Telexed

AI news through a solo-operator lens — only what changes your day3 of 412

FILTER[All][Agents & tools][Models & API][Generative media][Infra & SaaS][ASO & growth][Indie business][Idea signals][Other][★6+ high-signal]

Simon Willison ✕clear filters

Fri, May 151 dispatches

#0412
#0412Other Simon Willison5 days ago
`datasette-llm-limits` `0.1a0` adds per-user LLM spend caps
40radar
DatasetteOpen-source data publishing tool — strong plugin extensibility
LLM usage inside Datasette can now be hard-capped by user or globally with rolling windows and USD limits. Useful if you expose prompts to users; otherwise the impact is narrow but the cost-control pattern is worth copying.
- Works with datasette-llm and datasette-llm-accountant, so enforcement sits on top of existing usage tracking.
- Config supports per-user or global limits, with windows like rolling-24h and explicit amount_usd caps.
- Example policy sets $1.00 per actor over 24 hours, which is a clean template for metered AI features.
- Best fit is multi-user internal tools or lightweight SaaS surfaces where prompt access needs a hard budget guardrail.
Source: simonwillison.net/2026/May/15/datasette-llm-limits/#atomRead original →
40radar
PHOTO
FIG-4121:1

Wed, May 132 dispatches

#0411
#0411Other Simon Willison7 days ago
`CSP Allow-list Experiment`: Interactive `fetch()` Recovery Inside Sandboxed `iframe`s
40radar
A sandboxed iframe can catch blocked fetch() attempts, ask the parent to whitelist the origin, then reload with updated connect-src. Useful pattern for shipping safer user-script sandboxes without hardcoding every API upfront.
- Runs apps under default-src 'none' in a sandboxed iframe, then escalates blocked network origins to the parent for approval.
- Blocked fetch() calls surface the exact failed origin, so users can add only that domain to connect-src instead of loosening CSP broadly.
- The flow includes prompt, allow-list update, and refresh, turning CSP failures into a usable permission UX rather than a dead end.
- Good fit for code playgrounds, HTML preview tools, and user-generated app builders where external API access is needed but must stay constrained.
Source: simonwillison.net/2026/May/13/csp-allow/#atom-everythingRead original →
FIG-4111:1
40radar
FIG-4111:1
#0410
#0410Other Simon Willison7 days ago
`datasette` `1.0a29` fixes a nasty test race and smooths zero-row/mobile UX
40radar
DatasetteData tool — web app for exploring and publishing SQLite
A thread-safety bug that could segfault tests is now fixed, alongside small but practical UI cleanup for empty tables and Mobile Safari. Useful if you embed datasette in admin tools or data products, but not a broad market-moving release.
- Datasette.close() had a race with in-flight threaded queries and could trigger a segfault in tests; that class of bug is expensive to debug once it hits CI.
- Empty tables now still show headers and column options, so schema-first browsing works even with 0 rows.
- Mobile Safari column action dialog rendering was fixed, removing one of the more annoying iPhone/iPad admin UI papercuts.
- A new TokenRestrictions.abbreviated(datasette) helper generates "_r" dictionaries, which matters mainly for plugin and internal API users.
Source: simonwillison.net/2026/May/12/datasette/#atom-everythingRead original →
40radar
PHOTO
FIG-4101:1

`datasette-llm-limits` `0.1a0` adds per-user LLM spend caps

`CSP Allow-list Experiment`: Interactive `fetch()` Recovery Inside Sandboxed `iframe`s

`datasette` `1.0a29` fixes a nasty test race and smooths zero-row/mobile UX