INTRO TO AI

Part 7 Appendix I

Mehmet Kerem Turkcan
Associate Research Scientist
Center for Smart Streetscapes, Columbia University
New York, USA
keremturkcan.com  ·  mkt2126@columbia.edu

Move with the arrow keys, a presentation clicker, or the buttons at the bottom left; the gear at the bottom right opens the slide settings.

The Orbit Lab

Imagine asking a coding agent to make a small lesson where students explore planets and answer three questions.

Before we build: which parts could live inside the browser?
  • A rotating solar system
  • Planet facts and quiz buttons
  • A score for the current visit
localhost:8000 Which planet is this? Earth Mars Score: 2 of 3
Illustrative Orbit Lab target. A concrete target gives the agent something testable to build.

The VS Code workspace

Create a folder named orbit_lab. In VS Code, choose File → Open Folder and select it.

EXPLORER ORBIT_LAB index.htmlstyles.cssapp.js index.html <h1>Orbit Lab</h1> <button>Earth</button> TERMINAL PS ...\orbit_lab> CODING AGENT Build a planet quiz forgrade 9 science students. review proposed changes
The open folder is the workspace. Explorer shows files; the editor shows content; the agent panel holds the conversation; the integrated terminal runs project commands.
Workspace Trust: trust folders that you created or received from a known source. Ask school IT about managed devices.

The coding agent extension

  1. Open Extensions with Ctrl+Shift+X.
  2. Search for one official extension and verify its publisher.
  3. Select Install, open its panel, and sign in.
Search textPublisherHow to open it
CodexOpenAICodex icon, or Command Palette → Codex: Open Codex Sidebar
Claude CodeAnthropicSpark icon, Activity Bar, or Command Palette → Claude Code

Windows shortcuts are shown. Extension names and interface details can change, so verify the publisher and follow the current official documentation. A school may distribute an approved extension through managed VS Code settings.

The first extension session

  1. Open orbit_lab as the VS Code workspace.
  2. Open the agent panel and begin in a planning mode.
  3. Ask the agent to inspect the empty folder and propose files.
  4. Read the plan before allowing edits.
  5. Keep command and file approvals enabled while learning.
ExtensionConservative starting controls
CodexPlan first; use the permissions control beneath the prompt and choose Ask for approval
Claude CodePlan mode first; use Manual mode when edits begin
Read every proposed command. Confirm the workspace folder, the files affected, and the reason for network access.

The extension boundary

A coding agent can inspect project context and can request permission to edit files or run commands.

Context or actionTeacher choice
Workspace filesOpen a dedicated project folder that contains only the application
Open file or selected textAttach only the material needed for the task
File editsReview the diff and keep approval controls enabled
Terminal commandsRead the command, working folder, and expected effect
Network accessAllow downloads only from known package sources when the project needs them
Privacy boundary: keep student records, credentials, private assessments, and confidential school files outside the workspace and prompts.

A useful prompt

PartWhat to tell the agentOrbit Lab example
GoalThe visible resultA planet quiz students can use
ContextAudience, folder, and existing filesGrade 9 science; empty folder
ConstraintsTools, limits, and safety requirementsStatic HTML; keyboard friendly; no accounts
Done whenChecks that prove the work is completeServe locally; test all three questions

A prompt is a work order. A clear finish line helps the agent inspect its own work.

Agent habit: for a larger idea, first ask for a plan and questions. Approve the plan before implementation.

The extension work cycle

1 Contextopen files 2 Promptclear outcome 3 Planreview steps 4 Diffinspect edits 5 Previewuse the app 6 Checkpointcommit in Git
Each short cycle ends with a working version that can be restored.
Use editor context: open or select the relevant file before prompting. Attach the file explicitly when the extension offers an @ mention or context button.

The first build prompt

Goal: Build a small Orbit Lab where students rotate a simple solar system, click a planet, and answer three multiple choice questions.

Context: The audience is grade 9 science students. This folder is empty.

