标签：#AI

Browser automation with Playwright, Python, GitHub Actions, and Entire to auto-enter San Francisco Stern Grove concert lotteries each week!

Every small task used to mean a new tab. JSON formatter on one site, GST calculator on another, PDF merger somewhere that wanted my email before it would merge two pages. Ads everywhere, slow UIs, and that low-grade worry about uploading a payslip or invoice to a server I do not control. I got tired of juggling twenty bookmarks for work that should take thirty seconds — so I started building one place for all of it. What ToolReign is ToolReign is a free online toolbox: 260+ utilities across 15 categories , all running in your browser. Developer tools (JSON formatter, JWT decoder, API client), text utilities, SEO helpers, PDF and image tools, spreadsheets, and a finance section I built with India in mind — GST with CGST/SGST/IGST splits, EMI and SIP calculators, HRA exemption, gratuity, income tax estimates, and more. The idea is straightforward: open a tool, do the work, leave. No signup wall, no file uploads to a backend, no account to manage. I am Anirudha Sonwane , a Senior Software Engineer at Giant Leap Systems in Pune. ToolReign is a side project I build around my day job — not a pitch deck, just something I wished existed. The tech stack decisions Next.js 14 App Router and static export Each tool lives at its own route under src/app/{category}/{tool-slug}/ . That maps cleanly to SEO: one URL, one search intent, one page of metadata. The site exports statically ( output: 'export' ), so production deployment is uploading an out/ folder to static hosting — no Node server to babysit. The App Router made this scale. Add a page component, register the slug in tool-registry.json , and the sitemap, category hubs, and search index pick it up automatically. At 260+ tools, hand-maintaining URLs would have broken within a month. 100% client-side — the decision that shaped everything This was the core architectural bet, and it is also the privacy story: your data never leaves the browser. Finance calculators are plain TypeScript math with useMemo . PDF merge and split use

You already understand tokens. Extensions are just middleware for your money. If you have ever worked with Stripe, you know the pattern. You start with a simple charge: send money from point A to point B. Then you add features — subscriptions, transfer fees, metadata on invoices, compliance checks. Each feature is a separate Stripe product or API call, and wiring them together is your job. Solana's Token Extensions Program is the same idea, but at the blockchain protocol level. Instead of bolting features on top of a basic token after creation (which Solana does not allow), you declare every capability upfront, and the runtime enforces it automatically. No smart contract to write. No backend service to maintain. Just configuration flags at creation time. What is a token extension? A token extension is an optional feature you enable when you create a token mint. Under the hood, each extension reserves extra bytes in the mint's on-chain account. Those bytes store configuration — an interest rate, a fee percentage, a metadata URI — and the Solana runtime reads them during every transaction. The original SPL Token Program is simple. It stores supply, decimals, and authorities. The Token Extensions Program ( TokenzQdBNbLqP5VEhdkAS6EPFLC1PHnBqCXEpPxuEb ) is a superset. It stores everything the original does, plus additional data for each extension you enable. Extensions map directly to Web2 concepts Extension Web2 Analogy What It Does Transfer Fees Payment processor fee Deducts a % on every transfer Interest-Bearing Savings account APY Displays time-adjusted balance Metadata Product catalog entry Stores name, symbol, URI on-chain Default Account State KYC gating All accounts start frozen; you thaw approved users Non-Transferable Professional license Tokens cannot be sold or transferred Permanent Delegate Admin revoke power Issuer can burn tokens from any holder A concrete example Here is the exact command I ran to create a token with transfer fees, interest-bearing, and m

