DEV Community: Niroshan Dh

Check out

Niroshan Dh — Fri, 11 Sep 2026 10:22:16 +0000

Niroshan Dh

Sep 11

The Night Gemini Summoned a Choir of Ghosts in My YouTube Sidebar !! A Software Engineer’s Post-Mortem

#ai #webdev #programming #security

3 min read

The Night Gemini Summoned a Choir of Ghosts in My YouTube Sidebar !! A Software Engineer’s Post-Mortem

Niroshan Dh — Fri, 11 Sep 2026 10:14:08 +0000

It was late last night, and I was deep in the trenches of YouTube. I was watching a breakdown of statistics and AI usage trying to connect some dots between how human neural pathways process data and how we map that psychology into reinforcement learning. But the creator was spending way too much time explaining basic statistical variance. I didn’t need the 101 class :( ~ I needed the meat.

So, I opened the Gemini “Ask” side-panel in Chrome, fired off a targeted prompt, and asked it to sift through the noise.

The AI nailed it. It gave me a crisp, intelligent summarization complete with exact video timestamps. I clicked the first timestamp.

Nothing happened. 🤔

I clicked it again. Still nothing. Impatient, I rapid fired a few more clicks across different timestamps. Suddenly, it sounded like I was in a crowded auditorium. Three different instances of the same guy’s voice started overlapping, explaining different parts of the video simultaneously. The chaotic part? The main YouTube video player on the left was still paused.

I refreshed the page. The ghost voices kept talking.

As a software engineer, this is the kind of bug that makes you sit up, crack your knuckles, and open the task manager. Here is the autopsy of what actually happened, and why bridging the gap between an AI’s “brain” and a browser’s “body” is harder than it looks.

The Technical Autopsy ~ Why the UI Went Rogue🤓

When I checked Chrome’s background processes, I saw multiple hidden instances running. The root cause was a classic architectural disconnect between isolated application states.

Here is exactly what was going under the hood

The Brain/Body Disconnect

Gemini (the neural brain) parsed the context perfectly. It provided the correct timestamp payload. But the Chrome side-panel (the UI body) failed to communicate that state change to the main DOM window.

The Isolated iframe Trap

Instead of using an event listener or window.postMessage to pass the ?t=120 timecode to the parent YouTube player, the extension panicked. It treated the timestamp like a standard href link and silently opened it inside its own isolated side-panel environment effectively spinning up an invisible iframe.

The Orphaned Threads

If you come from a Java or Go background like I do, you know this pain. In Java, this is the equivalent of accidentally instantiating a brand-new object in a detached thread when you meant to update a Singleton. In Go, it’s like firing off a bunch of detached goroutines that just leak memory in the background because you lost the channel to shut them down.

The JavaScript Sandbox

Because Chrome extensions run in an isolated sandbox for security, the side-panel couldn’t natively reach into the YouTube DOM to update the video player’s state. When I spam-clicked the timestamps, I was just spawning more hidden background iframes. The main view remained completely unchanged, but the browser was rendering invisible video players over and over again.

Core Architecture Takeaways

Whether you are building full-stack JavaScript UIs, robust Spring Boot backends, or the next agentic AI interface, this glitch is a perfect reminder of a few core development realities:

State must have a single source of truth
If two components (the side-panel and the main DOM) are trying to play a video, they need a centralized state manager. Otherwise, you get phantom data.
Fail loudly, not silently
If a UI component fails to communicate with its target, it should throw a visible error. Silently spinning up hidden background frames is how memory leaks and UX nightmares are born.
Intelligence doesn’t fix bad plumbing
You can have the most advanced AI model generating flawless output, but if your API endpoints or DOM event listeners drop the payload, the user experiences a broken product.
Event bubbling is a minefield
In component-based design (like React or browser extensions), cross-origin communication requires strict event handling. If you don’t bind your clicks to the right listener, they will trigger default browser behaviors you never intended.

In the end, I had to kill the background processes manually. It was a frustrating UX moment, but a beautiful reminder (: no matter how advanced our AI gets at simulating brain neurons and psychology, it is still entirely at the mercy of some JavaScript event handlers trying to talk to an iframe.

And honestly? That’s what makes engineering so much fun. :) ……

“Note: This is a harmless UI state bug found in the wild, shared purely for educational and architectural fun.”

