DEV Community: Andy Yeung

Why Windows wouldn't let me rename a folder I wasn't using

Andy Yeung — Wed, 28 Oct 2026 07:06:46 +0000

Background

I wanted to give a Next.js project folder a new name. It should have been a two-second job, but every attempt ended with Access is denied, even though I had closed every file inside it.

The usual answer is to reboot. I wanted to know what was actually holding it.

What I tried

Stopped the dev server: still couldn't rename it.
Closed every editor window: a quick check showed more than ten editor processes still running in the background.
Force-quit those editor processes: that also stopped another project's dev server running in its terminal, and the rename still failed.
Checked the files with Windows' own lock check (Restart Manager): it said nothing was locked.
Installed PowerToys: its install log said the machine was waiting for a reboot.

In the end I kept the old name, but I finally understood what was going on.

Why Windows locks things

Windows makes a different trade-off from macOS and Linux:

Windows: when a program opens a file, other programs can't delete or rename it unless the first program explicitly allows it. That way nothing swaps out a file a running program depends on.
macOS and Linux: you can rename or delete a file while it's open, and the program that opened it keeps reading the old contents.

What gets locked is often the folder itself rather than any one file. In a development project the usual suspects are:

Working directory: once a terminal has cd'd into a folder, the folder can't be renamed.
File watchers: editors and dev servers watch the whole project, and they can keep running after the window is gone.
Antivirus scans: Defender scans newly written files, and node_modules holds a lot of them.
System services: the search indexer and Explorer thumbnails and previews.

The tool that answers the question: File Locksmith

Access is denied tells you something is using the folder, but never what. File Locksmith, one of the small utilities in Microsoft's free PowerToys, answers exactly that.

Turn it on: open PowerToys and switch on File Locksmith.
Ask about a file or folder: right-click it in File Explorer, choose Show more options, then Unlock with File Locksmith. You can select several items at once.
It looks inside folders: for a folder it also checks every file and subfolder in it, which is what my case needed. A check that only looks at single files misses this.
Read the list: it shows every process using your selection, and each one expands for more detail.
Release only what's needed: End task stops that one process. The list updates by itself when a process goes away, and Reload scans again.
See everything: by default it only sees your own programs. If the list is empty but the folder is still locked, choose Restart as administrator to include system services and other users' processes.

There's also a command-line version that can wait until a file is released, which is handy in a build script:

PowerToys.FileLocksmith.CLI.exe --wait --timeout 30000 "C:\path\to\my-project"

If you can't install PowerToys

Resource Monitor is built in: open it, go to the CPU tab and search for the folder name under Associated Handles.
Sysinternals handle does the same from the command line:

handle.exe -nobanner my-project

Both list the handles each process holds, folders included. Restart Manager only checks files, which is why it found nothing when the folder itself was locked.

Mistakes I made

Closing the windows isn't closing the program: with every editor window gone, more than ten processes were still running.
Force-quitting has side effects: a dev server running in the editor's terminal stops with it.
Using the wrong tool: a file-only check can't see folder locks, so my "nothing is locked" conclusion was wrong.
A pending reboot: unfinished system updates make every kind of lock harder to track down.

What improved

Now when a folder won't rename, I right-click it and File Locksmith tells me which program is holding it, instead of me closing apps one by one and guessing. I end just that one process instead of rebooting. And before renaming a project, I close the editor, the dev server and any terminal that's sitting inside it.

Two more ways to avoid it altogether: keep projects on a Windows 11 Dev Drive (or add them to Defender's exclusions), or run Node.js projects inside WSL.

Cover: Closeup padlock wooden door by Markus Spiske, CC0 1.0.

My first day with ComfyUI: from a selfie to a 20-second aquarium shot

Andy Yeung — Tue, 27 Oct 2026 07:06:32 +0000

Background

After installing ComfyUI for a friend I couldn't resist trying it myself. I don't work in VFX and knew nothing about nodes or models, so I started from ComfyUI's built-in templates: LTX-2.5 for image to video and FLUX.2 Klein for image editing. My graphics card has 16 GB of VRAM, and a 5-second clip took about 100 seconds.

What I tried

A selfie with the template's own prompt: the clip started with me at a restaurant door and then cut to a cyberpunk rooftop. Image to video means "make the first frame move", so when the prompt describes a different place, the AI does both.
Edit the photo first, then animate it: an image-edit prompt saying "turn him into a cyberpunk character" gave me a movie hero who looked nothing like me. Rewriting it as a list ("keep his face, change only these things") got much closer.
A full-body shot with new clothes and a new location: no likeness at all. In a full-body frame the face is only a few dozen pixels, far too little for the AI to keep the details that make it you.
Changing tack: a photo without a face: me from behind at an aquarium. With no face to keep, the AI could put all its effort into the fish and the camera. This worked best.

How I did it

1. The first frame decides everything

Location, distance and aspect ratio all come from the first frame. My first aquarium clip showed only my head and shoulders: the aspect ratio was still 16:9, so a very tall portrait photo was cut into a horizontal strip from the middle. I cropped the photo to 9:16 (trimming only the top of the tank and keeping my feet) and set the aspect ratio to 9:16.

