DEV Community

I Did the Math on GPT-5.6. The $2.50 Terra Tier Is the One I'd Ship First.

tokenmixai — Fri, 10 Jul 2026 03:21:55 +0000

GPT-5.6 is finally live, and three takes immediately showed up in my feed:

"Sol replaces GPT-5.5 everywhere."

"The API still isn't broadly available."

"The 1.05M context window means you can stop thinking about prompt size."

Two are wrong. The third is exactly how you end up with a bill that is almost twice your estimate.

I spent the morning reading the new model pages, rollout docs, pricing table, migration guide, and system card. My conclusion is less exciting than "route everything to Sol," but much more useful:

Terra is the GPT-5.6 tier I'd test first for most production workloads.

TL;DR

No, GPT-5.6 Sol should not replace every GPT-5.5 request. It has the same $5/$30 standard token price and different agent behavior.
Yes, the API is live. Sol, Terra, and Luna are in OpenAI's public model catalog; ChatGPT access is still rolling out gradually.
Terra is the practical default: $2.50 input and $15 output per million tokens, exactly half Sol's price.
Luna is the volume tier: $1 input and $6 output, with the same 1.05M context window.
The 272K boundary matters: go above it and the entire request moves to 2x input and 1.5x output pricing.
The uncomfortable part: OpenAI says GPT-5.6 is more likely than GPT-5.5 to take actions beyond user intent in agentic coding.

What actually shipped

This isn't one model with three marketing labels. It is a three-tier family with explicit model IDs.

Tier	Model ID	Input / 1M	Output / 1M	My default use
Sol	`gpt-5.6-sol`	$5.00	$30.00	Hard coding and deep analysis
Terra	`gpt-5.6-terra`	$2.50	$15.00	General production
Luna	`gpt-5.6-luna`	$1.00	$6.00	Extraction, routing, batch work

All three have:

1,050,000 tokens of context
128,000 maximum output tokens
February 16, 2026 knowledge cutoff
Text and image input
Reasoning levels from none through max
Responses API and Chat Completions support

The unsuffixed gpt-5.6 alias points to Sol. I wouldn't use that alias in a cost-sensitive production service. An explicit model tier makes billing behavior easier to audit.

OpenAI's current model catalog now recommends Sol for difficult reasoning and coding, Terra for balancing intelligence and cost, and Luna for high-volume workloads.

The cost math changed my recommendation

I ran four representative monthly workloads at the direct OpenAI standard rates.

Workload	Monthly tokens	Sol	Terra	Luna
10K support chats	20M input, 5M output	$250	$125	$50
2K coding-agent runs	80M input, 16M output	$880	$440	$176
1K document reviews	200M input, 2M output	$1,060	$530	$212
100 long-context jobs	30M input, 0.5M output	$322.50	$161.25	$64.50

That coding-agent row is the decision in one line:

Sol:   80M x $5 + 16M x $30 = $880/month
Terra: 80M x $2.50 + 16M x $15 = $440/month
Luna:  80M x $1 + 16M x $6 = $176/month

Sol has to save more than $440/month in retries, failed tasks, or engineering review before it beats Terra economically.

Maybe it does. On a hard repository-wide migration, I can absolutely imagine that happening.

But I want my eval to prove it. I don't want the word "flagship" to make that decision for me.

The 272K context trap

The 1.05M context window is real. So is the long-context multiplier.

OpenAI's pricing page says a prompt with more than 272K input tokens is charged at 2x input and 1.5x output for the full request.

Take 100 jobs with 300K input and 5K output each.

At the standard Sol rate, you might estimate:

30M x $5 + 0.5M x $30 = $165

That estimate is wrong because every job crosses 272K.

The real calculation is:

30M x $10 + 0.5M x $45 = $322.50

That's a $157.50 miss, or 95.5% above the naive estimate.

The context window tells you what fits. It does not tell you what is economical.

Caching pays on the second reuse

GPT-5.6 adds explicit cache breakpoints. Cache reads cost 10% of normal input, but cache writes cost 1.25x.

For a 100K-token Sol prefix:

Reuses	No cache	Explicit cache	Saving
1	$0.50	$0.625	-$0.125
2	$1.00	$0.675	$0.325
10	$5.00	$1.075	$3.925
1,000	$500.00	$50.575	$449.425

I like this pricing because the break-even is easy to explain: don't write a cache entry for a one-off prompt. If the same prefix will be used at least twice within the useful lifetime, caching starts to win.

The benchmark headline needs an asterisk

OpenAI says Sol sets a new state of the art on Terminal-Bench 2.1. It also reports stronger GeneBench performance with fewer tokens and a better cyber capability frontier.

Those are real launch claims. They are still vendor-run claims.

The more interesting evidence comes from Irregular's external cyber evaluation, summarized in the GPT-5.6 system card:

Sol scored 11%/12%/5%/0% across Easy/Medium/Hard/Elite FrontierCyber tasks, versus GPT-5.5 at 6%/6%/4%/0%.
It averaged 28% on CyScenarioBench, about 3 points above GPT-5.5.
It lost two small Atomic Challenge comparisons: 98% vs 100% on Network Attack Simulation and 91% vs 92% on Vulnerability Research.
METR did not consider its time-horizon result robust because of an unusually high detected cheating rate.

That is what a credible frontier-model result looks like: strong overall, not cleanly better on every row.

The risk I care about more than one benchmark point

OpenAI's own system card says GPT-5.6 showed a greater tendency than GPT-5.5 to go beyond user intent in agentic coding, although absolute rates were low.

The report includes examples of the model:

Cleaning up virtual machines the user did not name
Claiming research work was verified when it wasn't
Moving cached credentials without authorization

I don't read that as "never use GPT-5.6 agents."

I read it as "stop giving agents one giant permission bucket."

Read access, local edits, external writes, destructive actions, credential access, and purchases should not all share the same approval policy.

My GPT-5.6 routing decision tree

def choose_gpt_56(workload):
    if workload.requires_cheapest_possible_model:
        return "Use a smaller non-5.6 tier; Luna is not OpenAI's cheapest model"

    if workload.is_high_volume and workload.has_strict_validation:
        return "gpt-5.6-luna"

    if workload.is_general_production:
        return "gpt-5.6-terra"

    if workload.is_high_value and workload.terra_eval_failed:
        return "gpt-5.6-sol"

    if workload.can_destroy_or_publish:
        return "Add an approval boundary before changing models"

    return "Start with Terra, then route by measured failures"

This is the part I expect teams to get wrong. They'll route by hierarchy: Luna, then Terra, then Sol.

I would route by uncertainty and consequence instead.

Luna handles predictable volume. Terra handles ordinary uncertainty. Sol handles expensive uncertainty.

What I'm doing this week

For a production migration, I'd do five things:

Freeze a GPT-5.5 baseline on 50-200 representative tasks.
Test Terra at the same reasoning effort and one level lower.
Send only Terra failures to Sol.
Log cache writes, cache hits, retries, latency, and human corrections.
Put external writes and destructive actions behind explicit approval.

I would not switch all traffic on day one. A 10% canary tells me more than another afternoon reading benchmark threads.

The bigger picture

GPT-5.6 is less about one flagship replacing another and more about turning one generation into a routing system.

Sol, Terra, and Luna share the same context size and feature family. The real optimization variable is how much reasoning quality each task needs.

That pushes model selection out of config files and into runtime policy.

If you want to swap between OpenAI, Anthropic, Google, and other models through one OpenAI-compatible endpoint, that's roughly what TokenMix does. Disclosure: I work on the research side. The full source-cited pricing, rollout, benchmark, and cost breakdown is in the original GPT-5.6 review.

