ArduPilot's ModeReason enum is the exhaustive list of on-board autonomous decisions: of 56 values, 43 are the aircraft deciding for itself, 21 of those because it detected something dangerous, and exactly one — SOARING_THERMAL_DETECTED — because it found an opportunity. As for end-to-end, PX4 mainline's mc_nn_control has a 10 KB tensor arena and a Kconfig default of n; ArduPilot mainline has none.
Thermal camera prices jump in steps because ECCN 6A003.b.4.b splits control on 111,000 focal-plane elements: 384×288 clears it by 408 pixels, 640×512 is three times over, nothing common sits between, and FLIR prices the Boson 640 at 2.04–2.31× the 320. The Note 3.b carve-out then limits not resolution but focal length — you may have a thermal camera, just not a telephoto one.
The public evidence of a production ramp isn't in the factory but in the government e-procurement system: the fire service's 88 thermal drone sets were priced centrally, six fire departments' first tenders drew no qualifying bidder, all seven awards I pulled equal the budget to the dollar, and the bidder pool is about six firms. A control group added afterwards — aerial ladder trucks, at 0.54 failed-to-awarded versus the drones' 0.33 — refutes this post's original first conclusion: failed tenders are the norm in Taiwanese fire-service procurement.
Grepping all 9,199 lines of Skybrush's open-source light-show firmware for neighbour, collision and swarm turns up nothing: no aircraft knows another exists, and the entire content two hundred of them synchronise is one GPS time-of-week integer plus a millisecond offset, with collision avoidance settled on the ground in the choreography software. Chapter 7 of Taiwan's drone cybersecurity spec — the swarm chapter — leaves the 'drone' column a dash down all twelve items and tests switches and routers instead.
The same 5 kg aircraft on the same 2 kg pack needs 512 W to hover for 41 minutes as a multirotor, or 128 W to cruise for 164 minutes and 197 km as a fixed wing — and that range is independent of cruise speed. A VTOL's cost is not the energy burned in transition (2.4%) but that it carries both a rotor system and a wing, worth about a quarter of the range; Taiwan builds something at every rung from 40-minute electric multirotors to a 6-hour piston helicopter.
Hover power scales with takeoff weight to the 1.5 power while battery energy scales linearly, and that one exponent gap makes added battery hit diminishing returns fast — the optimum battery fraction solves to two-thirds of takeoff weight, independent of rotor diameter, rotor count, efficiency and energy density. What actually caps endurance is payload, not the regulatory weight thresholds: 60 minutes needs a 314 Wh/kg cell, and the best high-rate cell today is 242 Wh/kg.
ExpressLRS derives its hop sequence by running the bind phrase through MD5 into a UID and feeding that to a linear congruential generator — fully reproducible, and I ported it to Python and matched the original C bit for bit — while the link itself has no encryption at all, only a 14-bit CRC. Taiwan's LP0002 then turns channel count into a power ceiling: 75 or more hopping channels at 2.4 GHz allows 1 W, fewer allows 0.125 W.
Analogue FPV video in Taiwan has two separate problems: LP0002's 5.8 GHz window is only 125 MHz wide while the market's standard channel table spans 300 MHz, leaving eighteen of the forty classic channels inside the window once transmit width is counted. The harder one is that §4.10.1.1 recognises only frequency-hopping transmitters at 5.8 GHz, and analogue video is fixed-frequency — it doesn't violate a clause so much as fail to match any clause in the document.
Flying a drone to 28 m in SITL and switching on the simulator's built-in GPS jamming, the flight controller declared EKF failure about seven seconds later, switched to LAND, landed and disarmed — it neither flew away nor crashed. Reading PX4's source then shows that of the 12 gates in EKF2_GPS_CHECK, bit 11, jamming detection, is off by default: the estimator catches jamming on its own, while spoofing can only be reported by the receiver.
After cloning and building both, three things differ from the stereotype: ArduPilot's EKF3 header credits the derivation to PX4/ecl, so the hardest layer is shared; PX4's last year of commits comes from company domains (380 from Auterion alone) while ArduPilot's comes from personal addresses with one contributor at 37%; and what really decides the choice is not performance but BSD-3 versus GPLv3, and which layer you need to modify.
