"Files never leave your browser" is becoming standard copy for PDF tools, image editors, and document converters. But a trust claim and a verifiable fact are different things. Here's how to turn "zero upload" into something any user can audit in about two minutes, and how to enforce it at the browser level so it isn't just a promise. Step 1: Read the Network panel Open DevTools → Network, enable "Disable cache", reload. While processing a file, filter by "Fetch/XHR" and "Doc". A genuinely client-side tool should show only HTML/CSS/JS/WASM asset loads — no POST requests, no GETs carrying file content in query parameters. The non-obvious trap: third-party analytics, Google Fonts, and CDNs all show up as outbound requests. If you claim zero uploads, those count too. The honest move is to self-host fonts and scripts and drop analytics entirely, so the request list is genuinely short enough to eyeball. The Network panel is the human-readable check. The next part is what actually makes it hold. Step 2: Enforce egress with CSP connect-src This is the piece people get backwards, so it's worth stating precisely. CSP's connect-src is an egress allowlist the browser enforces before the request is sent . A fetch /XHR to an origin that isn't on the list is blocked by the browser and never leaves the machine. You'll see it fail in the console as a CSP violation, with no entry in the Network tab going out to that origin. This includes no-cors requests. no-cors is sometimes assumed to be an escape hatch, but it isn't one for this purpose. All no-cors does is let you issue a cross-origin request while making the response opaque (you can't read the body). It does not bypass connect-src : if the target origin isn't in your connect-src allowlist, the no-cors request is blocked exactly the same way — it never goes out. So you can't smuggle a file out to a third party with no-cors under a tight CSP. That's what makes CSP the actual proof, not just documentation. Tighten connect-src to 's

We open sourced Centaur last month—a Slack agent we built for our own investing and engineering work. Over the past few months it's grown to 100-150 daily power users across a few organizations, handling both judgment-heavy tasks like investment research and raw horsepower work like searching massive codebases. The interesting part isn't just our internal use. We've been running a small Slack Connect with external orgs using it, and the feedback has been consistent: most SaaS tools don't cut it because companies need too much customization and their critical integrations aren't supported out of the box. Our roadmap is getting clearer as we tackle the tricky parts of multi-org collaboration. We're working on scoping Slackbot access by channel, which would finally let different organizations' agents coexist safely in the same space—almost like an Enterprise Matrixbook. But the real challenge isn't the vision, it's execution. Keeping costs low while staying self-hostable for smaller teams has forced us to rethink everything. The hard problems only become obvious once you're deep in the implementation. That said, I do think Slack has won in one sense: it's the best place for a coworker agent to emerge, rather than a standalone application. Curious whether others are seeing this pattern too.

Hermes-Crew Hybrid: A Hybrid Architecture for Secure Multi-Agent AI Workflows I built a hybrid system that combines a central orchestrator (Hermes) with temporary CrewAI micro-crews, protected by 3 layers of security. Here's what it does and why it matters. The Problem Multi-agent AI systems are powerful but dangerous. When you chain multiple agents together, a single compromised agent can poison the entire workflow. Existing solutions are either too heavy (enterprise PKI infrastructure) or too light (basic regex filters). The Solution: 3-Layer Security Layer 1 — Pre-execution (MCP Tool Auditor): Before any agent can register a tool, it's audited for malicious instructions. Layer 2 — Runtime (Agent Fixer Stage): Every output from every agent passes through a 3-stage pipeline (normalization → pattern matching → embeddings) in under 1ms. Layer 3 — Pre-commit (Code Safety Hook): Before any git commit lands, the diff is analyzed by CrewAI + Ollama local. Malicious code gets rejected automatically. Architecture Hermes (Director) │ ├── MCP Tool Auditor → verifies tools before registration │ ├── Execution: venv (fast) / Docker (isolated) / auto (smart) │ ├── Agent 1: Researcher │ ├── Agent 2: Analyst │ └── Agent 3: Writer │ ├── Security Gateway (Agent Fixer Stage) → filters output (<1ms) │ └── Consolidator → parses output + generates Obsidian notes What Makes It Different 1. Portable by design. Zero hardcoded paths. Every user configures their own .env . 2. Multi-model via LiteLLM. Works with Ollama local, OpenAI, Anthropic, Gemini, Groq, OpenRouter — any provider. 3. Local-first. Everything runs on the user's machine. No cloud dependencies required. 4. Obsidian integration. Every analysis generates a structured note with YAML frontmatter. Code Safety Hook in Action When you run git commit with malicious code: ❌ [ COMMIT RECHAZADO] Code Safety detected risks: → CrewAI detected vulnerabilities: VERDICT: FAIL → Agent Fixer Stage detected anomalies: High threat score: 1.05 Fo

