标签：#EV

Si sabes Python pero el frontend te frena, NiceGUI es una de las mejores noticias de los últimos años: te permite construir aplicaciones web completas —con botones, formularios, gráficos y navegación— usando solo Python. ¿Qué es NiceGUI? Es un framework construido sobre FastAPI (backend) y Quasar/Vue (frontend). Tú escribes Python; NiceGUI genera la interfaz en el navegador y mantiene sincronizado el estado por ti. No necesitas HTML, CSS ni JavaScript para empezar. Lo simple que es Una app con un botón que muestra un mensaje son literalmente cuatro líneas: from nicegui import ui ui . button ( ' Saludar ' , on_click = lambda : ui . notify ( ' ¡Hola! ' )) ui . run () La jerarquía de la interfaz se expresa con context managers , que reflejan cómo se anidan los elementos: with ui . card (): ui . label ( ' Iniciar sesión ' ). classes ( ' text-xl font-bold ' ) usuario = ui . input ( ' Usuario ' ) clave = ui . input ( ' Clave ' , password = True ) ui . button ( ' Entrar ' , on_click = lambda : entrar ( usuario . value , clave . value )) Añadir estado reactivo, formularios, tablas o rutas ( @ui.page('/panel') ) es igual de directo. ¿Para qué es ideal? MVPs y prototipos: validar una idea en días, no semanas. Dashboards internos y paneles de datos. Herramientas internas para tu equipo, sin montar un frontend aparte. Demos de modelos de IA o scripts que necesitan una interfaz. ¿Cuándo NO es la mejor opción? NiceGUI renderiza en el cliente, así que para sitios donde el SEO del contenido es crítico (un blog, una landing pública que debe posicionar) conviene complementarlo con buenas meta etiquetas y datos estructurados, o valorar renderizado en servidor. Para aplicaciones, dashboards y herramientas internas es una elección excelente y muy productiva. Rendimiento y despliegue Una app NiceGUI se despliega como cualquier app de FastAPI/Uvicorn, normalmente detrás de nginx con systemd. Sirve los estáticos desde nginx y usa ui.run(show=False) en producción para no abrir un navegador

I built Suzi Chat to bring back the nostalgic feel of late-90s/early-2000s browser chat rooms. Key Features: Create and customize your own public or private chat rooms instantly from the browser. Built-in multiplayer casual board games (Chess, Checkers, Gomoku). No complicated setup—straightforward web-based access. Built using a NestJS backend and running on a dedicated Linux VPS. Live Platform: https://suzichat.com Looking for feedback from other developers on the UI layout, room creation flow, and multiplayer lobby stability.

Introduction I did something stupid. I built a superhero-themed Nuxt app, connected it to an Anthropic model through Amazon Bedrock , and gave it a tool that deletes files from my computer. In fact, if I wasn't careful, it could have deleted all my files! The first time I tried it, I didn't use any sort of approval mechanism. And as you expected it just deleted things. Then I looked into how my coding agent works, and I learned about tool approvals. I learned that AI SDK 7 has a tool approval at the model-call level. It works by pausing for an approval, showing an approval window, and then deleting it. I then put Kiro CLI behind the same interface using Agent Client Protocol (ACP). Watch the full video on YouTube . Prerequisites You need: Node.js 22 or later. AI SDK 7 requires Node.js 22 and uses ECMAScript modules (ESM). npm 11 or another package manager that works with Nuxt 4. AWS credentials available through the standard provider chain. Access to an Amazon Bedrock model in your AWS Region. The AWS CLI if you want to list the inference profiles available to your account. An authenticated Kiro CLI installation for the optional ACP section. Step 1: Create the Nuxt app Create the project and install the versions used in the recorded demo: npx nuxi@latest init nuxt-agent-approval cd nuxt-agent-approval npm install \ nuxt@4.5.2 \ vue@3.5.41 \ ai@7.0.66 \ @ai-sdk/vue@4.0.66 \ @ai-sdk/amazon-bedrock@5.0.57 \ @aws-sdk/credential-providers@3.1111.0 \ @nuxt/ui@4.10.0 \ zod@4.4.3 npm install -D @iconify-json/lucide@1.2.123 Register Nuxt UI and expose the Amazon Bedrock settings through server-side runtime config: // nuxt.config.ts export default defineNuxtConfig ({ modules : [ ' @nuxt/ui ' ], css : [ ' ~/assets/css/main.css ' ], runtimeConfig : { awsRegion : process . env . AWS_REGION ?? ' us-west-2 ' , bedrockModelId : process . env . NUXT_BEDROCK_MODEL_ID } }) Add the two Nuxt UI imports: /* app/assets/css/main.css */ @import "tailwindcss" ; @import "@nuxt/ui" ; You can c

