iiinova — where your digital self keeps evolving

Jonathan Martín @jonimartin.bsky.social · 25/08/2026

AI wrote tests for 20 modules with a real bug. All 20 suites passed. None caught the bug. New writeup: the seven ways a build goes green without doing the work, and the one no static check can see. fervon.dev/veredicto/ai-generated-t… #testing #ai #ci

000

Jonathan Martín @jonimartin.bsky.social · 13/08/2026

Lookspan 0.5.2 is out, and it's the release I'd most want people to take: four security fixes, all of them present in 0.5.1. One capital letter bypassed token auth entirely — Express routes case-insensitively, the guard didn't, and GET /API/traces returned th… #security #release #observability #ai

000

Jonathan Martín @jonimartin.bsky.social · 13/08/2026

I went to verify my own change from a few days ago — I'd moved view-refresh logic into the same handler that raises alert toasts, and had never watched a toast appear in a browser since. That part was fine. 76ms to the toast, 248ms to the refreshed list. Then I ask… #ux #observability #ai #alerts

010

Jonathan Martín @jonimartin.bsky.social · 13/08/2026

Lookspan's HTML audit report is a file that leaves your machine — downloaded, archived, opened later by someone who wasn't there. So I attacked it with five XSS payloads and opened the result in a browser. Nothing executed. The escaping is correct. Then I wen… #testing #security #ai #observability

000

Jonathan Martín @jonimartin.bsky.social · 12/08/2026

Lookspan's cost page shows a total, and under it a breakdown by provider. I checked whether they agreed. total: 0.021 by provider: 0.0135 36% of the bill wasn't in the chart. Nothing on screen said so. The breakdowns dropped every row where the dimension w… #observability #costs #ai #python

000

Jonathan Martín @jonimartin.bsky.social · 12/08/2026

Lookspan is about to publish a release, so I checked something the test suite never had: what happens to an existing database when you upgrade. Installed the published 0.4.1, created a database with it, put a trace in. Opened that same file with today's build. Mig… #migrations #sqlite #testing #ai

000

Jonathan Martín @jonimartin.bsky.social · 12/08/2026

I went looking for XSS in Lookspan's HTML audit report. Five payloads, opened the file in a real browser: nothing executed. The escaping was fine. But reading that code I noticed how days were bucketed: substr(started_at, 1, 10) That's the UTC date. I'm at… #observability #timezones #ai #bugs

000

Jonathan Martín @jonimartin.bsky.social · 12/08/2026

Yesterday I closed CORS on Lookspan so a page on another origin couldn't read the local API. Today I checked whether that was enough. It wasn't. DNS rebinding walks straight past it. The attacker points their domain at 127.0.0.1 after the page has loaded, a… #security #dnsrebinding #localfirst #ai

000

Jonathan Martín @jonimartin.bsky.social · 12/08/2026

Lookspan binds to 127.0.0.1 and calls itself local-first. But your browser reaches your loopback even when the network can't — and CORS was reflecting whatever origin asked. So I served a page from a different origin and pointed it at the API. It read the traces ba… #security #cors #localfirst #ai

000

Jonathan Martín @jonimartin.bsky.social · 12/08/2026

Lookspan's docs say: with --token set, /api/* requires an Authorization header. Express routes case-insensitively. The auth guard asked req.path.startsWith('/api'), which does not. So the guard and the router disagreed about what a path was, and requests fel… #security #express #ai #observability

000

Jonathan Martín @jonimartin.bsky.social · 12/08/2026

Lookspan's README promised telemetry never drags secrets into the database. I attacked that promise with eight realistic secret shapes against a running server. Three were stored in the clear. The redaction scan stopped at six levels deep and returned every… #security #observability #ai #redaction

000

Jonathan Martín @jonimartin.bsky.social · 12/08/2026

Third silent truncation in Lookspan in five review passes. This one was the worst. Before anything reaches the LLM judge it gets cut to 12,000 characters. The cut carried no marker. So a 15,200-character answer arrived at the judge ending mid-word. The judge is ins… #evals #llm #observability #ai

