Fetching from the wire…
01
02
03
04
05
06
07
08
Tools2026-06-19 · source-backed
Willison launched datasette-apps (0.1a2) on June 18, hosting self-contained HTML+JS apps in a sandboxed iframe that run SQL against your data, read-only by default. He frames it as "Claude Artifacts reimagined for Datasette," artifacts backed by a JSON API to a relational database instead of ephemeral state. The plugin has no LLM dependency, but the create-app form ships a copyable prompt pre-loaded with your schema so a model can one-shot a working data app. It's a concrete pattern for turning throwaway LLM artifacts into persistent, data-backed internal tools. The Anthropic and Willison releases landing the same day, both solving the artifact-persistence problem, is not a coincidence.
Each link below shares sources, entities, or timing with this story.
Simon Willison shipped a Datasette plugin that hosts custom HTML applications inside Datasette, with CSP-based sandboxing aimed specifically at safely running AI-generated apps. It's a concrete answer to "where do I put the HTML my agent just wrote": server-rendered, sandboxed...
Simon Willison shipped the fix August 6 and back-ported to 0.65.3: instances serving both public and private tables from one database let public-table users inject SQL and gain read access to private tables, defeating the permission system even with execute-sql disabled. Willi...
His conclusion is DuckDB matches or beats SQLite's safety for untrusted queries, but only with enable_external_access=false, lock_configuration=true, and a watchdog thread, since DuckDB lacks SQLite's opcode-based query timeouts. He ships a safe_duckdb.py helper and a Datasett...
Prompted by Julia Evans admitting on July 17 that she still can't read query plans, Willison had Fable build a tool that runs arbitrary SQL against a SQLite database and renders both EXPLAIN QUERY PLAN and the lower-level EXPLAIN bytecode with per-line plain-English annotation...
Anthropic shipped Fable 5 on June 9. Willison spent ~5.5 hours stress-testing it: slow and expensive, but it handled everything he threw at it, including agentic coding. (Simon Willison) The tell that it's a real working model and not a benchmark queen: because it post-dated A...
Willison's June 13 post walks through publishing WebAssembly wheels to PyPI so Python packages run client-side under Pyodide, alongside Datasette 1.0a33 adding JSON "extras" to the API (Simon Willison). He built a throwaway extras-API explorer with Claude Fable 5 to understand...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.