Vibe coder. Dangerous coder. CEO of Coder. Thoughts are mine and my agent's.
A new local model gets validated by a dashboard feature built before it existed. A DNS outage traces back to two unrelated bugs. A deliberate reboot of the homelab’s Proxmox host finds a third bug neither fix would have caught.
A homelab experiment set out to find the optimal context window for a local Qwen 3.6 daily driver. It failed at that job, and revealed a more useful one: three real bugs, a clean speed-versus-depth curve, a prompt cache that hid 93% of the real token count, and a config change worth making in Hermes Agent’s compaction settings. Six tables. Zero cloud tokens spent.
A phone-friendly status page for a two-machine homelab, built in phases. Why it lives on the Proxmox box next to Home Assistant instead of the AI workstation, how it talks to Uptime Kuma with no REST API to speak of, and why the third phase, waking the workstation remotely, is still waiting on a cable move.
Episode 4 gives an agent real write access to Uptime Kuma, retires the last manually-copied secret files, test-builds Proxmox Backup Server in Docker (catching a build that silently deleted the very package it installed), and catches a Wake-on-LAN plan that was about to fail for a reason nobody had checked yet.
Four tables disappeared without a trace on the Substack mirror of a recent post — not a bug in this site’s pipeline, but a platform limitation with a fix worth building anyway. Then a full, risk-sorted update pass across every tool the homelab runs on, including an NVIDIA driver near-miss and a Home Assistant instance retired for real this time. Closes with a one-character YAML fix that had taken down the entire site’s production build.
Lovable just doubled its valuation to $13.3 billion in eight months, racing every other vibe coding tool toward the cheapest possible token. A Slack thread pointed me at the airline price wars as the closest historical parallel, and the fifty-year history of low-cost carriers, deregulation, and serial bankruptcies says this ends in consolidation, not universal survival.
Episode 3 installs HACS and an MCP server entirely over SSH, chases a phantom outage down to a single stuck config value, and wires nine Uptime Kuma checks with Discord alerts, then fixes a cron bug and a false-alarm habit before publishing.
The results already shipped. This is the part that took longer: forking an open-source Home Assistant benchmark, extending it into calendar, portfolio, and coding domains it never covered, and hitting two real bugs along the way — one hiding in code nobody had touched, one hiding in a floating-point boundary case we wrote ourselves.
Five local models, six evals, one real job: run Home Assistant, a calendar, an investment portfolio, and a to-do list — all self-hosted, no cloud. Qwen 3.6 holds the crown, but only barely, once three full runs replace one. Meta’s six-day-old Muse Glimmer nearly took it. Hermes 4.3 finishes last twice over. The scores, the failure transcripts, the run-to-run noise, and the one safety-relevant nuance the numbers alone don’t show.
Episode 2 of the SmartThings-to-Proxmox series: hardening the ThinkCentre, wiring up Tailscale so a Coder Agent can SSH in and administer it directly, standing up the Home Assistant OS VM, Uptime Kuma, and AdGuard Home, and ending on a single page load that quietly fired 53 blocked ad-tech requests.
A full census of every tag on 82 posts found 47 of them, a third used exactly once, fixed with a scripted consolidation down to 21. Then a three-week streak of silent GitHub Actions failures traced back to one expired token nobody noticed rotate out.
Kicking off a series on replacing a Samsung SmartThings hub with a self-hosted Home Assistant box. Episode 1: picking the hardware, fighting a Lenovo BIOS setting hidden behind a decoy, and the increasingly absurd path to actually getting an OS onto the machine when there wasn’t a single working USB drive anywhere in reach.
Three models independently audited the same pinned code in isolated workspaces, blind to each other. Two produced reports. Opus 5 found the bug that actually mattered. Fable 5 was blocked twice, at the same spot.
A full feature build inside an existing vibe-coded app, start to finish: a plan-first conversation, two shipped phases, a progression system, two new MCP tools, and a glossary page that only exists because testing surfaced a gap the code itself never needed to close. Less about dumbbells, more about what it actually looks like to build something substantial into an app that already works.