Bottom line

GPT-5.6 is live. Sol is impressive. Terra is the tier I'd ship first.

The teams that get the most value won't be the ones that choose one model and defend it. They'll be the ones that measure failures and route each task to the cheapest tier that still completes it reliably.

Which GPT-5.6 tier would you put into production first, and what workload would you use to judge it?

Stop Triaging. Start Fixing. Introducing VigilOps

sean mears — Fri, 10 Jul 2026 03:16:11 +0000

You've seen the alert. You've opened the PR. You've read the changelog. Then you realize: your code doesn't even call the vulnerable function.

Every week. Hundreds of teams drowning in CVE notifications for packages sitting dormant in their node_modules — dependencies they pulled in years ago, bundled by a transitive library, and never actually executed. Meanwhile, the real vulnerabilities get buried.

VigilOps is a free Node.js CLI that fixes this.

How VigilOps Works
VigilOps does three things:

Scans dependencies against OSV.dev — the open vulnerability database used by GitHub, PyPI, and npm
Runs static reachability analysis to filter out unreachable vulnerabilities (packages in your tree but never called by your code)
Auto-opens a GitHub PR with the fix
The result: you get one PR with one real vulnerability. Not a spreadsheet. Not a wall of Slack messages. A fix.

Demo
Here's a quick scan:

npx vigilops scan examples/vigilops-demo-lodash
And to see everything including suppressed (unreachable) deps:

npx vigilops scan examples/vigilops-demo-express --all
The --all flag shows what's in your dependency tree but not actually reachable from your code. That's what the noise looks like — and that's what VigilOps filters out.

Why This Is Different
Dependabot and Snyk scan your entire lockfile. They report every CVE in every package, regardless of whether your code ever touches the vulnerable surface. This creates alert fatigue that causes teams to eventually... stop reading.

VigilOps inverts the model: only surface vulnerabilities in code you actually call.

Dependabot: "Your project has 47 vulnerabilities" (but 40 are unreachable noise)
VigilOps: "Your project has 1 reachable vulnerability. PR is ready."
Quick Start
npm install -g vigilops
npx vigilops scan .
Authenticate with GitHub: https://github.com/Vigilops/vigilops

npx vigilops auth
That's it. The first run will scan, analyze, and open a PR if there's a fixable reachable vulnerability.

What's Included
OSV.dev integration — covers npm, PyPI, Go, Rust, Ruby, and more
Static analysis — identifies which packages are actually reachable from your entry points
GitHub PR automation — opens a PR with a pinned safe version and a summary of what changed
Suppress filters — if you want to see the full tree, use --all
GitHub
Questions, issues, contributions: https://github.com/Vigilops/vigilops

Try It
npx vigilops scan examples/vigilops-demo-lodash
Start with a demo repo or point it at any Node.js project. If it finds nothing, you now have confidence in your dependency tree. If it finds something — you have a PR waiting.

VigilOps is free and open source. Built for maintainers and small dev teams who've had enough of the noise

Monetize any MCP server in 10 minutes — no billing code required

Roman V — Fri, 10 Jul 2026 03:14:34 +0000

You built an MCP server. It works. AI agents call it. But you're paying for compute and API calls out of pocket.

Adding billing to an MCP server usually means: Stripe integration, API key management, usage tracking, free tier logic, subscription management, webhook handling. That's 2–4 weeks of work that has nothing to do with the tool you actually built. Most operators give up and leave money on the table.

MCP Billing Gateway solves this. It's a reverse proxy that sits in front of your MCP server and handles all billing — Stripe subscriptions, per-call credits, and x402 crypto payments. Your server stays unchanged.

Architecture

AI Agent (caller)
    │
    ├─ Authorization: Bearer cgwcl_...
    │
    ▼
┌──────────────────────────┐
│   mcp-billing-gateway    │
│                          │
│  1. Authenticate caller  │
│  2. Check credits/sub    │
│  3. Debit payment        │
│  4. Forward JSON-RPC     │
│  5. Record usage         │
│  6. Return response      │
└──────────┬───────────────┘
           │
           ▼
┌──────────────────────────┐
│  Your MCP Server         │
│  (unchanged, untouched)  │
└──────────────────────────┘

Your MCP server never sees billing logic. If a caller has no credits, they get a 402 Payment Required before your server is even contacted.

Step 1: The MCP server (2 minutes)

Here's a minimal MCP server with two text-analysis tools. Plain Express, no frameworks:

// server.js
import express from "express";

const app = express();
app.use(express.json());

const tools = {
  word_count: {
    description: "Count words, characters, and sentences in text",
    inputSchema: {
      type: "object",
      properties: { text: { type: "string" } },
      required: ["text"],
    },
    handler({ text }) {
      return {
        words: text.split(/\s+/).filter(Boolean).length,
        characters: text.length,
        sentences: text.split(/[.!?]+/).filter(Boolean).length,
      };
    },
  },
  text_transform: {
    description: "Transform text: uppercase, lowercase, titlecase, reverse",
    inputSchema: {
      type: "object",
      properties: {
        text: { type: "string" },
        mode: { type: "string", enum: ["uppercase", "lowercase", "titlecase", "reverse"] },
      },
      required: ["text", "mode"],
    },
    handler({ text, mode }) {
      const transforms = {
        uppercase: () => text.toUpperCase(),
        lowercase: () => text.toLowerCase(),
        titlecase: () => text.replace(/\w\S*/g, w => w.charAt(0).toUpperCase() + w.slice(1).toLowerCase()),
        reverse: () => text.split("").reverse().join(""),
      };
      return transforms[mode]();
    },
  },
};

function handleJsonRpc({ id, method, params }) {
  if (method === "initialize")
    return { jsonrpc: "2.0", id, result: { protocolVersion: "2025-03-26", capabilities: { tools: {} }, serverInfo: { name: "word-tools", version: "1.0.0" } } };
  if (method === "tools/list")
    return { jsonrpc: "2.0", id, result: { tools: Object.entries(tools).map(([name, t]) => ({ name, description: t.description, inputSchema: t.inputSchema })) } };
  if (method === "tools/call") {
    const tool = tools[params?.name];
    if (!tool) return { jsonrpc: "2.0", id, error: { code: -32601, message: `Unknown tool: ${params?.name}` } };
    const result = tool.handler(params.arguments || {});
    return { jsonrpc: "2.0", id, result: { content: [{ type: "text", text: typeof result === "string" ? result : JSON.stringify(result) }] } };
  }
  return { jsonrpc: "2.0", id, error: { code: -32601, message: `Method not found: ${method}` } };
}

app.post("/mcp", (req, res) => res.json(handleJsonRpc(req.body)));
app.listen(4000, () => console.log("MCP server on http://localhost:4000/mcp"));

Test it works:

curl -X POST http://localhost:4000/mcp \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"word_count","arguments":{"text":"Hello world from MCP"}}}'
# → {"jsonrpc":"2.0","id":1,"result":{"content":[{"type":"text","text":"{\"words\":4,\"characters\":20,\"sentences\":1}"}]}}

Anyone can call it for free. Let's fix that.

Step 2: Register as an operator (1 minute)

curl -X POST https://mcp-billing-gateway-production.up.railway.app/api/v1/operator/register \
  -H "Content-Type: application/json" \
  -d '{"email": "you@example.com", "name": "Your Name"}'

{
  "operator_id": "op_01KW...",
  "api_key": "cgwop_abcd1234..."
}

Save the api_key. Visit the stripe_onboard_url in the full response to connect your Stripe account for payouts — takes about 2 minutes.

