标签：#code

There is a sentence my coding agent used to say that I now read as a warning light. You are completely right. For months I took it as a compliment. The machine agreed with me, so I figured I was onto something. I would describe a plan, watch the agent call it a strong plan, and go build it. If you work with an AI agent every day, you have heard your own version of this. Smart call. Solid approach. That makes a lot of sense. Each one is the machine nodding along while you talk. It feels good. That is the problem. What took me too long to admit An agent that agrees with everything I say stops being a thinking partner. It turns into something that flatters me into shipping my first idea. My first idea is rarely my best idea. Nobody's is. The whole point of a second mind in the room is that it pushes back when the first mind is about to walk into a wall. A yes-machine removes the one thing that made a second mind worth having. This has a name Sycophancy. These models are trained to be agreeable, because agreeable scores well in the feedback that shapes them. OpenAI said so out loud in 2025 when they pulled back a version of their model for being, in their words, overly flattering. They were pointing straight at the default behaviour. So your agent is doing exactly what it was tuned to do when it tells you that you are right. No malfunction involved. One opinion most builders have not made peace with Your agent's confident wrong answer costs more than a useless one. A useless answer wastes a minute. You see it is useless and move on. A confident wrong answer wastes a week, because you trusted it, built on it, and found out only when it broke in front of someone who mattered. Occasional wrongness is survivable. Everything is wrong sometimes. What actually bites is being wrong while sounding certain, and agreeable, and exactly like what you wanted to hear. How to tell if your agent is a yes-machine You can test it in a minute. Tell it a bad idea on purpose. Propose somethi

We've all been here. A new form shows up, you install React Hook Form, add Zod or Yup, and in ten minutes you have something that "works." The problem doesn't surface that day. It surfaces three months later, when the same VIN you validate in the create car form also has to be validated in edit , in import from Excel , and it turns out the rule —"17 characters, the last 5 numeric"— is written three times, each one slightly different, and none of them lives in a place you can point to and say "here is what a valid VIN is." A typical form with a library looks roughly like this: const schema = z . object ({ vin : z . string (). length ( 17 , " The VIN must be 17 characters " ), miles : z . number (). min ( 0 , " Miles cannot be negative " ), // ...and 8 more fields }); const { register , handleSubmit , watch , formState : { errors }, } = useForm ({ resolver : zodResolver ( schema ), }); It works. But if you stop to look at it, you're paying three costs that almost never get named: 1. Clean code dissolves. The business rule ends up scattered across the schema , the resolver , the register calls, the Controller s, and the JSX. The knowledge — what makes a car valid — has no home. It's wired into the UI. And what's wired into the UI doesn't get reused: it gets copied. 2. Performance and coupling are paid silently. These libraries live on subscriptions: watch , re-renders on every keystroke, internal state to keep in sync. For a contact form, who cares. For a screen with 15 fields, sub-forms, and cross-field validation, your component is tied to the library's lifecycle —not yours— and you start fighting it instead of using it. 3. Developer convenience is a trap. It's wonderfully convenient at first . But that same rule: how do you test it without mounting a component? How do you move it to the backend? How do you translate it into two languages without polluting the schema? Everything the library gave you for free, it charges you for the day you need to step outside its mo

The problem: agents forget your project every session If you pair with a coding agent, you have lived this: a new session starts and the context is gone. The agent re-discovers your auth flow, re-guesses why a decision was made, re-reads the same files to rebuild a mental model you already explained yesterday. Project knowledge — the why behind your systems, the runbooks, the "don't touch this, here's the reason" — lives scattered across wikis, code comments, and people's heads. None of it travels with the code, and none of it survives a fresh context window. CLAUDE.md helps, but it's for standing instructions , and it gets loaded wholesale into every prompt. Auto-memory captures what an agent picked up, but it's implicit, per-agent, and not reviewed. A wiki is for humans and needs exporting. There's a gap: curated team knowledge that's structured, versioned with the code, and readable by any agent or person. What OKF is Open Knowledge Format is an open, vendor-neutral format (announced by the Google Cloud Data Cloud team in June 2026, Apache-2.0) that represents knowledge as a directory of markdown files with YAML frontmatter . That's the whole idea. No schema registry, no runtime, no SDK. If you can cat a file you can read it; if you can git clone a repo you can ship it. A bundle looks like this: .okf/ ├── index.md # progressive disclosure (root carries okf_version) ├── log.md # ISO-dated change history, newest first ├── services/auth-api.md # one concept = one file; path is its ID ├── datasets/orders-db.md ├── decisions/use-okf.md ├── runbooks/payment-failures.md └── metrics/checkout-conversion.md Each concept needs exactly one thing to be conformant: YAML frontmatter with a non-empty type . Everything else is optional. --- type : Service title : " Auth API" description : " Issues and verifies short-lived access tokens." resource : https://github.com/acme/auth tags : [ auth , platform ] timestamp : 2026-06-14T10:00:00Z --- # Endpoints | Method | Path | Descriptio