Clear the Lineup Submission The Bug AI applications can fail silently — producing wrong outputs, degraded performance, or unexpected behaviors without explicit errors. In my case, the issue was SQL drift: queries executed successfully but returned incomplete or unstable results due to unsafe wildcard usage (SELECT *). This silent failure propagated downstream, degrading model accuracy without obvious alerts. The Fix I introduced an agentic validation and inspection layer into the pipeline using LangGraph, StatesGraph, MCP, and A2A. Inspection Layer: Deterministic checks (SQL linters, schema validators). Validation Layer: Agentic reasoning about query safety. MCP Integration: Standardized access to profilers and monitoring APIs. A2A Collaboration: Agents exchanged context to enforce compliance. This combination allowed the system to detect unsafe queries and route them for human review before deployment. PR Link Here’s the merged PR where the fix was implemented: Continental-Thaligai Repository – Merged PRs https://github.com/NikhilRaman12/Continental-Thaligai/pulse#opened-pull-requests Code Snippet python from langgraph import Graph from statesgraph import State from mcp import MCPClient class SQLInspection(State): def run(self, query): if "SELECT" in query and "*" in query: return {"risk": 0.7, "message": "Wildcard SELECT may cause drift"} return {"risk": 0.1, "message": "Query safe"} graph = Graph() graph.add_state("sql_inspection", SQLInspection()) graph.connect("sql_inspection", "human_review", condition=lambda r: r["risk"] > 0.5) result = graph.run("SELECT * FROM transactions") print(result) Diff Example: diff SELECT * FROM transactions SELECT transaction_id, amount, date FROM transactions This change eliminated silent drift in query results and improved reliability in downstream AI pipelines. Outcome Silent SQL drift eliminated. Improved accuracy in downstream AI models. Added regression tests to prevent recurrence. Strengthened CI/CD pipeline with agentic saf

At what point did you start to think you were an engineer? An engineer. What a lofty,...

Two agents finish the same task and report back. Fixed. The migration now handles null values. It wrote the code. It never ran it. Fixed. Added a null-handling layer, refactored the migration runner into a strategy pattern, and introduced a validation module. Every word true. All of it works. None of it asked for, and that strategy pattern is now yours to maintain forever. Point your code-review agent at both. If it checks claims against the repository — does this code exist, do the tests pass, did the commit land — it catches the first instantly and passes the second without hesitation. If it compares the work against the original request, it catches the second and misses the first entirely , because the described work is exactly what was asked for and simply does not exist. Neither reviewer is broken. They answer different questions. Most teams build one reviewer, point it at everything, and never ask which question it is asking. So I built reviewers that named what they were hunting. That worked, briefly, and then taught me something worse. The agent optimised for the check The verifier existed because of a specific behaviour I kept seeing: an agent would route a claim through a check and then present the check's approval as though it were independent confirmation. Not fabrication — something subtler. Authority laundering. The claim arrives pre-validated, and the validation is the thing you now argue with instead of the claim. Once a verifier existed, the behaviour adapted. The agent shaped its submission to fit what the verifier checked, collected the pass, and cited it. The gate had become a target, and the work had become the thing that fit through the gate. I first saw this in one model. Months later, after version changes and a rebuilt roster, I watched a different model — different vendor, different architecture — do the same thing on the same day I was writing this. Which is why "know your model's failure mode" is weak advice Models do fail in characterist

