October 2, 2026 — SvelteKit 3 cleans house, and your imports pay for it

Host0:30

The Svelte team says it has cleaned out the junk drawer. That's SvelteKit three, stable as of Thursday. And like any junk drawer cleanup, your stuff is now somewhere else. Two moves matter. Configuration leaves the Svelte config file for your Vite config. And the dollar lib alias becomes hash lib, built on Node subpath imports. The team says this lets the Vite plugin read configuration synchronously, instead of resolving it through a separate asynchronous process. The catch, per InfoQ, is that hash lib imports must be unambiguous, a full file name or an explicit index file. You trade SvelteKit-only convenience for native Node tooling. You also need Svelte five and Vite eight. The notes say Vite eight brings Rolldown and faster builds. That's the team's characterization, and the announcement gives no benchmark. New in the box: environment variables declared in one file, public or private, build time or runtime, optionally validated with Standard Schema libraries. Svelte five also brings broader error boundaries, with errors flowing through handleError. Remote functions are still experimental, and they need Async Svelte, which has its own flag. The team says they make everything else look a bit clunky, including SvelteKit's load functions and actions. Bold, for a feature that needs two flags. Migration is one command. Run `npx sv migrate sveltekit-3 --tasks all --confirm`. It migrates what it can and leaves a TODO list for everything else. If you're agentically inclined, the team says, your robot friends will make short work of it. Teams with big SvelteKit two codebases will push back, especially if tooling assumes dollar lib. How migration holds up with custom aliases and adapters is still unproven. Starting fresh? Run `npx sv create my-new-app`.

2:28

SvelteKit changed what your code imports. Cloudflare's Clef changes what a model hands back. Not a paragraph. A probability. Clef and Clef-flash, announced Thursday, are what Cloudflare calls decision models. You send text or structured state, up to four images, and up to sixty four questions. Each is yes or no, a choice, or an ordinal score. You get probabilities back. No prose. Mechanically, it's one pass through a Qwen backbone, then a head scores every allowed answer in parallel. Cloudflare says there's no intermediate text to generate token by token. Clef is twenty seven billion parameters, Flash nine billion. It runs on Workers AI by binding or REST, and the weights are on Hugging Face under Apache two point oh. Context is sixty five thousand five hundred thirty six tokens. Input costs twenty four cents per million tokens for Clef, nine cents for Flash. Output pricing isn't documented. The numbers: Cloudflare reports median latency of two hundred nine point three milliseconds for Clef, thirty eight point eight for Flash, and five hundred twenty four point one for Jev. It says Clef models lead seven of ten benchmarks, though Jev wins some, like When2Call and BRIGHT. BenchLM mirrors the table but says it did not rerun it. A provider self-report is displayable evidence, not an independent run, it notes. New for callers: image input, which the text-only Jev lacks, and Jev integrations can switch by changing endpoint and model. Limits: four mebibytes per image, long state gets truncated, and rate limits aren't documented. Verdict. Try Flash on bounded routing or classification with a fixed answer set. Test on labeled examples and send uncertain results to a human. Skip it for open-ended reasoning, coding, or anything needing an explanation. From a Worker, call AI run with the clef-flash ID.

4:38

Clef's weights are open, but you'd still call it on Cloudflare's servers. This next one aims to run on your own machine, if your machine is large. The README answers why your PC froze on first launch. Normal, it says. Wait, and don't close the window. That's thirty five to fifty five gigabytes loading into RAM, for one to three minutes. Strata is a Windows and Linux inference engine for Qwen three point eight Flash Next, with OpenAI-compatible and Anthropic-compatible local endpoints on port eight thousand eighty. It's a mixture of experts, twenty four thousand five hundred seventy six of them, ten used per word. Strata keeps the busy ones on the GPU and leaves the rest to RAM and CPU. A small helper guesses ahead and the big model verifies, which the README claims is one point six to one point eight times faster. You want twelve gigabytes of VRAM, thirty two of RAM, and eighty of disk. The README says an RTX thirty ninety should manage a hundred to a hundred forty tokens per second. That's the project's estimate, not an independent benchmark. To try it, run the setup script on Linux, or START-HERE dot bat on Windows. It picks an engine and downloads the model, about seventy gigabytes.

6:04

Strata is about where a model runs. Pi is about what happens when the process around it dies. Pi one point oh is a hardened, minimal, extensible agent harness, now with Codemode and full-screen mode by default. Earendil's stated goal: Pi must become more durable. The real story is Pi Durable, a separate experimental package for long-running agents. It checkpoints each task step before moving on. If the process dies, a new one reopens storage, finds unfinished tasks, and continues from the last checkpoint. Every tool call is a task with recorded intent. After a crash, a safe tool can rerun. An unsafe interrupted one is reported to the model, not silently replayed. Storage is memory, SQLite, or JSONL. The number I liked: the source is about fifteen thousand lines, roughly two hundred fifty thousand tokens with Claude. Earendil adds that you can usually skip three thousand lines of storage backends. A library you can read in one sitting, if your sitting is a context window. The limit: the Pi repo warns there's no built-in permission system, and it runs with whatever permissions launched it. Durability isn't a sandbox. And how it handles irreversible side effects, exactly-once, isn't clear yet. To try it, install Pi with the install script from pi dot dev. For the durable packages, run `npm install @earendil-works/pi-durable @earendil-works/pi-ai @earendil-works/chord`.

