AI 资讯

Downloading an installer and immediately executing it as root collapses three operational decisions into one command: Which artifact? -> Did these bytes arrive intact? -> Should this host execute them? Separate those decisions and the install becomes reviewable, reproducible, and recoverable. A concrete source-review boundary At commit c58bcd4 , the MonkeyCode runner installation template selects x86_64 or aarch64 , checks AVX on x86, requires root, and downloads an architecture-specific installer before executing it. The reviewed template uses curl -4sSLk , so certificate verification is disabled by -k . It also downloads an unversioned path. I could not find a pinned version, digest, or signature check in that template. That is a statement about controls visible in one pinned file—not a claim that the release service is compromised or that no external release control exists. Put a manifest before execution For each release artifact, publish immutable metadata through a separately protected release process: { "version" : "1.2.3" , "architecture" : "x86_64" , "file" : "runner-installer-1.2.3-x86_64" , "sha256" : "<64 lowercase hex characters>" , "size" : 18439210 , "rollback" : { "previous_version" : "1.2.2" , "artifact" : "runner-installer-1.2.2-x86_64" } } SHA-256 detects bytes that differ from the manifest. It does not prove who authored the manifest. Serve the manifest over validated TLS, pin it through deployment configuration, or sign it and verify the signature with a trusted offline public key. Verify as an unprivileged staging step The companion verify-installer.mjs checks filename, exact size, digest, version, architecture, and rollback metadata: node verify-installer.mjs release-manifest.json fixture-installer.sh node test-verifier.mjs Expected output uses the fixture's actual digest: PASS 1.2.3-fixture sha256=<digest> PASS verified fixture; rejected tampered artifact before execution The negative test appends a line to the artifact and requires both size

Two buttons in a confirmation dialog look simple: Cancel and Confirm. Keyboard behavior makes the component a small state machine. A recent MonkeyCode change gives us a concrete example. Issue #862 and PR #863 add these shortcuts to the slash-command confirmation: ArrowLeft -> focus Cancel ArrowRight -> focus Confirm The reviewed implementation at commit c58bcd4 moves focus through button refs. That is a useful extra interaction. It is not a replacement for the dialog's accessibility foundation. Keep the baseline first For an alert-style confirmation, users still need: an accessible name and description; focus moved inside when the dialog opens; Tab and Shift+Tab constrained to dialog controls; Escape to dismiss when cancellation is allowed; visible focus; focus returned to the trigger after close; actual buttons whose labels explain the actions. The WAI-ARIA Authoring Practices Alert Dialog Pattern describes the modal semantics and keyboard foundation. Left/right mapping is a product shortcut, not a required AlertDialog convention. That means we must not steal keys from the established behavior around it. Isolate the extra mapping The companion keyboard.mjs starts with a pure function: export function arrowAction ( key ) { if ( key === " ArrowLeft " ) return " cancel " ; if ( key === " ArrowRight " ) return " confirm " ; return null ; } The event handler ignores unrelated and modified keys: export function handleDialogArrow ( event , controls ) { const action = arrowAction ( event . key ); if ( ! action || event . altKey || event . ctrlKey || event . metaKey ) return false ; event . preventDefault (); controls [ action ]. focus (); return true ; } Notice what is absent: no handler for Tab , Shift+Tab , Escape , or Enter . The native <dialog> and buttons in the minimal demo retain their normal jobs. In a React component, use a well-tested modal/dialog primitive for focus containment and dismissal, then add this narrow handler to its content. A complete minimal dialo

