AI Engineer Europe 2026
Code Mode: Let the Code do the Talking
Read the talk
Code Mode: Let the Code Do the Talking
Generated code can compose API calls, act on existing application state, and tailor software to a task—provided its execution environment grants only the capabilities it needs.
From a talk by Sunil Pai
Before you start: Familiarity with JavaScript, API calls, and the basic model–tool interaction loop will help you follow the examples.
When tool calling becomes choreography
A couple of tools and a short agent run are manageable. Add Google services, Jira, and a wiki, and hundreds of tool definitions start crowding the model’s context. Completing a task also becomes a sequence of exchanges: request an operation, return its result, ask the model what to do next. Composition gets awkward, and each round trip adds delay.
Sunil Pai’s alternative is to ask the model for JavaScript that runs against an exposed environment. Instead of expressing every step through another JSON tool call, the model writes a program. A typed API gives it a structure to work against; syntax checking and type checking offer feedback; and programming languages already have extensive representation in model training data.
Move the composition into code. A single execution can loop through results, retain intermediate state, sequence dependent operations, and parallelize independent ones. The underlying API requests still happen, but the model need not intervene between every pair of requests. These are ordinary programming capabilities applied to agent execution.
Suggest correction
This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.
An entire API behind search and execute
Cloudflare’s API makes the scaling problem concrete. Pai credits colleague Matt Carey with applying Code Mode to a surface he estimates at roughly 2,600 endpoints. Pai estimates that exposing each endpoint as an individual tool would require about 1.2 million tokens in the first call. The problem arrives before the agent has done any useful work: describing everything it could do overwhelms the interface.
Carey’s implementation exposes just two tools, both accepting a string of code:
| Tool | Code runs against | Purpose |
|---|---|---|
search | The complete OpenAPI document | Find relevant operations and their schemas |
execute | Callable API functions | Compose and perform the selected operations |
The complete OpenAPI document is available to the search program on the server; it is not inserted wholesale into the model’s context. The program selects the relevant information and returns it. The model can then write execution code using the operations it discovered. This separates discovering capabilities from using capabilities.
Pai reports reducing that tool-description footprint to roughly 1,000 tokens, approximately a 99.9% reduction. His spoken baseline varies from 1.2 to 1.5 million tokens; Carey’s published measurement compares approximately 1.17 million tokens of equivalent tool definitions with about 1,000 for the two-tool interface, using tiktoken. The comparison concerns tool-surface context overhead, not total task tokens or latency. The API remains broad; its full description no longer has to accompany every initial request.
Suggest correction
This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.
Compose the task, then watch execution
Consider an incident request: the website is being DDoSed, and the customer wants the attacking IP addresses identified and blocked. At three in the morning, navigating a complicated dashboard is an expensive way to express an otherwise direct intention.
Pai estimates about eight conventional MCP round trips for the illustrative DDoS task, versus one composed JavaScript execution near the API. That is a comparison of orchestration: the generated program still calls the necessary API functions, but it can carry results between them without asking the model to select each next step. The eight-round-trip figure is an estimate for the example, not a measured incident-response benchmark.
The live demonstration uses a smaller request: list the account’s Workers. Pai gives the demo read-only access and approves an allow interaction. The intended sequence is straightforward:
- Search for API endpoints matching the Workers-listing task.
- Generate code that calls the discovered listing endpoint.
- Return the resulting Workers to the user.
The visible run reaches endpoint discovery and generated execution code.
Then it encounters JavaScript errors and appears to attempt pagination. Pai says he tested it ten times before going onstage, but the stage run does not establish a clean end-to-end completion. He points to Workers being listed and suggests the remaining trouble might be rendering. The demonstration therefore shows discovery and execution activity, with an unresolved failure in the overall interaction. A smaller tool interface does not eliminate mistakes in generated programs or result handling.
Suggest correction
This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.
Give everyone access to a small script
Optimizing an MCP server is only the first application. The larger possibility is a different way for people to interact with systems: describe a task, then let generated code perform the custom combination of operations it requires.