2. Describe what's already in the frame first

First the person, clothes and setting, then one or two motions and one camera move, and finally "Same location throughout, no scene change, no cuts". LTX-2.5 also generates sound, so the prompt can end with what you want to hear.

3. Control the camera with words

For a wide shot, write "wide shot, the camera keeps the same distance". To stop it pushing in too far, write "stays at a medium distance, always showing the whole sardine ball", because fish seen too close fall apart.

4. For 20 seconds, move the camera instead of cutting

The AI tends to warp at a hard cut. I wrote four beats with "first... then... finally...": a slow push in on the wide view, then tilt up to follow the manta ray, then drift back down to the sardine ball as a shark swims through it, then pull back to finish. About five seconds each, so it never feels rushed.

One continuous take, smooth camera movement, no hard cuts.
At the start: <wide description of the first frame>. The camera drifts slowly toward <subject> but stays at a medium distance.
Then <second subject> passes; the camera gently tilts and pans to follow it.
Then the camera drifts back to <main subject>.
At the end, the camera slowly pulls back to the wide view.
The person does not move. Same location throughout, no scene change, no text.
<sound description>.

Things that bit me

Keeping a real face is the hardest part: asking the AI to "become a character" makes it invent a new person. "Keep the face, change only...", a waist-up framing and a higher resolution all help; for full-body likeness you need a dedicated face-swap tool or a LoRA trained on your face. That's also why VFX artists pair AI with Nuke.
Settings I forgot to change: I thought I had set 20 seconds and portrait, but the result was 5 seconds and landscape. Check duration and aspect ratio before every run.
Be specific about the sardines: a vague "fish" gave me a crowd of big fish. "A massive swirling ball of thousands of small silvery sardines with dark spots along their sides" gave me the ones I wanted.
Game screenshots as references: fine for playing around, but don't copy existing characters or locations for commercial work. And tick "Add AI label" when you post.

What improved

	At first	Later
Location	Restaurant door, then a sudden cyberpunk rooftop	The same place from start to end
Framing	Cut down to head and shoulders	Whole body in frame
Fish	A crowd of big fish	A sardine ball, a manta ray and a shark
Length and camera	5 seconds, pushing in the whole time	20 seconds, four natural camera beats

Let AI apply it for you

If you want to turn a photo into an AI video, paste this into an AI chat along with your photo:

Help me write an image-to-video prompt for ComfyUI (LTX-style models) from the attached photo:

1. Describe exactly what is already in the photo: subject, clothes, setting, lighting.
2. Add only one or two motions and one camera move. For clips over 10 seconds, use "first... then...
   finally..." beats with continuous camera moves instead of cuts.
3. Control distance with words: "wide shot, the camera keeps the same distance" or "stays at a medium
   distance"; avoid "close-up" or "push in" unless I ask.
4. End with: "Same location throughout, no scene change, no cuts, no text." and a short sound description.
5. Tell me which aspect ratio and duration to set so the photo is not cropped.

Cover: A large school of silver fish with dark markings swimming through deep blue water in a spacious aquarium. by Faisal Ahammad, CC0 1.0.

A one-click ComfyUI + Nuke installer for a friend in VFX

Andy Yeung — Mon, 26 Oct 2026 03:31:25 +0000

Background

My friend does compositing and wanted to find out whether AI image and video tools could fit into a Nuke workflow. An open-source plugin, ComfyUI-for-Nuke, makes that possible, but it needs a lot: ComfyUI itself, a PyTorch build that matches the graphics card, two ComfyUI nodes, the Nuke plugin, Python packages for Nuke's own Python and an edit to Nuke's menu.py.

My friend isn't technical, and their biggest fear was an update that stops old projects from opening. So the rules were clear: no typing commands, no changes to anything already on their computer, and updates only when they choose them, with a way back.

What I tried

A written list of install steps: nine steps, a few of them in an administrator terminal. For someone who isn't technical, one wrong step and they are stuck.
One bash script for Windows and Mac: it sounds neat, but a fresh Windows PC has no Git, so no Git Bash, so the very first step (install Git) can't run. In the end Windows uses the built-in PowerShell, Mac uses the built-in bash, and both read the same version list.
Using the Python and Git already on the computer: it saves space, but any upgrade could break their other tools. Everything moved to private copies instead.

How it works

1. Everything in one folder

The script downloads private copies of Git, uv (a Python package manager) and Python into the install folder. The only thing written outside it is a tiny settings file that remembers where it was installed. No environment variables, no PATH changes.

2. Versions pinned in one list

ComfyUI, the nodes and the plugin are pinned to tested commits. PyTorch is picked for the graphics card: a newer driver gets the newer CUDA build, older cards get an older build, and without NVIDIA it falls back to CPU.

{
  "repos": { "comfyui": { "ref": "v0.x.y", "commit": "<sha>", "risk": "Medium" } },
  "torch": [ { "name": "cu130", "minDriver": 580, "minComputeCap": 7.5 },
             { "name": "cpu" } ]
}

3. Updates one by one, with a restore point first

"Check for updates" lists each item with its old and new version and a risk note (the Nuke plugin is marked "High: ComfyUI nodes in older .nk scripts may need to be refreshed"), and only what they pick gets updated. Before every install, update or rollback the script records each repo's commit, the Python package list and menu.py, so any earlier state can come back.