📖 TL;DR GPT-5.6 shipped July 9, 2026 in three tiers Sol (flagship), Terra (balanced), and Luna (cheapest) all tuned for agentic tool calling. All three share a 1M-token context window , 128K max output, and native MCP support in the Responses API. Test any MCP server against Sol, Terra, or Luna in MCP Agent Studio — pick the model, connect a server, and watch each tool call live. OpenAI dropped GPT-5.6 on July 9, 2026 - and this one is aimed squarely at agents. Three models landed at once: Sol , Terra , and Luna . Each is built to call tools, not just chat . That makes testing MCP servers with GPT-5.6 a different exercise than testing a plain chat model. Tool selection is the whole game. I have spent this week pointing all three at MCP servers GitHub, Postgres, Playwright, and multi-server setups. This post is what I learned. You will see which tier to run for which workload , how the new tool-calling features change MCP, and how to test each one free in your browser. Skip it and you will overpay for Sol on jobs Luna handles fine. What Is GPT-5.6? Sol, Terra, and Luna Explained GPT-5.6 is a three-tier model family, not a single model. OpenAI split it by cost and horsepower so you match the model to the job. Here is the lineup, straight from OpenAI's pricing page: Model Built for Input / Output (per 1M) GPT-5.6 Sol Flagship — ambitious agentic work $5.00 / $30.00 GPT-5.6 Terra Balanced — efficient, high-volume work $2.50 / $15.00 GPT-5.6 Luna Fast, affordable — everyday work $1.00 / $6.00 The specs are shared across all three. Every tier gets a 1M-token context window, 128K max output, and a February 16, 2026 knowledge cutoff. So the choice is not about context or capability limits. It is about how much reasoning each task actually needs. New to the protocol these models call? Start with what is Model Context Protocol , then come back. Why GPT-5.6 Changes MCP Tool Calling Here is the part that matters for MCP. GPT-5.6 does not just call tools one at a time it can orc

The live AI employee inside your product, serving every user Discussion | Link

AI sales platform for modern B2B teams Discussion | Link

Here's the thing: speed Test: I Found AI APIs 99% Cheaper Than Premium I have a confession: I've been overpaying for AI APIs for years. Like, embarrassingly overpaying. When I finally sat down and actually benchmarked 15 different models on speed and cost, I couldn't believe what I found. Some of the fastest models out there cost literal pennies per million tokens. Here's the thing — if you're still defaulting to whatever the big labs are pushing, you're leaving serious money on the table. So I spent a week running tests through Global API's infrastructure, hitting endpoints from multiple regions, and crunching numbers until my eyes hurt. What I discovered genuinely surprised me. Check this out: there's a model that pushes 80 tokens per second and costs $0.15 per million output tokens. Compare that to premium options charging $3.00/M and you'll understand why I had to write this down. Let me walk you through everything I found. Why I Even Started This Whole Thing My monthly AI bill got out of control. I'm running a few production apps that do text generation, summarization, and chat, and my December bill made me physically flinch. I knew there had to be faster, cheaper models hiding in the ecosystem — I just hadn't taken the time to actually measure them properly. That's the whole reason I ran these benchmarks. Not for clout, not for content marketing. Pure self-interest. I wanted to know where the actual sweet spots are. Where you get the best speed-per-dollar ratio. Where you can save 70%, 80%, even 99% without tanking your user experience. What I found was honestly kind of shocking. My Testing Setup (For the Nerds) I kept the methodology tight and consistent. Here's exactly how I ran everything: Date: May 20, 2026 Test regions: US East (Ohio) and Asia (Singapore) Prompt: "Explain recursion in 200 words" Output target: ~150 tokens per run Iterations: 10 runs each, averaged the results Streaming: Enabled via SSE Base URL: https://global-apis.com/v1 I measured two k

In indie game development, one of the biggest challenges is finding high-quality assets to bring our ideas to life. My goal has always been to create a complete world that stands out from the asset-saturated market, which often feels repetitive and even boring. However, I noticed that most available resources are low-resolution, typically 16x16. While 16x16 sprites have been functional for years, modern game engines allow for much greater detail while still preserving that classic retro vibe. The typical workaround has been to simply scale 16x16 sprites twice to make them 32x32, or three times for 48x48. This approach sacrifices an incredible amount of potential detail just to optimize... I'm not even sure what, since the file sizes end up being practically the same. That is why choosing a 48x48 pixel grid was not a random decision. In modern pixel art, this size represents the perfect balance between the classic nostalgia of 16-bit systems and the need for contemporary expressiveness. Plus, when I first started creating graphics, I was primarily using RPG Maker MV (RMMV), which has a native 48x48 grid. With a lower resolution, I would have lost the ability to subtly animate a character's gaze, individual movements, or the flow of their hair. Minor details—like wall sketches or windows with lighting that shifts depending on the time of day—would have been impossible. On the other hand, transitioning to other game engines made me realize two critical points about shifting to an even higher resolution. First, and most basic, is the workload: a larger canvas means significantly more work (which is why it’s easier to draw in 16x16 and let the software upscale it). Second, going too high causes the art to lose that retro charm I wanted to preserve at all costs as a core part of my brand. When I started designing this universe, I initially thought of a cozy, soft, pastel color palette. However, those styles tend to feel too modern and lacked that genuine retro feel. So, I

