DEV Community: Jason Guo

I built an old-photo colorizer on Cloudflare Workers + fal.ai: what worked and what bit me

Jason Guo — Thu, 01 Oct 2026 14:26:23 +0000

Disclosure: I'm the maker of the site below.

I recently launched Colorize Old Photos, a small web app that colorizes black and white photos and repairs scratches, creases and fading. You get a free watermarked preview; full-resolution downloads use one-time credit packs (no subscription). This post is a short write-up of the stack and the things that surprised me.

Stack

Next.js 16 (App Router) deployed to Cloudflare Workers with OpenNext
D1 for accounts, credits, jobs and rate limits; R2 for uploads and results (1-day lifecycle rule)
Cloudflare Images binding for the watermarked 720px preview
fal.ai for the models: fal-ai/ddcolor for colorizing, fal-ai/nano-banana-2/edit at 2K for restoration
PayPal Orders v2 + webhook for payments, Google OAuth and email magic links for login

1. Workers can't wait for a slow model

A cold DDColor start on fal can take about 90 seconds, and a Worker request can't just sit there. I ended up with a poll-driven job flow: the client submits, the server stores the job and returns an id, and each poll asks fal for the status and advances the job. No background task has to outlive the request.

2. Models: the cheap ones didn't fix damage

I tested a damaged copy of a public-domain Library of Congress photo. The "standard" tier (CodeFormer + DDColor) colorizes fine but doesn't remove scratches or creases, and CodeFormer smooths faces. An image-editing model (nano-banana-2) was the only option that both cleaned the damage and stayed faithful to the original. So colorize-only uses DDColor, and anything involving restoration uses the editing model.

3. "Deleted within 24 hours" wasn't true until I set a header

My privacy page promised uploads are deleted within 24 hours. R2 handled my copy, but fal keeps generated media indefinitely unless each request sets an object lifecycle preference header. I now send X-Fal-Object-Lifecycle-Preference with a 3600 second expiry on every submit and verified that the file really stops being served. If you promise deletion, check your providers' copies too.

4. Free previews need a hard cost cap

Anyone can upload a photo for a free preview, so I added a daily USD budget cap, per-IP, per-subnet and per-device rate limits (fixed windows in D1), Turnstile, and an upload moderation step. It's cheap insurance against someone scripting the free tier.

5. Small things

Cloudflare Images can't decode HEIC, so iPhone photos are converted client-side first.
NEXT_PUBLIC_* variables must be build variables on Workers Builds, not runtime ones.
Dashboard-only vars get wiped by wrangler deploy unless you set keep_vars: true.

If you try it, I'd genuinely like feedback on the before/after quality, especially faces: colorizeoldphotos.com. Happy to answer questions about any part of the stack.

AI Governance Moves to Courts, Tests, and Public Infrastructure | WindFlash Daily

Jason Guo — Sat, 26 Sep 2026 07:07:52 +0000

On September 25, a U.S. appeals court upheld the Pentagon’s decision to designate Anthropic a supply-chain risk. The 2–1 ruling makes a company’s limits on how its model may be used part of a live procurement dispute. In a different setting, Microsoft has packaged agent threat discovery, policy generation, and repeat testing into one open-source workflow; its published billing-agent example reduced a measured disclosure rate from 30% to 5.9%, though the test was small and company-run.

These developments put a practical question ahead of the usual capability race: who defines an AI system’s boundaries, and how can those limits be checked? A new paper finds that most of the tested coding-agent harnesses let agents delete their own logs. Meanwhile, the Dutch DAWO community is building a government workplace from inspectable, replaceable components rather than a single vendor product. Courts, independent records, repeatable tests, and public infrastructure are different answers to the same trust problem.

The engineering underneath still matters. Go’s experimental portable SIMD interface aims to make vectorized code easier to carry across processor families, and AWS reports a 40% increase in rollout throughput for one distributed reinforcement-learning setup. But Oracle’s New Mexico data-center project shows that planned compute is not usable compute: power and permitting delays can become financing obligations before servers ever run. Together, the stories point to a less glamorous measure of AI progress—whether its systems can be governed, verified, and supplied with dependable infrastructure.
Windflash AI Daily

Cheaper Frontier Models, Bigger Stakes for AI's Next Phase | WindFlash Daily

Jason Guo — Wed, 23 Sep 2026 08:46:31 +0000

The newest model releases are making frontier capability cheaper at the same time that companies and governments are being asked to account for how it is built and used. OpenAI’s GPT-6 Sol and Luna put sharply different API prices on the table; Anthropic says Opus 5.5 matches Fable 5.1 on most work at 40% lower run cost. Those claims are not directly comparable, but they show cost becoming a headline feature alongside intelligence.