4. Only one marked block in `menu.py`

Nuke's settings file gets a single block with clear start and end markers, backed up before every change, and uninstall removes only that block.

5. Logs, a change list and "Doctor"

Every run writes a log and ends with a list of what was installed, updated or backed up. When something goes wrong, "Doctor" puts a zip of logs and settings (no images or projects) on the desktop that they can send me.

Things that bit me

uv tries to be helpful: when it installs Python it adds a shortcut to the PATH and registers it in the Windows registry. It takes --no-bin and --no-registry to really leave the system alone.
The user's PYTHONPATH: if the computer has PYTHONPATH or PYTHONHOME set, even a separate environment picks up old packages or fails to start. The script and the launcher clear those variables for their own process only.
PowerShell swallows output: running a program directly inside a function turns its output into the function's return value, so prompts and progress bars vanish. Start-Process -NoNewWindow -Wait fixed it.
The Mac's bash is old: macOS ships bash 3.2, with no associative arrays, so the script reads JSON with the built-in plutil instead of extra tools.

What improved

	Before	After
Install	Nine manual steps, admin rights	Double-click, choose 1, about fifteen minutes
Effect on the computer	Changes system Python and PATH	Everything in one folder
Updates	All at once, no way back	Picked one by one with a risk note, can roll back
When something breaks	Just "it won't open"	Logs, a change list and a Doctor zip

Still to do: the Mac version hasn't run on a real Mac yet. That's next.

Let AI apply it for you

If you want to package an open-source tool for a friend who isn't technical, paste this into an AI coding assistant:

Write a one-click installer for <tool> for a non-technical user:

1. Self-contained: download private copies of every runtime (Git, Python via uv) into one install
   folder. Never touch the system PATH, registry, environment variables or existing installs, and
   ignore PYTHONPATH/PYTHONHOME for our own processes only.
2. Pinned: keep every version (repos by commit, packages, runtimes) in one manifest of tested versions.
   Pick the GPU build from the detected driver.
3. Updates: list each item with old/new version and a plain-English risk, let the user pick by number,
   and update tested versions together as a set.
4. Reversible: before every install/update/rollback, snapshot repo commits, the package list and any
   config file we edit; offer rollback to any snapshot. Only edit config inside a marked block, after a backup.
5. Traceable: a log per run, a summary of what changed, and a "Doctor" option that zips logs and settings.

Windows uses the built-in PowerShell 5.1, macOS the built-in bash 3.2. Ask before anything destructive.

Cover: Free close socket toolbox image by Unknown, CC0 1.0.

Free AI for my Chrome extension's users, with no API key and no surprise bill

Andy Yeung — Mon, 19 Oct 2026 07:07:55 +0000

The problem: I wanted the extension to see what I'm working on

Groupify is my Chrome tab organizer. When I start a new project I usually have Pinterest, the Next.js docs, Cloudflare and Vercel open at once, and grouping by website just splits them apart. What I wanted was one click to put those tabs in one group, with a sensible name such as “Website deploy”.

That needs AI. The question was which AI.

What I tried

Chrome's built-in AI (Gemini Nano): it runs on the user's computer, free and private, so it's the ideal choice. But it needs a capable machine and a lot of free disk space. My own computer doesn't have it, and most users won't either.
Asking users for their own API key: the simplest technically, but my users aren't developers. Nobody signs up for a key to rename tabs.
My own API on OpenAI or Azure: possible, but neither has a real free tier for this. A budget alert only emails me; it doesn't stop anything, so a bit of abuse still turns into a bill.

I wanted a free allocation that stops when it's used up, like the Azure speech free tier I use in another extension.

Why Cloudflare Workers AI

Workers AI gives every account a free daily allocation. On the Workers Free plan, requests past it fail instead of being charged, so the most it can ever cost me is nothing. I only needed a tiny Worker in the middle that does three things: recognise my extension, limit how much each person can use, and turn the tabs into a prompt.

How I applied it

1. The Worker does two things

One endpoint names a set of tabs; the other sorts a pile of tabs into groups by task. The Worker stores nothing and logs nothing, so it never remembers what anyone sent.

2. Send only what's needed

The extension sends each tab's title and site name, never the full address, because addresses often carry tokens or private parameters. At most 40 tabs go in one request, and long titles are cut short.

3. Only my extension gets an answer

The Worker answers only my extension's origins (the store build and my development build) through CORS. That means the extension needs no new permission, so users see no new warning when it updates. An origin can be faked, so there's also a per-IP limit per minute on top of the free allocation's hard cap. The worst case is a day without AI.

4. A model that's good at Chinese and cheap

Most of my users read Traditional Chinese, so I picked a cheap open model that handles Chinese well and told it to skip its thinking output to save allocation. Naming a group uses very little, and at my current number of users the free allocation goes a long way.