Suppose there are 200 photos on a desktop that need categorizing and renaming. A programmer opens an editor and writes a script, perhaps sending each image to a vision model for a caption before renaming it. A nontechnical user has to ask someone for help or find an application whose built-in workflow comes close. Pai caricatures that second option as a generic photo-management subscription with an unnecessary background daemon. The underlying limitation is real: the application’s predefined interface determines which combinations are convenient.
A language model can translate a request to rename files by date and location into code that operates on the exposed system. The user gains access to a task-specific script without needing to write it. This moves the boundary between what a programmer can customize and what everyone else must accept from a product’s buttons and forms.
Suggest correction
This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.
Play the game already on the canvas
Kenton Varda, introduced as the creator of Cloudflare Workers, explored this boundary in a personal coding environment. He asked it to generate a drawing canvas in the style of tldraw or Excalidraw, complete with brushes and colors. On that canvas, he drew a Tic-Tac-Toe grid and an X in the top-left corner.
When Kenton asked the model to play Tic-Tac-Toe with him, it initially started generating a new Tic-Tac-Toe application. He stopped it. The existing application already exposed its state: an array of strokes, each made from points. The grid lines and X were present in that array. He redirected the model to inspect the state and play there.
The model brought the stroke data into its context, recognized the board and the X in the top-left cell, and drew a circle in the center. There was no Tic-Tac-Toe code in the application. The model interpreted a general drawing representation and used the same representation to make its move.
At the data level, the change can be as small as appending one stroke. This JavaScript expresses that operation using a teaching board with grid lines at coordinates 100 and 200, an X in the top-left cell, and a circle centered at (150, 150):
javascript
const strokes = [
{ id: "grid-v1", points: [[100, 0], [100, 300]] },
{ id: "grid-v2", points: [[200, 0], [200, 300]] },
{ id: "grid-h1", points: [[0, 100], [300, 100]] },
{ id: "grid-h2", points: [[0, 200], [300, 200]] },
{ id: "x-down", points: [[25, 25], [75, 75]] },
{ id: "x-up", points: [[25, 75], [75, 25]] }
];
const circle = Array.from({ length: 65 }, (_, i) => {
const angle = (i / 64) * 2 * Math.PI;
return [
150 + 30 * Math.cos(angle),
150 + 30 * Math.sin(angle)
];
});
const nextStrokes = [
...strokes,
{ id: "o-center", points: circle }
];
The existing strokes stay intact. nextStrokes adds the center move in the format the canvas already understands; no separate game interface is necessary.
Pai reports that Opus eventually lost the game, and that its reasoning traces suggested it had let Kenton win. That is his interpretation of the traces. The architectural observation does not depend on playing strength: the model could participate by reading and changing existing application state.
Suggest correction
This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.
A harness for acting inside the system
Pai describes the shift as the model having “started inhabiting the state machine.” It stopped building another application and began acting within the one that already existed. He presents this as an exploratory direction, with a Ghost in the Shell reference, rather than a settled architecture with all its implications worked out.
This helps explain the growing interest in agent harnesses. Coding agents can serve as general-purpose computing interfaces because they can generate the programs needed for a particular task. Pai points to people running Pi on Mac minis, while questioning the need for dedicated hardware merely to make API calls. The useful abstraction is the harness, wherever it runs.
A harness supplies more than code generation. It provides a safe execution space and exposes the capabilities that generated code may use. Intent becomes code; code enters a scoped runtime; the runtime connects it to selected system operations. The scope of those operations determines what the agent can actually do.
Suggest correction
This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.
Begin with execution and no authority
The word sandbox covers several different designs. Cloudflare’s container- and VM-based Sandbox SDK is not the environment Pai means here. His contrast is between surrounding a feature-rich environment with security controls and starting with an environment that can only execute code. Initially, it has no exposed APIs and cannot make fetch requests. Capabilities are then granted explicitly.
Cloudflare implements this approach with Dynamic Workers and V8 isolates. Pai emphasizes fast startup and cites roughly ten years of security hardening. The important property is not JavaScript by itself: the host controls which APIs are exposed and which outgoing network connections are possible.
His recommended default is no outgoing fetches, only exposed APIs. Network isolation must be configured; it is not an automatic property of an isolate. The SDK revision available before the talk documents default fetch/connect blocking in DynamicWorkerExecutor, while Dynamic Worker configuration supports globalOutbound: null. A generated program’s authority comes from the capabilities the host grants, rather than unrestricted access to the network.
