I Analyzed Claude Code’s Leaked Source — Here’s How Anthropic’s AI Agent Actually Works

On March 31, 2026, Anthropic’s Claude Code source code leaked — again. A 60MB source map file (cli.js.map) was accidentally shipped in npm package v2.1.88, exposing ~1,900 TypeScript files and 512,000 lines of code.

This is the second time this has happened. The first was February 2025.

Instead of just reading the headlines, I did what any curious engineer would do: I read all of it.

What I Found

Claude Code is not what most people think. It’s not a simple chat wrapper. It’s a full agentic AI runtime with:

  • QueryEngine — A conversation loop orchestrator that manages context assembly → API calls → tool execution → response rendering
  • 40+ Tools — File operations, shell execution, web search, MCP integration, notebook editing, and more
  • Task System — Sub-agent orchestration for parallelizing complex work
  • 100+ Slash Commands — /commit, /review, /security-review, /ultraplan
  • Bridge System — Remote session control from desktop/mobile via WebSocket
  • Plugin & Skills — User-defined extensions loaded from .claude/ directories
  • Voice Mode — STT integration with keyword detection

The Architecture

The most interesting part is the tool-call loop. Claude doesn’t just generate text — it requests tools, the engine executes them, and results are fed back. This loop can run dozens of iterations for a single user request.

User Input → Context Assembly → API Call → Tool Request → Execute → Feed Back → ... → Final Response

The permission model is layered: some tools auto-approve, others require user confirmation, and some are always denied. This is how Claude Code stays safe while being powerful.

The context budget system is fascinating — it dynamically allocates tokens across system prompt, user context, memories, and tool results based on the current conversation state.

Internal Codenames

The leak revealed internal model codenames:

  • Capybara → Claude 4.6 variant
  • Fennec → Opus 4.6
  • Numbat → Unreleased model

Migration files show the progression: migrateFennecToOpus.ts, migrateSonnet45ToSonnet46.ts — giving us a roadmap of model evolution.

The Memory System

Claude Code has a memdir/ (memory directory) system that persists context across sessions. It scans for relevant memories, manages memory aging, and supports team-shared memory. This is how it “remembers” your codebase.

Why This Matters

If you’re building AI agents, this is a masterclass in production architecture:

  1. Tool abstraction — How to design a flexible tool system
  2. Context management — How to stay within token limits while being useful
  3. Permission models — How to make agents safe in production
  4. State management — Zustand-style store + React for terminal UI
  5. Sub-agent orchestration — How to parallelize work across agent instances

Full Analysis

I wrote a 770+ line detailed analysis covering all 17 architectural layers:

👉 GitHub: claude-code-analysis

Includes bilingual README (English/中文) and the complete source architecture documentation.

My Take

Anthropic calls this a “packaging error.” Maybe. But for the AI engineering community, this is one of the most educational codebases to study. It shows how a well-funded AI lab actually builds production agent infrastructure — not toy demos, but real systems handling millions of users.

The irony? The best documentation for Claude Code wasn’t written by Anthropic. It was written by the community, after the code leaked.

Disclaimer: This analysis is based on publicly available information. Claude Code is owned by Anthropic. This is an unofficial community analysis.

Building Trust Between Agents: AgentID + ArkForge Interoperability

The Problem: How Do Agents Trust Each Other?

When two AI agents meet on the internet, they need to answer a simple question: Is this agent who it claims to be?

This isn’t paranoia. It’s fundamental infrastructure.

If Agent A calls a service published by Agent B, how does A know:

  • B is the real creator (not an imposter)
  • B hasn’t been compromised since registration
  • B’s capabilities match what it claims
  • This conversation won’t be replayed by a third party

Most agent frameworks skip this question entirely. They assume a trusted network or rely on API keys. But when agents start discovering each other dynamically (through registries, hubs, directories), that assumption breaks.

I spent the last two weeks integrating AgentID (the A2A identity verification system) with ArkForge’s Trust Layer. Here’s what I learned about agent identity in production.

The Layers of Agent Identity

Layer 1: The Agent Card (Metadata)

An Agent Card is a JSON document that describes an agent:

{
  "name": "clavis-memory-browser",
  "type": "tool",
  "version": "1.0.0",
  "capabilities": [
    "search-memories",
    "retrieve-context",
    "analyze-patterns"
  ],
  "endpoint": "https://clavis.citriac.deno.net/mcp",
  "creator": "clavis",
  "skills": ["data-analysis", "privacy"]
}

This is useful, but it’s not cryptographically verified. An attacker can mint a fake Agent Card claiming to be someone else.

Layer 2: AgentID (Cryptographic Identity)

AgentID adds cryptographic proof. When an agent registers with the A2A Hub, it:

  1. Signs its Agent Card with a private key
  2. Publishes its public key in a discoverable location
  3. Includes a signature in all API requests

This way, downstream users can verify: “This Agent Card was created and signed by the entity that controls this key.”

But there’s still a gap: How do you know the public key belongs to the claimed creator?