I run Claude Code most of the day. The thing that kept biting me wasn't the model getting dumber. It was the model forgetting what we'd already settled, then confidently redoing it wrong. You've probably hit it. You write a CLAUDE.md , you keep notes, you tell it "we decided X." A few prompts later it relitigates X, or quietly breaks something it fixed an hour ago. Bigger context windows didn't fix it for me either. A 1M window just means more room for stale instructions to rot in. Here's the reframe that actually held: stop treating the model as the place the state lives. The model is a worker, not a filing cabinet A context window is working memory, not a record. It's lossy, it drifts, and every new turn re-derives the world from whatever's in front of it. If "what's done and what's half-broken" only exists in that window, you're trusting the most forgetful part of the system to remember the most important thing. So I moved the state out of the model and into the work. Two pieces did most of it: A frozen spec the agent re-reads. Not a chat message it might compress away. An actual file that says what we're building and what's already decided. When it starts drifting, the spec is the source of truth, not its memory of the conversation. A checklist it can only tick after something is verified. [ ] becomes [x] when a test passes or I've confirmed the change, never because the model "thinks" it's done. The checklist carries the progress. The model just moves it forward one verified step at a time. The difference is subtle but it's the whole game. Before, the work was a side effect of the conversation. After, the conversation is a side effect of the work. The agent can lose the whole thread and reload from the spec plus the checklist and basically pick up where it left off. A number that surprised me When I actually measured my own sessions, almost none of my tokens were fresh input. The bulk was cache reads and re-reading instructions that hadn't changed. So the "cont

I'm a professional developer, and AI has significantly increased my output—I'd say by maybe 30 or 40 percent. GitHub Copilot has significantly changed the way I work with code. However, I take pride in producing high-quality code quickly, which is why my rates are high. Using AI helps me increase my output while maintaining that level of quality. My take on AI is that it is not going to replace humans anytime soon. It is, however, putting significant pressure on the economy. Previously, setting up a functional, decent-quality project without much complexity took time—at least weeks. Now, such tasks are incredibly fast and easy; anyone can set them up in a few minutes using AI, even without any coding knowledge. Success in most fields, however, is not just a measure of how fast you can build; it's also about how well you can execute. Current AI can offer advice, but it still cannot execute for you. Market success requires sensitivity, context, and adaptability. AI can help significantly if you know how to ask the right questions. But the economy is made of people, not AI (yet). To earn money, someone must give you money because they value what you offer. The arrival of LLMs hasn't changed this. I feel the pressure. The corporation I work for is pushing for AI adoption, and the initial drawbacks and realizations are already becoming apparent. First point: Customers, at best, don't care about your AI. They don't want it. Second point: AI succeeds at making developers more productive but fails with higher complexity—though not for the reason people usually think. With the right prompt, GPT-5.4 can create fairly complex solutions, even more complex than many corporate business processes. The real reason is that, at a certain level, complexity lies not in the total amount of information in the system, but in how the human aspect of the business translates when you try to formalize higher-level context. This is something most developers don't see (or care about). For examp

I run brand and product work for crypto and fintech companies, and this year the same request keeps landing on my desk, worded slightly differently each time: we don't want to look like crypto anymore. It comes from payment companies, exchanges, stablecoin startups — the ones that spent years looking like "the future" and now want to look like a bank. Or rather, a neobank. The first thing they ask to kill is the gradient. This isn't taste finally maturing. It's regulation. Under MiCA you can't operate in European crypto without a license, and a licensed company that still looks like a 2021 DeFi protocol has a problem its lawyers can't fix. So the whole industry is quietly repainting itself toward "trustworthy." Here's the trap I keep watching people walk into. The gradient everyone's fleeing is already being replaced by a new monoculture — the same off-white, the same restrained type, the same calm. Swapping a gradient for clean sans-serif feels like progress because it looks like the companies that already won (Stripe, Coinbase). But you're not them, and wearing the surface of a trusted brand doesn't make you inherit the trust. It's just a different uniform. The escape route became a traffic jam. The deeper issue: the audience flipped. For 15 years crypto brands were built for insiders who chose crypto because it wasn't a bank. The dark dashboard and the "to the moon" energy were tribe signals. But a licensed company now answers to regulators, banks, institutions, and normal people moving their salary — none of whom read a glowing gradient as "innovative." They read it as "unregulated." Same brand, overnight liability. And the part most people skip: trust isn't a color. It's spread across every surface you own, all the way down to the transaction detail nobody thinks about. A clean homepage in front of a 2021 dashboard isn't progress — it's a tell. The repackaging that works goes all the way down: the same restraint and clarity from the cold email to the onboarding