Direct manipulation of static images on the Mac platform Discussion | Link

I gotta say, i Spent a Month Testing Chinese AI APIs — Here's What Actually Wins Look, I'm just an indie hacker trying to ship products without going broke. For the past month I've been obsessively running the four biggest Chinese AI model families — DeepSeek, Qwen, Kimi, and GLM — through every test I could think of. And honestly? I wish someone had given me a breakdown like this before I started. So here's my attempt. No corporate fluff, no hand-wavy "it depends" answers. Just real data from someone who actually pays these bills. Why I Even Started Looking at Chinese Models Honestly, I was a GPT-4o loyalist for the longest time. Then I saw my December API bill and nearly choked. $400+ for what amounted to a few chatbot features and some content generation. That's when a friend told me to check out DeepSeek and Qwen. I was skeptical. Like, REALLY skeptical. Chinese models in 2023 were a joke for English tasks. But I kept hearing whispers from other indie hackers about how good things had gotten. So I decided to actually test them properly through Global API's unified endpoint (more on that later). What I found kinda blew my mind. The Quick Cheat Sheet Here's the TL;DR table I wish existed when I started. I'm putting it up top because, lets be real, you probably just want the bottom line: Feature DeepSeek Qwen Kimi GLM Developer DeepSeek (幻方) Alibaba (阿里) Moonshot AI (月之暗面) Zhipu AI (智谱) Price Range $0.25-$2.50/M $0.01-$3.20/M $3.00-$3.50/M $0.01-$1.92/M Best Budget Pick V4 Flash @ $0.25/M Qwen3-8B @ $0.01/M N/A GLM-4-9B @ $0.01/M Best Overall V4 Flash @ $0.25/M Qwen3-32B @ $0.28/M K2.5 @ $3.00/M GLM-5 @ $1.92/M Code Generation ⭐⭐⭐⭐⭐ ⭐⭐⭐⭐ ⭐⭐⭐⭐ ⭐⭐⭐ Chinese Language ⭐⭐⭐⭐ ⭐⭐⭐⭐ ⭐⭐⭐⭐⭐ ⭐⭐⭐⭐⭐ English Language ⭐⭐⭐⭐⭐ ⭐⭐⭐⭐ ⭐⭐⭐⭐ ⭐⭐⭐⭐ Reasoning ⭐⭐⭐⭐ ⭐⭐⭐⭐ ⭐⭐⭐⭐⭐ ⭐⭐⭐⭐ Speed ⭐⭐⭐⭐⭐ ⭐⭐⭐⭐ ⭐⭐⭐ ⭐⭐⭐⭐ Vision/Multimodal Limited ✅ (VL, Omni) ❌ ✅ (GLM-4.6V) Context Window Up to 128K Up to 128K Up to 128K Up to 128K API Compatibility OpenAI ✅ OpenAI ✅ OpenAI ✅ OpenAI ✅ Alright, now let me act