Electronic warfare has one structural limitation: it needs a signal to attack. Fiber-optic control emits no radio, satellite links bypass ground jammers, and AI terminal guidance needs no link at all for the final leg — three methods systematically defeating jamming, which is why defense is shifting toward interception. Taiwan carries an extra layer: a Control Yuan investigation documents the Ministry of National Defense revising its drone response SOP three times in two months, from "may shoot down" to "flare warning only, first shot requires the Minister's authorization" and back to "shoot down with 7.62mm or smaller." That is not a technology problem.
Only four drone occurrences have entered Taiwan's official aviation safety statistics — because the threshold is 'substantial damage to a drone over 25 kg.' A hobbyist crash never enters the count. The two published investigation reports are the same model, the same manufacturer, and the same agency, and both probable causes were hardware failures: main rotor servo electrical failure in one, a fractured tail rotor pitch link in the other. In both, the flight control computer and the operator were explicitly cleared.
The three most important lines on a drone spec sheet are exactly the three lines spec sheets don't print. Taiwan's Drone Cybersecurity Testing Specification defines a product 'series' as units whose flight control, communications, and satellite positioning chip modules are all identical — regulation decides whether two drones are the same drone by those three modules, not by looks or endurance. And the weight field isn't a marketing number either: 250 g, 1 kg, 2 kg, 15 kg, and 25 kg are five separate legal thresholds.
The EU has had a workable path since the end of 2020 — the Specific category grants an operational authorisation based on risk assessment, with U-space Regulation (EU) 2021/664 rolling out on top. The US Part 108 rule was still at OIRA and unpublished as of July 2026. Taiwan doesn't have the framework at all: its regulations offer 'extended visual line of sight' (900m, 400ft, observer required), while true BVLOS runs on per-activity permits valid for three months.
The 2016 consumer drone bubble left specific wreckage: 3D Robotics stopped making hardware, GoPro recalled all 2,500 Karma units six weeks after launch and cut 15% of staff, Parrot cut 35% of its drone workforce, and Lily Robotics collapsed after taking $34M in pre-orders. In 2023 even Skydio — $570M raised — exited consumer, and three years later it is valued at $4.4 billion. This wave runs on a completely different engine, but three things are exactly the same.
The global drone market is roughly US$69B in 2026 (IDTechEx). China holds about 80% of it (CSIS) and DJI over 70% of multi-rotor. The FCC put every foreign-made drone on its Covered List in December 2025; Taiwan's drone output jumped from NT$5.0B to NT$12.9B in one year, and Q1 2026 exports already beat all of 2025. This piece breaks down the five-layer supply chain, the four demand blocks, and the two ceilings holding back scale.
Northeastern tested 17,260 Android apps and found zero activating the microphone. In May 2026 the FTC ruled that Cox Media Group — the company that claimed to be listening — collected no voice data at all and was reselling data-broker email lists, settling for $930,000. The real pipelines are off-site event feedback, lookalike spillover, contact-graph uploads, and location brokers.
Of the 267 companies the Ministry of Economic Affairs counted, 164 are in northern Taiwan. But geography is not division of labor — Thunder Tiger's published bill of materials shows motors, batteries, frames, and propellers sourced locally, while flight control, comms/GPS, and camera modules go to US, European, and Japanese partners. Exports were only 23% of 2025's NT$12.9B output, and 88.1% of export value sits in the 2–7 kg weight band per Ministry of Finance statistics.
Koboyo claims close to 90,000 free hand-drawn SVG icons (the count oscillates: 92,967 → 87,954 → 90,150), but its sitemap only lists about 17,930 icon pages, and its license page explicitly forbids building an icon library or canvas app with them. There are actually three routes to a hand-drawn look: collect a library, bend existing geometry programmatically (sketchyicons turns every straight run in Lucide into a quadratic Bézier, seeded by icon name for byte-for-byte reproducibility), or generate with AI. This piece compares seven libraries on scale and license, unpacks the algorithms behind sketchyicons and tldraw, and surveys the icon search tools now shipping MCP servers.
Take apart the feed ranking of ten platforms and they're all solving the same problem: how to trade off between newest, best, and letting new content be seen. What actually decides your answer isn't how clever the algorithm is, but whether your content is oversupplied or scarce — big platforms rank to filter content out, small communities want every post to be seen.