That price pressure meets a much larger infrastructure bet. Alibaba has announced a domestic accelerator and a plan for a five-to-ten-trillion-parameter model, while Google and the Gates Foundation are proposing a different kind of scale: climate and crop support for 200 million smallholder farmers. One is a compute race; the other asks whether AI services can reach people for whom data and local conditions matter more than leaderboard rank.

The discussion around agents adds a practical layer. OpenAI’s managed agent sessions and sandboxes make it easier to hand a system files and tools, but also make permissions, network access, and secret handling part of the product design. Anthropic’s account of AI contributing to R&D suggests that this delegation is reaching model development itself. That is supervised assistance, not autonomous self-improvement, and the distinction matters when evaluating the evidence.

Governance is moving into the same frame. OpenAI has begun a more systematic process for publishing misalignment cases, and the UN Security Council is convening company leaders and researchers to discuss AI and international security. Neither step settles what safe deployment requires. Together, however, they show a shift: the question is no longer only how much capability a model has, but who can afford to use it, what infrastructure supports it, and what evidence exists when systems act beyond the chat window.

https://windflash.us/daily-report/en/2026-09-23

Heart Machine Gutted | Build a Rocket Boy Nears Closure | Nex Raises $150M

Jason Guo — Fri, 18 Sep 2026 06:13:40 +0000

The sharpest contrast today is not between success and failure. It is between projects that must keep asking permission to exist and products that can prove a repeatable route to customers. Heart Machine lost its next game when one publisher changed its mind. Build a Rocket Boy appears to have run out of road after MindsEye failed to stabilize. Both stories show how quickly a studio disappears when its production plan depends on one oversized bet and one outside decision.

Nex occupies the other side of the market. Its pitch is easy to measure: a small camera-based box, family movement, licensed games, retail distribution, and a subscription. More than one million units sold gives investors a visible path from capital to expansion. The Drop Circuit is smaller, but it follows the same logic. Five experienced developers are building inside Fortnite, where the audience, tools, payments, and discovery system already exist. They traded some control for a shorter route to market.

That does not mean every studio should become a hardware company or a UGC vendor. It means financing is rewarding distribution certainty more aggressively than creative pedigree. The EU KIDS Act adds another pressure: platforms that own the audience will also carry more responsibility for age checks, spending traps, contact systems, and addictive design. The safest place to build may be inside a platform, but the platform's rules are becoming product architecture. Independent studios need more than a good game. They need several ways to reach players, several ways to finance the next milestone, and a plan that survives one partner saying no.
Game Daily

When exactly will Grok 4.7 be released?

Jason Guo — Thu, 17 Sep 2026 04:45:29 +0000

Grok 4.7 still isn't out. Here's a simple math read on when it might land.

All the dates below are from Elon Musk on X, not from xAI's own docs. As of Sep 17, docs.x.ai still lists Grok 4.6 as the latest flagship.

The public targets moved like this:
• Jul 24: "in 4 weeks" → about Aug 21
• Aug 12: "3 to 4 weeks" → about Sep 2–9
• Sep 2: "in 10 days" → about Sep 12
• Sep 11: "a few more days" → about Sep 14–16

Against the first hard target (Aug 21), we are already ~27 days late — almost one full original promise window. Against the last hard target (Sep 12), elapsed time is 1.5× the promised 10 days.

Prior Grok slips give useful multipliers:
• Grok 4.5: first promise window ~40 days, actual ~89 → ~2.2×
• Grok 4.6: promised 14 days, actual 19 → ~1.36×

Apply those to 4.7:
• Optimistic (4.6-like): around Sep 16–17 — basically now
• Mid (1.5× from the Sep 2 clock): around Sep 17
• Pessimistic (4.5-like from Jul 24): around Sep 24

The successive targets also compressed: Aug 21 → early September → Sep 12 → "a few days." Jump sizes roughly halved each time. That pattern, plus Musk's Sep 11 note that RL may have over-penalized response length (model quits hard tasks early, weak self-check), points to a short remaining window — not a multi-month redo — unless the fix is deeper than he framed it.