5. Off by default, and clear about what's sent

Cloud AI is a switch in Settings, off by default, with a line saying tab titles and site names go to my server and nothing is kept. The extension always tries on-device AI first, then the cloud, then names by date, so whichever step fails, users never see an error.

Things that tripped me up

Half a Chinese character: now and then the model put a broken character in the middle of a name. The Worker asks again once when that happens, and both sides strip any broken characters.
JSON isn't guaranteed: not every model supports JSON mode, so I take the first JSON object in the answer and check every field, for example that tab numbers aren't repeated or out of range.
The rate limit is approximate: Cloudflare counts per location, and in my test it only started refusing around the ninth request. Good enough against abuse, but not an exact counter.
A development build has a different ID: an unpacked extension's ID comes from its folder path, so the allow list needs that ID too.

One more small trick: telling your changes from the extension's

Once Groupify could sort tabs automatically, I hit a problem: automatic sorting must not pull apart groups I made by hand. If I put my own blog's tabs in a group called “Me”, sorting by purpose shouldn't move them into “Reading”.

But Chrome doesn't record who changed a tab or a group, only how things are now. So the extension has to tell for itself. Before it changes any group, it writes down “the next few seconds of changes are mine”. A background worker listens to Chrome's tab and group events, and treats anything outside that window as the user's decision, including dragging tabs and renaming groups in Chrome's own tab bar.

// The extension's own changes are wrapped, so they never count as the user's
async function asExtension<T>(change: () => Promise<T>): Promise<T> {
  await storage.session.set({ ownChangesUntil: Date.now() + 15_000 })
  try {
    return await change()
  } finally {
    // Chrome's events can arrive a little late, so keep the window open for a second
    await storage.session.set({ ownChangesUntil: Date.now() + 1_000 })
  }
}

const isOwnChange = async () => (await storage.session.get('ownChangesUntil')) > Date.now()

// Background worker: every other change is the user's decision
tabs.onUpdated.addListener(async (tabId, change, tab) => {
  if (change.groupId === undefined || change.groupId === NO_GROUP) return
  if (await isOwnChange()) return
  const group = await tabGroups.get(change.groupId)
  if (group.title) rememberSite(siteOf(tab.url), group.title) // e.g. "amsyn.org" -> "Me"
})

tabGroups.onUpdated.addListener(async (group) => {
  const before = lastKnownTitle(group.id) // from a snapshot the worker keeps
  if (before === group.title || (await isOwnChange())) return
  renameRulesAndLock(before, group.title) // rules and locks follow the new name
})

// Reclassify: what the user decided goes first, automatic sorting gets the rest
function reclassify(tabs: Tab[], rules: SiteRule[], mode: Mode) {
  const movable = tabs.filter((tab) => !tab.pinned && !isLocked(tab.group))
  const { claimed, rest } = splitByRules(movable, rules) // sites with a rule
  return [...groupsFromRules(claimed), ...plan(mode, rest)]
}

A few details:

Names, not IDs: a rule is “site → group name”. Chrome gives groups new IDs when it restarts, but names stay.
Side panel actions are recorded directly: dragging a tab, naming a new group or renaming one is already the user acting, so there's nothing to guess.
The latest decision wins: drag a site's tab into another group and the rule updates; Settings lists every rule so you can forget one.
Your groups lock themselves: a group you changed by hand gets a lock, so Reclassify leaves it alone.

What improved

	Before	Now
Users without on-device AI	Groups named after the date	One switch for AI names and sorting
API key	Users would need their own	None at all
Cost risk	A budget alert only notifies	Stops when the free allocation runs out
Privacy	—	Off by default, titles and site names only, nothing kept

If usage grows or someone abuses it, the worst that happens is a day without AI, and the extension goes back to naming by date. For a side project with a handful of users, that's the setup I'm most comfortable with.

Let an AI set it up for you

If you want to add free AI that can't run up a bill to your own extension or small tool, paste this into your AI coding assistant:

Add an optional shared AI feature to my browser extension, using this design:

1. Server: a Cloudflare Worker using the Workers AI binding (free daily allocation, so on the
   Workers Free plan it fails instead of billing). Pick a cheap model that handles my users'
   languages. Expose only the endpoints the feature needs, keep no logs or state, and validate
   every request body (cap the number of items and the length of each string).
2. Access: answer CORS only for my extension's origins (store ID plus my unpacked dev ID, read
   from a variable), so the extension needs no new permission. Add a per-IP rate limit with the
   Workers rate-limiting binding.
3. Data: send only what the prompt needs (for tabs: title and hostname, never full URLs).
4. Answers: ask for JSON, but parse leniently (find the first JSON object, ignore any thinking
   block) and validate every field. Retry once if the answer contains U+FFFD.
5. Extension: an opt-in setting, off by default, that says exactly what is sent and where. Try
   any on-device AI first, then the Worker, then a non-AI fallback, so no error ever reaches the
   user. Treat every HTTP error or timeout as "no AI".
6. Tests for request parsing, answer parsing and the fallback order, plus a README for the
   Worker with the deploy steps.