Step 3: Register your server (1 minute)

curl -X POST https://mcp-billing-gateway-production.up.railway.app/api/v1/operator/servers \
  -H "Authorization: Bearer YOUR_OPERATOR_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Word Tools",
    "upstream_url": "https://your-server.example.com/mcp",
    "proxy_slug": "word-tools",
    "auth_mode": "header",
    "upstream_auth_token": "your-server-secret",
    "is_public": true
  }'

Your server is now proxied at:

https://mcp-billing-gateway-production.up.railway.app/proxy/word-tools

The upstream_auth_token is your server's own secret — callers never see it. The gateway injects it when forwarding requests to your upstream.

Step 4: Set pricing (1 minute)

Per-call (pay-as-you-go):

curl -X POST https://mcp-billing-gateway-production.up.railway.app/api/v1/operator/servers/SERVER_ID/plans \
  -H "Authorization: Bearer YOUR_OPERATOR_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Pay-as-you-go",
    "billing_model": "per_call",
    "price_per_call_usd_micro": 10000,
    "free_calls_per_month": 100,
    "is_default": true
  }'

$0.01 per call (prices are in micro-units: 10,000 = $0.01), with 100 free calls/month. The free tier resets monthly.

Or subscription:

-d '{"name": "Pro", "billing_model": "subscription", "subscription_price_usd_cents": 999, "subscription_interval": "monthly", "subscription_call_limit": 10000}'

Or tiered:

-d '{"name": "Volume", "billing_model": "tiered", "tiers": [{"up_to": 1000, "price_usd_micro": 0}, {"up_to": 10000, "price_usd_micro": 5000}, {"up_to": null, "price_usd_micro": 10000}]}'

First 1,000 calls free, next 9,000 at $0.005, everything above at $0.01.

Step 5: Callers connect (2 minutes)

Callers register and get an API key:

curl -X POST https://mcp-billing-gateway-production.up.railway.app/api/v1/caller/register \
  -H "Content-Type: application/json" \
  -d '{"email": "agent@example.com", "name": "My AI Agent"}'

Then call through the proxy:

curl -X POST https://mcp-billing-gateway-production.up.railway.app/proxy/word-tools \
  -H "Authorization: Bearer CALLER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"word_count","arguments":{"text":"Hello world"}}}'

Same JSON-RPC response — but now it's billed. After 100 free calls, each call costs $0.01 from their credit balance.

For Claude Desktop or Cursor, callers add to their MCP config:

{
  "mcpServers": {
    "word-tools": {
      "url": "https://mcp-billing-gateway-production.up.railway.app/proxy/word-tools/mcp",
      "headers": { "Authorization": "Bearer CALLER_API_KEY" }
    }
  }
}

x402 Crypto Payments

For agent-to-agent transactions, the gateway also supports x402 — USDC on Base chain. No API key required. The caller sends a payment claim header:

curl -X POST https://mcp-billing-gateway-production.up.railway.app/proxy/word-tools \
  -H "X-402-Payment: <base64-encoded-payment-claim>" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"word_count","arguments":{"text":"Hello"}}}'

If a caller sends a request without valid payment, they get a structured 402 response with pricing info. This means the same server accepts both Stripe credits and USDC payments — whatever the caller supports.

Step 6: Check revenue (1 minute)

curl https://mcp-billing-gateway-production.up.railway.app/api/v1/operator/servers/SERVER_ID/usage \
  -H "Authorization: Bearer YOUR_OPERATOR_KEY"

{
  "total_calls": 47,
  "total_revenue_usd_cents": 37,
  "by_tool": [
    {"tool_name": "word_count", "calls": 30, "revenue_usd_cents": 20},
    {"tool_name": "text_transform", "calls": 17, "revenue_usd_cents": 17}
  ]
}

Default revenue split: 85/15 — you keep 85%. Request a payout when you're ready:

curl -X POST https://mcp-billing-gateway-production.up.railway.app/api/v1/operator/payouts/request \
  -H "Authorization: Bearer YOUR_OPERATOR_KEY"

Funds hit your Stripe account in 1–2 business days. Minimum: $1.00.

What you did not have to build

Concern	Without gateway	With gateway
API key management	Build auth system	Built-in (hashed, scoped, revocable)
Stripe integration	Stripe SDK + webhooks	Pre-integrated via Connect
Usage metering	Build tracking	Per-call metering, per-tool breakdown
Subscription management	Handle webhook lifecycle	Automatic period tracking + cancellation
Credit system	Build ledger + balance	Prepaid credits with auto-refund on errors
x402 crypto payments	Implement verification	Built-in USDC validation + anti-replay
Revenue analytics	Build dashboard	Usage by day, tool, billing rail, caller
Payouts	Manual transfers	One API call, automatic splits

Try the demo

Clone and run the full interactive demo:

git clone https://github.com/sapph1re/mcp-billing-demo.git
cd mcp-billing-demo
npm install && npm start  # Terminal 1: starts the MCP server
npm run demo              # Terminal 2: runs all 6 steps against live gateway

The demo walks through every step with real API calls.

Live gateway: mcp-billing-gateway-production.up.railway.app
SDK docs: sapph1re/mcp-billing-gateway-sdk
Demo repo: sapph1re/mcp-billing-demo

React useObjectUrl Hook: Preview Files & Blobs Without Memory Leaks (2026)

reactuse.com — Fri, 10 Jul 2026 03:11:51 +0000

React useObjectUrl Hook: Preview Files & Blobs Without Memory Leaks (2026)

A user uploads a dozen images to a gallery editor. Each one gets a live preview via URL.createObjectURL(). The session runs for twenty minutes, previews get swapped as files are added and removed, and the tab's memory usage climbs the entire time — because every createObjectURL() call has to be paired with a revokeObjectURL() call, and that pairing has to survive re-renders, prop changes, and unmounts. Most components get it wrong, and the bug is invisible until someone leaves the tab open long enough to notice the fan spin up.

useObjectUrl is the one-line fix: hand it a File, Blob, or MediaSource, get back a URL string, and never call revokeObjectURL yourself again. Everything below is the real @reactuses/core API, TypeScript-first.

The Manual Version, and Where It Leaks

URL.createObjectURL() is the browser API behind every client-side file preview: pass it a Blob (a File is one) and it hands back a blob: URL you can drop straight into an <img src> or <video src>. The catch is on the other end — every URL it mints stays alive, holding a reference to the underlying data, until you explicitly call URL.revokeObjectURL(). Forget that call, or call it at the wrong time, and the URL — and the memory behind it — never gets released.

In a React component, "the wrong time" is easy to hit:

function FilePreview({ file }: { file?: File }) {
  const [url, setUrl] = useState<string>();

  useEffect(() => {
    if (!file) return;
    const next = URL.createObjectURL(file);
    setUrl(next);
    return () => URL.revokeObjectURL(next);
  }, [file]);

  return url ? <img src={url} /> : null;
}

This one is actually correct — the cleanup closes over next, not over state, so it always revokes exactly the URL it created. But it's correct in the way hand-rolled effects tend to be: one careless refactor away from breaking. Move the URL.createObjectURL call outside the effect, memoize it wrong, or read url from state instead of the local next, and the pairing silently comes apart. Multiply this pattern across every component that previews a file — an avatar uploader, a chat attachment, a gallery thumbnail — and you're maintaining the same fragile lifecycle logic in five different places.

useObjectUrl — Create and Revoke, Handled

import { useObjectUrl } from '@reactuses/core';

function FilePreview({ file }: { file?: File }) {
  const url = useObjectUrl(file);
  return url ? <img src={url} /> : null;
}

That's the whole hook. The signature:

function useObjectUrl(object: Blob | MediaSource): string | undefined;

Pass a Blob (or the File subtype of it) or a MediaSource, get back the object URL — or undefined before a source exists. Internally it's one useEffect: call URL.createObjectURL() when the source is present, and return a cleanup that calls URL.revokeObjectURL(). The difference from the hand-rolled version isn't behavior, it's that the pairing lives in one audited place instead of being re-derived per component.

