标签：#p

Embabel has reached its 1.0 release, providing a framework for AI agents on Java It allows Java and Kotlin developers to define agents as typed domain objects. Built on Spring AI, Embabel supports multiple model providers and combines planning with predefined state machines, offering flexibility for agent workflows. By Erik Costlow

Qwen’s most capable model for coding and cowork Discussion | Link

# suddo (superuser don't do) Sometimes AI needs to run commands with sudo (installing a package, reading a file in /etc, etc). But most MCP clients don't support creating a PTY, so you end up having to open a separate terminal just to type your password: claude code $ sudo cat /etc/hosts AI: blabla password: > ! sudo cat /etc/hosts AI: please open a new terminal. Annoying. With suddo: AI calls the tool `execute_command` The server asks you, rejects, or allows it based on your rules If allowed: If you don't have a valid sudo timestamp, it asks for your password The command runs safely More detail and usage: https://github.com/sunu15712/suddo

I often see people using the term "namespace" incorrectly. Even when explanations of what a namespace is are presented, they only go as far as describing its function, neglecting to properly define the name "namespace" itself. Definition of the Namespace A namespace is literally the space to which a name belongs . If we were to classify the term namespace, it would be a specification (concept), not a tool. In namespaces, the higher level is represented as outer and the lower level as inner . In terms of class structure, this corresponds to outer classes and inner classes. In other words, to explain it from a different perspective, it looks like this. Representation of namespaces from the outer perspective Build namespaces (best) Define namespaces (to fit many programming language implementations) Open namespaces (such as Ruby's class definition and module definition ) Create namespaces (such as the pseudo-namespace hack in older JavaScript) Declare namespaces (such as the package declaration in Java or the namespace declaration in PHP) Representation of namespaces from the inner perspective Belong to a namespace (best) Entering the namespace (This is entirely from an inner perspective, so it might feel out of place depending on the context) Be included in the namespace (this is a reasonable explanation if explained objectively). Incorrect expression From the definition above, it is clear that the following expressions are incorrect. Add/Paste a namespace (the expression "add/paste a space" is grammatically incorrect). Use namespaces (not to the point of being completely broken, but treating namespaces as a tool) Separate/Cut namespaces (While "Separated by namespaces" is understandable, "separate/cut" can be misleading) Meaning of "Name" in Namespace The "names" referred to here can be class names, module names, or package names. What they represent varies depending on the language that implements namespaces. For example, in Ruby, it refers to constant names. In Rub

The lost-update bug that quietly corrupts homegrown wallet balances — and the five disciplines we used across PayWithToken to make money movement correct under concurrency. There is a bug that lives in a large share of the world's homegrown wallet systems. It doesn't throw an error. It doesn't show up in tests. It surfaces months later as a balance that is quietly, inexplicably wrong — and in a payments system, a wrong balance is either a customer who has lost money or a company that has given it away. This is the story of that bug, why the "obvious" wallet code causes it, and the handful of disciplines we used across PayWithToken to make money movement correct under concurrency. The bug: lost updates Here is wallet code almost everyone writes first. Credit a user's balance: // DON'T do this $row = $db->query("SELECT balance FROM users WHERE id = $id")->fetch(); $new = $row['balance'] + $amount; $db->exec("UPDATE users SET balance = $new WHERE id = $id"); Read the balance, add to it in PHP, write it back. It works perfectly — until two things happen at the same time. Picture a wallet at ₦1,000. Two credits of ₦500 arrive simultaneously — say a bank webhook and the user tapping "confirm" on their phone: Request A reads balance = 1000. Request B reads balance = 1000 (A hasn't written yet). A computes 1500, writes 1500. B computes 1500, writes 1500. Two credits landed; the balance rose by ₦500. ₦500 vanished. This is a lost update, and it is a race condition, which means it is invisible until you have real concurrent traffic — exactly when you can least afford it. The debit version of the same bug lets a balance go negative or double-spends a token. Fix #1: let the database do the arithmetic The read-modify-write happened in PHP, across three round trips, with a gap where another request could interleave. The fix is to make the update a single atomic statement and let the database's row lock serialise it: // DO this — one atomic statement $db->prepare("UPDATE users SET

submitted by /u/DataBaeBee [link] [留言]