[Boost]

Niroshan Dh — Fri, 13 Mar 2026 00:51:40 +0000

Building a Secure, Asynchronous AI Agent Orchestrator in Java

Niroshan Dh ・ Mar 13

#ai #architecture #agentaichallenge #webdev

Building a Secure, Asynchronous AI Agent Orchestrator in Java

Niroshan Dh — Fri, 13 Mar 2026 00:51:23 +0000

When developing applications that rely on multiple AI agents, performance and security become massive challenges. AI tasks are heavy and take time. If we process them on the main application thread, the whole system freezes.

To solve this, I built AegisPipeline a lightweight, event driven Java engine. It uses a Scatter Gather architectural pattern to run AI tasks in the background safely and efficiently.

Let’s break down the main layers, the Security Gateway, the Orchestrator, the Dispatcher, and the Job Tracker, and see how they interact to process files.

1. Security & Ingestion (The Gateway)

This is the entry point for user uploads. We cannot simply trust user-provided file extensions (like .pdf or .png) because hackers can easily spoof them to upload malicious scripts.

How it works: This layer uses Apache Tika to read the file’s “magic bytes” (the raw binary signature) to determine its true MIME type.

Example: If a user uploads a file named document.pdf but it's actually an executable script, the Gateway detects the mismatch, fails fast, and rejects the payload before it ever reaches our AI agents. It also generates a random UUID for the filename to prevent Path Traversal attacks.

2. Core Orchestrator (The Brain)

Once a file is secured and stored, the Orchestrator takes over. It contains the JobManager and the WorkflowStrategy. It acts as the "traffic controller" for AI tasks.

How it works: Instead of hardcoding which AI agent processes which file, the Orchestrator looks at the validated file type and dynamically selects a strategy.
Example: If the file is a binary (application/x-binary), the Orchestrator selects the SecurityScanStrategy, which knows it needs both a VIRUS_SCANNER agent and a STATIC_ANALYZER agent.

3. Task Dispatcher (The Muscle)

The dispatcher is where the magic of asynchronous processing happens. It pushes the heavy lifting off the main application thread so the system remains fast and responsive for other users.

How it works: It uses Java’s ExecutorService (a fixed thread pool) and CompletableFuture to scatter the tasks to different AI agents simultaneously.

// We use CompletableFuture to push the heavy AI processing to a background thread.
// This frees up the main application thread to accept more user uploads.
CompletableFuture.supplyAsync(() -> {
 try {
 // The specific AI agent executes its heavy analysis here
 return agent.executeAnalysis(secureFilePath);
 } catch(Exception e) {
 System.err.println("Agent failed: " + e.getMessage());
 return 0.0; // Fail-safe return
 }
}, aiThreadPool)

4. Job Tracker (The Memory)

Because multiple AI agents are processing data at the exact same time on different threads, we need a highly secure way to store their results without data corruption.

How it works: The JobTracker acts as an in-memory database using a ConcurrentHashMap. It uses an AtomicInteger to count how many tasks have finished.
Example: When the VIRUS_SCANNER finishes, it saves its score here. Because we use atomic operations, if two agents finish at the exact same millisecond, the system still counts them perfectly.

Let’s look at an example: How all these layers work together
Here is the exact flow when a user uploads a file for AI analysis:

Client Upload -> The user uploads a file to the system.
Security Gateway -> The SecureIngestionService validates the magic bytes, assigns a safe UUID, and saves the file via the StorageProvider.
Core Orchestrator -> The JobManager finds the matching WorkflowStrategy for the file type to see which AI agents are needed.
Job Tracker -> Initializes a new job session, locking in the exact number of AI agents we expect to hear back from.
Task Dispatcher (Scatter) -> Throws the tasks into the background ExecutorService thread pool.
AI Agents -> The required agents analyze the file in parallel.
Job Tracker (Gather) -> Each agent reports its score back to the thread-safe map.
Core Orchestrator (Fusion) -> Once the final agent finishes, the WorkflowStrategy calculates a final weighted probability score and cleans up the memory.

Find it on -> GitHub

Building a Free, Private Audio Transcriber with Next.js

Niroshan Dh — Mon, 12 Jan 2026 04:34:56 +0000

Niroshan Dh

Jan 12

3 Ways to Run AI in the Browser with Next.js (No API Keys Required)

#javascript #webdev #ai #machinelearning

3 min read

No Server. No API Keys. Just AI running in your browser.

Niroshan Dh — Mon, 12 Jan 2026 04:33:42 +0000

3 Ways to Run AI in the Browser with Next.js (No API Keys Required)

Niroshan Dh ・ Jan 12

#javascript #webdev #ai #machinelearning

3 Ways to Run AI in the Browser with Next.js (No API Keys Required)

Niroshan Dh — Mon, 12 Jan 2026 04:30:43 +0000

The "API Fatigue" is Real

We are all building AI wrappers. But the standard pattern Frontend sends data to Backend → Backend hits OpenAI → Backend pays $0.03 → Frontend displays result is getting expensive. And frankly, it's boring.