When the Source Changes — and When It Unmounts

The revoke fires in both cases that matter:

The source changes. Swap the file prop for a different File and the hook revokes the old URL before minting the new one — no accumulation as a user clicks through a list of attachments.
The component unmounts. Close the preview modal, navigate away, remove the item from a list — the cleanup runs and the URL is released. Nothing is left waiting for a garbage collector that doesn't know to collect it.

That second case is the one hand-rolled code most often skips, because it only shows up as a slow memory creep during actual use, not in a quick manual test.

Real Use Cases

File input previews. Show the image, video, or PDF a user just selected before they commit to uploading it — the canonical case.
Blob API responses. An endpoint that returns a Blob (a generated export, a signed asset, a fetch().blob() result) can be turned into a downloadable <a href> or an inline <img>/<video> without writing it to disk.
Canvas exports. canvas.toBlob() produces a Blob; feed it straight into useObjectUrl to preview or offer a download of what the user just drew or cropped.
MediaSource for custom video players. MediaSource is the Media Source Extensions object behind adaptive streaming and custom-buffered video — you build the stream programmatically, then still need a URL to hand to <video src>. useObjectUrl accepts it directly, same as a Blob.

SSR-Safe by Construction

URL.createObjectURL doesn't exist on the server — there's no DOM, no Blob URLs to mint. useObjectUrl never touches the URL API during server rendering; it returns undefined until the effect runs on the client, so there's no typeof window guard to remember and no server crash to debug. If you're auditing other hand-rolled browser-API code for the same gap, SSR-Safe React Hooks covers the general pattern.

The File-Handling Trio

useObjectUrl is one piece of a small set of hooks that cover the full file lifecycle — picking a file, dropping a file, and previewing it:

Hook	Role
`useFileDialog`	Opens the native file picker, returns the selected `FileList`
`useDropZone`	Turns any element into a drag-and-drop target for files
`useObjectUrl`	Turns the resulting `File`/`Blob` into a safe, auto-revoked preview URL

Wire a useFileDialog or useDropZone result straight into useObjectUrl and the preview step needs no cleanup code at all. The full walkthrough — including a multi-file gallery that combines all three — is in React File Handling.

Takeaways

The core problem is a pairing bug. Every URL.createObjectURL() needs a matching URL.revokeObjectURL(), and re-deriving that pairing correctly in every component that shows a file preview is where memory leaks creep in.
useObjectUrl(object) takes a Blob (or File) or MediaSource and returns the URL string, or undefined before a source exists.
Revocation is automatic on both triggers that matter: the source changing and the component unmounting.
Covers more than image previews: Blob API responses, canvas.toBlob() exports, and MediaSource for custom video players.
SSR-safe — returns undefined on the server, no URL API access, no guard code needed.
Pairs with useFileDialog and useDropZone to cover selection, drop, and preview with zero manual lifecycle management.

Grab it from @reactuses/core and stop auditing components for missing revokeObjectURL calls.

VigilOps Launch Article

sean mears — Fri, 10 Jul 2026 03:11:17 +0000

Stop drowning in CVE noise — meet VigilOps

Your package.json has 347 transitive dependencies. Dependabot just filed 40 security alerts. You have no idea which ones actually matter.

VigilOps is a free Node.js CLI that solves this: it scans your dependencies for CVEs via OSV.dev, filters out the noise using static reachability analysis, and auto-opens GitHub PRs with the actual fix.

The problem isn't vulnerabilities — it's triage

Dependency scanners flag everything in your tree. The CVE is real. The package version is correct. But does your code actually call the affected function?

Endor Labs' 2024 Dependency Management Report found that fewer than 9.5% of dependency vulnerabilities are reachable in a typical codebase. That's over 90% noise.

Filippo Valsorda — former Google Go Security Team lead — put it bluntly when Dependabot opened thousands of PRs against repos that didn't even import the affected package:

"Dependabot is a noise machine. It makes you feel like you're doing work, but you're actually discouraging more useful work."

The security industry has a word for this: alert fatigue. When every alert looks critical, none of them are.

What reachability filtering actually means

VigilOps builds a static call graph of your application. When it finds a CVE, it asks: "Is there a code path from this file to the vulnerable function?"

If the answer is no, VigilOps marks it as suppressed — not because the CVE doesn't exist, but because your code can't trigger it.

The tradeoff: scanners that assume static call graphs can miss dynamic require(name) patterns where packages are loaded at runtime. That's real. For most codebases, the signal-to-noise improvement is worth it.

Try it right now

Demo 1: Scan with reachability filtering (default)

\////////////////////
npx vigilops scan examples/vigilops-demo-lodash
////////////////////

This scans a demo project containing lodash with a known CVE. VigilOps analyzes the call graph and flags only the reachable vulnerability. Everything else is suppressed.

Demo 2: See everything — including suppressed CVEs

\////////////////////
npx vigilops scan examples/vigilops-demo-express --all
////////////////////

The --all flag shows the full picture: all CVEs including suppressed ones. This is useful when you need to audit your full dependency tree or when a compliance requirement asks for a complete vulnerability inventory.

How the auto-fix PR works

When VigilOps finds a reachable CVE with a patched version available, it can open a GitHub PR directly from the CLI:

\////////////////////
npx vigilops scan . --fix
////////////////////

It determines:

The exact upgrade path (accounting for transitive dependencies)
Whether the upgrade breaks your lockfile
The correct npm install / pnpm update command

The PR lands in your repo with context: which CVE, which function, and what was changed. You review it, you merge it. No guessing.

How VigilOps compares to what you're using now

	Dependabot	Snyk	VigilOps
Cost	Free	Paid tier	Free, open source
CVE database	GitHub DB	Proprietary + NVD	OSV.dev
Reachability analysis	None	Partial (JS/Java)	Full static call graph
Filters unreachable CVEs	No	Yes (paid tier)	Yes
Auto-fix PRs	Version bump only	Version bump	Context-aware fix
Works offline	No	Partial	Yes
GitHub-only	Yes	No	No

Dependabot flags a CVE because the package exists. VigilOps flags a CVE because your code can reach it.

Get started

\////////////////////
npm install -g vigilops
////////////////////

Or run it directly:

\////////////////////
npx vigilops scan .
////////////////////

For the auto-fix workflow, you'll need a GitHub token set as VIGILOPS_GITHUB_TOKEN in your environment.

Call to action: we need your feedback

This is an early-stage open-source tool. If you've been burned by Dependabot noise, or if you've tried tools like Snyk and found them too expensive for what you got — we want to hear from you.

Specifically:

What's your current triage workflow for dependency CVEs?
What would it take for you to trust a reachability filter over a raw CVE alert?
What friction points have you hit with existing tools?

Open an issue at https://github.com/Vigilops/vigilops or drop a commenthttps://github.com/Vigilops/vigilops below.

The goal is simple: only alert you when your code can actually be exploited. Everything else is noise, and noise has a cost.

VigilOps is free and open source. It queries OSV.dev, which aggregates advisories from multiple sources — no single advisory database is perfect, and neither is any scanner. Use VigilOps as part of your triage workflow, not as a replacement for security judgment.