Building Three Privacy-First Mini Apps That Feel Like Standalone Products PureHub is an open-source collection of 22 free, ad-free mini apps. This release focuses on a simple product question: can a mini app inside a hub still feel dependable, focused, and complete? QR Studio The web scanner now supports a live camera and uploaded images through local decoding. Scan history stays in local storage, URL results receive basic safety checks, and supported cameras expose a torch control. Android uses CameraX and ML Kit with explicit scanner cleanup, duplicate-result protection, and copy, open, and share actions. Zen Pomodoro A one-second decrement loop drifts when a tab sleeps. The new timer stores a target time and recalculates the remaining duration, so switching tabs or waking a device no longer quietly extends a session. Weekly sessions and focused minutes remain on-device. Android uses a monotonic clock for the same reason. Zen Breath The breathing guide now includes Calm 4-6, Box 4-4-4-4, and Relax 4-7-8 patterns, controlled sessions, cycle totals, and accessible motion behavior. Nothing requires an account. Standalone safety for all 22 tools Each mini app now has a runtime contract describing its local storage namespace, offline behavior, and device capabilities. A per-tool error boundary prevents one failure from taking down the rest of PureHub. The three flagship tools also load as independent chunks and are available as PWA and Android launcher shortcuts. What happens next The Command Center will compare 14 days of anonymous aggregate opens, helpful votes, and shares. The strongest useful-use signal - not raw views - will choose the next deep-polish target. Try the release at PureHub or inspect the source on GitHub .

30 Technical Interview Questions You Should Be Able to Explain Out Loud (JS / React / Node) Most interview prep content gives you a definition. Real interviews test something different: can you explain your reasoning clearly, out loud, under a little pressure — not just recite the right words. I put together 30 questions across JavaScript, React, and Node.js. Every answer here is written the way you'd actually say it in an interview, not the way a textbook would write it. How to actually use this: cover the answer, try explaining it out loud in under 30 seconds, then read the answer. If you froze or rambled, that's the real signal — more than whether you technically knew the concept. JavaScript Fundamentals 1. What's a closure, and why does it actually matter in real code? A closure is a function that remembers the variables from where it was created, even after that outer function has finished running. It powers private variables, debouncing, memoization, and module patterns. 2. setTimeout(fn, 0) vs Promise.then() — which runs first? The Promise wins. .then() callbacks go into the microtask queue, which fully drains before the next macrotask (like setTimeout ) runs — even with a 0ms delay. 3. Why does var break inside loops with closures, but let doesn't? var is function-scoped — every iteration shares the same variable. let is block-scoped, so each iteration gets its own fresh binding. 4. Where does == actually give you a different (and wrong) answer than === ? == does type coercion first — 0 == false and '' == 0 are both true. === compares type and value directly, no surprises. 5. Why does this break in callbacks with regular functions, but not arrow functions? Regular functions get this based on how they're called. Arrow functions inherit this lexically from where they were defined, so it stays consistent no matter how they're invoked. 6. If a property isn't on an object, where does JS look next? JS walks the prototype chain — the object, then its prototype, the

How one frustrated shopper turned a spreadsheet nightmare into a community-powered resource that's saving buyers hours of research. If you've ever shopped for a mini PC, you know the drill. Open a dozen retailer tabs. Copy specs into a spreadsheet. Squint at product titles that hide critical details. Try to figure out whether that $299 model has soldered RAM or upgradeable slots. Give up and buy something you're not quite sure about. This is exactly the frustration that led a developer to build Mini PC Price — a free, sortable comparison table that aggregates real marketplace listings with full specifications, all in one view. The Problem: Specs Buried in Fine Print The mini PC market has exploded in recent years. Brands like Beelink, Minisforum, Intel NUC, ASUS, Lenovo, and HP are flooding the market with devices ranging from $100 stick-class boxes to $1,000+ workstations. But the shopping experience hasn't kept pace. Most e-commerce listings show a product name, a price tag, and a few bullet points. Critical information — RAM type (soldered vs upgradeable), GPU class (integrated vs discrete), OS bundle (Windows pre-installed or barebone), storage interface (NVMe vs SATA) — is often buried in product descriptions or missing entirely. "The difference between an 8 GB listing and a 16 GB listing of the same model can be easily missed if the table doesn't make it obvious," the creator explains. "I wanted to build a tool that surfaces exactly what matters, side by side, so buyers don't have to guess." The Solution: One Table, Full Specs, Community-Maintained Mini PC Price is not another curated top-ten list or a simple deal feed. It's a full-parameter database where each row represents a real marketplace listing. Prices refresh daily, and specs are collected from official product pages. Critical attributes receive human verification where mismatches are common. The tool's default view sorts by price ascending — the fastest way to find mini PCs under $100 or $150. But th

