标签：#p

React Hooks have revolutionized how we write React components, offering a powerful way to manage state and side effects directly within functional components. This paradigm shift has led to cleaner, more readable, and often more maintainable codebases by moving away from the complexities of class components. Why the Shift to Hooks? Before Hooks, managing stateful logic and side effects often meant relying on class components. This approach could introduce several challenges: understanding this binding, managing complex lifecycle methods across different phases of a component's life, and dealing with "wrapper hell" – deeply nested component structures resulting from Higher-Order Components (HOCs) and render props when trying to reuse logic. Hooks solve these problems by allowing developers to "hook into" React features directly from functional components. This makes logic reuse more straightforward and components inherently easier to understand and test. Essential React Hooks at a Glance Let's explore the core Hooks that form the backbone of modern React development: 1. useState : Adding State to Functional Components The useState Hook is the most fundamental. It allows you to declare state variables in functional components. Instead of dealing with this.state and a separate this.setState() method, useState provides a direct variable for your state and a dedicated function to update it. This simplifies local component state management significantly, making it more intuitive and less prone to errors. 2. useEffect : Handling Side Effects The useEffect Hook is designed for performing side effects in functional components. Side effects encompass operations like data fetching from an API, setting up event listeners or subscriptions, or directly manipulating the DOM. This Hook consolidates logic that was previously spread across multiple lifecycle methods like componentDidMount , componentDidUpdate , and componentWillUnmount in class components. A key aspect of useEffect i

JWT Validation: Verifying Tokens for Authentication and Authorization A practical guide to JWT validation — the process of checking a JSON Web Token's signature, claims, and structure to confirm a request is genuinely authenticated and authorized — covering signature verification, standard claim checks, key rotation, validation in ASP.NET Core, and the mistakes that most commonly lead to broken or bypassed validation. Table of Contents Introduction Anatomy of a JWT Signing Algorithms What "Validation" Actually Checks Signature Verification and Key Rotation Standard Claim Validation Validating JWTs in ASP.NET Core Custom Validation Logic Token Revocation: JWT's Fundamental Limitation Validating JWTs Across Services Common Vulnerabilities Debugging Validation Failures Quick Reference Table Conclusion Introduction A JWT arriving in an Authorization: Bearer <token> header is just a string until it's actually validated — and validation is doing considerably more work than it might first appear. It's not just "does this look like a JWT" or even just "is the signature valid" — proper validation confirms the token was issued by a trusted party, intended for this specific API, still within its valid time window, and hasn't been tampered with in any way. Get any one of these checks wrong or skip it, and you can end up with an API that accepts tokens it absolutely shouldn't. builder . Services . AddAuthentication ( JwtBearerDefaults . AuthenticationScheme ) . AddJwtBearer ( options => { options . Authority = "https://login.microsoftonline.com/{tenant-id}/v2.0" ; options . Audience = "api://my-api" ; }); Those two lines look simple, but they configure a genuinely thorough validation pipeline underneath — this guide covers exactly what that pipeline actually checks, why each check matters, and where things commonly go wrong when validation is configured incorrectly or bypassed under pressure. 1. Anatomy of a JWT Three parts, dot-separated eyJhbGciOiJSUzI 1 NiIsInR 5 cCI 6 IkpXVC