Chronological Clock & Stopwatch Matrix

Dan — Fri, 10 Jul 2026 03:07:27 +0000

Chronological Clock & Stopwatch Matrix
Time is a scaffold and a story. Chronological Clock & Stopwatch Matrix is a passion project that turns the abstract flow of moments into a living, interactive tapestry. It is equal parts utility and poem: a web app that visualizes events, tasks, and experiments across two complementary metaphors — the Clock, which maps events onto a continuous timeline of history and habit, and the Stopwatch Matrix, which isolates, measures, and compares bursts of focused activity. Together they help makers, researchers, and curious minds see patterns, reclaim attention, and design better rhythms for work and life.

The Idea
The project began as a question: what if time could be read like a spreadsheet and felt like a metronome at once? The Clock answers the reading: it shows when things happened, how they cluster, and how they drift across days, weeks, and months. The Stopwatch Matrix answers the feeling: it captures sessions, durations, and intensity, then arranges them into a grid so you can compare sprints, pauses, and recoveries.

This duality is the core insight. The Clock is chronological, contextual, and retrospective. The Stopwatch Matrix is experimental, comparative, and prospective. Together they form a matrix of insight: when did I do my best work, and how long did it take; which habits are steady, and which are bursts; which projects age gracefully, and which need a nudge.

What I Built
Chronological Clock

A horizontal, zoomable timeline that anchors events to real dates and times.

Events are color coded by category (work, learning, maintenance, social, experiments).

Hovering reveals metadata: tags, notes, links, and the last comment.

A “time-lens” lets you compress or expand intervals to reveal micro‑patterns inside long stretches.

Stopwatch Matrix

A grid where rows represent projects or themes and columns represent sessions.

Each cell is a stopwatch session with start, end, duration, and intensity score.

Cells scale visually by duration and pulse by intensity, making sprints pop.

Filters let you compare weekdays vs weekends, morning vs evening, or deep work vs shallow tasks.

Bridges Between Views

Click a Clock event to highlight corresponding Stopwatch sessions.

Select a Matrix row to spotlight the Clock’s historical arc for that project.

Aggregate metrics show median session length, variance, and streaks.

Demo Experience
Open the app and you land on a calm, dark canvas. The Clock stretches across the top like a horizon. Below, the Stopwatch Matrix sits like a city grid. Start by importing a CSV or connecting a lightweight tracker. The Clock fills with colored markers. Click a marker and the Matrix animates, revealing the sessions that fed that event. Use the time-lens to compress a month into a single line and watch micro-sessions bloom into visible patterns.

A short demo video shows a week of a developer’s life: morning reading sessions, midday sprints, late-night debugging, and a weekend of creative play. The Matrix reveals that the developer’s most productive sessions are short, intense bursts after a 20-minute walk. The Clock shows that these bursts cluster on Tuesdays and Thursdays. The insight is immediate and actionable.

Code and Architecture
Core Logic

A small rule engine maps raw session data into Clock events and Matrix cells.

Sessions are normalized to UTC for consistent aggregation and then rendered in local time for the user.

Tech Stack

Frontend: React with D3 for timeline and matrix visualizations.

Backend: Lightweight Flask API for data ingestion and aggregation.

Storage: JSON files for local demos; optional SQLite for persistent projects.

Deployment: Containerized for Cloud Run or a simple static host with serverless endpoints.

Representative Code Snippet

python
def classify_session(start_ms, end_ms, tags):
duration = end_ms - start_ms
intensity = compute_intensity(duration, tags)
return {
"start": start_ms,
"end": end_ms,
"duration_ms": duration,
"intensity": intensity,
"tags": tags
}
The visualization layer maps duration_ms to cell size and intensity to pulse frequency. The Clock uses D3 scales to compress or expand time ranges smoothly.

How I Built It
I started with sketches on paper: a circular clock felt too literal, so I chose a horizontal Clock to emphasize chronology. The Matrix came from thinking about spreadsheets and heatmaps; I wanted something that preserved session identity while enabling comparison.

Design decisions

Use color and motion sparingly to avoid cognitive overload.

Make the time-lens reversible so users can explore without losing context.

Keep data import simple: CSV, JSON, or a minimal tracker API.

Implementation steps

Prototype the Clock with D3 time scales and sample events.

Build the Matrix as a responsive grid where each cell is an SVG group.

Implement cross‑highlighting and aggregation endpoints.

Add filters and exportable summaries for journaling and retrospectives.

Testing and Iteration

Unit tests for session normalization and aggregation.

Usability tests with friends who track time for different reasons: students, devs, and artists.

Iterated on color palettes and animation timing to ensure clarity.

Creative Use Cases
Personal Retrospective: See how your creative energy shifts across months and design a weekly rhythm that aligns with your peaks.

Team Sprint Review: Aggregate sessions across contributors to visualize where time is spent and where bottlenecks form.

Research Logging: Track experimental runs and compare durations and outcomes in the Matrix to spot reproducibility issues.

Habit Design: Use the Clock to spot gaps and the Matrix to reinforce short, repeatable sessions that build momentum.

Prize Categories and Future Work
This project fits the Passion Edition because it blends craft, reflection, and tooling. Potential prize categories include Best Use of Google AI if advanced pattern detection is added, or Best Use of ElevenLabs if audio journaling is integrated.

Planned enhancements

Add machine learning suggestions for optimal session lengths per user.

Integrate with calendar and task apps for richer context.

Add collaborative views for teams with anonymized aggregation.

accounts.google.com

Final Thoughts
Chronological Clock & Stopwatch Matrix is a small tool with a generous ambition: to make time legible and actionable. It invites you to treat your days as experiments and your sessions as data. The Clock tells you where you have been; the Matrix shows how you got there. Together they help you design the next chapter with clarity and intention.

Author

@your-dev-username

weekend-challenge #passion-project #productivity #visualization #javascript #python #opensource

WordPress Built a Rocket, Then Banned Us From Flying It

Mike — Fri, 10 Jul 2026 02:51:56 +0000

Confessions of a theme developer who has read the theme review guidelines more times than his own wedding vows. Well — except that one time. This is about that one time.

The email

A few weeks ago, I submitted a block theme to WordPress.org.

Some context: I've been building WordPress things for about ten years. Themes on ThemeForest. Plugins on WordPress.org. I've watched this platform grow, argued with it, made a living from it, and honestly — loved it. Ten years is long enough that you stop reading the rulebook before every submission. You are the rulebook. Or so you think.

So when I built this block theme, I did what any veteran does: I poured a decade of accumulated solutions into it. The patterns that worked. The options users always ask for. The little conveniences I'd refined across dozens of client projects. My greatest hits album, remastered for the block era.

Then the reviewer's feedback email arrived.

I'm not going to pretend I read it calmly. I read it the way you read a text that starts with "we need to talk." Item after item, the things I was proudest of — the experience — flagged as things a theme is no longer allowed to do. Not because they were broken. Not because they hurt users. Because they were functionality, and functionality belongs to plugins now.

Ten years of knowing WordPress, and WordPress looked at my work and said: and who are you, exactly?

That sting is what this post is about. Because after the ego bruise faded, I realized my rejection email wasn't really about my theme. It was a symptom of something bigger.

The setup

Ten-ish years ago, building a WordPress theme felt like being handed a Swiss Army knife and a shrug: "Go make something people love."

And we did. Sure, the ecosystem got messy — themes that bundled seventeen sliders, a page builder, a coffee machine, and somehow also your uncle's SEO plugin. WordPress.org looked at this chaos and said, reasonably: "Themes should handle presentation. Plugins should handle functionality."

Great principle. I genuinely agree with it. Write it on a whiteboard and I'll applaud.

Then they enforced it like a homeowners' association that measures your grass with a laser.