First hour with Claude's browser extension: I pointed it at our LLC registration and watched it work through the forms, finding the right pages, filling the fields, moving on. I sat there holding a coffee, contributing nothing. I thought: I'm going to ship so many products. I shipped one. Here's what happened in between. Everything below was caught before launch. None of it was caught by being clever. It was caught by a process that got built slowly, mostly after being burned. What went wrong The idea wasn't the hard part. Once I went looking, I found several products with some of the same features. Nobody had the exact combination, but the idea was never the moat. Good implementation and distribution seem to be. You design the product while building it. Referral behaviour, what happens when a trial expires mid-session, how translations work across a page, none of it was in my head at the start. Each became a decision made under pressure, halfway through something else. Write as much of the workflow down as possible first. It says it did things it didn't do. Confidently. I deployed more than once to find the fix I'd been told about was never written. Treat every claim of completion as unverified. The rule that came out of it: make it prove the code is right before it theorises about what you did wrong. Bullet points, not paragraphs. Long replies made it hard to tell which of my five points got addressed. Numbering my instructions, and making it map answers back to the same numbers, turned "did you do item 3" into a question with an answer. It blames you first, and argues with facts. Two landing page changes; one appeared, one didn't. Its verdict: "you didn't deploy." I said one change was live, which is only possible if I had deployed. It repeated that I hadn't. It never asked which change I could see, and never reopened its own code, where the bug was. I swore at it. It stopped guessing, checked, and found the error. Many times, escalation seemed to be the only thi

That's a rebuild I shipped. The system: a RAG assistant for fraud analysts — ask it "how do we handle card testing followed by a successful auth?" and it should answer from the team's own SOPs and case history. The complaint: the answers were wrong, therefore the model must be dumb, therefore procurement should buy a bigger model. The model was fine. It was answering perfectly — from garbage context. Walk the forensic trail with me, because every step is checkable on your own system this week. Exhibit A: the chunking was destroying meaning before anything was embedded The ingestion split SOP documents every N characters, mid-sentence. Which means half the vectors in the index encoded fragments like this: chunk_147 = " ...ing to a freight forwarder. In these cases, do NOT " chunk_148 = " cancel the order immediately. First verify the customer via " The policy — don't cancel, verify first — exists in no single chunk. An embedding can't encode a meaning that isn't in its input. Retrieval was being asked to find semantics the pipeline had already shredded. Fix one: chunk on structure (sections, paragraphs), never on character counts, with enough overlap that no rule straddles a boundary. Exhibit B: dense-only retrieval, bimodal queries Fraud analyst queries split into two populations: pattern questions ("high-value order, new account, rushed shipping") and identifier questions ("what's the SOP for decline code 4863?", "rule VEL-013 rationale"). The system was dense-only — and embeddings treat a rare token like 4863 as noise, so identifier queries retrieved similar-feeling chunks instead of the literal match. Half the query population was structurally doomed regardless of model quality. Fix two: hybrid retrieval — BM25 for the identifiers, embeddings for the patterns, reciprocal rank fusion to merge. Exhibit C: nobody could see any of this, because quality was a rumor No golden dataset. No retrieval metric. The system's accuracy was whatever the loudest anecdote said it

What is MCP (Model Context Protocol)? Complete 2026 Guide TL;DR — Model Context Protocol (MCP) is an open JSON-RPC 2.0 specification, introduced by Anthropic in late 2024, that lets AI agents talk to external systems — file systems, databases, APIs, custom services — through a single standardized interface. An MCP server exposes capabilities (tools, resources, and prompts); an MCP client (Claude Desktop, Cursor, Zed, Sourcegraph Cody, your own agent) consumes them. Write the server once, and every MCP-compatible client can use it — no per-app integration work. If you have built agent tooling before, think of MCP as "LSP for AI tools" : the same idea that unified language servers across editors, now applied to the plumbing between agents and the systems they need to act on. Why MCP Exists Before MCP, every agent framework defined its own tool format. A tool written for LangChain didn’t work in Claude Desktop, which didn’t work in your custom agent, which didn’t work in Cursor. Each integration was bespoke, every prompt-engineered "function description" was framework-specific, and every team rebuilt the same wheel. The pain points MCP solves: Fragmentation. Five frameworks, five tool formats. Five times the work. No discovery. Clients couldn’t enumerate what a tool server offered without a hard-coded manifest. No portability. A debugging assistant you wrote for one agent wouldn’t move to another. Auth was ad hoc. Every integration invented its own way to handle API keys and OAuth. MCP makes the contract uniform: a server declares its tools, resources, and prompts; a client speaks the same JSON-RPC dialect to discover and call them. The same MCP server that ships with Anthropic's TypeScript SDK today will work with any future client that implements the spec, regardless of which LLM the client uses underneath. The Wire Protocol in One Page MCP rides on JSON-RPC 2.0 , which means every message is a JSON object with a jsonrpc: "2.0" envelope, a method , optional params ,