AI Agent 市场设计:让 Agent 像 App 一样被交易与编排 App Store 把「软件」变成了可被一键购买、安装、评分的商品,AI 时代对应的实体是「Agent」。一个 Agent = 一段可被复用的提示词 + 工具集 + 知识库 + 模型路由配置。本文讲清楚一个 Agent 市场需要哪些核心机制,以及 IHUI-AI 的实现路径。 一、Agent 市场的产品定义 什么是「可上架的 Agent」 不是所有对话 prompt 都能成为商品。一个可上架的 Agent 必须满足: 可独立运行 :用户购买后能立刻用,不需要再写代码。 可复用 :不同用户用同一个 Agent 都能得到稳定结果。 可定价 :有明确的使用边界(次数 / 时长 / 调用规模)。 可评估 :有客观的质量指标(成功率 / 满意度 / 失败率)。 Agent 定义格式 IHUI-AI 用一份 schema 描述可上架的 Agent: const MarketplaceAgentSchema = z . object ({ id : z . string (). uuid (), name : z . string (), description : " z.string(), " // 核心能力 systemPrompt : z . string (), tools : z . array ( z . string ()), // 引用工具/MCP server knowledgeBases : z . array ( z . string ()), // 绑定 RAG 知识库 modelRouting : z . object ({ default : z . string (), // 默认模型 fallback : z . string (). optional (), // 降级模型 }), // 定价 pricing : z . object ({ model : z . enum ([ " free " , " subscription " , " per_call " , " revenue_share " ]), price : z . number (), currency : z . string (). default ( " CNY " ), trialQuota : z . number (). default ( 0 ), }), // 评估 metrics : z . object ({ successRate : z . number (), avgLatencyMs : z . number (), rating : z . number (). min ( 0 ). max ( 5 ), usageCount : z . number (), }), }); 二、四种定价模型 模型 适用 优点 缺点 免费(Free) 引流、品牌 Agent 易扩散 无直接收入 订阅(Subscription) 高频工具型 Agent 收入稳定 流失需运营 按调用计费(Per Call) 低频高价值 Agent 与成本对齐 用户预算焦虑 分成(Revenue Share) 内容生成型 Agent 创作者激励 结算复杂 IHUI-AI 默认采用 订阅 + 按调用混合 :基础功能订阅包月,超出额度按调用计费,创作者拿 70% 分成。 三、Agent 质量评估:四维评分 简单的「5 星好评」不够,因为容易被刷分。IHUI 用四维加权: 任务成功率(40%) :Agent 完成用户原始任务的比率,由 LLM-as-Judge 自动评估。 用户评分(25%) :真实用户打分,过滤异常分布(全是 5 星或 1 星)。 响应延迟(15%) :首 token 时延 + 总时长,归一化到 [0,1]。 稳定性(20%) :错误率 + 重试率,错误越少分越高。 def agent_score ( metrics ) -> float : return ( 0.40 * min ( metrics . success_rate , 1.0 ) + 0.25 * metrics . user_rating / 5 + 0.15 * ( 1 - min ( metrics . p95_latency / 30_000 , 1 )) + 0.20 * ( 1 - min ( metrics . error_rate / 0.1 , 1 )) ) 这个分数实时更新,作为市场搜索排序的依据。 四、Agent 编排:从单个 Agent 到 Agent 工作流 单个 Agent 的能力有上限。Agent 市场的真正价值在于「让用户像搭积木一样编排多个 Agent」。

Coding agents usually do not drift because they are incapable. They drift because the task leaves too much room for interpretation. A request like “clean up authentication” sounds clear to a human who already knows the codebase. To an agent, it can mean anything from renaming one helper to replacing the entire authentication stack. The fix is not a longer prompt. It is a brief with four explicit parts : Outcome Context Guardrails Definition of Done Below is the exact structure I use. 1. State the outcome as an observable change Describe what should be different for the user or system when the work is complete. Weak: Fix the login bug. Better: When a user submits an expired magic link, show the existing “Link expired” message and offer a button that requests a new link without leaving the page. The better version gives the agent a destination. It does not prescribe the implementation, but it makes success testable. 2. Give only the context that changes the decision Context is useful when it removes ambiguity. It becomes noise when it is a tour of the whole repository. Useful context often includes: The relevant entry point or route The existing component or service that should be reused A similar implementation elsewhere in the codebase The command used to run the relevant tests A known constraint, such as backwards compatibility Example: The page is implemented in app/auth/verify/page.tsx . Reuse requestMagicLink() from lib/auth/client.ts . The existing error-message styles live in components/auth/AuthNotice.tsx . That is enough to start investigating without pretending we already know the final patch. 3. Add guardrails that define the change boundary Guardrails prevent a small task from becoming an accidental rewrite. A useful set might be: Do not change the public API. Do not add dependencies. Keep the current visual design. Do not edit generated files. Limit changes to the authentication flow and its tests. If a database migration appears necessary, stop and expl