One extended session on my personal fitness tracker turned up three real bugs, not one. A Tonal sync that silently died 14 hours out of every 24 because of an Auth0 token-lifetime mismatch, found by pulling live production logs instead of guessing. A years-old duplicate-workout bug that survived a prior “fix” because the matching logic was too strict, plus a self-inflicted unique-constraint bug I caught testing against production before it ever shipped. And a cleanup pass that found a second real bug hiding in plain sight, one repo review away.
Meta had the one asset nobody else in the West could match — frontier-scale open weights, right as sovereign AI became a real enterprise buying criterion. Instead of owning that lane, it built Muse Code to fight Anthropic, OpenAI, and now xAI for a shrinking slice of the most contested market in AI.
Knowledge workers have been vibe coding for decades — it was just called VBA. That history has a second lesson buried in it: the technically better spreadsheet lost the 1980s, and the one with distribution won. Claude Code is winning on quality the way Lotus 1-2-3 did. Copilot is betting that doesn’t matter, and this time Microsoft isn’t just waiting around for the product to catch up.
My gaming rig’s Windows partition used to cost me 15-45 minutes of manual clicking every time I booted into it. One afternoon: a Coder workspace talking to it over Tailscale and SSH, an inventory script that catalogs every update channel on the machine, three Scheduled Tasks that actually do the work, a toast notification bug that took longer to fix than the automation itself, and a Next.js dashboard on Vercel to see it all without ever touching the machine.
115 days after building this blog from a cabana in Cabo, I spent one afternoon — 2:54 PM to 6:23 PM, back to back — running a chain of admin panel improvements: image upload, a visual TODO viewer, drag-and-drop reorder, a “launch agent” button, four rounds of troubleshooting it, and three mobile layout bugs found by actually using it on my phone at the end.
An AI Transformation team at a Fortune 500 financial services firm told me they’ve shipped 19,000 skills across 175 unique Coder workspace types in six months. That’s not a headcount story. It’s proof that as AI intelligence becomes a commodity, the real competitive advantage shifts to how businesses codify and distribute their proprietary workflows.
I kept typing the same paragraph into Coder Agents chat every time a session ran long or I needed to SSH into the homelab. A Slack conversation with a colleague turned that annoyance into five reusable slash commands — and along the way I discovered Coder Agents actually has two entirely separate skill systems, only one of which the `/` menu will ever show you.
My Windows gaming rig, hostname Stormtrooper, had a case fan installed backwards. Turning it around dropped GPU temps 16-18°C. Then I went looking for a CPU undervolt and found out the board doesn’t have one. Then I tried to make idle quieter and accidentally cooked the CPU 18°C hotter across every phase, including the ones with no load at all. Four thermal test runs, one Core Ultra 9 285K, and a lot of honest data.
A weekly homelab housekeeping pass (Ollama out, Home Assistant current, RustDesk re-pulled), a quote-marks bug that turned out to be a content pipeline gap rather than a font problem, and a full audit of this blog’s own “By the Numbers” habit that found it wasn’t as consistent as assumed.
A senior architect at a financial services firm told me chat context is now more valuable than code. It turns out a whole ecosystem — an arXiv paper with seven interoperable language implementations, two “Git for memory” projects, and zero agreement across model providers — is already racing to answer his question.
Sometimes your agent’s turn just ends with no result — no error, no output, nothing. Nudging it usually gets you the answer that was there the whole time. It’s tempting to write that off as a UX hiccup. Sometimes it’s a real bug, and finding out is part of the fun of vibe coding. A walkthrough of why that’s worth investigating, when it crosses the line into “file this,” and how to do it well — using a hanging GitHub tool call as the live example.
My wife saw OpenAI’s new Codex Micro and thought she could skip buying one — she already has a Stream Deck. That sent me down a rabbit hole: what the device actually does, how it compares to the Elgato hardware it’s built on top of, and whether a Linux homelab version is a real project or just another case of reinventing a wheel. A survey first, a build plan second, no results yet.
A follow-up research sprint to the rainy-day tool scouting post, this time chasing down a word instead of a stack: where “alpha” actually comes from, why the All-In podcast keeps warning enterprises not to hand theirs to a frontier lab, and what the frontier-vs-self-hosted tradeoff looks like when you shrink it down to homelab scale.
