Developer details lessons from building an AI-edited Android launcher with Claude Code

·4 views

The author built AI Launcher, an open-source Android home screen designed to be modified by an AI coding agent that edits code, installs it, and checks results. Claude Code wrote most of the code while the author directed it and tested on real phones. A build passed all automated checks yet showed a black clock on a black background, which only a screenshot revealed, so the definition of done now requires both a passing verify script and visual review. Fresh agent sessions exposed gaps in the project's instructions, and a verify script that cleared phone logs was changed so scripts leave device state as they found it. Key input also caused the pager to focus off-screen pages, which was fixed by no longer composing those pages. The project has only been tested on two Samsung phones using Claude Code on Linux, and it currently requires a computer and coding agent since no APK is available yet.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

VIDRAFT's ViKernel Embeds Safety OS Controls Directly Into AI Model Weights

VIDRAFT has published ViKernel, a project that integrates an operating-system-style layer, including boot integrity, a rule-based policy engine, an append-only audit chain, and a kill switch, directly into an AI model's weights. The company argues that external wrappers and prompt filters can be removed or bypassed, whereas controls stored in the weights travel with the model file. The approach is presented as a response to the concern that the most capable component in an agentic system often has the weakest internal controls. A desktop-style interactive demo, ViKernel-Desktop v0.1, is publicly available on Hugging Face Spaces to visualize kernel state and kill/resume controls. The source is a conceptual and architectural write-up and does not include quantitative benchmark results.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Leantime API keys act as service accounts with broad visible access risks

Leantime, a project planning and task management tool with an API, uses users, roles, projects, and API keys that can function as durable service accounts. Internet-facing deployments may therefore expose credentials able to read or modify project data, and a ZoomEye count-only query returned 960 assets matching the Leantime fingerprint, though this does not confirm that all are active instances. The guidance recommends inventorying every API key by owner, role, project scope, and last use, and removing unused experimental keys. Administrators are advised to restrict who can create keys, alert on key and role changes, and verify API-level permissions with low-privilege test accounts. Self-hosted operators should also review secret storage, file permissions, and leftover setup paths.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Prefab UI Python Sandbox Flaw Allowed Host File Access; Upgrade to 0.21

A critical vulnerability, CVE-2026-120338, was disclosed in Prefab UI's Generative UI sandbox, affecting versions 0.14.0 through 0.20.2 and rated CVSS 10.0. The sandbox, which runs caller-supplied Python inside Pyodide within a Deno subprocess, was undermined by unrestricted Deno permissions and exposure of the Deno API to Python code. This allowed attackers to read and write files on the host system. Researchers at JFrog Security Research demonstrated that writing a .pth file into a server's virtualenv could execute code outside the sandbox on subsequent interpreter starts. The fixed versions, 0.21.0 and 0.21.1, were released in late October, before the advisory was published, and users of FastMCP with Generative UI enabled are advised to upgrade.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Most of my server's 'bot' traffic was its own health checks, not robots

The author added a counter to their own site's analytics to see who was visiting and found an inflated figure of 21,791 visits. Grouping the data showed that 20,709 of those came from curl requests to the homepage, sent from three addresses, which turned out to be each app container's health check hitting its own server. Link previews from Facebook also contaminated the numbers, and the real AI crawlers had only sent one request each. The author fixed the counting logic, removed the heartbeat traffic, and found that the actual figure for the first day was 914 visits from 26 addresses. They also noted that well-behaved crawlers like Googlebot, Microsoft and OpenAI self-identify through the From: header, which helped answer who runs the bots.

0 comments Read more at DEV Community