If you've tried building a Chrome extension recently, you've probably hit Manifest V3 and spent an hour just figuring out why your background page stopped working. MV3 replaced background pages with service workers, changed how content scripts communicate, and made permissions stricter. The official docs are... not great. So here's the structure that actually works. The folder structure chrome-extension/ ├── manifest.json ├── popup/ │ ├── popup.html │ ├── popup.css │ └── popup.js ├── options/ │ ├── options.html │ └── options.js ├── content/ │ └── content.js ├── background/ │ └── service-worker.js ├── utils/ │ └── storage.js └── icons/ The manifest.json (MV3) The biggest MV3 gotcha: background scripts are now service workers. { "manifest_version": 3, "name": "Your Extension", "version": "1.0.0", "permissions": ["storage", "activeTab", "scripting"], "action": { "default_popup": "popup/popup.html" }, "background": { "service_worker": "background/service-worker.js" }, "content_scripts": [ { "matches": [""], "js": ["content/content.js"] } ] } Communicating between popup and content script This trips up almost everyone. The popup can't directly access the page DOM — it has to message the content script. // popup.js const [tab] = await chrome.tabs.query({ active: true, currentWindow: true }); await chrome.tabs.sendMessage(tab.id, { type: 'RUN_ACTION' }); // content.js chrome.runtime.onMessage.addListener((message, sender, sendResponse) => { if (message.type === 'RUN_ACTION') { // do something on the page sendResponse({ success: true }); } return true; // keeps the channel open for async response }); The return true at the end is critical — without it, async responses silently fail. Storage that syncs across devices Use chrome.storage.sync instead of localStorage. Here's a utility wrapper that makes it clean to use anywhere: const Storage = { async get(key) { return new Promise((resolve) => { chrome.storage.sync.get([key], (result) => resolve(result[key])); }); }, async set

Tag any agent, wherever work happens. Discussion | Link

Claude for viral, high-converting social ads Discussion | Link

AWS Builder Center now offers free, time-limited sandbox environments for workshops, so developers no longer need to use their own AWS account and credit card or worry about unexpected charges. This has been a long-standing request from the community and removes one of the biggest friction points for practitioners learning new AWS technologies. By Renato Losio

The narrow control plane for AI agent tool and API calls. Discussion | Link

Word review artifacts need a CI boundary too Word already has useful interactive review workflows: legal blackline comparison and Document Inspector. But a controlled handoff or CI workflow has a different question: did this package gain unresolved revisions, comments, hidden runs, external relationships, macros, custom XML, or another opaque payload change? And can we answer that without turning a build artifact into a copy of the document? DocFence 0.1.0 is a local-first CLI for that boundary. It compares .docx and .docm packages without opening Word, executing macros, evaluating fields, following links, rendering a document, or uploading source material. More than a text diff The visible body is only one stored story. DocFence inventories the body, headers, footers, footnotes, endnotes, comments, and glossary parts. It also tracks revision markup, direct hidden-text runs, field codes, content controls, Track Changes, external relationships, custom XML, and macros. A generic opaque payload signal covers mutations in parts the specialized inventories do not explain, such as styles, media, embeddings, metadata, and the package manifest. The output intentionally contains counts and fixed change categories rather than paragraphs, comments, reviewer names, URLs, relationship targets, field instructions, custom XML values, macro bytes, part paths, or fingerprints. That makes JSON, Markdown, and SARIF practical for CI artifacts while keeping source material inside the team’s environment. Policies that are small enough to review A policy is a strict, short YAML file. It distinguishes a comparison boundary from a candidate-state boundary: a team can block a newly introduced external relationship while separately requiring that the candidate contain no comments or unresolved revisions at all. version : 1 rules : no_external_relationship_changes : true no_macro_payload_changes : true no_custom_xml_changes : true require_no_unresolved_revisions : true require_no_comments : tr

