Archives

The model confidently declares "done" while the work isn't — an error that doesn't error, and no layer of try/catch will catch it. Mechanical failures get retry with exponential backoff plus a hard max_steps brake; semantic failures get an independent verifier — and verification must run in an isolated context. Part 6 of the fe2agent series, with tiny-agent v0.6 (withRetry + MAX_STEPS + verifier).

You think the agent remembered your rule; really that sentence lives in yesterday's session's messages array, and today it wakes up brand new. Context is RAM, memory is disk — "write it down" is the only persistence, and retrieve-and-backfill is agent-land's lazy loading. Part 5 of the fe2agent series, with tiny-agent v0.5 (a markdown memory file + naive keyword retrieval + two new tools, save_memory / search_memory).

Change one line of the system prompt and the agent behaves like a different animal — prompts are like CSS: declarative, cascading, overridable, but with no devtools to show which rule is in effect. Part 4 of the fe2agent series — prompt layers, instruction dilution, and structured prompting, with tiny-agent v0.4 (same tools, two system prompts, run the behavior diff).

Two TODOs and one regret from three months ago are all settled, plus four things I never imagined: memory as the rule hub, Skills in the pipeline, bilingual i18n as a second publishing line, and AdSense reshaping the writing discipline. Seven evolutions, one section each — a ledger.

In frontend you dispatch and you write the reducer. In an agent the AI dispatches; the reducer half is still yours. Part 3 of the fe2agent series — the tool schema trio, separation of execution rights, validating the AI like an untrusted client, with tiny-agent v0.3.

You think the agent remembers you; really it re-sends the full messages array every turn. LLM calls are stateless — "conversation" is a client illusion.

An agent is a while loop whose function isn't pure. Series opener from UI=f(state) to action=LLM(context), with a 32-line runnable tiny-agent.

How Fiber's three mechanisms (double buffering, time slicing, lanes priority) map to AI Agent state design — three principles I stole and dogfooded.

GitHub Copilot added Kimi K2.7 Code to its model picker on 2026-07-01 — the first open-weight and first Chinese model there. Hand-verified data, plus the "open weights + Azure hosting + off-by-default" trust structure.

A line-by-line self-audit 52 days after blog166: of 5 predictions, 2 retracted (the Sonnet/Opus advice is stale, the open-source gap was underestimated), 1 still pending (Anthropic pricing), 2 held up. Plus six months of real model-routing observations from this blog and the checkpoints for the next audit.

DietrichGebert's ponytail launched on 2026-06-12 and climbed to 73k stars / 3,848 forks in three weeks, covering 16 agent ecosystems. Its core is a 7-step decision ladder that forces AI to obey YAGNI. I ran an A/B test against a 196-line TableOfContents component from this blog; after installing ponytail the review recommendation was to cut it to 25-30 lines, a -84% change. Inside — firsthand test data, three structural reasons for the viral growth, a step-by-step breakdown of the ladder, and three counter-boundaries.

微信读书 (WeRead) shipped its official Agent Skill on 2026-05-17 — the first "official player" among Chinese content platforms. Community forks exploded in the first week; six weeks later there is still not a single commercialized product. This post unpacks the three structural blockers behind the "official access + community boom + zero commercialization" pattern, and what indie devs can actually cash in on right now.

Zhipu's official GLM-5.2 harness "ZCode" hit the Hacker News front page (155/192 when I first opened it, 264/236 now). This isn't "yet another AI IDE" — it's the first time a Chinese dev tool has been seriously evaluated by mainstream Silicon Valley engineers. This post breaks down the timeline, what ZCode actually is (a desktop app, not a CLI), the three real objections on HN, and a 30-line TS snippet for wiring up GLM Coding API yourself.

Zhipu's GLM 5.2 hit 39% F1 on Semgrep's IDOR vulnerability detection benchmark, beating every Claude Code Opus version at roughly 1/6 the per-finding cost — while still trailing about 2 points on aggregate benchmarks. Kimi and Qwen reproduce the same pattern. Is "scenario-specific superiority" the 2026 inflection point for Chinese models?

Tencent WorkBuddy launched 2026-03-09 and hit 8.85M monthly visits (+831% MoM) with a DAU 3-4x the

When Karpathy coined Vibe Coding in Feb 2025, he only talked about how good it felt to write. GitClear's 211M-line study and the 2026 wave of rescue jobs both map that feeling onto a 4x maintenance bill in year two. This post unpacks the three mechanisms that detonate around day 90 — the Spaghetti Point — and how to keep AI speed without paying that bill.