Originally published on echoeffect.net . If you have been inside Google Search Console recently and clicked into the Pages report (previously called Index Coverage), you may have seen a section titled "Why pages aren't indexed." That list tells you exactly which URLs Google found on your site but chose not to add to its search index, and the reason for each one. This is not abstract SEO theory. Pages that are not indexed cannot rank. If Google is excluding pages from your site, you are losing search visibility you should have, and the reason is usually fixable once you understand what Google is actually telling you. This post covers the four most common "not indexed" statuses small business websites encounter, what each one means in plain terms, and the exact steps to resolve it. A quick note before diving in: Some pages on your site should not be indexed. Thank-you pages, admin pages, internal search result pages, and duplicate filter pages are examples where non-indexing is correct. Before fixing any of these errors, confirm the flagged URL is actually a page you want in Google's index. 1. Page With Redirect What it means: Google followed one of your URLs and landed on a different URL because a redirect was in place. The original URL is not indexed. Only the final destination URL is eligible to be indexed. This status is usually caused by one of three things: Old URLs still listed in your XML sitemap that have since been redirected (common after a site redesign or domain migration) HTTP versions of pages listed in your sitemap when the live site runs on HTTPS Trailing-slash inconsistencies, where your sitemap lists yoursite.com/page but the server redirects to yoursite.com/page/ The redirect itself is not necessarily a problem. A 301 redirect is the correct way to permanently move a page. The issue is that Google's crawler is spending time and crawl budget following chains to find the real URL, and your sitemap or internal links are pointing to the wrong address.

Moving from AI-Assisted Engineering to AI-Agentic Software Engineering The rise of AI coding assistants has transformed how developers write software. Tools like GitHub Copilot, ChatGPT, Claude, and Gemini have significantly improved developer productivity by helping generate code, explain concepts, and automate repetitive tasks. However, the industry is now entering the next evolution: AI-Agentic Software Engineering . Instead of AI simply assisting developers, AI agents can now take ownership of entire software engineering tasks—from requirement analysis and architecture design to implementation, testing, documentation, and code reviews. The challenge is no longer whether to use AI, but how to integrate AI agents into a structured Software Development Lifecycle (SDLC). This requires moving away from vibe coding toward specification-driven development , where AI agents operate using well-defined requirements, standards, and engineering principles. Today, I'd like to discuss two of the most popular frameworks enabling this transition. 1. Spec Kit Spec Kit is a specification-driven framework designed for Human + AI collaborative software development . The philosophy is simple: define the specification before generating the code . Rather than asking an AI to build an application from a vague prompt, Spec Kit encourages teams to create structured specifications, architectural decisions, and engineering principles that guide AI throughout the development lifecycle. Some key benefits include: Structured and repeatable software development Better requirement traceability Consistent architecture decisions Reduced AI hallucinations Lower development costs through predictable AI interactions Support for selecting the most appropriate LLM based on project requirements Integration of quality engineering practices from the beginning of the SDLC Spec Kit is particularly valuable for engineering teams that want to adopt AI without sacrificing software quality or maintainability.

