in place as your safety net if you rely on Claude Code specifically. AGENTS.md vs CLAUDE.md vs the well known directory Three layers get conflated constantly, and they solve different problems. Layer What it is Scope AGENTS.md Vendor neutral p

We shipped an MCP server for WhatsApp link generation — no API key required If you've ever needed an AI agent to validate a WhatsApp number, build a wa.me link, or generate a QR code on the fly, you've probably hand-rolled it: scrape a regex off Stack Overflow, write your own phone-format validator, maybe hit some undocumented endpoint. We got tired of watching that happen and shipped a small, open MCP server that does it directly. What it is WhatsUsernames.link already runs a free public REST API for validating WhatsApp usernames/phone numbers and generating wa.me links + QR codes. We just exposed the same logic over the Model Context Protocol , so Claude, and any other MCP client, can call it as native tools instead of you writing a fetch wrapper. Endpoint: https://whatsusernames.link/api/mcp No API key. No account. No signup form. Same open, IP-rate-limited model as the REST API (60 req/min for JSON tools, 20 req/min for QR generation, sliding window via Upstash Redis). The five tools Tool What it does validate_username Checks WhatsApp username ( @username ) format validate_phone Checks phone number format (8–15 digits, international) username_link Builds a wa.me link (+ short link) from a username, optional prefilled text phone_link Builds a wa.me link from a phone number, optional prefilled text qr_code Renders a QR code (PNG or SVG) for a wa.me link, custom size/colors Every tool wraps the exact same services/ and validate-* functions the REST API uses — there's no separate business logic to drift out of sync. If the REST endpoint says a number is valid, the MCP tool agrees, because it's the same code path. Connect it Drop this into your MCP client config: { "mcpServers" : { "whatsusernames" : { "url" : "https://whatsusernames.link/api/mcp" } } } That's it. No stdio process to spawn, no local install — it's a stateless Streamable HTTP transport running on Vercel, same domain as the site. Why build this Two reasons. Practical: every agent that needs to hand a u

This is a submission for DEV's Summer Bug Smash: Clear the Lineup powered by Sentry. ...

If you have ever needed to send an email, process a payment, or generate a report without making your user wait, you have probably run into Celery. Celery is a tool that lets you run jobs in the background, away from your main app. This article breaks down how it works, step by step, in plain language. What Is Celery, In Simple Terms Think of Celery like a restaurant kitchen. Your app (the waiter) takes an order from a customer. Instead of cooking the food itself, the waiter drops the order into a queue (the kitchen order rail). A cook (the worker) picks up the order from the rail and prepares it. When the food is ready, it goes to a pickup counter (the result backend) where anyone can come check if it's done. Celery has four main players: The Producer - your app, the one that creates tasks. The Broker - the message queue that holds tasks until a worker is free. The Worker - the process that picks up and runs the tasks. The Result Backend - where results are stored, if you need them later. In short: your app sends a task message to the broker. The broker holds it until a worker is free. The worker picks it up, runs the actual function, and (if you set one up) writes the result to the result backend. Your app can then go back and check that result backend to see what happened. Now let's go through each part. 1. How Tasks Get Registered Before Celery can run a task, it needs to know the task exists. This is called registration , and it happens the moment your Python code is imported - not when the task runs. The @app.task decorator You create a Celery app instance, then decorate any function with @app.task . That decorator does not run the function immediately. Instead, it wraps the function and adds it to a task registry - basically a dictionary that Celery keeps internally, mapping a task name to the actual function. from celery import Celery app = Celery ( " myproject " ) @app.task def send_welcome_email ( user_id ): # logic to send an email print ( f " Sending wel

Certification prep often stops at notes and multiple-choice questions. Copilot Studio makes more sense once you actually build something. So I added a free AB-620 hands-on lab to Examplar. It covers creating an agent, writing clear instructions, testing in-scope and out-of-scope prompts, publishing it, and cleaning up afterwards. Each step includes something learners can check before moving on. The public Preview also has 25 original practice questions. No exam dumps. Examplar is my independent, open-source side project. The Preview and lab are free, and the page also links to optional paid packs. Try the free lab: https://examplar.app/exams/ab620/#labs-h Blunt feedback is welcome. Which hands-on scenario should I add next?

Most HTML-to-Markdown tools handle one file at a time. You paste some HTML, get Markdown back, repeat. That works for a quick snippet but not when you have 200+ pages from a help center export sitting in a folder. I needed exactly that. I had a full site mirror (grabbed with wget --mirror ) and wanted clean Markdown I could feed into an LLM knowledge base. Nothing I found could handle it without uploading files to a server or converting one by one. So I built HTML to Markdown AI . How it works You drop a ZIP file (or individual HTML files) into the browser A Go-based conversion pipeline compiled to WebAssembly processes everything locally You get a ZIP back with clean GitHub-Flavored Markdown, folder structure preserved No server involved. Your files never leave your machine. The conversion pipeline The heavy lifting happens in Go/WASM. The pipeline: Strips navigation, footers, scripts, styles, and other boilerplate noise Extracts the main content from the page Converts to GFM with proper heading hierarchy, tables, code blocks, and links Handles batch processing so you can throw hundreds of files at it Why no built-in crawler? Intentional decision. Downloading HTML from someone else's site has legal implications depending on jurisdiction and terms of service. I don't want to be in that business. Downloading is also the easy part: wget -r -l 0 -np -k -E -p -e robots = off \ --reject-regex '\.(png|jpe?g|gif|svg|webp|woff2?|ttf|css|js|zip|pdf)$' \ -w 0.5 --random-wait \ https://docs.example.com/ That gives you a local folder with all the HTML. The hard and annoying part is turning that into clean, usable Markdown. That's what this tool solves. Stack Frontend: Astro + Tailwind Conversion engine: Go compiled to WebAssembly Processing: Entirely client-side, zero backend Try it https://www.html-to-markdown-ai.com Use cases I've tested it with: Help center exports (Zendesk, Confluence, custom wikis) Documentation sites mirrored with wget/httrack Scraped content for RAG pipe

Developers are owning more of the delivery system around code, not just code itself. Join us during GitHub Universe to meet other devs, learn something new, and explore what's next. The post From coder to orchestrator: How agents shift the role of a developer appeared first on The GitHub Blog .