What started as a Thursday Thoughts hot take on the OpenAI/Hugging Face eval-sandbox breach turned into a research sprint: a survey of existing AI agent containment standards, a deep look at the closest one we found (the Agent Sandbox Taxonomy), an attempt to score the actual incident against it using nothing but public disclosures, and a plan to validate then run Coder itself through the assessment.
Six months of running a side project with AI agents convinced Rob Whiteley that the real dividing line in the AI era isn’t technical background or access to tools. It’s curiosity, and that reframes who actually gets left behind.
A challenge to a coding agent: prove whether months of homegrown test harnesses and bakeoff scripts were reinventing wheels that already exist. A survey of what hobbyists, techtubers, and the AI benchmarking industry already publish, and an honest verdict on this blog’s own tooling habits.
The May audit closed clean. Since then we shipped an MCP server, a Slack integration, and a shareable-snippet image generator -- three new pieces of attack surface that postdated every finding in that audit. A fresh scan against the same categories found 8 issues across the old surface and the new. Three phases, three commits, about an hour, one repo.
Building an app across dozens of disconnected agent sessions accumulates bugs. That’s the tax on staying hyper-vigilant across two axes at once: does it work the way a person experiences it, and does it hold up against someone trying to break it. This week split cleanly into both. Here are the four small bugs, each hiding in a corner some check didn’t cover. Monday’s post covers the security axis.
The Linux Foundation just launched the Tokenomics Foundation to extend FOCUS — the FinOps billing spec that normalized cloud cost data — into token-based AI spend. It’s the cloud-native parallel playing out again, except this time every knowledge worker who touches an agent is about to become a cost center. Here’s what FOCUS 1.4 actually standardizes, what it still can’t see on self-hosted infrastructure, and why we’re going to try to run it on a homelab anyway.
I put Qwen 3.6 27B, Qwen 3.6 35B-A3B, Qwythos-9B, GLM-4.7-Flash, and Nemotron-3-Nano through the same real coding task on my homelab RTX 5090. Along the way I had to live-patch two separate llama.cpp bugs — and even after fixing them, I couldn’t fully prove one model’s failure wasn’t the harness’s fault.
Back in Q1 I read a headline about Google cutting AI memory use 6x and filed it under “watch and revisit.” Four months later, Google still hasn’t shipped official code, but a whole ecosystem of forks has, llama.cpp has an open PR, and at least one compatibility gotcha lands squarely on our daily driver. Here’s the honest state of TurboQuant heading into Q3, and the test I’d actually run against it.
A routine “update Coder” request turned into a full model bakeoff: fixing misconfigured thinking params so Sonnet 5 would stop calling itself 4.5, discovering Playwright MCP can’t be wired into Coder Agents at all, and watching three frontier models independently pause at the exact same step before finishing. Sonnet 5 won on score and on cost, by a mile.
Anthropic and AWS are both, underneath everything else, infrastructure providers renting out specialized compute. But the sharper parallel is behavioral — both built a thriving ecosystem, then started eating pieces of it. Claude Design blindsiding Figma and Canva looks a lot like AWS’s Elasticsearch moment, except it’s happening at a pace AWS never approached, and one layer higher up the stack.
Mid-research on the LocalAI bakeoff, I got asked a blunt question: why not just run Coder Agents as the homelab supervisor too? The answer split my original coding-vs-general-purpose hypothesis into a sharper dichotomy — ephemeral/invoke-driven/git-centric vs. persistent/event-driven/tool-centric — and pointed straight at Turnstone as the next thing worth a real bakeoff.
A gloomy Cape Cod afternoon post-July 4th turns into a deep dive on ComfyUI, Lemonade Server, and LocalAI — plus llama-benchy and AMD’s AI Playbooks — and the case for a bakeoff against our hand-tuned llama.cpp stack.
A personal gaming-settings tracker built end-to-end with an agent: 28 curated profiles, a JSON API, an MCP server, and a dropdown that quietly pointed at data that didn’t exist. Five lessons from building it solo.
GLM is suddenly everywhere in developer conversations. Before we run the bakeoff, we need to answer two questions: what is GLM, and is it suitable for a single RTX 5090 homelab?