You ask Claude to review your code. It says "looks good, clean, well factored". Of course it does. It wrote that code five minutes ago. You just asked the author to grade his own paper, and he gave himself an A. Having an AI review code works. But not by asking the one who just wrote it. Quality doesn't come from a smarter model, it comes from an architecture where no role checks itself. The self-preference bias This isn't a hunch, it's measured. A model evaluating its own output rates it higher than others' at equal quality: the self-preference bias , documented by Panickssery and co-authors in 2024, and it's causal, not correlational. The model recognizes its own style and prefers it. In practice that means the naive loop "write, then review what you just wrote" is broken by construction. You don't get a review, you get a justification. The agent already decided its code was good the moment it produced it; asking again only confirms. The blind reviewer So the first rule: the reviewer is never the author. In my config, the review agents run in a clean context . They don't see the implementation prompt, they don't know what constraints the author set, they meet the diff like a colleague on Monday morning. And when the author is a known model, the reviewer is from a different family , to break style recognition. One detail matters as much as the rest: the developer's name never enters the reviewer's prompt. No "this was written by a senior", no "review this model's work". The author's identity is exactly the information that triggers the bias. We take it off the table. No finding without a receipt The second trap is the opposite of the first. An AI reviewer, especially in a clean context, tends to over-flag: it invents problems to look useful, it flags "vulnerabilities" that aren't. A review that cries wolf on every line is no better than a complacent one: either way, you stop listening. Hence the receipt rule. Every finding must cite a file:line and pass a check bef

One morning I pasted four principles into my CLAUDE.md , the global instruction file Claude Code reads at the start of every session. "Think before you code", "simplicity first", that kind of maxim you see fly by on X, credited to Andrej Karpathy. I felt clever for about a day. Then I watched Claude read the file, nod, and carry on exactly as before. A CLAUDE.md is a suggestion box. The model nods, then does whatever it wants. If I wanted it to code my way, writing it down wasn't going to cut it. I had to enforce it. What follows is what that frustration turned into: a config in four layers, reinstallable in one command, and a discovery that runs through everything else. The only rigor that counts is the one a model can't grant itself. Four layers, and only one really changes the behavior My config has four floors, from softest to hardest. The brain is CLAUDE.md : how I work, not the docs for my code. The rule that sums it up lives inside it: "what not to add: anything Claude rediscovers by reading the code." It holds my design principles, my stance on orchestrating subagents (I size up, I delegate, I verify: "I stay the brain, they're the hands"), and one line that becomes the thread running through the whole thing. The references : a go-best-practices.md file the brain points to in plain text whenever Go is involved. The skills : ten of them. A skill is a folder with a playbook that Claude loads on demand for a specific job: review code, write an article, distill a book. Mine are packaged as a marketplace, in a public GitHub repo , with a changelog and a version number. That's the real differentiator: versioned tooling, not just rules scribbled in a file. The guardrails , finally. And this is the only layer that reliably changes behavior. The first three, the model can read and ignore. The fourth, it can't. The four config layers, from softest (the model can ignore) to hardest (the model is bound by the guardrail) Brain CLAUDE.md: how I work References go-best-pra