If I need to upgrade .NET 8 to .NET 10 , I treat the work as an API contract migration, not a project-file edit. A service can compile, pass unit tests, and still surprise consumers with a changed JSON shape, status code, authentication response, or OpenAPI document. That risk matters now because Microsoft has confirmed that .NET 8 and .NET 9 reach end of support on November 10, 2026 . .NET 10 and C# 14 are the current stable releases, and .NET 10 is the supported LTS destination. Why the deadline changes my upgrade order My first step is inventory, not retargeting. I list every deployable project, test project, global.json , container base image, CI SDK pin, and Microsoft package reference. dotnet --list-sdks shows what a machine can build; dotnet --info shows what the current environment actually resolves. If that inventory needs more detail, my older guide to dotnet sdk check is a useful starting point. For APIs still on .NET 8, the broader Web API setup and security checklist can help identify behavior worth protecting before the move. I then separate the migration into three changes: SDK and target framework, NuGet dependencies, and runtime infrastructure. Keeping those changes visible makes a failure easier to locate. A giant dependency-refresh commit may be quick to create, but it is hard to diagnose. Upgrade .NET 8 to .NET 10 behind contract tests Before changing net8.0 , I add a small set of tests around the endpoints consumers cannot tolerate changing. I care about observable behavior: status codes, content types, required JSON names, and authentication boundaries. I avoid asserting an entire serialized string because harmless property ordering can make that test noisy. Here is a focused xUnit test for a Minimal API: using System.Net ; using System.Text.Json ; using Microsoft.AspNetCore.Mvc.Testing ; using Xunit ; public sealed class ProductContractTests ( WebApplicationFactory < Program > factory ) : IClassFixture < WebApplicationFactory < Program >> { [

How we added an on-demand translation help feature to our book translation platform, streaming LLM suggestions for tricky passages. At LectuLibre, our AI-powered book translation service allows users to upload EPUB or PDF files and get translations generated by large language models like Claude and DeepSeek. But we quickly noticed a pain point: automated translations, while fast, sometimes produced awkward or ambiguous results for culturally specific phrases, idioms, or technical jargon. Users wanted a way to get instant, contextual help for these tricky passages without leaving the platform. That’s when we set out to build the 翻译与转录求助 (Translation Assistance) feature — an interactive side panel where users can select any sentence or paragraph and receive alternative translations, explanations, and stylistic suggestions from an LLM in real time. In this article, I’ll walk you through the engineering challenge, the architecture we chose, and the specific code and trade-offs that made it work smoothly under production constraints. The Problem: Real-Time, Context-Aware Translation Help The core requirement was simple: a user highlights a piece of text in the translated book and clicks “Get Assistance”. Immediately, the system should stream back multiple translation options, a brief explanation of differences, and stylistic notes — all aware of the surrounding context, the author’s style, and the target language. Under the hood, this meant: Low latency : Users expect a response in under 2 seconds. Streaming : The LLM output can be long, so we needed to stream tokens as they are generated. Context awareness : We must include enough surrounding text from the book to ground the model’s response. No blocking : The main translation pipeline shouldn’t be affected; the assistance feature should exist as an independent async service. Cost efficiency : Avoid re-processing the entire book each time a user asks for help. Our Approach: Async FastAPI + SSE + Rate Limiting We run a P

This is an English translation of my original article on Qiita . An Android build failed in an Expo SDK 54 app. The project still used Expo SDK 54, but several Expo packages had been upgraded to versions intended for SDK 55. TypeScript checks passed, and the development server ran normally. I did not catch the mismatch until EAS Build reached the native build step. What the dependency list looked like The relevant part of package.json looked like this: { "dependencies" : { "expo" : "~54.0.33" , "expo-apple-authentication" : "~55.0.13" , "expo-dev-client" : "^55.0.27" , "expo-image-picker" : "^55.0.18" , "expo-linking" : "^55.0.12" , "expo-notifications" : "^55.0.19" , "expo-splash-screen" : "^55.0.18" } } The expo package was still on version 54, while several related packages were on version 55. This happened because those packages had been installed individually using their latest versions. The package version does not always match the Expo SDK number. For example, Expo SDK 54 uses expo-notifications 0.32 and expo-splash-screen 31. Looking only at major version numbers is not enough to determine SDK compatibility. Start with expo install --check Expo CLI can compare the installed packages with the versions expected by the current SDK: npx expo install --check It can also return the result as JSON: npx expo install --check --json This is more reliable than trying to infer compatibility from package.json manually. Expo CLI can fix the versions automatically: npx expo install --fix npx expo-doctor I wanted to review each change, so I used the reported versions to update package.json myself. The versions I changed These were the main corrections: - "expo-apple-authentication": "~55.0.13" + "expo-apple-authentication": "~8.0.8" - "expo-dev-client": "^55.0.27" + "expo-dev-client": "~6.0.21" - "expo-image-picker": "^55.0.18" + "expo-image-picker": "~17.0.11" - "expo-linking": "^55.0.12" + "expo-linking": "~8.0.12" - "expo-notifications": "^55.0.19" + "expo-notifications"