7:39

Pi warns that durability isn't a sandbox. GitHub's new feature is a fine reason to remember that, because Copilot can now drive your desktop. It's a public preview in Copilot CLI and the Copilot app, on macOS and Windows. Copilot can read accessible app content and visual context, click, type, press keys, scroll, and drag across applications. GitHub's pitch is GUI-only or legacy software with no API, CLI, or MCP integration. You describe the outcome, the apps, and the constraints. In the CLI, slash computer on enables it, show checks it, off disables it. GitHub's own example is an expense report in Safari, an unusually ordinary job for something pitched as agentic. Controls: Copilot asks approval before controlling an app, you can review or reset always-allow apps, and organization settings can disable it. On macOS it needs Accessibility and Screen Recording permissions. Security teams will push back on handing over screen-reading and input control. And it's unclear how Copilot handles destructive actions, secrets visible on screen, or prompt injection in content an app displays.

9:00

Nothing connects this to Copilot, except that both promise less friction. The Register notes that at the bottom of every data lake, sink, pool, or basin, there's a drain for cash. It's talking about Basin, Cloudflare's data platform, generally available as of Thursday, built on Apache Iceberg and R2. Technically, it's a bundle. Pipelines ingests through HTTP endpoints or Workers bindings and writes Iceberg tables to R2. You query with Basin SQL, or point Spark, Snowflake, Trino or DuckDB at the same tables through the Iceberg REST API. The Register reports the Basin names replace existing ones: Pipelines, R2 Data Catalog, and R2 SQL. Cloudflare says querying from other clouds, platforms and regions carries no transfer charges. The catch, per The Register: R2 doesn't charge egress for direct access, but Pipelines sink delivery can bill after the allowance, and connected metered services may charge too. Lower cost and no lock-in are Cloudflare's claims. What a representative pipeline actually costs isn't clear yet. To try it, run npx wrangler r2 sql query, with your warehouse name and a SQL string. Then read the pipeline pricing before you move anything. Teams with mature warehouses won't rush.

10:30

GitHub private vulnerability reports. The default form now demands a proof of concept of at least a hundred fifty characters, and admins can set daily limits and allow-list trusted reporters. If you customize the form, REST API reports must match it, so check your integrations first. A hundred fifty characters is a small attempt to end the one-line reproduction. MAI-Transcribe-2-Streaming. Microsoft says the first partial transcript lands in just over a hundred milliseconds, across sixty languages. Partials get revised, then a stable transcript commits. Worth testing if you build voice agents, but the accuracy rankings are Microsoft's, so try your own accents and noise. MAI-Voice-2.1 costs twenty two dollars per million characters, Flash fifteen. Strands Decider 2B. The second decision model of the day. AWS reports local inference, with median latency around a hundred fifteen milliseconds on an RTX thirty ninety and around a hundred fifty three milliseconds for small tasks on an M3 MacBook. Install it with pip install strands-decider. AWS itself says it's worse than reasoning models at complex problems, and this is version nineteen, after version twenty did not replace it as the reference model.

11:57

NVIDIA says GPT six Astra Ultrafast is now in the OpenAI API and available to eligible ChatGPT Work and Codex users, running on Blackwell GPUs. The claim is up to eight times faster token generation than Astra Standard, with no methodology published. OpenAI's page lists a Fast mode at twice the price for up to twice the speed, but nothing on Ultrafast pricing. NVIDIA also says OpenAI used its own models to optimize the inference software. If you run agent loops, where generation latency repeats every cycle, measure before you believe the eight.

12:41

Fast Boot. Three security items, and nobody in them is subtle. FortiMail, exploited. Attackers are exploiting a FortiMail flaw rated nine point eight, letting unauthenticated visitors write arbitrary files, with fixes still upcoming. Fortinet's logs show a remote archive account literally named archive two three four, so naming was clearly not the hard part. Hackers, hacked. DIVD, the Dutch vulnerability disclosure nonprofit, says two Zammad zero-days, chained from session hijacking to root, got it breached on September twenty first. DIVD assessed that an AI agent polluted its own man-in-the-middle attack with password spraying, a burglar kicking over its own ladder. Several, apparently. Debian's September twenty ninth kernel advisory covers several vulnerabilities, which an oss-security commenter pointed out means one thousand three hundred thirteen CVE IDs. Debian stable Trixie users should upgrade the Linux packages to version 6.12.111-1, so at least the fix is shorter than the list. Archive two three four, a robot kicking over its own ladder, and a several that meant one thousand three hundred thirteen. Nobody remembered to be subtle.

14:01

Today: SvelteKit three went stable, Cloudflare shipped Clef, Strata aims to run Qwen locally, Pi hit one point oh, Copilot learned to click, and Basin gave Cloudflare's data stack a new name. Try this before Monday: run the SvelteKit migration on a branch and read the TODO list it leaves you. Sources and links are in the show notes. Follow The Daily Reboot wherever you get your podcasts. I'm your host. Go commit something.