Most teams don't need five databases. PostgreSQL's extension ecosystem covers caching, queues, full-text search, and vector search — but the real decision isn't 'can it do it' but 'where does ops cost cross performance needs.'
@playwright/mcp uses an accessibility tree instead of screenshots, cutting token cost by 10–50x — the best default for AI agents doing web automation. Puppeteer MCP fits screenshot-heavy tasks. Direct CDP via MCP is for low-level tooling or domains that Playwright/Puppeteer don't expose.
Chrome DevTools MCP wraps Chrome DevTools Protocol (CDP) as an MCP server, giving AI agents direct access to 40+ CDP Domains including Profiler, HeapProfiler, and Security that Playwright and Puppeteer MCP don't expose — at the cost of having to implement MCP tool definitions and auto-wait logic yourself.
@playwright/mcp defaults to an accessibility tree (browser_snapshot) instead of screenshots, cutting token consumption by 90%+. Combined with Playwright's native auto-wait, it's the best starting point for AI agents doing web automation.
server-puppeteer is the Puppeteer wrapper in the official MCP servers monorepo — seven lean tools built around screenshots and evaluate. Token cost is significantly higher than @playwright/mcp per interaction, but it fits well when the screenshot itself is the deliverable or custom JS execution is the core need.
AI agents running tests are non-reproducible; hand-written Playwright is hard to maintain. Four tools that emerged in 2024-2025 each tackle this dilemma with very different design philosophies.
A Go read-only scanner open-sourced by Perplexity in May 2026 (v0.1.1, zero non-stdlib dependencies). It inventories npm/PyPI/Go/RubyGems/Composer/MCP/editor and browser extensions into NDJSON, matches against a custom exposure catalog, and answers the question 'which machines in my fleet are currently affected' the moment a supply chain incident hits. It deliberately never invokes any package manager and is not an EDR.
When mobile Chrome keeps redirecting back to the login page after sign-in, the culprit isn't always OAuth or broken frontend state. In this case, the root cause was that the HTTP entry point for app-dev.daodao.so wasn't issuing a 301 redirect to HTTPS, so /auth/me requests sent with an http origin didn't include the auth_token cookie.
Antigravity CLI is a terminal agent Google announced at I/O on May 19, 2026. Written in Go (versus Gemini CLI's Node.js), its binary is called agy, and it shares the same agent harness as the desktop Antigravity 2.0. It is also Gemini CLI's successor — the personal-tier Gemini CLI service ends on June 18, 2026.
Rewriting tool descriptions from soft suggestions to hard rules (whitelist + consequence explanation) eliminated the LLM's incorrect tool selection; adding skip_signal=True fixed vector store double-indexing.
/loop is Claude Code's native cron feature — set schedules in plain English and let Claude monitor, auto-fix PRs, and run recurring tasks in the background. Session-scoped and expires after 7 days; for cross-session scheduling, use Routines or Desktop scheduled tasks.
Routines is Claude Code's cloud automation system (formerly Cloud Scheduled Tasks). Beyond cron scheduling, you can trigger runs via API endpoint or GitHub events — scan issues, review PRs, run checks, open PRs — all while your computer is off.
Two answers stand out for remotely accessing your home Mac in 2026: Cloudflare Tunnel if you need browser-based access with no client install, and Tailscale if you just want something simple for personal use. This post compares both, covers ZeroTier, Pangolin, NetBird, and other alternatives, and explains why Cloudflare's remotely-managed tunnel makes setup significantly easier in 2026.
Warp evolved from a Rust-powered modern terminal into an AI Agent-integrated development environment (ADE), open-sourced under AGPL in April 2026, with over 700,000 developer users.
DeerFlow is ByteDance's open-source Super Agent Harness built on Python 3.12 + LangGraph. It orchestrates long-running tasks through sandboxes, long-term memory, sub-agents, skills, and a messaging gateway. It hit #1 on GitHub Trending in February 2026, now surpassing 63,000 stars, with support for Telegram/Slack/Feishu, Claude Code integration, and multiple search backends.
NotebookLM has no official API. This extension works by combining three techniques: reverse-engineered Google batchexecute RPC calls, DOM scraping, and cross-tab message passing.
