标签：#tooling

Deep into a coding session, you realize you want beta testers to try some new functionality first....

Every npm project is one malicious package away from a supply-chain breach. NPM Safety Guard catches threats that npm audit completely misses — from DPRK backdoors and typosquatted packages, to exposed API keys and AI credential theft hidden inside your node_modules. This video walks through all 23 detection layers, one by one, showing exactly what each layer catches and how it protects your project in real time. 🛡️ Intro NPM Safety Guard is the most comprehensive npm security scanner for developers. It ships as a VS Code extension (also works in Cursor and Windsurf) and a JetBrains plugin (WebStorm, IntelliJ IDEA, and all IntelliJ-based IDEs). It runs silently in the background and alerts you to supply-chain threats, malware, CVEs, and credential leaks — before they can cause damage. Layer 1 — Known Malicious Packages Checks every package in your package.json against a bundled database of documented supply-chain attacks, including DPRK/Lazarus Group backdoors, the infamous event-stream compromise, and dozens of other confirmed malicious packages. The database is also synced against a live remote feed so newly discovered threats are caught even before you update the extension. Layer 2 — CVE Vulnerabilities Queries the Google OSV.dev API for known CVEs across all your direct dependencies. No API key needed — it is completely free. Results are cached for 24 hours to minimize network calls. CVSS scores are mapped to severity levels (Critical, High, Medium, Low) so you always know exactly how serious each vulnerability is and which version fixes it. Layer 3 — Install Script Hooks Flags packages that declare preinstall, postinstall, install, or prepare npm scripts. These hooks run automatically during npm install — before any of your own code executes — making them the number one real-world vector for supply-chain malware delivery. Legitimate packages that genuinely need install scripts (like node-gyp and imagemin) are automatically whitelisted. Layer 4 — Deep Tarball AS

According to ChartMogul's 2026 analysis of 200 B2B software products, the median free-to-paid...

Originally published on danholloran.me The original Grimicorn was an exercise in restraint: muted pastels on a blue-gray base, tuned so nothing on screen ever burns your eyes. Grimicorn Neon is the opposite impulse. Same grim-reaper-meets-unicorn idea, except this one is plugged into the mains — saturated, glowing accents on a near-black base, dark-only, loud on purpose. What makes the pair interesting from an engineering angle is how little had to change to get there. Neon is not a new theme so much as the same theme with the volume knob turned all the way up. That only works because of a decision made back in the calm version: colors are defined by role, not by appearance. Eight roles, eight louder hexes Both themes share the exact same role map. Blue is keywords, links, and the primary accent. Green is strings, success, and the cursor. Yellow is types, decorators, and warnings. The accent hierarchy is still blue → purple → teal, and the semantic anchors still hold: green means good, the error color means wrong. What changes is only the values bound to those roles. Calm Grimicorn's blue is a soft #83AFE5 ; Neon's is an electric #2323FF . Calm green is a sage #A9CE93 ; Neon green is an acid #A3E635 . The error role even swaps identity, from a gentle salmon to a hot #FF2D9B pink. Lay the two palettes side by side and the structure is identical — only the saturation and brightness move: // same eight roles, two personalities const calm = { blue : " #83AFE5 " , green : " #A9CE93 " , error : " #DD9787 " , base : " #253039 " , }; const neon = { blue : " #2323FF " , green : " #A3E635 " , error : " #FF2D9B " , base : " #0A0A0B " , }; Because every one of the fourteen tool ports — VS Code, Ghostty, Obsidian, Claude Code, JetBrains, tmux, and the rest — is generated from a single palette.md , producing the neon set was mostly a matter of feeding the build a different eight values. The emitters that translate roles into VS Code scopes or ANSI slots never knew the difference.

