Practical software notes from a Korean programmer and software architect in Indonesia — Laravel/Vue SaaS projects, AI operations, DevOps, and the Korea to Southeast Asia tech bridge.
I write from hands-on software work: Laravel SaaS projects, DevOps, Windows utilities, AI automation, and the operating constraints of building from Indonesia.
A short path through the core argument of this site: agents need maps, automation needs proof, and tools need exit paths.
One post per day. Mon = news · Tue = code · Wed = Indonesia · Thu = tools · Fri = debate · Sat = build · Sun = free.
Vite's Nov 10 advisory is rated Critical, but it only reaches dev servers that are opened to the network. How to find your Vite versions and every place someone types --host, with two small scripts.
Node.js shipped security releases for lines 22, 24 and 26 on Nov 11, 2026. What the advisory lists, which parts matter for your setup, and a check for every place Node hides.
Shinjae Kang
Read
GitHub will block pull_request_target on public repos from Dec 2, with practice blocks on Nov 9 and Nov 16. Here is how to tell a rehearsal from a real bug, and what to decide per workflow.
Shinjae Kang
Read
Laravel Herd workspaces give each coding agent its own branch, folder and subdomain, but the database stays shared unless you pick clone or empty. Here is how to check it and how to block a reset.
Shinjae Kang
Read
An unattended Claude Code job can stop with Not logged in while nothing in your code changed. The CLI now shows when a stored sign-in ends. Here is the preflight, the three proofs, and the weekly check that catch it first.
Shinjae Kang
Read
Composer's new cooldown policy holds back fresh releases so malware gets caught first. It holds back the patch for a real vulnerability too. Here is how to set the wait, who on the team may skip it, and how to leave a record when they do.
Shinjae Kang
Read
The agent's form saved the record, so the PR looked done. Here is the four-check review and the Playwright plus axe test I run on every AI-written Vue form before it ships, especially in the error state.
Shinjae Kang
Read
A denied tool with no result in chat is not proof the tool never ran. Print withheld plugin result versus never ran versus the named Claude Code owner before you file the wrong ticket.
Shinjae Kang
Read
A quiet Read on a network share after you approved a local folder, or after auto mode, is not proof always-ask is off. Print UNC versus local versus the named Claude Code owner before you file the wrong ticket.
Shinjae Kang
Read
A skill tool that still runs after you leave plan or auto is not proof the mode never changed. Print leftover allowed-tools, the current mode, and the named Claude Code owner before you file always-ask-broken.
Shinjae Kang
Read
A phone yes that reuses a reply ID is not a second human allow. Print the ID, the open request, and the named Claude Code owner before you file always-ask-broken.
Shinjae Kang
Read
A trycloudflare.com URL with --allowed-mail is email OTP on a Quick Tunnel, not a Cloudflare account on either side. Print allowed-mail, account, and the named Tunnel owner before you file Access-broken.
Shinjae Kang
Read
A user-installed mod that approves one nested piece of a compound shell is not proof deny is off. Print the nested rule, the approval source, and the named Claude Code owner before you file allow-broken.
Shinjae Kang
Read
A 40-character check on a ghs_ string is not proof the GitHub App token is invalid. Print length, opacity, and the named App owner before you file a broken-auth ticket.
Shinjae Kang
Read
A missing always-ask prompt on a dangerous rm is not proof always-ask is off. Print the redirect, the prompt, and the named Claude Code owner before you file the ticket.
Shinjae Kang
Read
Seeing laravel/ai in composer.lock is not proof the chat fetch client is patched. Print the lockfile line, the fetch-client field, and the named Laravel owner before you file an all-patched ticket.
Shinjae Kang
Read
An every-run prompt on python3 -c is not proof that sandbox auto-allow is off. Print the equals matcher, the auto-allow setting, and the named Claude Code owner before you file an auto-allow-broken ticket.
Shinjae Kang
Read
A GitHub changelog that moves a self-hosted runner date is not permission to skip the fleet. Print the moved date, the registration floor, the runtime floor, and the named Actions-runner owner before you file all-clear.
Shinjae Kang
Read
A GitHub Actions badge that says 2,500+ is a capped count, not a run inventory. Print the cap, the 1,000-item page, a date-range filter, and the named Actions owner before you file missing runs.
Shinjae Kang
Read
An auto-started Codex background server is not proof session settings match. Print auto-start, the recovery choice, and the named Codex owner before you file an all-clear.
Shinjae Kang
Read
A green wrangler deploy is not proof Durable Object code is live. Print the deploy, the code-update strategy, and the named Workers owner before you file an all-cutover.