I am going to start with a number most people will not say out loud. 1,200 applications. That is how many jobs I applied to over 3 to 4 months trying to switch from a service-based company to a product-based one. I had spreadsheets, saved searches, and browser tabs I kept telling myself I would close tomorrow. Some nights I was applying at 11pm just to hit my self-imposed daily quota. Out of 1,200, I got around 10 interview calls. Out of 10, I got 4 offers. The applications got me in the room. What happened inside the room is what this post is actually about. The One Thing That Followed Me Into Every Interview At my previous company I worked on a lot of things, but one project came up in literally every single interview. We had a Python module that parsed ASAM MDF files. Binary log files from vehicles and sensors, often gigabytes in size. The parser was painfully slow. Around 8 minutes to load a single file. The kind of slow where you start it, go get lunch, and hope it is done when you come back. I rewrote it in Rust. Load time dropped from 8 minutes to 12 seconds. 40x improvement on GB-scale files. Every interviewer stopped me the moment I mentioned it. The questions were real engineering questions, not generic resume stuff. "Why Rust over Go or C++?" "How did you profile the bottleneck first?" "What was your testing strategy when rewriting something this critical?" "What would you do differently now?" I would spend 20 to 30 minutes just on this one project. Not because they were grilling me. Because it was a genuine conversation between two people who cared about the problem. Here is why it worked: I had lived with it. I hit walls in the rewrite that took days to figure out. The context, the wrong turns, the eventual solution were all stored in my head. When a follow-up question came, the answer was just there. You cannot fake that. A first follow-up question exposes a tutorial project immediately. Real work under real constraints creates a depth that no amount o

Lately, it feels like my feed is completely flooded with "Become an AI/ML Engineer in 2 Hours!" crash courses and quick certificates promising a golden fast-track into machine learning roles. But let’s be completely real for a second: there are no tutorial shortcuts here. The more I dive into actual system architecture and cloud infrastructure, the more obvious it becomes: machine learning isn't a standalone magic trick. It's built entirely on rock-solid Computer Science, efficient data structures, and heavy-duty software engineering. Software Engineering First, AI Second If you can’t build or scale a reliable backend, manage data pipelines, or understand low-level underlying system logic, you simply cannot scale an AI model in production. Prompt engineering is cool for prototyping, but production-level ML requires real, foundational engineering skills. You have to learn how to be a great software engineer first. Looking Past the Hype (A Solid Structural Roadmap) If you actually want to look past the superficial fluff and understand how real data workloads, model deployments, and ML infrastructure fit into a cloud environment, I found an incredibly solid, structured resource. Instead of hand-waving past the hard parts, Microsoft Learn has an official, step-by-step breakdown on Azure AI and Machine Learning Fundamentals. It actually goes into the core architectural principles and shows you what real cloud-scale infrastructure looks like. Whether you are trying to map out your summer learning roadmap or just want to understand the actual systems backing these models, I highly recommend checking it out. Here is the structured entry point if you want to skip the shortcuts and dive into the real infrastructure: 🔗 Official Azure Machine Learning Technical Hub What are your thoughts? Are you seeing the same "AI shortcut" hype on your feeds, or are people finally starting to focus back on core system fundamentals? Let's discuss in the comments!

Most discussions around MCP focus on tool calling. That is natural. When people first see MCP, the obvious use case is simple: Let the AI call external tools. A model can read a GitHub issue. A model can query a database. A model can update a file. A model can call an API. In that sense, MCP looks like an RPC layer for AI agents. That is useful. But I think it may not be the most important use of MCP. The more interesting use is this: MCP can distribute context, rules, skills, and operating contracts to AI clients. In other words, MCP is not only a way for AI to call tools during work. It can also be a way to define the working environment before the work starts. The problem with RAG RAG is usually used to answer this question: What information might be relevant to this request? The system searches documents, retrieves chunks, and gives them to the model. This works well for many cases. But it has structural limits. RAG retrieves likely relevant information. It does not necessarily define how the work should be done. For team-level AI work, this is a problem. A team does not only need information. A team also needs shared rules. For example: What is the authoritative source? What should be treated as unknown? When should the AI stop? When is human confirmation required? What is the closure condition? Which workflow should be used? Which domain skill applies? What evidence must be recorded? RAG can retrieve documents that describe these rules. But retrieval is not the same as governance. A retrieved chunk is just context. It is not necessarily an operating contract. The problem with local prompts Many teams try to solve this with prompts. They write instructions like: Follow our coding rules. Use this design document. Ask questions when unclear. Do not make risky changes. This helps, but it does not scale well. Each developer may have a different local prompt. Each AI client may load a different file. Each repository may contain a slightly different version of the ru

