Node.js

Weekend edition. Browser politics meet AI plumbing again — Mozilla files a hard ’no’ on Chrome’s Prompt API (the one that lets pages call into a browser-bundled LLM), 564 points on HN. Shai-Hulud-style supply chain attack lands in PyTorch Lightning; AI training pipelines are now in the same threat model as npm. Two Japanese-source items: VS Code ships Agent window for parallel coding agents, Node.js 26 enables Temporal by default. From the Chinese dev community: ‘Gemini got worse this week’ and ‘AI coding is more exhausting than the old way’ — both early signals that the cost side of the AI coding ledger is finally being talked about.

Three threads this morning. (1) The platform layer is paying down years of debt at once: VS Code 1.108 ships a preview ‘Agent window’ for running multiple coding agents side-by-side, the long-running Bun rewrite-in-Rust PR finally lands on main, Node.js 26 turns on Temporal by default, and Mojo 1.0 hits Beta. (2) Security and privacy are pushing back hard: HN’s #1 story (442 pts) is an owner physically removing the DCM and GPS from a 2024 RAV4 hybrid, #2 is a public stack-overflow PoC against Nginx, and the V2EX thread of the day is a manager discovering coworkers resold the company’s LLM gateway key. (3) Skills as an interface have a real day in the sun: obra/superpowers cracks the GitHub trending top 5, and a Zenn write-up of Claude Code vs Codex playing Othello with identical Skills (final: 56-8) is making the rounds.

HN’s top three slots are all AI trust stories: Claude Code allegedly refusing or upcharging requests when commits mention ‘OpenClaw’ (865 pts); PyTorch Lightning hit by a Shai-Hulud-themed supply-chain attack (299 pts); Rivian shipping a real, vehicle-wide kill switch for cloud telemetry (331 pts). V2EX threads document a Gemini quality regression and a clean mihomo-via-Tailscale exit-node recipe. Publickey covers Node.js 26 enabling Temporal by default and Mojo reaching 1.0 Beta. Simon Willison ships a CSP allow-list iframe experiment and quotes Boris Mann’s deadpan: ‘11 AI agents’ is as meaningful as ‘11 browser tabs.’ On GitHub Trending, obra/superpowers — a packaging convention for Claude Code skills — keeps climbing.