Simon Willison's Weblog: jinja

Claude Code for web - a new asynchronous coding agent from Anthropic

2025-10-20T19:43:15+00:00

Anthropic launched Claude Code for web this morning. It's an asynchronous coding agent - their answer to OpenAI's Codex Cloud and Google's Jules, and has a very similar shape. I had preview access over the weekend and I've already seen some very promising results from it.

It's available online at claude.ai/code and shows up as a tab in the Claude iPhone app as well:

As far as I can tell it's their latest Claude Code CLI app wrapped in a container (Anthropic are getting really good at containers these days) and configured to --dangerously-skip-permissions. It appears to behave exactly the same as the CLI tool, and includes a neat "teleport" feature which can copy both the chat transcript and the edited files down to your local Claude Code CLI tool if you want to take over locally.

It's very straight-forward to use. You point Claude Code for web at a GitHub repository, select an environment (fully locked down, restricted to an allow-list of domains or configured to access domains of your choosing, including "*" for everything) and kick it off with a prompt.

While it's running you can send it additional prompts which are queued up and executed after it completes its current step.

Once it's done it opens a branch on your repo with its work and can optionally open a pull request.

Putting Claude Code for web to work

Claude Code for web's PRs are indistinguishable from Claude Code CLI's, so Anthropic told me it was OK to submit those against public repos even during the private preview. Here are some examples from this weekend:

Add query-string-stripper.html tool against my simonw/tools repo - a very simple task that creates (and deployed via GitHub Pages) this query-string-stripper tool.
minijinja vs jinja2 Performance Benchmark - I ran this against a private repo and then copied the results here, so no PR. Here's the prompt I used.
Update deepseek-ocr README to reflect successful project completion - I noticed that the README produced by Claude Code CLI for this project was misleadingly out of date, so I had Claude Code for web fix the problem.

That second example is the most interesting. I saw a tweet from Armin about his MiniJinja Rust template language adding support for Python 3.14 free threading. I hadn't realized that project had Python bindings, so I decided it would be interesting to see a quick performance comparison between MiniJinja and Jinja2.

I ran Claude Code for web against a private repository with a completely open environment (* in the allow-list) and prompted:

I’m interested in benchmarking the Python bindings for https://github.com/mitsuhiko/minijinja against the equivalente template using Python jinja2

Design and implement a benchmark for this. It should use the latest main checkout of minijinja and the latest stable release of jinja2. The benchmark should use the uv version of Python 3.14 and should test both the regular 3.14 and the 3.14t free threaded version - so four scenarios total

The benchmark should run against a reasonably complicated example of a template, using template inheritance and loops and such like In the PR include a shell script to run the entire benchmark, plus benchmark implantation, plus markdown file describing the benchmark and the results in detail, plus some illustrative charts created using matplotlib

I entered this into the Claude iPhone app on my mobile keyboard, hence the typos.

It churned away for a few minutes and gave me exactly what I asked for. Here's one of the four charts it created:

(I was surprised to see MiniJinja out-performed by Jinja2, but I guess Jinja2 has had a decade of clever performance optimizations and doesn't need to deal with any extra overhead of calling out to Rust.)

Note that I would likely have got the exact same result running this prompt against Claude CLI on my laptop. The benefit of Claude Code for web is entirely in its convenience as a way of running these tasks in a hosted container managed by Anthropic, with a pleasant web and mobile UI layered over the top.

Anthropic are framing this as part of their sandboxing strategy

It's interesting how Anthropic chose to announce this new feature: the product launch is buried half way down their new engineering blog post Beyond permission prompts: making Claude Code more secure and autonomous, which starts like this:

Claude Code's new sandboxing features, a bash tool and Claude Code on the web, reduce permission prompts and increase user safety by enabling two boundaries: filesystem and network isolation.

I'm very excited to hear that Claude Code CLI is taking sandboxing more seriously. I've not yet dug into the details of that - it looks like it's using seatbelt on macOS and Bubblewrap on Linux.

Anthropic released a new open source (Apache 2) library, anthropic-experimental/sandbox-runtime, with their implementation of this so far.

Filesystem sandboxing is relatively easy. The harder problem is network isolation, which they describe like this:

Network isolation, by only allowing internet access through a unix domain socket connected to a proxy server running outside the sandbox. This proxy server enforces restrictions on the domains that a process can connect to, and handles user confirmation for newly requested domains. And if you’d like further-increased security, we also support customizing this proxy to enforce arbitrary rules on outgoing traffic.

This is crucial to protecting against both prompt injection and lethal trifecta attacks. The best way to prevent lethal trifecta attacks is to cut off one of the three legs, and network isolation is how you remove the data exfiltration leg that allows successful attackers to steal your data.

If you run Claude Code for web in "No network access" mode you have nothing to worry about.

I'm a little bit nervous about their "Trusted network access" environment. It's intended to only allow access to domains relating to dependency installation, but the default domain list has dozens of entries which makes me nervous about unintended exfiltration vectors sneaking through.

