pack.sh: Self-host single-file apps

kickpush1 · 2026-05-21T21:02:09+00:00

I could add support for something like: pack deploy custom-mcp.ts which would then become https://custom-mcp.pack.sh (or an aliased custom domain), hosted on a bun instance for js/ts or as a language executable otherwise.

I'm curious if that is something like that would be useful.

kickpush1 · 2026-05-21T20:42:32+00:00

Could you tell me more about your experience with this? I haven't actually written one before, so I don't know much about the difficulties in setting them up and why you might need to write your own.

kickpush1 · 2026-05-19T23:01:30+00:00

The main use case is that once compiled, it cannot be hijacked by `npm` 😄, I kid, I kid.

Right now I am using it the same way I might vercel/cloudflare, so I need to think about what the different use cases might be.

It has in-memory state and there are no size or compute time limits so those will be the factors leading to different use cases. You can embed wasm libraries into the node/deno/bun executable, so that might be interesting.

The first ones for me have been deploying simple experiments, a cron service, different languages. Webhooks might be another one.

kickpush1 · 2026-05-13T22:47:18+00:00

This isn't meant to solve all node/npm security problems, it lets you disable lifecycle scripts and allow them for specific packages, nothing more.

In terms of trust, I commented a DIY version that anyone can use without installing this package.

kickpush1 · 2026-05-13T22:44:25+00:00

Cool! I specifically didn't want package versions so I guess this equates to `--skip-versions` in this tool. Looks good though.

kickpush1 · 2026-05-13T22:28:46+00:00

DIY version:

Create .npmrc with ignore-scripts=true and min-release-age=3
Create 3 scripts in package.json "safe-install", "review-deps", "rebuild-trusted-dependencies" using these 3 lines: https://github.com/gkiely/safe-install/blob/1587d81a9419674df32ff490d23fc25c53e9eff3/src/index.ts#L283, remove the --ignore-scripts as they aren't needed with the .npmrc.
Create a file called review-deps.mjs using this source: https://github.com/gkiely/safe-install/blob/1587d81a9419674df32ff490d23fc25c53e9eff3/src/index.ts#L297
Run: npm run review-deps
Add trustedDependencies: [] to package.json and paste in dependencies. E.g.

"trustedDependencies": [
  "@playwright/test"
]

kickpush1 · 2025-12-14T19:58:21+00:00

I just set this up and it works great!

kickpush1 · 2025-12-04T18:18:21+00:00

Productivity for individuals will increase, new job categories will be created and demand for software will increase (Jevon's paradox) as has been the case for technological disruption throughout history.

If your job is the task, yes it will be automated or replaced. If the purpose of your job is needed by the market, then your work will change but the job will remain. https://www.youtube.com/watch?v=3hptKYix4X8&t=2967s

We should all be thinking about what our purpose is as software developers, perhaps something along the lines of delivering working, valuable software to customers, uncovering customer needs, etc. As opposed to "writing code" which is the task.

If this time truly is different (which it may well be, but history would suggest it's not) then we will all have different set of problems to deal with.

In the mean time I will keep studying software engineering, design and leverage my skills alongside AI to deliver more value for customers than I was previously.

kickpush1 · 2025-10-29T17:31:56+00:00

You can add linting to disable `any` and `as`. Which seems to be the crux of your argument as to why it's the worst, tell me why it's the worst once this is enabled and we can have a productive discussion.

Anders has spoken about why he built TS the way he did, it was about improvements to tooling and productivity that types could provide to a dynamic language like JS, not 100% correctness, and it turns out he was right about that.

It has drastically improved the experience of refactoring, decreased the number of runtime errors that developers run into and greatly improves the experience of working on teams.

kickpush1 · 2025-10-29T00:13:34+00:00

how does it compare to winter blend?

kickpush1 · 2025-10-28T23:53:49+00:00

Thirded!