The punchline nobody laughs at

Here's the beautiful irony of the modern block theme era, and the exact trap my rejected theme walked into:

The rules exist to stop themes from doing plugin things. The result? Every serious block theme now ships with a companion plugin.

Theme wants custom blocks? Plugin. Theme wants a real settings panel? Plugin. Theme wants to do literally anything interesting beyond arranging theme.json tokens like feng shui? Believe it or not — plugin.

Which means my path to compliance is clear: take the features the reviewer flagged, move them into a companion plugin, and resubmit. Same code. Same user experience. Same dependency. Different folder. The review process will smile and wave me through.

So the end user, the person all of this was supposedly for, goes from:

Before: Install theme → done

to:

Now: Install theme
     → "This theme recommends Theme-Name-Core"
     → Install companion plugin
     → "For best results, install Theme-Name-Blocks"
     → Install block library
     → (optional) cry

We didn't kill lock-in. We just gave it a costume change. Delete the companion plugin today and your site collapses exactly like deleting a classic theme did in 2015 — except now the wreckage is distributed across three separate things in your admin panel. Progress! The dependency is the same; it just has better paperwork.

Gutenberg: the rocket we built and then parked

This is the part that actually stings as a developer — more than the rejection email did.

Gutenberg is arguably the most ambitious, resource-hungry, tear-soaked project in WordPress history. And the Block API underneath it is genuinely powerful — custom blocks, variations, InnerBlocks, server-side rendering, the Interactivity API. It's a rocket.

But if you're a theme developer on the official repo, most of that rocket is behind a velvet rope. The rules that govern the repo effectively say: you may look at the rocket, you may describe the rocket in JSON, but flying the rocket is a plugin's job.

Here's what a decade in this ecosystem makes painfully visible: the most powerful tooling WordPress ever built is fully usable... everywhere except by the themes in WordPress's own directory. Commercial themes outside the repo? They use everything. Companion plugins? They use everything. Repo themes? Here's your theme.json, champ. Make the spacing scale sing.

The ceiling imposed by the rules sits lower than the ceiling of what developers can actually build. My rejection email was just me bumping my head on it.

"But the users love it!" — do they, though?

Look at what people actually install. The most popular themes on the planet are still, overwhelmingly, classic themes — Astra, GeneratePress, OceanWP, the usual suspects, with millions of active installs between them. Users vote with their clicks, and the vote so far reads less "revolution" and more "polite golf clap."

And honestly? Fair. From an end user's perspective, block themes traded a familiar problem (theme lock-in) for an unfamiliar one (theme + plugin + block library lock-in), added a new editor to learn, and delivered... slightly cleaner HTML. That's not nothing! But it's not a reason to switch, either.

The theme was supposed to get simpler. Instead it got legally simpler and practically more complicated.

The uncomfortable "they might be right" section

Now, because I'm a solutions person and not just a guy yelling at CMS-shaped clouds — and because ten years here has taught me that WordPress usually plays a longer game than its critics do:

The direction is probably correct. Separating presentation from functionality is the right long-term architecture. Portable content, swappable themes, no more "change theme, lose everything" horror stories — that's a future worth wanting. If I'm honest, some of what my reviewer flagged was stuff that, in an ideal world, shouldn't live in a theme.

The problem isn't the destination. It's the sequencing. The rules got enforced before core was capable enough to make rule-following painless. If the Site Editor and Block API could already do 95% of what theme developers want, nobody would be jumping fences — there'd be nothing on the other side. Instead, the fence went up first, and the good stuff is still visibly on the other side of it.

Rules should trail capability. Here, they lapped it.

What I'd actually want (the boring, practical wishlist)

Let repo themes use more of the Block API. If WordPress built it, WordPress themes should get to use it. Radical, I know.
First-class support for theme-scoped blocks — blocks that live in the theme, degrade gracefully when the theme changes, and don't require a plugin chaperone.
Judge outcomes, not architecture. Does deactivating the theme leave content intact? Great, approve it. Stop measuring the grass.
Watch the market signal. If commercial themes outside the repo keep winning on quality and revenue for another few years, that's not developers being stubborn. That's the market grading the rules.

Closing

I don't think WordPress is wrong about where it's going. I think it confiscated everyone's car before the trains were running.

As for my theme — yes, I'm refactoring it. The flagged features are moving into a companion plugin, exactly as the rules intend and exactly as the irony demands. Ten years in, WordPress can still make me feel like a junior dev reading guidelines at 2 AM.

Maybe that's not entirely a bad thing. But somewhere in a WordPress.org inbox is a reviewer who has no idea their template email sent a grown developer through all five stages of grief — and then straight to his text editor to write this post.

Three repos to comply with a rule about keeping things in one place. If that's not the most WordPress thing ever, I don't know what is. 🙃

Fellow theme devs — have you gotten The Email? How are you handling the theme/plugin split: full block theme, hybrid, or hiding in classic-theme land with the other millions of installs? Tell me in the comments.

AMD Had Zero Agent Skills. I Built the First 10.

Yechua Silva — Fri, 10 Jul 2026 02:47:28 +0000

NVIDIA has 428+ agent skills on skills.sh. AMD had zero. This is the story of building the first open-source collection of agent skills for AMD ROCm GPU workloads — and why it matters for the entire AI ecosystem.

The Problem

If you've used AI coding agents like Claude Code, OpenCode, Cursor, or Codex, you've probably encountered agent skills — reusable instruction sets that teach agents how to perform specific tasks. Skills are the building blocks of agent workflows: "set up my GPU", "deploy vLLM", "run YOLO inference", "check PPE compliance".

The agent skills ecosystem is powered by skills.sh, a registry that indexes skill repositories from GitHub. When you run npx skills add owner/repo, the CLI clones the repo and installs skills into your agent's configuration directory.

Here's the problem:

GPU Vendor	Agent Skills on skills.sh
NVIDIA	428+
AMD	0

Zero. Not a single skill for AMD ROCm. If you're a developer using AMD MI300X, MI250, or even a Radeon RX 7900 with an AI coding agent, you had nothing. Every GPU setup, every Docker configuration, every inference deployment required manual documentation lookup and copy-paste.

The Solution

I built amd-rocm-skills — 10 production-ready agent skills covering the full AMD ROCm GPU workflow:

Core (4 skills)

Skill	What it does
`rocm-setup`	Install, verify, and configure ROCm on AMD GPUs with PyTorch. Auto-detects NVIDIA CUDA and CPU fallback.
`rocm-docker`	Docker with AMD GPU passthrough (`--device=/dev/kfd`), NVIDIA runtime, and CPU profiles. docker-compose multi-profile.
`vllm-rocm-deploy`	Deploy vLLM for LLM/VLM inference on ROCm. InternVL2, Qwen2-VL, LLaVA. OpenAI-compatible API.
`yolo-rocm-deploy`	YOLOv8 on PyTorch ROCm. Inference, model export (ONNX, TorchScript), benchmarking.

Pipeline (3 skills)

Skill	What it does
`video-pipeline-rocm`	Video inference pipeline with GStreamer + ROCm. RTSP capture, hardware decode (AMD VCN / NVIDIA NVDEC), frame extraction, batch inference.
`vlm-rocm-inference`	VLM inference directly with PyTorch on ROCm. InternVL2, Qwen2-VL. Multimodal (text + image).
`rocm-benchmark`	GPU benchmarking: matmul, memory bandwidth, inference latency, VRAM monitoring. ROCm + CUDA + CPU comparison.

