HN user

awayto

81 karma

Working on educational saas related stuff...

https://github.com/jcmccormick https://github.com/keybittech

meet.hn/city/us-Eugene

Posts4
Comments60
View on HN

Run pwd to see the directory you’re working in. You’ll only be able to edit files in this directory.

If you're using the agent to produce any kind of code that has access to manipulate the filesystem, may as well have it understand its own abilities as having the entirety of CRUD, not just updates. I could easily see the agent talking itself into working around "only be able to edit" with its other knowledge that it can just write a script to do whatever it wants. This also reinforces to devs that they basically shouldn't trust the agent when it comes to the filesystem.

As for pwd for existing projects, I start each session running tree local to the part of the project filesystem I want to have worked on.

Could you point to some resources which talk about how docker isn't considered a safe sandbox given the network and file system restrictions I mentioned?

I understand the sharing of kernel, while I might not be aware of all of the implications. I.e. if you have some local access or other sophisticated knowledge of the network/box docker is running on, then sure you could do some damage.

But I think the chances of a whitelisted llm endpoint returning some nefarious code which could compromise the system is actually zero. We're not talking about untrusted code from the internet. These models are pretty constrained.

Google has what I would call a generous free tier, even including Gemini 2.5 Pro (https://ai.google.dev/gemini-api/docs/rate-limits). Just get an API key from AiStudio. Also very easy to just make a switch in your agent so that if you hit up against a rate limit for one model, re-request the query with the next model. With Pro/Flash/Flash-Lite and their previews, you've got 2500+ free requests per day.

Yeah I agree. Ultimately I would suggest not having any kind of function call which returns an arbitrary command.

Instead, think of it as if you were enabling capabilities for AppArmor, by making a function call definition for just 1 command. Then over time suss out what commands you need your agent do to and nothing more.

You can build your agent into a docker image then easily limit both networking and file system scope.

    docker run -it --rm \
      -e SOME_API_KEY="$(SOME_API_KEY)" \
      -v "$(shell pwd):/app" \ <-- restrict file system to whatever folder
      --dns=127.0.0.1 \ <-- restrict network calls to localhost
      $(shell dig +short llm.provider.com 2>/dev/null | awk '{printf " --add-host=llm-provider.com:%s", $$0}') \ <-- allow outside networking to whatever api your agent calls
      my-agent-image
Probably could be a bit cleaner, but it worked for me.

Also if you're doing function calls you can just have the command as one response param, and arguments array as another response param. Then just black/white list commands you either don't want to run or which should require a human to say ok.

I dabbled with this kind of issue in my docs and ended up using JavaScript's Intersection Observer [0]. It's not a perfect solution [1], but I think it worked well enough [2]. It just identifies when the element comes on screen and then marks it as active however you please. I do appreciate the depth the article went into though!

[0] https://developer.mozilla.org/en-US/docs/Web/API/Intersectio... [1] https://github.com/keybittech/awayto-v3/blob/main/landing/la... [2] https://awayto.dev/docs/0.3.0/

  Location: Oregon
  Remote: Yes
  Willing to relocate: No
  Technologies: Go/Python/TS/JS/HTML/CSS/Java/C#
  Résumé/CV: https://www.linkedin.com/in/joe-mccormick-76224429/
  Email: joe [-at-] keybittech.com
Been writing code for 25+ years. 10+ years professionally. Started freelancing a few years back. I've done a number of projects with the community so far, and really hoping to find new avenues currently. On the side I release a great deal of open source software at https://github.com/jcmccormick.

I've made web applications (front and back end concurrently) for the majority of my time developing. However, now I have turned my sights on to LLM use. I have now learned how to work with all kinds of backends (JAX, Transformers, PyTorch, etc.) while being able to effectively fine tune my own models (from other bases). Definitely not a math major, but I do understand the practical use and intentions of model layers, matrix multiplications, and other various inner processes of neural networks.

I am currently working on a project that produces AST parses of one of my projects (20k+ loc), turns them into embeddings, and trains a model to answer questions and help me continue to code that project. All I can say is that it does work on principle, and is just a matter of time before I'll have a generalized pipeline for such projects.