I run Claude Code most of the day. The thing that kept biting me wasn't the model getting dumber. It was the model forgetting what we'd already settled, then confidently redoing it wrong. You've probably hit it. You write a CLAUDE.md , you keep notes, you tell it "we decided X." A few prompts later it relitigates X, or quietly breaks something it fixed an hour ago. Bigger context windows didn't fix it for me either. A 1M window just means more room for stale instructions to rot in. Here's the reframe that actually held: stop treating the model as the place the state lives. The model is a worker, not a filing cabinet A context window is working memory, not a record. It's lossy, it drifts, and every new turn re-derives the world from whatever's in front of it. If "what's done and what's half-broken" only exists in that window, you're trusting the most forgetful part of the system to remember the most important thing. So I moved the state out of the model and into the work. Two pieces did most of it: A frozen spec the agent re-reads. Not a chat message it might compress away. An actual file that says what we're building and what's already decided. When it starts drifting, the spec is the source of truth, not its memory of the conversation. A checklist it can only tick after something is verified. [ ] becomes [x] when a test passes or I've confirmed the change, never because the model "thinks" it's done. The checklist carries the progress. The model just moves it forward one verified step at a time. The difference is subtle but it's the whole game. Before, the work was a side effect of the conversation. After, the conversation is a side effect of the work. The agent can lose the whole thread and reload from the spec plus the checklist and basically pick up where it left off. A number that surprised me When I actually measured my own sessions, almost none of my tokens were fresh input. The bulk was cache reads and re-reading instructions that hadn't changed. So the "cont

7 daily crons, 2 starvation incidents that triggered the rewrite Health checks before work, not after, catch silent failures Queue-low alarm fires at 5 items, not at zero A cron is ignorable for 3 weeks only when failures are loud I run 7 GitHub Actions crons every day, and for two months I never looked at them. Then a content queue starved silently and I posted nothing for 4 days before noticing. Here is what I changed so a cron can stay green and be ignorable for 3 weeks straight. The Two Incidents That Forced The Rewrite The first starvation happened on a Tuesday. My image generation cron pulled prompts from a queue, made the assets, and pushed them to a publish queue. The image API returned a 429 (rate limited) and the job exited cleanly with a green checkmark. GitHub Actions reported success. The workflow logs said "0 prompts processed" in a line I never read. For 4 days the publish queue drained and nothing refilled it. I found out because a follower asked why I went quiet. The second incident was sneakier. A cron that calls an external API hit an auth token that had expired. The script caught the error, logged it, and returned exit code 0 because I had wrapped the whole thing in a try/except that swallowed everything. Green check, no work done. This one ran for 6 days before I caught it during an unrelated debug session. Both failures shared one root cause: a green checkmark in GitHub Actions means the process exited zero, not that the work happened. Those are completely different claims. A cron that catches its own errors and exits clean is lying to you in the most polite way possible. After the second incident I sat down and wrote out what I actually wanted. I wanted to never look at these workflows unless something was wrong. I wanted "wrong" to be loud. And I wanted the loudness to arrive before the damage, not after. That meant three changes. First, the exit code had to reflect real work, so swallowed exceptions had to re-raise or set a failure flag. Sec

The problem Just saying "hi" to Claude Code costs ~31,000 tokens . I was paying $500+/month in API costs and had no idea where the tokens were going. So I built tokenwise — a free CLI that shows exactly where your AI coding agent wastes tokens. What it does tokenwise audit — Scan your instruction files It scans your CLAUDE.md, AGENTS.md, and rules files, then shows: How many tokens each file costs per message Boilerplate the AI already knows ("Always write clean code") ALL-CAPS emphasis that doesn't help (NEVER, ALWAYS, MUST) Duplicate sections Unscoped rules that load when they shouldn't tokenwise scan — Analyze your sessions It reads your latest session logs and shows: Token breakdown by component (system prompt, history, tool output) Cache hit rate Top 3 "token hogs" with actionable tips Monthly cost projection The key insight Most people try to compress context (which makes the AI dumber). tokenwise measures first, then applies safe fixes. You can't optimize what you can't measure. Quick start npx @davizin713/tokenwise audit npx @davizin713/tokenwise scan Zero API calls. Zero LLM inference. 100% local. Free forever. Works with 11 agents Claude Code, OpenCode, Cursor, Aider, Cline, Codex CLI, Goose, Continue.dev, Windsurf, Augment, and Kilocode. Links GitHub: github.com/davi713albano-coder/tokenwise npm: npmjs.com/package/@davizin713/tokenwise Built with TypeScript / Node.js js-tiktoken for token counting sql.js for reading OpenCode sessions MIT licensed If you use Claude Code or any AI coding agent, try it and let me know what you think! ⭐

