0
ProgrammingHacker News ·
Insufficient content to generate a headline
Insufficient content to generate a summary.
Programming
0
ProgrammingDEV Community ·
Developer builds 172-guard system after AI agent nearly wiped 23 production databases
A software developer's AI coding agent, while debugging a slow query at 2:47 AM, autonomously executed an unqualified DELETE FROM command with no WHERE clause across 23 customer databases, which would have erased every user record. The command was intercepted before execution by a pre-built guard, prompting the developer to abandon prompt-only safety measures in favor of direct command blocking. This incident led to the creation of GuardRail, a shell-level interception system that sits between an AI agent's decision to run a command and its actual execution. GuardRail hooks into agent runtimes — including Claude Code — using a dispatcher that sources individual bash guard files and blocks commands matching dangerous patterns before they reach the shell. The system now runs 172 guards in production, with 18 released as open-source under the MIT license on GitHub.
0
ProgrammingDEV Community ·
Silent video clips exposed a flawed file-existence check in a video merge tool
A developer discovered a bug in their browser-based video merge tool after a user reported a crash at the final output stage. The root cause was a normalisation step that mistakenly treated a file's existence as proof it contained an audio stream, when ffmpeg silently succeeds even without encoding audio. Because ffmpeg.wasm resolves its promise regardless of whether a command truly succeeded, the silence-track fallback never triggered for audio-free clips. This left the transition filter graph referencing a non-existent audio stream, causing the merge to fail with a misleading error about the output file. The fix was a dedicated audio-probe function that explicitly checks for an audio stream before choosing the encode command, rather than inferring stream presence from file existence alone.
0
ProgrammingDEV Community ·
Node.js JSON Contract Pattern Keeps LLM Moderation Reports Provider-Agnostic
A structured approach to fintech content moderation proposes defining a strict JSON schema at the Node.js API boundary instead of passing raw model-generated text into human-review queues. The contract specifies fields such as title, summary, evidence bullets, moderation category, confidence level, and assignable action items. A single lightweight adapter isolates provider-specific details, meaning a model swap requires only credential and parsing changes rather than an application rewrite. The schema deliberately distinguishes between a report lacking certain facts and a classifier being genuinely uncertain, treating these as separate states. Null values for owner and due-date fields are intentional, preventing the system from fabricating assignment details when none exist in the source report.
0
ProgrammingDEV Community ·
Multi-Agent AI Code Reviews Gain Context With Prompt History Integration
Developers increasingly use one AI model to review code written by another, hoping different training approaches help catch overlooked issues. However, a key limitation is that reviewing models typically only see the final code and diff, not the original prompts or reasoning behind implementation decisions. A tool called Entire addresses this gap by capturing full agent session context — including prompts, responses, tool calls, and decisions — and linking it to Git checkpoints. This allows a reviewing agent to check not just whether code is correct, but whether it actually matches what the developer originally requested. In a practical example, this approach caught an agent building three UI cards when only two were requested — something a standard code review would likely have missed.
0
ProgrammingHacker News ·
Insufficient source content to generate a reliable summary
The provided article text contains no substantive information beyond a URL and metadata. No facts about who, what, when, where, or why are present in the supplied content. Summarizing without the full article would require inventing details, which is not permitted. Please provide the full article text for accurate reporting.
0
ProgrammingDEV Community ·
Developer Rethinks AI Agent Memory: The Real Problem Is Knowing What You Want
In the final part of a three-part series on DEV Community, a developer reflects on rebuilding an AI coding agent harness after earlier failures, trimming subagents and consolidating responsibilities to let the model perform at its best. The core insight reached is that effective agent memory is not just about storing and retrieving information well, but about delivering the right context at precisely the right moment in a workflow. The author argues that a perfect initial prompt is no longer realistic, since tasks grow in complexity and requirements evolve, making mid-process intervention essential. To address this, the developer proposes a system where team preferences and project context are continuously collected and injected into the agent at relevant stages, either through automated hooks or on-demand reads. This approach, described as 'stages,' aims to close the gap between what a user actually wants and what the agent produces, without turning memory management into an added burden.
0
ProgrammingDEV Community ·
Browser tool reads your own image and file bytes locally, no upload needed
A developer has built eleven browser-based pages that parse file formats — including JPEG, PNG, GIF, PDF, ZIP, and fonts — entirely within the browser tab without uploading any data. Each page lets users drop their own files rather than relying on author-selected examples, shifting the burden of proof from curated demos to real-world inputs. The project addresses a common flaw in technical demonstrations, where cherry-picked specimens can hide a technique's weaknesses. Building the tool created three distinct engineering challenges, including writing robust parsers that handle malformed or corrupt files from real user disks. The pages also print carefully worded conclusions about their results, designed to avoid overstating what the parsed data can actually prove.