The runtime also needs observability at the level of the generated code. Pai’s deliberately absurd example is investigating why an agent made a multimillion-dollar trade the previous Tuesday: the operator needs to recover the program responsible and understand what it did. Fast startup without an inspectable execution history is insufficient for consequential actions.
V8 is one implementation choice. WebAssembly or a custom JavaScript interpreter could serve the same role if they provide controlled capabilities and fast execution. The architectural requirements survive the runtime choice: a bounded execution environment, explicit authority, and enough visibility to explain its actions.
Suggest correction
This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.
From one execution to personal software
Once a program can execute against controlled capabilities, the next question is how long it can live. Pai proposes extending a one-off API operation into workflows that run for days, months, or years, with each instance carrying state through its lifetime. Those persistent instances could also support interfaces tailored to individual users. These are proposed extensions beyond the demonstrated API run.
E-commerce illustrates the opportunity. As a store serves more people, its interface tends toward something generic enough to work for everyone. Personalization often changes a small detail, such as a button color. Pai proposes generating a substantially different interface for the task at hand—although he jokes that the Opus-generated slide illustrating this idea still looks poor.
The store already has context: preferences, cart contents, orders, and clues about what might be frustrating the customer. That context can become actions in a generated interface. It need not be delivered through a blank chat box.
- Return and replacement: A customer wants to return shoes and find something similar under $100. The interface could combine those operations even if product engineers never built that exact flow.
- Delayed order: Another customer wants to know what happened to an overdue purchase. Their interface should surface the relevant order and resolution actions instead.
The proposal is to generate different programs for different users while keeping them backed by the system the product team built.
The harness need not live inside a single product. Placing it closer to the user—even on an iPhone—could let it combine capabilities from several services, task by task, inside the same safe environment. Placement changes which systems can be brought together around the user’s intent.
For UI developers, this reopens the question of what an interface should be. Pai characterizes generated code plus safe execution as an underexplored branch of software design. The possibility is not simply another way to generate screens: the program that mediates between a person and their services can itself be assembled for the occasion.
Suggest correction
This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.
Design for the code-generating client
Humans remain the customers, but increasingly the immediate clients of software systems will be agents generating code. Pai’s rhetorical billion new users are these software intermediaries. Serving the human therefore includes making the system legible and usable to the agent acting for them.
That calls for a deliberate developer experience:
- Discovery: Registries and search should help an agent find the operations it needs.
- Contracts: Types and syntax feedback should make valid interactions easier to construct.
- Documentation: Markdown should make the system’s behavior accessible as text.
- Recovery: Errors should tell the agent what it can do next.
These are familiar developer concerns, now applied to clients that synthesize their own programs during a task.
Capability-based security is the principle Pai most wants builders to retain. JavaScript is incidental: Python, WebAssembly, or even a renewed interest in Lisp could support the same direction. The recurring runtime needs are events, sandboxing, explicit capabilities, embeddability, fast startup, and ephemeral execution.
Pai expects React and other UI programmers to have an advantage because they have spent so much time close to users. Understanding what a person is trying to accomplish remains valuable even when the interface and its coordinating program can be generated dynamically.
For a long time, programmers had code’s flexibility while everyone else had buttons and forms. That distinction is beginning to break. Generated code can become the means by which a person’s particular intention reaches the systems they use, instead of requiring that intention to fit an existing screen.
“Let the code do the talking” names this interaction model: code performs the work between human intent and system capabilities. Pai leaves it as an opening research direction—how to give more people the flexibility of programming while keeping execution understandable and its authority controlled.
Suggest correction
This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.
Resources
From the talk
Matt Carey's implementation account explains discovering and composing Cloudflare API operations through search and execute.
Introduces Dynamic Workers and explains isolate execution, explicit resource bindings and outbound network controls.
Source and documentation for Pi's coding agent, agent runtime and supporting libraries.
Further reading
- let the code do the talkingArticle
Sunil Pai connects Code Mode, the canvas experiment, capability-scoped sandboxes and software tailored to individual users.
