DEV Community: Ricardo Zorzal Davila

Meet Clúsia: PR reviews for humans, with your own AI at your side

Ricardo Zorzal Davila — Sat, 17 Oct 2026 14:32:45 +0000

Most of my code reviews used to happen in a browser tab I'd squeeze in between meetings. Lately a lot of teams hand that job to a bot, and the bot leaves a pile of comments that mostly get resolved without being read.

I wanted somewhere calmer to read a change, with an AI I picked sitting next to me. It answers my questions and points at things, and I decide what goes on the PR.

That's Clúsia. It's a free macOS app, open source under Apache-2.0 and written in Rust, and I think it's ready for other people to try.

How a review works

You open a pull request and Clúsia checks it out in a local worktree. You comment on a line or a range, reply to threads and resolve them, and all of it stays in a draft on your machine. When you press Finalize review, the draft goes to GitHub as one review. Before that, nothing gets posted.

The draft also survives new pushes. If the author pushes while you're halfway through, your comments move to where their code went. If you saved a review and came back a few days later, your agent can read each comment against the new commits and suggest whether to keep it, move it, mark it obsolete or reword it. You go through the suggestions one by one, or accept all of them at once.

Your agent, on your account

Clúsia doesn't ship a model. It talks to the Claude Code or Codex you already use, with your own login, or to any program you write that speaks a small JSON-lines protocol. Your GitHub token never reaches the agent, and the agent never writes to git or GitHub. Publishing is your job.

When a review opens, the agent writes a summary, and then you can chat with it about the PR. It can read and search the worktree on its own. For anything else, like running cargo test or editing a file, a modal shows you the exact command, the reason the agent gave and a countdown. If you don't answer, the request is denied. Commands run in a sandbox by default, with no network and writes only inside the review's worktree.

Security checks

When you open a review, your agent also looks at the change for security problems. Each finding comes with a severity (high, medium or low), the line it's about and sometimes a code suggestion, written as a review comment you can use. You add it to your draft, edit it first or dismiss it. A finding on a line the PR didn't touch becomes a general comment.

I was careful with the wording here. When nothing turns up, Clúsia says something like "Claude Code found no security issues in 7 files". It won't tell you the change is safe, because an agent that read the PR can't promise that, and I'd rather you keep reading.

Audits, area by area

Next to Security there's an Audits tab. The agent goes through the change looking at correctness, concurrency, error handling, performance, tests, and docs and changelog, and each area gets its own findings. You can switch areas off, and you can add your own with a name and a short instruction (up to 500 characters), something like "check that every new endpoint has rate limiting".

If the agent didn't answer for an area, the tab says Not checked. I didn't want a silent "ok" there.

Each check runs in a session forked from the review's chat, so it already knows what the agent read and your chat stays free while it works. At most two checks run at the same time across all your reviews, because every one of them is a real turn on your account.

Diagrams of the change

This is the part I've had the most fun building. The Diagrams tab asks your agent to explain the PR in up to eight diagrams, and it picks the kinds that fit the change: flow, dependency graph, sequence, entity-relationship, use cases, data flow, state machine or class diagram.

Clúsia validates every drawing and lays it out itself, so the arrows stay straight and readable. Click a box and you see its code at the commit it was drawn from, with the lines the PR added highlighted. From there you can comment on those lines and the comment goes straight into your draft. Each drawing is kept per commit, so after a new push you can step back through the versions and see what was added, changed or removed between them.

The last diagram in the list is a 3D one I call "Where the words live". The agent picks the words the change adds or touches, groups them into families and names a few use cases and three axes. Clúsia then finds every place those words appear in the repository, and the agent places each file and function on the axes. You can turn the map around, filter to only what the PR changed, and click any point to read the code and comment on it. It helps most when I'm reviewing code I didn't write and want to know what else depends on a name before I approve a rename.

The menu bar and the terminal

A popover in the menu bar shows the PRs waiting for you, saved reviews that went stale and a heatmap of your review activity. You get notifications for review requests, new commits on PRs you reviewed, replies, mentions and failing CI, and you can set quiet hours. If you'd rather stay in the terminal, there's a CLI too: clusia prs, clusia open owner/repo#123, clusia review publish.