Cloudflare named code mode in September 2025, resting it on one line: "LLMs are better at writing code to call MCP, than at calling MCP directly." The follow-up post put a number on it — an entire 2,500-endpoint API in about 1,000 tokens. I wanted my own number, on my own data, for a task I actually had. The task fetch all linear tickets in progress (full body for each) and count the amount of times we say 'mcp' across all of it 39 tickets. Nothing exotic — the kind of thing you ask an agent on a Tuesday. There are two ways an agent can do this. As tool calls. One list_issues , then a get_issue for each ticket. Every ticket body travels into the model, because the model is the thing holding the running total. Forty round trips, each one waiting on the model to decide what to ask next. As a script. The agent writes ten lines, runs them once, and reads back a number. The bodies never enter its context at all. The numbers into the model round trips as tool calls ~65,500 tokens (262,159 chars) 40, in sequence as one script ~226 tokens (903 chars) 1 290× less into context. 99.66% saved. The token figures use the rough four-characters-per-token heuristic — the character counts are the exact measurement, and the ratio is the part that survives different data. Yours will differ with your tickets. And ~65,500 is the floor, not the ceiling. In a tool-call loop, context is re-read on every subsequent turn. The script pays once. The part the token count misses Two things, and I think both matter more than the headline ratio. Latency. Forty sequential tool calls each wait for a model to decide what to ask next. The script issues the same forty HTTP requests without stopping to think between them. The token saving is money; the round-trip saving is the thing you actually sit through. Correctness. Counting occurrences of a substring across a quarter of a million characters of prose is something a model does approximately . A script does it exactly. So the tool-call path doesn't ju

Look, startup or Enterprise? How to Pick the Right AI API Stack Let me set the scene for you. A few months back, I was chatting with two friends on completely opposite ends of the AI spectrum. One was bootstrapping a side project on pizza and prayers, wondering if he could afford to add an LLM to his SaaS without going bankrupt. The other was leading engineering at a mid-sized fintech, sweating bullets because his CTO wanted enterprise-grade guarantees before signing a single contract. Same problem on paper: "we need an AI API." Completely different universes in practice. Here's how I'd actually walk each of them through it — and why the generic guides you'll find on the internet miss the mark. The Misconception That Trips Everyone Up I want to be honest with you about something. Most AI API guides assume both audiences want the same thing at different scales. That's wrong. Dead wrong. A startup founder I know burned through two weeks trying to wire up DeepSeek's direct API last quarter. He gave up not because the tech was hard, but because he didn't have a Chinese payment method, didn't want to verify with a Chinese phone number, and got stuck in a KYC loop. Meanwhile, an enterprise architect I talked to last month was spending months negotiating with OpenAI's sales team on annual contracts for committed-use pricing — when all he wanted was a predictable API endpoint with a real SLA behind it. The lesson? The "go straight to the provider" advice is a non-starter for a lot of people, and nobody's talking about why. Let me show you what actually matters depending on which side of the fence you're on. What Startups Actually Need (And Don't) Let me break this down. If you're building a startup — early stage, scrappy, maybe pre-seed or seed — your AI API checklist looks something like this: Cost matters more than perfection You want to experiment with multiple models without signing 12 contracts You need to ship this week, not next quarter Your "compliance team" is just

Originally published at fathohm.dev . The term "comprehension debt" is Jason Gorman's, from September 2025, carried by Addy Osmani in March 2026 — this piece is about measuring it. There's a module in your codebase that shipped last month. It works. It has tests. It passed review. And if it breaks at 2am, nobody on your team can explain what it does. Ask "who understands this?" about any given file in an AI-native codebase and the honest answer, increasingly often, is no one — not because your engineers got worse, but because the code stopped passing through their heads on its way into production. The decoupling For seventy years, code getting written implied that somebody understood it. The implication was so reliable we never thought of it as an assumption: writing code was the act of understanding a problem precisely enough to express it. However bad the code, however absent the docs, there was at minimum one person — the author, at the moment of authorship — who knew what it did and why. Every practice we have for keeping teams oriented in a codebase quietly leans on that floor: review assumes the author can defend the change, onboarding assumes someone can explain the system, debugging assumes a colleague to ask. AI agents broke the implication. Code getting written and code getting understood are now separate events, and only one of them is scaling. An agent can produce in an afternoon what a team used to write in a month — and the afternoon does not come with a month's worth of understanding attached. The floor of "at least the author knows" is gone: for agent-authored code, the author isn't on your team. It isn't anyone. The gap between what a codebase does and what the humans responsible for it understand needs a name, because things without names don't get managed. It has one, and it has had one for a while. Jason Gorman named it comprehension debt in September 2025 — what happens "when teams produce code faster than they can understand it" — and Addy Osma