The main backend runs on a remote HTTPS server, so the auth_token cookie is scoped to that domain. The browser never sends it to the local AI backend, causing the API to treat every request as unauthenticated.
env.AI is not just run(). It also exposes toMarkdown (document-to-Markdown conversion), autorag (managed RAG), gateway (external provider proxy), and models (metadata lookup). Understanding these four method groups is what unlocks Cloudflare as a full AI platform inside Workers.
Better Agent Terminal (BAT) is an Electron desktop app that unifies multiple project workspaces, terminals, and Claude Code Agents into a single window — solving the everyday pain of exploding iTerm tabs and the lack of a proper GUI container for agents. MIT License, available on macOS, Windows, and Linux.
Claude Code only reads CLAUDE.md; Codex only reads AGENTS.md. Teams using both end up maintaining two identical files. Fix: make CLAUDE.md a symlink pointing to AGENTS.md — one source of truth.
Skill paths are almost always runtime-specific. AGENTS.md is the reliable way to share rules across agents. Put personal reusable capabilities in each agent's supported global directory; put project workflows inside the repo.
code-review-graph uses Tree-sitter to parse your codebase and build a persistent knowledge graph, tracks the blast radius of changes, and feeds only truly relevant context to the AI — claiming an average 8.2x reduction in token usage.
GitBook is a Git-based documentation platform with Markdown editing, version control, and multi-user collaboration. Ideal for technical docs, API references, and internal knowledge bases. The free plan is sufficient for individuals and small teams.
The NVIDIA DGX Spark is powered by the GB10 Grace Blackwell Superchip, 128 GB of unified memory, and delivers 1 petaFLOP of FP4 compute — starting at around $3,999 USD. It lets developers run 200B-parameter models locally and fine-tune 70B models, making it the most accessible NVIDIA AI development platform available today.
A breakdown of nine major documentation platforms — their positioning, pros, cons, and ideal use cases. Decision logic: open-source projects → Docusaurus/VitePress, API docs → Mintlify/ReadMe, internal enterprise → Confluence, fastest to launch → GitBook.
Claude Code is Anthropic's agentic coding tool that runs in the terminal, IDEs, Slack, GitHub, and on the web. Its core extension system has six layers: CLAUDE.md (persistent context), Skills (on-demand workflows), Hooks (deterministic automation), Subagents (isolated delegation), MCP (external tool connections), and Agent Teams (multi-agent collaboration).
Codex CLI is OpenAI's open-source terminal coding agent built in Rust. It supports MCP, subagents, image input, and code review. Paired with the codex-1 (o3-optimized) or GPT-5-Codex model, it can read, write, and execute code directly on your local machine.
Gemini CLI is Google's open-source terminal AI agent (Apache 2.0). ⚠️ Announced end-of-service on 2026/06/18 — official migration path is Antigravity CLI. Free accounts get 60 requests/minute and 1,000 requests/day; Skills, Hooks, and Subagents all carry over.
OpenCode is an open-source AI coding agent built in Go (95K+ GitHub stars) with a built-in TUI, support for 75+ LLMs, LSP integration, Vim-style editing, and SQLite session management. Free, no subscription required — works with local or cloud models.
Pi is a minimalist coding agent built in TypeScript by Mario Zechner, featuring just 4 core tools (read, write, edit, bash) and a 300-word system prompt. It's extensible via Extensions, Skills, and Prompt Templates, runs on the Bun runtime, and ships with built-in Ollama support via `ollama launch pi`.
When processing requests, Claude Code randomly displays one of 185 built-in verbs (like Thinking, Brewing, Clauding), then picks one of 8 completion verbs with elapsed time. You can customize these via spinnerVerbs in settings.json, using either replace or append mode. All data in this post is verified directly from cli.js source code.
gstack is Garry Tan's open-source Claude Code skills toolkit. Its 20 specialized skills transform a solo developer into an entire engineering team — automating everything from product planning and design review to code review, QA, and deployment.
Standard Playwright gets blocked by Cloudflare. Both playwright-extra + stealth and nodriver can bypass it. The final step is wrapping the solution into an MCP server so AI agents can use it automatically.