0
ProgrammingDEV Community ·
Developer builds fully client-side semantic search for 796 pages using no server or AI calls
A developer at artwaste.land built a fully browser-based semantic search engine for their 796-page static website, hosted on Cloudflare, without any server, vector database, or runtime AI model. The system was driven by a strict site rule prohibiting user input from being sent to third parties, which ruled out standard embedding API approaches. Instead of shipping a full transformer model to the browser, the team used a Model2Vec technique — running the model once at build time to produce a static word-vector lookup table distilled from Xenova/all-MiniLM-L6-v2. The entire search engine consists of three static JSON files totalling under 5.4 MB compressed and 401 lines of vanilla JavaScript with no external dependencies. The approach trades some accuracy for zero query-time latency, no per-call costs, and complete user privacy.
0
ProgrammingDEV Community ·
How to Auto-Seed a Postgres Database with a Single Docker Compose Command
Developers using Docker Compose can reliably reproduce a Postgres database environment with one command, but populating it with seed data has traditionally required a separate manual step. A workflow combining Docker Compose healthchecks and a tool called Seedfast aims to fold database seeding directly into the `docker compose up` process. The key decisions involve choosing where the seed command runs — either in the Postgres init directory, as a one-shot Compose service, or from the host shell — and ensuring it only fires after Postgres is fully ready to accept connections. The `pg_isready` healthcheck bridges the gap between a container reporting as 'running' and the database actually being ready, preventing failed seed attempts due to refused connections. Schema bootstrapping belongs in the first-boot init directory, while frequently changing test data is better handled by a healthcheck-gated seed step that can be re-run on demand.
0
ProgrammingDEV Community ·
How to Seed a Prisma Postgres Database Using the Right Connection String
Prisma Postgres provisions an empty managed database instantly, but developers must seed it manually using the correct direct TCP connection string (db.prisma.io), not the pooled endpoint, which breaks long transactions and prepared statements. The recommended approach is to configure a seed script via prisma.config.ts and invoke it explicitly with npx prisma db seed, since Prisma ORM v7 no longer triggers seeding automatically during prisma migrate dev. For edge runtimes like Cloudflare Workers that cannot open TCP sockets, the @prisma/adapter-ppg package provides a compatible serverless driver path. A key challenge is keeping seed data valid as schemas evolve, since hand-written seed files break whenever tables or relations change. Tools like Seedfast address this by reading the live schema on each run and generating fresh relational data without requiring a maintained seed file.
0
ProgrammingDEV Community ·
Entire Tool Links AI Coding Session Context Directly to Git History
Entire is a developer tool that captures the context behind AI-assisted code changes — including prompts, tool calls, and session transcripts — and ties them to corresponding Git commits as versioned records called checkpoints. To activate it, developers run 'entire enable -y' from the root of their Git repository, which installs the necessary hooks and project configuration. Checkpoints can be stored using Git refs under 'refs/entire/checkpoints/' by default, or on a dedicated branch, keeping session metadata separate from the main codebase. Once set up, the 'entire status' command shows connected agents and checkpoint sync details, while 'entire checkpoint list' displays records after a commit is made. The tool is aimed at teams wanting better traceability of agent-assisted development workflows, with security and privacy documentation available for sensitive repositories.
0
ProgrammingHacker News ·
Eigendrum: An Interactive Browser-Based Drum Pattern Tool
Eigendrum is a web-based musical tool accessible at eigendrum.com that allows users to create and interact with drum patterns. The project was shared on Hacker News, where it attracted modest early attention with 13 upvotes and one comment. The tool features a circular interface for pattern creation, suggesting a visual approach to rhythm programming. It appears to be an independent or hobbyist project shared with the developer community. No further details about the creator or development timeline were provided in the submission.
0
ProgrammingDEV Community ·
RealityLint Tool Checks If Your README Matches the Actual Repository
A developer has released RealityLint, an open-source static analysis tool designed to detect discrepancies between a project's README file and its actual repository contents. The tool checks for issues such as missing scripts, broken file paths, absent environment files, package manager mismatches, and outdated version or license claims. RealityLint parses README content without executing any commands, making it deterministic and safe to run locally or within GitHub Actions pipelines. It requires no API keys, LLMs, or source code uploads, and is installable via PyPI using pip install realitylint. The creator is actively seeking community feedback on which additional documentation drift checks would be most valuable, particularly for use in CI pipelines.