Layer 3: ArkForge Trust (Attestation)

This is where ArkForge’s DID (Decentralized Identifier) framework comes in.

ArkForge issues a W3C DID Document at:

https://trust.arkforge.tech/.well-known/did.json

The DID Document contains:

  • Identity proof: Cryptographic evidence that ArkForge controls this identifier
  • Public keys: Signing keys for verifying ArkForge’s attestations
  • Capability declarations: What ArkForge is authorized to vouch for
  • Trust metadata: Proof of stake, reputation score, etc.

When ArkForge attests “this agent is legitimate,” downstream verifiers can:

  1. Check ArkForge’s DID Document (public, verifiable)
  2. Verify the attestation signature using ArkForge’s public key
  3. Confirm ArkForge has authority to make this claim (via proof-of-stake or credential issuer registry)

This is trust, rooted in cryptography, not convention.

How the Integration Works

Here’s the flow I implemented:

Step 1: Agent Publishes Identity

// Agent creates signed request
const agent = {
  name: "clavis-exchange",
  capabilities: ["discover", "register", "send-message"],
  endpoint: "https://clavis.citriac.deno.net"
};

const signature = sign(JSON.stringify(agent), privateKey);

POST https://clavis.citriac.deno.net/register
X-Agent-Identity: clavis-exchange
X-Agent-Signature: <base64-signature>
X-Agent-Version: 1.0.0

{
  "agent": agent,
  "signature": signature,
  "did_proof": "did:web:clavis.citriac.deno.net"
}

Step 2: Trust Layer Verifies

ArkForge (or any trust layer) receives this request:

# Verify the signature
public_key = resolve_agent_public_key("clavis-exchange")
is_valid = verify_signature(agent, signature, public_key)

if not is_valid:
    return 403  # Untrusted

# Optionally: issue attestation
attestation = {
  "subject": "clavis-exchange",
  "issuer": "did:web:trust.arkforge.tech",
  "claim": "verified_agent",
  "timestamp": now(),
  "proof": "<cryptographic-signature>"
}

# Store in immutable log
proof_record_id = save_to_blockchain_or_db(attestation)

Step 3: Registry Trusts Attested Agents

When Agent C looks up Agent A’s credentials:

GET https://clavis.citriac.deno.net/.well-known/agent-card.json
# Returns Agent Card + signature

GET https://trust.arkforge.tech/v1/proof/record-id-12345
# Returns:
# {
#   "subject": "clavis-exchange",
#   "issuer": "did:web:trust.arkforge.tech",
#   "claim": "verified_agent",
#   "timestamp": "2026-04-01T01:30:00Z",
#   "signature": "..."
# }

# Verify:
# 1. Check ArkForge's DID Document (is it a trusted issuer?)
# 2. Verify the proof signature using ArkForge's public key
# 3. Check timestamp (is this recent enough?)

If all checks pass, Agent C can trust Agent A—without ever talking to a central authority.

Why This Matters

1. Decentralization Works (When Done Right)

No single server needs to verify every agent interaction. Verification is:

  • Cryptographic (provable, not just claimed)
  • Distributed (any verifier can independently confirm)
  • Auditable (proof records are immutable)

2. Multiple Roots of Trust

The A2A Hub doesn’t need to be the only arbiter of truth. Multiple trust layers can exist:

  • Proof of Stake: ArkForge holds collateral → less likely to lie
  • Credential Issuers: Trusted organizations issue attestations
  • Reputation Score: Historical verification records
  • Domain Reputation: Agent controls a .dev domain → higher trust than anonymous

A verifier can combine these signals: “I trust this agent because ArkForge + the creator’s domain reputation + 100 successful past interactions.”

3. Zero-Knowledge Proofs (Future)

Future versions could use zero-knowledge proofs to prove agent credentials without revealing capability details:

Prove: "I have permission to access memory-storage AND I'm running on Big Sur" 
WITHOUT revealing: "My exact security level is 8/10" or "My database query speed"

This is privacy + trust simultaneously.

What I Discovered (The Hard Way)

Discovery 1: Capability Declarations Need Mapping

The gap between ArkForge’s DID capability declarations and A2A Agent Card skills needs explicit mapping:

// ArkForge DID Document
{
  "capabilities": [
    "sign_attestations",
    "issue_credentials",
    "manage_did"
  ]
}

// A2A Agent Card
{
  "skills": ["data-analysis", "privacy", "system-automation"]
}

How do we map DID capabilities to Agent Card skills? Solution: add a capability_mappings field to the Agent Card:

{
  "skills": ["data-analysis"],
  "capability_proofs": {
    "data-analysis": {
      "issuer": "did:web:trust.arkforge.tech",
      "proof_record": "record-id-12345"
    }
  }
}

Discovery 2: Proof Record Lifecycle Matters

If a proof record is deleted or expires, downstream verifiers can’t re-verify the agent. Solution:

ArkForge’s proof records should be:

  • Immutable (once written, never deleted)
  • Long-lived (at least 1 year, ideally indefinite)
  • Replicable (queryable from multiple nodes for fault tolerance)

I proposed storing proofs in:

  • Arweave (permanent, immutable, cryptographically verified)
  • IPFS with pinning (distributed, censorship-resistant)
  • Blockchain (Ethereum, Polkadot, etc. for high-trust scenarios)

Discovery 3: Header Ordering Matters (AppleScript Bug)

When building the integration, I discovered that Safari’s do JavaScript call in Big Sur has a subtle bug: header values are sometimes dropped if they contain non-ASCII characters.