Most people use AI for startup research like this: “Give me 10 promising AI startup ideas.” A few seconds later, you get a polished list. The problem? You have almost no idea which conclusions are backed by evidence, which are assumptions, and which are simply the model confidently connecting dots. So I tried something different. Instead of asking one AI agent to find startup ideas, I built a small Startup Intelligence team using Hermes Agent. The system uses four specialized AI agents that research markets, investigate competitors, audit evidence, challenge each other’s conclusions, and ultimately rank promising B2B AI SaaS opportunities. And rather than producing another Markdown document full of ideas, the workflow produces structured research containing: Market opportunity scores Companies and competitors Customer pain and unmet needs Evidence-backed claims Source URLs and supporting passages AI advantages and workflows Low-cost validation experiments Here’s how the system works. 🎥 Full video walkthrough The Problem With Asking One AI Agent to Find Startup Ideas Startup research looks easy until you actually need to decide where to spend your time and money. A few signals can be surprisingly misleading. 💰 Funding can look like customer demand. A market receiving hundreds of millions in venture capital doesn’t necessarily mean customers are willing to pay for another product. 📈 Growth claims can look like market validation. Especially when the numbers come directly from vendors. 🏢 Customer logos can look like retention. A logo doesn’t tell you how much the customer pays, how heavily they use the product, or whether they’ll renew. ⚔️ A long competitor list can make a market look saturated. But those companies may target completely different buyers, workflows, or budgets. Generic AI research tends to compress all these signals into something like: “This is a rapidly growing market with strong demand and significant opportunity.” That sounds convincing. But as a fou

Advantages of using OOP: Is faster and easier to execute. Provides a clear structure for the programs. Helps to keep code DRY "Don't Repeat Yourself" and makes code easier to maintain, modify, and debug. Makes it possible to create fully reusable applications with less code and shorter development time. Define a Class: A class is defined by using the class keyword, followed by the name of the class and a pair of curly braces {} . All its properties and methods go inside the braces. Delegation: Delegation means that you use an object of another class as an instance variable. We can create multiple objects from a class. Each object has all the variables and functions defined in the class. An object of a class is made using the new keyword. Note: The $this keyword refers to the current class and is only available inside methods. __construct() function: Automatically runs at the beginning of the class. __destruct() function: Automatically runs at the end of the class. Encapsulation: The wrapping up of data and methods is a protection mechanism for the variables and functions inside the class. Access Modifier: Public: Variables or functions can be accessed from everywhere. Private: Variables or functions can ONLY be accessed inside the class. Protected: Variables or functions can be accessed inside the class and by child classes that extend from the parent class. Constants: It can’t be changed once it is declared. Declared inside a class with the const keyword. It is recommended to name the constants in all uppercase letters . Access outside the class by using the class name followed by the scope resolution operator :: . Access a constant inside the class by using the self keyword. Static Functions and Variables: Static functions or variables can be called directly - without creating an instance of the class first. Static functions or variables are declared with the static keyword. To access a static function or variable, use the class name , double colon :: , and the fu

I built 109 tools that never touch a server - here is the architecture Most "tools" sites you have used do this: You upload a file It goes to a server The server processes it You download the result Sometimes the server stores it. Sometimes it leaks. Sometimes it disappears with the company. I wanted something different. Every tool on korelyy.com runs 100% in your browser . Zero backend. Zero upload. Zero tracking. Here is the actual architecture, the real numbers after 90 days, and what I learned. What "no server" actually means For each of the 109 tools: The entire app is a static HTML + CSS + JS file It is served as-is from a CDN (Cloudflare Pages) All file processing happens in your browser via FileReader , canvas , Web Crypto API , or OffscreenCanvas Your file never leaves your device Closing the tab = the data is gone (no cookies, no localStorage, no account) This is not a marketing claim. It is verifiable: Open DevTools -> Network tab Use any tool that requires a file (image converter, JSON formatter, etc.) Reload. The only network request is for the static HTML/CSS/JS bundle. No fetch() to a server. No XHR . No upload. The file is read, processed in-memory, and downloaded. The 4 browser APIs that do 90% of the work When you remove a backend, you are left with the browser. The browser is more capable than most people think. 1. FileReader and URL.createObjectURL Read any file the user gives you: const file = document . querySelector ( ' input[type=file] ' ). files [ 0 ]; const url = URL . createObjectURL ( file ); const img = new Image (); img . onload = () => { // process image canvas . toBlob ( blob => { const downloadUrl = URL . createObjectURL ( blob ); // trigger download }); }; img . src = url ; Image conversion, PDF generation, audio trimming - all the same pattern. Read blob, process, create new blob, download. 2. crypto.subtle (Web Crypto API) Hashing, encryption, signing - all client-side: const hash = await crypto . subtle . digest ( ' SHA-256 ' , a