Ever started a new project and found yourself rebuilding the same modal, dropdown, toast notification, tabs, and switches for the 20th time? I got tired of that. So I built UltraHTML , a lightweight UI library that gives you modern components with simple HTML and JavaScript, no framework required. Getting Started Include the CSS and JS files: <link rel= "stylesheet" href= "dist/ultra.css" > <script src= "dist/ultra.js" ></script> Initialize UltraHTML: Ultra . init (); Done. Buttons UltraHTML includes two button styles out of the box: ultra-button — a clean, modern button. ultra-button-wave — adds a wave/ripple-style interaction effect. Basic button: <button class= "ultra-button" > Simple Button </button> Wave button: <button class= "ultra-button ultra-button-wave" > Wave Button </button> Buttons use UltraHTML's default green theme, but because they're standard HTML elements, you can easily customize them with CSS. For example, here's a red button that displays a popup message: <button onclick= "Ultra.popupmsg('Hello from UltraHTML!')" class= "ultra-button ultra-button-wave" style= "background-color: red" > Show Popup </button> You can create buttons that match your site's branding without learning a separate theming system: <button class= "ultra-button" style= "background-color: #3b82f6;" > Blue Button </button> <button class= "ultra-button ultra-button-wave" style= "background-color: #f59e0b;" > Orange Button </button> <button class= "ultra-button ultra-button-wave" style= "background-color: #ef4444;" > Red Button </button> UltraHTML handles the styling and interactions while still giving you full control over how your buttons look. Modal Example Need to display important information? <script> window . addEventListener ( " load " , () => { Ultra . init (); Ultra . modal ({ head : " Important " , text : " You need to reset your password " , buttonText : " Reset " , buttonAction : ( modal ) => { console . log ( " Going to reset page... " ); modal . remove (); } }); }

Why This Matters: The 2 AM Problem It's 2 AM. Your phone rings. Your production database is down. Customers can't log in. Revenue is dropping by the second. You call the Ops team. They restart the server. Downtime: 45 minutes. Cost: $100K in lost sales. Root cause? Unknown. This happens thousands of times a week at companies worldwide. The question isn't "Will your system break?" It's " When it breaks, are you ready? " That's where SRE comes in. What is SRE? (The Real Definition) SRE (Site Reliability Engineering) = Applying software engineering principles to build reliable, scalable infrastructure and systems. It's not just about keeping servers running. It's about: Reliability : Systems that don't break unexpectedly Scalability : Systems that handle growth without collapsing Infrastructure : Automating how systems are built, deployed, and monitored Measurability : Knowing exactly how your system is performing at any moment Traditional operations manages infrastructure reactively — when something breaks, you fix it. SRE manages infrastructure proactively — you engineer it so it rarely breaks, and when it does, it heals itself. The Key Insight: Reliability is Engineered, Not Hoped For Here's the critical shift in thinking: Old mindset : "Let's build this system and hope it doesn't break." SRE mindset : "Let's measure what 'reliable' means, design the system to achieve that, and automate the monitoring and recovery." But reliability isn't just uptime. It includes: Uptime : Is the system available? Latency : How fast does it respond? (A slow system is effectively broken) Error rate : What percentage of requests fail? Throughput : Can it handle the traffic? User experience : Does the system meet user expectations? All of these are engineered and measured. A Simple Analogy: The Bridge Imagine you're managing a bridge. Traditional approach : Engineers patrol daily, react to problems, work around the clock fixing issues SRE approach : Engineers design monitoring that aler

I've shipped 4 Chrome extensions and 2 VS Code extensions. The advice that always sounds smart — "find a popular extension the dev abandoned, rebuild it better" — is miserable in practice. You open the Web Store, see 100k users and a 4.4 rating, think you found gold, then burn a weekend reading reviews only to realize half the complaints are unfixable traps (sync died, login broke, backend gone). So I built a small pipeline to do the boring part automatically. The method Scrape public Chrome Web Store metadata — users, rating, last-updated date. Filter: 20k–300k users, 18+ months without an update, rating 3.3–4.4 (good enough to prove demand, bad enough to prove pain). Pull up to 50 recent reviews per candidate via public CWS data. Score each one: score = log10(users)10 + months_stale0.5 + feature_request_count2 - trap_count1.5 The key part is trap_count — I subtract points for complaints about sync/login/server issues, because those are unfixable without inheriting someone else's dead backend. High "demand" with high trap count is a mirage. One example Extension Manager — 100k users, 4.4★, last updated ~25 months ago. Looks healthy until you read the 1–2★ reviews: "The site-specific rules feature simply does not work… the core feature advertised is broken." "It won't save any changes made… extensions are re-enabled automatically." A user even posted an RCE report: the dev parses JSON with a Function(str)() fallback — executing arbitrary code from untrusted input. That's not "build a clone." That's "fix the rules engine, kill the eval, add local backup, ship something 100k people already want." The counterintuitive part The highest-scoring extension in my list (200k users, abandoned ~4 years) is actually the worst business opportunity — it's a simple toggle utility whose users will never pay, and the original asks for camera/mic permissions (adware-grade). Raw download counts would put it at the top of your build list. Revenue potential buries it. That gap between "