Video demo link : https://youtu.be/vSjeTkrou1s?si=qTcrWyz0HSWDiWSF If you run Claude Code, Codex, or other AI agents, you know the pain: the terminal floods with generated output while you're still typing — and your keystrokes lag, characters "drag." TawTerminal fixes that. Your keystrokes go straight to the screen on a separate path from shell output, so typing stays instant even while an AI agent streams thousands of lines. What you get: ⚡ Zero input lag — GPU-accelerated (WebGL) rendering at 60fps, multi-process so heavy output never blocks your typing 📁 Workspace folders — pin folders in the sidebar, spawn a shell rooted in any directory in one click, with live git branch + status 🤖 One-click AI agents — launch Claude Code, Codex, PI, or tawx directly from the sidebar, sessions auto-restored 🪟 Split panes & tabs — Cmd+D to split, Cmd+T for tabs 🖼️ Paste images — drag-drop or Cmd+V images straight into the terminal 🎨 4 beautiful themes — Tokyo Night, Catppuccin Mocha, Dracula, Rosé Pine 📊 Live AI usage footer — see today's Claude Code / Codex token + cost estimate 🍎 Native macOS feel — clean hidden title bar, clickable URLs, custom fonts Requirements: macOS, Apple Silicon (M1 or newer). Signed & notarized by Apple — installs clean, no security warnings.

I’ve always been fascinated by PDFs. They look simple on the surface. Just a document you can open anywhere but underneath they’re a full layout engine, object graph, drawing model, and archival format all at once. I enjoy that mix of precision and complexity and that is exactly what led me to build PDF::Make (and yes I had some help from Claude LLM). I wanted a fully featured toolkit that could both generate PDFs and let me inspect/edit them programmatically. At the low level, PDF::Make exposes the raw building blocks of the format: PDF objects, pages, the drawing canvas, a parser/reader, and import/merge primitives. This is the layer you reach for when you need fine grained control or want to work with the structure of a document directly. For everyday document creation, PDF::Make::Builder sits on top of that foundation and provides a higher level API. It handles the boilerplate of page setup, fonts, text flow, and layout so you can produce a polished PDF in just a few lines of Perl. The same toolkit is also designed for post-processing. You can open an existing PDF, extract structured text along with its coordinates, and then draw annotations or overlays back onto the page, making it straightforward to build review, QA, or markup workflows on top of documents you didn’t originally generate. This post shows a practical two-step flow: Create a PDF Re-open it, extract text coordinates, and draw border highlights around matched words 1) Create a PDF with PDF::Make::Builder Script: #!/usr/bin/perl use strict ; use warnings ; use PDF::Make:: Builder ; my $pdf = PDF::Make:: Builder -> new ( file_name => ' source_demo.pdf ', configure => { text => { font => { family => ' Helvetica ', size => 12 , colour => ' #222222 ' }, }, }, ); $pdf -> add_page ( page_size => ' Letter ') -> add_h1 ( text => ' PDF::Make blog demo ') -> add_text ( text => ' PDF::Make builds and edits PDF files directly from Perl. ') -> add_text ( text => ' In the next step we extract text coordinates and

I spent last month migrating 23 client sites from JPEG/PNG to WebP and AVIF. Here's what I wish someone told me before I started. AVIF vs WebP: the real numbers AVIF is about 30% smaller than WebP at the same quality level. But Safari support is still patchy — if your traffic is 40%+ iOS, you need <picture> tags with WebP fallback. No way around it. The biggest win wasn't the format The single biggest reduction came from capping max image width at 1200px and setting quality to 80. One site went from 9.4MB to 318KB per page — a 97% reduction — just from those two settings plus lazy loading. The format switch was the cherry on top, not the cake. Tools I used daily SmartImgKit — quick batch conversions in the browser. No uploads, no signup, drag and drop. Handles the 80% case where you don't need a CLI pipeline. Supports JPG, PNG, WebP, AVIF, GIF, BMP, TIFF. ImageMagick — server-side batch jobs for when you need automation. Squoosh — one-off fine-tuning with visual comparison. Sharp (Node.js) — build pipeline integration. The HEIC surprise Every iPhone user's photos are HEIC. Most web tools crash on them. You need a converter that handles them before the pipeline — SmartImgKit's HEIC converter works locally in-browser, no uploads. The 80/20 rule Format + max width + lazy loading = 80% of the gain. Everything else is diminishing returns. Don't over-engineer it.