If any of this sounds valuable to you, I'm certainly looking forward to utilizing my knowledge, so please do reach out via linkedin messenger, or my email. Thanks for your time.

On routing, make sure any endpoints used between containers are (1) configurable, and (2) using the docker internal network naming conventions when working locally.

For example I have a compose with 10+ containers in it. Each container that needs to talk to another has some kind of environment property to tell it the name of that other container. So the "api" container might have a property called DB_HOST="db", "db" being the name of the db container.

Now, when developing i.e. the "api" image locally, your local dev server should be configured in the same way, providing the DB_HOST property to your local dev server environment. By doing this, you can completely stop the "api" container, allowing the local dev server to take its place, configured to talk to your other containers running in the docker network.

This way you are maintaining the local dev server setup that we've been using for ages and not developing directly on a docker image or dependent on its build cycle, etc.

SEEKING WORK

  Location: Oregon

  Technologies: Recently: Infra, DevOps, Self-Hosting, HTMl, CSS, JS, React, Typescript, Java, Shell, Docker, Postgres -- Professionally in the past: PHP, C#, Marionette, Angular, AWS

  Email: joe - at - keybittech.com
Hey, I'm Joe. I'm a hard working generalist with a focus on educational systems, infrastructure, and wiring things together. Currently I'm working on an online collaborative platform which you can read tech docs for at https://awayto.store. The topics covered will absolutely give you a clear idea of my capabilities with regard to developing interactive, deeply integrated systems. Hope we can speak soon! Thanks for your time.
  Location: Oregon
  Remote: Yes
  Willing to relocate: No
  Technologies: Recently: Infra, DevOps, Self-Hosting, HTMl, CSS, JS, React, Typescript, Java, Shell, Docker, Postgres -- Professionally in the past: PHP, C#, Marionette, Angular, AWS
  Résumé/CV: https://www.linkedin.com/in/joe-mccormick-76224429/
  Email: joe - at - keybittech.com
Hey, I'm Joe. I'm a hard working generalist with a focus on educational systems, infrastructure, and wiring things together. Currently I'm working on an online collaborative platform which you can read tech docs for at https://awayto.store. The topics covered will absolutely give you a clear idea of my capabilities with regard to developing interactive, deeply integrated systems. Hope we can speak soon! Thanks for your time.

walk through a door in an RPG Maker game end up playing a Quake level! And then, upon killing a certain enemy, be suddenly in a bossfight in a SMW ROMhack!

I just learned about this [1] yesterday but seems to be the first data point I've seen regarding something like you describe. Very cool to see, and it definitely blew my mind that things like this are now being developed.

[1] https://archipelago.gg/

    Location: Oregon
    Remote: Yes
    Willing to relocate: No
    Technologies: Full-stack dev for 20+ years. HTML, CSS, JS, TS, SQL, PHP, Java, C#, Node, General Infra Specialist, AWS Cloud* stack
    Resume: https://www.linkedin.com/in/joe-mccormick-76224429/
    Email: joe -- at -- keybittech.com
I'm currently open to projects of all sizes. Currently working on wrapping up my own web application deployment framework, with docs and demo here: https://awayto.store
    Location: Oregon
    Remote: Yes
    Willing to relocate: No
    Technologies: recently I'm using Javascript/Typescript, Node, SQL, Docker, Shell -- but I've been developing for 25 years and used a lot of stuff.
    Resume: On request. https://github.com/jcmccormick 
    Email: joe \at\ keybittech.com
My name is Joe. I am a software engineer. I build my own software, Awayto, which you can currently demo at https://awayto.store to see my output. The demo features a communications platform, similar to what you would expect if you were running an online writing center. There is RBAC, scheduling & online appointments, voice/video calling, shared whiteboard/document marking, and more. However, the system is built in a generic fashion where features can be added or removed on a whim, leading to a pivotable system for whatever business you're creating.