Try it

You need a Mac, Apple silicon or Intel. The script builds Clúsia from source with Homebrew or Rust, never asks for sudo, and the first build takes about five minutes:

curl -fsSL https://raw.githubusercontent.com/rzorzal/clusia/main/install.sh | bash

If you'd rather read the script before running it (fair), download it first:

curl -fsSL https://raw.githubusercontent.com/rzorzal/clusia/main/install.sh -o install.sh
less install.sh
bash install.sh

The first run uses your gh login, asks where your clones live and finds the agent you have installed. Then open a PR from the tray or with clusia open owner/repo#123.

Come help

Clúsia is young, and what people tell me now will shape most of what comes next. If you review code every day, I'd really like to know whether this fits how you work.

The repo is github.com/rzorzal/clusia. A star helps other reviewers find it. Issues are welcome for anything that breaks, confuses you or is missing. If you want Clúsia to work with a model or tool it doesn't support yet, the harness protocol is short and there's a working example in Python.

And in the comments, tell me how you review PRs today. I'm curious what other people's setups look like.

The website, with screenshots, is at rzorzal.github.io/clusia.

How to easy explain Machine Learning for everyone

Ricardo Zorzal Davila — Thu, 29 Jul 2021 14:40:30 +0000

Did you had to explain for someone what is a Machine Learning (ML) ? For your boss, investor, friend, family or anyone ? I think everybody who use ML at the work had to explain it. Sometimes it is hard because some people doen't know math or statistics very well ( and some other doesn't even know what it is). When I have to explain it I always try to understand who will listem, because if I was talking with my boss, he know something of math, and I can say things like 'function' or 'variable'. But when I'm talking with my friends, they don't even know what is it (sometimes they said that they are understaning, but I know that is a lie haha). This article is a methodoly that I develop to explain what is ML for everyone, without technical words or math language. I hope you can use it as much as I.

First things first

Let me introduce you the meaning of learning. When we said: 'The machine is really think on that' it is the same of 'The machine is making some calcs'. I know that this may act like something hard to understand, but everybody make calc when we are trying to think. Let me show you.

If I need to know what is the best way to go from here to the nearest starbucks. Our mind start thinking in: How much time it gonna take if I choose the A way, B way or even C way? Or other one will think: How much miles (or kilometers) do I will need to walk if I take A way, B way or C way? Look all those questions made you think in 'How much', but you can also think: What the way is more secure to go. But how we can measure securty ? The number of robers in the neighborhood ? The number of cars in the street ? The ammount of people transit in it on a day ? Even your qualitative question can be coverted at a quantitative one. And that is the beauty of thinking.

When we are trying to learning something we are simulating possibilities of doing something based on our own tests. We know that the way B is more short than way C, but way C in some hours of the day is not secure, so we can choose the way B instead of way C. Look, we are interpreting our data with our observations and learn with it. I know you had have to walk into all of theses ways to know the better choose.

Machine will do the same as you did. But it will use math to understand the best choose. And it can use a lot of thinking types to choose the best. As you can prefer doing something because of something, the machine can think in a way different from the other one. We call it algorithm, and the data we are using to choose we call it features (or you can call it variables).

How we can predict something ?

Now we understand what is learning in terms of thinking, how we can predict the future ?

As we see at the top, we need to produce our observations based on our life. Machine can do the same to predict the future, but you need to give data for it. Machines can use the data from the past to understand better how the future will be.

Imagine now that you start work in a new job, and don't know the better way to fo there. You need to start going there without any perceptions. After 10 times going to work, you can choose a better way, because you have data to understand what is the better. After 100 times, you may have a solid thinking in what is the better, and will choose always the right way.

Machines will do the same. You can pass 10 observations and it will predict something, but when more and more data is passed, it can predict better. If you want to see them act by itself you can just pass sensors and say, go from A to B. It will start make your own observations, and you just need to say if it made a good or bad decisions.

Look we now have 2 types os act. You can teach a machine passing data to it from the past, or you can just say if it made a good choice. This is called supervised and unsupervised methods.

But how it can create the rules ? Lets imagine a configurable engine that make fruit juice. You can configure it to make orange juice pressing some buttons, insert the oranges into it and you will have orange juice at the final step. If you want mango juice, you need to set other configurations, input mango and it will produce mango juice.

Now you want papaya juice, but we don't now how to set the configuration. You will start pressing some buttons trying to create the correct configuration to do it. Now you are learning how to use this engine to produce papaya juice.

Ordinary functions act like the first exemple. We have data, and the rules and it produce a result to us. In the other hands, ML will need only the data and the result, and it will output the rules to do it. So if you pass papaya and papaya juice to the engine with ML, it will produce a configuration to make papaya juice to you. Now you can get this configuration and the data, put it into the engine without ML to start produce you papaya juice.