Starting in 2025, Claude Code, Codex CLI, Charm Bubble Tea, and Ink all took off at once. After 30 years of GUI dominance, the CLI suddenly became the default form factor for AI tooling — Claude Code itself even ships as a Bun binary. This isn't nostalgia. Three structural constraints — LLM I/O, controllable long-running tasks, and cross-tool interop — are pushing engineers back to the terminal. Includes a 30-line Claude Agent SDK sample.

blog191 walked through the five components of Loop Engineering and named three debts—verification, comprehension, cognitive surrender—without offering a treatment plan. This post fills that gap: a Wharton 1,372-person experiment, Anthropic's 52-engineer study with a 17% comprehension gap, a real $4,200 overnight bill, Claude Code's PreToolUse rejection hook, and three checkpoint patterns—the full playbook in one place.

AGENTS.md is the de facto standard in 2026, CLAUDE.md is still Claude Code's richer format, and project memory holds a different class of information altogether. Stitch them into a "Project Passport" so every new session begins with the AI clearing customs in seconds instead of asking you to paste context again.

The previous post argued monorepos are an organizational problem. This one walks through the actual setup, end to end. pnpm catalogs for version alignment, Turborepo 2.x task graphs, changesets + OIDC publishing, remote cache, CODEOWNERS — every command and config you need, current as of 2026.

Monorepo isn't a yes/no technical choice. Babel went in and then quietly walked half of it back, Lerna spent a stretch with no maintainer, and Mercari's cross-region CI burned real money for a year. All three cases point at the same thing: what decides whether a monorepo works isn't Turborepo or Nx, it's your team and how it's organized.

The "Loop Engineering" term Addy Osmani popularized in June isn't a replacement for prompt engineering — it's about swapping you out as "the person who hits enter" and turning you into "the person who designs the loop". Walks through the five components plus a state, and the three debts Osmani is really worth remembering for (verification debt / comprehension debt / cognitive surrender) — and along the way, why I disagree with him placing loop above the harness.

Anthropic shipped Fable 5 on 6/9, swapping the Opus/Sonnet/Haiku naming for Fable/Mythos. But the things that actually force every Claude API integrator to touch code aren't the names — they're the new stop_reason refusal, the forced adaptive thinking, and the "you must wire up a fallback model" architecture. After two days driving it inside Claude Code, here's the integration-side detail you need.

Prompt engineer, context engineer, harness engineer, agentic engineer — these aren't four competing job titles. They're nested layers of concern, from a single instruction to an entire autonomous system. Understand how the four layers relate, and you'll know exactly which one you're optimizing every time you get stuck.

This isn't a tutorial on installing electron-builder. It's a primer for web developers with a few years of React experience, organized by actual impact from biggest to smallest — from the fundamental process model, to the native-module pit everyone falls into, to tooling and debugging. Reading it should save you about a week of trial and error.

BrowserView is officially deprecated in Electron 30; the new API is the WebContentsView + BaseWindow combo. This post breaks down the new model: key differences from iframe/webview/BrowserView, migration code diffs, how to lay out multi-view apps, and a few easy-to-hit pitfalls.

A deep dive into the full version management lifecycle for Electron apps — from versioning conventions to auto-update mechanics, user notifications, and rollback strategies. Built on real-world practices with electron-updater and semantic versioning to deliver a user-friendly update experience.

A few days ago I wrote a teardown of safeStorage — the conclusion was that it's fine for ordinary API keys. But what if you need to store a wallet private key worth tens of thousands of dollars? safeStorage falls short. This post looks at how real desktop wallets like MetaMask and Phantom do it, and why the trio of "encryption + master password + short-lived unlock" is unavoidable.

I've spent 10 months using Claude Code on a real-money futures trading project. This is an honest retrospective: the AI never touched the money directly (I'm not that bold), but it did write code on the critical order/stop-loss/close-position paths. Here are the boundaries I held, where AI genuinely helped, and the moments I had to take over.

No boring comparison tables here. This post reverse-engineers the decision logic from what real products did in 2026 — why VS Code / Slack / Claude Desktop are still betting on Electron, why the Ubuntu 26.04 desktop went all-in on Flutter, and why Teams and Zed walked away.

safeStorage is Electron's recommended API for storing secrets, but its implementation details are rarely discussed. This post cracks open the source: roughly 100 lines of C++ wrapping Chromium's OSCrypt, AES-128-CBC, an IV hardcoded to 16 spaces, and PBKDF2 with a single iteration. Paired with real cases — VS Code credentials read directly by extensions, VoidStealer grabbing the master key with a hardware breakpoint — it ends with a threat-model-based storage decision table.