A single shared API key is fine right up until a second person uses it. intent-brain — the system, repo qmd-team-intent-kb , renamed to the intent-brain plugin v0.4.0 this day — is a team knowledge base. A Fastify HTTP API sits over a governed memory corpus. In front of that API is an MCP server named teamkb , so a teammate doesn't open a dashboard or learn an endpoint. They ask in Claude Code and get a cited answer back with qmd:// citations. That's the whole pitch: institutional memory you query in the same place you write code. Up to this day it authenticated with one shared TEAMKB_API_KEY . The shared key has two failures that only show up once the tool has more than one user. First, every request looks identical, so the audit log can't say who asked. Second, revoking one person means rotating the key for everyone — there's no per-person handle to drop. Both are structural, not bugs you patch. You fix them by giving each person their own credential. The work closed that gap with three things, in this order: per-user tokens (identity), a server-side write gate (authorization), and a per-read access log (audit). The through-line: the API is the real boundary. The MCP client-side tool gate is UX, not security. And the per-read access log stays separate from the governance audit trail — separate log, not no log. Identity: per-user tokens replace the shared key apps/api/src/auth/token-registry.ts . Each token resolves to a record: { actor, role } , where role is 'admin' | 'member' . The shared key's two failures both dissolve here — every request now carries an actor , and revoking one person is dropping one record, not a team-wide rotation. Tokens come from layered sources, in precedence order: explicit records → a TEAMKB_TOKENS JSON env → a TEAMKB_TOKENS_FILE (default ~/.teamkb/tokens.json ) → the legacy single TEAMKB_API_KEY , which becomes one admin token with actor "shared" for back-compat. Each entry is a bearer token resolved to an identity at request time. Ma

The dogfood run went green. The gate had governed zero calls. That is the agent-governance-plane's entire job: run an AI coding agent inside a sandbox, route every tool call through a Unix-domain-socket gateway, and write a signed, hash-chained journal of every allow/deny. A green run that gated nothing isn't a pass. It's a governance plane governing air. The gate that catches its own hollowness AGP's CI dogfood doesn't just check that the harness exits 0. evidence-bundle.sh fails on a 0-gated run — if the journal shows no decisions, the build is red regardless of process exit status. That guard is what surfaced this at all: the agent process came up, the harness reported success, but the bundle had no verdicts to verify. Red. That's the last I'll say about hollow-green detection here. It's the door, not the room. The room is why zero calls reached the gate, and the answer turned out to be a collision between two things that look unrelated until you trace the syscall: Linux capabilities and a Unix socket's permission bits. The wrong theory The first hypothesis blamed the execution path. AGP has a dev-sandbox mode where the agent and the gate share a process, and a docker mode where the agent runs in a container talking to a host daemon over a bind-mounted socket. The theory was that the same-process path was short-circuiting the gate — agent and gate in one address space, the socket round-trip optimized away, decisions never journaled. Plausible. Wrong. The dev-sandbox path journaled fine in isolation. The failure only appeared in docker mode, and the moment that became clear the investigation moved from "which code path" to "what's different about the container." What's different about the container is the security posture. The real root cause: caps meet a missing write bit The short version: connecting to a Unix domain socket needs write permission on the socket file. --cap-drop ALL strips CAP_DAC_OVERRIDE — the capability that lets root ignore permission bits — s

