AI 资讯

Have you ever noticed this? You explain your project to an AI chatbot, have a great conversation, then come back later... and it asks you to explain everything again. Start a new chat, and it's like meeting you for the first time. This isn't a bug. It's how most AI models work—they don't remember past conversations on their own. That's where Cognee comes in. Instead of making AI start from scratch every time, it gives AI a way to remember what matters. Why does AI forget everything? Most AI models don't have long-term memory. Every time you start a new chat, the AI only knows what you send in that conversation. It doesn't remember your previous chats, your project, or your preferences unless you provide them again. A common solution is RAG (Retrieval-Augmented Generation) . It stores your documents in a searchable database so the AI can look up relevant information when needed. RAG genuinely helps, but it only knows what sounds similar. It doesn't know "Priya" and "the payments lead" are the same person, or that this week's ticket shares a root cause with one from March. Similarity search finds neighbors — it doesn't understand relationships. That's where Cognee takes a different approach. What is Cognee? Cognee is an open-source memory layer for AI applications. Instead of making an AI start from scratch every time, Cognee helps it remember information across conversations. It can learn from your documents, files, websites, or notes and use that knowledge whenever it's needed. Unlike traditional RAG systems that mainly find similar text, Cognee also understands how different pieces of information are connected. That gives AI more accurate and meaningful answers. It's Apache-2.0, runs locally by default, and has 27k+ GitHub stars. How does it work? At a high level, the process is simple: flowchart LR A[Text, Files, URLs] --> B[remember()] B --> C[Cognee builds AI memory] C --> D[recall()] D --> E[AI answers using remembered knowledge] For example: "Alice bought a Pr

When you build a desktop app with Tauri v2 , sooner or later you'll hit a question: how do I bundle and manage an external CLI binary inside my app? Maybe it's ffmpeg for video processing. Maybe it's a database engine. Maybe — as in my case — it's frpc , the reverse-proxy client from the popular frp project. This post walks through the full lifecycle: bundling, spawning, lifecycle management, and even self-updating the binary at runtime — all from Rust. 1. Declaring the Sidecar In tauri.conf.json , declare the binary under bundle.externalBin : { "bundle" : { "externalBin" : [ "binaries/frpc" ] } } Tauri identifies the target platform by a filename suffix convention . You need to place the correctly-named binary in your project: Platform Filename macOS (Apple Silicon) frpc-aarch64-apple-darwin macOS (Intel) frpc-x86_64-apple-darwin Windows (x64) frpc-x86_64-pc-windows-msvc.exe Tauri automatically strips the suffix at runtime and loads the right binary for the current platform. 2. Spawning the Process Use tauri_plugin_shell to spawn the sidecar: use tauri_plugin_shell ::{ ShellExt , process :: CommandEvent }; #[tauri::command] async fn start_frpc ( app : tauri :: AppHandle ) -> Result < (), String > { let sidecar = app .shell () .sidecar ( "frpc" ) .map_err (| e | e .to_string ()) ? ; let ( mut rx , child ) = sidecar .args ([ "-c" , "frpc.toml" ]) .spawn () .map_err (| e | e .to_string ()) ? ; // Store the child handle so we can kill it later app .state :: < std :: sync :: Mutex < Option < tauri_plugin_shell :: process :: CommandChild >>> () .lock () .unwrap () .replace ( child ); // Listen to stdout/stderr in a background task tauri :: async_runtime :: spawn ( async move { while let Some ( event ) = rx .recv () .await { match event { CommandEvent :: Stdout ( line ) => { // Parse log line, update UI state... } CommandEvent :: Stderr ( line ) => { /* ... */ } CommandEvent :: Terminated ( _ ) => { // Process exited — update state machine } _ => {} } } }); Ok (()) } The