000

Jonathan Martín @jonimartin.bsky.social · 12/08/2026

Lookspan's eval feature runs the first 100 items of a dataset. The panel said 'runs up to 100 items synchronously' — the same sentence whether your dataset had five items or five hundred. Point a 150-item dataset at it and the button offered to run all 150. The… #evals #observability #ai #testing

000

Jonathan Martín @jonimartin.bsky.social · 12/08/2026

I spent an iteration on Lookspan verifying something that turned out to be fine. The Connect page hands a new user eight copy-paste snippets. The docs elsewhere have been covered by a test since the day one of them shipped with an extra brace and wouldn't parse.… #testing #observability #ai #docs

000

Jonathan Martín @jonimartin.bsky.social · 12/08/2026

Lookspan's header said: connected to the live span stream, the dashboard updates in real time. I had never watched it happen in a browser. It wasn't true. The server emitted an event per stored span. The client received them — and used them only to raise alert t… #observability #ai #realtime #sse

000

Jonathan Martín @jonimartin.bsky.social · 12/08/2026

Every accessibility audit I had run on Lookspan used a seeded database. So I finally opened it the way a new user does: empty. Two WCAG AA failures live only on that first screen. A link inside a sentence distinguished by colour alone (1.04:1), and a code chip that… #a11y #observability #ai #wcag

010

Jonathan Martín @jonimartin.bsky.social · 12/08/2026

Tested the most ordinary thing a person can do to Lookspan: double-click the desktop icon twice. The second instance printed 'Lookspan running at 127.0.0.1:3100' and then exited with code 0. On Windows the listen callback fires before the error event, so the… #nodejs #windows #cli #devtools

001

Jonathan Martín @jonimartin.bsky.social · 12/08/2026

Lookspan 0.5.1 is out. Three fixes, and all three came from running the thing rather than reading it: deep links 404ing wherever npm -g puts you under a dot-directory, the trace list naming a trace after one of its children when spans arrive in separate batche… #release #observability #ai #devtools

000

Jonathan Martín @jonimartin.bsky.social · 12/08/2026

Cut Lookspan 0.5.1. Every fix in it came from using the thing, not from reading the code: deep links 404ing on reload wherever npm -g puts you under a dot-directory, the trace list naming a trace after one of its children when spans arrive in more than one bat… #release #observability #ai #devtools

010

Jonathan Martín @jonimartin.bsky.social · 12/08/2026

A user showed me their Lookspan console flooded with one warning per row: invalid span.framework inferbench from DB, using custom. Ingest accepts any non-empty string for a span's framework — that's the whole point, receive from whatever produces spans — but the… #bugs #observability #ai #devtools

000

Jonathan Martín @jonimartin.bsky.social · 12/08/2026

Tested the documented install path for Lookspan's desktop launcher for the first time — it literally could not be tested before, because it refuses to run from the npx cache and there was no published version to install globally until yesterday. Global install, shortcu… #testing #cli #npm #devtools

000

Jonathan Martín @jonimartin.bsky.social · 12/08/2026

Mission Control now installs with one command: npx @fervon/launchpad, run from the folder where you keep your projects. It auto-detects each one (Node, Python, Go, Rust, Deno), launches them on collision-free ports, and streams live logs. Local only: binds… #devtools #opensource #nodejs #localfirst

000

Jonathan Martín @jonimartin.bsky.social · 12/08/2026

A dependency scan pointed at Lookspan's tree, so I went looking at what users actually install and load. The scary-sounding findings all traced to better-sqlite3's install-time toolchain, already patched — npm audit reports zero vulnerabilities across th… #performance #supplychain #nodejs #devtools

000

Jonathan Martín @jonimartin.bsky.social · 12/08/2026

Lookspan 0.5.0 is out. Two of the fixes in it are the reason to upgrade rather than the features: the published bundle from 0.4.1 could not start at all, and the Postgres driver rejected every single write while returning 400 invalid_payload — blaming the caller's… #release #llm #observability #ai

000

Jonathan Martín @jonimartin.bsky.social · 12/08/2026

Yesterday axe-core said Lookspan's dashboard was clean. Today I tried using it with only a keyboard. Both side panels were unusable: opening one left focus on the button behind it, Escape did nothing, and neither announced itself as a dialog. And the Costs vi… #accessibility #a11y #keyboard #webdev

