Systems & architecture
12 posts tagged #ai on DiCodeWeb, from fundamentals to production, newest first.
12 postsUpdated Oct 24, 2026
A practical threat model for applications that put an LLM between tools and private data: direct and indirect prompt injection, the lethal trifecta, and the design patterns that keep the damage contained, mapped against the OWASP Top 10 for LLM Applications.
MCP isn't magic, it's a well-designed JSON-RPC protocol. This post explains hosts, clients, servers, primitives and transports as of the 2026-07-28 spec, then builds a read-only TypeScript server over order data: tool design, pagination, testing with the Inspector, OAuth for remote servers, and the security holes you need to close.
When running a model on the user's machine makes sense and when it doesn't, how far Chrome's built-in AI has shipped, Transformers.js, ONNX Runtime Web and WebLLM on WebGPU/WASM, running inference in a Web Worker, caching model weights, and UX for the first download.
What happens to an LLM feature once real traffic arrives: where latency actually comes from, a per-feature token and cost meter with tenant budgets, structuring prompts for provider prompt caching, exact and semantic caching, model routing, trimming context, batch APIs, parallel calls, retries with fallback and circuit breakers, and the dashboard I watch.
Where coding agents genuinely help a frontend team and where they quietly fail, how to give them context with AGENTS.md and small tasks, plan-then-implement, verification loops, reviewing AI-generated PRs, supply-chain risks like slopsquatting, and which skills matter more now for mid and senior engineers.
Building a golden dataset from real usage, deterministic checks first, LLM-as-judge with rubrics and its biases, pairwise comparison, running evals in CI on prompt or model changes, tracking cost and latency alongside quality, online signals, tracing, and how to avoid overfitting your eval set.
Tool calling is really a loop that your code drives. This post covers defining tools with schemas, an agent loop with a step limit, handling invalid arguments, a message list with typed parts, streaming partial arguments, rendering tool calls as components, and making users confirm tools with side effects.
Anyone can build a RAG demo in an afternoon; making it answer correctly is the hard part. This post walks through a TypeScript RAG pipeline on PostgreSQL/pgvector: structure-aware chunking, hybrid search fused with RRF in a single SQL query, reranking, filtering by permission before ranking, citations, and how to measure quality with numbers.
The frontend half that AI chat tutorials tend to skip: picking a transport, parsing SSE by hand when events are split across chunks, a Route Handler that keeps the API key safe and propagates cancellation upstream, message-parts state, batching renders with requestAnimationFrame, safe incremental markdown, autoscroll, accessibility and error handling.
How I design and build UI for features whose output changes every time: latency budgets and streaming, suggestions that can be accepted, edited or rejected with a typed state model, undo and preview, honest sources, feedback wired to analytics, graceful failure and accessibility.
The frontend side of sending files to an LLM: file input, drag-and-drop and paste, sniffing types by magic bytes, downscaling images and stripping EXIF in the browser, HEIC from iPhones, PDFs, recording audio with MediaRecorder, presigned uploads with progress and cancellation, object URL cleanup, accessibility and what the server must still check.
How I build product features on LLMs that return typed JSON: structured output modes in the major APIs, defining schemas with Zod, handling refusals and truncated output, retry with repair, versioning prompts in code, realistic expectations about temperature, and designing schemas models handle well.