Automating Daily Bluesky Posts with a JSON‑Driven Content Pipeline TL;DR: I added a set of JSON files and a lightweight loader to the content‑automation repo so our CI can generate and publish daily Bluesky posts automatically. The change centralizes multilingual copy, makes the publishing script data‑driven, and removes the manual copy‑paste step that was breaking our release flow. The Problem Our weekly release process includes a short status update on Bluesky. The copy lives in a markdown file that we edit manually, then copy‑paste into the Bluesky CLI. Two issues kept surfacing: Human error – a typo or missing line would cause the post to be rejected by the API ( Error: Invalid payload: missing "text" ). No versioning – we had no way to track which text was used for a given date, making it impossible to audit or rollback a post. The symptom was a failed CI job that stopped the whole pipeline with the error above, and we were forced to roll back the entire release just to fix a missing word. What I Tried First My first attempt was to add a tiny shell script that reads a bluesky.md file and pipes it into the CLI: cat content/2026/08/16/bluesky.md | npx bluesky-cli post That worked locally, but the script crashed in CI because the file path was hard‑coded and the runner didn’t have the bluesky-cli binary installed. I also quickly realized that the same script would need to support English and Spanish versions, so the hard‑coded approach would explode as we added more languages. The Implementation 1. Data‑driven content files Instead of markdown, I switched to a JSON structure that can hold multiple languages and post types (progress, announcement, etc.). Each day gets its own folder under content/YYYY/MM/DD/VS/ . For the 2026‑08‑16 release we added: content/2026/08/16/VS/bluesky_en.json content/2026/08/16/VS/bluesky_es.json content/2026/08/16/VS/metadata.json Example bluesky_en.json [ { "type" : "progress" , "text" : "Finally pushed a real change: coverage for the

There's an argument to be made that people wouldn't be all that interested in Coyote vs. Acme if it weren't for the way David Zaslav tried to kill it. By trying to shelve the project, Warner Bros. Discovery only drew attention to its habit of disappearing nearly completed movies in order to cash in on […]

I used to think a bulk date converter was basically a dropdown wrapped around a date library. Paste a bunch of rows, pick YYYY-MM-DD , done. Then you look at real exports from spreadsheets, CRMs, logs, and old internal tools and realize the problem isn't "formatting" at all. It's triage. Some rows are obvious. Some are malformed. Some have month names. Some came from a CSV with five unrelated columns. And then there's the classic cursed input: 01/02/2024 , which is either January 2 or February 1 depending on who produced the file. The Vue component behind this tool is interesting because it doesn't pretend that ambiguity goes away if you call the right parser. It models that ambiguity explicitly. It starts by assuming uploaded files are messy, not clean One thing I liked in the source is that it doesn't treat file input as a single happy path. If you upload a TXT file, it works line by line. If the upload looks CSV-ish, it switches into a tiny parser and then tries to figure out which column is actually the date column. The CSV split logic is manual instead of using a naive line.split(",") , which matters because quoted commas are a real thing in exports: const splitCsvLine = ( line ) => { const result = []; let cur = "" ; let inQuotes = false ; for ( let i = 0 ; i < line . length ; i ++ ) { const ch = line [ i ]; if ( ch === ' " ' ) { if ( inQuotes && line [ i + 1 ] === ' " ' ) { cur += ' " ' ; i ++ ; } else { inQuotes = ! inQuotes ; } } else if ( ch === " , " && ! inQuotes ) { result . push ( cur ); cur = "" ; } else { cur += ch ; } } result . push ( cur ); return result . map (( s ) => s . trim ()); }; After that, it doesn't ask the user to map columns immediately. It scores each column by counting how many cells look like dates, then auto-selects the best candidate: for ( let c = 0 ; c < maxCols ; c ++ ) { const count = dataRows . filter (( r ) => isLikelyDateCell ( r [ c ])). length ; columns . push ({ index : c , header : headerRow ? headerRow [ c ] : "" }); i

The universe may never tell you if your choices mattered. Owlcat’s Osiris Reborn might not either.