A few weeks back I shared some early Zen code examples. Since then, a lot has changed. We're now at v1.1.1 and the language actually has real tooling. What's new: Full CLI with package management zen publish - publish packages directly from CLI zen install - install packages from the registry zen list - browse all published packages with pagination Language improvements Struct support with literals and returns Regex with POSIX ERE ( matchRegex ) File I/O with binary support FFI bindings to C functions 162 stdlib functions across math, strings, fs, os, http, crypto, path utilities Package Registry (v1.0.0) JWT-based authentication GitHub-hosted packages Support for both runnable apps and libraries Semantic versioning The reactive variables concept from the first post is still there (that was my favorite feature), and now you can actually write real programs and share them with the community. Full docs: https://jishith-dev.github.io/zen-doc/site/ Install: curl -fsSL https://raw.githubusercontent.com/jishith-dev/Zen/main/install.sh | bash Next up: HTTP server APIs, better imports, and whatever the community asks for. Open to feedback and collaborators 💻 ✨ zen #programming #compiler #llvm #packagemanager #opensource #programminglanguage

The document hub, our vision of DocuShark . We want to make collaboration simple again. There are too many amazing tools, too many surfaces to get lost in. Bring them together - and you've got a near-endless wealth of knowledge for anyone with access. The editor is out, and loaded with features, only getting more powerful. Our editor offers: high-speed, realtime collaborative editing on documents in your Cloud Workspace, documents that can write, draw, and store files at the same time, never lose access when your network goes out - offline copies let you use every feature anywhere, and agent endpoints (MCP) for all your agentic needs. The page and canvas are one, with generous file storage, allowing you to design whitepaper-level PDFs in hours, not weeks, with every file, reference, and diagram within that document, all while offline with changes saving when you're back online. It's a mini Google Drive in each document, with offline storage so you can edit anywhere, anytime with changes syncing across your team. The Integrations Story - Combine, don't Compete DocuShark isn't here to compete, it's here to integrate, and keep complex ideas lean and organized across platforms. As we release our integrations, knowledge drift shrinks, leaving you with richer context while you keep working with your favorite apps - or don't, we have rich editor tools as well. An Agent Powerhouse - Keep your Context Close DocuShark is built for agents from the ground up. Citations keep your agent's research properly attributed. Fields eliminate drift and block duplication before it starts. Anchored edits make changes surgical, not sweeping. More is in the works, and the roadmap is moving fast. Try DocuShark - The Editor's Free and Fast You can either launch straight into the editor , or get a cloud workspace and start collaborating today!

I 've been using Cursor on non-trivial repos and kept hitting the same issue: the agent finds a file but misses routes, shared modules, and tests that should run after a change. I built FlowIndex — a local CLI + MCP server that scans a repo and builds a behavior graph in SQLite (entrypoints, imports/calls, tests, git co-change). No embeddings, no SaaS, no LLM calls in the index itself. Setup: pip install "flowindex[mcp]" In your project: flowindex init flowindex scan Add to ~/.cursor/mcp.json (use your repo' s absolute path for cwd ) : { "mcpServers" : { "flowindex" : { "command" : "flowindex" , "args" : [ "mcp" ] , "cwd" : "/absolute/path/to/your/repo" } } } 4. Restart Cursor — you get tools like get_change_impact, suggest_tests, make_context_pack, explain_entrypoint, get_repo_overview. Example workflow: before editing payments/ledger code, ask the agent to use make_context_pack or get_change_impact on that file — it pulls from the local graph, not a generic file search. Honest limits: static analysis + git heuristics only. Call paths resolve via imports but aren 't compiler-grade. TS/JS is heuristic. Documented in the README. MIT · pip install flowindex · https://github.com/adu3110/flowIndex Curious if others use MCP for repo context and what tools you wish existed. Happy to fix setup issues if anyone tries it.