And that is wonderful. You can use ML to learn the rules of doing something, and with this rules in your hands, you can replicate it to predict the future.

Conclusion

I know that this method is not accurate as expected, but for me it is working better than when I show graphs, functions, methods and all the boring stuffs for ordinary peoples. You can adapt it to your own observations, because after all, we are juice engines adapting our configurations to do the better fruit juice.

Some people will start make some questions like: What you do when something occur ? What I need to start undersand better it ? How much time you studied to learn it ? And such others. In that case I advise you to try to explain with your own words and try to not scare them haha. Maybe they are thinking in learn more and you can be their teacher. Good luck and comment if you have any others ideas to explain better what ML is.

Conceitos básicos de blockchain (exemplo de iteração com React + Formik)

Ricardo Zorzal Davila — Fri, 29 Jan 2021 20:50:33 +0000

O mundo hoje presa por segurança e privacidade, principalmente no meio econômico. E foi nesse meio que se popularizou a blockchain. Neste artigo vamos entender alguns conceitos básicos desse ecossistema e uma implementação em React utilizando Formik que irá interagir com a rede.

Este artigo é um artefato gerado da apresentação interna da empresa WA Project e que tem como autores Marcus Vinicius, Claudio Neto e Ricardo Zorzal

O que é Blockchain afinal ?

É um conjunto de transações colocados em blocos protegidos por criptografia formando uma grande corrente e são espalhados por vários computadores. A blockchain é pública e qualquer pessoa pode verificar e auditar as transações.

Todas os blocos da blockchain são validados por pessoas que utilizam poder computacional para calcular o hash de cada bloco para garantir que as informações são verdadeiras e imutáveis. Dentro de cada bloco também encontramos o hash do bloco anterior, o que garante que informações não serão inseridas entre os blocos.

Todos os blocos que são inseridos, são validados pela maioria da rede, ou seja, pelo menos 50%+1 da rede deve concordar que aquela transação é legítima e correta.

Métodos de validação de transações

PoW - Proof-of-Work (Poder computacional)

Esse método faz com que as transações sejam difíceis de provar a veracidade, gastando muito poder computacional, ou seja, ele faz o computador usar muito do seu CPU para realizar os cálculos de validação e provar a veracidade do nó.

PoS - Proof of Stake (Quantidade de Ativos)

Esse outro usa a quantidade de ativos (tokens). Quanto mais ativos o usuário possuir, maior a chance de ele ser um validador da transação. Assim faz com que não gaste tanto poder computacional, consequentemente menos energia elétrica, mas o usuário ficaria com boa parte dos tokens destinados à essa finalidade.

Aplicações da blockchain

Aplicações financeiras
Contratos inteligentes
Serviços de cartórios e documentos.
DNS descentralizado.

Aplicações reais

Arcade.City - Uma espécie de Uber peer-to-peer
Direct.One - Uso de blockchain para criação de documentos digitais e envio de mensagens transacionais com validade jurídica
Nasdaq - Emissão de título privados via blockchain
The DAO - Decentralized Autonomous Organization: Companhia de venture capital baseada em blockchain ( Fundo de investimento )

Ná prática, como funciona?

Para demonstrar o funcionamento, criamos um repositório que implementa uma votação usando esse serviço e um exemplo usando React + Formik que irá interagir com a blockchain.

Blockchain
React + Formik

Se quiserem aprender um pouco mais sobre o desenvolvimento do front-end, é só clicar aqui!

Essa é uma tecnologia para se ficar de olho em 2021. Muitos sistemas vem crescendo e com o mundo se importante cada vez mais com privacidade e segurança muitas soluções usando blockchain podem vir a surgir. Acreditamos que ficar de olho e entender minimamente o que é e onde pode chegar essa ferramenta, poderá facilitar o desenvolvimento, nos tornando desenvolvedores cada vez melhores.

[PT-BR] Node Secure update. Quais foram os problemas ?

Ricardo Zorzal Davila — Sat, 08 Feb 2020 03:06:12 +0000

Em fevereiro de 2020 foi liberada uma atualização para as versões 10x, 12x e 13x do Node.js e que causou uma certa ansiedade de discussão na comunidade em todo o globo. Ela veio para corrigir 3 problemas de servidores HTTP, principalmente aqueles que utilizam parser's nativos, como é o caso do mais utilizado e conhecido atualmente, o Express. Ambos os 3 problemas são encontrados na forma de interpretar uma conexão HTTP entre 2 (ou mais) pontas, podendo deixar os servidores vulnerareis ao ataque tanto em seu formato TSL quanto no inseguro HTTP.