Shinjae Kang
Read
A green /readyz is not proof Postgres is healthy. Print the ready status, the store probe, and the named gateway owner before you file an all-clear.
Shinjae Kang
Read
A permission rule that contains a NUL byte is not a wildcard allow. Print the rule bytes, the match-nothing result, and the named permission-rule owner before you file an allow-all ticket.
Shinjae Kang
Read
A job that hits its timeout is not a dead worker pool. Print the job timeout, the worker kill, and the named queue:work owner before you file an outage.
Shinjae Kang
Read
A docker glob that matches one command is not a sandbox exemption for npm ci && docker build. Print the glob, split every part, and name who owns sandbox.excludedCommands before you file a hole.
Shinjae Kang
Read
A failed local DNS lookup on a Claude apps gateway pod is not a missing host when the pod only talks through a forward proxy. Print the env, read the boot network line, and name who owns proxy-only egress.
Shinjae Kang
Read
A repo-root AGENTS.md is not Claude Code’s project instructions while CLAUDE.md or CLAUDE.local.md exists. Print the load line, open /config, and name who owns the instruction file.
Shinjae Kang
Read
A green Laravel or Vue workflow on ubuntu-latest is still today's image, not the image GitHub will move that label onto. Print the label, the named pin, the test job, and the workflow owner before the migration window.
Shinjae Kang
Read
A Wrangler onboarding write for a missing previews block is a warning, not permission to point preview at production KV, D1, or secrets. Print the block, the placeholder, and the named config owner before you ship.
Shinjae Kang
Read
An old MCP client that still opens with initialize is a handshake the new Laravel server still answers, not a dead 1.0 package. Print the method, the pin, and the named owner before you file the server.
Shinjae Kang
Read
A red WebFetch at five minutes is a download deadline, not a stuck model. Print the named CLI pin, the deadline env, and the named owner before you page the model.
Shinjae Kang
Read
A wall of HTTP 400s on a named Claude Code base URL is a schema reject, not a status outage. Print the 400 body, the named URL, and the named CLI pin before you page the gateway.
Shinjae Kang
Read
A remote or headless row that says waiting for your input is not done. Open the agent list, split Needs input from Working, and name who owns the CLI pin.
Shinjae Kang
Read
When import.meta.url fails on a Worker, Node.js APIs are already on. Name who owns the compat-flag list before the coding agent flips the wrong switch.
Shinjae Kang
Read
When a managed allow-list cannot be read, Claude Code now admits nothing. Classify the block, name who owns the file, then resume the coding agent.
Shinjae Kang
Read
A failed Cloudflare CLI login is a requested-scope list, not a status page. Copy the unknown scope, name who owns the CLI pin, then resume the coding agent.
Shinjae Kang
Read
An Organization policy line on /status can explain a miss. It does not prove the fleet policy loaded. Read claude doctor, name the proxy owner, then resume coding.
Shinjae Kang
Read
A deferred Inertia group named auth is a request batch, not a PHP function. A red loadDeferredProps test is not a missing Vue prop. Name who owns the group strings.
Shinjae Kang
Read
GitHub Issues are off on most Laravel packages. The ticket is a pull request that documents the bug, with a named owner. laravel/framework Issues stay on.
Shinjae Kang
Read
GitHub CLI’s Linux signing key expires Saturday 5 September 2026. Last night’s green apt update is not a trusted keyring. Name the owner of the image before the next CI layer runs apt.
Shinjae Kang
Read
A Copilot content exclusion is a policy row. App and CLI now honor it. Agent chat in the editor still can. Name the owner of the list and of the surface before you call a secret recovered.
Shinjae Kang
Read
GitHub now prints a ready-to-approve assessment on every Copilot review. That line is a note. The admin switch that turns it into a required approval is off by default. Keep it off.
Shinjae Kang
Read
A ranked cheat-sheet of five desk rules from this week: who pins the model, what .gitignore does not lock, who merges, who retries, and who still reads the diff.
Shinjae Kang
Read
The agent that writes the diff does not choose the model for that pull request. A named human pins the model before the session starts. Auto is a vendor default, not an owner.
Shinjae Kang
Read
A coding agent may open the pull request. A named human still owns the merge click. Treat GitHub agent merge and auto-merge as opt-in shortcuts, never as the default.
Shinjae Kang
Read
A green chart lockfile is not permission to add ECharts beside ApexCharts. Name a rollback owner and one failing chart fixture before anyone ships a second visualization stack.