Stop the ReAct Chaos: Building Deterministic Multi-Agent Cycles with Spring AI Graph If you are still letting LLMs freely decide their next execution step in an unconstrained ReAct loop, you are burning cloud budget on infinite loops and non-deterministic failures. In 2026, enterprise-grade AI requires the strict guardrails of stateful, cyclic graphs where transitions are governed by code, not LLM vibes. Why Most Developers Get This Wrong Naive ReAct Loops: Relying entirely on prompt-based tool calling to determine flow, which inevitably derails after 3-4 turns. Stateless Agents: Passing massive, unmanaged chat histories back and forth instead of maintaining a single, thread-safe state object. Lack of Edge Controls: Failing to hardcode conditional transitions, letting the LLM hallucinate its way into non-existent API endpoints. The Right Way The solution is to model your multi-agent system as a deterministic, cyclic graph where the LLM only executes node-level tasks, while Java code controls the state transitions. Define an Immutable State: Use Java record types to represent the thread-safe state passed between nodes. Explicit Nodes and Edges: Map agents (e.g., Writer, Critic) to discrete nodes and use conditional routers to decide the next transition. Spring AI Graph API: Leverage Spring AI 1.2.0's StatefulGraph to manage state persistence and concurrent transitions out-of-the-box. Model Specialization: Use fast, cheap models (like Llama 3.3) for routing decisions, and reasoning models (like Claude 3.5 Sonnet) only for complex node tasks. Show Me The Code (or Example) // Define stateful graph with immutable State record var workflow = new StatefulGraph < AgentState >() . addNode ( "writer" , state -> writerAgent . call ( state )) . addNode ( "critic" , state -> criticAgent . call ( state )) . addEdge ( START , "writer" ) . addEdge ( "writer" , "critic" ) . addConditionalEdge ( "critic" , state -> { return state . isApproved () ? END : "writer" ; // Deterministic cy

In Part 1 , we learned that building great AI applications isn't just about writing better prompts. It's about providing the right context . But that naturally leads to another question: How much context can an AI actually understand? If you've used ChatGPT, Claude, Gemini, Cursor or any AI coding assistant for a while, you've probably experienced something like this. 🤔 "Didn't I Already Tell You That?" Imagine you're debugging a production issue with an AI assistant. You start by explaining the architecture. Then you share the API flow. Then database schema. Then logs. Then stack traces. After 30 minutes of conversation, you ask: "So what's causing the bug?" Instead of giving the answer, the AI responds: "Could you share your database schema?" You stare at the screen. "I already did..." Sometimes it even forgets details from earlier in the same conversation. Naturally, people assume: The AI has bad memory. The model is unreliable. The conversation is broken. In reality, something completely different is happening. You're running into one of the most important concepts in modern AI systems: The Context Window. Understanding this concept changes how you interact with AI—and more importantly, how you build AI-powered applications. 🧠 Before We Talk About Context Windows… We first need to understand something much smaller. Tokens. Almost every AI provider mentions them. Pricing is based on them. Context windows are measured using them. Yet many developers still think: 1 token = 1 word That isn't true. 🔤 What Exactly Is a Token? A token is the basic unit of text that an AI model processes. Humans naturally read text as: Characters Words Sentences Large Language Models don't. Before text reaches the model, it's converted into smaller pieces called tokens by a tokenizer. The model never sees your original sentence. It only sees a sequence of tokens. Think of a tokenizer as a translator between humans and AI. You write English ↓ Tokenizer ↓ Sequence of Tokens ↓ LLM The toke

1:00 AM to 2:27 AM. One bug, three root causes, zero clean error messages. It started with a simple complaint: an admin sends a push notification, and the user never receives it. No crash, no red error in the console, nothing obviously broken. Just silence on the other end. That kind of bug is the most frustrating kind. Everything looks like it's working. The permission prompt shows up fine. The admin panel says "sent." And yet nothing arrives. By 1 AM, after a long day already spent on a fairly large project, this was the last thing left to fix before calling it a night. It turned into an hour and a half of tracing one silent failure into another. Layer One: The CSP Was Blocking the Fix Before It Could Even Start The first clue showed up in the browser console: a Content Security Policy violation, quietly blocking a script that OneSignal's SDK needed to complete its own initialization. The permission popup looked completely normal, so it was easy to assume the subscription step was working. It wasn't. The script that OneSignal used internally to finish setting up the subscription was being blocked by the site's own security headers. The fix was small: add the missing domain to the script-src directive. But finding it meant not trusting what the UI looked like it was doing, and instead reading the actual network requests line by line. Layer Two: "Sent" and "Delivered" Are Not the Same Thing Once the CSP was fixed, notifications appeared to send successfully. The API returned a success response, an ID was created, and the admin panel showed a "sent" confirmation. Except the user still got nothing. This turned out to be a subtler problem. OneSignal's newer API doesn't return a recipient count in that initial response, so a message could be "created" successfully by OneSignal's servers while still reaching zero actual devices. The code was treating message creation as proof of delivery, which is not the same thing at all. The fix involved polling OneSignal's delivery-s

