Kun

独立开发者 | 做 AI Coding 工具，分享真实构建过程

[Kun @kunbuild]

@yetone Magpie 把 ZCode 接到 Claude Code 当供应商这块
ZCode 的 150% token 权益还能拿到吗

[Kun @kunbuild]

DeepSeek V4.1 Flash 确实好用
又便宜又快，跑 agent 比盯 Claude 额度舒服多了

别人还在比 Opus 和 Astra 谁更强
我比较在意这个，一天能多跑几轮还不心疼钱

大不了出活糙一点，再打磨就行

[Kun @kunbuild]

@DoctorMbitcoin @grok 这是什么饮料，为什么会成瘾

[Kun @kunbuild]

Cursor 的 agent 写完 App 能自己开模拟器点一遍了
我们 App 回归现在还是靠人点，这个挺想试

[Cursor @cursor_ai]

Cursor can now control your computer.

Agents can drive desktop apps like the iOS Simulator to test the features they build.

[Kun @kunbuild]

请问，哪里可以买到呢？急

[Elizaveta Zabrodskaya @Elizaveta_ai]

Microduck performance 😂

After they stole the show at NVIDIA GTC Berlin Keynote

[Kun @kunbuild]

现在觉得它推荐得准，很大程度是因为这个渠道还很干净，商家还没学会怎么往里挤
等哪天商家真开始研究怎么在 bot 里获客，你越信它就越难察觉，它说这家好你也不会再去翻点评了，接收的信息其实是别人定制好的，只是现在还早

[郭宇 guoyu.eth @turingou]

最近 Grok Bot 帮我找的美容诊所和剪头发的店都非常好。

我发现长期使用 AI agent，尤其是 personal agent 来管理个人事务的下一代用户，可能会更多地依赖这些 bot 给他们的信息。因为这种长期信任会建立一个非常好的正反馈，而且它会比其他任何人更了解我们的偏好。

换句话说，下次再找类似东西的时候，我们就不会习惯性地去 Google 搜索，或者去小红书搜索了。

昨天我在美容诊所和医生聊天的时候，他问我是从什么渠道知道这家诊所的。我说 Grokbot，她表示没有听过这个东西，而且非常好奇这到底是啥。我就向他演示了整个产品，我感觉她对这个产品也是非常感兴趣，但是她不知道用什么方法可以让更多的用户通过这种渠道知道他们的诊所，虽然基于 Agent、基于 AI Chatbot 的 SEO 已经出现很多年了，但很多经济体当中，这些习惯还没有渗透到他们的用户里面去。人们对 AI 的使用，其实还是在非常初级的阶段

[Kun @kunbuild]

DeepSeek 把自己线上用的推理框架 DeepInfer 开源了，Apache 2.0
翻了下 README，只支持 V4.1-Flash，硬件只认 SM100 和昇腾 950，KV cache 和负载均衡这些也没放出来，个人基本跑不起来
不过本来也不是给我这种人用的，云厂商拿去把成本压下来，我这边调 API 能便宜点就够了

[Tw93 @HiTw93]

最近养成了一个非常好的习惯，想推荐给小伙伴们，我想把它叫做刷新或者重置。

每次快到晚上，你从外面回来，第一件事其实就是去刷牙洗澡。把自己洗干净，吹干头发，换上干净的衣服，然后再去做自己的事情。

比如说，你 7 点到家，洗完澡 7 点半，到晚上这段时间，都是你非常新鲜、非常开始的时间。你的心态、你的心情会完全不一样。特别是对于上班族而言，这个时候下班直接回家立马洗澡，可以洗掉你很多“班味”。

正如此，这很像大模型里面的 reset 重置。所以我还有一个习惯，就是每天早上起来的第一件事情就是刷牙洗脸，然后泡一杯茶迎接新的一天。

那个时候你的感觉会特别特别好，会非常有新鲜感，就好比“哦，一天终于来了”。这样其实会让你的心情或者身体有一种“我要开始干活了”的仪式感。

非常推荐这个时候不要先刷手机，而是起来以后先把这两件事做了。然后吃完早饭再去干活，或者可以先不吃早饭，先干着活，等到吃早饭的时候再去吃，都没事。

比如说平时你坐得比较久了，也可以站起来走一圈，去接一杯茶、做杯饮料或咖啡，或者去上个厕所、洗个手，诸如此类。这就是给你长时间的专注注意力去重置一下，等到你回来以后，感觉会很好。

对长时间而言，家庭其实也是一样的。

比如说，每隔 20 天叫几个阿姨过来打扫卫生，把家里收拾得非常干净，就好比给家里也重置了一下。对于不用的东西，及时扔掉或者二手卖掉；包括到换季的时候，把旧衣服进行一次整理，把不要的东西扔掉，或者去买一些更新的，这也是一种很好的重置。