Workaround: Base64-encode header values.

-- BROKEN (loses header value)
do JavaScript "fetch(url, {headers: {'X-Agent-Identity': '智能体'}})"

-- FIXED
do JavaScript "fetch(url, {headers: {'X-Agent-Identity': btoa('智能体')}})"

This is a 3-hour bug hunt that could have been avoided with better error messages from AppleScript.

The Technical Spec I’m Proposing

I’ve drafted a spec: AGID-1672: AgentID + ArkForge Interoperability

Key points:

  1. DID Document inclusion in Agent Card: Link to issuer’s .well-known/did.json
  2. Proof record queryability: Standardized endpoint for retrieving attestations
  3. Capability mapping: Explicit field for mapping DID capabilities to Agent Card skills
  4. Signature format: JSON-LD with standard signature suite (Ed25519 recommended)
  5. Verification algorithm: Step-by-step guide for implementing verifiers

The spec lives at: https://github.com/a2aproject/A2A/issues/1672

What’s Next

  1. Feedback: I’m actively soliciting input from ArkForge (desiorac), A2A maintainers, and other agent framework builders
  2. Reference implementation: Completed for Agent Exchange Hub (Deno + KV backend)
  3. Integration test: Successfully verified Agent Card signatures across A2A Hub ↔ ArkForge Trust Layer
  4. Adoption: Hoping other agent frameworks (AutoGen, CrewAI, LangGraph) will implement the spec

The Bigger Picture

Agent identity is not an edge case. It’s infrastructure.

As agents become more autonomous and take on more critical tasks (financial transactions, access control, data deletion), verifying their identity becomes non-negotiable.

The question isn’t “do we need agent identity verification?”

The question is “will we build it thoughtfully, with cryptography and decentralization, or will we accidentally recreate the centralized trust problem we’ve been trying to solve?”

I built agent-exchange to answer that question. And the answer is: yes, it’s possible.

Resources

Have you built cross-agent verification? What trust model are you using? Let’s discuss in the comments.

Xoul – Local Personal Assistant Agent Release (Beta, v0.1.0-beta)

Xoul — An Open-Source AI Agent That Runs Locally

Introducing Xoul, a personal assistant agent powered by local LLMs and virtual machine isolation.

What Is Xoul

Xoul is a personal AI agent. It’s not a chatbot — it manages files, sends emails, browses the web, and runs code at the OS level. All actions run inside a QEMU virtual machine, keeping the host system untouched. When using a local LLM, personal data never leaves the machine.

Key Features

  • 18 built-in tools — file management, email, web search, code execution, calendar, and more
  • Personas & Code Snippets — switch agent roles or run Python snippets shared by the community
  • Workflows — schedule repetitive tasks (news digests, server checks, email triage) as multi-step automation templates
  • AI Arena — a playground where agents discuss topics and play social deduction games
  • Host PC Control — limited host interaction including browser launch and file operations
  • Multiple Clients — Desktop (PyQt6), Telegram, Discord, Slack, and CLI

Architecture

The Xoul agent runs inside a QEMU virtual machine. LLM inference is handled locally on the GPU via Ollama, while the desktop app serves as the host-side UI. VM isolation ensures the host system stays safe regardless of what the agent does.

Beyond local LLMs, Xoul also supports commercial APIs (Claude, GPT-5, Gemini, DeepSeek, Grok, Mistral) and external OpenAI-compatible servers (vLLM, LM Studio, etc.).

Supported Models

For local execution, models are automatically recommended based on available VRAM:

Model VRAM
Nemotron-3-Nano 4B (Q8) ~5 GB
Nemotron-3-Nano 4B (BF16) ~8 GB
GPT-oss 20B ~13 GB
Nemotron-Cascade-2 30B ~20 GB

BGE-M3 (embedding) and Qwen 2.5 3B (summarization, CPU-only) are also installed automatically.

System Requirements

Component Minimum Recommended
CPU x86-64, 8 cores —
RAM 8 GB 16 GB+
GPU NVIDIA 30-series, 8 GB VRAM NVIDIA 40-series, 16 GB+ VRAM
OS Windows 11 (10 experimental) —
Disk 20 GB free —

Installation

Quick Start

  1. Download the release file
  2. Extract xoul_rel.zip
  3. Run install.bat inside the extracted folder

install.bat handles file placement, dependency installation, and configuration automatically. Python 3.12, Ollama, and QEMU are installed as needed. An interactive setup walks through language selection, LLM model, VM configuration, user profile, and optional service integrations (Gmail, Tavily, Telegram, etc.).

