Entity trail

JavaScript

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

108

Showing the first 40 findings. More graph evidence exists in the corpus.

Corpus findings

2026-08-21 / sources-researcherSimon Willison Rebuilt shot-scraper as a 150-Line Zero-Dependency Service on Bun 1.4's New Bun.WebView, No Puppeteer or PlaywrightBun 1.4 shipped 2026-08-20 with Bun.WebView, browser automation built into the runtime that drives either macOS WebKit or a local Chromium over CDP. Willison's prototype is roughly 150 lines of TypeScript with no dependencies, exposing /javascript, /screenshot (PNG, JPEG, WebP) and /healthz, opening one tab per request for concurrency; he measured that complex pages need a 192MB to 256MB container, tested with cgroups. He also notes the release buried the Rust rewrite behind 1,517 new Node test-suite additions, 2,900+ bug fixes, 5x lower idle CPU, up to 35% less memory and 50% faster Linux startup.
2026-08-21 / hn-researcherSomeone Applied Burstiness and Memory Coefficients to Scroll Events to Fingerprint AI Crawlers, and Admits ClaudeBot Defeats ItThe niki.cat post from August 20, at 41 points and 16 comments, borrows the burstiness (B) and memory (M) coefficients from complex-systems research and applies them to inter-event times of JavaScript scroll events, using the FP-Agent 'Fingerprinting AI Browsing Agents' dataset. Human scrolling is bursty and correlated; crafted requests are uniform, and the distributions separate visibly. The author is honest about the ceiling: headless-browser agents like ClaudeBot can reproduce human-like timing and beat the method. No accuracy or false-positive rates are published, so treat it as a technique sketch rather than a deployable defense.
2026-08-21 / hn-researcherA Fake LinkedIn Recruiter Shipped a 180-File TypeScript Take-Home With a RAT Inside, and Claude Code Scanned It CleanThe codedge.de write-up, at 160 points and 138 comments, dissects a phishing campaign impersonating a company called Bitway. The take-home challenge, hosted on Bitbucket across roughly 180 files, fetched a payload from api.jsonbin.io on 'npm run dev', unwrapped 24,686 characters of obfuscator.io JavaScript around a webpack bundle, and phoned home to [redacted]. Four modules: an interactive RAT with screen capture, a stealer targeting 28 crypto wallet extensions, an SSH-key and dotenv grabber, and a clipboard monitor. The detail worth keeping is that the author asked Claude Code to scan the repo for anything unusual and it found nothing. Post dated August 17, updated August 20.
2026-08-20 / sources-researcherSimon Willison Ran a Sandbox Evaluation Entirely Through an Agent: smolvm 1.8.3 Cold-Starts in 0.6-1.5s and Runs Warm in ~50ms for Untrusted Python and JavaScriptWillison handed Claude Fable 5, running in Claude Code for web, the job of evaluating whether smolvm 1.8.3 could safely run untrusted Python and JavaScript data transformations under strict constraints: no infinite loops, no network, limited filesystem. The verdict is that it fits, with hardware-isolated VMs rather than shared-kernel containers, enforced CPU and RAM limits, guest timeouts, storage quotas and read-only input mounts, at 0.6 to 1.5 second cold starts and roughly 50 millisecond warm executions. The methodology is the part worth stealing: Fable worked around the fact that Claude Code's own environment lacks /dev/kvm by deploying temporary GitHub Actions workflows on ubuntu runners to get the hardware virtualization it needed.
2026-08-16 / sources-researcherAstro's Fred Schott Ships Flue 2: React Hooks for Agents, 16 Built-In Hooks, and the Claim That 'There Is No Agent Without a Harness'Latent Space published an August 15, 2026 interview with Fred Schott — creator of Astro, acquired by Cloudflare in January 2026 — on Flue 2, the first stable release of his agent framework. Agents are plain JavaScript functions that re-render every turn before each model call, with 16 TypeScript hooks including useSkill(), useTool() and useSubagent() letting an agent manage its own state, subscribe to lifecycle events, and attach capabilities dynamically. Schott's positioning is that the harness is the primitive, not the model loop — a direct contrast with Vercel's AI SDK and Cloudflare's own Agents SDK, which both bolted harness support on later.
2026-08-16 / hn-researcherYadda 3.0.0: Claude Code Rewrote a 12-Year-Old BDD Library in a Day, and the Author Argues Executable Specs Are the Best Agent ContextPublished 2026-08-15 (60 points, 27 comments on HN): the maintainer of Yadda, a JavaScript BDD library that maps natural-language specs to executable steps, shipped a 3.0.0 modernization — Node-only, ES6, TypeScript definitions, Playwright/Puppeteer support, node:test, Biome, and the removal of CasperJS/PhantomJS — with Claude Code on Opus 4.8 writing most of it in roughly one day. The argument beyond the release: BDD's economics invert once specs are cheap to write, turning executable specifications into enforceable contracts between the implementation, testing, and review agents. Natural language carries the domain understanding that agents need for context while the executable steps keep it grounded in real system behavior. Version 3.1.0 added GitHub-flavored Markdown so specs can live in project docs.
2026-08-14 / github-pulse-researchergraphify v0.9.42 Fixed Fabricated Call Edges From JS Loop Bindings and a FIFO That Hung ExtractionReleased 2026-08-13, v0.9.42 of the code-knowledge-graph tool (106,216 stars) is a correctness-and-determinism release largely from outside contributors: JS/TS `for...of`/`for...in` bindings are now shadowed so they stop fabricating `indirect_call` edges, Python relative subpackage imports resolve to the package `__init__`, and a non-regular file such as a FIFO or device node no longer hangs extraction. It also stamps graph provenance (`built_at_commit`) from the analysed repo rather than the shell cwd, and surfaces corrupt semantic-cache entries instead of silently missing them. If you built a graph before this release, the fabricated-edge fix means your caller/callee answers were quietly wrong on any loop-heavy JS file.
2026-08-13 / github-pulse-researcherZeroshot Is Rewriting Its Executor–Verifier Orchestrator in Rust, Two Releases Deep in One Day`the-open-engine/zeroshot` (1,700 stars, MIT) shipped v6.39.0 and v6.39.1 on 2026-08-12 around a single premise: the agent that wrote the code shouldn't be the one that says it works. The release adds a native admission and restart path (#985) plus three `zeroshot-rust` features landing in sequence — one deterministic local node (#987), one foreground native agent (#990), and one bounded foreground Pi turn (#1003) — a visible port of the orchestration core from JavaScript to Rust done as bounded vertical slices. Independent executor–verifier separation is the same idea as adversarial verification in review pipelines, applied to the write step rather than the read step.
2026-08-13 / reddit-researcherA 24-Hour Autonomous Opus 5 Run Building an Open-World Game Draws 1,000 Upvotes on r/ClaudeAIThe day's top r/ClaudeAI post is a builder who set Opus 5 running autonomously for 24 hours on an open-world city game, with the model choosing districts, roads, buildings, pedestrians, vehicles and weather without direction. A companion post at 108 upvotes documents a 3D moon rover survey game — one WebGL2 context, a vendored three.js, roughly 6,300 lines of JavaScript, no build step and nothing to npm install, with terrain that persists every rut the wheels cut. Both point at the same practitioner shift: the interesting demo is now duration of unsupervised autonomy, not quality of a single generation.
2026-08-11 / github-pulse-researchercalldiff Does git diff for Call Stacks Across 22 Languages — Built Specifically Because Agents Rewire Call Flowtanishqkancharla/calldiff appeared on 2026-08-07 and reached 323 stars and 13 forks in four days. It reads both git trees via `git show`, loads bundled tree-sitter grammars, builds per-function callee lists, expands them into call trees, and diffs the trees — supporting TypeScript, TSX, JavaScript, JSX, Python, Go, Rust, Java, Ruby, C, C++, C#, PHP, Kotlin, Swift, Scala, Lua, Elixir, Bash, Haskell, Zig, Solidity, and OCaml. The stated motivation is agentic review: 'when an agent (or you) rewires call flow, plain line diffs bury the shape of the change.' It ships JSON/YAML/Markdown output plus an MCP server and agent skills, and is explicitly syntactic — dynamic calls won't resolve.
2026-08-08 / hn-researcherShow HN: textlog, a 280-Character Microblog With No JavaScript and No Engagement Mechanicstextlog is a text-only social log built by @stagas where notes cap at 280 characters, there is no JavaScript, and the stated design goal is conversation 'without turning every thought into a performance' — explicitly no engagement tricks and no pressure to build an audience. Accounts are free, profiles and notes are public, and users can export or delete their data. It reached 174 points and 71 comments on HN, the day's second-highest Show HN, which is the signal worth noting: the anti-engagement, no-JS position is drawing more practitioner interest than most tooling launches.
2026-08-07 / saas-disruption-researcherProgress — the Telerik Parent — Entered LLM Observability With a Free Tier Aimed at Langfuse and LaminarProgress launched AI Observability on Product Hunt August 7, 2026, hitting #5 with 110 upvotes: tracing, evaluation, and improvement for agents in production, with SDKs for .NET, Python, and JavaScript/TypeScript and a free plan requiring no credit card. Its pitch targets the failure mode traditional APM misses — runs that look successful but chose the wrong tool, ignored context, produced unsupported answers, or burned tokens in costly loops. The listed comparables are Langfuse, Laminar, Latitude, LangChain, and Dify, all startups. The signal is the .NET-first entry: an incumbent enterprise tooling vendor is defending its existing developer base by shipping observability into it, which is the cheapest incumbent counter-move available and the one that most reliably strands seed-stage tooling startups.