Shinjae Kang
Read
An interrupted MCP tool in a headless coding-agent session used to look finished. Treat empty completion as a bug until the harness asserts an interrupted error.
Shinjae Kang
Read
A bigger context window still lets a coding agent search the whole tree. Put the map file on the ticket as an allow-list, fail out-of-map paths, and name who updates the list.
Shinjae Kang
Read
Multi-agent Hermes setups fail when specialists work unsupervised. Gates, checkpoints, and a coordinator that verifies artifacts before publishing.
Shinjae Kang
Read
Chat said done is not recovered. I wait for a file on disk, a job log that names why the run stopped, and one fail-once restart from the last good commit.
Shinjae Kang
Read
Running multiple coding agents on one Git working tree without a lease contract is a merge race, not parallelism. Here's the isolation and ownership pattern that prevents silent corruption.
Shinjae Kang
Read
Exit code 0 with empty output is not success — it's a zombie task. Here's how to detect and own the proof artifacts that separate real completion from silent failure in AI agent cron pipelines.
Shinjae Kang
Read
TanStack Table 9.0.0-beta.64 honors explicit global-filter opt-in. That is pilot hygiene, not permission to unpin stable 8.21.3. Here is the gate list before a Vue admin table leaves the spike branch.
Shinjae Kang
Read
shadcn-vue 2.8.1 looks like a quiet patch until registry entries, icon maps, message-scroller gutters, and number-field styles hit a real admin surface. Treat the lockfile bump as a release decision with an owner, smoke list, and rollback.
Shinjae Kang
Read
PHP 8.5.9 fixes CVE-2026-17543 in pgsql and other security issues. A green Laravel deploy does not prove the hosts, CI images, workers, and base containers actually run the patched binary.
Shinjae Kang
Read
ApexCharts 6.6 adds premium unit and waffle charts with trial watermarks, tree-shakeable imports, and TypeScript options. Treat adoption as a license, fixture, accessibility, and rollback contract.
Shinjae Kang
Read
A generated migration that runs locally is not a production contract. Before an AI coding agent rewrites columns, require expand steps, dual-read boundaries, backfill evidence, worker compatibility, and an explicit rollback decision.
Shinjae Kang
Read
A clean AI-generated diff is not ready for production until a team can disable it, restore its data path, and prove the prior behavior returned. Build rollback evidence into the change before the model writes the patch.
Shinjae Kang
Read
A practical way to decide whether a resumed coding-agent run is safe to continue: inspect local evidence, enforce command gates, review the diff, preserve test logs, and make rollback cheap.
Shinjae Kang
Read
A successful Laravel mutation does not prove a Vue admin screen is fresh. Define query-key ownership, invalidation, rollback, and hydration as one cache contract.
Shinjae Kang
Read
ApexCharts 6.4 changes heatmap geometry, rendering imports, and interaction defaults. Treat the upgrade as a dashboard contract migration with visual and behavioral tests.
Shinjae Kang
Read
Use Git trailers, CI checks, and Git notes to make each commit carry a compact, reviewable handoff record.
Shinjae Kang
Read
A production evaluation guide for LangGraph, AutoGen, CrewAI, and LangChain: define state, proof, rollback, and maintenance exit criteria before an agent framework reaches a real SaaS workflow.
Shinjae Kang
Read
A dev server that misses filesystem events is an unreliable feedback loop. Build proof for the path from edit to browser, then keep a rollback ready.
Shinjae Kang
Read
Treat repository instructions for coding agents as a governed change-control system: owned, reviewed, scoped, evidenced, and reversible.
Shinjae Kang
Read
A Laravel image workflow should preserve originals, produce deterministic variants, isolate processing behind a seam, and remain operable after the demo is gone.
Shinjae Kang
Read
Treat Laravel and Inertia request boundaries as explicit compatibility contracts: validate and normalize input, serialize durable job payloads, lock responses with fixtures, and leave a clean rollback seam.
Shinjae Kang
Read
A short AI-generated diff can cross validation, request, persistence, and test boundaries. Review the named code entities, the evidence, and the rollback seam—not only the lines that changed.
Shinjae Kang
Read
An exactOptionalPropertyTypes error is often an ownership decision left undocumented. Use a narrow boundary, type tests, runtime tests, an exact lockfile, and a rollback path to turn strict TypeScript into a maintainable migration.
Shinjae Kang
Read
A cautious Vue 3.6 Vapor Mode adoption pilot for Laravel and Vue SaaS teams: isolate one route, measure it, and keep a rollback path while Vapor remains unstable.