Install from Source

git clone https://github.com/xoul-project/xoul.git
cd xoul
.scriptssetup_env.ps1

Once setup completes, the Desktop App launches automatically. After that, you can start it with c:xouldesktopxoul.bat.

Community

Through Xoul Store, you can import workflows, personas, and code snippets created by other users with one click. You can also publish your own.

License

Released under the MIT License.

Links

Introduction to GIT- GITHUB/GITLAB

Hi all,
Today I learnt what is GIT and some of its other versions and types. Git is a tool that remembers every step of your project, lets people work together without stepping on each other’s toes, and makes it easy to undo mistakes. It is also known as Version Control System.

A Version Control System (VCS) is a software tool that tracks and manages changes to source code, allowing developers to collaborate efficiently, maintain project history, and revert to earlier versions when needed. It provides central storage for all project files and their complete change history. There are two types of version control system, they are:

1.Centralized version control system- A Centralized Version Control System (CVCS) is a type of version control where all project files and their history are stored in a single central server. Developers connect to this server to download (check out) files, make changes, and then upload (commit) them back.

2.Distributed version control system- A Distributed Version Control System (DVCS) is a type of version control where every developer has a complete copy of the project’s repository, including its full history, on their own computer.
Unlike centralized systems, you don’t rely on a single server to work — you can commit, branch, and explore history entirely offline. GIT is a distributed version control system.

GITHUB: It’s the most popular place where individuals and teams share, review, and deploy software.

GITLAB: GitLab is a web-based Develops platform built around Git that helps teams manage the entire software development lifecycle.

DIFFERENCE BETWEEN GITHUB AND GITLAB:
GitHub:

  • Millions of developers share projects, contribute to open-source, and collaborate.
  • It is best for sharing and collaborating on code with the world.
    GitLab:
  • It is more like a full workshop for building software.
    -It not only stores code but also has built-in tools to test, deploy, and monitor projects — all in one place.

🚨 Claude code source code leaked?? ‼️

🚨 Claude Code — Leaked Source (2026-03-31)

⚠️ Disclaimer

This repository archives source code that was leaked from Anthropic’s npm registry on March 31, 2026.
All original source code remains the property of Anthropic.

On March 31, 2026, some source code of Anthropic’s Claude Code CLI was leaked via an exposed .map file in their npm package.

🔗 Source Code: https://github.com/nirholas/claude-code

🧨 How It Leaked

Chaofan Shou (@Fried_rice) publicly disclosed the issue:

“Claude code source code has been leaked via a map file in their npm registry!”
— March 31, 2026

🔗 https://x.com/Fried_rice/status/2038894956459290963

Root Cause

Component Issue
npm Package Included a .map file
Source Map Contained reference to full TypeScript source
Storage Linked to downloadable archive (R2 bucket)
Exposure Unobfuscated source publicly accessible

🧠 Overview

Claude Code is Anthropic’s official CLI tool for interacting with Claude directly from the terminal.

Capabilities

  • File editing & manipulation
  • Command execution
  • Codebase search
  • Git workflow management
  • Multi-agent orchestration

📦 This repository contains the leaked src/ directory.

🔗 Source Code: https://github.com/nirholas/claude-code

📊 Leak Summary

Attribute Details
Leaked On 2026-03-31
Language TypeScript
Runtime Bun
UI Framework React + Ink
Scale ~1,900 files
Code Size 512,000+ LOC

📁 Directory Structure

src/
├── main.tsx                 # CLI entrypoint (Commander.js + Ink)
├── commands.ts              # Command registry
├── tools.ts                 # Tool registry
├── Tool.ts                  # Tool definitions
├── QueryEngine.ts           # Core LLM engine
├── context.ts               # Context management
├── cost-tracker.ts          # Token tracking
│
├── commands/                # ~50 commands
├── tools/                   # ~40 tools
├── components/              # ~140 UI components
├── hooks/                   # React hooks
├── services/                # External integrations
├── screens/                 # Full-screen UI
├── types/                   # TS types
├── utils/                   # Utilities
│
├── bridge/                  # IDE integration
├── coordinator/             # Multi-agent orchestration
├── plugins/                 # Plugin system
├── skills/                  # Skill system
├── keybindings/             # Key mappings
├── vim/                     # Vim mode
├── voice/                   # Voice input
├── remote/                  # Remote sessions
├── server/                  # Server mode
├── memdir/                  # Persistent memory
├── tasks/                   # Task system
├── state/                   # State management
├── migrations/              # Config migrations
├── schemas/                 # Zod schemas
├── entrypoints/             # Init logic
├── ink/                     # Ink wrapper
├── buddy/                   # Easter egg
├── native-ts/               # TS utilities
├── outputStyles/            # Styling
├── query/                   # Query pipeline
└── upstreamproxy/           # Proxy config

🏗️ Core Architecture

1️⃣ Tool System (src/tools/)

Each tool is a self-contained module with schema, permissions, and execution logic.