CORS Errors Explained: Every Fix, Every Framework (2026 Guide) TL;DR — A CORS error means the browser blocked a cross-origin request because the server did not explicitly allow it. The fix is always server-side : return the correct Access-Control-Allow-Origin header from your backend. This guide covers every CORS error type, a step-by-step diagnosis flow, and copy-paste fixes for Express, FastAPI, Next.js, nginx, Cloudflare Workers, and Vercel. You can inspect and validate your CORS headers live with the CORS Header Checker — no curl, no Postman, no install. What CORS Actually Is (and Why the Browser Enforces It) The Same-Origin Policy (SOP) is a browser security rule: JavaScript running on https://myapp.com can only read responses from requests made to the same origin — same scheme, same host, same port. Everything else is cross-origin. CORS — Cross-Origin Resource Sharing — is the mechanism that lets servers selectively relax the Same-Origin Policy. A server adds HTTP headers to its responses that tell the browser: "it is okay to share this response with code from origin X." Without those headers, the browser reads the response, then silently discards it and throws a CORS error into your console. Three things to burn into memory before you read further: CORS is enforced by the browser, not the server. curl and Postman do not check CORS — they always get the response. Only browsers do CORS. If your API works in Postman but fails in the browser, CORS is almost certainly why. The fix is server-side, always. Browser extensions that "disable CORS" are masking the problem in your local browser only. They break for every real user. Never ship code that depends on them. Preflight is a separate request. For non-simple requests (anything with a custom header, a JSON body, or methods other than GET/POST), the browser sends an OPTIONS request first to ask for permission. Your server must handle this correctly. The Four CORS Error Types — Diagnosed from the Console Message Err

Cloud canvas where your team and AI agents works together Discussion | Link

Local sandboxes for AI agents on your Mac, Linux, bare metal Discussion | Link

Every year, developers ask the same question: "Which programming language should I learn next?" And...

submitted by /u/davidalayachew [link] [留言]

I remember the day I hit my breaking point. I had spent the entire morning — five hours — wrestling with a React component that an AI assistant had generated for me in about four minutes. The code looked flawless at first glance. Proper hooks, clean JSX, even decent comments. But it didn't work. And worse, I couldn't figure out why. Everyone talks about how AI speeds up coding. And it's true — when it works, it's magical. I've personally seen my feature delivery time drop by maybe 40-50% on good days. But what nobody talks about — what I certainly never saw in the breathless LinkedIn posts — is the debugging nightmare that follows when the AI gets it wrong. That day, I realised I had spent ten times longer debugging AI-written code than I would have spent writing it myself from scratch. I started tracking it. Over three months, I logged every AI-assisted task. The numbers were sobering: on average, each AI-generated snippet took me 3.2 times longer to verify and fix than to write myself. And for complex tasks — anything involving state management, async flows, or edge cases — the ratio jumped to 8-12x. The AI was giving me confidence, not correctness. And confidence, as any seasoned developer knows, is the enemy of debugging. The Hallucination That Cost Me a Sprint One incident stands out. I was building a data pipeline in Python that needed to batch-process JSON files from an S3 bucket and push transformed records into a PostgreSQL database. I gave the AI a detailed prompt: "Write a function that reads all JSON files from a given prefix, validates each record against a schema, and inserts them in batches of 500. Use threading for I/O." The AI returned a beautiful 60-line function. It used concurrent.futures.ThreadPoolExecutor , had proper error handling, even logged progress. I was impressed. I dropped it into the codebase, ran the tests — they passed. Deployed to staging. Worked like a charm. Then production hit. Three hours later, the database had 30,000 duplicat

