iiinova — where your digital self keeps evolving

what I was doing (using TS for security) was not common at the time, so it was understandably not so much of an easy sell but AI agent guardrails use this now successfully to prevent these types of security holes

010

Karl Horky @karlhorky.com · 18h

@lirantal.com @notwes.bsky.social circling back around to this after a while in the AI agentic era, there have been new tools that also follow a similar pattern to using TS as a security tool if you ask your agent, i'm sure you'll find a lot more precedent of this eg github.com/rauchg/gdp-ts

Middleware only authenticates. The check happens in the route body, right where its result is needed, and disablePasswordProtection does not compile without it.

110

Karl Horky @karlhorky.com · 26/08/2026

introducing the `code-comments` skill: clearer, more deterministic code comments why: AI mostly writes in horrible, unclear, twisted ways (esp Claude) and that slop is saved in your codebase code comments, w. human + AI comprehension costs npx skills add karlhorky/agent-skills

https://github.com/karlhorky/agent-skills/pull/2

Add code-comments skill

karlhorky

3 hours ago

Comments written by AI agents often:

lead with the mechanism rather than the reason (the "what" instead of the "why")
bury the failure being avoided ("bury the lede")
use vague nouns or identifiers from another layer
repeat column or field names instead of describing stored values
The code-comments skill defines three forms:

an action opening with an imperative verb
a fact opening with the system or entity it describes
a column or field description written as a noun phrase
Actions use <verb> <noun> <reason>, except when the action and nearby code make the reason clear. Comments put affected records or entities near the start for faster debugging and use identifiers from the surrounding code so they remain searchable.

The skill also covers failure-first comments, matching TSDoc and CREATE TABLE descriptions, comment prefixes, and long background comments.

Add action,

https://github.com/karlhorky/agent-skills/blob/main/.agents/skills/code-comments/SKILL.md

Code Comments
Overview
Write comments for what the code does not express, usually a reason or behavior. Most comments take one of three forms:

Action: start with an imperative verb
Fact: omit the action and state a reason or behavior with its subject first
Description: use a noun phrase for what a database field or TypeScript property stores
Write actions as <verb> <noun> <reason>. Common words before an explicit reason include because, so, so that, to and for.

Exceptions:

Omit <reason> only when the action and nearby code make it clear
Use one sentence with no trailing period, wrapping it across lines when needed. Use multiple paragraphs only when the comment requires background.

Announce at start: "I'm using the code comments skill."

Examples of Code Comments
Start actions with an imperative verb
Example 1: omit a reason clear from nearby code
Good:

-- Sort optional lectures after other r

Put debugging details first for scannability
Comments are often read while debugging, so two things are critical for speed of scanning:

1. The first word of the comment
2. The words near the start of the comment
Start actions with a verb followed by affected records or entities. Start facts with affected records or entities. Put generic conditions and reasons afterward.

Example 1: action verb directly followed by affected records
Good:

-- Exclude Tech Fundamentals Foundations (Immersive) cohorts, which
-- never had graduation events, so their certificates have no end
-- date to print
Example 2 (bad): put a generic condition first
Bad:

-- Return no certificate for Immersive cohorts with no graduation event,
-- because there is no end date to print - currently only Tech
-- Fundamentals Foundations (Immersive) cohorts
Why bad:

- Names the affected cohorts on the last line
- Starts with a generic condition that does not identify the affected cohorts

220

Karl Horky @karlhorky.com · 20/08/2026

but I understand that Netlify may want something like Mise to also manage other package manager versions like npm, Bun, Deno, vlt, etc looks like it supports devEngines.packageManager (and the older packageManager) mise.jdx.dev/configuratio....

mise.jdx.dev

Configuration | mise-en-place

mise-en-place documentation

100

Karl Horky @karlhorky.com · 20/08/2026

nice, thanks! seems to have a lot of great AI writing tells (although I actually prefer dense writing with fewer characters, so I won't apply this skill wholesale) but I've bookmarked it - maybe I'll grab some things next time I make some edits to my agents.md or try adding a skill