Don't ask me for any secret. Stop after writing the code so I can review and deploy it.

Cover: Mail sorting room, U.S. Post by libraryofcongress, CC0 1.0.

Getting my iPhone music app to keep playing on the lock screen

Andy Yeung — Sun, 18 Oct 2026 07:06:39 +0000

I mostly use my private music app on an iPhone, added to the home screen, with the phone locked in my pocket. For a music app, two things are the bare minimum:

When a track ends on the lock screen, the next one starts.
The lock screen and Dynamic Island show previous and next buttons.

Both sound basic. In a home-screen web app on iOS, both took me far longer than I expected.

What I tried first

A short silent clip between tracks. Before each switch I played a tiny silent sound, hoping iOS would think audio never stopped. The clip was so short it fired its own "ended" event, which sometimes skipped several tracks at once. Timers in the background were delayed too, so it worked only some of the time.
Endless silent audio in the background. Keeping a silent loop playing all the time did make the lock screen move on to the next track. But I didn't know why it worked, and it broke again whenever I changed something else.
Registering the buttons again after play started. This brought back previous and next on the Dynamic Island, but again I didn't know why.

When I rewrote the player, both problems came back. This time I wanted to understand the real cause instead of trying things until something stuck.

Why the next track never started

From WebKit bug reports and other developers' digging into WebKit's source, the picture is this:

On recent iOS versions, when an audio element plays to its natural end and nothing else is playing, WebKit closes the app's audio session.
In the foreground, the next play() simply opens it again.
In the background, iOS won't let the app reopen it. The next track shows up on the lock screen, but paused, until you open the app.
Pausing or seeking doesn't close the session. Only a natural end does.

That explains why the endless silent audio helped: something was always playing, so the session never closed. But there's a simpler way: make sure the music itself never "ends".

The fix: loop, and catch the jump back to the start

The audio element always has loop turned on. When a track reaches its end, the browser doesn't fire "ended"; it jumps back to 0:00. The player notices that jump, pauses, switches the source and plays the next track.

const audio = new Audio();
audio.loop = true; // never reaches a natural end

const isWrap = (from: number, to: number) =>
  playedPastStart && !recentManualSeek() &&
  from > 3 && to < 1.5 && from - to > 2;

audio.addEventListener('seeking', () => {
  if (isWrap(lastTime, audio.currentTime)) playNext();
});

A few things made it reliable:

Seeks I make myself are marked, so dragging the progress bar back to the start isn't mistaken for the end of a track.
Pause first, then change the source. Pausing doesn't close the session.
Switch within the same event, not in a timer, because background timers get delayed.
Download the next track early, while the current one plays, so the switch is instant with no gap.
Tell iOS this is a music app by setting the audio session type to playback, where the browser supports it.

Why the buttons skipped 10 seconds

The second problem: I had registered previous and next, but the Dynamic Island showed buttons that skip 10 seconds back and forward instead.

iOS ignores Media Session handlers that are registered before the audio element becomes "Now Playing".
Without valid previous and next handlers, it falls back to the 10-second skip buttons.
My rewrite registered everything once when the app opened, before any sound. That's why the old "register again after play" trick had worked: the timing was right by accident.

The fix is to register the handlers again on every playing event, which costs almost nothing, and to clear the seek buttons explicitly:

audio.addEventListener('playing', () => {
  const ms = navigator.mediaSession;
  ms.setActionHandler('previoustrack', previous);
  ms.setActionHandler('nexttrack', next);
  // otherwise iOS adds ±10s and hides previous/next
  ms.setActionHandler('seekbackward', null);
  ms.setActionHandler('seekforward', null);
});

What changed

On a locked iPhone, one track ends and the next one starts, every time.
The lock screen and Dynamic Island show previous and next.
I know why it works, so changing the player no longer breaks it.

A small testing tip: you don't have to wait for a whole song. Lock the phone and drag the progress bar to the last few seconds. Still, listen through at least once at the end, since that's closest to real use.

One caveat: what I described about WebKit comes from bug reports and other developers' analysis, not from Apple's documentation, so a future iOS version could change it.

Shipping my Chrome extension on merge, with no stored secrets

Andy Yeung — Sat, 17 Oct 2026 11:43:51 +0000

I maintain a small Chrome extension that translates text with Chrome's built-in AI. It doesn't have many users, but I update it now and then, and every update meant the same routine: bump the version, write the changelog, build, zip, sign in to the store dashboard, upload and submit. None of it was hard. It was just easy to get wrong, like the time I forgot the version number and the store refused the upload.

What I didn't want

Most guides for automating this put a long-lived credential in your CI secrets, either a service account key or an OAuth refresh token. That works, but it means a key that never expires sits next to your code. If it leaks, anyone can publish as you.

I wanted the automation without a key to lose.

How it works now

Step by step

1. Let the commits decide the version. I write commit messages in the Conventional Commits style. A new feature bumps the minor version, a fix bumps the patch and docs or chores don't release at all. A release tool reads them, updates the manifest and changelog, and tags the release.

2. Always keep a zip. Every release builds the extension and attaches the zip to a GitHub release, so there's always something to upload by hand if the store step ever fails.