🚀 Join the Omnia Community — Contributors Wanted Hello everyone, I'm building Omnia , an open-source, privacy-first productivity workspace designed to combine notes, tasks, calendars, habits, goals, reminders, and AI assistance into a single desktop application. The vision is simple: Create the productivity app we all wish existed — fast, beautiful, extensible, local-first, and truly owned by its users. Current Stack React 19 TypeScript Tauri v2 SQLite Zustand Tailwind CSS v4 Tiptap Editor OpenRouter / OpenAI / Ollama What We're Building Omnia aims to become a serious alternative to tools like Notion, Obsidian, and other productivity platforms while remaining: Free and open source Privacy-focused Local-first Highly customizable Community-driven Looking For Contributors Everyone is welcome, regardless of experience level. Frontend Developers Help improve: UI/UX Editor experience Dashboard widgets Accessibility Responsive layouts Rust Developers Help with: Tauri backend Native integrations Performance optimization Security improvements Designers Help create: Themes Icons Illustrations User experience improvements Documentation Writers Help build: Wiki pages Tutorials Guides Developer documentation Open Source Enthusiasts Help by: Testing releases Reporting bugs Suggesting features Participating in discussions Current Priorities Stabilizing the first release Performance improvements Windows support Linux support Plugin architecture Theme ecosystem Export & backup tools Why Contribute? Because this is an opportunity to help shape an ambitious open-source project from the very beginning. Every contribution matters, whether it's a bug report, documentation improvement, design suggestion, or a major feature implementation. If you're interested in building the future of personal productivity software with us, we'd love to have you on board. Let's build something amazing together. 🚀 See you in the repository!

A year ago, "it's just a ChatGPT wrapper" was a dismissal. You'd hear it about a startup and know what it meant: an LLM API call, a little RAG, file upload, a chat box on top. Thin. Replaceable. Probably dead the next time the base model shipped a feature. I keep coming back to that phrase, because it stopped being true in a way I didn't notice happening. The thing you'd be wrapping is no longer a model with a chat UI. It's a fast, stateful web application with its own agent loop, its own sandbox, its own artifact system. The wrapper didn't get easier to build as the models got better. It got heavier . The simple interface hides the hard part. A ChatGPT-shaped product is not just an API call with a chat box around it; it's the accumulation of many product and infrastructure decisions that make execution feel safe, stateful, and immediate. The model is the part you can buy. The surrounding runtime is the part people had to design. What gets me is the timescale. It's been roughly a year, and the question actually worth arguing about has moved out from under us — from "is this just a wrapper?" to "where does the sandbox even run?" The pace is faster than I can comfortably track. And the part I keep finding fun is that it all bends toward the practical, not away from it: every one of these shifts makes the tools more usable, more real, closer to something you'd actually ship. Surprising and, honestly, a good time to be building. This isn't a "wrappers are over" argument, and it isn't advice. It's me writing down where my thinking has drifted while trying to build these things myself — partly so I can find out where it's wrong. Read it as one person's notes. What "wrapper" used to mean The old shape was honestly small. Roughly: prompt → LLM API → (RAG retrieval) → response + file parsing on the side The whole game was prompt design, a retrieval index, and some glue. You could stand it up in a weekend. The reason "wrapper" was an insult is that the surface area was tiny —

A deep dive into the podcasts, papers, tweets, and tutorials of the engineer who made me add a fifth...

Have you ever been at a situation where you have been recently hired to maintain a legacy project, an important project at your company, but the previous team has long retired, and when you start, there is no documentation? When that happens, the old adage of "The code is the documentation" sounds true, but what happen when the code is also very old, hard to understand, and make use of libraries from when your parents were dating? In that case, using an AI Tool to help you understand how this project was created and maintained could be an option. Below are five prompt engineering techniques taken from a scientific article, with CLI based examples, to help you get the best out working with a legacy project. Zero-shot prompt A zero-shot prompt is when you make a prompt to request the model to execute a task without giving it any extra information or practical example in the input prompt. A classic example would be to ask a coding model to translate a "string.xml" file containing commonly used text strings in a natural language (for example, English) into another (for example, Spanish). Those are the easiest prompts to create and to feed to the model, but their results can be more unpredictable, since they usually lack the constraints of larger prompts. Prompt example: I want you to translate the contents of "string.xml" from English into Spanish and output it to me. Check this project files and directories, and provide me a list containing the current node version being used on this project and its libraries. Few-shot prompt In contrast to a zero-shot prompt, a few-shot prompt is a prompt including one or more pairs of the desired input and output, so the model can infer or mimic the desired output when you input the next value. A classic example would be asking a model for predictions based on a set of constraints. Those prompts tend to be longer and more complicated, and you must check the answer, because there is always a chance the model may infer incorrectly your