Quais foram os problemas encontrados ?

O principal dos 3 se deve à uma má interpretação do header "Transfer-Encoding". Este header tem como objetivo deixar claro ao servidor como os dados do payload serão formatados, sendo valores possíveis para este: chunked, compress, deflate, gzip, identity. E todos podendo ser combinados usando uma virgula, como "chunked, compress" que neste caso seria interpretado como ou sendo "chunked" ou sendo "compress".

O ataque poderia ser feito colocando uma formatação que não existe, como "eeee" e passando como body uma outra request. O servidor então terminava de interpretar o header do request e parava, enviando como response dados sensíveis, dando assim vazão ao ataque, que como no próprio release-note do node diz: "The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system."

O problema foi evidenciado pelo engenheiro de software do Ebay, Ethan Rubinson!

Os relatados deste problema podem ser encontrados neste link:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15605

O segundo problema que iremos entender é também um problema na forma de interpretar o header do HTTP, ou HTTPS. Dessa vez quem revelou o problema à comunidade foi Alyssa Wilk, que trabalha no Google.

Neste caso a interpretação dos parser's nativos tratavam de forma errada os espaços em branco de alguns headers que até então não "tratava" os valores passados para o cabeçalho, com isso alguns ataques conseguiam fazer os servidores ignorarem alguns algoritmos de segurança que checavam a integridade da conexão entre os nós envolvidos.

Esse ataque está relocionado no link abaixo:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15606

Agora vamos para o terceiro problema de segurança corrigido, onde dessa vez tivemos 2 "autores" que informaram o problema, Rogier Schouten e Melvin Groenhoff.

Este ataque consiste em configurar uma chamada TLS, ou seja HTTPS, onde seja passado a propriedade subjectAltName com 19 strings como certificado da conexão, isso fará com que o servidor caia e possibilitaria uma invasão por queda (ou um ataque de negação de serviço também) caso o servidor tente ler o certificado do nó que faz a requisição.

Como esse caso é um pouco mais técnico e só acontecia em servidores que utilizassem o HTTPS e que o certificado estivesse mal configurado, o problema pode ter sido pouco utilizado pelos atacantes.

Vocês podem acompanhar usando o link:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15604

Mesmo sendo uma atualização importantíssima para os servidores e todos os programas afetados, os mantenedores do Node.js ainda deixaram claro que para quais-quer fins você pode usar a flag "--insecure-http-parser" para não levar essas atualizações para o seu sistema, mas é de suma importância entender os riscos e que os desenvolvedores da plataforma dizem que não seria uma boa prática.

Legal, como eu faço para ver as correções ?

O mais legal da comunidade Node.js é a facilidade de ver o trabalho dos mantenedores, você pode ficar atento ao próprio site nodejs.org e entrar nas versões e acompanhar os change logs de cada versão. Além de consultar vários artigos sobre as versões e atualizações da plataforma, no site mesmo.

Outra ótima maneira é acessar o repositório no github e verificar os commits :) https://github.com/nodejs/node

O mais legal de tudo, é que como tudo é documentado, testado e explicado dentro do próprio repositório, os casos de teste também podem ser rodados e avaliados por vocês.

Como é o caso deste link, que mostra o commit feito para testar a solução do primeiro problema que apresentei aqui:
https://github.com/nodejs/node/commit/eea3a7429b

Além desses canais, de tempos em tempos são feitas reuniões online da comunidade e dos mantenedores e tudo é postado no canal do Youtube. Exemplo de post: https://www.youtube.com/watch?v=mj33ibz7Ias

Comunidade acima de tudo

Essas correções de segurança e os problemas que foram encontrados (até os quais ainda não temos solução) podem ser encontrados (e reportados por vocês) em sites como o https://cve.mitre.org/index.html e é muito importante, para todo o ecossistema, que a comunidade esteja ativa e troque bastante figurinha sobre todos os assuntos.

Se os desenvolvedores que citei aqui não tivessem relatado os problemas e os mantenedores do Node correrem para os corrigir, talvez sua aplicação sofresse os ataques e você nunca iria entender à fundo o que houve.

Contribua com a sua plataforma, com sua comunidade, com sua linguagem de programação favorita. O importante aqui é você participar :)