3. Create an identity that can't do much. In Google Cloud I created a service account with no roles at all. Its only power comes from being added as a member of my publisher account in the Chrome Web Store dashboard.

4. Trust GitHub instead of a key. Workload Identity Federation lets a GitHub Actions run show Google a short-lived proof of which repository it comes from. Google checks that it's my repository and, only then, gives it a token for the service account that lasts 15 minutes. I restricted it to one repository, so forks and other projects can't use it.

5. Connect the store. In the dashboard's Settings, I added the service account and copied my publisher ID. (Older guides send you to an Account page that no longer exists.)

6. Keep a human in the loop. The upload runs in a protected GitHub environment with me as the required reviewer. Every store submission stops and waits until I press Approve. The store job starts like this:

permissions:
  contents: read
  id-token: write # lets the run ask GitHub who it is
environment: chrome-web-store # waits for my approval
steps:
  - uses: google-github-actions/auth@v3
    with:
      workload_identity_provider: ${{ vars.GCP_WORKLOAD_IDENTITY_PROVIDER }}
      service_account: ${{ vars.GCP_SERVICE_ACCOUNT }}
      token_format: access_token
      access_token_scopes: https://www.googleapis.com/auth/chromewebstore

7. Test without changing anything. The workflow has a read-only status mode that just asks the store what's published. When it answered with my current version, I knew the whole chain worked.

A few things that tripped me up

Two Google APIs need to be on besides the Chrome Web Store API: the one that issues service account tokens and the token exchange service.
The workflow needs permission to request GitHub's identity token. Without it, there's nothing to exchange.
I fill in all the settings at once. My workflow treats the extension ID as the sign that the store is set up, so setting it alone would make the next release try to upload and fail.
The store only accepts a higher version than the one it has, so re-running an old release fails on purpose.

What changed

Releasing is one click. I merge, wait for the notification and approve.
Versions and changelogs write themselves from the commit messages.
There's no key to leak. Each run gets a token that expires in 15 minutes, and only my repository can get one.
I still decide. Nothing reaches the store without my approval, and removing the service account from the dashboard cuts it off instantly.

Google's review still takes its time, and the listing text and screenshots still live in the dashboard. But shipping a fix no longer needs a free evening.

Use it with your own extension

If you'd like the same setup, paste this into an AI coding assistant inside your extension's repository:

Set up automatic publishing for my Chrome extension in this repository, using this design:

1. Versioning: use Conventional Commits with release-it (or the closest tool for this stack).
   feat bumps minor, fix bumps patch, docs/chore don't release. On every push to main it
   bumps manifest.json, updates CHANGELOG.md, commits, tags and creates a GitHub Release
   with the zipped build attached.
2. Store upload: a reusable GitHub Actions workflow that calls the Chrome Web Store API v2
   (upload, wait for processing, then publish) with a small script. Support three modes:
   status (read-only), upload (draft only) and publish. Refuse to upload a version that
   isn't higher than the one in the store.
3. Credentials: no long-lived secrets. Use Google Workload Identity Federation with
   google-github-actions/auth, permissions id-token: write, token_format access_token and
   the chromewebstore scope. The service account gets no IAM roles; restrict the WIF
   provider with an attribute condition to this repository only.
4. Safety: run the store job in a GitHub Environment named chrome-web-store with me as a
   required reviewer. Read all IDs from repository variables (not secrets):
   GCP_WORKLOAD_IDENTITY_PROVIDER, GCP_SERVICE_ACCOUNT, CWS_PUBLISHER_ID, CWS_EXTENSION_ID.
   Skip the store job (don't fail) until all four are set.
5. Docs: write docs/PUBLISHING.md with the one-time setup: the gcloud commands for Cloud
   Shell (enable iamcredentials, sts and chromewebstore APIs, create the pool and provider,
   bind roles/iam.workloadIdentityUser), adding the service account under Settings in the
   Chrome Web Store Developer Dashboard, where to find the Publisher ID, and how to test
   with the status mode.

Don't ask me for any secret. Tell me which steps need me in a browser, and stop after
writing the code and docs so I can review them.

Cover: Free carton boxes factory photo by Unknown, CC0 1.0.

My music app no longer needs my computer on

Andy Yeung — Fri, 16 Oct 2026 07:35:20 +0000

I have a small music app that I built for myself. It's a PWA that plays the tracks I've collected, with the audio stored in the cloud and a simple library on top. Playing music was never the hard part. Adding a track was. Each new track needs a slow job: fetch it, convert it, upload it, then add it to the library.

The old setup: the app called my computer

That slow job ran on my home computer. A small API server sat on it, exposed to the internet through a tunnel, and the app called it directly whenever I added a track.

It worked, but it had some real problems:

The computer had to be on. If it was off, adding a track just failed, and I had to try again once I was home.
There was a server open to the internet. It was a server on my home network that I had to keep locked down.
The progress bar was fake. The app only knew the request had been sent. The rest was an animation.
Errors disappeared. When an upload credential expired, uploads failed quietly for a while. The only sign was a line in a console nobody was watching.