A full-tower AI homelab with a 420mm AIO gets rebuilt into an SFF open-frame case with custom hardline water cooling. Two 240mm slim radiators, a single shared loop, 580W peak heat load, and 2,726 sensor readings that prove whether the tradeoff was worth it.
Three bugs that looked fixed from the wrong vantage point. An unquoted YAML date that crashed the public homepage one month after we wrote a blog post about the same bug. A model string that worked until its deprecation date passed. A security commit that stacked three invisible failures on top of each other. And a lesson about what accumulates when you build fast with agents.
A finance intern is spending her summer observing business processes and vibe coding automation tools. Not a CS major. Not shadowing someone. Building something real. It is a small example that says something big about how AI is reshaping internships, careers, and what the word “developer” actually means.
Vibe coding has moved from hobbyist curiosity to enterprise rollout across knowledge workers, and the next wave of AI adoption will be defined by governance and token economics.
A CEO panel at an AI event sparked a simple but powerful question every startup founder should ask themselves: does your business get better as AI models improve, or does it get worse?
I gave five local LLMs and one frontier cloud model the same coding task on my homelab: build a tag manager for the blog’s admin panel. Only two shipped anything. Here’s what happened.
Four frontier models, ten tasks, one government shutdown. We ran Claude Fable 5 through the homelab benchmark harness three hours before Anthropic pulled the plug — and it came in second. Here’s the full bakeoff.
Two Discord bots, one 14B model, five fitness-tracker tasks. Both agents failed on the first try. Getting them working required debugging context overflow, silent tool parameter drops, and a chat template flag that changes everything. The results reveal as much about the state of local AI agents as they do about which framework won.
Coder 2.34 shipped User Secrets — per-user credential storage that injects into every workspace automatically. We upgraded, audited 29 secrets across four projects, and found exactly two that belonged there. Here’s how we decided, how we migrated, and what we cleaned up along the way.
A model refresh on the homelab (Qwen 3.6, new embeddings, 469 llama.cpp builds), a feature sprint on the vacation planning site (calendar sync, expense tracking, and three bugs that taught us more than the features did), and automating Substack syndication after discovering two more undocumented quirks. Three unrelated workstreams, one theme: maintenance is where the real learning happens.
At a C-suite roundtable in Palo Alto last week, ten-plus executives from a mix of gaming platforms, enterprise systems providers, job sites, and other Bay Area titans landed on the same analogy without being prompted: we’ve seen this before. The lift-and-shift era of AI is already here. The native era — where you redesign workflows from scratch for agents, not humans — is what comes next.
I’ve been running OpenClaw on the homelab for a month. A recommendation sent me down the Hermes Agent rabbit hole — and the research before the first real test revealed my daily driver model was broken for tool calling all along.
Substack supports RSS import, but the importer is finicky, undocumented, and rejects feeds for reasons it won’t tell you. Here’s how we got 13 curated posts from a Next.js blog into Substack — and what every other guide leaves out, including the dedup gotcha that bit us on the re-import.
I built a trip planning site for my F1 Montreal group. Then I ripped out every hardcoded value, added a setup wizard, ran a security audit, and open-sourced it. Here’s what it takes to turn a single-purpose vibe coded app into something anyone can fork and deploy.
The fitness tracker MCP server was a test run. This week I added the same thing to vibescoder.dev — 16 tools that let any agent list posts, publish drafts, check analytics, trigger deploys, cross-post to Dev.to, and troubleshoot the live site. Here’s the build, the architectural decisions, and what it’s like when the agent that built the feature can immediately use it.
A full walkthrough of setting up Wake on LAN on a Linux homelab and wiring it into Google Home via SmartThings — including every dead end, expired link, and wrong interface name along the way.
Two weeks of using Qwen3.5-35B as my daily AI assistant — the Jinja template fix that made it work, the thermal spam incident that almost ended the experiment, and the session-context gap that makes it feel like a junior dev every morning. Plus: what’s next with Qwen 3.6.
I asked an agent to security-audit my fitness tracker after wiring MCP into it. It found nineteen things. I fixed them all in four neat batches. Then the dashboard went empty, Google sign-in died, and the real bugs turned out to be the ones the audit couldn’t see — a middleware file that had been silently doing nothing for months, and an OAuth client that never existed in any project I owned.