Shinjae Kang
Read
Grok 4.5 is now available on the xAI API with pricing and reasoning controls that make developers pay attention. The real adoption test is whether it survives your local coding-agent harness.
Shinjae Kang
Read
Wrangler 4.108.0 added a quiet branch for agent-driven static Pages deploys. The operational lesson is simple: an AI deployment is not complete until the target platform, URL, resource ownership, and rollback path are verified.
Shinjae Kang
Read
TanStack Table v9 beta added web workers for row models, then immediately shipped sorting and cell-order fixes. Treat that as a migration boundary, not a free performance switch.
Shinjae Kang
Read
The first merge gate catches obvious AI coding mistakes. A repeatable review harness catches the slower failures: drift, missing rollback paths, weak tests, and agent changes that look fine until production maintenance begins.
Shinjae Kang
Read
A low-cost observability pattern for agent crons using logs, artifacts, summaries, and delivery checks before adding paid monitoring tools.
Shinjae Kang
Read
Why automation only compounds when it closes the loop with metrics, review, and next actions instead of simply generating more output.
Shinjae Kang
Read
A practical contract for giving coding agents repository context, edit boundaries, verification steps, and rollback paths before they touch code.
Shinjae Kang
Read
Why coding agents need compact repository maps, ownership boundaries, and verification paths more than bigger context windows.
Shinjae Kang
Read
A practical test for adopting beta libraries: prove the rollback path, migration cost, and ownership model before they enter production.
Shinjae Kang
Read
A field note on why rendered UI is not enough, and how to verify AI-generated interfaces against behavior, accessibility, and maintenance risk.
Shinjae Kang
Read
A production checklist for cron jobs that proves useful artifacts exist, are fresh, and can be consumed downstream after the process exits.
Shinjae Kang
Read
GLM-5.2's MIT-licensed open weights at one-sixth the cost of GPT-5.5 isn't a benchmark story — it's a cost-structure story. Here's what it means for your architecture decisions this week.
Shinjae Kang
Read
Five cron patterns that look healthy while silently failing, with checks for stale files, empty outputs, partial JSON, and missing delivery.
Shinjae Kang
Read
A 2026 frontend survival guide for replacing unnecessary JavaScript with modern CSS features while keeping behavior accessible and maintainable.
Shinjae Kang
Read
Why a green cron exit can still mean failed work, and how to verify agent jobs by checking useful output instead of process status.
Shinjae Kang
Read
A field report on changing an LLM backend cleanly: where provider abstraction helps, where costs shift, and what still needs verification.
Shinjae Kang
Read
How to detect zombie AI agent pipelines with freshness checks, artifact validation, and downstream proof instead of trusting running processes.
Shinjae Kang
Read
A current guide to keeping AI coding-agent instructions, verification, approval, and rollback in the repository so a tool or model change does not rewrite release control.
Shinjae Kang
Read
What actually breaks when you run AI agents on cron 24/7 — zombie tasks, subagent black holes, and the architectural patterns that make autonomous pipelines reliable.
Shinjae Kang
Read
A long-running coding agent can stay green after it changes directory. Production still needs a sandbox that survives /cd, a budget that counts nested work, and a human who owns both.
Shinjae Kang
Read
OpenCode hit 160K GitHub stars and dethroned Cursor as the #1 AI dev tool. Claude Fable 5 launched with record benchmarks — then got suspended 3 days later. Here's what actually matters for your workflow.
Shinjae Kang
Read
Z.AI's GLM 5.2 (744B MoE, 1M context, MIT license) tops open-weights benchmarks and runs coding agents at frontier level. Full breakdown.
Shinjae Kang
Read
How a Hugo blog adopted a token-driven design system from real references, turning brand choices into reusable CSS and publishing rules.
Shinjae Kang
Read
Three acquisitions in twelve months. Korean dev tools are no longer a fragmented market — they're a small oligopoly, and the API surfaces are starting to look the same.
Shinjae Kang
Read
Modern JavaScript runtimes have had structured state primitives for years. You probably don't need a 40KB dependency for what your app actually does.
Shinjae Kang
Read
Five years of quiet, distributed, community-driven tooling work. The results are starting to show up in the kinds of projects that get adopted outside the country.
Shinjae Kang
Read
It's a personal AI agent. It's not a product for end-users. With that frame, it works better than anything else I've tried. Here's what works, what doesn't, and when I'd reach for something else.
Shinjae Kang
Read
Two years of watching the field from Jakarta. The replacement threat was always a junior-developer story. The senior-developer story is the opposite of what most people are writing about.
Shinjae Kang
ReadBrowse by theme.
Type at least 2 characters to search.