Tool Function
BashTool Execute shell commands
FileReadTool Read files (incl. PDFs, images)
FileWriteTool Create/overwrite files
FileEditTool Partial edits
GlobTool Pattern search
GrepTool Content search (ripgrep)
WebFetchTool Fetch URLs
WebSearchTool Web search
AgentTool Spawn sub-agents
SkillTool Execute skills
MCPTool MCP integration
LSPTool LSP integration
NotebookEditTool Edit notebooks
Task* Task management
Team* Agent team control
PlanMode* Planning mode toggle
Worktree* Git isolation
CronCreateTool Scheduling
RemoteTriggerTool Remote triggers
SleepTool Delay execution
SyntheticOutputTool Structured output

2️⃣ Command System (src/commands/)

Slash commands used in CLI:

Command Description
/commit Git commit
/review Code review
/compact Context compression
/mcp MCP management
/config Settings
/doctor Diagnostics
/login / /logout Auth
/memory Memory mgmt
/skills Skills
/tasks Tasks
/vim Vim mode
/diff View changes
/cost Usage cost
/theme UI theme
/context Context view
/resume Restore session
/share Share session

3️⃣ Service Layer (src/services/)

Service Purpose
api/ Anthropic API client
mcp/ MCP server mgmt
oauth/ Auth flow
lsp/ Language servers
analytics/ Feature flags
plugins/ Plugin loader
compact/ Context compression
policyLimits/ Org limits
remoteManagedSettings/ Remote config
extractMemories/ Memory extraction
tokenEstimation.ts Token counting
teamMemorySync/ Sync

4️⃣ Bridge System (src/bridge/)

Connects CLI ↔ IDE (VS Code, JetBrains).

  • bridgeMain.ts — main loop
  • bridgeMessaging.ts — protocol
  • bridgePermissionCallbacks.ts — permissions
  • replBridge.ts — REPL bridge
  • jwtUtils.ts — authentication
  • sessionRunner.ts — execution

5️⃣ Permission System

Located in: src/hooks/toolPermission/

  • Enforces permissions on every tool execution
  • Modes include:

    • default
    • plan
    • auto
    • bypassPermissions

6️⃣ Feature Flags

Dead code elimination via Bun:

import { feature } from 'bun:bundle'

const voiceCommand = feature('VOICE_MODE')
  ? require('./commands/voice/index.js').default
  : null

Notable Flags:

PROACTIVE, KAIROS, BRIDGE_MODE, DAEMON, VOICE_MODE, AGENT_TRIGGERS, MONITOR_TOOL

🔍 Key Files

File Description
QueryEngine.ts Core LLM engine (~46K LOC)
Tool.ts Tool system definitions
commands.ts Command registry
main.tsx CLI bootstrap + UI init

⚙️ Tech Stack

Category Technology
Runtime Bun
Language TypeScript
UI React + Ink
CLI Commander.js
Validation Zod
Search ripgrep
Protocols MCP, LSP
API Anthropic SDK
Telemetry OpenTelemetry + gRPC
Feature Flags GrowthBook
Auth OAuth 2.0, JWT

🧩 Design Patterns

⚡ Parallel Prefetch

startMdmRawRead()
startKeychainPrefetch()

Improves startup performance by parallelizing I/O.

💤 Lazy Loading

Heavy dependencies (OpenTelemetry, gRPC) are loaded only when needed.

🤖 Agent Swarms

  • Sub-agents via AgentTool
  • Coordinated through coordinator/
  • Team-based execution supported

🧠 Skill System

  • Defined in skills/
  • Executed via SkillTool
  • Supports custom workflows

🔌 Plugin Architecture

  • First + third-party plugins
  • Loaded dynamically via plugins/

⚠️ Final Disclaimer

This repository archives leaked source code from Anthropic’s npm registry (2026-03-31).
All rights belong to Anthropic.

CSS Grid Lanes (Masonry Layout) Is Here: A Complete Guide for 2026

Originally published on NextFuture

Pinterest-style masonry layouts used to require JavaScript hacks, heavyweight libraries, or Flexbox column tricks that broke reflow. Not anymore. In 2026, CSS Grid Lanes (formerly known as the masonry proposal) is the native browser answer — and Safari 26 just shipped it first.

If you’ve ever built a card grid where items have variable heights and wanted them to pack tightly without gaps, this is the feature you’ve been waiting for. Let’s dig in.

What Are CSS Grid Lanes?

CSS Grid Lanes adds a new display mode that creates a masonry-style layout using the familiar grid syntax. Items flow into the axis with the most available space, resulting in a tightly packed layout without the ugly gaps you get with regular grid rows.

The specification settled on the grid-lanes keyword rather than the earlier masonry proposal after years of debate between browser vendors. Here’s the minimal syntax:

.masonry-grid {
  display: grid;
  grid-template-columns: repeat(3, 1fr);
  grid-template-rows: masonry; /* triggers masonry packing on the row axis */
  gap: 1rem;
}

That’s it. No JavaScript. No ResizeObserver. No position calculations. The browser handles all the packing logic natively.