AI can generate unit tests in seconds. But how do you know whether those tests are actually useful? Most teams still rely on code coverage and pass rates to evaluate their test suites. The problem is that a test can pass, increase coverage, and still provide little or no additional confidence. We've been seeing examples where AI-generated tests: Duplicate existing coverage Depend on system time or GUID generation Access files, network resources, or environment variables Use ineffective or unnecessary mocking Add maintenance cost without improving quality Today we launched Typemock Test Review, a tool that analyzes tests during execution and identifies duplicate, fragile, ineffective, and high-maintenance tests. Instead of looking only at source code, it combines runtime behavior, code coverage, dependency analysis, assertions, and mocking patterns to determine whether a test is actually contributing value. Some of the issues it can detect: Duplicate tests Hidden external dependencies Flaky test risks Unused or stale fakes Ineffective mocking Tests that increase maintenance without increasing confidence I'm curious how other teams are dealing with the explosion of AI-generated tests. Are you reviewing AI-generated tests differently from manually written tests? Have you found good ways to measure test quality beyond coverage and pass/fail metrics?

TL;DR: What gadgets, tools, furniture and whatnot do I need for an ideal desk setup for a...

According to product onboarding and SaaS activation research compiled by Appcues and industry...

MCP is useful, but most of the time you do not actually need it. It gives an agent a clean way to discover tools, call APIs, and work with external systems. In practice, a skill file can describe the same usage path without dragging the whole MCP surface into context. But MCP is not free; rather than MCP itself, the real issue is the habit of loading a big MCP surface into every session, no matter what the session is actually about. Once a Claude Code or Codex run pulls in a bunch of servers, the model sees those tool definitions right away, even if the job is just writing docs or fixing a small bug. That is where the waste starts. The hidden cost of always-on MCP Every MCP server brings metadata with it: tool names, descriptions, argument schemas, nested parameters, enums, examples, and sometimes prompts or resources. While useful, this is still context. If you connect a handful of lightweight tools, the overhead is annoying but manageable. If you connect a real stack of services, the cost compounds fast. In practice, you end up paying for: tool discovery before the task starts schema text the model may never use repeated loading across unrelated sessions extra context pressure that pushes out the actual work That last point matters more than people think. Context acts as the active working set the model uses to reason. The more of it you burn on static tool catalogs, the less room you have for the user request, the repo state, prior reasoning, and the actual answer. Anthropic has already written about this problem directly in the context of MCP. Their engineering post on code execution with MCP calls out tool-definition bloat and shows how direct tool calls can consume a lot of context before the model even starts doing the real job. The tool list is not just setup noise; it is part of the session cost. Why skills are cheaper Skills take a different path. A skill file keeps the always-loaded portion tiny. Usually that means just the skill name and a short descript

Tools Full comparisons and context in my 2026 AI tech stack post . This is just what you need installed to follow the workflow below. Claude Code If you're new, start with the cheat sheet and Anthropic best practices . Security — set this up first: Claude Code Security Hooks — 7-layer prompt injection defence, read guards, canary files Lock down your .env and any git-secret files in .claude/settings.local.json before anything else MCP: Context7 — library/API docs on demand DeepWiki — open source repo documentation Skills: Matt Pocock's skill set — /grill-me , /handoff , /improve-codebase-architecture (covered in detail below) Understand Anything — interactive code knowledge graphs Ponytail — laziest-senior-dev heuristic, pairs well with /improve-codebase-architecture Agents: DocsExplorer — handles docs lookup in a subagent without polluting main context Hooks / proxies: rtk — token reduction proxy, single Rust binary UI: Claude HUD — status bar showing model, context size, active tools and agents Other tools JetBrains — for git, debugging and reviewing Claude's changes; Claude Code plugin Warp.dev — terminal; Warp Oz for hands-off tasks, Claude Code for hands-on Process As I've mentioned in previous posts, my workflow is typically very different from what you'll see in the hype and social media posts. I don't typically work on monorepo, single stack, single language projects. My clients are typically full-on microservices with multiple languages and stacks. And beyond that, I still prefer IDEs over fancy pluggable text-editors, which often means I can't keep all the projects single scoped. What this means is that current favourites like Air , Conductor , and Antigravity don't work for me. So I've been solving my own problems, and this process I'm sharing today allows me to employ multiple agents working mostly independently on different repos towards a singular goal. I treat my agents like I would juniors or contractors; trust but verify. I give them tasks, but I ha