Constraints: Use plain HTML, CSS, and JavaScript. Make a static application with no backend, accounts, database, package manager, or build step. Keep all files in this folder. Support keyboard use and both light and dark browser settings.

Done when: Serve the folder locally, open the page, test every answer, check the browser console for errors, and tell me which files you created.

Create README.md with the exact start, test, and stop commands so another teacher can repeat the setup.

Project instructions for the agent

Keep durable instructions in the project so each new agent session receives the same expectations.

orbit_lab/ AGENTS.md Codex CLAUDE.md Claude Code index.html ...

Include:

  • the audience and learning goal
  • commands for serving, building, and testing
  • files or folders the agent may change
  • accessibility and privacy requirements
  • the checks required before completion
Review commands and permission requests. Keep secrets out of instruction files and prompts.

The first files

orbit_lab/ index.html styles.css app.js assets/ planet.svg

index.html is the page the browser opens.

styles.css controls appearance.

app.js controls behavior.

assets/ holds images, sounds, and other files.

Explanation request: “Explain every file in two sentences for a teacher who is new to web development.”

Reviewing agent changes

A diff shows the old and new versions of a file. Removed lines and added lines receive different colors.

  1. Read the list of changed files.
  2. Open every diff and read the changed lines.
  3. Accept, revise, or revert the change.
  4. Preview the application after approval.
removed: <h1>Planets</h1>
added:   <h1>Orbit Lab</h1>

Claude Code can show a side by side proposal before an edit. Codex and VS Code Source Control can show changed lines beside the file. Use the agent chat for follow up changes.

Approval is a decision. Confirm that the code matches the learning goal and stays inside the requested scope.

HTML, CSS, and JavaScript

HTML desks, doors, labels the structure CSS colors, spacing, type the appearance JavaScript buttons, quiz, motion the behavior Together, they make the classroom usable.
The classroom is a memory aid; the standard terms remain HTML, CSS, and JavaScript.

A static application

Question: if the quiz reacts to every click, must it have a backend?

No. JavaScript can run inside the browser and make a page highly interactive.

A static HTML application is delivered as files. Each visitor receives the same program files.

It can still:

  • animate
  • calculate
  • play media
  • save small settings in the browser

When is static enough?

Classroom needStatic application?Reason
Public lesson or simulationYesEveryone can receive the same files
Quiz feedback during one visitYesThe browser can calculate a score
Remember a display preferenceUsuallyThe browser can store a small local setting
Teacher sees every student resultNeeds moreResults must reach a shared system
Private accounts or secret answer keyNoBrowser files can be inspected

Live Preview for plain HTML

Microsoft's Live Preview extension starts a local server and opens a static page inside VS Code.

  1. Open Extensions with Ctrl+Shift+X. Search for Live Preview and verify the Microsoft publisher.
  2. Open index.html.
  3. Select the preview icon, or run Live Preview: Show Preview from the Command Palette.
  4. Use Open in Browser when you need the full browser developer tools.
  5. Run Live Preview: Stop Server after the work session.
Scope: Live Preview is convenient for plain static files. Vite and Flask provide their own development servers.

Live Preview remains under development, so its buttons and requirements can change. Follow the current Microsoft project documentation.

The integrated terminal

VS Code opens a terminal in the workspace folder through View → Terminal or Ctrl+`.

Server request: “Start a Python static server on 127.0.0.1 at port 8000. Show me the command before running it. Keep the terminal visible.”
python -m http.server --bind 127.0.0.1 8000

The terminal stays busy while the server runs.

Visit http://127.0.0.1:8000.

Press Ctrl+C in that terminal to stop the server.

Development tool: Python documents this server as unsuitable for production because it provides only basic security checks.

The address in the browser

http://127.0.0.1:8000/index.html
httpProtocolThe communication standard
127.0.0.1HostThe computer to contact
8000PortThe program door on that computer
index.htmlPathThe file or resource being requested

Localhost and 127.0.0.1

Suppose a student types “localhost” on a Chromebook. Which computer will the browser contact?

localhost is a special name for this same device.