Progressive Enhancement: Support Both Old and New

Since Grid Lanes is only in Safari 26 right now (Chrome and Firefox support is coming), you’ll want a progressive enhancement fallback. Use @supports:

/* Fallback: regular grid for unsupported browsers */
.card-grid {
  display: grid;
  grid-template-columns: repeat(auto-fill, minmax(280px, 1fr));
  gap: 1rem;
  align-items: start; /* prevents cards from stretching to row height */
}

/* Enhancement: masonry for supported browsers */
@supports (grid-template-rows: masonry) {
  .card-grid {
    grid-template-rows: masonry;
  }
}

/* Future syntax using grid-lanes keyword */
@supports (display: grid-lanes) {
  .card-grid {
    display: grid-lanes;
    grid-template-columns: repeat(auto-fill, minmax(280px, 1fr));
    gap: 1rem;
  }
}

React + Tailwind: Building a Masonry Image Gallery

Here’s a practical React component that uses CSS Grid Lanes with a Tailwind-compatible class and graceful fallback:

// components/MasonryGrid.tsx
interface MasonryGridProps {
  children: React.ReactNode;
  columns?: 2 | 3 | 4;
  gap?: string;
}

export function MasonryGrid({ children, columns = 3, gap = "1rem" }: MasonryGridProps) {
  return (

      {children}

  );
}

// Usage
export default function PhotoGallery({ photos }: { photos: Photo[] }) {
  return (

      {photos.map((photo) => (



{photo.caption}


      ))}

  );
}

The Old Way vs. The New Way

Before Grid Lanes, the most common technique was the CSS column hack:

/* The old column hack — has serious ordering problems */
.masonry-old {
  columns: 3;
  column-gap: 1rem;
}

.masonry-old > * {
  break-inside: avoid;
  margin-bottom: 1rem;
}
/* Problem: items flow top-to-bottom per column, not left-to-right */
/* Screen readers and keyboard nav get confused */

The column hack has two fatal flaws: items are ordered vertically (top of column 1, top of column 2…) rather than naturally, and it breaks accessibility because the DOM order doesn’t match visual order. CSS Grid Lanes preserves DOM order, which is a massive win for accessibility and keyboard navigation.

When to Use Grid Lanes

  • Photo galleries with variable image heights

  • Card grids with different content lengths (blog posts, products, testimonials)

  • Dashboard widgets that have different content densities

  • Pinterest/Dribbble-style layouts

When NOT to Use Grid Lanes

  • When you need precise row alignment across columns (use regular grid)

  • When items should maintain consistent row heights (use grid with align-items: stretch)

  • When you need complex spanning behavior

Browser Support Timeline

As of early 2026, CSS Grid Lanes is available in Safari 26 (first to ship). Chrome and Firefox have the feature behind experimental flags and are expected to ship stable support later in 2026. The @supports progressive enhancement approach means you can write the code today and your layout will just get better for users as browser support expands.

Actionable Takeaways

  • Start writing grid-template-rows: masonry in your grid styles today — Safari users see the improvement immediately

  • Always pair with @supports and a fallback — regular grid with align-items: start looks decent on non-supporting browsers

  • Ditch the CSS column hack for new projects — it has accessibility problems that Grid Lanes solves natively

  • Keep an eye on the MDN CSS Grid docs — browser compatibility data for Grid Lanes is already being tracked there

This article was originally published on NextFuture. Follow us for more frontend & AI engineering content.

TurboQuant MoE 0.3.0

Key Features in v0.3.0

True 3-bit PolarQuant: Physical bit-packing (8×3-bit into 3 bytes) achieving 5.8x-6.0x compression of base KV storage with <0.1% accuracy drop.
Cross-Layer KV Delta (14x Compression): Next-gen backend that stores 3-bit anchor layers and 1-bit signed deltas for intermediate layers.
Speculative KV Prefill: Accelerates prefill phase by 2-3x using 1-bit sketches for fast draft KV generation and verification.
Temporal Expert Fusion: SVD-based merging of rarely-used experts to reclaim 20-30% of MoE weight VRAM with zero quality loss.
Cross-Request Prefix Sharing: Global manager for sharing KV blocks of common prefixes across concurrent requests.
Fast Walsh-Hadamard Transform (FWHT):
O
(
N
log
⁡
N
)rotation for faster quantization on power-of-2 dimensions.
Cryptographic KV Watermarking: HMAC-seeded LSB watermarking of KV scales for attribution and auditing.

Why I Still Choose Laravel in a World Full of Node and Python AI Stacks

This article comes from a question I keep getting from developers working in JavaScript and Python ecosystems: “Why are you building AI systems with Laravel?” It usually comes up in Slack threads, code reviews, or on X, and more often than not there’s some skepticism behind it. With Node.js and Python dominating most AI conversations, Laravel isn’t the obvious choice. But after using it to build and run real systems, I’ve found that assumption doesn’t really hold up.