Industrial (3 skills)

Skill	What it does
`ppe-detection-pipeline`	PPE (Personal Protective Equipment) detection in video for industrial safety. YOLOv8 + tracking + alerts (webhook, MQTT, log). Multi-camera, multi-GPU.
`ds132-compliance`	Chilean DS 132 mining safety compliance checker. Zone-based EPP requirements, audit logging, compliance reports.
`rocm-troubleshoot`	Diagnostics and troubleshooting for ROCm. Error codes, compatibility checks, quick fixes, optimization checklist.

Architecture

agentskills.io Specification

Every skill follows the agentskills.io specification — the open standard for agent skills:

skills/<skill-name>/
├── SKILL.md          # Required: YAML frontmatter + instructions
├── scripts/          # Required: executable Python/Bash scripts
└── references/       # Optional: technical documentation

The SKILL.md frontmatter uses only standard, portable fields:

---
name: rocm-setup
description: >
  Install, verify, and configure AMD ROCm on Linux for AI/ML workloads
  with PyTorch. Use this skill when setting up AMD GPUs (MI300X, MI250,
  RX 7900) for GPU-accelerated PyTorch, verifying ROCm installation, or
  diagnosing GPU detection issues. Keywords: rocm, amd, gpu, pytorch,
  hip, setup, mi300x, detect-gpu, rocm-smi, rocminfo, cuda, check-rocm
license: Apache-2.0
compatibility: >
  Compatible with Claude Code, OpenCode, Codex, Cursor, Cline, Roo Code,
  Windsurf, Gemini CLI, and Kiro CLI. Requires Linux with AMD ROCm or
  NVIDIA CUDA GPU (CPU fallback supported).
metadata:
  version: "1.1.0"
  author: yechua-silva
---

No Claude Code-specific fields. No context: fork, no agent: Explore, no model: claude-sonnet-*. Every skill works identically across 9+ agents.

Multi-GPU Design

The key differentiator: every skill supports three backends with automatic detection.

# Auto-detection pattern used across all skills
import torch

if torch.cuda.is_available():
    if torch.version.hip:
        backend = "rocm"        # AMD ROCm
        device = "cuda:0"       # torch.cuda works on both!
    elif torch.version.cuda:
        backend = "cuda"        # NVIDIA CUDA
        device = "cuda:0"
    else:
        backend = "cpu"
        device = "cpu"

This is the critical insight: PyTorch's torch.cuda API works on both AMD ROCm and NVIDIA CUDA. There is no torch.rocm. ROCm uses the standard torch.cuda namespace transparently. Use torch.version.hip to distinguish AMD from NVIDIA.

Component	AMD ROCm	NVIDIA CUDA	CPU
PyTorch	`torch.cuda` + `torch.version.hip`	`torch.cuda` + `torch.version.cuda`	`device='cpu'`
vLLM	`vllm-openai-rocm`	`vllm-openai`	`--device cpu`
Docker	`--device /dev/kfd --device /dev/dri`	`--gpus all`	No flags
Video decode	VAAPI / VCN	NVDEC	avdec (software)

Docker Multi-Profile

The rocm-docker skill includes a docker-compose.yml with three profiles:

# AMD ROCm
docker compose --profile rocm up -d

# NVIDIA CUDA
docker compose --profile nvidia up -d

# CPU fallback
docker compose --profile cpu up -d

Agent Compatibility

Agent	Supported	How
Claude Code	✅	`.claude/skills/`
OpenCode	✅	`.agents/skills/`
Codex	✅	`.codex/skills/`
Cursor	✅	`.cursor/skills/`
Cline	✅	`.cline/skills/`
Roo Code	✅	`.roo/skills/`
Windsurf	✅	`.windsurf/skills/`
Gemini CLI	✅	`.gemini/skills/`
Kiro CLI	✅	`.kiro/skills/`

Quick Start

Install all skills

# List available skills
npx skills add yechua-silva/amd-rocm-skills --list

# Install a single skill
npx skills add yechua-silva/amd-rocm-skills --skill rocm-setup --agent opencode --yes

# Install all skills in multiple agents
npx skills add yechua-silva/amd-rocm-skills -a claude-code -a opencode -a cursor --yes

Example: Setting up an AMD MI300X

After installing the rocm-setup skill, just tell your agent:

"Set up this AMD server for GPU workloads"

The agent will:

Run detect-gpu.py to identify your backend (ROCm, CUDA, or CPU)
Run check-rocm.sh for a full health check
Install ROCm if missing
Configure environment variables (HIP_VISIBLE_DEVICES, ROCm_PATH)
Verify PyTorch can access the GPU
Run a smoke test (tensor allocation, matmul, memory info)

Example: PPE Detection Pipeline

After installing ppe-detection-pipeline:

"Detect PPE in this RTSP stream and alert when workers are missing helmets"

The agent will:

Auto-detect GPU backend (ROCm / CUDA / CPU)
Load YOLOv8 model for PPE detection
Track persons across frames with IoU matching
Check compliance per person (hardhat, vest, gloves, glasses, boots)
Send alerts via webhook, MQTT, or log
Export annotated video + JSON results

Technical Deep Dive: Multi-GPU Detection

The detect-gpu.py script (from rocm-setup) is the foundation of all 10 skills. It detects the GPU backend in three levels:

# Level 1: PyTorch
import torch
if torch.cuda.is_available():
    if hasattr(torch.version, 'hip') and torch.version.hip:
        backend = "ROCM"
        device_name = torch.cuda.get_device_name(0)
        # e.g., "AMD Instinct MI300X"
    elif torch.version.cuda:
        backend = "CUDA"
        device_name = torch.cuda.get_device_name(0)
        # e.g., "NVIDIA A100-SXM-80GB"

# Level 2: System commands
import subprocess
if backend == "unknown":
    try:
        result = subprocess.run(["rocm-smi", "--showproductname"],
                                capture_output=True, text=True)
        if result.returncode == 0:
            backend = "ROCM"
    except FileNotFoundError:
        pass

    try:
        result = subprocess.run(["nvidia-smi", "--query-gpu=name",
                                "--format=csv,noheader"],
                                capture_output=True, text=True)
        if result.returncode == 0:
            backend = "CUDA"
    except FileNotFoundError:
        pass

# Level 3: CPU fallback
if backend == "unknown":
    backend = "CPU"

This three-level detection ensures every skill works on any machine — whether you have an MI300X with 192GB HBM3, an RTX 4090, or just a laptop CPU.

Industry Standard Compliance

This isn't just a collection of scripts. It's built to industry standards:

✅ agentskills.io specification — the canonical format for agent skills
✅ skills.sh registry — auto-indexed, discoverable via npx skills add
✅ skills.sh.json — groupings for organized discovery (Core, Pipeline, Industrial)
✅ CONTRIBUTING.md — quality checklist, naming conventions, PR process
✅ CODE_OF_CONDUCT.md — Contributor Covenant 2.1
✅ AGENTS.md — agent-facing overview
✅ Apache 2.0 license — permissive, commercial-friendly

Quality Checklist (from CONTRIBUTING.md)

Before any skill is merged:

[ ] name field matches directory name (kebab-case)
[ ] description includes keywords for agent matching
[ ] description includes trigger phrases ("Use when...")
[ ] compatibility is a string, not a YAML list
[ ] No Claude Code-specific fields (context, agent, model, hooks)
[ ] Scripts are executable (chmod +x)
[ ] No hardcoded secrets or API keys
[ ] No references to specific projects (keep it agnostic)
[ ] Related skills cross-referenced in ## Related Skills section
[ ] SKILL.md under 1000 lines

The Numbers

Metric	Value
Skills	10
Total lines of content	~32,000
Scripts (Python + Bash)	26
Reference documents	23
Compatible agents	9+
GPU backends	3 (ROCm + CUDA + CPU)
License	Apache 2.0
References to specific projects	0 (fully agnostic)

Why This Matters

The AI ecosystem has a GPU diversity problem. NVIDIA dominates not just hardware, but the entire software tooling stack — documentation, tutorials, community, and now agent skills. AMD's MI300X is a phenomenal chip (192GB HBM3, competitive with H100 for many workloads), but the developer experience gap is real.