I'm interested in working with businesses with the above feature set interests, educational groups, community services, and so on. The software is fully open source and runs bare metal or (currently) on hetzner. As a freelancer I am looking for work on projects of similar scope, as well as implement Awayto for your own purposes, should you need.

I've been developing for 25 years and am of course open to other projects as well. And I look forward to hearing what ideas you have, and your needs.

Please contact me at joe \at\ keybittech.com for any inquiries, and check my profile for more info and links to my work.

SEEKING WORK | Oregon | Remote

My name is Joe. I am a software engineer. I build my own software, Awayto, which you can currently demo at https://awayto.store to see my output. The demo features a communications platform, similar to what you would expect if you were running an online writing center. There is RBAC, scheduling & online appointments, voice/video calling, shared whiteboard/document marking, and more. However, the system is built in a generic fashion where features can be added or removed on a whim, leading to a pivotable system for whatever business you're creating.

I'm interested in working with businesses with the above feature set interests, educational groups, community services, and so on. The software is fully open source and runs bare metal or (currently) on hetzner. As a freelancer I am looking for work on projects of similar scope, as well as implement Awayto for your own purposes, should you need.

I've been developing for 25 years and am of course open to other projects as well. And I look forward to hearing what ideas you have, and your needs.

Please contact me at joe \at\ keybittech.com for any inquiries, and check my profile for more info and links to my work.

It's definitely less tokens at least in my contrived case. Looking at the compressed text, I can make out what is what, and see that it's just minimizing words to their root parts.

Typescript (22 tokens):

    export type IAssist = { id: string; prompt: string; promptResult: string[]; };
Story (26 tokens):
    IAssist contains: id which is a string; prompt which is a string; promptResult which is an array of strings.
Compressed (13 tokens):
    IAsst{id,prompt,promptR}
And again I'll just call this interesting, because is it really going to know promptResult is a string array in most cases? Definitely not unless it gets some help in the component description, maybe.

This reminds me of an interesting exeriment I did earlier this year with ChatGPT.

First, I came upon this reddit post [1] which describes being able to convert text into some ridiculous symbol soup that makes sense to ChatGPT.

Then, I considered the structure of my Typescript type files, ex [2], which are pretty straightforward and uniform, all things considered.

Playing around with the reddit compression prompt, I realized it performed poorly just passing in my type structures. So I made a simple script which essentially turned my types into a story.

Given a type definition:

    type IUserProfile {
        name: string;
        age: number;
    }
It's somewhat trivial to make a script to turn these into sentence structures, given the type is simple enough:

"IUserProfile contains: name which is a string; age which is a number; .... IUserProfiles contains: users which is an array of IUserProfile" and so on.

Passing this into the compression prompt was much more effective, and I ended up with a compressed version of my type system [3].

Regardless of the variability of the exercise, I can definitely say the prompt was able to generate some sensible components which more or less correctly implemented my type system when asked to, with some massaging. Not scalable, but interesting.

[1] https://www.reddit.com/r/ChatGPT/comments/12cvx9l/compressio...

[2] https://github.com/jcmccormick/wc/blob/c222aa577038fb55156b4...

[3] https://github.com/keybittech/wizapp/blob/f75e12dc3cc2da3a41...

Why would I use this instead of some minimal implementation of the official OpenAI packages?

Looking at the chatgpt.js file in the repo, a great deal of the code revolves around manipulating UI elements. What does any of this have to do with interacting with an API, and why would I use your UI, baked into this script, outside of something I control myself?

Then, the Usage section shows a few commands, completely unrelated to any UI elements.

I'm not sold on this; seems like a wrapper around something that is much simpler in practice.

Who has time for docs?

Perhaps you could... I dunno, use an AI or something to generate those for you?

I wonder if error boundary components/functionality are an anti-pattern. They invite the developer to create components which expect to fail. Even basic hide/show logic is better than expecting devs to orchestrate unified error handling across the app.

Free Organ 3 years ago

Looking at a lot of the entries, how do you even go about moving these?

For sure. If it ain't broke don't fix it. Node and express are still great. I still use them. Heroku and rails would still be great to this day, too.