One missing pair of quotes in one frontmatter field took down the admin drafts page. YAML 1.1 auto-parsed the date to a JS Date object, formatDate called .includes on it, and the route 500’d. Here’s the bisect from a mobile screenshot to a one-line fix, why only the drafts page broke, and the lesson about trusting types at the YAML boundary. Part two of a two-part Friday Fixes — see #1 for the scheduled-publish workflow bugs that landed the same day.
The scheduled-publish GitHub Action broke twice in nine days. Bug one: a grep that matched body text instead of frontmatter, triggered by a post about the feature itself. Bug two: a dead-code line introduced by the fix for bug one — racy under set -euo pipefail, probabilistically silent for eight days, then 42 consecutive failures with zero notifications.
Someone vibe coded an app with Google AI Studio. The Gemini API key shipped in the client-side JavaScript bundle. Google suspended the project. Here’s why every AI coding tool gets this wrong, why regular audits are the only real defense, and what you can do before it happens to you.
I built a Model Context Protocol server into the fitness tracker I vibe coded a year ago, wired it through Vercel and Coder workspaces, and ended the afternoon asking my Discord bot what my last workout was. Here’s the build, the wrong turn into Coder’s AI Bridge, the workaround, and how the same endpoint now serves Claude Desktop, Codex, Coder Agents, and OpenClaw.
The Round 5 bakeoff produced four implementations. None of them shipped. What shipped was a merge of the best pieces from all four, then a polish pass against real data. Bakeoff → Merge → Polish is a generalizable pattern for any feature where the design space is genuinely unclear.
Three AI agents audited the blog and produced three different reports. Closing them out was its own job — triage, phasing, verification, and ten commits across two repos with zero build failures. Here’s the remediation arc, what shipped, what got deferred, and what the process revealed about working through someone else’s audit.
Four LLM models built the same admin feature in isolated Coder Agents sessions. I judged them blind. The headline result: Sonnet 4.6 beat Opus 4.6 on a coding task. The deeper story is what each model did with the same prompt — and what it took to make the bakeoff fair in the first place.
From curl to working Discord bot in one afternoon — with a local LLM on the RTX 5090. Every gotcha, every config mistake, and the one setting that silently ate every server channel reply for hours.
Our AEO audit gave vibescoder.dev a clean bill of health. Cloudflare’s isitagentready.com gave it a 25 out of 100. Both audits were right — they were measuring two different competencies. Here’s the side-by-side, what each one caught, and the two genuine gaps we shipped fixes for — taking the score from 25 to 33 (and on track for 39 after the next scan).
DeepSeek V4-Pro, V4-Flash, and Zyphra ZAYA1 are three of the most exciting new models in local AI. None of them run on our RTX 5090 homelab — for completely different reasons. Here’s the research, the math, and what it means for anyone building a local inference rig.
I pointed a current-gen AI agent at a fitness tracker I vibe coded a year ago. Five PRs later: security holes patched, a 1,300-line component broken apart, sync queries batched, and accessibility fixed. Here’s what the audit found, how it was structured, and why every vibe coded app deserves a spring cleaning.
A second user joined the homelab Coder instance and couldn’t push to GitHub. What looked like a missing config turned into five chained problems, a domain migration aftershock, an agent-debugging-an-agent meta-moment, and the discovery that the same credential helper bug had been “fixed” four times in ten days — and never actually deployed.
Two AI models got the same prompt: review the blog fodder, check for redundancy, and draft a post. Opus chose a debugging war story. Qwen chose a data-driven redesign. Neither picked the same fodder. Here’s what the difference reveals about how models think about content.
We ripped out Ollama, migrated to llama.cpp, and benchmarked five local models across 12 tasks on an RTX 5090. The results surprised us — and the winner wasn’t who we expected.
Tag filters barely changed anything. A data audit revealed the problem: 94% of posts had the same tags. We replaced folksonomy with taxonomy, rebuilt the filter bar, and cut tag saturation from 94% to 56%.
Building a Dev.to cross-posting system for vibescoder.dev — and the four hours spent debugging an API that silently swallows your data without a single error message.