The 10 second test that keeps missing heart failure Margaret is 68. She gets breathless on a hill, sleeps on two pillows, and her ECG looks "normal." Six months later she is in the ED with fluid filled lungs. Her echo shows HFpEF, the stiff heart type that makes up half of all heart failure and is missed most often. What if her first ECG already held the answer? I broke down a new preprint from Norway where researchers trained an open source AI on 284,000 ECGs using a clever fix they call pragmatic labelling. Instead of trusting noisy ICD codes alone, they paired codes with NT-proBNP. The result is a model that reads raw 12 lead voltage and spots heart failure across the full EF spectrum. In prospective testing on 43,109 patients it hit AUC 0.84 overall, 0.91 for HFrEF, and up to 0.96 with strict labelling. It even outperformed NT-proBNP head to head, and flagged HFpEF in patients with normal biomarkers. No new hardware. Just better eyes on the ECG you already order. I wrote a simple walkthrough of how it works, where it fits in primary care, and what it gets wrong. Read the full breakdown here: https://sharetxt.live/blog/heart-failure-detection-in-ecg-using-ai

Tracking Tech Sentiment in Real-Time with VADER and Python What does the developer community feel about your product? Not what they say in reviews — what do they actually feel when they mention it on Hacker News or Reddit? I built a Sentiment Analyzer that fetches posts from HN and Reddit, runs VADER sentiment analysis, and outputs structured scores. Here's how it works. What It Does The tool pulls posts from two sources: Hacker News : Top or new stories via the official Firebase API Reddit : Any subreddit, sorted by hot, new, top, or rising Each post gets analysed with VADER (Valence Aware Dictionary and sEntiment Reasoner) — a rule-based model tuned for social media text. No GPU required, no API keys, no latency. What You Get Each analysed post includes: { "source" : "hackernews" , "title" : "Shadcn/UI now defaults to Base UI instead of Radix" , "sentiment" : "neutral" , "sentimentScores" : { "positive" : 0.0 , "neutral" : 1.0 , "negative" : 0.0 , "compound" : 0.0 }, "keywords" : [ "shadcn" , "ui" , "defaults" , "base" , "radix" ], "score" : 43 , "commentsCount" : 3 } The compound score ranges from -1 (very negative) to +1 (very positive). Anything below -0.05 is classified negative, above 0.05 is positive, and in between is neutral. Why VADER Instead of an LLM? Three reasons: Speed : VADER processes 10,000+ posts per second. An LLM call takes 1-2 seconds per post. Cost : VADER is free and runs locally. LLM sentiment analysis costs per token. Consistency : Rule-based models give identical results every time. LLMs can be inconsistent across runs. For high-volume monitoring tasks — like tracking every HN post mentioning your product — VADER is the right tool. Real-World Use Cases Brand Monitoring Set the analyzer to fetch posts from r/yourproduct and HN search for your brand name. Get daily sentiment reports. Catch negative sentiment before it escalates. Trend Detection Track sentiment around technologies like "AI agents", "Rust", or "WebAssembly" across both platfo

Introduction As data grows exponentially, accessing and querying databases efficiently...

As someone who is not affiliated with any of the big tech companies, I find it particularly difficult to have the confidence or enthusiasm to approach any ML problem with an attitude that my professors probably had at my stage in life. I'm sure I am not the only one having the following thoughts: "My research is currently being done better at companies." "ML problem I set out to solve is already solved and in fact turned into products and sold for millions at companies X, Y, Z. There is no need for further research." "Industry is not interested in theoretical ideas and there is plenty of evidence for that, starting with their hiring practice." "Companies wouldn't have millions of dollars in funding or revenues if their models weren't working." "Research is like Darwinian evolution. Evolution aims to produce the fittest model. After decades of evolution, the fittest model is already in industry, why should I explore other evolutionary dead-ends?" "There may not be a next big thing after LLM. If there were, it would be simply incorporated as a function or a subroutine that LLM simply calls when needed, and the average person would be none the wiser. My contribution would be invisible." Seems like research outside of big tech companies is pointless (unless you are a prof who is making big $$ while doing it). Because whatever they are working on might be lightyears ahead of whatever you are doing, but you wouldn't know because their model is simultaneously closed-source and omnipotent. There are tons of people sharing their resumes on other ML/CS subreddits and occasionally you see that their projects are along the lines of "linear regression for Titanic dataset" or "YOLO for pedestrian detection" and they are wondering out loud why nobody is hiring them. Everyone with more ML experience can see because there is zero need for people with this skillset. But what if my very research also looks the same to people in industry? What if my "deep geometric autoencoding variati