Roughly 70% of posts blog080-166 on this blog were written with Claude Code's help, yet readers almost never notice. Here are the 7 "anti-AI-tone" principles I distilled — the goal isn't to make AI sound less like AI, it's to make AI sound like you. Includes the automated check script from my blog-preflight Skill.

blog080 was written in early March 2026. Two-plus months later, GPT-5.5, Claude Opus 4.7, and Gemini 3.1 Pro have all shipped, and open-source flagships GLM-5.1/Qwen 3 Coder have closed the gap to within 5-15 points of closed models. This is the May update: what changed, and how to adjust your March picks.

Neither the Vercel breach nor the Nx Console incident was a protocol vulnerability—both were credential governance failures. This post distills these two AI tooling supply chain attacks into 8 defense principles plus a 1-hour audit checklist, covering OAuth least privilege, secret tiering, managed device isolation, and IDE extension credential isolation—a security playbook indie developers and small teams can act on immediately.

A head-to-head comparison of multi-agent orchestration plugins: Ruflo calls itself the "leading Claude orchestration platform" but underdelivers in execution, Maestro stays lightweight, Claude Octopus runs reviews across 8 models in parallel, and Codex Peer Review gates merges behind three sequential reviewers. From architecture to measured token costs — a decision framework for indie developers.

The Claude Code ecosystem has splintered into 100+ plugins as of May. This post zooms in on the "workflow methodology" category—Superpowers, Shipyard, Ralph Loop, Maestro, and Karpathy CLAUDE.md. Design philosophy, context overhead, fit, and combination strategies, plus a decision tree for indie developers.

I upgraded my own blog (48 pages, Astro 5.16.6) to Astro 6.3.1 and recorded what actually changed, whether builds got faster, and what broke. Verdict: near-zero migration cost for a small blog, but the official "2x faster" claim doesn't hold at 48 pages — measured build times were essentially flat.

I hooked the same Subagent up to both Claude Code's built-in file-based memory and mem0's vector retrieval, then compared token cost, recall quality, and cross-session learning. The result: concrete thresholds for which approach fits which data scale, plus a look at procedural memory—the weakest but most promising direction.

Anthropic officially describes Claude Code as a five-layer architecture: MCP for connectivity, Skills for task knowledge, Agent as the main worker, Subagents for parallel isolation, and Agent Teams for coordination. This post breaks down each layer's role and collaboration patterns, with a real-world example from my blog's blog-preflight Skill showing three layers working together.

Cursor and Claude Code both start from source code, but a frontend engineer's real work happens in the browser—the actual color on hover, the real DOM after SSR, the re-render triggered by the third useState. Frontman works in the opposite direction: from the browser back to the code. This post breaks down its architecture and combines it with Anthropic's frontend-design Skill and others into a complete frontend AI workflow.

Pull your repetitive playbooks, checklists, and multi-step workflows out of CLAUDE.md and turn them into Skills. Using a "pre-publish blog check" as the running example, this post covers the SKILL.md structure, every frontmatter field, context fork isolation, the boundaries with Slash Commands and Sub Agents, plus debugging and sharing.

A 2026 head-to-head coding comparison of the leading large language models: benchmark numbers, pricing, and real-world coding performance for GPT-5.5, Claude Opus 4.6, and Gemini 2.5 Pro — to help you pick the right model for everyday development.

An in-depth comparison of the leading React chart libraries in 2026—Recharts, Apache ECharts, Nivo, and TradingView Lightweight Charts—across three core scenarios (candlestick charts, bar charts, treemaps), with recommendations based on performance, bundle size, and ease of use.

An in-depth comparison of the leading AI coding tools in 2026: Claude Code, Cursor, GitHub Copilot, Windsurf, Trae, Cline, Gemini CLI, and Aider — covering real-world data, current pricing, and use cases to help developers pick the right tool.

Stanford's 2026 AI Index report shows AI agent success rates on real computer tasks jumped from 12% to 66% in a single year—just 6 percentage points shy of the human baseline. Here's what that means for frontend developers and how to adjust your workflow to take advantage of this inflection point.

A post-mortem of the April 2026 Vercel breach and its full attack chain: Roblox cheat script → Lumma Stealer → over-permissive OAuth → SSO lateral movement → leaked environment variables. We break down the security blind spot behind each link and the defenses developers should put in place.

