03 / Blog

Notes on building things.

Architecture, AI workflows and the code behind them, with the diagrams I drew to get there.

  1. 2026.10.30TanStack Redact: same React code, smaller engine.import from "react" is a contract, not a file. TanStack Redact's build plugin points it at a runtime about a third the size, so your unchanged app ships less JavaScript, at the cost of React's time slicing. What it swaps, what it saves, and what breaks. As of 2026.10.→
  2. 2026.10.29Your server unzips what strangers send.Content-Encoding works in both directions: a client can POST a Brotli-compressed body without asking, and Express 5 inflates it before your code runs. That is why CVE-2026-111497, a bug in Node's Brotli decoder, is reachable by any POST, and why the fix is a Node update, not an npm one. As of 2026.10.→
  3. 2026.10.28REA doesn't clone apps. It explains one feature, with proof.REA (Reverse Engineer Anything) is October's viral GitHub repo, sold as "AI can copy any app". What it really does: it wires your coding agent to Ghidra, JADX and a browser over MCP, so it can explain one feature of an app you have no source for, with an evidence ID for every claim. How it's wired, what the skill adds, and where it stops. As of 2026.10.→
  4. 2026.10.27Kimi K3.1 Pro: near Opus, half the price.Moonshot AI's new flagship scores within a point of Claude Opus 5.5 on terminal coding on Moonshot's own numbers, at $2 / $10 per million tokens against Opus's $4 / $20. What changed from Kimi K3, what the benchmarks say, what the API won't let you do, and why "open weights" isn't true yet. As of 2026.10.→
  5. 2026.10.26Use AI to practise, not to perform.A developer job hunt in India with AI as a coach before each stage and never a crutch during one: six prompts for search, applications and interviews, which job sites have an official AI connector, and why the unofficial ones risk your account. As of 2026.10.→
  6. 2026.10.26Your Compose file is already a diagram.compviz reads a compose.yaml and draws the architecture: services become nodes, depends_on becomes edges, and the customisation lives in the same file as standard Compose labels, so it still runs with docker compose. How it reads the file, what it matches, and what it deliberately doesn't do.→
  7. 2026.10.25CSS corner-shape: a corner's size vs its shape.border-radius sets how big a corner is. corner-shape sets what shape it is: round, squircle, bevel, scoop, notch or square, all as superellipse() values. How the keywords map, the radius-0 gotcha, and how to ship it as progressive enhancement while it's Chromium-only. As of 2026.10.→
  8. 2026.10.24PHP2Shell: the PHP bug that lives between requests.Two critical PHP engine bugs (CVSS 9.2) where one request leaves broken state behind and a later request on the same worker can turn it into remote code execution, before your app code runs. Who's affected, which versions fix it, how to check what's really serving your site, and what the stopgaps don't cover. As of 2026.10.→
  9. 2026.10.23How HTTPS decides to trust a site.The padlock doesn't mean a site's certificate is good. It means a chain of signatures leads to a root your browser already ships. eMudhra's eight intermediate CA keys, each one byte long, show what happens when one link in that chain is weak, and why browsers were protected within hours while curl, Node and Python were not. As of 2026.10.→
  10. 2026.10.22Your API key is a password with a credit card attached.OpenCode said provider keys saved in its hosted Console may have been exposed, and some users reported charges up to about $1,700. Why an API key works for whoever holds it, why the keys on users' own machines weren't involved, and the three things that limit the damage: rotate, scope, cap. As of 2026.10.→
  11. 2026.10.22CSS @function: write your own CSS functions.CSS can now define named functions with typed parameters and defaults. How @function works, why it isn't a Sass function, the pitfalls that fail silently, and how to ship it while only Chromium supports it. As of 2026.10.→
  12. 2026.10.19Pele: Mermaid text in, SVG out, no browser.Pele is Obsidian's MIT library that takes Mermaid syntax and returns an SVG string, with zero runtime dependencies and colours as CSS variables. Why rendering Mermaid usually means headless Chrome, what Pele changes, and the layout catch. As of 2026.10.→
  13. 2026.10.19CSS mesh gradients: from four fake blobs to one real mesh.Every mesh gradient in CSS today is a stack of radial-gradient() layers. On 2026.10.14 the CSS Working Group agreed to add real 2D gradients: mesh-gradient() and freeform-gradient(). What was decided, what the draft syntax looks like, and why you should keep your radial stack for now. As of 2026.10.→
  14. 2026.10.17TanStack Start: a server function is just a function.createServerFn code runs only on the server, but you call it from the browser like a typed local async function. The build swaps the body for an RPC stub, so server code never ships and the call becomes a fetch. Which also makes it a public endpoint. How it works, the code, and what people get wrong. As of 2026.10.→