127.0.0.1 is the usual IPv4 loopback address for this same device.

::1 is the IPv6 loopback address.

💻

The student contacts the Chromebook.

“Local” always depends on who is speaking.

Sharing on a classroom network

python -m http.server 8000 --bind 0.0.0.0

0.0.0.0 tells the server to listen through every network connection on the teacher computer.

Students visit the teacher computer's local network address, such as http://192.168.1.42:8000.

The sample address is illustrative. Find the actual address in the computer's network settings.

Teacher computer 192.168.1.42:8000 class WiFi student device student device
Use this only on a trusted private network. Stop the server after class.

Ports and firewalls

A port identifies one server program on a computer. It works like a room number after a street address.

A firewall decides which incoming network connections may enter. It works like a security desk with a list of permitted rooms.

What you seeLikely causeFirst action
“Address already in use”Another program has that portStop it or choose port 8001
Teacher computer works; students failLoopback binding or firewall ruleCheck binding, private network, and firewall
Some devices failDifferent WiFi or network isolationConfirm every device is on the same allowed network

Windows Firewall blocks unsolicited incoming traffic unless a rule permits it. Keep the rule specific to the application, port, and private network.

Node and npm

Node.js runs JavaScript outside the browser. Development tools can use it to prepare a web application.

npm downloads JavaScript packages and runs project commands.

A package is reusable code published for other projects. A dependency is a package that this project needs.

Ask the extension: “Check whether Node and npm are available in the VS Code terminal. Explain the output.”
node --version
npm --version

If either command is missing, install a current Long Term Support release from the official Node.js website, then restart VS Code. School managed devices may require help from IT.

Separate tools: the coding agent extension can edit files without making Node part of the finished site. Students can use the finished static site without installing Node or npm.

The npm project files

orbit_lab/ package.json package-lock.json node_modules/ index.html src/ main.js

package.json names the packages and useful project commands.

package-lock.json records the exact dependency tree. Commit it with the source.

node_modules/ contains downloaded packages. npm install can recreate it, so leave it out of Git.

Common misconception

npm can remain a development tool and package manager while the finished application remains entirely frontend.

Three.js and Vite

three.js is a JavaScript library for drawing interactive 3D scenes in a browser.

Vite is a development and build tool. It serves source files while you work, then prepares compact files for publishing.

source filesplus three.js Vite browser

A Vite build prompt

Goal: Add an interactive 3D solar system to Orbit Lab.

Context: The current static quiz works. Preserve its questions and accessibility.

Constraints: Use three.js from npm and use Vite for development and builds. Keep a static architecture. Scope the project to HTML, CSS, JavaScript, three.js, npm, and Vite. Keep the scene simple enough for school laptops.

Done when: Run npm install, start the Vite development server, test keyboard controls, run npm run build, run npm run preview, and report any browser console errors.

“Frontend framework” means a larger system such as React or Vue. A small activity often needs less machinery.

The Vite work cycle

CommandWhenWhat it does
npm installAfter download or dependency changeCreates or updates node_modules/
npm run devWhile editingStarts a fast local development server
npm run buildBefore publishingCreates the finished files in dist/
npm run previewAfter buildingServes the finished files for a final local check

Edit source → build → preview → publish

The coding agent can run these commands after approval. Read the integrated terminal output because it records warnings, addresses, and failures.

The dist folder

source you edit index.htmlsrc/main.jsassets npm run buildVite prepares files dist/ generated filesready for a hostrebuilt from source
The dist folder is a generated delivery package. Keep editing the source files.

Git and GitHub

Git records versions of files in the project folder.

GitHub can store a copy of that Git project online and can publish a static site.

A repository is a project folder together with its saved Git history.

  1. Open Source Control with Ctrl+Shift+G.
  2. Select Initialize Repository.
  3. Open each changed file to review its diff.
  4. Select Stage, enter a message, then select Commit.