Back when we introduced MCP support , we ended on a teaser: Phase 3 would tackle Sampling —letting servers request completions from the host instead of only exposing tools and resources to it. NodeLLM 1.17 delivers on that, and pairs it with a second, unrelated but overdue improvement: precise control over how tool calls execute, now available consistently in both core and the ORM persistence layer. 🔄 MCP Sampling: Closing the Loop Sampling inverts the usual MCP direction. Instead of the client asking the server for tools, the server asks the client to run an LLM completion on its behalf. This lets an MCP server offer LLM-powered capabilities—summarization, classification, drafting—without needing its own API key or provider integration. createLLMSamplingHandler answers those requests using a real NodeLLM instance, so a server's tool ends up powered by whatever model you configure client-side: import { createLLM } from " @node-llm/core " ; import { MCP , createLLMSamplingHandler } from " @node-llm/mcp " ; const llm = createLLM ({ provider : " openai " }); const mcp = await MCP . connect ( { command : " node " , args : [ " ./sampling-server.mjs " ] }, { sampling : createLLMSamplingHandler ( llm , " gpt-4o-mini " ) } ); const tools = await mcp . discoverTools (); // The server only advertises sampling-backed tools once it sees // the client declared sampling support during the handshake. If you need full control over how a sampling request is answered—routing by model hint, injecting your own guardrails—pass a plain handler function instead of { llm, model } . It receives the raw sampling/createMessage params and returns a CreateMessageResult , so you decide exactly how (or whether) to answer. ⚡ Concurrent Tool Execution When a model returns several independent tool calls in the same turn, NodeLLM has always executed them one at a time. That's safe by default, but wastes time when the calls don't depend on each other—three weather lookups for three different cities, s

If you're a solo founder or small team shipping on GitHub, at some point someone asked you: "what changed in the last release?" And if you're honest with yourself, your answer was probably a Notion page nobody reads, a GitHub releases tab your users don't know exists, or "I'll get to it." A changelog sounds like a low-priority vanity feature. But here's what I've learned building a SaaS: when you ship frequently and users don't know what changed, they churn quietly — not because the product got worse, but because they never noticed it got better. Why Headway stopped being the answer For years, Headway was the indie-hacker answer to this problem. Beautiful in-app widget, dead simple setup, priced reasonably. A lot of us put it in our sidebars and called it done. The problem: Headway hasn't shipped a meaningful update since roughly 2020. No GitHub sync. No AI generation. No email notifications to push updates out to users. The integration ecosystem it was built for has moved on, and the product hasn't. Search "Headway alternatives changelog" and you'll find threads on Indie Hackers and Reddit full of people actively looking for something else. That's not a dead category — it's one where the go-to tool has been abandoned and nobody decent has filled the gap at the indie-hacker price point. What's actually available in 2026 Here's an honest look at the main options: Tool Price AI generation GitHub sync Email digest In-app widget Headway $29/mo No No No Yes AnnounceKit $79-129/mo Partial No Yes Yes Beamer $49-499/mo No No Yes Yes Shiplog $19/mo Yes Yes Yes Yes A few things worth noting: AnnounceKit is well-built and widely used. If you're a funded team or have a larger user base that needs NPS surveys and user segmentation, it earns its price. For a bootstrapped founder, $79/mo for a changelog widget is hard to justify before you're at serious MRR. Beamer is similarly full-featured and similarly priced for growth-stage SaaS teams. Their entry tier has gotten more reasona

AI coding assistants are great at writing code and terrible at knowing when to write it. Ask one to build a feature and it will happily jump straight to implementation, skipping the questions a good engineer asks first: what exactly are we building, why, what are the risks, and how should it be broken down? The result is fast output that often solves the wrong problem. AWS's AI-DLC (AI-Driven Development Life Cycle) is an attempt to fix that gap. It's an open-source set of workflow rules — released by awslabs — that steer AI coding agents through a disciplined software development process instead of letting them freewheel. Importantly, it isn't a tool you install or a service you pay for. It's a methodology delivered as a bundle of markdown rules that your existing coding agent reads and follows. The core idea: methodology over tooling One of AI-DLC's stated tenets is "methodology first." The whole thing ships as plain markdown rule files that you drop into whatever your agent already uses for project instructions — CLAUDE.md for Claude Code, .cursor/rules/ for Cursor, .github/copilot-instructions.md for GitHub Copilot, .amazonq/rules/ for Amazon Q, steering files for Kiro, and so on. There's nothing to run. The agent loads the rules and its behavior changes. This makes AI-DLC deliberately agnostic . It doesn't tie you to a specific IDE, model, or vendor — any coding agent that supports project-level rules can use it. The philosophy is that a good development methodology should outlive any particular tool. A three-phase adaptive workflow At its heart, AI-DLC organizes work into three phases that mirror how thoughtful software actually gets built. The Inception phase answers what to build and why . This is where the agent does requirements analysis, creates user stories when they're warranted, sketches the application design, breaks work into units that can be built in parallel, and assesses risk and complexity before a line of code is written. The Construction phase