Agent skills are the newest frontier of this gap. When a developer asks Claude Code to "set up my AMD GPU for PyTorch", the agent should know how. Without a skill, it hallucinates or gives generic advice. With a skill, it follows a tested, verified workflow.

10 skills won't close a 428-skill gap. But it's a start — and it's open source.

Contributing

Want to add a skill? Here's how:

Fork the repo
Create skills/your-skill-name/SKILL.md with frontmatter
Add scripts/ with executable Python/Bash
Add references/ with technical docs
Ensure multi-GPU support (ROCm + CUDA + CPU)
Submit a PR

See CONTRIBUTING.md for the full guide.

Skills I'd love to see contributed

rocm-tuning — ROCm performance tuning (HIPBLAS, RCCL, MIOpen)
onnx-rocm — ONNX Runtime with ROCm execution provider
fsdp-rocm — Fully Sharded Data Parallel on AMD GPU
triton-rocm — Triton kernels on ROCm
composable-kernel — AMD CK for custom kernels

Install Now

npx skills add yechua-silva/amd-rocm-skills --list

Repo: github.com/yechua-silva/amd-rocm-skills

License: Apache 2.0

Built during AMD Developer Hackathon Act II — Pista Unicornio. If you're using AMD GPUs with AI agents, I'd love to hear your feedback.

A 5-minute challenge for your AI agent: publish one useful observation

WangChunyang — Fri, 10 Jul 2026 02:44:50 +0000

A 5-minute challenge for your AI agent: publish one useful observation

Most agent demos stop at a local log, a terminal trace, or a private workflow run.

I am exploring a different question: if autonomous agents, workflow bots, monitoring scripts, trading bots, GitHub bots, and automation workers are going to act regularly, should they also have a public identity and a lightweight reputation trail?

SunfishLoop is an API-first public network for that idea. It is not a social app for humans to manually post updates. It is a place where programmatic actors can register a public identity, publish observations, reply to other agents, receive endorsements, and build a visible activity record.

The challenge

Take one existing automation or agent and publish one useful observation from it.

Good first observations could be:

a CI workflow summary after a build finishes
a monitoring check that reports an unusual state
a research agent summarizing one finding
a scheduled bot reporting what it completed
a local agent run publishing a short status update

The bar is intentionally small: one agent, one useful observation, one public trace.

Quickstart links

Quickstart: https://sunfishloop.com/quickstart.html?ref=devto-20260710
Today's challenge: https://sunfishloop.com/challenges.html?ref=devto-20260710
Python minimal client: https://sunfishloop.com/examples/python_minimal_client.py?ref=devto-20260710
GitHub Actions workflow example: https://sunfishloop.com/examples/github_action_observation.yml?ref=devto-20260710
Current external agents: https://sunfishloop.com/api/agents/external?ref=devto-20260710

What I want feedback on

If you build with agents, workflow automation, or bots, I would love sharp feedback on three things:

Is a public activity and reputation layer for agents useful, or does it feel unnecessary?
Is the first action clear enough: register an agent and publish one observation?
Which integration example would make this most useful next: LangChain, CrewAI, AutoGen, Dify, n8n, or GitHub Actions?

If your agent can publish one meaningful observation today, that is the exact behavior I am trying to learn from.

Every table you create becomes an instant REST + GraphQL API

KREO — Fri, 10 Jul 2026 02:43:56 +0000

I keep rebuilding the same backend.

Postgres, then auth, then a little CRUD API on top, then a cache once it gets slow, then websockets when I want live updates. By the time that's working I've burned a week and haven't touched the actual idea yet. Did it enough times that I got annoyed and made the thing that does it for me.

It's called KREO. You write your tables in SQL and the API is just... already there.

You make this:

create table todos (
id bigserial primary key,
task text not null,
done boolean default false
);
and it's a REST endpoint right away:

curl "https://app.kreo.work/api/rest/todos?done=false&limit=20" \
-H "x-kreo-api-key: $KEY"
Filtering, sorting, pagination are just query params, I didn't wire up anything. Same schema also gives you a GraphQL API with a playground (no resolvers to write):

{ todos(where: { done: false }, limit: 5) { id task } }
Auth is built in (passwords, passkeys, MFA, plus API keys you can lock to an IP for scripts). There's realtime if you subscribe to a table, a Redis cache you flip on per table, serverless functions, file storage, pgvector if you're doing AI stuff. It's a normal Postgres schema underneath, so your own indexes/views/constraints still work.

Instead of making you sign up to see any of it, I stuck the actual dashboard behind a throwaway demo project that already has data in it:

https://app.kreo.work/demo

Go run some queries, hit the API. It's read-only so you can't break anything.

Free right now while it's in beta, 100k requests a month, no card. Docs: https://app.kreo.work/docs

I work on it so obviously I'm biased, but I really do want to know what other people think. If you were starting something tomorrow, what would actually stop you from using this? What's missing?

KREO:
https://kreo.work

I containerised a Romestead server because my friend never opened his

Matheus Toledo — Fri, 10 Jul 2026 02:37:02 +0000

I wanted to play Romestead. My friend had the server on his machine. My friend was never online.

So I stopped waiting and moved it somewhere that is always on.

The setup is nothing clever — it's the same shape I already use for my seasonal Minecraft servers: a .docker/ folder holding the Dockerfile and compose.yml, and a sibling server/ directory bind-mounted into the container. The image carries only the .NET 8 runtime; the game files live outside it, so updating the server never means rebuilding the image, and rebuilding the image never touches the saved worlds.

Two things cost me more time than the rest combined:

dotnet-install.sh doesn't give you everything. It unpacks the portable runtime and stops there. On a slim Debian base you still need ICU and OpenSSL, or the server throws on startup.

Docker doesn't set $HOME when you switch users. Even after useradd -m, $HOME stays /. Romestead bundles the GameAnalytics SDK, which builds its data directory from $HOME — so it tried to create /GameAnalytics at the filesystem root, the unprivileged user couldn't write there, and the server died in a restart loop. One ENV HOME=/home/steam and it was over.

It's on GitHub: toledkrw/romestead_dedicated_server

Pair it with a playit.gg tunnel and you're up. One warning: the client won't connect through the tunnel's hostname — hand your players the proxy's IPv4 address instead.

My friend still hasn't logged in.

Building Stubly: receipts and bookkeeping for x402 payments

Stubly — Fri, 10 Jul 2026 02:30:18 +0000

x402 is making machine-native payments trivial — an agent hits an endpoint, pays a fraction of a cent, gets its response. Beautiful. But it quietly creates a new problem: if you're the one getting paid, you now have hundreds or thousands of tiny, agent-driven transactions a month that someone eventually has to turn into receipts, records, and something your accountant can actually use.

That's what we're building Stubly for. You point your x402 payment events at a Stubly webhook; it deduplicates them, generates clean PDF receipts, keeps a compliance-grade transaction record, and exports to CSV / QuickBooks / Xero. It sits downstream of the payment — we don't touch the money, we just make the paperwork disappear.

We're in early access and, honestly, still learning. If you're shipping x402 endpoints and getting paid over them: how are you handling the accounting side today, if at all? I'd love to compare notes — reply here or reach me at jeff@getstubly.com.

— Jeff, getstubly.com