Overview Today's focus was on automating article publishing to CSDN and WeChat MP (微信公众号) using Playwright, after CSDN deprecated its public Open API. Key achievements include: injecting Markdown content into CSDN's dynamic editor, handling title input quirks, implementing QR code login for WeChat MP, updating the Dev.to API publisher, and consolidating platform configs into a single YAML file. We also fixed session log capture after a Claude Code update changed the log file path. Problems and Solutions 1. CSDN Open API Deprecation → Browser Automation Background : In early 2026, CSDN silently shut down its public Open API. All endpoints returned 404/403. We needed a fallback to keep publishing to China's largest developer platform. Solution : Use Playwright to simulate a real user login and article creation. The approach: Launch a headless Chromium browser. Navigate to CSDN's login page. Perform one-time manual login via QR code. Serialize cookies to csdn_cookies.json . On subsequent runs, load the cookies and skip login. Go to the editor, inject Markdown content via DOM manipulation, fill the title, and click publish. Code snippet : import asyncio from playwright.async_api import async_playwright async def publish_to_csdn ( title : str , content_md : str ): async with async_playwright () as p : browser = await p . chromium . launch ( headless = True ) context = await browser . new_context ( storage_state = " csdn_cookies.json " if exists else None ) page = await context . new_page () await page . goto ( " https://mp.csdn.net/mp_blog/creation/editor " ) # Inject content await page . evaluate ( f ''' () => {{ const editor = document.querySelector( ' .editor-content ' ); if (editor) {{ editor.innerHTML = ` { escaped_content } `; editor.dispatchEvent(new Event( ' input ' , {{ bubbles: true }})); }} }} ''' ) # Fill title await page . fill ( ' #title-input ' , title ) await page . click ( ' button:has-text( " 发布 " ) ' ) await page . wait_for_url ( " **/mp_blog/manage/ar

One balance. Every model. Chat, image, video & audio. Discussion | Link

Mine got flagged twice in one day. Both essays generated more engagement than anything else I've...

Vercel Labs recently open-sourced zero-native, a cross-platform framework for native desktop applications. Zero-native bypasses Electron runtime in favor or native OS WebViews and claims to achieve smaller, more efficient native apps with minimal overhead. Zero-native is written in Zig, thus directly interoperates with native C libraries, and features fast incremental compilation times. By Bruno Couriol

GitHub热门项目 | AI coding assistant skill (Claude Code, Codex, OpenCode, Cursor, Gemini CLI, and more). Turn any folder of code, SQL schemas, R scripts, shell scripts, docs, papers, images, or videos into a queryable knowledge graph. App code + database schema + infrastructure in one graph. | Stars: 67,157 | 5,478 stars this week | 语言: Python

As developers, we compare files constantly — reviewing pull requests, checking config changes, spotting bugs between versions. But not all diff tools are created equal. Some require installation, some upload your files to remote servers, and some just don't support the formats you need. Here's a rundown of the best free file diff tools available in 2026, so you can pick the right one for your workflow. 1. FileDiffs — Best for Privacy & Format Support If you work with sensitive files or just don't want your data sitting on someone else's server, FileDiffs is the tool you need. What makes it stand out: Supports 60+ file formats — PDF, Word, Excel, code files, JSON, XML, CSV and more Runs entirely in your browser — client-side processing means your files never leave your device 100% private — zero data transfer, zero uploads, zero risk No install, no signup, no hassle — just open and compare It's the go-to tool when you need to compare files quickly without worrying about privacy or compatibility. 2. Meld — Best Desktop Diff Tool Meld is a classic open-source visual diff and merge tool for Linux, Windows, and macOS. It's great for comparing files, directories, and version-controlled projects. Best for: Developers who prefer a desktop app and work heavily with Git. 3. Beyond Compare — Best for Power Users Beyond Compare is a feature-rich diff tool with support for files, folders, FTP, and cloud storage. It's not free (paid after trial) but worth mentioning for its depth of features. Best for: Teams that need advanced folder sync and merge capabilities. 4. Diffchecker — Quick Online Diffs Diffchecker is a simple web-based diff tool for text and code. It's quick and easy but uploads your content to their servers and has limited format support compared to FileDiffs. Best for: Quick one-off text comparisons where privacy isn't a concern. 5. KDiff3 — Best for Three-Way Merges KDiff3 is a free, open-source diff and merge tool that supports three-way comparison. It's a bit dat