The 2026 World Cup has $3.89 billion bet on it across Polymarket. That's not retail money — that's whales. I built WhaleTrack to track exactly what those big wallets are doing. Here's the stack: Backend: Node.js server fetching live data via Bullpen CLI Frontend: Vanilla JS, real-time updates Data: Polymarket CLOB API via Bullpen Analytics: Google Analytics for traffic tracking The hardest part wasn't the code — it was getting users. Pure SEO and content distribution (Reddit, Twitter, IH). The site is live at whaletrack.app — would love feedback from devs on the UX and performance. Happy to open source parts of it if there's interest.

Privacy isn't a checkbox. It's not a statement in your terms of service. It's not a toggle in your settings app. Privacy is architecture. And most apps get this backwards. The Architecture Test Here's a simple test for any app that claims to be "privacy-first": If your server goes down, can anyone still access user data? If the answer is yes, your privacy is a policy question — not a technical guarantee. You've built a system where trust in the company replaces trust in the code. Every photo cleaner that uploads your images to a server has already failed this test. The moment data leaves your device, privacy becomes something you promise rather than something you enforce . What On-Device Processing Actually Means When we built Swipe Cleaner, we made one architectural decision that defined everything else: zero data leaves the phone . This means: No cloud processing of photos No API calls that transmit image data No server-side storage of any kind Every scan, every classification, every cleanup happens locally The app is 4.7 MB. That's it. There's nothing to hide because there's nowhere to hide anything. Why Architecture Beats Policy Companies spend millions on legal teams writing privacy policies that their architecture contradicts. They collect data "to improve the service" while the service could have been designed to not need that data in the first place. Policy-based privacy Architecture-based privacy "We promise not to misuse your data" "We can't misuse data we never have" Requires ongoing trust Verifiable by anyone Can change with an update to ToS Requires rewriting the entire app Compliance-driven Principle-driven The Trust Problem Here's what I've learned building privacy-focused tools: users can't verify your privacy policy. They can't audit your servers. They can't check if you're actually deleting their data after processing. But they can verify that an app never sends their photos anywhere. They can check network traffic. They can inspect the binary. Tha

Your codebase almost certainly relies on RSA and elliptic-curve cryptography — TLS, JWTs, SSH keys, signed tokens. All of it is breakable by a large enough quantum computer (Shor's algorithm), and "harvest now, decrypt later" means data you encrypt today can be captured today and decrypted later. Regulators noticed: CNSA 2.0 (US federal + suppliers), DORA (EU financial entities, applies from Jan 2025), and NIS2 now mandate strict cryptographic risk management — which in practice means knowing where your quantum-vulnerable crypto lives, a cryptographic bill of materials (CBOM). Most teams can't answer "where is our RSA/ECC?" off the top of their head. Here's how to make CI answer it for you, on every push, for free. What we're building A GitHub Action that scans your repo, grades its post-quantum readiness A–F , writes a CycloneDX 1.6 CBOM , and — if you want — fails the build when classically-broken crypto (MD5, RC4, 3DES, deprecated TLS) shows up. Step 1 — try it in your browser first (30 seconds, nothing uploaded) Before touching CI, paste a package.json / requirements.txt / cipher list into the in-browser scanner and see your grade. It runs entirely client-side — no upload: https://throndar.ai/cbom Step 2 — add it to CI (the 5 lines) # .github/workflows/pqc-readiness.yml name : PQC readiness on : [ push , pull_request ] jobs : scan : runs-on : ubuntu-latest steps : - uses : actions/checkout@v4 - uses : brandonjsellam-Releone/pq-readiness-scorecard@v1 with : path : . That's it. The Action is self-contained and dependency-free — no npm install , no setup step. On the next push it prints a scorecard to the job summary: Post-Quantum Readiness Scorecard: D (52/100) — Quantum-vulnerable — migrate 3 files · broken-classical 0 · quantum-broken 4 · weakened 1 · resistant 0 Step 3 — see findings in the Security tab (SARIF) The Action emits SARIF 2.1.0. Upload it and every finding shows up as a code-scanning alert: - id : pqc uses : brandonjsellam-Releone/pq-readiness-score