010

Karl Horky @karlhorky.com · 19/08/2026

still trying to get Claude Code (Opus 5, but all Anthropic models are like this) to be more grounded in reality and less persuasive / rhetoric-heavy the responses are by default so unstructured and void of proof / verification push a little bit against the rhetoric and "You're absolutely right!"

https://github.com/karlhorky/dotfiles/blob/393f4d4149db43af38f04210d9d80a0de1c88cb4/settings/.codex/agents.md?plain=1#L49-L56

# Reasoning

- avoid rhetoric in your reasoning: report like a lab notebook, not an argument
- show the command / code and its output for every factual claim
- tables or other illustrative instruments which summarize data are nice, but they never replace the data behind them - show both the summary and the cited data
- when you haven't verified something, mention:
- you haven't verified yet
- you're guessing / inferring
- the next steps for verifying
- drop persuasive language in headlines and body text: `Verdict:`, `Why X is wrong`, conclusions with no accompanying data

131

Karl Horky @karlhorky.com · 18/08/2026

TypeScript overlays in MDX files 😍 Using TS 7.x Content Mappers by @andrewbran.ch 🙌

0180

Karl Horky @karlhorky.com · 12/08/2026

ahh @github.com is removing "Close" notifications?? 😬 notifications are already bad enough, making them worse? submit your feedback here: github.com/orgs/communi...

August 10, 2026 • 1 minute read
Custom thread subscriptions are being deprecated

You’ll no longer be able to configure custom thread subscriptions for GitHub notifications.

300

Karl Horky @karlhorky.com · 12/08/2026

new proof of concept script: diagnostics from Next.js TypeScript language service plugin on the command line 😍 (also in CI) like `astro check` or `vue-tsc` or `mdx-tsc`

https://github.com/karlhorky/next-js-tricks#check-nextjs-typescript-plugin-diagnostics-in-terminal

Check Next.js TypeScript Plugin Diagnostics in Terminal
Next.js includes a custom TypeScript plugin for diagnostics such as missing types on metadata exports. However, the plugin diagnostics are not reported by tsc or a next CLI subcommand.

The TypeScript team have up until now (August 2026) rejected the feature request that tsc execute TypeScript language-service plugins:

microsoft/TypeScript#16607
To report the Next.js plugin diagnostics in the terminal and CI, install @typescript-eslint/project-service:

pnpm add --save-dev @typescript-eslint/project-service
Make sure the existing tsconfig.json enables the Next.js plugin:

{
"compilerOptions": {
"plugins": [{ "name": "next" }]
}
}
Add the following script:

scripts/next-tsc.ts

...

VS Code showing the Next.js metadata TS71008 warning and next-tsc exit code 1

GitHub Actions failing on the Next.js metadata TS71008 warning from next-tsc

220

Karl Horky @karlhorky.com · 10/08/2026

another of my weird code review habits check PR changes (even for your PRs) - if not self-explanatory in PR context, make line comments on what/why benefits: 1. finds many logic errors + overengineering 2. returning to PRs later offers extra context both for AI and people

playwright/leadSeesMatchingDesignAndContent.spec.ts

```diff
// after Reach UI Tabs hides some images
// - https://github.com/microsoft/playwright/issues/31737#issuecomment-2233775909
- await expect(lazyImagesLocator).toHaveCount(23);
+ await expect(lazyImagesLocator).toHaveCount(26);
```

@karlhorky
add 3 lazy-loaded SVG <Image /> (next/image) on homepage

packages/database/tables/0150-quizzes.ts

```diff
- typeId: QuizType['id'];
+ curriculumVersionId: CurriculumVersion['id'];
+ quizTypeId: QuizType['id'];
```

@karlhorky

switch from `type_id` to `quiz_type_id` to match existing foreign key naming patterns

110

Karl Horky @karlhorky.com · 07/08/2026

that kind of day ... where a React key warning in your app leads you to discover a bug in React 🤯 github.com/react/react/...

https://github.com/react/react/issues/37240

Bug: False-positive missing key warning when Flight outlines a static child

#37240
Open
Description
@karlhorky
karlhorky
opened 5m ago
Contributor
React version: 19.2.8

Steps To Reproduce
Open /repro and observe the Each child in a list should have a unique "key" prop. error message in the browser console.
Compare with /control, which reduces the preceding serialized prop from 4000 to 2500 characters.