In a climbing RAG system, 'recommend the next route' (progression) and 'recommend a similar route' (similarity) were conflated by a single hasSimilarRouteIntent() function, causing recommendation quality to collapse. The fix is a two-stage intent classification with a Regex Fast Path + LLM Fallback.
The RAG system's extractRouteReference() used a for...return pattern that grabbed only the first match — so when a user provided five completed routes, only one was used. The fix evolves through three layers: rule-based multi-entity extraction, user profile aggregation, and embedding centroid.
Query: 'I just sent Beauty in the Mirror 5.11b — recommend routes of similar difficulty.' The results came back full of routes with similar-sounding names, not similar grades. Root cause: dense embeddings compress multiple attributes into a single vector, and the rarity of the route name drowns out the grade signal. The fix: three layers of defense — metadata pre-filtering, query rewriting, and score fusion.
Biome does the work of ESLint + Prettier in a single tool, running 10–20x faster with far less configuration. DaoDao uses it across an entire monorepo — lint and format in one pass.
AEO (Answer Engine Optimization) is a content strategy aimed at AI search engines like Perplexity, ChatGPT Search, and Google AI Overview. The core idea is to make your content the easiest source for AI to cite — not just another link in the results page.
SEO is more than keywords. Structured data (JSON-LD), Open Graph, hreflang, and robots.txt are the technical optimizations that actually help search engines understand your content. This guide walks through a complete implementation using an Astro blog as the example.
BullMQ is the most mature job queue in the Node.js ecosystem, backed by Redis, with support for priorities, retries, scheduling, and delayed jobs. DaoDao uses it to handle notification delivery and practice auto-completion scheduling.
Celery is Python's go-to distributed task queue, using Redis or RabbitMQ as a broker to offload long-running work to the background. DaoDao's AI service uses it to handle async tasks like LLM feedback generation.
Global skills live in ~/.claude/skills/, but they go missing in new sessions or the Desktop App? The problem usually isn't a missing file — it's that the skill descriptions aren't being loaded into context. This post clarifies the CLI vs Desktop App differences, the role of settings.json, and the most reliable fix.
ClickHouse is a column-oriented OLAP database that scans hundreds of millions of rows in seconds. DaoDao uses it to record user behavior events for the AI recommendation engine's feature engineering, letting PostgreSQL focus on transactional data.
D1 is Cloudflare's serverless SQLite database that binds directly to Workers, supports full SQL (JOINs, transactions), and handles automatic backups. It's well-suited for small-to-medium relational data needs — NobodyClimb uses it as its primary database.
KV is Cloudflare's globally distributed key-value store. Reads are served from the nearest edge node with extremely low latency. It's ideal for caching, feature flags, and ephemeral data — but writes are eventually consistent.
R2 is Cloudflare's object storage service — S3-compatible API, zero egress fees, and native Workers binding. Stop worrying about bandwidth bills for media-heavy applications.
Cloudflare Workers uses V8 Isolates instead of containers — no cold starts, global edge deployment, and direct access to D1, R2, KV, and AI via Bindings. Great for APIs, SSR, and lightweight backends; not suited for long-running tasks.
Docker lets you bundle your application together with its environment, eliminating the 'works on my machine' problem. Combined with multi-stage builds and Compose, it's an essential tool for modern backend deployment.
Expo turns React Native development from 'environment setup hell' into a state where you can just start writing logic. Expo Router brings file-based routing that dramatically lowers the barrier for web developers making the switch. Both DaoDao and NobodyClimb use it to ship across iOS and Android.
Express is the most mature Web framework for Node.js, with a rich middleware ecosystem and abundant learning resources. Paired with TypeScript and a clear layered architecture, it remains a justifiable choice in 2026.
FastAPI is a modern Python web framework built on type hints — it auto-generates OpenAPI docs, supports native async, and delivers performance close to Node.js. It's the top choice for AI/ML services and the most worthwhile framework to learn in the Python backend ecosystem.
GitHub Actions is the lowest-friction CI/CD tool available today, ideal for small-to-medium projects. The key to monorepos is using path filters so only affected apps trigger a build.
Hono is a web framework designed specifically for edge runtimes like Cloudflare Workers, Deno, and Bun. It's an order of magnitude lighter than Express, natively supports Web Standard APIs, and is the go-to choice for edge environments.