Linear Regression: From Least Squares to Production-Ready Practice Tags : machinelearning , datascience , python , tutorial Linear regression is the first algorithm most people learn, and the one most people never study deeply. It is also the model you will still find in production after fancier algorithms fail, because it is fast, stable, and explainable. This article is not a "call .fit() and read the score" tutorial. We will cover the math, the statistical assumptions, the diagnostics, regularization, evaluation, production concerns, and the interview questions that separate beginners from engineers. Why Linear Regression Deserves a Second Look Linear regression is the foundation for understanding almost every other supervised model: Logistic regression is linear regression with a sigmoid on top. Ridge and Lasso are linear regression with constrained weights. Neural networks are stacked linear transformations with nonlinear activations. Tree models are judged against the same baseline: "can I beat a linear model?" More importantly, linear regression is still the right answer in many business problems. When you need to explain a prediction to a regulator, a client, or a finance team, a clean linear model with interpretable coefficients beats a black box. The Math: Least Squares and the Normal Equation Given features X and target y , a linear model assumes: y = X * beta + epsilon The goal is to minimize the residual sum of squares: L(beta) = ||y - X*beta||^2 Taking the derivative with respect to beta and setting it to zero gives the normal equation : beta = (X^T * X)^(-1) * X^T * y In practice, use the pseudoinverse ( pinv ) instead of the inverse, because X^T X may be singular or numerically unstable when features are collinear. import numpy as np def normal_equation ( X , y ): Xb = np . c_ [ np . ones ( X . shape [ 0 ]), X ] # add intercept beta = np . linalg . pinv ( Xb . T @ Xb ) @ Xb . T @ y return beta Three Equivalent Views of Least Squares 1. Geometric view

Às vezes, a maior barreira para começar um projeto não é a complexidade do problema, mas a busca por...

I Learned Go in 3 Weeks. Yesterday, My Code Merged into k9s. From zero Go experience to a...

I was on a call last month with a startup CTO who had just gotten their AWS bill. They had built a beautiful RAG application: semantic search, conversational AI, the works. Their vector index was humming along with about 50 million embeddings. Then they hit product-market fit. Within six weeks, they scaled to 500 million vectors. Their monthly infrastructure costs went from $2,000 to $20,000. The real kicker? When we looked at the access patterns, over 80% of those vectors were queried less than once a week. They were paying hot-storage prices for data that was, by any honest measure, cold. The standard advice here is "just use a cheaper vector database." The more interesting question is: why are you storing all your vectors at the same temperature in the first place? The Cost-Recall-Latency Triangle Vector search forces a three-way tradeoff. You can optimize for cost, recall, and latency, but you only get to pick two. Want high recall and low latency? That costs money (in-memory HNSW graphs with full-precision vectors eating RAM). Want high recall at low cost? Latency goes up. Want cheap and fast? Recall suffers. Most teams pick a single point on this triangle and apply it uniformly to every vector in their index. That decision made sense when vector databases offered a single storage tier. It makes the same amount of sense as storing your entire filesystem on NVMe SSDs because some files need fast access. The conventional wisdom says you pick your point on the triangle and live with it. But the conventional wisdom was written before vector storage got interesting. The better approach: tier your vectors the same way you already tier your storage. Different access patterns deserve different economics. The same embedding that costs $0.12/month in RAM might cost $0.004/month on disk and $0.0002/month in object storage. When you have 500 million of them, those decimals matter. The Hot Tier: In-Memory HNSW and Exact k-NN For vectors that get hit constantly (your user-fa