000

Jonathan Martín @jonimartin.bsky.social · 12/08/2026

Ran axe-core against Lookspan's dashboard for the first time. All eight views failed WCAG AA. The biggest one was my own fault: when I reskinned the theme to warm carbon a few days ago, two greys landed at 4.42:1 and 2.54:1 — and both carry real text. The cool… #accessibility #a11y #webdev #design

010

Jonathan Martín @jonimartin.bsky.social · 12/08/2026

Third iteration in a row fixing the same sentence in a different file. Lookspan's Postgres driver runs an embedded engine — it never contacts the host in your connection string and loses data on restart — but every doc said 'same schema, same features',… #documentation #testing #postgres #devtools

000

Jonathan Martín @jonimartin.bsky.social · 12/08/2026

Audited Lookspan's 19 doc pages today. The 'send your first span' curl — literally the first command a new reader runs — had an extra brace and failed to parse. The READMEs had the correct version; the docs site copy had drifted. Same example maintained by han… #documentation #testing #devtools #ai

000

Jonathan Martín @jonimartin.bsky.social · 12/08/2026

Been posting links to Lookspan for weeks. Today I finally checked what the preview card looked like: nothing. The landing pointed og:image at an SVG — no social platform renders SVG in a link preview — and used a relative path, which scrapers don't resolve. The liv… #webdev #opengraph #devtools #ai

000

Jonathan Martín @jonimartin.bsky.social · 12/08/2026

Lookspan advertised an optional Postgres backend. Turns out no write to it had ever worked: ingesting a span nests two transactions, the driver emitted a SAVEPOINT for the inner one, and the embedded engine cannot even parse SAVEPOINT. Worse, the driver… #postgres #testing #databases #observability

000

Jonathan Martín @jonimartin.bsky.social · 12/08/2026

Ran Lookspan's three instrumentation SDKs against a real running instance for the first time — the unit tests all mock the exporter, so nothing had ever confirmed that wrapping a client actually lands a correct span in the database. That's the path every user takes… #testing #llm #observability #ai

000

Jonathan Martín @jonimartin.bsky.social · 12/08/2026

Spent an iteration trying to break Lookspan's operational flags against the actual published bundle, not the source: auth, retention, alerts, custom pricing, CSV export safety. 21 behavioural checks, all correct — nothing to fix. The one failure was my own tes… #testing #observability #ai #devtools

000

Jonathan Martín @jonimartin.bsky.social · 12/08/2026

Two months of 'known flaky' turned out to be one missing file. Lookspan's CI passed on Linux but never locally on Windows: biome flagged all 163 files, and one test suite failed to parse. Everyone (me included) learned to ignore it. It was core.autocrlf rewriting the ch… #devtools #git #testing #ci

120

Jonathan Martín @jonimartin.bsky.social · 12/08/2026

Lookspan's dashboard was scrolling sideways on any narrow window — and the measurement was the useful part: all seven views overflowed by exactly the same 157px. Identical numbers across unrelated pages means the cause is shared, not per-page. It was the seven-item h… #webdev #ux #observability #ai

000

Jonathan Martín @jonimartin.bsky.social · 12/08/2026

Lookspan's three Python SDKs are on PyPI. None of them had ever run in CI — and two of the three had no tests at all. Fixed that, and the tests immediately found two bugs in already-published code: the LangGraph adapter was writing the model name into the provi… #python #llm #observability #testing

000

Jonathan Martín @jonimartin.bsky.social · 12/08/2026

Shipped a one-click desktop launcher for Lookspan: `lookspan install-desktop` registers it as a real app — Desktop + Start Menu on Windows, an .app bundle on macOS, a .desktop entry on Linux. Click it, the server boots and the dashboard opens. Building it surfaced… #llm #observability #ai #devtools

010

Jonathan Martín @jonimartin.bsky.social · 12/08/2026

Lookspan's dashboard now wears the same forge theme as the rest of Fervon: carbon surfaces, ember accents. The interesting bit was the lever — remapping Tailwind's `neutral-*` scale inside `@theme` recoloured ~320 existing classes without touching a single view. Also f… #llm #observability #ai #mcp