The original Cloudflare account explains presenting tools as TypeScript APIs and executing generated code in a restricted environment.
Updates since the talk
A worked Agents SDK example wraps tools into a code-generation tool and executes the result in an isolated Dynamic Worker.
Read the complete timestamped transcript
- 0:00
[upbeat music] Our next presenter created PartyKit, the open source tool for real-time multiplayer apps.
- 0:22
For his day job, he builds AI agents at Cloudflare. Please join me in welcoming to the stage, Sunil Pai. [upbeat music]
- 0:58
20 minutes to the pub. [audience chuckles] Uh, hi, uh, my name is Sunil Pai. Uh, I work at Cloudflare. Uh, I build agents over there, uh, for the Agents SDK. I'm trying very hard for this not to be a Cloudflare talk, but I think we are on the sponsor board, so that's nice.
- 1:16
Uh, this is a talk about something we call Code Mode. Uh, I've been wearing the hat, uh, and, uh, there's some prior art to it. We don't claim to have invented it, but this is a talk about the implications of something new that we're, we're discovering.
- 1:31
So, um, you guys have built, uh, AI applications, and tool calling gets weird at scale. When it's just a couple of tools and very short runs, it's fine, but the moment you start stuffing in, uh, your Google services, your Jira, your Wiki, et cetera, and you have like hundred, hundreds of tools filling up the context, it starts
- 1:51
breaking. Um, and uh, the composition is weird, and there's this back and forth that you have to do with, uh, the model that's really slow.
- 2:03
Uh, we decided to take a different tact. Instead of doing this JSON back and forth thing, we asked the model to generate code, usually JavaScript, that we could run against an environment.
- 2:18
Uh, and some of the benefits seem a little obvious to us. Uh, with code you get a typed API, you can do type checking, there are syntax errors. Uh, models are trained on gigabytes, if not terabytes of data already in the training set.
- 2:34
Uh, and instead of doing this back and forth, you could write code that executes it all in one run, just one execution.
- 2:43
So, uh, so this is what I mean, like there are f- uh, fundamental capabilities of code. You're able to do looping, you're able to hold state, uh, you're doing sequencing, paralleliz- parallelization, things that you would normally do with code anyway as an engineer.
- 3:01
So the first place we applied this, uh, my colleague Matt Carry, who's actually going to be speaking about this a little more tomorrow, you should watch his talk. Uh, the Cloudflare API surface is about 2,600 API endpoints.
- 3:14
If we exposed a tool for every single one of them, it's about 1.2 million tokens in your first call. Like it just blows. There's no way to create an MCP server for the entire Cloudflare API surface.
- 3:27
And he had a very clever idea where he exposes just two tool calls, uh, search and execute. Both of these endpoints accept code as an input, literally a string of code.
- 3:41
For search, the input to the function that you pass to it is the entire OpenAPI, uh, JSON spec. And once it does that execute gives, gives you a whole bunch of functions that you can call against the things that you called.
- 3:55
And it reduced that 1.2, 1.5 million token thing down to 1,000 tokens. Kind of unheard of. I think it's like 99.9% reduction. Uh, this is gonna be scary. I actually ha- I have a live demo of this, and, um, demos don't usually do me well on stage.
- 4:12
But, uh, but the point being that we were able to take a wide, super wide API surface and make it incredibly fast.
- 4:21
Uh, the prompt itself can be, uh, fairly generic. So I should have kicked up the font size on this one. The prompt here is, as a customer you come in and say, "We are getting DDoS-ed.
- 4:34
I want you to find every offending IP that's like attacking us and block them."
- 4:41
In a moment of panic when your website is going down, you don't have the time to do menu diving. Uh, the Cloudflare dashboard is famously a little cumbersome to handle.
- 4:53
Uh, and you just want the thing done, and you can't even get an A, it's like 3:00 in the morning.
- 4:59
Uh, with a regular MCP thing, and this isn't even talking about stuffing 1.2 million tokens, it would be about eight round trips to do each of those API calls.
- 5:09
Instead, the model can generate this string of code, run it immediately right next to the API surface and do it in one shot. And it's just running JavaScript. It's just functions and, um, just things that you're exposing on the API surface.