You can also configure a custom environment with your own allow-list. I have one called "Everything" which allow-lists "*", because for projects like my MiniJinja/Jinja2 comparison above there are no secrets or source code involved that need protecting.

I see Anthropic's focus on sandboxes as an acknowledgment that coding agents run in YOLO mode (--dangerously-skip-permissions and the like) are enormously more valuable and productive than agents where you have to approve their every step.

The challenge is making it convenient and easy to run them safely. This kind of sandboxing kind is the only approach to safety that feels credible to me.

Update: A note on cost: I'm currently using a Claude "Max" plan that Anthropic gave me in order to test some of their features, so I don't have a good feeling for how Claude Code would cost for these kinds of projects.

From running npx ccusage@latest (an unofficial cost estimate tool) it looks like I'm using between $1 and $5 worth of daily Claude CLI invocations at the moment.

Tags: armin-ronacher, jinja, sandboxing, security, ai, prompt-injection, generative-ai, llms, anthropic, claude, coding-agents, claude-code, lethal-trifecta, async-coding-agents, disclosures

MiniJinja: Learnings from Building a Template Engine in Rust

2024-08-27T15:47:19+00:00

MiniJinja: Learnings from Building a Template Engine in Rust

Armin Ronacher's MiniJinja is his re-implemenation of the Python Jinja2 (originally built by Armin) templating language in Rust.

It's nearly three years old now and, in Armin's words, "it's at almost feature parity with Jinja2 and quite enjoyable to use".

The WebAssembly compiled demo in the MiniJinja Playground is fun to try out. It includes the ability to output instructions, so you can see how this:

<ul>
  {%- for item in nav %}
    <li>{{ item.title }}</a>
  {%- endfor %}
</ul>

Becomes this:

0   EmitRaw "<ul>"
1   Lookup  "nav"
2   PushLoop    1
3   Iterate 11
4   StoreLocal  "item"
5   EmitRaw "\n <li>"
6   Lookup  "item"
7   GetAttr "title"
8   Emit    
9   EmitRaw "</a>"
10  Jump    3
11  PopFrame    
12  EmitRaw "\n</ul>"

Via @mitsuhiko

Tags: armin-ronacher, jinja, templates, rust, webassembly

Datasette Enrichments: a new plugin framework for augmenting your data

2023-12-01T20:14:50+00:00

Today I'm releasing datasette-enrichments, a new feature for Datasette which provides a framework for applying "enrichments" that can augment your data.

An enrichment is code that can be run against rows in a database table. That code can transform existing data or fetch additional data from external sources, then write that augmented data back to the database.

A good example of an enrichment is geocoding: take a table with an address column, run each address through a geocoding API, then write the resulting location back to latitude and longitude columns on the same table.

Each enrichment is itself a plugin. The Datasette enrichments system is designed to be easily extended with new enrichment types, to serve a wide variety of use-cases.

Demonstrating enrichments

I've made a video demo to demonstrate the new capabilities introduced by this plugin.

The video shows off two enrichments: datasette-enrichments-gpt for running prompts against OpenAI's GPT language models, and datasette-enrichments-opencage for geocoding addresses.

In the video I demonstrate the following:

Uploading a CSV file of Film Locations in San Francisco to create a table
Running the OpenCage geocoder enrichment against those rows to populate latitude and longitude columns
... which results in a map being displayed on the table page using datasette-cluster-map
Applying the GPT enrichment to write terrible haikus about every museum on my Niche Museums website
Extracting JSON with key people and dates from each museum descriptions
Using the GPT-4 Vision API to generate detailed descriptions of photographs displayed on the site

Enrichments so far

I'm releasing four enrichment plugins today:

I've also published documentation on developing a new enrichment.

datasette-enrichments-gpt

The most interesting enrichment I'm releasing today is datasette-enrichments-gpt. This enrichment provides access to various OpenAI language models, allowing you to do some really interesting things:

Execute a prompt against data pulled from columns in each row of a table and store the result
Run prompts against URLs to images using the GPT-4 Vision API
Extract structured data from text

I demonstrated all three of these in the video. Here's how I used JSON object mode to extract JSON structured data for people and years from the museum descriptions, using this prompt:

Return JSON: {"people": [...], "years": [...]}

Each person should be {"name": "...", "bio": "One line bio"}

Each year should be {"year": 1893, "description": "What happened in that year"}

I also ran GPT-4 Vision against images, with the prompt "describe this photo". Here's the description it gave for this photograph from the Bigfoot Discovery Museum:

In the photo, we see an elderly man with a full white beard and glasses, wearing a cap and a blue denim shirt, seated behind a cluttered desk. The desk is strewn with various items including papers, books, and what appears to be works of art or prints. The man seems engaged in conversation or explaining something, mid-gesture with his right hand.