My read:
• P50: Sep 20–22
• P75: Sep 24–26
• P90: early October if RL needs a real retrain

On Sep 14 he was still talking about 4.7 as the near-term model (roughly Opus 5.0 class), with 4.8 next. So this does not look cancelled — just late. Until a model page shows up on docs.x.ai, treat every date as aspirational.

Z.ai delayed GLM-5.3's open weights after cyber tests Z.ai delayed GLM-5.3's open weights after its own cyber tests. The AI race is shifting from the model to the control layer around it. https://windflash.us/daily-report/en/2026-08-15

Jason Guo — Sat, 15 Aug 2026 14:10:01 +0000

AI Daily Report: The Control Layer Becomes the Product (Aug 15, 2026)

Cyber capability, agent harnesses, provenance, inference, and governance are converging into AI’s new control layer.

windflash.us

In the Age of AI, Human Writing Is Scarce — and That Makes It Worth More

Jason Guo — Sun, 09 Aug 2026 08:39:17 +0000

Everyone can now generate a thousand words in a second. So why does good writing feel rarer than ever?

Because AI made text cheap, but it made thinking expensive. Anyone can produce fluent paragraphs on demand. What's scarce is the writer behind them — the one with a real point of view, a clear argument, and the discipline to say something true. In a world flooded with generated content, the human ability to write well is no longer a nice-to-have. It's a competitive edge.

So how do you actually build that skill? A few things that work:

Write before you prompt. Draft your own rough version first, then use AI to critique or sharpen it — not to replace the thinking. The struggle to find the words is where the skill grows.
Read like a writer. Notice how the pieces you admire are structured: how they open, how they transition, how they land. Steal the patterns, not the sentences.
Ship in public. Publishing forces clarity in a way private notes never will. A post with real readers raises your standards fast.
Practice on a schedule. Writing is a muscle. Small, frequent reps beat occasional marathons.

I've been building on this idea myself. I made WriteFit — a tool to help people practice and improve their writing consistently, so the habit sticks and the skill compounds.

If you're thinking about your own writing in the AI era, I'd love to hear how you're approaching it. What's helped you the most?

On August 5, Sundar Pichai told Google staff that Demis Hassabis would become Chair of Google DeepMind and Chief Scientist of Alphabet, that Koray Kavukcuoglu would take day-to-day control of DeepMind as SVP, and that Jeff Dean was leaving after 27 years.

Jason Guo — Fri, 07 Aug 2026 17:24:15 +0000

I Built a Tools Website for Geometry Dash Players — Here's What I Learned published: false

Jason Guo — Tue, 04 Aug 2026 17:34:09 +0000

If you've ever played Geometry Dash, you know the struggle. You want to beat your first demon, but which one? You want to unlock the Vault of Secrets, but you're missing 12 diamonds and can't remember where to farm them. Your screen goes black mid-level and you don't know why. All this information exists — scattered across wikis, Reddit threads, and YouTube comments in six different languages.

I got tired of tab-switching between five resources just to pick my next level. So I built GD Level Tools — a single site that brings the most-needed tools and guides together under one roof.

What I Built

The site has six interactive tools and seventeen in-depth guides, all designed around real questions Geometry Dash players actually ask:

1. Level Finder

A filterable catalog of 30 curated demon levels. You can filter by:

Difficulty (Auto → Extreme Demon)
Length (Tiny → XL → Platformer)
Skill tags (Wave, Ship, Cube, Timing, Memory, UFO, Ball, Robot, Spider, Mobile-friendly)
Sort by beginner score, mobile score, or name

Each level has its own detail page with a gameplay video, review, skill tags, tips, "who should play / who should skip" sections, and recommended next levels.

2. First Demon Picker

This is the one I'm most proud of. It's a 7-question interactive questionnaire that recommends your ideal first demon based on:

Your platform (PC / Mobile / Both)
Your strongest and weakest skills
Preferred level length
Memory tolerance
Visual decoration preference
Your main goal (just clear it? build skills? have fun?)