  15. 2026.10.16Code Mode: one script instead of ten tool calls.In a normal agent loop, every tool call is a round trip and every raw result lands in the model's context. With Code Mode, the agent writes one small JavaScript script that calls its tools as functions, and only the final result goes back. OpenCode 2.0 turns it on by default for every MCP server; Cloudflare measured what it saves. As of 2026.10.→
  16. 2026.10.15SSE vs WebSockets: you probably need the one-way pipe.If only the server talks (notifications, live scores, AI tokens), Server-Sent Events give you a live stream over one ordinary HTTP response, with reconnection built into the browser. WebSockets are for when the client talks back a lot too. The format, the reconnect, and the limits people get wrong. As of 2026.10.→
  17. 2026.10.15Gemini 4 Argon, and how it stacks up.Google's new flagship can write up to 1M tokens in one answer while its rivals stop at 128K, and it costs $2 / $10 per million tokens until Nov 30. What changed from Gemini 3.x, how it compares with Claude Opus 5.5, Fable 5.1 and GPT-6 Astra, and what the 1M output really means for your code. As of 2026.10.→
  18. 2026.10.14How a passkey logs you in.A passkey is a key pair: the site keeps the public half, your device keeps the private half and signs a fresh challenge every time you log in. That one mechanism explains why a database leak gives attackers nothing and why a phishing site can't use your key. The login flow, the code, and the details people get wrong. As of 2026.10.→
  19. 2026.10.13Canvas fingerprinting: tracked with no cookies.A page draws some text on a hidden canvas, reads the pixels back and hashes them. Your GPU, driver, OS and fonts make those pixels slightly different from everyone else's. How it works in six lines, why incognito and a VPN don't touch it, and which browsers actually defend against it. As of 2026.10.→
  20. 2026.10.12Easing: why some motion feels right.Two boxes cross the same distance in the same time and one of them feels alive. A short, practical tour of easing functions: what the curve means, which one to reach for, and how to write any of them in CSS today.→
  21. 2026.10.12ArtCraft: Adobe-style apps, rebuilt in Rust.Seven free, MIT/Apache-licensed apps that aim at Photoshop, Illustrator, Premiere and the rest, written in Rust with AI agents and running on the desktop or in a browser tab. What it is as of 2026.10, what clean-room means, and how honest the readiness numbers are.→
  22. 2026.10.12Claude Haiku 5.5 vs 4.5, in plain English.Anthropic's new small model costs a tenth as much per token on most requests, reads five times more at once and jumps from 1 in 6 to about 3 in 4 on desktop tasks. What changed from Haiku 4.5, what the benchmark numbers actually mean, and what breaks when you switch.→
  23. 2026.10.11e2e: the agent clicks once, then replays.TesterArmy's open-source e2e framework lets you write a test step in plain English. An agent drives it once, the step is recorded when a later check passes, and every run after that is a replay with no model calls. What it does, as of 2026.10, and where the catch is.→
  24. 2026.10.11JPEG XL in Chrome: same photo, fewer bytes.Chrome 155 decodes JPEG XL. What the format buys you, how to repack the JPEGs you already have without losing a pixel, and the four lines of HTML that let you ship it today with a safe fallback. As of 2026.10.→
  25. 2026.10.10Grill me: let your agent ask before it codes.Most bad agent code is the right code for the wrong plan. Matt Pocock's /grill-me skill is two lines long and adds no knowledge at all: it changes when the agent acts. Here is how the design-tree interview works, why it works, and when not to use it.→
  26. 2026.10.09Vite+ 1.0: one CLI instead of six tools.VoidZero shipped Vite+ 1.0 on 2026.09.28: one free command, vp, and one vite-plus dependency in place of Vite, Vitest, ESLint, Prettier, tsup and Turbo. What it is as of 2026.10, what runs underneath, and what it doesn't do yet.→
  27. 2026.10.09React <ViewTransition>: wrap it, then start a transition.React 19.3 made <ViewTransition> stable, and Next.js 16.4 ships it. Wrapping an element is only half of it: nothing animates until the update is a Transition. What triggers it, the four kinds of animation React picks, what the browser actually does, and the pitfalls that make it silently do nothing.→
  28. 2026.10.08Does this code need to exist?Ponytail is an agent skill that makes AI coders walk a seven-rung ladder before they write anything: does it need to exist, is it already here, does the language or the browser do it. The ladder works just as well without the tool. Here is each rung, with code.→
  29. 2026.10.07A coding agent is just a loop.Strip a coding agent down and you find a while loop, a few tools and a chat that keeps growing. A tour of that loop, using Pi, the open-source agent that ships with four tools and a prompt under 1,000 tokens, as the specimen.→
  30. 2026.10.06Claude Code mods are middleware for your agent.Claude Code now loads mods: plugins made of your own JavaScript or TypeScript that run inside the agent. Every hook gets ($, e, next), the same shape as Express and Koa middleware. What a mod is, the three things a hook can do, how to make a guard fail closed, and what you are trusting when you install one.→