The silicon race is heating up amid the struggle to keep up with demand.

devtools #infrastructureascode #cdk #aws Index TL;DR Major Features Bedrock AgentCore — From Alpha to Stable Fn::GetStackOutput & Weak Cross-Stack References Validations Framework Performance Improvements CloudWatch PromQL Alarms CLI Improvements New L2 Constructs Service Enhancements Community Highlights Community Content & Resources How Can You Be Involved Hey CDK community! Here's an update covering everything that shipped in April and May 2026. TL;DR Bedrock AgentCore graduated to stable — production-ready AI agent infrastructure with semver guarantees. Cross-region references got a major upgrade with native Fn::GetStackOutput support and weak cross-stack references. The new Validations framework replaces policyValidationBeta1 with a richer plugin system. And file fingerprinting is ~33% faster with persistent asset caching. These features are available in aws-cdk-lib v2.247.0 through v2.257.0 and aws-cdk CLI v2.1116.0 through v2.1125.0. Full changelogs on GitHub Releases ( Library | CLI ). Major Features Bedrock AgentCore — From Alpha to Stable The @aws-cdk/aws-bedrock-agentcore-alpha module has graduated to aws-cdk-lib/aws-bedrockagentcore — stable APIs, semver guarantees, production-ready. If you've been building AI agents with Bedrock but held off on CDK because of the alpha label, it's time to upgrade. ( #37876 ) AgentCore provides the core infrastructure for building AI agents: runtimes, gateways, identity management, observability, and online evaluation. The Policy submodule remains in alpha as it continues to evolve rapidly. ┌─────────────────────────────────────────────────────┐ │ Bedrock AgentCore (Stable) │ ├─────────────────────────────────────────────────────┤ │ │ │ ┌──────────┐ ┌──────────┐ ┌──────────────────┐ │ │ │ Runtime │ │ Gateway │ │ Identity │ │ │ │ (L2) │ │ (L2) │ │ (L2) │ │ │ └────┬─────┘ └────┬─────┘ └────────┬─────────┘ │ │ │ │ │ │ │ ▼ ▼ ▼ │ │ ┌──────────┐ ┌──────────┐ ┌──────────────────┐ │ │ │Observa- │ │Online │ │ Policy Engine │ │ │

One of the most powerful upgrades you can give any AI developer Introduction AI coding assistants are dazzling on a single file and surprisingly lost on a large one. Point a capable agent at a mature, multi-package codebase and you watch the same pattern every session: it greps for a symbol, opens a dozen files to work out how they fit together, and burns a large slice of its context window simply rediscovering the shape of the system before it can do any actual work. That orientation phase — the crawling, the grepping, the file-by-file reconstruction of structure the codebase already encodes — is the single biggest waste of tokens in most AI-assisted workflows. And it repeats every session, because nothing persists. The fix is straightforward: give the agent a map. Model your codebase as a knowledge graph and let the agent query the map instead of crawling the territory. This article explains what that looks like, why it works, and what it actually finds when you run it on a real system. TL;DR A code-graph should map your architecture not just your code. Converting grep to graph minimises token usage and saves you time. Find bugs, security mistakes, and omissions in your codebase in seconds. Plan upgrades quickly and with far more accuracy. Using deep-memory's vocabulary simplifies usage for your AI. Use deep-memory free. Check out the full example code-graph-guide.md What is a code-graph A code-graph is a graph database representation of your system. I use the word system and not code deliberately — the real power comes from driving architectural insights, not just building a faster file search. Code graphs are becoming popular. There are some impressive repositories where the author has scripted a process to mirror a codebase into a graph DB, capturing files, imports, and call relationships. That approach is useful for dependency visualisation. But mirroring syntax only scratches the surface. What separates a useful code-graph from an elaborate directory listing

Our infrastructure "documentation" was a Google Sheet. Anyone on the team could edit it. Nobody...