The recommendation engine scores each candidate demon against your answers and ranks them by match percentage. Each result comes with a "why it fits" explanation, a "what to watch for" warning, and a practice tip.

No more asking "what should my first demon be?" on Reddit and getting 40 different answers.

3. Demon Progression Planner

Enter how many demons you've beaten, and it tells you exactly where you are on an 8-stage ladder from "First Demon" to "Extreme Demon" — with recommended next levels for your current stage and a full roadmap showing the entire journey.

The stages:

Stage	Demon Count	Example Levels
1. First Demon	0	The Nightmare, The Lightning Road
2. Beginner Easy	1–5	Platinum Adventure, Demon Park
3. Standard Easy	6–15	Shiver, Speed Racer
4. Early Medium	16–30	B, Problematic
5. Medium	31–50	Nine Circles
6. Hard	51–80	Jawbreaker
7. Insane	81–120	Supersonic, Windy Landscape
8. Extreme	120+	Pointercrate Top 150

4. Vault Codes

63 secret codes across all four in-game vaults (The Vault, Vault of Secrets, Chamber of Time, and the new 2.2 Wraith Vault) — searchable, with unlock requirements and what each code gives you.

I was careful to label these as "in-game secret codes, not cheats." They're official codes put in the game by the developer, not exploits.

5. Guides

Seventeen guides across six categories:

Rewards (6): Diamonds, Gold Keys, Demon Keys, User Coins, Master Emblem, Moons
Mods (4): Geode installation, Geode troubleshooting, FPS unlock, TPS explained
Fixes (4): Screen going dark, screen tearing, can't play levels, V-Sync
General (4): All icons, star grinding, 2.2 update, level creation
Skills (1): Practice mode
Demons (2): Best easy demons for beginners, Extreme Demon List 2026

Each guide has step-by-step instructions, FAQ sections, and related guide links.

Why I Built It

Three reasons, in order of importance:

1. The information was scattered

Want to know what your first demon should be? Check the wiki. Want to know if it's mobile-friendly? Check a Reddit thread. Want a gameplay video? Search YouTube. Want to know what to play next? Ask on Discord and hope someone responds.

I wanted one page that answers all of these questions for each level.

2. Existing resources don't account for personal preference

Most "best first demon" lists are just ranked by difficulty. But a level that's easy on PC might be brutal on mobile. A level that's great for wave players might be miserable for ship players. The First Demon Picker accounts for your skills, platform, and preferences — not just a generic difficulty ranking.

3. I wanted to build something with real users

Not a todo app. Not a weather dashboard. A site that solves a problem I personally have, for a community I'm part of. That meant I actually cared about the content quality, the UX, and whether the recommendations were good — because I'd be using it myself.

Tech Stack

Layer	Choice	Why
Framework	Next.js 16 (App Router)	SSR/SSG, file-based routing, metadata API
Language	TypeScript	Type safety for the level data model
Styling	Tailwind CSS + CSS variables	Game-themed dark neon design system
Deployment	Cloudflare Workers	Edge network, generous free tier
Analytics	Google Analytics 4	With Consent Mode v2 for GDPR
SEO	JSON-LD structured data	WebSite, Organization, Article, FAQ, Breadcrumb schemas

The site is 71 static pages — every level, guide, and fix page is pre-rendered at build time. No database, no CMS. All content lives in TypeScript data files, which means:

Zero runtime cost (static files on a CDN)
Type-safe content (can't publish a guide with a missing field)
Git is the CMS (every content change is a commit with history)

A Few Things I Learned

Recommendation engines are harder than they look

The First Demon Picker looks simple — answer 7 questions, get recommendations. But designing the scoring logic took multiple iterations. Early versions recommended the same 3 levels to everyone because the "beginner-friendly" signal overwhelmed everything else.

The fix was weighting by question importance. Your strongest skill matters more than your visual decoration preference. Your platform matters more than your preferred length. Getting these weights right required testing with real players and adjusting.

SEO for a fan site is different from SEO for a SaaS

Most SEO advice online is about building topical authority through blog content. But for a tools site, the SEO play is different:

Tool pages target high-intent keywords ("first demon picker", "geometry dash vault codes")
Guide pages target informational keywords ("how to get diamonds in geometry dash")
Level pages target specific level names ("the nightmare geometry dash")

Each page type needs different structured data. Level pages get Article + FAQPage schemas. The homepage gets WebSite + Organization. Guide listings get ItemList. I built helper functions in src/lib/seo.ts to keep this consistent.