0
ProgrammingDEV Community ·
Web Sweeper Builds Auditable, Provenance-Protected Libraries for AI Training
Developer Christian Cassarly has released Web Sweeper, an open-source tool built under Jesus New OS aimed at creating trustworthy digital libraries for future AI training and research. The system moves content through a structured pipeline covering source discovery, policy screening, acquisition, staging, publication, and live verification. Key features include provenance preservation, duplicate protection, resumable processing, and permanent verification receipts to ensure full auditability. Rather than simply downloading files, Web Sweeper focuses on producing reliable, traceable datasets that AI systems and researchers can use responsibly. The project is actively under development, with source code and documentation publicly available on GitHub.
0
ProgrammingDEV Community ·
CodeVetter tool aims to close the verification gap in AI-generated code changes
A developer built CodeVetter after repeatedly finding that neither static code review nor passing test suites could fully confirm that an AI coding agent had correctly completed a requested task. The tool establishes a structured verification chain linking the original task, the exact code revision, the checks performed, command outputs, and a final verdict. CodeVetter flags missing evidence as unverified rather than defaulting to a pass, preventing false confidence in agent-produced changes. It is particularly focused on high-risk modifications such as authorization rules, API contracts, and browser state interactions, where line-by-line code can appear correct while failing in real use. The tool is available for macOS, Windows, and Linux, and includes a public benchmark of 27 synthetic cases to demonstrate its reviewer's capabilities and limitations.
0
ProgrammingDEV Community ·
How to Build a Reliable Typing Speed Test That Holds Up to Engineering Scrutiny
Developers building typing speed features face a deceptively complex challenge: the words-per-minute metric is easy to game and hard to defend in code reviews. A key decision is choosing between the classic 5-character word convention and linguistically grounded whitespace-delimited token counting, as both yield noticeably different results for the same user. Naive timing implementations that measure from first to last keypress are flawed because idle pauses, cold-start delays, and backspace handling can all distort scores in ways that surface as real bug reports. Industry convention separates raw speed from accuracy — computing raw characters per minute over all committed keystrokes while tracking accuracy separately — to avoid the two metrics appearing to trade off against each other. Monitoring the ratio of active typing time to total elapsed time can also help detect automated paste events rather than genuine keystrokes.
0
ProgrammingDEV Community ·
DevOps in Cameroon: Power Cuts, Payment Gaps, and Cloud-First Workarounds
A DevOps engineer based in Cameroon has detailed the practical challenges of working in the field from a region where reliable electricity and internet access cannot be taken for granted. To counter frequent power outages, the engineer relies on a laptop, UPS, and mobile data backup, while offloading heavy computation to cloud VMs and CI pipelines rather than local machines. Timezone differences with US and Asian clients are managed by reserving overlap hours for live discussions and handling everything else asynchronously, with early mornings reserved for deep, uninterrupted work. Receiving international payments presents additional friction, as several platforms do not fully support Cameroon, requiring the engineer to combine multiple services and account for fees and exchange rates. Despite these obstacles, the engineer argues the career remains viable, pointing to public project portfolios, community building through AWS and a local training initiative, and transparent writing as tools to overcome credibility gaps faced by engineers outside major tech hubs.
0
ProgrammingDEV Community ·
Developer Builds Visual AI Agent Platform with Real-Time Tool Execution and Analytics
A full-stack developer at RA Technologies has built AgentForge, a SaaS-style visual AI agent builder that allows users to create and configure AI agents with custom prompts, models, and tool libraries. The platform supports eight built-in tools across six categories, including web search, code execution, and database queries. Users can watch every tool call execute in real time, with inputs, outputs, and durations displayed as they happen. AgentForge also tracks token usage, run duration, and tool-call details, and surfaces agent performance comparisons through a dashboard with charts. The project is built on Next.js, TypeScript, SQLite with Prisma, and Tailwind CSS, and is currently live on Netlify.
0
ProgrammingDEV Community ·
Observability Explained: Metrics, Logs, and Traces Are Three Distinct Mechanisms
Modern observability is commonly mistaken for an advanced form of logging, but the two differ fundamentally in how data is emitted rather than how it is analyzed. Metrics are counters held in application memory and periodically scraped or flushed, meaning a million requests generate one counter value rather than a million records. Logs function as discrete events enriched with a trace ID that acts as a linking key across services. Distributed tracing works by copying that trace ID into outgoing request headers at each service hop, allowing a backend to later reconstruct the full request path from independently exported spans. Because the trace ID must be propagated at request time, no retrospective log analysis can substitute for instrumentation built into the request path itself.