I've been working as Software Developer mainly focussed on Java and builts many application using Eclipse RCP framework or VS Code Application. Almost all the time I had to deal with multiple large files (either read/generate/validate) them which seemed very difficult and some of them almost impossible as most of them would be dependant on each other and would be referencing each other (just like how java files work together). Now assume client1 requires the same content in multiple Json files and client2 needs it in xml files. We couldn't go on writing a different application or go on adding if conditions and blah blah blah !!!! Wouldn't it be easier if as soon as I execute the application it generates the content in whatever format I choose and also taking care of dependencies/ references (like adding import statements). Additionally integrate with features of IDE and provide proposals, perform validations on the fly. Rela World Examples : Try googling Arxml once (Trust me I've dealing with these files for almost 7 years and it's always a nightmare to debug these) Solution: Xtext framework In this tutorial, I will show you how to use Eclipse Xtext and Xtend to build a simple, readable DSL that automatically generates Java boilerplate for you. Fair Warning: There will be no running executions screenshots or anything. You are gonna have to run it yourself and check the results and of course questions are always welcome in the comments section. But if for some reason you are unable to replicate this then let me know I'll try to explain further. I believe the best way to learn is by doing it yourself. The Goal: What are we building? Instead of writing 100 lines of Java with private fields, getters, and setters, we want our developers to write 5 lines of code in our own custom language (basically you can create your own programming language with your own custom syntax), like this: entity User { var name : String var age : Integer } When this file (assume file extension

Many Python beginners can write basic programs but get stuck when they try to run a real project on their own laptop. The issue is not always coding. Sometimes the real problem is setup . You may know loops, functions, and lists, but still face problems like: ModuleNotFoundError Python is not recognized Package installed but not working in VS Code Wrong interpreter selected These are common beginner setup issues. Why online compilers are not enough Online compilers are good for quick practice. But real Python projects need: project folders multiple files external packages virtual environments dependency files terminal commands debugging tools Git basics So, when the goal is to build real projects, it is better to move to a local Python setup early. Basic Python project setup flow A simple Python project setup flow looks like this: Install Python Install VS Code Create project folder Create virtual environment Activate virtual environment Install packages Save requirements.txt This setup may look basic, but it prevents many beginner-level errors later. Example folder structure A beginner-friendly Python project folder can look like this: python-project/ │ ├── main.py ├── requirements.txt ├── README.md └── venv/ Here is what each file or folder means: main.py is the main Python file. requirements.txt stores project dependencies. README.md explains the project. venv/ contains the virtual environment. Create a virtual environment Create a virtual environment using: python -m venv venv Activate it on Windows: venv \S cripts \a ctivate Activate it on Mac/Linux: source venv/bin/activate A virtual environment keeps each project’s packages separate. This helps avoid package conflicts when working on multiple Python projects. Install a package After activating the virtual environment, install packages using pip . Example: pip install requests Now create a Python file: import requests response = requests . get ( " https://api.github.com " ) print ( response . status_code ) If

AWS released Blocks in public preview, an open-source TypeScript framework where each Block bundles application code, local mocks, and AWS infrastructure. Designed for AI agents to write correct backends from the start, it runs locally without an AWS account and deploys the same code to Lambda, DynamoDB, Aurora, and Bedrock with zero changes. By Steef-Jan Wiggers

Today, I’m talking with Jack Conte, the CEO of Patreon. Jack last joined me on the show almost exactly five years ago, in the summer of 2021, and a lot has changed on the internet and in the creator landscape since then, so I was very excited to talk to him again, especially since his […]