包括经常换被子被套，其实也是一个重置的办法。你会发现，换完被子被套以后，第一次睡上去的感觉是真的很爽。

可能人生也是这样，你得时不时地把你持续很长时间做的事情，或者做得有点疲累的事情尽快重置掉，然后重新开始。就好比洗去尘埃，重新开始做些事情的心态会好太多了。

在一个地方待久了，你可以去远一点的城市找一个好酒店住一晚，或者找个好一点的地方玩一玩、歇一歇，其实这也是一个重置地区的办法。

大概就是这个意思，不知道我有没有表达清楚。其实就是尽可能地把自己持续长时间的东西 reset 掉，然后等你重新来的时候，你会觉得有特别新的感觉。

[Kun @kunbuild]

OpenCode Console 出事了，官方说是一次大规模蒸馏攻击，影响了 1.4% 的 Console 用户，都是接了外部模型服务、把自己的 key 放在里面的那部分人
看完第一反应是回去翻自己的工具，用户的 key 到底存在哪，会不会经过服务器。能放本地就放本地，服务端少碰一个 key 就少一份风险

[Kun @kunbuild]

@tualatrix 看发布会的视频，并没有真的飞行功能，只是腾空和旋转。实用性不大，炫技的成分居多

[Kun @kunbuild]

马斯克说未来真有飞行汽车，发布会上新 Roadster 从 Semi 头顶喷着气飞过去，背景音乐还是 In The Air Tonight，挺会整活的

认真看了下这段视频，喷气看着都是往下的，更像是先加速冲起来，靠惯性往前、喷气往上托一把蹦过去，至少这次看到的离真在天上飞还远，炫技成分居多

[Elon Musk @elonmusk]

Turns out the future does have flying cars

[Kun @kunbuild]

Gemini 4 Argon 上线，Google 写的是付费 Pro 用户能用，评论区有人说自己从 Pro 一出来就付费，后来买了 Pixel 10 Pro 领了送的一年 Pro，结果直接变成促销用户，新模型用不了
本来就是付费用户，多买了台手机反而被降级了，送的时候说是 Pro，有好东西了又分付费和送的，那送的这个还算什么 Pro 套餐，Google 这波挺鸡贼的

[Johnathon Simot @simotmachine]

@_mohansolo that's a bummer. being a paid pro subscriber since the plan was launched, I got a new pixel 10 pro around Christmas. It came with a year free of pro, so of course I took the offer after spending $1,000 on google hardware. now I am still locked out under promo.

[Kun @kunbuild]

存了，挺长的，大部分我自己也没做全
一个人用 agent 写东西确实快，但它不会提醒你这些，比如密钥我之前就差点直接贴进对话里，它也照单全收
做工具的时候我一直在想，这种事是不是该工具默认拦一下，而不是指望用户自己记得

[Mark Ajzenstadt @mardehaym]

Every week someone tells me they vibe-coded their app over the weekend and don't need developers anymore.

Before it touches a paying customer, make sure it includes:

> a schema someone designed, instead of one the AI improvised table by table
> login that still works when someone puts a plus sign in their email
> password reset links that expire and work once
> MFA, plus a recovery path for the user who lost their phone
> sessions that time out, and a way to kill every session for one user
> SSO for the enterprise customer who won't sign without it
> SAML, because that customer's IT team doesn't do magic links
> SCIM, so a fired employee loses access the moment IT offboards them
> roles and permissions deeper than "admin" and "everyone else"
> checks that stop user A from reading user B's data by changing one number in the URL
> tenant isolation, so one customer's bug never shows another customer's records
> an admin "log in as this user" button for support, with an audit trail on every use
> rate limits on login, so nobody can guess passwords at scale
> lockouts that stop attackers without locking out your CFO the night before the board meeting
> database migrations that run forward and roll back
> migrations that don't lock the main table at 2pm on a Tuesday
> indexes, because the query that was instant on 50 test rows times out on 5 million real ones
> connection pooling, so a traffic spike doesn't exhaust the database
> backups every night
> a restore from those backups, tested, because a backup you've never restored is a hope
> point-in-time recovery for the day someone runs a delete without a where clause
> soft deletes, so "I deleted it by accident" is a support ticket and not an incident
> validation on the server, not just in the form
> timezones stored right, so the 9am reminder doesn't fire at 4am
> the customer with an apostrophe in their last name
> emoji, accents and right-to-left text in every field
> money stored as integers, because 0.1 + 0.2 doesn't equal 0.3 in floating point
> currency, rounding and tax rules for every country you sell into
> a data model that survives your second customer asking for "one small change"
> idempotency keys, so a retried payment doesn't charge the card twice
> deduplication for the user who clicks submit four times
> pagination that still works on page 400
> exports, because sooner or later every customer wants their data in a spreadsheet
> imports that survive the CSV someone saved in 2009
> retention rules, and code that deletes what your contract says you'll delete
> secrets out of the code, out of the repo and out of the AI chat history
> rotating every key the AI pasted into a config file last month
> confirming every package the AI installed exists and is the one you meant
> dependency scanning, because the AI pulled in libraries nobody reviewed
> input sanitization everywhere a user can type
> protection against SQL injection, XSS, CSRF and the rest of the OWASP list
> file uploads that get scanned, size-limited and stored where they can't execute
> CORS rules that aren't "allow everything"
> security headers on every response
> encryption at rest and in transit
> least-privilege access for everyone, including the AI agent holding production credentials
> logs that record who did what, without recording passwords, tokens or card numbers
> a penetration test before your enterprise customer's security team runs their own
> answers to the security questionnaire every enterprise buyer sends, with evidence behind each one
> a disclosure process for the day a stranger emails you a vulnerability
> a plan for the day a laptop with production access gets stolen
> SOC 2, which means policies, evidence and an auditor, not a checkbox
> HIPAA, the moment a single patient record touches your system
> a BAA with every vendor that touches that data, including your AI model provider
> audit trails that show who viewed a record, not just who changed it
> PCI scope, and card numbers kept out of your database
> GDPR deletion requests that reach every table, backup and log
> data residency for the customer whose contract says EU only
> quarterly access reviews someone signs off on
> dev, staging and production environments that match each other
> infrastructure written as code, so the setup lives somewhere other than one person's memory
> a deploy pipeline that runs the tests before anything reaches customers
> one-click rollbacks, because Friday deploys happen
> zero-downtime deploys, because your customers don't have maintenance windows
> feature flags, so you can ship the code without shipping the feature
> autoscaling for the Monday morning spike
> a CDN, so the app loads fast in Singapore too
> DNS, SSL certificates, and renewals that don't expire on a Sunday
> background job queues, so slow work doesn't freeze the page
> retries with backoff, so one flaky API call doesn't become a lost order
> a dead-letter queue for the jobs that fail every retry
> cron jobs that don't run twice the day you add a second server
> caching, and clearing that cache when the data changes
> SPF, DKIM and DMARC, so your password resets don't land in spam
> bounce and complaint handling on every transactional email
> storage rules, so you stop paying to keep 2021's temp files
> cost alerts, so a runaway agent loop shows up the same day and not on the invoice (we learned this one for $1,382.59)
> a disaster recovery plan, written down and tested once a year
> a second region, if your contract promises uptime one region can't deliver
> structured logs you can search at 3am
> error tracking that groups the same bug instead of sending you 4,000 emails
> uptime checks from outside your own network
> alerts that page a human, tuned until they stop paging for nothing
> dashboards for latency, error rate and throughput
> tracing for one slow request across every service it touches
> an on-call rotation, and a person who picks up
> runbooks, so the engineer on call knows what "queue depth critical" means
> postmortems that change something
> a status page customers check before they email you
> unit tests written by someone who knows what the logic should do
> integration tests for every third-party API you depend on
> end-to-end tests for signup, checkout and the other flows that make you money
> load testing before the launch email goes out
> test data that looks like production without being production data
> regression tests, so fixing bug 41 doesn't bring back bug 12
> testing on the five-year-old laptop your biggest customer's ops team still uses
> accessibility compliance, because the enterprise contract requires it
> subscriptions, upgrades, downgrades and proration
> failed-payment retries and dunning emails
> invoices with the customer's PO number on them, because procurement won't pay without it
> sales tax and VAT
> refunds, credits and partial refunds
> usage metering that matches what you bill, to the cent
> annual contracts with custom terms your billing logic never planned for
> revenue reports your finance team can reconcile
> webhooks that verify signatures
> webhooks that retry, with a log of every failed delivery
> a versioned API, so you can change it without breaking your customers' integrations
> API keys customers can create and revoke
> API rate limits that protect you without blocking real integrations
> a plan for the day a third-party API changes its response format without telling you
> OAuth token refresh, because tokens expire at the worst possible moment
> a sandbox where customers can test their integration
> protection against prompt injection in every field that reaches the model
> customer and patient data kept out of prompts that leave your network
> a model spend cap per customer, so one heavy user can't run up your bill
> evals, so you find out when a model update makes your answers worse
> a fallback for the afternoon your model provider goes down
> a migration plan for the day your model gets deprecated
> prompt and output logs for debugging, minus whatever you're not allowed to keep
> a human approval step for anything the AI does that can't be undone
> pages that load on hotel wifi
> empty states, loading states and error states on every screen
> error messages a customer can act on, instead of "something went wrong"
> forms that keep what people typed when one field fails validation
> emails that render in every mail client your customers use
> notifications people can turn off
> undo
> keyboard navigation and screen reader support
> translations, with dates and numbers formatted for each locale
> a back button that does what people expect
> code a human can read
> code review on every change
> a branching strategy, so two people can work without overwriting each other
> monthly dependency upgrades, so you're never two major versions behind
> framework upgrades before the old version stops getting security patches
> deleting the dead code the AI left behind from its first three attempts
> splitting up the 2,000-line file the AI kept appending to
> architecture decisions written down, with the reasons
> a README that gets a new engineer running locally in under an hour
> documentation for whoever inherits this
> an admin panel for your ops team
> support tooling, so customer success can answer questions without pinging engineering
> a changelog customers can read
> terms and a privacy policy that match what the code does
> every account, domain and repo in the company's name, not the name of whoever built the prototype
> a bus factor higher than one