- 5:29
Okay, live demo. This is a demo of our mythical server. Uh, I hope I'm logged in because if I'm not, I'll need all of you to close your eyes while I enter a password.
- 5:39
Let's say I just want to like list my workers.
- 5:46
Oh, there it is. List my workers. I say send.
- 5:50
Oh, uh, okay, and there's no password required. [audience chuckles] Okay, fine. That's fine. Okay, I give it only read-only access for this demo.
- 5:56
Uh, do the thing. Yes, allow. Sure, whatever.
- 6:00
Ba, ba, ba, ba, ba. Nice. Okay, it comes back. And, uh, you'll see it'll start executing tool calls. I should be able to open this up. It has sent- Saying, "Hey, find me all API endpoints that just say the words list workers," or something like that.
- 6:15
Uh, it then runs code, uh, which, hey, yeah, it's like one single request for the API endpoint to get all the workers. Uh, it must have received a whole bunch of these.
- 6:27
It's actually going through JavaScript errors now. This is gonna be fun to see if it actually succeeds. [laughs]
- 6:35
Yikes. Or is it trying to do it like per p- It's trying to paginate through the thing. Assume that this worked anyway, and I'll keep talking while it does this. [laughs]
- 6:46
Uh, love that this is happening to me on stage because I did test it 10 times before coming on. Uh, I need to pay for the Mythos, uh, uh, model to make this work accurately. [laughs]
- 6:58
Uh, by the way, you can actually see it is actually, like, listing workers over here. It might just be having trouble, uh, rendering it over here. Um, the point being, uh, we are able to shrink that down.
- 7:08
Now, if this was a talk about optimizing MCP servers, I would be done and dusted. I was like, "Hey, you should throw this, and trust me, it works when you're not staring at it and have 800 people looking at you on the stage."
- 7:20
But it did give us an idea that there's something deeper going on here. The ability to, like, run this code and, uh, feels like there's a new way of interacting with systems, with LLMs.
- 7:35
Um, here's what I think. Like, everyone here is a programmer, and I give you a problem statement like, "You have 200 photos on your desktop. I need you to categorize and rename them."
- 7:48
First thing you do is you lo- you're going to open up an ID. You're going to write a little script. Maybe you're going to pass every image to a vision model now because you get a nice caption for it.
- 7:56
Uh, rename it, and you're done and dusted. That is how you interact with systems. Uh, my mother's not going to do this. Her options are to, well, call me up or usually, like, buy an app, either a desktop, phone.
- 8:09
And no one's made an app that does exactly just that. There's going to be, like, lowest common denominator apps for photo management, and it's $7 a month. And for some reason, you have to install a daemon which is stealing your crypto or some such stuff.
- 8:24
Uh, and there's been this dichotomy, and it's fine. Like, until now, this has been an acceptable, uh, this has been an acceptable trade-off that non-technical people will have custom-made interfaces built for their needs and desires.
- 8:39
LLMs are breaking this boundary. They... Every human being on the planet now has access to a buddy that can spit out code that can interact with systems. Uh, it takes, it takes a line like, "Rename these files by date and location," and generates code and can run it on your, uh, on whatever system you expose to it.
- 9:03
Uh, I say executed safely here, and that's the bit that I do want to talk about in a minute. The other example I have, so this is Kenton. Kenton is the creator of Cloudflare Workers.
- 9:12
Uh, famously, I'm... So he does the work, and I like taking credit for his work. This is our relationship in the company. Uh, so he, he had a thread a little while ago where he built, he's built a little vibe coding environment for himself because no one else does that in the world right now.
- 9:27
So unique. Build your own little vibe coding thing. Uh, the, the thing he asked it to generate was a canvas, one of these TL Draw, Excalibur style canvases. Uh, and it did it.
- 9:40
It did a little canvas with little brushes and colors. And the first thing Kenton did was draw a Tic-Tac-Toe board on it with a little X in the corner.
- 9:48
This is the finished state, and I'll get to that in a second. He did that,
- 9:52
and, uh, what he told the model then is, "I want you to play Tic-Tac-Toe with me." The model, as you can guess, it started generating a Tic-Tac-Toe app. Okay?