020

Karl Horky @karlhorky.com · 07/08/2026

hmm, maybe someone has already explored first-party semantic diff drivers for Git? (per language and framework) has anyone seen anything like this?

010

Karl Horky @karlhorky.com · 07/08/2026

I can follow, that they are different ASTs what do you mean to say with that? or did you not mean to draw any deeper conclusion?

100

Karl Horky @karlhorky.com · 07/08/2026

Kind of related: Michael Montalbo has a recent Git RFC for external "hunk providers", eg. for tools like Difftastic 👀 This isn't about built-in 1st-party semantic diff drivers though lore.kernel.org/git/pull.212...

lore.kernel.org

Making sure you're not a bot!

110

Karl Horky @karlhorky.com · 07/08/2026

Even with all of these new code review tools lately, we still have diffs like this on GitHub (even SemanticDiff can't ignore the {' '} diff) Wonder if these belong in Git as semantic diff drivers per language/framework 👀 so diffs everywhere can ignore these 🤔

- {formField.label} {formField.required && <Asterisk />}
+ {formField.label}{' '}
+ {formField.required && <Asterisk />}

- <option key={`option-${option}`} value={option}>
+ <option
+ key={`option-${option}`}
+ value={option}
+ >

450

Karl Horky @karlhorky.com · 05/08/2026

Naming is hard So try to avoid naming things as much as possible - use existing names, from the language, framework, external APIs, etc One of my latest additions to AGENTS . md github.com/karlhorky/do...

000

Karl Horky @karlhorky.com · 03/08/2026

Not yet, but we're a small team so it's easy to communicate this process Other things that can also help: - keep the PR as draft until there are real implementation commits and it's ready for review - organize your work so that you can quickly push a real commit (ideally amending the empty commit)

110

Karl Horky @karlhorky.com · 30/07/2026

3. AI and humans can quickly look up the spec / plan details in PRs and see them in the context of the repository history

100

Karl Horky @karlhorky.com · 30/07/2026

Benefits: 1. Avoids the double work of creating the spec / plan and also the PR title and description (since you need the PR details anyway) 2. Keeps the spec / plan close to the proposed change (the PR), rather than in separate, disconnected specs/plans folder

100

Karl Horky @karlhorky.com · 30/07/2026

Lightweight AI planning (avoiding a "plan" or "spec" which easily gets out of date): Start PRs with an empty commit + include all of the planned tasks in PR title and description (using checkboxes) Then keep this up to date and check off the points as you / AI implement github.com/karlhorky/do...

https://github.com/karlhorky/dotfiles/blob/main/settings/.codex/agents.md?plain=1#L4-L12

# GitHub

- opening PRs
- always make user review title and description before starting work
- as usual: create a branch
- create an empty commit with a title with the prefix `Add initial empty commit`
- as usual: push the branch to GitHub
- propose 3 possible PR titles along with 1 possible PR description, following your PR title and description rules
- ask the user for approval
- after any iteration and approval, create a PR with the approved title and description
- once you're ready to commit the first time, amend the empty commit and force push

231

Karl Horky @karlhorky.com · 17/06/2026

Security: VS Code 1.125 finally has a delay for auto-updates of extensions 👍 // Delay extension updates for 7 days "extensions.autoUpdateDelay": 168, Prompted by the recent security breaches and over 300 upvotes on my feature suggestion code.visualstudio.com/updates/v1_1...

VS Code release notes blog post showing a new setting:

Configurable extension auto-update delay
Setting:
extensions.autoUpdateDelay
This setting is managed at the organization level. Contact your administrator to change it.ORG
To give you more control over when extension updates are installed, you can now configure a delay for automatic extension updates. This builds on the delayed extension auto-updates feature introduced in the previous release.