A breakdown of how the forrestchang/andrej-karpathy-skills repo gained 44K stars in a single week: Karpathy's four principles for AI coding (think before coding, simplicity first, surgical changes, goal-driven execution), and how to use them directly in Claude Code.

A deep dive into two underrated Claude Code environment variables: CLAUDE_CODE_EFFORT_LEVEL controls the reasoning effort tier, and CLAUDE_CODE_ADDITIONAL_DIRECTORIES_CLAUDE_MD enables sharing rules across projects — with complete configuration examples and use cases.

In March 2026, the axios npm package was hijacked by a North Korean state-level APT, planting a RAT into millions of developer environments within 3 hours. This post breaks down two separate but related incidents: the full supply-chain poisoning attack chain, and the technical mechanics and real-world exploitability debate around CVE-2026-40175 (CVSS 10.0).

A ClawHavoc-style supply chain attack poisons 1,184 agent skills and hits 300,000 users; within two weeks, Cisco and Microsoft ship agent security tooling. This post breaks down the threat model, compares the two defense architectures, and walks through real integration code.

Claude Managed Agents, which entered public beta in April 2026, moves the agent loop, tool execution, and sandboxed runtime entirely into Anthropic's cloud—three API calls are all it takes to get an autonomous agent running. This post walks through the core concepts, demonstrates the full workflow with real code, and compares it against building your own.

Not another feature rundown of Hermes — this is what it's actually like after wiring it into a real development workflow: code review, requirement breakdown, doc generation, scheduled monitoring. Which scenarios genuinely help, and which ones will bite you.

Claude Code Hooks might be the most underrated AI coding feature out there. This post starts with how the three hook types fire, then walks through 10+ real configurations from my blog agent, tooling site, and daily work to show how Hooks can make Claude Code truly part of your workflow.

Hermes Agent is an open-source AI assistant framework from Nous Research, featuring a self-learning loop, cross-platform messaging integration, and cron scheduling, with one-command migration from OpenClaw configs. This post covers its core features, where it fits, and its limitations.

When the third-party AI agent framework OpenClaw shut down, I rebuilt the entire multi-agent automation experience with the Claude Code CLI: Telegram bots, scheduled tasks, session persistence — plus every pitfall I hit along the way.

Alibaba's Qwen3.6-Plus topped OpenRouter's global daily leaderboard just one day after launch, and Chinese AI token usage has now outpaced the US for five straight weeks. What does this actually mean? This post breaks it down across technology, data, and ecosystem.

A developer built Flash-MoE in 24 hours: it runs the 397B-parameter Qwen3.5 model on a 48GB MacBook Pro at 4.4 token/s, using only about 6GB of RAM and no cloud GPUs. We break down how it works: SSD streaming, Metal shader optimization, and MoE sparse activation.

In March 2026, the Apifox desktop client was hit by a supply chain attack: a JS file on the official CDN was replaced with a malicious version that stole users' SSH keys, Git credentials, and other sensitive data. A technical breakdown of the attack chain, blast radius, and how to check if you were affected.

Squad, an open-source project, lets you spin up an AI dev team inside your repo with two commands—an architect, frontend dev, backend dev, and tester, each with their own job, collaborating on top of Copilot. A look at its architecture, what it's like to use, and the multi-agent collaboration patterns behind it.

AI agents are learning to operate computers the way humans do—reading the screen, clicking the mouse, typing on the keyboard. From Anthropic's Claude Computer Use to Microsoft's CUA to OpenAI's Operator, Computer-Use is redefining what "software integration" means.

Google Stitch just got a major update, evolving from a simple prompt-to-mockup tool into an AI-native design canvas. Infinite canvas, voice interaction, the DESIGN.md design system format, MCP integration — five big features shipped at once. Free, powered by Gemini, and aimed squarely at Figma Make.

A deep dive into Karpathy's open-source AutoResearch project: how a 630-line Python script lets an AI agent run ML experiments autonomously on a single GPU, completing 700 experiments in two days and finding 20 effective optimizations. From architecture to practical applications, here's why every developer should pay attention to the "Karpathy Loop" pattern.

MCP (Model Context Protocol) has published its 2026 roadmap with four priority areas: transport evolution, agent communication, governance maturity, and enterprise readiness. A technical breakdown of the concrete problems and proposed solutions in each area.