The backdrop is a room filled with bookshelves brimming with books and some items that look like filing organizers, hinting at a vast collection. The shelves are densely packed, giving the space a cozy and somewhat cluttered appearance, likely a reflection of intellectual activity and a personal workspace. Various other items such as a poster and possibly personal memorabilia can be seen on the walls adding to the character of the room.

Overall, the image portrays a scholarly or artistic atmosphere, suggesting that the man could be a collector, a bookstore owner, an academic, or an artist.

datasette-enrichments-opencage

datasette-enrichments-opencage provides access to the OpenCage geocoder.

I really like OpenCage. Many geocoders have strict restrictions on what you can do with the data they return - some of them even prohibit storing the results long-term in a database!

OpenCage avoid this by carefully building on top of open data, and they also financially support some of the open data projects they rely on.

This plugin (and datasette-enrichments-gpt) both implement a pattern where you can configure an API key using plugin secrets, but if you don't do that the key will be requested from you each time you run an enrichment.

datasette-enrichments-jinja

I wanted to launch with an example of an enrichment that can execute arbitrary code against each row in a table.

Running code in a sandbox in Python is notoriously difficult. I decided to use the Jinja sandbox, which isn't completely secure against malicious attackers but should be good enough to ensure trustworthy users don't accidentally cause too much damage.

datasette-enrichments-jinja can execute a Jinja template against each row in a table and store the result.

It's a small but powerful template language, and should prove useful for a number data manipulation tasks.

datasette-enrichments-re2

datasette-enrichments-re2 provides an enrichment that can run a regular expression against a value from a table and store the result.

It offers four different modes:

Execute a search and replace against a column
Extract the first matching result and store that in the specified column (adding a column to the table if necessary)
Extract all matching results and store them as a JSON array in the specified column. If the regular expression uses named capture groups this will be an array of objects, otherwise it will be an array of strings.
Execute a regular expression with named capture groups and store the results in multiple columns, one for each of those named groups

That's quite a lot of functionality bundled into one enrichment! I haven't used this for much yet myself, but I'm looking forward to exploring it further and documenting some useful patterns.

Writing your own enrichment plugin

The most exciting thing about enrichments is what they can unlock in the future.

I've tried to make it as easy as possible for Python developers to build their own enrichment plugins.

The Developing a new enrichment documentation walks through the process of building a new enrichment plugin from scratch.

Enrichments run inside Datasette using Python asyncio. This is a particularly good fit for enrichments that use external APIs, since HTTPX makes it easy to run multiple HTTP requests in parallel.

The -opencage and -gpt enrichments are two examples of enrichments that use HTTPX.

Interested in building one? Join the new #enrichments channel on the Datasette Discord to discuss ideas and talk about the new feature!

Tags: jinja, plugins, projects, datasette, enrichments

New Major Versions Released! Flask 2.0, Werkzeug 2.0, Jinja 3.0, Click 8.0, ItsDangerous 2.0, and MarkupSafe 2.0

2021-05-12T17:37:14+00:00

New Major Versions Released! Flask 2.0, Werkzeug 2.0, Jinja 3.0, Click 8.0, ItsDangerous 2.0, and MarkupSafe 2.0

Huge set of releases from the Pallets team. Python 3.6+ required and comprehensive type annotations. Flask now supports async views, Jinja async templates (used extensively by Datasette) “no longer requires patching”, Click has a bunch of new code around shell tab completion, ItsDangerous supports key rotation and so much more.

Tags: async, flask, jinja, python

datasette-template-sql

2019-11-15T00:59:50+00:00

datasette-template-sql

New Datasette plugin, celebrating the new ability in Datasette 0.32 to have asynchronous custom template functions in Jinja (which was previously blocked by the need to support Python 3.5). The plugin adds a sql() function which can be used to execute SQL queries that are embedded directly in custom templates.

Via @simonw

Tags: jinja, projects, sql, templates, datasette

Flask 0.1 Released

2010-04-16T17:12:48+00:00

Flask 0.1 Released

Armin’s Flask (a Python microframework built around Werkzeug and Jinja2) is looking pretty solid for a two week old project—extensive documentation, comprehensive unit test support (and example applications with unit tests) and some very tidy API design.

Tags: armin-ronacher, flask, jinja, microframeworks, python, testing, werkzeug

Replacing Django's Template Language With Jinja2

2008-07-22T17:18:16+00:00

Replacing Django's Template Language With Jinja2

Part of Will Larson’s series on taking advantage of Django’s loose coupling.

Tags: django, jinja, loosecoupling, python, will-larson

Jinja2 Final aka Jinjavitus Released

2008-07-19T23:52:34+00:00

Jinja2 Final aka Jinjavitus Released

The Jinja template engine now has auto-escaping as an optional feature, disabled by default. Worth considering as an almost drop-in replacement for Django’s template language if features such as macros and compilation to Python code appeal to you.

Tags: autoescaping, django, jinja, python