Use the
extensions.autoUpdateDelay
This setting is managed at the organization level. Contact your administrator to change it.ORG setting to configure the delay in hours. By default, VS Code waits two hours before installing extension updates. The delay only applies when auto-update is enabled.

issue on GitHub:

"Security: minimumReleaseAge setting for mitigating supply chain attacks on extensions" by @karlhorky

which received 334 upvotes

111

Karl Horky @karlhorky.com · 17/06/2026

And thanks to my co-MCs @jessiebellehooks.bsky.social @tolin.ski @w3cj.com for helping entertain 🙌

000

Karl Horky @karlhorky.com · 17/06/2026

Thanks for letting me intro and grill you afterwards with questions too 😃 Noah Yamamoto, @paolo.ricciuti.me, @joyeecheung.bsky.social, @erickwendel.bsky.social, @tkdodo.eu, David Mark Clements

220

Karl Horky @karlhorky.com · 17/06/2026

Had a great time MCing at @jsnation.gitnation.org 2026 in Amsterdam! Great to see all the friends and make new connections Thanks to the organizers at @gitnation.bsky.social , and everyone else who helped organize, spoke and otherwise joined the event! #JSNation

Hall full of people at JSNation 2026 in Amsterdam

Karl Horky MCing on stage at JSNation 2026 in Amsterdam

Karl Horky asking questions to Erick Wendel on stage at JSNation 2026 in Amsterdam

100

Reposted by Karl Horky

Vite @vite.dev · 04/06/2026

Today, VoidZero joins Cloudflare. Vite remains MIT, vendor-neutral, and stewarded by the same wider team. The same goes for Vitest, Rolldown, and Oxc. Cloudflare is also committing $1M to an OSS fund to support independent development in the Vite ecosystem.

vite.dev

Cloudflare supports Vite's mission

The VoidZero team is joining Cloudflare. Vite remains MIT, vendor-neutral and stewarded by the same wider team.

521238

Karl Horky @karlhorky.com · 02/06/2026

Looking forward to MCing at JSNation Conf 2026 in Amsterdam next week 🚀 As a preview, here's multiple badly-generated AI photos of me on stage, which don't look like me at all hint: I like talking about AI slop / AI fails ✨ and how we can do better See you all there!

bad AI-generated photo of Karl, wrong eyes, wrong face

bad AI-generated photos of Karl on stage as a giant, pointing down at people

bad AI-generated photos of Karl on stage as a giant, sitting in the air on nothing, with spotlights shining down on him

120

Reposted by Karl Horky

Jiahan Chen @chenjiahan.bsky.social · 26/05/2026

Do you know that using GitHub CLI (gh) may expose you to supply-chain attacks? It stores a long-lived GitHub token on your machine, which can be stolen by any malicious scripts. This is what happened in the recent Nx supply-chain compromise, which led to GitHub’s source code being leaked.

2347

Karl Horky @karlhorky.com · 19/05/2026

Come and join us at Jetbrains for the next AmsterdamJS, with some TC39 members 🙌

080

Karl Horky @karlhorky.com · 17/05/2026

VS Code extension Security: I proposed a setting in VS Code to limit extension installs to versions older than X days This is to mitigate supply chain attacks, similar to pnpm's minimumReleaseAge github.com/microsoft/vs...

Security: minimumReleaseAge setting for mitigating supply chain attacks on extensions #316867

In the last years, supply chain attacks have increased dramatically. A few examples in the VS Code extension ecosystem:

- AI-Slop ransomware test sneaks on to VS Code marketplace - BleepingComputer
- Malicious VS Code AI Extensions With 1.5M Installs Found Exfiltrating Code - The Hacker News
- Fake Clawdbot VS Code Extension Installs ScreenConnect RAT - Aikido
- Solidity Devs Targeted Again: Malicious VS Code Extension Drops ScreenConnect RAT - Checkmarx
- VS Code extensions contain trojan-laden image - ReversingLabs
- Malicious VSCode extensions on Microsoft's registry drop infostealers - BleepingComputer
- Malicious VSCode extensions infect Windows with cryptominers - BleepingComputer
- Nx Compromised to Steal Wallets and Credentials - Semgrep
- Supply Chain Risk in VS Code Extension Marketplaces - Wiz

Allow for minimumReleaseAge-style...