Next.js 15 + React 19's App Router shifts rendering responsibility from the client to the server. use cache ties caching logic directly to data functions instead of scattering it across fetch options. Both DaoDao and NobodyClimb chose this stack for very practical reasons.
@opennextjs/cloudflare enables Next.js 15 App Router deployments on Cloudflare Workers — dynamic SSR runs in a Worker, static assets are served from Cloudflare Assets. Zero server management, but with clear feature limitations.
PM2 keeps your Node.js app running on a server — auto-restarts on crash, supports cluster mode to max out CPU cores, and handles log management. Nearly every Node.js app deployed on a VM or VPS needs it.
Prisma's schema-first design gives you versioned migrations, full TypeScript types on every query, and intuitive relation handling. The tradeoff is a learning curve and the inherent limits of any ORM abstraction — but for most TypeScript projects, it's a worthwhile deal.
React Hook Form handles form performance, Zod defines the validation schema — together they eliminate nearly all form boilerplate. Share a single Zod schema across a monorepo and you get one source of truth for both frontend and backend validation.
Redis is an in-memory key-value store that's blazingly fast. DaoDao uses it to handle three responsibilities at once — API caching, session storage, and BullMQ job queues — all from a single Redis instance.
shadcn/ui is not an npm package — it copies component source code directly into your project, giving you full ownership. DaoDao uses it to build packages/ui, a shared component library used across three Next.js apps.
TailwindCSS's core value is solving CSS's global namespace pollution and dead code problems. Utility classes keep styles co-located with components, and unused classes are automatically purged at build time — production CSS bundles typically come in at just a few dozen KB. Both DaoDao and NobodyClimb use it for web styling.
Tamagui is a UI framework built for React Native with a complete design token system, theme support, and compile-time optimization that moves style computation to build time. NobodyClimb chose it over NativeWind primarily because its cross-platform token system is more robust.
Managing API data with useState + useEffect means reinventing the wheel — and doing it worse. TanStack Query handles caching, background updates, and loading/error states so you can focus on UI logic.
Turborepo solves monorepo build speed problems; pnpm workspaces solves dependency sharing. Together they are the best choice for JS/TS monorepos today.
TypeScript types only exist at compile time — they vanish at runtime. Zod lets you validate external data at runtime while inferring TypeScript types from the same schema. One definition, two jobs done.
No Provider, no reducer — global state in just a few lines. NobodyClimb uses it for auth and UI state, paired with TanStack Query for server state.
Use OpenSpec to break requirements into engineering tasks, Claude Code to implement them, hooks to auto-format and protect, local review before committing, three AI reviewers running in parallel on PR, and auto-deploy after merge. This entire workflow lets one person maintain quality across six sub-projects.
Hooks are Claude Code's event system. They trigger shell commands, HTTP requests, or LLM evaluations automatically before/after tool execution, when a prompt is submitted, or when a task ends. Use them to block dangerous operations, run automated reviews, inject context, or write audit logs.
A Skill is an SOP written for AI. Define the steps in a Markdown file and Claude follows them. No coding required, no frameworks to learn — just write down what an experienced person would do.
Stuck mid-debug and can't fix it right now? Use /file-bug-issue to package the error analysis, reproduction steps, and attempted fixes from your conversation into a well-structured GitHub issue. Pair it with a Remote Agent to let AI automatically take over the fix.
Using Claude Code's Scheduled Remote Agent, automatically scan GitHub issues every 2 hours, implement features, open PRs, and address review feedback — no human intervention required. Humans only write issues and click merge. Pair it with the custom /publish-tasks skill to push OpenSpec engineering tasks directly to GitHub issues.
Hooks are automated safety nets (blocking bad commits), Skills are interactive workflows (running checks + auto-fixing), and instruction files (CLAUDE.md / AGENTS.md) are behavioral guidelines. Each layer operates independently, but together they enable an AI agent to automatically run lint, typecheck, and build checks before every commit.
Three main classification systems dominate: Conventional Comments (label-based), Google's severity prefixes (Nit/Optional/FYI), and SonarQube's four quadrants (Bug/Vulnerability/Code Smell/Hotspot). AI review tools have each developed their own taxonomies, but the core dimensions consistently converge on four areas: correctness, security, performance, and maintainability.