AI Coding Agents Need a Control Layer AI coding agents are getting good enough that the problem is changing. A year ago, the question was mostly: Can this thing write useful code? Now, for a lot of builders, the better question is: How do I supervise this thing once it is actually doing work? That shift feels important. Claude Code, Cursor, Codex, and similar tools are not just autocomplete anymore. They can plan, edit files, run commands, review code, and work across larger chunks of a project. That is powerful. It also gets messy fast. The bottleneck is moving The hard part is no longer just picking the best coding agent. It is figuring out how to manage agent work once multiple tools or sessions are active. Questions start showing up: What is each agent doing right now? What changed? What still needs human review? Where did approval happen? Which agent owns which task? Did two agents touch the same part of the codebase? What should be paused, redirected, or stopped? What happened while I was focused somewhere else? That is not really a prompting problem. It is a control problem. The current workflow is mostly duct tape A lot of agent workflows seem to rely on some combination of: terminal tabs tmux sessions git branches git worktrees editor diffs notes issue trackers rules files memory vibes That works for a while. But once agents become more autonomous, or once a builder runs more than one agent at a time, the workflow starts to need a real operating layer around it. Not because the agents are bad. Because the agents are getting useful enough to need supervision. The missing layer The layer I keep thinking about has a few jobs. State What is running? What is paused? What needs attention? Ownership Which agent owns which task, branch, file, or objective? Review What changed, and what still needs a human to look at it? Approval Where should the human say yes before work continues? Intervention When should a builder pause, redirect, compare, or stop an agent? Memor

A working prompt library is the main event, not an appendix. The industry still treats prompts as some half-baked spitball left in a README, or, worse, a plaintext blob stapled to package.json and forgotten. That's a waste of compute and credibility. What powers reliable AI-assisted refactoring, onboarding, or even next-gen code IDEs is not the size of the model but the clarity and context supplied by the actual, shipped prompt set. OTF kits turn this lesson into a repeatable deliverable: every paid template includes 20+ production-tested prompts tied to the real file structure, component API, and product-specific conventions. This is not a suggestion; it's structural. The takeaway: a real prompt library is as important as your component library. Treat it like one. Start with the pain: why blank chat boxes don't scale The web is full of “integrations” that paste a blank chat input over your codebase and call it an “AI coding assistant.” The result: hallucinated function names, invented conventions, broken import paths. Here’s what happens in real life: Dev: "Add a social login button." AI (blank prompt): "Sure! Insert <SocialLoginButton> in your LoginScreen.js." Dev: (There’s no such component. There's not even a LoginScreen.js.) Short: A generic prompt with zero context simply can't know your conventions, files, or patterns. The agent will either fail, hallucinate, or pepper you with clarifying questions you have already answered in your product architecture. Takeaway: Prompting without context is coding without types — fragile guesses instead of structured outcomes. What a first-class prompt library enables When the prompt library ships with the codebase, it looks like this: Every prompt knows the folder structure (e.g., features/auth , screens/Settings/index.tsx ). Conventions are hard-coded: naming, import styles, design token usage. Endpoints and integration points (e.g., “update the Stripe webhook handler in api/webhooks/stripe.ts ”) are spelled out. The promp

Every time I started a new AI chat session, it read my entire codebase. 50 files. Thousands of tokens. On every single message. Whether I was asking about authentication, database schema, or a single UI component — the AI read everything. I'm 16 and building AI-powered products. Token costs add up fast. Context windows fill up. The AI loses track of older files. Responses slow down. So I built something to fix it. The Problem When you work with AI on large projects, you face a choice: Give the AI too much context → burns tokens, hits context limits, slower responses Give it too little → AI misses important files, makes wrong assumptions There's no middle ground — or at least there wasn't. Introducing FolioDux FolioDux is a lightweight, open-source file-mapping standard for AI-assisted development. The idea is simple: instead of giving your AI every file, you give it a compact index that tells it where everything is and what it does . The AI reads the index first, identifies the relevant files, and reads only those. One file. Two rules. Any AI. It works with Claude, ChatGPT, Gemini, Cursor, Copilot — any tool that accepts a system prompt. How It Works You add one file — FOLIODUX.md — to your project root. # FOLIODUX · TaskFlow · v1.0 · 2026-06-18 · 17 files STACK: React19+TypeScript+Vite · Express+SQLite · JWT --- ## TASKS auth/login/register → AuthView.tsx, authService.ts, server.ts create/edit task → TaskForm.tsx, taskService.ts, server.ts, types.ts list/filter tasks → TaskList.tsx, taskService.ts database → db.ts, server.ts --- ## INDEX App.tsx | fe | root: routing, auth state, layout wrapper AuthView.tsx | fe | login + register forms, error display taskService.ts | svc | CRUD tasks, local cache, optimistic updates server.ts | be | Express: all routes — auth, tasks, projects, user db.ts | be | SQLite setup, schema creation, migrations on boot types.ts | typ | Task, Project, User, Status(todo|in-progress|done) --- ## GROUPS Frontend: App.tsx · AuthView.tsx · TaskLi