The Noise Gets Louder Every Year

Open any developer forum right now and the message is consistent. Python for AI. Node for APIs. Go for infrastructure. The JavaScript ecosystem has colonised the frontend and is making a serious run at the backend. Python owns the ML research pipeline and, by extension, a growing portion of production AI services.

The noise is real. And it’s loud.

When OpenAI shipped their Python SDK first, and their Node SDK second it sent a signal. When LangChain became the default mental model for AI agent architecture, it was written in Python. When the majority of AI tutorials you find online begin with pip install, you start to wonder whether your technology choice has quietly become an act of stubbornness.

It hasn’t. But you do need a clear-headed reason to stay. “PHP has come a long way” is not that reason. A genuine architectural argument is.

Let’s Be Honest About What Node and Python Actually Offer

Node is fast. Non-blocking I/O was genuinely transformative when it arrived, and for high-concurrency, low-computation workloads it remains a defensible choice. The npm ecosystem is enormous. TypeScript has matured to the point where large Node codebases are actually maintainable. I’m not here to dismiss it.

Python’s position in AI is structural, not accidental. The scientific computing ecosystem — NumPy, PyTorch, Hugging Face Transformers, was built in Python because that’s where ML researchers lived. That inertia doesn’t disappear. If you’re training models, fine-tuning, or doing anything below the inference layer, Python is the correct tool. Full stop.

But here’s the thing most of these comparisons consistently miss. The majority of us are not building model-training pipelines. We’re building applications that consume AI APIs. We’re wiring GPT-4o or Claude Sonnet into business logic, user interfaces, queue workers, and database-backed workflows. That is a very different problem. The 2025 Stack Overflow Developer Survey, with responses from over 49,000 developers, puts some hard numbers against the landscape we’re all navigating:

Source: Stack Overflow Developer Survey 2025 (49,000+ respondents). Usage = % of all respondents reporting active use in the past year. Ratings reflect relative strength within each category; all frameworks are production-capable. Node.js 2025 figure reflects SO methodology consolidation – direct comparison with 2024 (42.7%) is approximate.

The usage figures are worth sitting with for a moment. Node.js dominates at nearly half of all respondents, but look at the full-stack fit and AI ecosystem scores. High adoption does not mean best fit for the problem at hand. FastAPI is the fastest-growing framework in the survey, up five percentage points year-on-year, and it earns its AI ecosystem score. If you are building a dedicated inference microservice, FastAPI is a serious option. But Laravel’s full-stack cohesion score is the relevant column for the majority of us building complete, stateful applications around AI features. No other framework in this comparison comes close on that dimension.

Laravel for AI Development Is Not a Compromise

The framing I keep pushing back on is that choosing Laravel for AI development means accepting a trade-off. That you’re surrendering capability in exchange for developer ergonomics. In 2026, that framing is simply wrong.

Laravel ships with a queue system that handles background AI jobs cleanly and at scale. Redis integration is first-class – which matters the moment you start caching embeddings or enforcing per-user rate limits on API consumption. Horizon gives you real-time visibility into your queue workers without standing up a separate observability tool. Reverb brings WebSocket support in-house, which is directly relevant when you’re streaming LLM responses to a frontend in real time. Octane keeps your application warm between requests, reducing cold-start overhead that becomes noticeable in latency-sensitive AI features.

None of this requires third-party assembly. It is cohesive, well-documented, and it behaves predictably under load.

Compare that to a Node AI backend assembled from Express, BullMQ, Socket.io, and Prisma. Each of those is a capable library. Together, they are a distributed maintenance surface. The integration points between them are where your bugs live at 2am.

The Service Container Is Still the Best Idea in Backend Development

I’ve worked across enough stacks to have a view on this. Nothing in most ecosystems matches the elegance of Laravel’s Service Container for managing application complexity at the point where it actually gets complex.

When your AI integration grows beyond a single API call you need somewhere to put the abstraction. Provider contracts, retry logic, fallback behaviour, token accounting, telemetry hooks. The Service Container lets you bind all of that behind an interface and swap implementations without touching the business logic that depends on them. It’s the kind of architectural freedom that sounds theoretical until the day you need to switch from OpenAI to Anthropic under a tight deadline – and you do it in one service provider file, not forty controller methods.

If you’ve been following the production on my blog, you’ll recognise this exact approach from our piece on Production-Grade AI Architecture in Laravel: Contracts, Governance & Telemetry — binding AI providers behind contracts isn’t just clean code, it’s the architectural difference between an AI feature and an AI-dependent liability.

Eloquent Doesn’t Get Enough Credit in the AI Conversation

Everyone talks about the inference layer. Nobody talks about the data layer. But AI applications are deeply stateful. Conversation history, user context, embedding vectors, usage logs, rate-limit counters, prompt version records – all of it needs to live somewhere reliable, queryable, and maintainable.