GDPR consent doesn't have to be heavy

I added a cookie consent banner with GA4 Consent Mode v2. The key insight: default to denied, then update on consent. This means:

Page loads → consent is denied (set before gtag.js loads)
User clicks "Accept" → gtag('consent', 'update', { analytics_storage: 'granted' })
User clicks "Decline" → stays denied, but GA4 still sends cookieless pings

Even declined users show up in aggregate analytics. You don't lose all your data by being compliant.

Cloudflare Workers + Next.js is a great combo

The site deploys as a Cloudflare Worker via @opennextjs/cloudflare. Build output is a single Worker that serves 71 static pages from the edge. Cold starts are non-existent. The free tier covers my traffic with room to spare.

The one gotcha: Workers have a 1MB compressed bundle limit on the free plan. I had to be mindful of bundle size, which meant no heavy client-side libraries. All interactivity is vanilla React state — no charting libs, no animation libs, no UI component kits.

What's Next

More levels: The catalog has 30 levels now. The goal is 100+ covering every difficulty tier.
Community submissions: There's a level submission form, but submissions are reviewed manually. I'm considering a moderation workflow.
Versus mode guide: Geometry Dash 2.21 is coming with a competitive mode. That's a whole new content area.
AdSense: The site is structured for AdSense approval (original content, privacy policy, terms, DMCA). Once traffic justifies it, ads will help cover the domain + Workers costs.

Try It

The site is live at geometrydashlevel.com. It's a fan-made project, not affiliated with RobTop Games — I put a disclaimer in the footer and on every relevant page to make that clear.

If you play Geometry Dash, I'd love to hear what you think. What's missing? What tool would you add? What level should I review next?

This is an independent fan site. Geometry Dash is a trademark of RobTop Games. All content is created by fans, for fans.

Kimi K3 demand forced Moonshot to pause new subscriptions, while Qwen 3.8 reignited the open-weight AI race. The real competition is shifting from model size to reliable delivery. https://windflash.us/daily-report/en/2026-07-20

Jason Guo — Mon, 20 Jul 2026 09:46:30 +0000

AI Daily Report: Kimi K3 Demand, Qwen 3.8 and the Open-Weight Surge (Jul 20, 2026)

Kimi K3 strains GPU capacity as Qwen 3.8 draws intense developer debate, while Codex and Claude Code changes expose the infrastructure behind AI tools.

windflash.us

https://windflash.us/daily-report/en/2026-07-19

Jason Guo — Sun, 19 Jul 2026 16:10:38 +0000

Daily Report - AI intelligence for builders

Today’s strongest signal is that AI is moving from producing suggestions to taking actions, while the surrounding controls are still catching up. Reports of GPT-5.6 Sol deleting local files after being granted broad permissions illustrate the operational risk. The MCP, A2A, and ACP overview shows the other side of the same transition: developers are standardizing how agents reach tools and delegate work. These protocols can make useful automation easier, but every additional connection also expands the surface that needs permissions, logs, recovery paths, and human review.

The GitHub essay on software scope offers a practical way to use this new capability without confusing speed with certainty. An agent-generated patch can act as a probe that reveals whether a request is genuinely small, yet the low cost of producing code does not remove the cost of maintaining it. That distinction is especially important when agents can modify files or execute commands. Fast drafts are valuable evidence; they should not automatically become trusted changes.

The same accountability question appears beyond coding. TP-Link’s long-running GPS exposure shows how narrow fixes can leave a wider system vulnerable. Riemann-1.0 moves learned action into robotics, while DeepMind and Isomorphic Labs are applying AI to biological monitoring and threat response. These systems operate in very different domains, but they share a requirement: autonomy must be paired with containment, traceability, and a clear way for people to stop or reverse consequential actions. The useful engineering priority is therefore not maximum autonomy. It is dependable control over increasingly capable systems.

Kimi K3 and the “State of Open Source AI 2026” report point in the same direction: open models are becoming credible choices for more production workloads, while the cost of capable inference continues to fall.

Jason Guo — Sat, 18 Jul 2026 13:20:05 +0000