Upgraded action-maker from hardcoded mock data to live Cloudflare Workers AI generation. The architecture splits into Worker (AI only), Server (data storage), and Frontend (orchestration). Hit two gotchas along the way: Qwen3's thinking block and the Workers AI response format.
When reviewing vulnerability scan results for a Node.js Docker image, you can't just look at package names. First distinguish between project dependencies and the packages bundled with npm inside the base image — otherwise you'll fix the wrong thing.
Vulnerability scanning isn't just about generating reports — it helps you discover known risks in your system before they become incidents. This post uses Trivy as a hands-on example to explain what scanners actually look for, how to read the results, and how to get started.
Wrap a local Python script into an MCP Server using FastMCP so Claude Code can call it directly — no more manually running pipelines.
The MCP tool was returning a description field that caused 1,033 job listings to exceed the token limit. The fix: exclude description by default and add pagination.
docker restart does not recreate the container, so changes to volumes in docker-compose.yml only take effect after running docker-compose down && up.
Claude Code has five permission modes: default (confirm each step), acceptEdits (auto-accept edits), plan (read-only planning), auto (background AI classifier review), and bypassPermissions (YOLO, skip everything). Switch with Shift+Tab or configure via settings.json. Auto mode is the sweet spot — no step-by-step confirmations, but with safety guardrails.
Service names aren't resolvable across Compose projects — you need to add a network alias so nginx can find the container.
A hands-on log of installing Superpowers (packaged by DwainTR) for Copilot CLI on a local machine — including the diagnostic process when skills didn't appear after installation, the fix, and practical tips.
Cross-project DNS resolution requires container_name or a network alias — and only aliases support horizontal scaling.
A brief error during nginx restart caused Cloudflare to mark the origin as unhealthy and stop forwarding requests, returning 502 on its own. The key clues: localhost hits to the origin return 200, and nginx access logs are completely empty. Just wait for Cloudflare to automatically re-check the origin — it recovers on its own.
A monolithic nginx.conf becomes unwieldy as services grow. Splitting it into per-service files under conf.d/ via include is the standard solution.
When nginx uses the `set $variable` pattern for dynamic upstreams, the DNS cache expires every 30 seconds — the first request after expiry hits a 502 because no IP is available. Upgrading to nginx 1.27.3 and switching to an upstream block with the resolve parameter fixes this: DNS updates happen asynchronously in the background.
Once SSH config is set up, scp works directly with aliases — no need to type out the full IP every time
Ghostty is a fast, native, general-purpose terminal emulator. cmux is a terminal built on top of Ghostty, specifically designed for AI coding agents. They're not competitors — they operate at different layers.
Cloudflare Custom Error Pages require a paid plan. On the Free Plan, use a Worker with inline HTML to intercept 5xx responses instead.
Use includeIf + SSH Host aliases to let Git automatically switch accounts based on directory path — no more manual switching.
Even when a route has prerender = true, Cloudflare Workers' Rollup bundler still attempts to bundle native modules, causing the build to fail. The fix is to move any native module work into a postbuild script.
Astro scoped CSS appends a scope hash to each selector, but elements rendered by <Content /> don't receive that hash — causing all prose styles to silently break.
After finishing a debug session, just say 'write this up as a post' — Claude Code extracts content from the conversation, applies a template, generates frontmatter, and commits it to the repo. No extra writing required.
In wrangler.jsonc, use custom_domain: true in routes with only the hostname as the pattern — no /* wildcard
Next.js + Expo frontend, Node.js + Python dual backend, PostgreSQL + Redis core — plus a social notification system and LLM recommendation engine. Here's how DaoDao builds a learning community platform with a modern tech stack.
A climbing community platform where the web app, mobile app, and AI Q&A all run on Cloudflare — no dedicated servers.
A dynamically composable RAG pipeline built on Cloudflare Workers AI (gemma-3-12b-it + bge-m3): 14 base steps + 6 LangGraph-specific nodes, with three strategy graphs (Baseline / Agentic / Plan-Execute) selected at runtime.
Switching templates means replacing the entire project foundation. Figure out what you actually need first, then choose between AstroPaper, Cactus, or AstroWind.
Astro + the full Cloudflare suite — static-first, edge-computed, zero maintenance cost