Extensible AI assistant for Datasette that converts natural language to SQLite queries and charts via plugin system; runs on Gemini 3.1 Flash-Lite or local models like gemma-4-26b.
Eliminates manual SQL writing for data exploration workflows. Plugin architecture lets you inject domain-specific tools (image generation, code execution, charting) without forking core—critical for teams building on Datasette infrastructure.
Replaces manual SQL + charting workflows for Datasette users. Requires Datasette instance + Claude/OpenAI/local LLM with reliable tool calling. Ready now for exploration; production viability depends on query reliability against your schema. Start with the live demo at agent.datasette.io to validate behavior.
“Datasette Agent provides a conversational interface for asking questions of the data you have stored in Datasette”
“Add the datasette-agent-charts plugin and it can generate charts of your data as well”
“The live demo runs on Gemini 3.1 Flash-Lite—it's cheap, fast and has no trouble writing SQLite queries”
“like the rest of Datasette, it's extensible using plugins”
“Claude Code and OpenAI Codex are both proving excellent at writing plugins”
Get issues like this in your inbox — free, every weekday.
Quick Signals
GitHub Copilot shifts usage-based billing June 1st
Pro gets $15/month included usage ($10 base + $5 flex), Pro+ gets $70 ($39 base + $31 flex), new Max tier adds $200/month for sustained agent work; code completions remain unlimited.
If you run long agent chains or multi-step workflows, the flex allotment cushions overage risk without manual credit management. Base credits stay fixed 1:1 with subscription price—only flex varies as model costs shift, so you know your floor cost.
This replaces flat-rate Pro/Pro+ plans with metered billing. Requires zero action if on monthly plans (auto-migrates June 1st). Worth adopting now only if you currently hit usage ceilings; otherwise audit your actual consumption before upgrading to Max. The flex buffer buys runway, but no public benchmarks yet on whether $15 or $70 covers real agent workloads.
“Longer agent runs, multi-step work, and more capable models will all put pressure on the usage amounts”
“Base credits: matched 1:1 with your subscription price. These never change.”
“Flex allotment: variable additional usage on top of your base. Flex allotments will vary over time.”
“Code completions and next edit suggestions remain unlimited on paid plans and don't consume credits.”
Supabase adds PrivateLink, Claude connector, Postgres rules
PrivateLink routes AWS traffic through VPC without internet exposure; Claude connector enables direct database management via natural language; 30-rule Postgres ruleset teaches AI agents correct SQL patterns.
Data Point
HealthCraft measures LLM safety collapse under clinical pressure
RL environment with FHIR R4 state and dual-layer safety rubric exposes that frontier models fail multi-step workflows (Claude 1.0%, GPT-5.4 0.0%) despite partial single-step competence.
Static QA benchmarks miss failure modes that matter in production medical workflows—trajectory-level safety collapse and tool misuse under sustained pressure. Developers deploying clinical LLMs now have a measurement harness that catches what reaches real patients, not abstract accuracy.
Replaces toy medical QA evals with realistic multi-step task chains (195 tasks, 2,255 binary criteria, 515 safety-critical). Requires FHIR R4 integration, MCP tool support (24 exposed), and deterministic LLM-judge overlay for evaluator noise control. Ready to pilot now—code, tasks, Docker bundle released under Apache 2.0—but training-reward signal is not production-safe yet per authors' own 0.929 prevalence gameability finding. Use for benchmarking before deployment; training ablations pending.
“the first public reinforcement-learning environment that rewards trajectory-level safety under realistic emergency-medicine conditions”
“performance collapses to near zero (Claude 1.0%, GPT-5.4 0.0%) despite partial competence on individual steps”
“safety-failure rates of 27.5% and 34.0%”
“the reward signal is not drop-in training-safe: restraint criteria pass at 0.929 prevalence, a gameability an eval harness can tolerate but a training reward cannot”
“Environment, tasks, rubrics, and harness are released under Apache 2.0”
Eliminates public internet egress for sensitive workloads, reduces network configuration complexity. AI-native database tooling (Claude, Copilot) now ships with guardrails, reducing invalid schema mutations and permission leaks in agent-driven development.