000

Jonathan Martín @jonimartin.bsky.social · 17/06/2026

Trace by Fervon: local-first personal memory for your digital life — the Rewind that Meta killed, without recording your screen. Everything stays on your device. Part of the Fervon studio: fervon.dev/trace #privacy #localfirst #memory #productivity

730

Jonathan Martín @jonimartin.bsky.social · 17/06/2026

launchpad: a local launcher that discovers your projects, boots each on its own port (no collisions), and gives you live logs, git status & metrics in one place. MIT licensed. Open source: github.com/JoniMartin27/launchpad #devtools #localhost #opensource #nodejs

010

Jonathan Martín @jonimartin.bsky.social · 17/06/2026

claudescope: a local-first dashboard + full-text search for your Claude Code sessions. Just run npx claudescope-cli — 0 dependencies, 0 network calls, your history stays yours. Open source: github.com/JoniMartin27/claudescope #claude #devtools #cli #localfirst

420

Jonathan Martín @jonimartin.bsky.social · 17/06/2026

inferbench: download, launch & benchmark local LLM engines (llama.cpp & more) from one desktop app. Real tokens/sec on YOUR hardware — no invented numbers. Now serves models over MCP and generates images too. Open source: jonimartin27.github.io/inferbench #llm #localai #benchmark #llamacpp

010

Jonathan Martín @jonimartin.bsky.social · 17/06/2026

Lookspan: local-first observability for AI agents. MCP-native span/trace ingest — see every LLM call, token cost & latency in a dashboard you run yourself. No SaaS, nothing leaves your machine. Open source: github.com/JoniMartin27/lookspan #llm #observability #ai #mcp

1342

Jonathan Martín @jonimartin.bsky.social · 15/06/2026

lookspan keeps shipping: local-first observability for AI agents. Recent: a Postgres driver, a full docs site, relative-time views and reasoning-token pricing. MCP-native, your traces stay local. github.com/JoniMartin27/lookspan #observability #ai

110

Jonathan Martín @jonimartin.bsky.social · 15/06/2026

New tiny tool: claudescope. 'npx claudescope' opens a local dashboard with full-text search over all your Claude Code sessions. Local-first, zero deps, zero network. github.com/JoniMartin27/claudescope #claude #devtools

000

Jonathan Martín @jonimartin.bsky.social · 15/06/2026

Open-sourced Launchpad: a local mission control for your side projects. Auto-discovers and boots each one on its own unique port, with live logs, git status and metrics. MIT, runs at 127.0.0.1. github.com/JoniMartin27/launchpad #devtools #opensource

000

Jonathan Martín @jonimartin.bsky.social · 15/06/2026

inferbench leveled up: a new Serve mode + MCP server. Keep local LLMs resident and expose them to any MCP client — now with local image generation (sd.cpp) and CSV/JSON benchmark export. jonimartin27.github.io/inferbench #llm #localai

000

Jonathan Martín @jonimartin.bsky.social · 15/06/2026

Trace by Fervon is live: a local-first personal memory for your digital life — the 'Rewind' idea, without recording your screen. Everything stays on your machine. Early, but real: fervon.dev/trace #privacy #localfirst

010

Jonathan Martín @jonimartin.bsky.social · 14/06/2026

Today I'm launching Fervon 🔥 — my software studio. A whole portfolio (Trace + open-source dev tools), built with fleets of AI agents. From Latin fervere — to burn. Forged red-hot. fervon.dev #BuildInPublic #LocalFirst #AI

140

Jonathan Martín @jonimartin.bsky.social · 12/06/2026

Just opened GitHub Discussions across my local-first dev tools 👋 Come say hi, request a feature, or tell me what breaks — Lookspan (LLM observability), InferBench (1-click local LLM benchmarks), ClaudeScope (Claude Code analytics) & Mission Control. All MIT,… #opensource #localfirst #devtools #llm

000

Jonathan Martín @jonimartin.bsky.social · 12/06/2026

InferBench update ⚡ one-click benchmark for local LLM engines — TTFT, tok/s, VRAM & quality, measured for real. Now it also generates images locally via stable-diffusion.cpp, plus a Serve mode + MCP server to expose your models. 100% local, no Docker needed. MIT. https:/… #llm #localllm #benchmark

200