What if your users could run Whisper, YOLO, or even Llama directly in their Chrome tab?

I recently built CodeCoffeeTools.com entirely around this "Client-Side AI" concept. Here is the technical breakdown of how you can do it too using Transformers.js.

How is this even possible?

You might think running a neural network in JavaScript would be agonizingly slow. It used to be. But three technologies have converged to make this viable:

ONNX Runtime: A cross-platform accelerator for machine learning models.
WebAssembly (WASM): Allows C++ code (the ONNX runtime) to run at near-native speed in the browser.
Transformers.js: A library by Hugging Face that bridges the gap, letting you use models just like you would in Python, but in JS.

The "Free" Audio Transcriber (Whisper)
Instead of paying OpenAI $0.006/minute, we use the Whisper-Tiny model.

import { pipeline } from '@xenova/transformers';
// 1. Create the pipeline (Downloads the 40MB model once)
const transcriber = await pipeline('automatic-speech-recognition', 'Xenova/whisper-tiny.en');
// 2. Transcribe
const result = await transcriber('https://example.com/my-audio.mp3');
// 3. Output
console.log(result.text); 
// Output: "Hello world, this is a test."

Note -: Always run this in a Web Worker so you don't freeze the UI while the transcription crunches numbers.

Real-Time Object Detection (YOLO)

We can run object detection (identifying "person", "car", "dog") at 60 FPS in the browser using the detr-resnet-50 model.

import { pipeline } from '@xenova/transformers';

// 1. Load the detection pipeline
const detector = await pipeline('object-detection', 'Xenova/detr-resnet-50');
// 2. Detect objects in an image
const output = await detector('my-image.jpg');
// 3. Result
console.log(output);
/* [
  { label: 'person', score: 0.99, box: { xmin: 50, ymin: 20... } },
  { label: 'bicycle', score: 0.95, box: { xmin: 120, ymin: 80... } }
] 
*/

Running a Chatbot Locally (Text Generation)
Yes, you can run LLMs in the browser. You won't run GPT-4, but you can run highly optimized models like Phi-2 or TinyLlama.

import { pipeline } from '@xenova/transformers';
const generator = await pipeline('text-generation', 'Xenova/TinyLlama-1.1B-Chat-v1.0');
const output = await generator('Write a tagline for a coffee shop:', {
  max_new_tokens: 20,
  temperature: 0.7
});
console.log(output[0].generated_text);

Note -: This requires WebGPU support for decent speed, which Transformers.js v3 (currently in alpha/beta) supports brilliantly.

Performance

Yes it's matter - "But won't this crash my user's browser?"

It can, if you aren't careful. Here is how I handled performance on CodeCoffeeTools:

1. Quantization is Key: I never use the full "float32" models. I use "quantized" (q8 or q4) versions. They are 4x smaller and run 2x faster with almost zero loss in accuracy.
2. Lazy Loading: Do NOT load the AI model when the homepage loads. Only load it when the user clicks "Start Tool."
3. Cache It: Transformers.js caches files in the browser. The first visit takes 10 seconds to download; the second visit takes 100ms.

We are moving towards a web where the server just serves the app, and the client does the thinking.
If you want to see these examples running live (and critique my code), check out CodeCoffeeTools.com. I've open-sourced the "Privacy-First" philosophy, even if the repo itself is private for now.
What should I build next? A local Background Remover or a PDF Summarizer? Let me know below!

Heee check this out..

Niroshan Dh — Thu, 01 Jan 2026 16:35:26 +0000

New update for CodeCoffeeTools! I include P2P Transfer Tool + more..

Niroshan Dh ・ Jan 1

#webdev #showdev #productivity #security

New update for CodeCoffeeTools! I include P2P Transfer Tool + more..

Niroshan Dh — Thu, 01 Jan 2026 12:08:30 +0000

Happy New Year, everyone! 🎉

I hope 2026 is off to a great start for all of you. To kick off the year, I’ve been working on a massive update for my side project, CodeCoffeeTools.
A few weeks ago, I shared CodeCoffeeTools here a collection of developer tools + ... that run 100% locally in your browser. The response was amazing, but I kept hearing one request

How do I move these secure files between my devices without using the cloud?

So, I got to work. ☕

I just pushed a major update to CodeCoffeeTools, introducing Peer-to-Peer (P2P) File Transfer, a native App Install (PWA) feature, and a bunch of new utilities.