The new setup: the database is the queue

The fix came down to one change: the app no longer calls the worker. It writes a job into a table, and the worker comes to collect it.

The worker only makes outgoing connections, to the database and to storage. No tunnel, and nothing open to the internet.
If the computer is off, jobs simply wait in the table. When it's back on, the worker picks them up one by one.
As it works, the worker writes its progress back into the job, and the app shows it live. The progress bar is real now.
The worker also checks in regularly, so the app can show whether the worker is online.

Postgres already has what you need to hand out jobs safely: a worker can claim the next waiting job in a way that no other worker can claim it at the same time. If a worker dies halfway through, the job is released after a while and tried again, a few times at most, before it's marked as failed with a Retry button in the app. No Redis or separate queue service, and the free tier of my database covers it.

A queue is something people can write to

Moving the work into a table brings up a new question: who is allowed to write to it? Whatever lands in the table, the worker will do. So:

Only approved accounts can add jobs, and only for themselves.
Every job is validated twice: by the database when it's inserted, and again by the worker before it runs. Only the kind of link the app expects is accepted. Without that, a job could ask the worker to fetch an address on my home network.
A job can only touch the person's own library, even though the worker itself has broader permissions.

What changed

My computer can be off. It used to mean "the app is broken". Now it just means "new tracks show up a bit later".
Nothing is open to the internet. The worker only reaches out.
Progress and errors are real. If something fails, the reason shows up in the app, with a Retry button.
No new services. The database I already had does the job.

Using a database as a queue isn't a new idea. For a small personal project that you only use now and then, though, it's just enough: it turned "my computer must always be on" from a hard requirement into something I don't have to think about.

Cover: Old vinyl records lined shelf by Unknown, CC0 1.0.

I kept losing my Claude artifacts, so I made a mod

Andy Yeung — Thu, 15 Oct 2026 03:40:35 +0000

A lot of what I make with Claude now ends up as an artifact: a page or a doc that lives on claude.ai instead of in the chat. That includes quotes for Aori Creative clients, a pricing sheet, a security overview of my CMS, a script for a YouTube video I'm planning and notes on a side project's recommendation algorithm. They're useful, and I come back to them.

Or I try to. Finding them again was the hard part.

A gallery that only grows

Artifacts land in one long list, newest first. That's fine for the first few. For me, after a couple of weeks, a client quote sat next to a video script, which sat next to an internal security note, and half the titles only made sense on the day I made them.

The chat a page came from was usually closed by then, so there was no easy way back to it. I'd scroll, open the wrong one, scroll again, and sometimes just ask Claude to make the thing again.

First, some order

The quick fix was to tidy what I already had:

Categories in the title. Every artifact got a short prefix: company, clients, YouTube or side projects. The gallery is still one list, but now I can scan it.
A catalogue in Notion. One database with the title, category, a one-line summary and a link. That's where I go when I want to search or sort.
An index page. One more artifact, pinned to the sidebar, that lists everything by category with a search box. Its entries live in the artifact's own small database, so adding an entry doesn't mean republishing the page.

That cleaned up the past. But it only stays clean if every new artifact gets filed too, and I knew I'd forget.

Then, a mod that asks at the right moment

Claude Code lets you write mods: small modules that hook into what Claude does and can draw a little UI next to the prompt. That was the right place for this. The moment to file an artifact is right after it's made, while I still remember what it's for.

So now, when Claude publishes a new artifact, a row appears above the prompt once Claude is done:

New artifact "Q3 pricing review" — add it to your catalogue? [Add] [Skip]

Press Add, and Claude picks a category from my list, writes a one-line summary, adds it to the Notion database and the index page, and renames it with the category prefix. Press Skip, and the row goes away.

A few details mattered more than I expected:

It only asks about new artifacts. Updating a page or fixing a typo doesn't count, and the index page never asks to file itself.
It waits. The row only shows up when Claude isn't busy, so it never interrupts a task halfway through.
It speaks my language. My copy asks in Traditional Chinese, and it also comes in English, Simplified Chinese, Japanese and Korean.

Sharing it

Once it worked for me, it seemed silly to keep it to myself. So I made it generic: Notion is optional, the categories are yours, and there's an index page template you can publish as is. It's open source on GitHub, and installing it is one line at the Claude Code prompt:

/plugin install artifact-catalog --marketplace amsyeung/artifact-catalog

Leave everything empty, and the first time you press Add, Claude will ask where you'd like things filed.

What changed

I find things again. Pinned index, by category, with search. No more scrolling.
Nothing piles up. Filing takes one press, at the moment I still remember what the artifact is for.
The titles make sense. Even in the plain gallery list.

It's a small tool for a small annoyance. But I use Claude every day, and this was the kind of friction that adds up. Small fixes like this are often the ones I end up using the most.

Cover: Wooden Card Catalog Furniture by MarkBuckawicki, CC0 1.0.

Why I moved my portfolio off Notion and Contentful

Andy Yeung — Tue, 13 Oct 2026 16:58:26 +0000

My portfolio, amsyn.org, is two things: a blog and a photo gallery. Until recently, I wrote the blog in Notion and kept the gallery in Contentful. Both made sense when I set them up, and both still worked. But over time the site got slower, messier and harder to change, so this month I took them both out.