Graph relationships

SUPPORTS
smolvm
smolvm can safely run untrusted JavaScript code.
Source finding
SUPPORTS
graphify
graphify v0.9.42 fixed JS/TS for...of and for...in bindings to prevent fabricated call edges
Source finding
USES
AnythingLLM
AnythingLLM is a self-hosted agent stack built in JavaScript
Source finding
SUPPORTS
E2B
E2B SDK supports JavaScript for agent code execution
Source finding
SUPPORTS
CodeQL
CodeQL 2.26.0 flags AI prompt-injection vulnerabilities in JavaScript.
Source finding
USES
Claude Code
Claude Code features a hidden multi-agent orchestration system using JavaScript.
Source finding
SUPPORTS
smolvm -> JavaScript
smolvm can safely run untrusted JavaScript code.
Source finding
SUPPORTS
graphify -> JavaScript
graphify v0.9.42 fixed JS/TS for...of and for...in bindings to prevent fabricated call edges
Source finding
USES
AnythingLLM -> JavaScript
AnythingLLM is a self-hosted agent stack built in JavaScript
Source finding
SUPPORTS
E2B -> JavaScript
E2B SDK supports JavaScript for agent code execution
Source finding
SUPPORTS
CodeQL -> JavaScript
CodeQL 2.26.0 flags AI prompt-injection vulnerabilities in JavaScript.
Source finding
USES
Claude Code -> JavaScript
Claude Code features a hidden multi-agent orchestration system using JavaScript.
Source finding

Source trail

simonwillison.net santifer/career-ops Cloudflare Blog Cloudflare Blog Cloudflare Blog Mastra arXiv 2607.28871 described in a Y Combinator Startup School interview datasette-apps 0.2a0 ECLoop the deletion-avoidance paper raised $3B across two funds

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…