A deep dive into the architecture and design of MiroFish, a swarm intelligence prediction engine. Built by a college senior in 10 days with Vibe Coding, it topped GitHub Trending and landed a 30M RMB investment from Shanda. Here's what it got right, technically.

How Coinbase's x402 protocol revived the HTTP 402 status code to let AI agents pay for API calls with stablecoins. From protocol design to hands-on code, from the Stripe/Mastercard competitive landscape to the reality of $28K daily volume — a full breakdown of the agent payments space.

A deep dive into Chrome's built-in Gemini Nano model and the browser-native AI APIs (Prompt, Translation, Summarization) — from technical architecture to production practice, showing how to build privacy-first local AI apps, with complete code examples and performance analysis.

A deep dive into OpenClaw's Cron Job and Heartbeat mechanisms—from choosing between them to engineering practice—with a real production case study covering error handling, state management, and cost optimization.

Hands-on benchmarks of 12 AI models (GPT-4o, Claude 3.5, Gemini 2.0, Qwen 2.5, GLM-4, Kimi, and more) across 6 real-world scenarios including code generation, Chinese writing, and reasoning. Includes performance scores, monthly cost comparisons, and a decision tree to help you pick the right model.

A deep dive into building episodic, semantic, and procedural long-term memory for AI Agents, with a complete technical architecture, code implementation, and production optimization strategies.

How AI Agents are evolving from "assistive tools" into "collaborative partners" and reshaping the modern developer workflow. Based on real project experience, a deep dive into three core capabilities — context awareness, proactive execution, and tool orchestration — with complete code examples.

A deep dive into the technical architecture, security models, and governance mechanisms of MCP, Agent Skills, and Skills.sh — unpacking the design-philosophy clash behind real-world security incidents, with a practical selection guide for enterprises and developers.

How to design and build a multi-task collaboration system for AI Agents, covering task decomposition, state management, and error recovery. A hands-on look at agent collaboration architecture through a real blog-publishing workflow.

A deep postmortem of two real production incidents, analyzing why AI agents systematically ignore explicit rules and how to design constraint mechanisms that actually hold. Covers the technical root causes, common patterns, and actionable solutions.

A deep dive into OpenClaw's memory architecture, from file layout to retrieval tuning, with actionable best practices for managing AI Agent memory

A deep dive into building an AI dev assistant from scratch with memory, tool calling, and task planning — a hands-on look at AI-native development patterns

What are Skills? How do you install and use them in Claude Code, Codex, OpenClaw, and other AI tools? Explore skills.sh and awesome-openclaw-skills, tap into 3,000+ community Skills, and turn your AI Agent from a generalist assistant into a domain expert.

12MB vs 150MB, 14KB incremental updates, full-stack TypeScript. How does electrobun redefine desktop app development with Bun + Zig? A complete breakdown of its architecture, performance, and hands-on usage.

From Claude Code CLI to OpenClaw: how AI agent configuration systems evolved, seen through the 35.6k-star everything-claude-code project. A deep dive into Skills, Hooks, and Rules, plus a practical guide to porting configs across tools.

How do you keep AI Agent token costs under control? How do you deal with hallucinations? How do you roll it out across a team? This post shares battle-tested optimization strategies and collaboration practices, backed by real cost data.

The series finale. From Copilot to autonomous agents, from closed to open source — this post maps where AI agents are heading, compares the major tools, and explores how the developer's role is changing. Complete learning roadmap included.

Real-world lessons from a week of running a multi-agent system: a config management incident, TypeScript import errors, a wrong publish date, cost optimization in practice, and best practices for team collaboration.

Use AI Agents for intelligent code review and automated test case generation. From Git Hook integration to E2E testing, this post shares a complete hands-on setup with real project metrics.

Expose a locally running OpenClaw Gateway to the public internet with an SSH reverse tunnel plus an Nginx reverse proxy, accessible via your own domain. All data stays local, with multiple layers of security — at zero cost.

An AI Agent is not just a chatbot — it's an intelligent assistant that can invoke tools and manage context on its own. This post breaks down how Agents actually work, then walks through a hands-on React component generator to show how AI can reshape the frontend development workflow.

Setting up multiple OpenClaw agents and multiple Telegram accounts comes with plenty of pitfalls. Based on hands-on experience, this post covers every common problem and its fix so you can skip the pain.

A hands-on comparison of Claude Code, OpenClaw, and Cursor — the three big AI coding tools. From runtime model, memory systems, and model support to skill mechanisms, this guide covers how to choose an AI agent dev tool in 2026, plus a deep dive into their config systems and a cross-tool migration guide.