YINI Specification RC 6 is now released The YINI configuration format has reached Specification Release Candidate 6 . YINI is a configuration format designed to feel familiar if you like INI-style files, but designed to bring more explicit structure, clarity, useful data types, and predictable parsing rules to real-world configuration needs.. The short version: @yini ^ App name = "Example" version = "1.0.0" debug = false ^^ Server host = "127.0.0.1" port = 8080 ^^ Features enabled = [ "auth", "logging", "metrics", ] YINI tries to sit somewhere between classic INI, JSON, TOML, and YAML: More structured than traditional INI. Less punctuation-heavy than JSON. Indentation-insensitive unlike YAML. Explicit about parsing rules and validation behavior. RC 6 is an important release because it tightens several parts of the language and moves the format closer to a stable 1.0 specification. What changed in RC 6? RC 6 includes a number of syntax and behavior updates. The main theme is the same as before: Make the format clear for humans, but deterministic for parsers. Here are some of the notable updates. Clearer section markers YINI uses section markers to define structure. ^ App name = "MyApp" ^^ Server host = "localhost" ^^^ TLS enabled = true The number of section markers defines the nesting level. This keeps hierarchy visible without relying on indentation. The primary section marker is: ^ YINI also supports alternative section markers, but ^ remains the recommended default for most files and examples. Strict and lenient mode behavior is more clearly defined YINI has two parsing modes: Lenient mode — practical, forgiving, and intended as the default. Strict mode — validation-focused and intended for stricter tooling, CI checks, and production-sensitive configuration. A file can declare its intended mode: @yini strict or: @yini lenient RC 6 clarifies how these declarations should behave when the file is parsed in a different mode. The goal is to avoid silent surprises. If

AI Observability for Lovable Apps: Monitor Prompts, Traces, and Evaluations with Currai Building AI applications has never been easier. Tools like Lovable allow developers and founders to create AI-powered products in minutes. Whether you're building a chatbot, AI assistant, recommendation engine, AI agent, or prediction app, generating the application is often the easy part. The real challenge starts after launch. How do you know what prompts are being sent to the model? How do you debug unexpected AI responses? How do you compare prompt variations and determine which performs better? How do you evaluate output quality over time? How do you track token usage and costs? This is exactly why we built Currai . What is Currai? Currai is an AI observability platform that helps teams understand, test, and improve AI applications in production. It provides: Prompt tracing AI request monitoring Session tracking Prompt versioning A/B testing LLM evaluations Cost and token analytics OpenTelemetry support Instead of guessing why your AI application produced a particular response, Currai lets you inspect the entire execution flow. The Problem With AI Applications Traditional monitoring tools were built for APIs, databases, and backend services. AI applications introduce a completely different set of challenges: Prompt changes can significantly impact output quality Model updates can affect behavior Hallucinations are difficult to track User conversations are hard to debug Prompt experiments are often unmanaged Quality evaluation is usually manual When something goes wrong, application logs alone don't provide enough visibility. You need observability designed specifically for AI systems. Trace Every AI Request Currai captures every prompt, model response, latency metric, token usage, and cost. You can inspect: System prompts User prompts Model outputs Execution traces Tool calls Metadata This makes debugging AI applications dramatically easier. Run Prompt A/B Tests Prompt engin