Teams make dozens of architectural decisions every month but document almost none of them. The rest dissolve into Slack threads, hallway conversations, and the minds of people who will leave the company within a year. Six months later, a new developer stares at the code and asks: "Why Redis here instead of PostgreSQL for queues?" Nobody remembers. An archaeological dig through Git history, Slack, and Notion begins. Two hours spent investigating a decision that originally took 15 minutes. Architecture Decision Records (ADRs) solve this problem. But they don't get written. The reason is simple: drafting an ADR takes 30-40 minutes, and the developer has already moved on to the next task. AI compresses that to 3-5 minutes. This article covers ADR structure, prompts for LLM-based generation, real-world examples, and CI pipeline automation. What ADRs are and why capturing architectural decisions matters An ADR (Architecture Decision Record) is a document that captures one specific architectural decision. Not a spec, not an RFC, not a design document. One decision, one file. Michael Nygard introduced the concept in 2011. The format took hold at large companies (Spotify, Thoughtworks, GitHub) but remains rare in smaller teams. The main reason: the writing overhead feels higher than the value it delivers. Three situations where the absence of ADRs hurts the most: Onboarding. A new developer reads the code and encounters an unconventional decision. Without an ADR, they either spend hours investigating, or treat it as a mistake and "fix" it. Both paths are expensive for the team. Revisiting decisions. Context changes: load increases, new requirements emerge, a dependency goes stale. Without a record of why the current solution was chosen and which alternatives were rejected, the team re-runs the entire analysis from scratch. Audits and compliance. In regulated industries (fintech, healthtech), architectural decisions require documented justification. ADRs close that gap automa

We'll get back to you. It's a sentence almost every job seeker has heard. For some, those words become the beginning of a new career. For many others, they become another unanswered promise. But the truth is, an interview doesn't begin when someone asks, Tell me about yourself . For millions of job seekers, it begins much earlier. Before the Interview Even Begins It's 6:45 in the morning. The alarm rings. A young professional stands in front of the mirror, adjusting the outfit they've carefully prepared the night before. He checks his resume one last time, gathers his documents, confirms the location, and takes a deep breath. As he’s about to leave, someone at home asks, “Do you think this one will work out?” He smiles. “I hope so.” He walks out carrying more than a folder. He carries expectations, financial pressure, family responsibilities, and the quiet hope that this interview might finally change everything. The Hidden Cost Nobody Talks About People talk about skills, preparation, and confidence. Those matter. But there’s another side rarely discussed: the hidden costs. Transportation. Professional clothing. Internet bills. Certification courses. Resume updates. Travel. Meals. Even taking a day off from a part-time job or missing freelance work. For someone without steady income, these aren’t just expenses — they’re investments with no guaranteed return. Sometimes they lead to an offer. Often, they end in rejection or silence. A Resume Can Tell You Skills. It Can’t Tell You a Story. A resume tells recruiters what a candidate has done. It doesn't tell them what they're carrying. It doesn't reveal the father waiting for good news, the mother asking how it went, the EMI due next week, the rent that can't wait, or the confidence slowly wearing down after repeated rejections. When Expectations Change Candidates prepare for the role they applied for. Sometimes they discover the responsibilities, salary, or even the position itself has changed. Business priorities evo

I spent the better part of the last decade writing enough boilerplate code to regret it. In the early PHP days, it was FTPing files; in the modern era, it's writing custom Python scripts just to check if a new Claude model is out or to see if my prompt is going to blow my budget on tokens. We have reached a point where we are building 'agentic workflows,' yet the first thing every developer does when they want an agent to interact with Anthropic is write an API wrapper. It's redundant work. If you're using Claude in Cursor or Claude Desktop, the model should be able to talk to its own source. The Anthropic MCP server changes this by turning the Messages API into a set of tools rather than a separate integration task. It turns your AI agent into an orchestration layer for the API itself. The problem with 'Just use the API' When you're building with LLMs, there's a hidden tax: context management and cost uncertainty. You send a prompt, it works. You send a slightly larger one, it hits a context limit or costs three times what you expected. If your agent has access to the count_tokens tool via MCP, the workflow changes fundamentally. Instead of blindly sending massive payloads and praying to the provider gods, the agent can 'pre-flight' a prompt. It can look at the messages array, calculate the input token count, and decide—without human intervention—whether it needs to truncate context or if it's safe to proceed. This isn't just about convenience; it's about building reliable, autonomous systems that don't fail halfway through a complex reasoning task because they hit a hard limit. Managing the heavy lifting: Batching as a first-class citizen The most underrated tool in this set is create_batch_message . If you've worked with Anthropic's batch API, you know it’s the only way to handle high-volume, independent requests without destroying your budget. It's 50% cheaper than standard requests. But managing batches traditionally is a pain in the neck. You have to submit th

