Jack Timonen

Co-Founder of @GitHits_com, a context layer for AI coding agents. End the retry loops.

[Jack Timonen @Jack_Timonen]

Context matters, also in GTM

[Tristan Comte @tristan_cte]

made 40 GTM brains with Pancake

copy a brain and give that context to your agent

https://t.co/wjLmKDS4HB

our research on how context affects GTM recommendations below

[Nathan Burg @NathanBurg]

Your agents can now pull the full OSV writeup on a vuln without leaving their terminal!

New in the GitHits CLI and MCP: pkg vulns --details. Try it on [email protected] and you’ll get CVE-2026-4800

[Nathan Burg @NathanBurg]

It's been a brutal few weeks for exploits.

Your agent should be able to check a CVE before it ships code, not after.

New in the GitHits CLI and MCP: give it a CVE or GHSA ID, get every affected package, the vulnerable ranges, and the fix.

npx githits vulns CVE-2020-8203

[Nathan Burg @NathanBurg]

I've been testing open models on computer use, and they get way better when they can also read the app's source.

Qwen3.8-27B went from 24/60 to 44/60 on WebArena, mostly on rules the UI hides. Small test, our own tasks. Anyone else seen this?

[Jinjing Liang @JinjingLiang]

I'm not building open source hoping to get acquired.

I have friends already making $2M a year at OpenAI, $1.5M a year at SpaceX, and $4M a year at Meta.

Joining an AI lab right now would probably make more financial sense for me.

But I don’t want to.

I just want to be my own boss and grind through my own product building journey.

Call me stupid or naive or whatever 😆, but maybe I’m not alone here

[Petri Kuittinen @KuittinenPetri]

Warning! Grok build can break the bank and cause you a massive bill - don't be as stupid as I was.

I was using Grok build on my work laptop instead of my home computer and it turned out to be huge mistake. I thought it would use the remaining weekly credits on my SuperGrok Premium credits, but instead of it used API and it seems by default xAI API uses $20 up (I disabled the auto replenish credits, which should have never been made default).

The total bill for 2 hours of coding was $111.41. I didn't notice it as I had sound turned off at my laptop and I got email for every $20, but only noticed it when it was too late.

Those $111.41 bought me only ~110 million tokens with Grok 4.6 high. For comparison $1 would have bought me ~160 million tokens amount via DeepSeek (using Deepseek-flash max via official API). This makes Grok 4.6 approximately 160 times more expensive, which is a ridiculous price difference. Yes, you read it right. $10 of deepseek buys 1.6 billion tokens, $111 of Grok 4.6 use gives 110 million tokens.

Deepseek-flash ~$0.00625 per 1M tokens
Grok 4.6 ~$1 per 1M tokens
These are real world usage numbers, same code base.

Either Grok 4.6 runs on an extremely inefficient stack compared to Deepseek or their API profit margins are 99.98%. The estimate profit margin for Deepseek API are 80% or more.

Note: most of the 2 hours of $111 "worth of coding" was just optimizing code and running relevant benchmarks (C++). There was very little prompting from my side.

To make matters worse: despite having enough evidence and a solid plan Grok build failed to optimize my code enough. It is still far slower than CPython. $111 for a failure.

Now I am delegating the task to Ainiux + deepseek combo.

[Jack Timonen @Jack_Timonen]

We've been asked a few times to index private repos, so agents could read every repo they need without write access and check out only the repo they're changing. It would be a pretty big shift for GitHits, so I'm looking for a reality check. :) Would it make sense for DevBox if those read-only repos came from an index instead of the snapshot?

[Olli-Pekka Heinisuo @skvark]

Deep dives continue, this time it's the GitHits search tool: https://t.co/hlohmn9IpP

[Olli-Pekka Heinisuo @skvark]

After search, the next GitHits deep dive is the one everyone knows: grep https://t.co/fxn1ubIGSY

[Nathan Burg @NathanBurg]

GitHits now works on Googlesource repos and Dart packages.

Point it at any https://t.co/TU8rtkCPNl repo. We asked Research when an oauth2 token counts as expired: 10 seconds before its actual expiry, cited to token.go.

Dart works too. Grep on pub:[email protected] is pinned to the exact v1.2.2 tag. Live in the CLI and MCP 0.38.1.

[Nathan Burg @NathanBurg]

A pattern for scaling cloud agents:

Each agent only clones the repo it's changing into its sandbox. It reads its open source dependencies through GitHits, at the versions the lockfile pins.

Right version in 192 of 192 runs. No snapshots.

More in my write-up: https://t.co/j1ot5XX5Cy

[Nathan Burg @NathanBurg]

lodash 4.17.21 shipped with no release notes. It's also the release that fixed a command injection bug in _.template.

GitHits now generates release notes from commits when none are published, and it flagged that fix as a security change.

Run githits pkg changelog npm:[email protected] and see for yourself.

[Nathan Burg @NathanBurg]

We have a couple ~3B models cooking, trained for prompt to GitHits query. DM me if you want early access 🚀

[Yujian Tang @yujian_tang]

"You don't need a 5 trillion parameter model to write a JSON object."

Nathan Burg (@NathanBurg) on where agent tokens go: writing queries. So @GitHits_com is building small specialized models just for that.

The next event is on the calendar: https://t.co/nHpLyP4GR5

#AIAgents

[Jack Timonen @Jack_Timonen]

Every cloud agent starts in an empty sandbox. That gets expensive fast, because every job has to load the code it needs before it can do any work.

A team running thousands of agent jobs a week gives each job a fresh sandbox. The agent checks out the repo, does the work, and the sandbox is deleted. The next job starts from nothing, so it downloads and sets up everything again.

The agent also needs the code its dependencies run, at the version the lockfile pins. Without it, the agent guesses from training data or reads the wrong release.

There are two usual ways to give it that code.

1] The agent can clone the dependencies into each sandbox. Every job then pays for the download, the disk and the wait. Small sandboxes run out of disk and memory on large repos. A thousand jobs means a thousand copies of the same code.

2] The team builds snapshot images with the dependencies already in place. Every lockfile change means another image to build, store and keep current. Old branches pin old versions, so the catalog keeps growing. Agents start from the newest image anyway and read code the job never runs.

Both costs grow with the number of agents. A wrong version also doesn't show up as a failure, so nobody sees it.

Is this a problem worth solving?

#ai #DevTools

[Jack Timonen @Jack_Timonen]

@SnapKernel @code_rams @SnapKernel pls check out https://t.co/lNku3oaDwZ

[Jack Timonen @Jack_Timonen]

@guikyoki This is cool!

[Jack Timonen @Jack_Timonen]

@milindlabs @mausbot_ What do you mean? :)

[Olli-Pekka Heinisuo @skvark]

Deep dive to one of our latest tools, resolve target: https://t.co/OvdMV6taX1