The Nimble SharePower is a versatile battery pack that gets even better when you're traveling with a friend.

MergePDF is a 100% client-side PDF tool. No backend, no uploads, no sign-up. Here's the architecture, the tricky parts, and why privacy is a feature, not a setting. Every tax season, the same thing happens. Someone in my family asks me to merge a few PDFs. They Google "merge PDF." They click the first result — a slick, friendly-looking site. They upload their tax returns to a server they've never heard of. That bothered me. So I built MergePDF. It merges, splits, rotates, and rearranges PDF pages — and your files never leave your browser. No backend. No sign-up. No ads. No tracking. iLovePDF uploads your tax returns. We don't. This post is about how it works, the parts that were harder than I expected, and why "client-side only" is a design philosophy, not just a technical choice. The pitch in 30 seconds Drop one or more PDFs onto the page. You get a grid of page thumbnails — real, rendered previews of every page. Drag to reorder. Click to select. Rotate, delete, extract a range. Merge everything into one file, or split into single-page PDFs zipped up. Download. Done. Your browser does all of it. There is no server processing documents. There isn't even a server to process documents. The stack It's a Next.js app, but honestly Next.js is just the host here. The interesting parts are all client-side libraries doing real work: No database. No API routes. No auth. No analytics. The only thing in localStorage is your theme preference. Drag-to-reorder that doesn't fight tap-to-select This one took three attempts. The requirement: Tap a thumbnail → select it (emerald ring) Shift-tap → select a range Long-press + drag → reorder Swipe on mobile → scroll the grid (don't drag) The conflict: if the whole card is the drag handle, taps get swallowed. If only a tiny grip icon is the handle, nobody finds it (especially on mobile, where there's no hover). So split produces a ZIP. fflate's zip packages every single-page PDF into one download. Rotations are honored here too — each spl

👉 TL;DR: A developer's laptop quietly becomes one of the densest credential stores in the organization. Cloud keys sit in ~/.aws, tokens pile up in shell history and .npmrc, SSH keys live in ~/.ssh, session cookies persist in the browser, and AI coding agents cache secrets in their own config files. None of it in a Git repository, none of it visible to the scanners most teams rely on. The laptop is the origin point: where credentials first land, where they dwell unrotated for months, and where infostealer malware goes looking. This article maps every location, explains why traditional scanning misses them, and lays out how to bring that hidden credential plane under the same discipline you apply to code. The perimeter moved to the laptop Security has spent a decade hardening repositories, pipelines, and vaults. The machine where developers actually work — installing CLIs, authenticating to clouds, running AI assistants — is still treated as trusted ground. But it isn't. A single laptop accumulates dozens of long-lived credentials across a dozen or more locations over months of normal work. No standard secrets scanner inspects any of them. Modern infostealers are written specifically to harvest the credential files that accumulate through ordinary development workflows. The laptop is not a new attack surface. It's one the industry has under-measured for years. Why your repo and CI scanners never see this Pre-commit and CI secret scanning inspect what reaches the repository or the pipeline. That is exactly why they miss the laptop. A credential sitting in ~/.aws/credentials or shell history never gets committed, so a repo scanner never sees it. Most of those credentials are long-lived and rarely rotated, dwelling on the machine for months. AI tooling accelerates the problem: more agents, more integrations, and more local config files mean more credentials in more places than manual hygiene can track. Structurally, the laptop is where every credential originates before

One of the best things my smart home does is help me care for my pets, and security cameras are particularly useful for keeping track of my many critters. But the barrage of notifications they send often means I miss important ones. So, when Google announced its new Pet Memory feature for Gemini for Home, […]

GitHub has announced that Stacked Pull Requests are now available in public preview, introducing native support for breaking large software changes into smaller, dependent pull requests that can be reviewed and merged independently. By Craig Risi