Zum Hauptinhalt springen
Echtzeit-Radar & Feeds
Alle RSS Feeds ➔
👥 Community & Social
Windows Tipps & SecurityGrafikkarte vor Überhitzung schützen: So geht’s(25.09.2026 um 08:00 Uhr)
••••••••••
Windows Tipps & SecurityGrafikkarte vor Überhitzung schützen: So geht’s(25.09.2026 um 08:00 Uhr)
••••••••••
Intelligence View
⚡ tsecurity.de Intelligence

How We Built a Full-Featured AI Chat UI in 33KB with Zero Frameworks

When we set out to build a web interface for Pi Coding Agent, we made a deliberate choice: no React, no Vite, no TypeScript, no build step. Just vanilla HTML, CSS, and JavaScript. Here's what we learned building a production-quality…

0
↗ Quelle (dev.to)
Reagiere als Erste:r — dein Feedback zählt!

When we set out to build a web interface for Pi Coding Agent, we made a deliberate choice: no React, no Vite, no TypeScript, no build step. Just vanilla HTML, CSS, and JavaScript.



Here's what we learned building a production-quality real-time chat UI the old-fashioned way.






The Architecture



Everything lives in two files:





  • public/index.html — the entire frontend (HTML + CSS + JS in one file)


  • server.js — Express server with WebSocket support



Pi runs as a subprocess in RPC mode. The server bridges browser WebSockets to Pi's RPC protocol. Messages flow like this:




Browser → WebSocket → Server → Pi RPC → Server → WebSocket → Browser









Event-Driven State Management



Instead of React's state management, we use a single handleEvent() function that processes all WebSocket messages:




function handleEvent(data) {
switch (data.type) {
case "status": ...
case "message_start": ...
case "message_token": ...
case "message_end": ...
case "agent_end": ...
}
}






Each event updates the DOM directly. It's simple, fast, and easy to debug.






Message Queueing



One of our favorite features: you can keep typing while Pi is still responding. The server sends queued messages to Pi with streamingBehavior: "followUp", and Pi processes them in order natively.






Why No Framework?



Honestly? Speed of development. We could make changes, refresh, and see results instantly. No hot reload to wait for, no bundle to rebuild, no component tree to reason about. Just HTML elements and event handlers.






The Result




  • 33KB total package size

  • 4 npm dependencies


  • npx wgnr-pi to install and run

  • Full features: streaming, sessions, model picker, thinking levels, images, export



Sometimes the best framework is no framework.



GitHub: https://github.com/wgnr-ai/wgnr-pi

npm: https://www.npmjs.com/package/wgnr-pi``

1. Sofort-Triage & Abwehrmaßnahmen

SOC Incident Playbook: Vulnerability Remediation & Verification
Syntax validiert (0 Fehler)
title: Detect Exploitation - How We Built a Full-Featured AI Chat UI in 33KB with Zero Frameworks
id: 2c1ebb0a-7eb8-4769-ab5d-1c457c3a2fd7
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-25
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access
Syntax validiert (0 Fehler)
rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-25"
        description = "YARA Signature for "
    strings:
        $str = "How We Built a Full-Featured A" ascii wide
    condition:
        any of them
}
Syntax validiert (0 Fehler)
index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("How We Built a Full-Featured AI Chat UI ")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count
Syntax validiert (0 Fehler)
message: "*How We Built a Full-Featured AI Chat UI *"
Syntax validiert (0 Fehler)
CommonSecurityLog
| where Message has "How We Built a Full-Featured AI Chat UI "
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc

2. Cyber Threat Intelligence & Forensik

🎯
MITRE ATT&CK Matrix Navigator 14 Taktiken
Reconnaissance
-
Resource Development
-
Initial Access
Execution
Persistence
-
Privilege Escalation
Defense Evasion
Credential Access
-
Discovery
-
Lateral Movement
-
Collection
-
Command and Control
Exfiltration
-
Impact
tsecurity.de Cognitive Threat RAG
Fokus-Vektor:

Kognitive Analyse für identifizierte Bedrohung: Erhöhte Bedrohungslage im Bereich How We Built a Full-Featured AI Chat UI .... Basierend auf 368k Vektor-Korrelationen werden sofortige Isolationsmaßnahmen für betroffene Endpunkte empfohlen.

🛡️ Angriffsfläche & Exposure

Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.

⚡ Empfohlene Sofortmaßnahmen
  • 1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
  • 2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
  • 3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.
🔗 Semantisch verwandte Zero-Days MariaDB 11.7 VEC
Ähnliche Beiträge
🔍 Verwandte News

Auch interessante Nachrichten How We Built a Full-Featured AI Chat UI in 33KB with Zero Frameworks

Thematisch verwandte Begriffe: Built, FullFeatured, Chat, 33KB · 6 Treffer

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Zum Aktualisieren ziehen
ZERO-DAY CVE-2026-97898 | Insecure Direct Object Reference / missing object-level authorization in…
Advisory →
tsecurity.de Icon
Offline-Lesen, Eilmeldungen & 0ms Ladezeit

Installiere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.

Nächster Beitrag