Commit:

  • source files
  • package.json
  • package-lock.json

Ignore:

  • node_modules/
  • .env

VS Code uses the Git installation on the computer. Ask school IT for Git when Source Control reports that Git is unavailable. With a GitHub Actions deployment, dist/ can remain a generated artifact.

Publishing with GitHub Pages

  1. In VS Code Source Control, select Publish to GitHub and sign in when prompted.
  2. Choose repository visibility according to school policy and inspect the files being uploaded.
  3. On GitHub, open Settings → Pages and choose GitHub Actions as the source.
  4. For Vite, let the workflow build and upload dist/. Plain HTML can be uploaded directly.
  5. Wait for the deployment check, then open the Pages address on another device.
Deployment request: “Add the official GitHub Pages workflow for this Vite static site. Configure the repository base path. Run the production build locally. Explain every new file and the exact GitHub settings I must choose.”

Publish to GitHub uploads the repository. A Pages deployment creates the website. Treat the Pages website as public.

Common GitHub Pages failures

SymptomCause to checkRepair
Page is blankJavaScript error or wrong asset pathOpen developer tools; inspect Console and Network
Site works at home page; files show 404Vite base path misses repository nameWhen the address contains the repository name, set base: '/REPOSITORY/' and rebuild
Old version appearsBuild is pending, failed, or missingCheck Actions, rebuild, then refresh
Python route failsPages serves static files onlyUse a backend host for the Flask application
Diagnostic prompt: include the address, exact error, browser console output, expected result, and the files the agent may change.

The boundary of static hosting

GitHub Pages sends HTML, CSS, JavaScript, images, and other files to the browser.

The visitor can download and inspect those files.

Good fit: lessons, visualizations, public reference data, simulations
Requires a backend or external service: private accounts, shared records, protected answer keys, secret API credentials
Security requirement

Anything sent to the browser must be considered visible to the visitor.

Frontend and backend

The frontend runs in the browser. The backend runs as a server program and can enforce access policy, use secrets, and reach a database.

frontendOrbit Lab in browser backendPython and Flask databaseaccounts and results HTTP request query
In a school office, the frontend resembles a front desk while the backend resembles a protected records room.

A simple API request

An API is an agreed way for programs to ask for data or actions.

Frontend asks:

GET /api/planets
fetch('/api/planets')
  .then(r => r.json())

Backend answers with JSON:

{
  "name": "Earth",
  "moons": 1
}

JSON is a text format for structured data.

HTTP also carries a status such as 200 for success or 404 for a missing resource.

Origins and CORS

A browser origin is the protocol, host, and port together.

AddressOrigin compared with the first row
http://127.0.0.1:5173Starting origin
http://127.0.0.1:5000Different port, so different origin
https://example.orgDifferent protocol and host

CORS is the browser's permission system for frontend requests to another origin.

During development, use a Vite proxy or permit the exact frontend origin in Flask. Avoid a wildcard origin for authenticated applications.

A local Flask backend

Flask is a Python web framework. It maps URL paths to Python functions.

python -m venv .venv
.\.venv\Scripts\Activate.ps1
python -m pip install Flask
python -m flask --app app run --host=127.0.0.1 --port=5000

.venv keeps Python packages for this project separate.

app.py contains the Flask application.

127.0.0.1:5000 keeps the development server on this computer.

Flask's development server is for local development. Use a production hosting setup before public service.

A login round trip

1 Browsersend login over HTTPS 2 Flaskvalidate the request 3 Databasereturn password hash 4 Flaskverify the password 5 Flaskcreate a session 6 Browserstore the session cookie
A login is a conversation among browser, backend, and database.

Database, password hash, and session

TermPlain meaningSchool office memory aid
DatabaseOrganized information that persistsA protected records cabinet
Password hashA one way value used to verify a passwordA check that avoids keeping the original phrase
SessionA server record that remembers a signed in browserA temporary visitor pass
CookieA small value the browser returns with later requestsThe pass carried by the visitor
Never store plaintext passwords. Use a maintained password hashing library with a strong password hashing algorithm. Protect authenticated traffic with HTTPS.