7 daily crons, 2 starvation incidents that triggered the rewrite Health checks before work, not after, catch silent failures Queue-low alarm fires at 5 items, not at zero A cron is ignorable for 3 weeks only when failures are loud I run 7 GitHub Actions crons every day, and for two months I never looked at them. Then a content queue starved silently and I posted nothing for 4 days before noticing. Here is what I changed so a cron can stay green and be ignorable for 3 weeks straight. The Two Incidents That Forced The Rewrite The first starvation happened on a Tuesday. My image generation cron pulled prompts from a queue, made the assets, and pushed them to a publish queue. The image API returned a 429 (rate limited) and the job exited cleanly with a green checkmark. GitHub Actions reported success. The workflow logs said "0 prompts processed" in a line I never read. For 4 days the publish queue drained and nothing refilled it. I found out because a follower asked why I went quiet. The second incident was sneakier. A cron that calls an external API hit an auth token that had expired. The script caught the error, logged it, and returned exit code 0 because I had wrapped the whole thing in a try/except that swallowed everything. Green check, no work done. This one ran for 6 days before I caught it during an unrelated debug session. Both failures shared one root cause: a green checkmark in GitHub Actions means the process exited zero, not that the work happened. Those are completely different claims. A cron that catches its own errors and exits clean is lying to you in the most polite way possible. After the second incident I sat down and wrote out what I actually wanted. I wanted to never look at these workflows unless something was wrong. I wanted "wrong" to be loud. And I wanted the loudness to arrive before the damage, not after. That meant three changes. First, the exit code had to reflect real work, so swallowed exceptions had to re-raise or set a failure flag. Sec

GitHub added an enterprise setting this week that looks like the kind of thing most developers will never read about unless it breaks their editor. Enterprise managed settings now support strictKnownMarketplaces for VS Code and GitHub Copilot CLI. In plain English: an organization can restrict which extension and plugin marketplaces are known and allowed inside the developer tools people actually use. That sounds like desktop management. I think it is more interesting than that. If coding agents can discover tools, install plugins, call commands, read repositories, modify files, and run workflows from the IDE or terminal, then plugin marketplace policy is no longer a minor preference. It is part of the runtime boundary. The agent does not only need permission to think. It needs permission to reach for tools. And the place where those tools come from is now a security surface. the tool catalog moved closer to the developer For a long time, extension marketplaces felt like productivity infrastructure. You installed a formatter, a theme, a language server, a test explorer, a Docker helper, a cloud plugin, a database browser, maybe three things you forgot existed. Some companies cared a lot. Many mostly hoped the endpoint security product would notice anything truly bad. That world was already risky, but the blast radius was usually framed around the human developer. A plugin could read files, run code, exfiltrate data, or weaken the local environment. Bad, but familiar. Agents change the framing. An AI coding assistant sitting in the IDE or CLI may use plugins as capabilities. It may call into developer tooling, use installed extensions as context, or depend on local integrations to perform work. Even when the agent itself does not directly install anything, the available tool environment shapes what it can do. So the question stops being "which extensions are developers allowed to install?" It becomes "which tool supply chains are allowed to become part of our automat

penAI reportedly plans to share its newest model, GPT 5.6, with a select group of partners instead of to the broader public. The reason: the Trump administration told it to.

Explore how the GitHub Copilot agentic harness delivers strong results across multiple benchmarks and leading token efficiency, while maintaining flexibility to choose among more than 20 models. The post Evaluating performance and efficiency of the GitHub Copilot agentic harness across models and tasks appeared first on The GitHub Blog .

So much for voluntary review.