My blog lived somewhere else

I like writing in Notion, and the editor is great. To get posts onto the site, I forked an old notion-parse project, kept it working with the current Notion API, and added a Next.js MDX mode. It's on npm as @amsyn/notion-parse, and I'll keep maintaining it.

Every time I edited a post, a webhook kicked off a full rebuild that pulled everything from Notion and converted it to MDX. It worked, but it was fragile. My articles only existed inside that build step, a typo fix meant rebuilding the whole site, and when the sync failed quietly, the site could ship without its articles.

A CMS I was only using as a database

The gallery's photos were always in my own storage. Contentful only held the details: title, camera, lens, tags and albums. I had also built my own upload screen, so I never used Contentful's editor, which is the main reason you'd pick a headless CMS in the first place.

That left me fighting its limits without getting its benefits. Every photo page asked Contentful for data while the visitor waited, and the images were resized on the fly from full-size camera files. That's why the gallery always felt a little slow to load.

AI tags I couldn't manage

When I first imported my photos, I let a vision model write the tags and albums. It felt clever. A few hundred photos later, I had Cityscape, Cityscapes and CityScapes as three different albums, and so many tags that the filters had stopped filtering anything. The model also had a habit of guessing locations: plenty of my European photos were apparently taken in Mong Kok.

The model wasn't the problem. Letting it invent its own labels was.

The fixes

A short, fixed list of tags. The site now has one list of allowed tags: subjects like street, mountains or food, and conditions like golden hour or snow. Every photo was re-tagged against that list. Any AI tagging from now on can only pick from it, never add to it. Albums are now trips I name myself, and a location only appears when I actually know it.

The gallery became plain data. All the photo details now sit in one file in the site's code and are read when the site is built. No CMS and no live queries. Every gallery page is generated ahead of time, and each photo is resized once into a few web-friendly sizes and served from a CDN. Location data is stripped from the images, which I should have been doing all along.

The blog moved to my own CMS. Rather than swap Notion for yet another service, I moved the blog into a small CMS I built myself. It didn't have a field for long-form writing, so I added a Markdown one, and this post is the first one written in it. When I hit publish, only the blog refreshes, not the whole site.

Write once, publish in a few places. The site has an RSS feed with full articles, and new posts are cross-posted automatically with a link back to the original here. If you're reading this somewhere else, that's how it got there.

What changed

The gallery is faster. Pages are ready before anyone asks for them, and images are already the right size.
The filters are useful again. A handful of tags you can actually browse by, instead of hundreds of near-duplicates.
Writing is simpler. I write in my own CMS, preview the draft on the real site, publish, and that's it.
Fewer moving parts. Two services gone, and less for me to keep alive.

The lesson I keep relearning: pick tools for how you actually use them, not for what they can do. Next up is a full redesign of the site, and I'll write about that when it's done.

DEV Community: Andy Yeung

Why Windows wouldn't let me rename a folder I wasn't using

Background

What I tried

Why Windows locks things

The tool that answers the question: File Locksmith

If you can't install PowerToys

Mistakes I made

What improved

My first day with ComfyUI: from a selfie to a 20-second aquarium shot

Background

What I tried

How I did it

1. The first frame decides everything

2. Describe what's already in the frame first

3. Control the camera with words

4. For 20 seconds, move the camera instead of cutting

Things that bit me

What improved

Let AI apply it for you

A one-click ComfyUI + Nuke installer for a friend in VFX

Background

What I tried

How it works

1. Everything in one folder

2. Versions pinned in one list

3. Updates one by one, with a restore point first

4. Only one marked block in menu.py

5. Logs, a change list and "Doctor"

Things that bit me

What improved

Let AI apply it for you

Free AI for my Chrome extension's users, with no API key and no surprise bill

The problem: I wanted the extension to see what I'm working on

What I tried

Why Cloudflare Workers AI

How I applied it

1. The Worker does two things

2. Send only what's needed

3. Only my extension gets an answer

4. A model that's good at Chinese and cheap

5. Off by default, and clear about what's sent

Things that tripped me up

One more small trick: telling your changes from the extension's

What improved

Let an AI set it up for you

Getting my iPhone music app to keep playing on the lock screen

What I tried first

Why the next track never started

The fix: loop, and catch the jump back to the start

Why the buttons skipped 10 seconds

What changed

Further reading

Shipping my Chrome extension on merge, with no stored secrets

What I didn't want

How it works now

Step by step

A few things that tripped me up

What changed

Use it with your own extension

My music app no longer needs my computer on

The old setup: the app called my computer

The new setup: the database is the queue

A queue is something people can write to

What changed

I kept losing my Claude artifacts, so I made a mod

A gallery that only grows

First, some order

Then, a mod that asks at the right moment

Sharing it

What changed

Why I moved my portfolio off Notion and Contentful

My blog lived somewhere else

A CMS I was only using as a database

AI tags I couldn't manage

The fixes

What changed

4. Only one marked block in `menu.py`