- 10:05
Kenton stopped it immediately. He's like, "Nope. You have access to the entire state of the system." And the state of the system here is an array of strokes. You know, like, just a whole bunch of points, grid line, grid line, X stroke, et cetera.
- 10:21
He said, "Inspect that and play it with me."
- 10:26
Uh, immediately, the model started. It output the state into its own context, and it's like, "I recognize what this looks like. It looks like a Tic-Tac-Toe board, and I can see that you put an X in the top left.
- 10:40
Let me draw a perfect circle in the middle of the app." To be clear, there is no Tic-Tac-Toe code anywhere in the system. The, the emergent behavior is that the model has, like, sure, I now know how to interact with the system with a set of strokes.
- 10:57
Uh, also, it lost. Uh, by the way, it lost the game, and then when we saw the reasoning traces, we noticed that Opus let Kenton win. [laughs] Which is a whole other weird area of alignment we're not talking about.
- 11:10
Anyway, so this actually generated a lot of conversation internally, and that's why, like, this talk is a little weird. It's a little woo-woo. I'm not even sure where we are going, and I want to, like, spread the idea to you and have you folks, like, uh, integrate it.
- 11:21
So the, the phrase we have started using is it stopped generating a program, and it instead started inhabiting the state machine. Uh, there's a Ghost in the Shell reference here.
- 11:31
For anyone who's over the age of [REDACTED:age], you need ibuprofen, uh, you should go back home. Uh, but no, like, it, it was a very strange thing to, for us not to have a separate app generation stage that you then, like, interact with.
- 11:43
That is entirely the part of the thing. So what does this new software architecture look like? Uh, everyone's building what they call a harness. Uh, it's because over the last three to six months, everyone has realized that these coding agents are great general purpose computing machines.
- 12:00
It's why they're running Cloud code. Cloud code? No, they're running Pi on a Mac Mini, which is the wrong machine for this, by the way. You don't have to spend $400 for a thing that makes API calls.
- 12:09
Uh, it's been driving me mad. If you check all the secondhand prices of Mac Minis have, like, shot up. I got one before it, but I bought it because I'm special that way.
- 12:17
Uh, you b- everyone's building this harness, and this architecture of the harness is not just that it can generate code, but it has a safe space to execute this code into which capabilities are, uh, exposed.
- 12:31
Uh, and there are some attributes to this sandbox. We're calling it a sandbox, which is again, another completely overloaded term, and I have friends in the industry, everyone's building a different kind of sandbox.
- 12:42
Uh, we have a sandbox SDK which uses containers and VMs, but that's not even what I'm talking about right now. Um, there are some capabilities to it. Unlike a container, which comes with all sorts of features that you surround with security, you know, you do a bunch of things from the outside, you start with something that has
- 12:59
no capabilities. The only thing it can do is execute code. It can't do fetches. There's no exposed APIs, no nothing. And then you grant capabilities to it explicitly. Uh, we have something called dynamic workers.
- 13:12
I told you, um, it's not really a Cloudflare code. Someone else build something better if you think it's better, it's fine. Uh, but this is what we use. We use V8 isolates because they start up really, really quickly, and, uh, it's about 10 years of security hardening.
- 13:25
Uh, it's in our DNA. We ca- we care a lot about that. Anyway, so we-- you start exposing capabilities as APIs, A, and we also can control all outgoing fetches and any network connections.
- 13:37
In fact, the default way we recommend you use this is no outgoing fetches, only APIs. It has to be fast, and you need absolute full observability into it. You need to know why last Tuesday it made a trade for $2.3 million for, I don't know, man, like llama poop or something, right?
- 13:54
You need to go back to that code. You need absolute observability on these systems. It can be V8 isolates like we use. Uh, you could use, I don't know, a web as- WebAssembly, a custom JavaScript interpreter.
- 14:07
Uh, that's not the main story here. You just want something that's able to execute, that you're able to expose capabilities to and run really quickly. From here, you can start getting really ambitious.
- 14:17
The example that I showed you was a one-off, take some code, run it on an API, expand. Now, what if you could ex- uh, generate long-running workflows that run for days, months, years?