Secrets stay on the backend

A secret is a credential such as (i) a database password, (ii) a private API key, or (iii) a session signing key.

An environment variable is a named value supplied to the server process outside the source files. Store backend secrets there or in a managed secret store. Keep local values in .env and add that file to .gitignore.

Never place secrets in:
  • frontend JavaScript
  • HTML or the dist folder
  • Git commits
  • prompts, screenshots, or console logs

Vite variables exposed to frontend code become part of the browser files. Every bundled value is public, regardless of its name.

A safer backend prompt

Goal: Make a local demonstration of Orbit Lab login and saved quiz results.

Context: This is a teaching demonstration with generated users and fake results. It will run only on 127.0.0.1.

Constraints: Use Python, Flask, and SQLite. Use a maintained password hashing library. Store only password hashes. Use server managed sessions. Validate all inputs. Keep secrets out of frontend files and Git. Add a requirements file and clear setup commands. Before coding, list the main security risks.

Done when: Test successful login, failed login, logout, unauthorized access, and saved fake results. Check that logs and error messages reveal no credentials.

SQLite stores this demonstration database in one local file. requirements.txt records the required Python packages.

Real student data changes the project. Involve school IT, privacy staff, and approved services before collecting it.

Ways to share an application

MethodWho can reach itBest useMain responsibility
LoopbackOne computerPrivate developmentKeep the terminal open
Classroom LANAllowed local devicesOne class sessionBinding, firewall, and WiFi
Temporary tunnelPeople with a public addressShort remote demonstrationQuota, access control, and laptop uptime
Static hostPublic web visitorsLessons without private dataDeployment and public content
Managed backend hostAuthorized web visitorsAccounts and shared dataSecurity, capacity, cost, and policy

What does an ngrok tunnel do?

ngrok gives a temporary public address that forwards requests through its service to a server on your computer.

visitorpublic internet ngrokpublic endpoint teacher laptoplocal server

Current free plan examples: 1 GB data transfer and 20,000 HTTP requests per month, plus a browser interstitial.

Illustrative load: 300 first visits at 4 MB each use about 1.2 GB. A page with 20 requests per visit uses about 6,000 requests. Assets, repeat visits, and quota changes alter the result.

ngrok free plan limits, accessed July 20, 2026: ngrok.com/docs/pricing-limits/free-plan-limits

A teacher laptop on the public internet

An IP address identifies a network destination. A domain name, resolved through DNS, gives people a stable name. Reliable public hosting requires more than binding a server to 0.0.0.0.

ObstacleWhy it matters
Private address and NATThe router shares a public address; internet visitors cannot directly use a 192.168 address
Changing public addressA shared link may later point elsewhere
Firewall and school policyIncoming service may be blocked or prohibited
Sleep, restart, and WiFi lossThe application disappears when the laptop disconnects
Domain, HTTPS certificate, updates, and logsThe teacher becomes the operator of a public service
Practical choice: use a static host for a public static lesson. Use an approved managed backend when the application needs accounts or shared data.

Serverless services

Serverless means a provider runs and scales the servers that execute your code. Servers still exist.

You usually pay according to usage, such as requests, execution time, storage, or data transfer.

Useful: little server maintenance, automatic scaling, quick deployment
Risk: a viral link, automated abuse, repeated error, or traffic loop can raise usage and cost quickly

The provider operates the servers and meters selected resources. Every plan has technical and financial limits.

Cost and abuse guardrails

  1. Set quotas or hard usage limits where the provider offers them.
  2. Set budget alerts and learn whether an alert also stops service.
  3. Require authentication before costly actions or private data access.
  4. Add rate limits that cap requests per user, session, or network address during a chosen time.
  5. Cache static files so repeated visitors avoid repeated computation.
  6. Watch logs and cost dashboards during and after a class launch.
  7. Prepare a stop switch and know how to disable the deployment.
Cost review request: “List every action in this design that can create provider charges. Propose a quota, rate limit, monitoring signal, and shutdown procedure for each one.”