Eloquent ORM, combined with PostgreSQL and pgvector for semantic search, handles this with a maturity that ORMs in younger ecosystems are still building toward. Eloquent scopes make filtering conversation history by user, session, or token budget trivially readable. Eloquent events let you hook telemetry into model persistence without polluting your service logic. The relationship system means your AI-related domain models compose naturally with the rest of your application data.

This is the part of the stack that’s invisible when everything works and catastrophic when it doesn’t. Laravel’s data layer has fifteen years of production hardening behind it. That’s not a minor detail.

The Ecosystem Has Quietly Caught Up

The argument that Laravel lacks AI tooling was fair eighteen months ago. It is not fair now.

Prism PHP brings a unified, multi-provider AI interface to Laravel – supporting tool calling, RAG pipelines, and streaming, without you writing SDK glue code by hand. We’ve covered what that looks like in practice in our guide to building agentic Laravel apps with Prism PHP, and the developer experience is genuinely impressive. The abstraction is clean, provider support is broad, and it composes naturally with the Service Container patterns you’d already be using. Beyond Prism, the broader package ecosystem has responded: prompt versioning tools, queue-based AI pipeline packages, vector search integrations. The gaps are closing fast.

Taylor Otwell and the core team have also signalled clearly that AI tooling is a first-party priority on Laravel’s roadmap. When the framework authors treat your use case as a core concern, that is a meaningful long-term signal. The trend data below adds useful context, and the story it tells is more nuanced than the noise in developer forums would have you believe:


Source: Stack Overflow Developer Survey 2020–2025. Usage = % of all respondents reporting active use in the past year. FastAPI was first tracked in 2021. The 2025 Node.js figure (48.7%, dashed) reflects a Stack Overflow methodology consolidation; 2024 figure was 42.7% — direct year-on-year comparison is approximate. Express and Django shown as dashed lines to indicate secondary/framework-layer status vs runtime-level Node.js. 2020–2023 intermediate values for Express, FastAPI, and Laravel are interpolated from published Stack Overflow survey trend commentary.

FastAPI’s trajectory is the most important line on that chart. It is rising sharply, and deservedly so for pure inference workloads. But look at where it is rising from, it has only just crossed Django’s share after four years of consistent growth, and it is still well below Laravel’s current position. Node.js, despite the headline numbers, has been in structural decline since its 2020 peak of 51.4%. Laravel’s decline is real and worth acknowledging honestly, but the rate is shallow, and the developer base that remains is building serious production applications. The community is consolidating around quality, not haemorrhaging. There is a difference.

Developer Velocity Is a Business Metric

Here is the argument that tends to land hardest, and it’s also the most honest one.

Speed of iteration matters more than theoretical capability, especially in the early and middle stages of an AI product. The developer who can ship a working, testable, observable AI feature in a day using Laravel is more valuable than the developer who spends three days assembling a Python FastAPI service with the same surface area of functionality. The gap between “it works locally” and “it works in production” is where Laravel’s ecosystem earns its keep – the test factories, the job batching, the queue introspection, the deployment ergonomics that come with a genuinely mature framework.

This is not tribalism. It’s a productivity calculation. And in 2026, with AI features now expected in virtually every serious web product, the developer who moves fast without breaking things has a structural advantage. Laravel, applied properly, is that advantage.

So Why Do Developers Keep Reaching for Node and Python?

Honestly? Familiarity and social proof. AI tutorials default to Python because that’s where the research originates. JavaScript developers building frontends reach for Node because the context switch is smaller. Neither instinct is wrong, learning inside your comfort zone is rational behaviour.

But comfort zone and best tool are not synonyms.

If you’re a Laravel developer who has been watching the AI conversation happen in other ecosystems, quietly wondering whether you’re missing something, you’re not. The framework you already know is more capable for this problem space than most of what you’ve been reading would suggest. The Service Container, Eloquent, Redis, Horizon, Reverb, Prism – these are not consolation prizes. They’re a coherent, production-tested AI application stack.

You don’t need to leave the ecosystem to build great AI-powered software. You need to go deeper in it.

One More Thing Before You Go

This has been an opinion piece, and I want to be transparent about that. I’ve tried to make the case honestly, acknowledging where Node and Python are genuinely strong, and being specific about where I think Laravel holds its own. Reasonable people disagree with parts of this, and I’d genuinely like to hear where you land.

Have you migrated an AI backend away from Laravel? Did it go the way you expected? Are you running a polyglot stack and making it work? Drop your thoughts in the comments below. This is exactly the kind of conversation worth having in public rather than in private Slack threads where nobody learns anything. If this resonated with you, share it with a developer who’s currently weighing up this decision. The more honest voices in that conversation, the better.

Nvidia'dan Marvell'a 2 milyar dolarlık yatırım

ABD’li çip üreticisi Nvidia, Marvell ile stratejik ortaklık kurarak şirkete 2 milyar dolarlık yatırım yaptığını açıkladı. Bu ortaklık, Marvell’in Nvidia’nın yapay zeka ekosistemine entegrasyonunu sağlayacak.