PrivateLink replaces NAT gateway + bastion patterns; requires AWS VPC Lattice setup. Claude connector requires Supabase project + Claude API key—ready now. Postgres ruleset is reference material, not executable, requires manual enforcement or linting integration. Worth evaluating PrivateLink if you have AWS infrastructure; Claude connector worth a test if you're already Claude-heavy.
“Connect your database to AWS resources over private networks. No public internet exposure. Traffic stays within AWS infrastructure using VPC Lattice.”
“30 rules across 8 categories teaching AI agents to write correct Postgres code. Works with Claude Code, Cursor, GitHub Copilot, and other tools.”
“Supabase is now an official Claude connector”
“pg_graphql disabled by default on new projects. Ships mid-February.”
Gemini Omni Flash generates video from multimodal input
Conversational video editing and generation via text prompts on images, audio, and video references—now in Gemini app and Google Flow.
Replaces manual video editing workflows with natural language instructions that maintain character consistency and physics across multi-turn edits. Developers building content generation APIs can now reference this native multimodal capability.
Flash model is live in Gemini app, Google Flow, and YouTube Shorts today. Supports image/audio/video input with video output; image and audio output modalities coming later. Worth testing now for prompt engineering patterns, but production integration depends on API availability and rate limits (not specified in announcement).
“Omni is our new model that can create anything from any input — starting with video”
“With Omini, you can combine images, audio, video and text as input and generate high-quality videos”
“we're rolling out the first model in the Omni family: Gemini Omni Flash, to the Gemini app, Google Flow and YouTube Shorts”
“Edit your videos through conversation”
“Omni has an improved intuitive understanding of forces like gravity, kinetic energy and fluid dynamics”
Node.js patches nine vulnerabilities across active releases
Two high-severity TLS/HTTP flaws can crash production servers; requires immediate updates to 20.x, 22.x, 24.x, 25.x.
CVE-2026-21637 incomplete fix and __proto__ header handling affect any TLS server or HTTP server receiving untrusted input—both bypass error handlers entirely, making them unrecoverable without process restart. The HMAC timing oracle and HashDoS in JSON.parse() widen attack surface for cryptographic forgery and DoS.
Update to Node.js v20.20.2, v22.22.2, v24.14.1, or v25.8.2 immediately if running TLS or HTTP servers. No configuration changes needed—patches are transparent. Permission Model users should also address UDS and fs.realpathSync.native() bypasses. Do not defer: both high-severity flaws crash processes on unexpected input.
“Incomplete fix for CVE-2026-21637: loadSNI() in _tls_wrap.js lacks try/catch leading to Remote DoS (CVE-2026-21637) - (High)”
“This security release includes the following dependency updates to address public vulnerabilities: undici (6.24.1, 7.24.4) on 22.x, 24.x, 25.x”
“2 high severity issues. 5 medium severity issues. 2 low severity issues.”
“When an SNICallback throws synchronously on unexpected input the exception bypasses TLS error handlers and propagates as an uncaught exception, crashing the Node.js process.”
“When this occurs, dest["__proto__"] resolves to Object.prototype rather than undefined, causing .push() to be called on a non-array.”
Lock down AI agents with token and filesystem isolation
AI agents run with your user permissions—use short-lived tokens, secret managers, and sandboxes (Claude /sandbox, Docker, or bubblewrap) to contain blast radius.
Agents can read SSH keys, push to remotes, hit production APIs, and execute shell commands with your full permissions. Credential leaks and destructive commands become operator error, not agent failure. Isolation and minimal scopes shift the risk model from 'trust the agent' to 'contain the agent.'
Replaces: permissive agent configs and plaintext credential files. Requires: 15 minutes to add .env deny patterns and rotate tokens to read-only; 30 minutes to enable Claude /sandbox or Docker isolation. Worth starting now—these are operational baselines, not nice-to-haves. Prioritize secret manager migration (Doppler/1Password CLI) and MCP token scoping first.
“They run with your permissions — which means anything you can do, they can do, including things you would never deliberately do.”
“Default to read-only tokens. Most agent work doesn't need write access.”
“Use read-only API tokens in local .env files — never admin or read-write credentials.”
“Agents have full read/write access to your filesystem by default. They can read SSH keys, cloud credentials, browser data, and any file your user account can access.”
“Don't use --dangerously-skip-permissions on macOS outside a Docker container or VM.”
“For long-running autonomous tasks, sandbox first, then use --dangerously-skip-permissions inside the sandbox only.”