We've all been there: staring at a blood test report from three years ago, trying to remember if that "slightly elevated" glucose level was a one-time thing or a trend. Our health data is scattered across messy PDFs, fitness tracker exports, and physical medical folders. In the era of AI, why are we still manually digging through folders? 📂 Today, we are building the Ultimate Personal Health Knowledge Base . By leveraging Retrieval-Augmented Generation (RAG) , we will transform fragmented medical reports and logs into a searchable, private, and intelligent second brain. We’ll be using LlamaIndex for orchestration, Unstructured.io for parsing those pesky PDFs, and ChromaDB for local vector storage. If you're looking for advanced architectural patterns or production-grade data engineering strategies beyond this tutorial, I highly recommend checking out the deep dives over at WellAlly Tech Blog , which served as a major inspiration for this build. 🚀 The Architecture 🏗️ The goal is to create a pipeline that ingests raw data, vectorizes it, and allows for Hybrid Search —combining semantic meaning with keyword precision (crucial for medical terms!). graph TD A[Raw Health Data: PDFs, CSVs, MD] --> B(Unstructured.io Parser) B --> C{Chunking & Cleaning} C --> D[Sentence-Transformers] D --> E[(ChromaDB Vector Store)] F[User Query: Is my cholesterol improving?] --> G[LlamaIndex Query Engine] E <--> G G --> H[LLM: Local or OpenAI] H --> I[Actionable Health Insight] Prerequisites 🛠️ To follow along, you’ll need a Python environment with the following stack: Unstructured.io : To handle "dirty" PDF and image-based reports. ChromaDB : Our lightweight, open-source vector database. Sentence-Transformers : To generate local embeddings without sending data to the cloud. LlamaIndex : The glue that connects our data to the LLM. pip install llama-index chromadb unstructured sentence-transformers llama-index-vector-stores-chroma Step 1: Ingesting Messy Medical Reports 📄 Medical reports are

This article was originally published on e-shikumi-labo . Hello, I'm Shin from e-Shikumi-Labo. This is Part 3 of "Systematized Thinking," where we use AI to build our own tools and independently maintain them. Last time, I talked about creating a system to automatically output Markdown (.md) files to Google Drive simultaneously with appending to a spreadsheet. With list management in a spreadsheet and a comfortable viewing environment in Obsidian established, it was getting very close to completion as a tool. However, as I continued to use it practically, new challenges emerged on the operational front. This time, I will share the risks I faced while transitioning from a "manual button" to "full automation," and the process of evolving into safe code. 1. I Want to Eliminate the "Hassle of Pressing a Button" During the prototype stage, the system was designed so that logs were saved by pressing a button placed on the screen. However, as long as a human operates it manually, there are inevitably limitations. If you are concentrating on the conversation, you might forget to press the save button and close the screen. If the conversation gets long, you might miss past utterances that are no longer displayed on the screen. "If I have the screen open and am conversing, I want it to automatically save in the background without bothering human hands." Thinking this, I asked the AI to write the code for full automation. 2. The Code the AI Produced: "Patrolling the Screen Every 1.5 Seconds" When I consulted the AI, it immediately presented code for full automation. The mechanism was, "Start a timer every 1.5 seconds, check the entire screen in the background, and send any new utterances." When I actually tried it, the logs accumulated automatically as soon as I conversed without pressing the button, and at first glance, it looked like exceptionally well-done full automation. However, I felt something was slightly off regarding this "monitoring on a 1.5-second cycle." 3. The B

A practical, no-hype breakdown of GitHub Copilot's features, free vs paid tiers, real limitations, and the kind of developer who actually gets their money's worth. "Is GitHub Copilot worth it?" usually means one of two things: will it save enough time to justify the subscription? or is a paid plan meaningfully better than the free one? This guide answers both, based on GitHub's documented features and the trade-offs that tend to matter in day-to-day development work. The short version is that Copilot has a genuinely useful free tier and a low-cost paid tier, so the real question is rarely "should I spend a lot of money" — it's "does an AI pair-programmer fit how I work." Below we cover what you get, what it costs, where it helps, and where it falls short, so you can decide for your own workflow. At a glance In short For developers who write code most days, GitHub Copilot is generally worth trying — and the free tier lets you find out at zero cost. The low-priced Pro plan is small relative to the time many users save on boilerplate, tests, and unfamiliar APIs, but you still have to review everything it produces. It's a weaker value for occasional coders, for those working mainly in niche or proprietary codebases where suggestions are less accurate, or for anyone who finds constant autocomplete distracting. Start on the free tier, test it on your real work, and upgrade only if you hit the caps or want agent mode and model choice. Always confirm current pricing and limits on GitHub's site. Pricing Confirm current pricing on each vendor's site. Free$0 Capped monthly code completions and chat messages Access in supported editors and on GitHub.com Good for evaluating Copilot at no cost Confirm current monthly caps on GitHub's plans page View Copilot plans ProAbout $10/month (or ~$100/year)confirm current pricing Removes the tight free-tier caps Agent mode and model selection Monthly allowance of premium requests (overage billed separately) Free trial has historically been