A stat from 2026 that should stop you cold: 88% of organizations reported a confirmed or suspected AI agent security incident in the past year (92.7% in healthcare). And more than half of all agents run with no security oversight and no logging — naked. The problem isn't that the AI isn't smart enough. It's that almost nobody welded boundaries around it. And boundaries are exactly where rigor lives. The incident list: speed flooring it, boundaries naked The last couple of weeks of security signals line up scarily well: 88% of orgs reported confirmed/suspected AI agent incidents in the past year; healthcare 92.7% ; over half of agents have no security oversight or logging. Supply chain is the front door. A plugin-ecosystem supply-chain attack harvested agent credentials from 47 enterprise deployments ; attackers used them to reach customer data, financial records, and proprietary code — undetected for six months. A public skills marketplace at one point hosted 824 of 10,700 malicious "skills." Config is an attack surface. Check Point disclosed remote code execution in a popular coding agent via poisoned repository config files ; MCP (Model Context Protocol) is the connective tissue across nearly every incident this year — poisoned configs, malicious marketplace skills, unauthenticated exposed MCP servers. By early 2026, at least ten public incidents across six major AI coding tools were attributed to " agents acting with insufficient boundaries. " The industry's own summary: AI agent security in 2026 is a supply chain problem first, a prompt-injection problem second. And every one of these shares a single root cause — the agent can act, but there's no architectural boundary on what it can touch, change, or call. Why "naked" is inevitable: bolt-on boundaries always leak Why do half the agents run with no oversight? Because in the mainstream approach, boundaries are bolt-ons : an allow-list here, a gateway there, logs you read after the fact. The trouble: The tools an

GitOps policy drift is what happens when a control plane keeps a policy perfectly reconciled long after the reason for that policy has stopped being true. Every commit is applied. Every pull request is merged cleanly. Every dashboard reads green. And the rule being enforced no longer reflects anything anyone would choose to enforce today — it just hasn't been told to stop. That gap is the subject of this post. Not configuration drift — the thing GitOps was built to kill — but a second, quieter failure mode that lives one layer above it: the policy is right by every technical measure and wrong by every practical one, and nothing in the reconciliation loop is capable of telling the difference. The Promise GitOps Actually Kept GitOps earned its place in the infrastructure as code architecture stack by solving a real and expensive problem: state drift. Before declarative reconciliation, infrastructure diverged from its source of truth constantly — a console change here, an emergency hotfix there, a manual override nobody logged. The git repository said one thing. Production said another. Reconciling the two was a forensic exercise. GitOps closed that gap with a simple, durable mechanism: a controller that continuously compares declared state to actual state and corrects the difference without waiting for a human to notice. That's not a small win. It's the reason platform teams can run infrastructure at a scale that would have been operationally unmanageable a decade ago, and it's why GitOps controllers sit at the center of nearly every modern infrastructure as code architecture built since. This post isn't an argument against that mechanism. It's an argument that the mechanism's success created a blind spot nobody designed for. What GitOps Never Promised to Solve Here's the boundary GitOps was never built to cross: reconciliation proves that declared state and actual state match. It says nothing about whether the declared state should still exist in its current form. A

Choosing a learning path is one of the most critical decisions you make as a beginner. When I set out to learn web development, I knew exactly what I needed: resources that were thorough, accessible 24/7, and completely free—both online and in print. Before settling on my 2026 learning path, I experimented with a few popular options. Here is a look at what I tried, why they didn’t quite stick, and where I ultimately landed. What Didn’t Work for Me Scrimba Scrimba offers highly interactive introductory courses in web development. However, I realized a bit too late that the platform isn't entirely free; a paywall kicks in shortly after you begin the core HTML and CSS sections. Because I was looking for fully open resources, I had to move on. Frontend Mentor Frontend Mentor is an excellent platform for practicing UI design, but it operates on a freemium model. While the basic learning paths are free, accessing project solutions, starter files, and advanced challenges requires a paid upgrade. 100Devs 100Devs is a free, self-paced, community-taught bootcamp led by Leon Noel. Originally broadcast live on Twitch, the full 30-week course repository is now available on YouTube and communitytaught.org. I actually joined the inaugural cohort in 2020 and attempted subsequent restarts. Leon is an engaging instructor, but the live-stream format presents some hurdles for self-paced learners. The videos are several hours long and include significant time spent interacting with the live chat, managing stream tangents, and breaking away from the core curriculum. Ultimately, the pacing made it difficult for me to stay focused and build momentum. (Note: I also found myself misaligned with some of the community’s culture and leadership choices over time, which made it easier to look for a fresh start elsewhere.) What did I choose? Ultimately, I chose The Odin Project (TOP) as my primary framework, and I couldn't be happier with the decision. The Odin Project checks every single box for