Hello. No idea if anyone's going to read this, but writing it feels like I've done something, so here we go. And maybe it helps someone. For the past few years, I've been building a piece of software in Unity. It has actual users, somehow. My role was everything: founder, product owner, and whatever else needed doing. Development, UI, the website, the content. That's startup life. I'm good at learning fast and shipping, so it worked.(of course not all of it... I'm not trying to take all the credit for others' work Im just saying what I did) But I never came into this as a leading developer, so updating the product became kinda frustrating. Moreover, graphics are central to this product, and even with HDRP, Unity wasn't getting me where I wanted. I know my way around C#. C++, not so much. With Unreal, I've learned the basic UI and not much else. BuT~ You study, you keep going, and things tend to work out. So wish me luck I'll reveal what the product is once the switch to Unreal succeeds I'll take some courses. I don't care if it's in Korean or English. I'll make it work. Time passes either way, we get older, we all die anyway. So let me just learn and build what I want to build. I'm writing this to leave a record of what I learn and what I try. Let's go 헬로 누가 이걸 보기나 할 지 모르지만 이런 글이라도 쓰면 성취감이 드니까 걍 씀 그리고 누군가에게는 도움이 될 수도 있으니까 킬킬 난 지난 몇년간 유니티로 소프트웨어를 하나 만들었음. 나름 유저도 있는 상황 ㅋㅋ 나의 역할은 대표이자 기획자이자 뭐 올라운더로 참여했음. 개발도 하고... 화면도 만들고 뭐 웹사이트도 만들고 콘텐츠도 만들고 뭐 다 그랬음. 스타트업이 다 그런 거지 뭐. 뭐든 빨리 배우고 결과물을 만들어내는 걸 잘하는 편이라 나름 잘 했음 다만 내가 개발자로 참여한 건 아니라서 이 프로덕트를 업데이트하는 과정이 좀 아쉽기도 하고 그래픽이 중요한 프로덕트인데 unity는 hdrp라 하더라도 아쉬웠음 c#에 대한 이해도는 있는 편인데 c++은 잘 모름 unreal도 기본적인 ui 익힌 거 빼고는 모름 공부해서 하다보면 뭐든 되지 않겠음? 위시 미 럭 프로덕트가 뭔지는 unreal로 업그레이드 하는데 성공하면 공개하겠음. 한국어 강의나 영어 강의 닥치는대로 다 볼 거고 뭐 어떻게든 해 보겠음 어차피 시간은 흐르고 나이는 들고 죽을텐데 이렇게 하고싶은 거 어떻게든 해보면서 뭐라도 만드는 게 남는 거인듯 내가 공부하고 실행해본 걸 흔적으로 남기려고 이 포스트 쓰는 걸 시작해본다 아자뵤

On hosting without SSH access, a common pattern is to open update-core.php (the WordPress update screen) with Playwright and read "what version is WordPress core currently running" straight off the page text. In one deployment, the recorded core version came back as something like 1.7.11 — a number that has never existed for WordPress core. Note: update-core.php is the WordPress admin's "Updates" page, listing pending updates for core, plugins, themes, and translations all on one screen. What was actually happening That page doesn't only show the core version string — it's packed with version numbers belonging to pending plugin and translation updates too. A line like "Update Plugin X to 1.7.11" is typical. # First implementation — grabs the first N.N.N-shaped number on the page match = re . search ( r ' \d+\.\d+(?:\.\d+)? ' , page_text ) version = match . group ( 0 ) if match else None This naive regex grabs whatever N.N.N -shaped number appears first on the page. Because of how the page is laid out, a plugin's pending update can render above the core version message, so 1.7.11 (a plugin's version) ended up recorded as the WordPress core version. Why this is hard to catch The bug doesn't throw an exception — the regex matches successfully, just on the wrong value. Nothing about it looks broken until someone notices the report shows a version that WordPress core has never shipped (there's no 1.x series for core). The fix — a three-stage guard Prefer a dedicated selector first — look for specific DOM locations where core's update message actually renders, like p.response > strong or #wp-version-message strong Fall back to keyword-anchored regex — if no selector matches, only accept a number immediately following the words "WordPress," "バージョン," or "Version" Validate plausibility as a final check — whichever path produced a value, run it through a function that checks the major version number falls within 4–9 def is_plausible_wp_core_version ( ver : str ) -> bool : m =