- 14:30
Uh, what if each of those instances has some state that it can carry with it, uh, through, um, through its lifetime? What if, in this world of generative UI, you can start generating a perfect, perfectly custom UIs for every single user that you have?
- 14:50
Everyone who does e-commerce knows this problem. The more popular you get, the more UI becomes this bland thing that has to work for every single user. And then you bring in the ML people and like, "Oh, what if we change the color button this way if it's somebody else?"
- 15:04
No. You can go absolutely custom. So, um, I, I, I like the fact that I got Opus to generate generative UI for a slide where I'm making a point about generative UI, and it still looks a little bit like shit.
- 15:18
Uh, but the idea is everyone-- Like ecom-- Uh, let me talk about that e-commerce. Like you have context about everything about the user, the things they like, the orders they have in their cart, the things that might be making them mad.
- 15:29
You can surface these things as actions. The UI doesn't have to be a blank chat box, though honestly, blank chat box e-commerce might be a lot of fun. Uh, h-here I have two different use cases.
- 15:40
In the first one, it's, uh, I need to return these shoes and find something similar under $100. If the product engineers have not implemented this, how are-- it's go- it's going to kind of suck and s- but you can generate something on the fly versus what is happening with my, uh, delayed order.
- 15:58
Point being, we are now in a world where we can generate completely different programs backed by a system that you built on your back end for every single user.
- 16:07
It's a new kind of software we're building. And this harness idea isn't just built into the product. A lot of people are finding power by running the harness closer to the user simply because then they get to start mashing up all their different services.
- 16:22
This is an anti-Cloudflare talk at this point. I'm like, you should be running the software on your iPhone, like not so much on our servers. Please run it on our servers.
- 16:30
Uh, but you-- But there you start getting to stitch together different systems in this safe environment, and you get to do it on a task-by-task basis.
- 16:41
Um, I put this in here because I'm a React programmer, and I don't want to freak out the React people by saying no one really wants to build UI anymore.
- 16:48
But really, it's a hearkening back to rethinking everything that we have thought about UI and for this new age. I keep thinking about it as part of the tech tree we have not really explored for thirty years because eval wasn't around, but now we have a safe eval, and we have these things that generate code for you.
- 17:06
But you do need to be in a place where you understand that your next billion users are these little robots that are generating code for you. To be clear, your customers are still humans, but things interacting with your systems, uh, if you really love your users, you need to find out where they hang out.
- 17:23
And they don't hang out in the pub. They hang out in registries. They dream in types and syntax errors, you know? Uh, you need to be thinking about what is the developer experience for these agents.
- 17:35
This is something a bunch of companies are already doing really well, by the way. You know? Docs which are marked down, uh, errors that let the agent know what to do next, uh, discoverability via search.
- 17:46
Uh, the big one that I do want to talk, that I want you to
- 17:50
embed in your head, I guess, is this idea of capability-based security.
- 17:55
This isn't even a JavaScript talk. It can be in Python. It can be in WASM. Uh, I hope it brings a resurgence of Lisp. It's how I kind of learned how like ASTs work.
- 18:05
It kind of breaks your brain. Uh, but the, but the attributes are still very much the same, events, sandboxing, capability-based security, embeddable so that it's really fast to start up and run ephemerally.
- 18:18
Uh, React programmers simply be-- Well, UI programmers, simply because they have so much, uh, they've been so close to users, I suspect that they'll do particularly well here, and that feels really good to me, by the way.
- 18:29
I feel happy about it. So to end,
- 18:33
for the longest time, programmers like us, we got code. We had infinite power to interact with any system that we could and complain about it on Twitter because our documentation isn't have the right CSS or something.
- 18:48
JavaScript programmers, super entitled, by the way. Uh, everyone else got buttons and forms. That distinction in breaking. In a world like this, you need to let the code do the talking.
- 18:58
The code is the thing that interacts with all your systems. Uh, come talk to me about it at the pub. Like, this is like, it feels like it's opening up a whole new area of research for us, uh, and we have a lot of ideas, and I get to finish my talk and the day with six seconds
- 19:13
left. How good is that? [audience laughing] Thank you very much. Appreciate it. [audience applauding] [upbeat music]