Choosing for the expected audience

Illustrative situationPractical starting pointTest before use
One teacher develops privatelyLoopback serverBrowser console and full activity
One class uses a static activityClassroom LAN or static hostWiFi access, firewall, devices, and asset size
Hundreds visit a public static lessonStatic host with cached filesPublished path, mobile use, and accessibility
Hundreds need accounts or shared recordsApproved managed backendCapacity, privacy, security, budget, and recovery

A simple static application may serve hundreds of visitors from a local server on suitable hardware and a suitable network. Capacity still depends on (i) the application, (ii) the teacher computer, (iii) the WiFi, and (iv) the network policy. A public audience also needs a stable address and continuous operation.

Audience counts are illustrative. Measure with the actual application and network.

Common misconceptions

ClaimWhat actually happens
“Static means motionless.”Browser JavaScript can provide rich interaction and animation.
“Using npm creates a backend.”npm may only prepare frontend files during development.
“Students can visit my localhost.”Each student's localhost refers to that student's device.
“A private repository hides a key in the published site.”Published browser files reveal values included in them.
“GitHub Pages runs my Flask file.”GitHub Pages publishes static files. Flask requires a Python host.
“Serverless means free and without servers.”A provider operates servers and meters selected resources.

A debugging map

LayerWhere to lookQuestion
Agent contextOpen files and attached referencesDid the prompt identify the correct file and expected result?
Editor checksVS Code Problems and OutputWhich warning or extension message appears first?
Browser behaviorDeveloper tools → ConsoleWhich JavaScript error appears first?
Files and API callsDeveloper tools → NetworkWhich request failed, and with what status?
Local serverVS Code integrated terminalDid the request arrive? Did the server report an error?
AddressBrowser address barAre protocol, host, port, and path correct?
Published siteBuild output and deployment logWas the newest dist folder deployed successfully?
Repair prompt: “I attached the failing file. Here are the exact address, expected behavior, first error, terminal output, and reproduction steps. Diagnose the cause first. Propose the smallest repair. Run the relevant check after editing.”

A classroom development cycle

  1. Create one project folder and open it as the VS Code workspace.
  2. Initialize a Git repository from Source Control.
  3. Describe one visible outcome with context, constraints, and checks.
  4. Use planning mode, then review the plan and proposed commands.
  5. Inspect every changed file in the diff view.
  6. Preview through Live Preview or the server in the integrated terminal.
  7. Test the activity, inspect browser errors, then commit the working version.
  8. Publish through the simplest method that fits the data and audience.
Teacher role: define the learning goal, protect student information, test the experience, and decide when the result is ready.

Student use checklist

Learning and access

  • instructions match the lesson
  • keyboard and readable contrast work
  • mobile and school devices work
  • errors have helpful messages

Technical checks

  • fresh install and build succeed
  • published paths and assets load
  • a rollback copy exists

Privacy and security

  • no secrets in browser files or Git
  • only approved data is collected
  • dependencies and licenses are understood
  • access and deletion procedures are clear

Operations

  • capacity and cost controls are set
  • logs are available
  • a named person can stop the service
FUTURE APPENDIX

Part 7 Appendix II: Completely Local Applications

Planned topics include (i) raw Python and C, (ii) command line and desktop programs, (iii) virtual environments and compilers, and (iv) executable files, permissions, packaging, and offline distribution.

Appendix II scope: programs that run completely locally.

Sources: coding agents

Documentation accessed July 20, 2026.

Sources: web toolchain and hosting

Documentation accessed July 20, 2026.

Sources: networks, security, and cost

Plan limits and service behavior can change. Recheck provider documentation before a live deployment. Documentation accessed July 20, 2026.

Mehmet Kerem Turkcan; Associate Research Scientist; Center for Smart Streetscapes, Columbia University; New York, USA; keremturkcan.com; mkt2126@columbia.edu

Intro to AI, Part 7 Appendix IBuilding and Serving Web Applications