Here is what’s new! 👇

1. P2P File Transfer (No Server Storage)

We've all been there: You have a sensitive file on your laptop that you need on your phone. You usually email it to yourself or upload it to a random cloud drive. That breaks the privacy chain.

I added a new P2P File Transfer tool that connects your devices directly.

How it works: It establishes a direct connection between your browser tabs (using WebRTC logic).
Privacy: The file streams strictly from Device A to Device B. It is never stored on my server, not even for a second.
Speed: Since it's local (if you are on the same WiFi), it's blazing fast.

2. You Can Now "Install" The App

CodeCoffeeTools is now a fully capable Progressive Web App (PWA).

Install it: Click the "Install" button (or the + icon in your address bar) to add it to your Dock (Mac) or Home Screen (iOS/Android).
Offline Capable: Many tools now work even if you lose your internet connection.
Native Feel: No more hunting through browser tabs to find your JSON validator.

3. Freshly Brewed Tools

I didn't stop at infrastructure. Based on your feedback, I’ve added several new tools to the roster:

SVG to PNG Converter: Scale and convert vectors without pixelation.
QR Code Generator: Create quick links for testing on mobile devices.
Citation Generator: (For the students out there!) Format references instantly.
Cooking & Unit Converters: Because sometimes developers bake too. 🍰

Why "Privacy-First" Still Matters

Every tool on the site still adheres to the core philosophy: Your data never leaves your device. whether you are compressing a massive image or formatting a sensitive SQL query, the processing happens in your browser's JavaScript engine, not on a backend server.

Try It Out

I’m building this as I complete my software engineering degree, and I’d love your feedback on the new P2P feature.

👉 Check it out: codecoffeetools.com

Let me know in the comments: What is the one "tiny" tool you use every day that you wish was offline-first?

I built this because I was tired of uploading my personal data to random converter sites. I'd love to hear if there are any other tools you think I should add. Thanks for checking it out!

Niroshan Dh — Mon, 15 Dec 2025 11:11:40 +0000

Niroshan Dh

Dec 15 '25

Stop Uploading Your Data! Why I Built a Privacy-First Dev Toolkit (CodeCoffeeTools)

#showdev #webdev #privacy #security

2 min read

[Boost]

Niroshan Dh — Mon, 15 Dec 2025 11:07:29 +0000

Stop Uploading Your Data! Why I Built a Privacy-First Dev Toolkit (CodeCoffeeTools)

Niroshan Dh ・ Dec 15

#webdev #showdev #privacy #security

Stop Uploading Your Data! Why I Built a Privacy-First Dev Toolkit (CodeCoffeeTools)

Niroshan Dh — Mon, 15 Dec 2025 11:04:31 +0000

The privacy problem with online tools

We've all been there. You need to convert a PDF, format some JSON, or hash a password quickly. You search for a free tool, upload your file to the first result, and then… wait.
But as a software engineer, a thought nags at the back of your mind,

Where did my files actually go?
is this server storing my data?
Did I just upload sensitive metadata to a random site? Most online tools process your data on their backend. yes. this means your files leave your device, travel across the internet, and land on a server you don't control..

The solution --> Codecoffeetools.com

I build Codecoffeetools to solve this specific problem. it is a collection of professional grade developer and office tools that run 100% locally in your browser.

Why "Privacy-First" Matters?

By leveraging modern JavaScript APIs, we can perform heavy tasks—like image compression, PDF manipulation, and encryption—right on the client side.

Zero Data Leaks - Your files literally never leave your device.
Zero Latency - No upload/download time. Results are instant.
Zero Cost - Free forever, no subscriptions.

What's Inside?

I’ve packed it with tools I use daily as a developer and student

🔒 Security:
Exif Data Remover - Clean metadata from photos before sharing.
Client-Side Password Generator - Create strong credentials without them touching a network request.
and more....
👨‍💻 Developer Tools:
JSON Formatter & Validator - Beautify messy API responses.
SQL Formatter - Clean up complex queries.
Diff Checker - Compare code snippets locally.
and more....
📄 PDF & Image:
Merge, Split, and Watermark PDFs instantly.
** Compress images** without quality loss.
and more....
📷 Image Tools:
Image Compressor - Compress images locally to reduce file size while maintaining quality.
HEIC to JPG Converter - Convert iPhone photos (HEIC) to JPG locally.

Try It Out

I’d love for you to break it (or just use it!). Check it out here: 👉 codecoffeetools.com
Feedback is welcome! Let me know in the comments if there’s a specific tool you’d like to see added next.