The error looks like a typo in the remote URL. Usually it isn't. On a machine with more than one GitHub account signed in, this message is GitHub's way of saying wrong identity, not wrong address. The symptom A repo clone that has worked for months suddenly can't fetch or pull. The remote URL hasn't changed. The repo hasn't been renamed or deleted; you can open it in the browser just fine. Yet the command line insists otherwise: $ git pull remote: Repository not found. fatal: repository 'https://github.com/<org> /<repo>.git/ ' not found Why GitHub's error is misleading For a private repository, GitHub won't confirm or deny that the repo exists to a caller who isn't authorized to see it. Confirming would leak information about private repos to anyone probing URLs. So instead of a clear 403 Forbidden , an unauthorized request gets treated the same as a repo that truly doesn't exist: a 404 , which git renders as Repository not found . "Repository not found" on a private repo almost always means the credential attached to this request can't see it. It's rarely a wrong URL. The usual cause: two accounts, one keychain This shows up most on machines used for both personal and organization-owned work: a personal GitHub account for side projects, and a separate account (or SSO identity) that actually holds access to the org's private repos. Credential helpers cache one token per host. If the cached token belongs to the personal account, every git operation silently authenticates as that account, including ones against the org repo it has no rights to. personal-account --(switch)--> org-account Active, no repo access Has repo access Diagnose it First, confirm the remote itself is fine. $ git remote -v If the URL opens in a browser while logged into the right account, the remote isn't the problem. Next, check which credential is actually cached. On macOS with the default helper: $ git credential-osxkeychain get <<< $'protocol=https \n host=github.com' username=personal-account

Native XDP and generic SKB-mode XDP are not the same thing in practice. The same BPF program can pass the verifier and still behave differently depending on which mode the kernel uses, this could be a different verdict, different frame bytes, or different metadata. This post ships three things: an open differential test harness, a fixed eleven-packet corpus, and a simple way to classify the differences it finds. A tagged release lets anyone reproduce the virtio/veth baseline on Linux 6.8. The operational risk is straightforward. A firewall or rate-limiter validated only under native XDP can fall back to generic mode on an unsupported driver, a veth port, or after a reload. You keep the same bytecode, but behaviour can change, often without a clear error line. What this release includes: A harness loop: corpus → inject on the RX path → native vs generic sweep → xdpdump capture → compare.py manifest, comparing both the captured frame bytes and the XDP verdict ( PASS / DROP / TX / REDIRECT ). A deterministic corpus with eleven embedded test IDs ( 0xA001 – 0xA005 , 0xA007 – 0xA00C ; 0xA006 is intentionally omitted as a reserved gap in the generator). An operational divergence taxonomy (Class A / B / C). A virtio/veth smoke gate on Linux 6.8; now gating on frame bytes and verdict agreement that shows the full path is reproducible end to end. Scope for this post: native vs generic XDP on the virtio_vm profile only (five BPF programs, pinned manifests). This is part 1 of 2; it establishes the harness and an instrument-validity baseline; a follow-up post covers bare-metal divergence results. Physical NIC results are not part of this baseline. Ordinary conformance checks stop at “did the program load?” Differential testing asks a sharper question: given identical input packets, do the backends produce the same observable outcome at the hook? Background: native vs generic XDP Both modes load the same BPF object. They diverge at the hook point and in how the packet is represen