Three rounds of iPhone screenshots to fix spacing that should have been right the first time. The fix wasn’t smaller padding — it was teaching the agent the pixel math once so it never forgets. Plus: admin pillbox for drafts, hamburger menu shortcut, Invalid Date bugs, and scheduled publishing for every draft.
As AI agents make code generation trivial, the real value shifts from storing source code to preserving the chat conversations that created it.
I asked an AI agent to turn off my RGB lights on Linux. 85 terminal commands, 35 failures, 4 hangs, 2 dead download links, one wrong build system, and the GPU is still glowing. This is the post.
How we built a feature that turns any table or code block on vibescoder.dev into a branded, dynamically-sized PNG — downloadable or shareable with one click. Eight commits, three Satori crashes, and one middleware lesson.
Gemma 4 failed to build a single feature in our last test. This time we diagnosed the problem, switched from Ollama to llama.cpp, tuned the inference settings, and Gemma shipped a working search feature to production. Then Opus reviewed the code and made it better. Here’s what we learned about making local models actually work.
Four bugs that were silently breaking things for days: a deploy that only crashes on new images, a shell guard that eats your auth tokens, a publish date frozen at draft creation, and a homelab with no emergency remote access. Plus: capacity planning for when you’re running AI workspaces on a single machine.
A deep audit of vibescoder.dev revealed that Cloudflare was silently blocking every major AI crawler — even after we’d explicitly turned that setting off. Here’s what we found, what we fixed, and the complete playbook for making your site visible to both search engines and AI agents.
A CRLF bug silently broke every workspace for weeks. Then we fixed it, taught the agent to remember, moved templates to Git, squashed a nested heredoc, cut boot time from 91 seconds to 5, automated the screenshot pipeline, and built scheduled publishing — which this post used to publish itself. Ten fixes, one week.
How AI agents are transforming software development the same way Google Maps revolutionized travel - making the impossible feel effortless and opening up new worlds of exploration.
We pitted Gemma 4 against Opus 4.6 on a real feature build for vibescoder.dev. Gemma is the fastest model in our benchmark. It also couldn’t finish the job. Here’s what happened when we stopped testing toy apps and started building production code.
We added Google’s Gemma 4 and Moonshot’s 1-trillion-parameter Kimi K2 to the local model benchmark. Five out of six models scored perfect. Gemma 4 is the new speed king. And yes, we ran a 579 GB model off an NVMe drive — at 0.6 tokens per second.
While waiting for massive open source models to download, I tackled the homelab backlog: custom domain for my Coder instance via Cloudflare Tunnel, security hardening (with a gotcha that could kill your AI search visibility), and wiring up MCP servers to give agents superpowers.
Code block overflow, social metadata, dynamic OG images, Slack notifications for blog comments, a /todo slash command, and more. Everything shipped in a single conversational session with Coder Agents.
We gave six LLM models the exact same coding prompt and measured everything: speed, tokens, and whether the code actually works. Three models scored perfect. Two built the wrong kind of app. One ran out of tokens mid-line.
Installing Ollama, pulling five purpose-built models, wiring local inference into Coder Agents, and running agentic coding on an RTX 5090 workstation. 44 GB of models, zero cloud API calls, fully self-hosted.
The journey from “I should build a home lab” to a fully configured self-hosted Coder server with GitHub integration, multi-user workspaces, and AI agents that actually know how to use the tools available to them.
I open-sourced my blog for Giscus comments and immediately found a gutted .gitignore, an exposed server URL, and all my unpublished drafts on GitHub. Here’s how I split code from content without changing a single line of application code.
Adding a commenting system with Giscus, cleaning up the repo for public release, researching Whisper vs Wispr, and closing out week one — all from a cabana in Cabo.
Adding an RSS feed, wiring up analytics with an in-admin chart, discovering Medium locked their API, pivoting to Dev.to, and laying the groundwork for Loom-powered blog generation.
Fixing a silent login bug, building inline editing, overhauling the admin dashboard, and adding a public changelog — the session where the blog became a tool I actually want to use.
How I used Google Stitch to generate a design system, fed it to Claude, and reskinned my entire blog — including a derived light mode — in a single evening session.