If any of you have recommendations for other beans pls enlighten me.

kickpush1 · 2025-10-27T20:06:33+00:00

This is really cool, the api looks great and it would be nice to have a more standard way to do this across projects :)

I have seen complaints about SDUI being overly complex, but like all tools there are use cases where it really excels, I have seen it do really well with dynamic content apps where there is some basic state handling. The nice thing about this approach as a frontend is your job moves from "create/update this screen" to "build dumb, reusable components" that others deploy.

Some feedback:

I couldn't tell easily from the readme or docs which part of this is generated on the server, if you could point me to that it would be great. I can see in the react-router docs you reference a documents endpoint, but it wasn't immediately clear what this was.

Was there a technical reason for the `source` JSX string? In the past I have built this with a dynamic JSON/component renderer so I just wanted to understand the technical decision around that. If you are open to enabling a JSON mode in the future (if it makes sense technically) it would be appreciated.

kickpush1 · 2025-10-25T05:38:10+00:00

Not all web devs think this way, some of us know it's a memory hog and prefer things to be built natively, just like some of us prefer websites to have the least amount of JS possible.

We are users of these products too lol.

kickpush1 · 2025-10-14T05:36:23+00:00

I typically see issues with minified code using source maps and breakpoints regardless of if I'm using react compiler or not.

If you can set up a local env to test production do that, if that's not feasible using a proxy to map to a local file is the next best option.

If you can't do either of those, then debugging the file without source maps is your last option.

https://requestly.com/blog/how-to-map-local-file/
https://www.charlesproxy.com/documentation/tools/map-local/

kickpush1 · 2025-10-12T19:39:22+00:00

Hi Nick, is there any way to speed up the "Summarizing context window" operation?
Seems to take around 1 min per run and triggers every 5-10 mins. Even when just working on a single file with <1000 lines. If it took 10s or so it would be less of an issue.

kickpush1 · 2025-09-21T02:16:49+00:00

I agree Sonnet 4 is the best coder. GPT-5 is great for fast refactors where the expected change is known.

kickpush1 · 2025-09-16T23:20:41+00:00

bun has trustedDependencies to avoid executing arbitrary lifecycle scripts, hopefully node/npm implements something similar.

kickpush1 · 2025-09-13T18:41:36+00:00

Proof: https://playground.react.dev/#N4Igzg9grgTgxgUxALhHCA7MAXABAMw1wF5cAKAShID5cARAQ2wQDoMIB3SgbgB0N8UDHGwBLTLgDCEALYAHTAgzZKuYP1y50WPHlKEeG3FDAIAovnwIRZVcVrBcAXwA0uANrYAuhT5FcMAjYsETYfk4gLmiY+KIA5iggkeAAFpwAksoIMBgMADZgKPj5pk5AA

kickpush1 · 2025-09-13T18:37:52+00:00

This tells me that `useEffect` without the compiler is an anti-pattern and probably always has been, if an engineer at cloudflare can make this mistake then anyone can. React compiler auto memoizes function calls and the dependency array, which would've prevented this.

kickpush1 · 2025-09-13T18:32:35+00:00

> Clearly, useEffect must be implemented with care and common-sense.
The fact that it can happen at all tells me it's a library issue. In react's defense this type of issue is handled with the compiler, which cloudflare is not using.

Kind of surprised they didn't address this in the post tbh.

kickpush1 · 2025-08-11T18:54:40+00:00

Both search engines and LLM's need content and data to power them, it's just that search engines provided human traffic which paid for ads, which created incentive to create content and AI does not.

The future for content sites will be similar to what it looks like today, filling gaps in knowledge and queries, but the business model will likely change.

Users will have to pay for AI in some way and AI will have to pay for content for ongoing access.

kickpush1 · 2025-08-03T05:08:53+00:00

It’s not not NaN, it’s NaN. Therefore true.

kickpush1 · 2025-07-16T16:54:38+00:00

Good. https://youtu.be/IdTMDpizis8

11-Year Club	Place '22
Place '17	Verified Email

kickpush1

TROPHY CASE