I kept re-running the exact same input through my translation app. Same code. Same model. Same everything. And the word "machines" kept flipping between two different translations. Sometimes it came out as "機械" (machine). Sometimes as "あなたのPC" (your PC). No code changed between runs. No input changed either. My first assumption was a race condition somewhere in my pipeline. It wasn't. Where I actually looked I checked the obvious suspects first: caching, threading, anything stateful that could make the same input behave differently on different runs. All clean. So I went one level deeper, into how the model picks the winning word. Translation models score every candidate word and pick whichever scores highest. When I logged the actual scores for "machine" vs "your PC" on this input, they were almost exactly tied. That's the part that mattered. When two candidates are separated by a tiny margin, the order floating-point operations get summed in can nudge the score just enough to flip which one wins. Same math, same inputs, different accumulation order between runs — and a near-tie flips sides. Nothing was actually random. It was deterministic all the way down. It just wasn't deterministic in a way I could predict, because the thing that decided the winner was rounding noise several layers below anything I was testing. The fix wasn't "make it deterministic" Forcing strict floating-point determinism across an ML pipeline is its own rabbit hole, and not one I wanted to go down for one word. Instead, I looked at why the tie was so close in the first place. "Machine" and "your PC" were close enough in meaning, in this context, that the model wasn't confident either way. So I widened the margin instead of trying to eliminate the noise: I swapped the input word choice from "machines" to "equipment," which the model was much more decisively confident about. Scores stopped being close enough for rounding noise to matter. The flip-flopping stopped. I want to be honest about a

TL;DR Traditional SaaS streaming requires exporting sensitive data to a vendor cloud, creating security risks and egress costs. BYOC reverses this model by running the data plane inside the customer’s cloud while the vendor manages the control plane. This keeps data within the enterprise perimeter while still providing a managed platform. Condense builds on this model with AI-driven automation, unified monitoring, and marketplace deployment, enabling private, compliant, and cost-efficient real-time data streaming. The enterprise data landscape is currently defined by a conflict between real-time AI data streaming utility and the strict requirements of data sovereignty . For years, the standard SaaS model forced a compromise. To access premium analytics, companies had to export sensitive telemetry to a vendor cloud. This created massive cloud egress costs and introduced significant security vulnerabilities. Bring Your Own Cloud (BYOC) for data streaming platforms has emerged as the professional solution to this dilemma. It allows a business to keep data within its own perimeter while benefiting from a fully managed, high-performance ecosystem. The BYOC Architecture: Privacy by Design An experienced analyst views BYOC as a clean separation of concerns. The architecture splits the environment into two distinct layers to ensure raw data never leaves the authorized environment. SaaS Control Plane: This is the management layer hosted by the provider. It handles the brain of the operation. It manages orchestration, user access, and pipeline configuration without ever seeing the actual data packets. Private Data Plane: This is the muscle. The managed Kafka clusters , Kubernetes (K8s) nodes, and storage engines like ClickHouse live inside the customer Virtual Private Cloud (VPC) . By keeping the data plane inside the customer perimeter, telemetry collection remains private. This architecture is the most direct path to satisfying internal security audits and global regulatory

Five litmus tests for “this will raise your intelligence” claims A pocket BS detector for brain-training ads, LinkedIn gurus, and your own wishful thinking. 1. Which dial moved? Intelligence talk smuggles four dials into one word: Dial Rough meaning g / fluid ability Harder to move; overclaimed constantly Knowledge & skill Moves with practice and education Acute sharpness Sleep, illness, mood, substances Long-horizon brain health Aging, disease risk, lifestyle If the claim does not say which dial, it is marketing soup. 2. What was the control? “People got better” is almost worthless. Better than last week of the same game is practice. Better than an active control that also gets attention, novelty, and expectation is interesting. Lumosity-style lawsuits exist because companies sold soup as medicine. 3. Near or far? Near transfer: you got better at this and close cousins. Far transfer: the effect jumped to something distant (school grades, matrix reasoning, life outcomes). Far transfer is scarce. Second-order metas on cognitive training keep finding near yes, far ≈ no once bias is handled. That is not cynicism. It is how human learning usually works. 4. Who was the sample? A processing-speed protocol that helps older adults does not automatically mint IQ points for a 24-year-old optimization bro. Deficient populations respond differently than well-nourished ones. Age and baseline matter more than branding. 5. Is the score flattering the seller? If the outcome is “our app score,” the app got better at measuring app use. Prefer outcomes that hurt to fake: standardized batteries against active controls, academic scores, carefully logged real-world performance. What I built instead of another vanity mini-game IntelligenceMax is a live reasoning gym: frontier models write fresh distinction-style items at your edge, and scoring is transparent / IRT-style. That is deliberate practice under honest difficulty, not a clinical IQ battery and not a promise that general intellige