1291

Karl Horky @karlhorky.com · 27/04/2026

Great research into the changing team dynamics of AI, and how a lot of tools and processes are built for: 1. slow, pre-AI ways of collaboration 2. multiplying singular AI users and siloing the AI interactions, instead of making it team-first

040

Karl Horky @karlhorky.com · 16/04/2026

VS Code: I suggested an "edit mode" for the integrated browser, for WYSWYG-style workflows of changing text copy If you also want this: it is a backlog candidate now, needs 20 👍 reactions to move it to backlog github.com/microsoft/vs...

Integrated browser "edit mode": use inline text edits as a signal for Copilot edits #310710

karlhorky
opened 5 hours ago · edited by karlhorky
When performing marketing copy edits, it is often faster to just change text copy directly in the integrated browser than to describe the change in chat and wait for Copilot to make the change and the dev server to update the integrated browser (especially true with slower dev servers).

In the integrated browser, introduce a mode where DOM elements/nodes containing text are temporarily editable (eg. the behavior of contenteditable attribute). The user can then edit text inline and click on a "Save" button, upon which Copilot should use the diff of the edited text (plus nearby DOM context and innerHTML, as necessary) as a signal to propose source edits in the backing tsx / jsx / html / svelte / vue / etc file.

This proposal is NOT about persisting DOM edits deterministically to files. The browser would only be the interaction surface, while Copilot still generates normal source edits for review, based on the diff.

This could be extended to other non-text edits in future, such as image paths.

Alternatives considered
Full WYSIWYG editor, mapping changes to source files deterministically

cc @meganrogge @jruales @kycutler

140

Karl Horky @karlhorky.com · 06/04/2026

Tomorrow: React Amsterdam ⚛️ April edition, at Picnic - Kirill Voloshin and Masoud Alali: Evolving the Picnic Page Platform with React Server Components - Leon Liefting: Building Flexible Breadcrumbs in Next.js With the App Router Hope to see you there! guild.host/events/react...

guild.host

React Amsterdam Meetup: React Server Components & more! | Guild

Apr 7th 6:30PM: Hey, React Amsterdam Community! We’re excited to kick off our next React meetup on April 7! Join us for an evening of practical insights, great conversations, and community vibes — fr...

020

Karl Horky @karlhorky.com · 31/03/2026

To bundle all of your security settings, use "configurational dependencies": pnpm.io/config-depen... Also, you can set these globally for defense in depth of unconfigured projects: pnpm config set minimumReleaseAge 10080 --global

pnpm.io

Config Dependencies | pnpm

Config dependencies allow you to share and centralize configuration files, settings, and hooks across multiple projects. They are installed before all regular dependencies ("dependencies", "devDepende...

010

Karl Horky @karlhorky.com · 31/03/2026

Example pnpm-workspace.yaml config github.com/upleveled/es...

github.com

130

Karl Horky @karlhorky.com · 31/03/2026

The axios breach is a good opportunity to review your package manager settings I recommend pnpm @pnpm.io Default: postinstall scripts are blocked, protects against axios vector Also try: - minimumReleaseAge: 10080 (pkgs must be min 7 days old) - trustPolicy - blockExoticSubdeps

3100

Karl Horky @karlhorky.com · 21/01/2026

Feb 5: Come and join our next React Amsterdam meetup 🚀 at Albert Heijn's AH Technology office in Zandaam Talks: - Releasing 20 Micro-Frontends in 1 Week With Module Federation by Gonzalo Beviglia - The Design System Journey by Gabriel Cardoso guild.host/events/react...

guild.host

React Amsterdam Meetup: The Design System Journey & more! | Guild

Feb 5th 6:00PM: Hey, React Amsterdam Community! We’re kicking off 2026 with our first meetup on February 5. Join us to explore how to scale

010