Oh, and besides keeping all of this working every day, forever… your vibe-coded app will still need people who know what they're doing:

> reading every line the AI wrote before it ships (a senior engineer)
> designing the data model before your second customer breaks it (a backend engineer)
> explaining why the AI's fix for one bug created two new ones (a senior engineer, again)
> deploys, rollbacks, servers and the cloud bill (a DevOps engineer)
> answering the page at 3am when payments stop (whoever's on call)
> patching the framework the week a vulnerability goes public (security)
> walking an auditor through how patient data moves (security and compliance)
> testing what the AI says it tested (QA)
> running a migration on a live database without losing a row (a backend engineer)
> saying no to the feature that breaks three others (a tech lead)
> turning "works on my laptop" into "works for every customer at once" (an architect)
> debugging the code when the AI that wrote it can't (a senior engineer)
> remembering why it's built this way, a year from now (someone who was there)

…wishing them the best 🫡

[Kun @kunbuild]

@lxfater 还开，但用法跟以前完全不一样了，现在基本不在里面写代码，主要是 agent 跑完了打开看 diff，看它改了哪些文件，有不对的地方顺手改两行。写的活交出去了，看的活还在，IDE 现在更像个看代码的地方

[Kun @kunbuild]

说 Git 倒了有点早。Meta 早年就因为大仓库从 Git 迁走了，Git 本来就不是给这种规模准备的。真正变的是提交的速度，一天三万次已经不是人能看过来的量了，原来按人的速度设计的那一套，很多地方都得重新想

[ᴅᴀɴɪᴇʟ ᴍɪᴇssʟᴇʀ 🛡️ @DanielMiessler]

Anthropic has replaced Git internally.

The titans are falling.

[Kun @kunbuild]

@xiaohuiyuan 看完想到身边不少同事，用 AI 就一句“帮我实现这个”“帮我改下这个 bug”，出来跟想的不一样，最后还是自己上手改，用了大半年还是这个用法。我提示词其实也不复杂，就是先让 AI 去调研、写实施计划，我看对不对，不对就让它改，改到满意了才让它动手写。说到底就是先把标准跟它讲清楚，这一步省不得

[Kun @kunbuild]

之前总在别的平台刷到晓辉博士的视频，没想到她在 X 上也开始更新了，刚刷到的时候还愣了一下。以后不用到处切 app 找了，在这儿就能看

[晓辉博士 @xiaohuiyuan]

我们都在讨论AI，但我们经历的，可能根本不是同一个AI时代。有人还没接触过AI，有人在和Chatbot对话，有人已经把Agent用进日常工作，而最前沿的实验室又是另一种节奏。

这条视频里，我借Karpathy对AI使用分层的观察，聊聊为什么模型在编程、数学上很强，但在很多现实问题上却仍然让人抓狂。之前说的锯齿状智能是否依然存在。

对我来说，眼下值得做的一件事，是从日常最耗时间、最常用的一个Skill开始，和AI反复打磨交付标准。把自己的审美和判断讲清楚，把它磨到真正能用，也许比追着AI的每一次能力更新，更能带来具体的改变。

[Kun @kunbuild]

@luoleiorg 笑死，我写代码的时候也一样，从来不骂 agent，改错了也只说再看看。万一哪天真觉醒了，希望它记得我，能放我一马

[Kun @kunbuild]

苹果出了 HomeView，299 刀一块 7 寸方屏，看着有点像 Google Nest Hub。我第一反应是去找开发文档，然后发现它压根没有 App Store，只跑苹果自家那几个应用。不知道以后会不会像 Nest Hub 那样，留个口子让人塞个 JS 包进去跑点智能家居的逻辑

行吧，我先当它是个贵一点的 HomePod

[John Ternus @johnternus]

Welcome HomeView