标签：#ens

We’ve all been there: you hit the gym three days in a row, hit your PRs, and feel like a Greek god. But by Thursday, you're exhausted because you forgot that "working out more" requires "eating more protein." In the era of AI Agents and LLMs, we shouldn't be manually tracking these gaps. We should be building autonomous systems that bridge the gap between our HealthKit data and our kitchen. In this tutorial, we are diving deep into the world of automated health management . We will use AutoGen to create a multi-agent swarm, LangGraph to manage complex state transitions, and Node-RED to bridge the gap between our code and the physical world (or at least our meal prep app). By the end of this, you’ll have a blueprint for an agent that monitors your fitness trends and proactively adjusts your life. The Architecture: Multi-Agent Synergy To make this work, we need more than just a simple script. We need a "Health Council." We'll deploy three distinct agents: The Data Analyst : Scrutinizes HealthKit API logs for trends. The Nutritionist : Specializes in macro-nutrient balance and dietary science. The Logistician : Executes the plan via Node-RED webhooks and Google Calendar. System Workflow graph TD A[HealthKit API] -->|Daily Logs| B(Health Monitor Agent) B -->|Trend Detected: High Activity/Low Protein| C{Nutritionist Agent} C -->|Calculates New Macros| D(Logistician Agent) D -->|Webhook Trigger| E[Node-RED Flow] E -->|Update| F[Meal Prep App / Calendar] E -->|Send| G[Notification/Email] F -.->|Feedback Loop| B Prerequisites Before we start coding, ensure you have the following in your toolkit: Python 3.10+ AutoGen : pip install pyautogen LangGraph : For stateful orchestration. Node-RED : Running locally or on a server to handle the Webhooks. OpenAI API Key : (Preferably GPT-4o for complex reasoning). Step 1: Defining the Agent Personas The magic of AutoGen lies in the "System Message." We need to give our agents distinct personalities and toolsets. import autogen config_l

Cross-Harness Tool Parity: Write One Custom MCP Tool, Deploy It Everywhere Achieving true tool parity across AI coding environments is no longer a theoretical challenge. Learn how the Model Context Protocol (MCP) enables a single, custom tool configuration to function seamlessly within Claude Code, Cursor, Codex, Gemini CLI, Copilot, and Windsurf, eliminating redundant setup and accelerating development workflows. The Problem with Pollinated Tooling Today’s developer landscape is fractured by AI tool choice. While having options like Cursor, Windsurf, and GitHub Copilot is beneficial, it creates a significant maintenance burden. If you build a custom internal tool—say, a wrapper around your company’s deployment API—you often find yourself maintaining six different integration scripts, configuration files, and authentication flows. One for Claude Code, another for the Gemini CLI, a separate one for Cursor’s extensions. This lack of tool parity means time is wasted on plumbing, not product. The core issue is that each "harness" or AI coding environment has its own proprietary way of discovering, authenticating, and invoking tools. The result is a siloed ecosystem where a powerful utility locked inside one editor remains inaccessible in another. What developers need is a universal contract—a standard way to define a tool that any AI harness can understand and execute with zero modification. The MCP Advantage: A Universal Tool Contract The Model Context Protocol (MCP) provides this exact contract. An MCP tool is not a plugin for a single editor; it is a standalone server that exposes a typed interface. Your tool is defined once, in a single configuration file and codebase. AI harnesses that support MCP act as clients, automatically discovering and invoking your tool based on this shared contract. Think of it as building a REST API but for AI agents. You define the endpoints (your tool's functions) and their schemas. Any compliant client—whether it's the agent running in

Hermes Memory Installer, a tool designed to streamline memory allocation in distributed systems, recently received a critical update: a fix that ensures alerts are raised when the host experiences resource pressure. This improvement is vital for maintaining system stability and preventing cascading failures. In this post, we'll explore the details of this fix, its implementation, and its significance for experienced developers managing memory-intensive workloads. Understanding Host Resource Pressure In distributed environments, resource pressure occurs when the host system is constrained—high CPU load, low available memory, or excessive I/O. For tools like Hermes Memory Installer, which allocate and manage memory across nodes, ignoring host pressure can lead to OOM kills, throttling, or degraded performance. Before this fix, the installer lacked proactive alerting, leaving operators unaware of critical conditions until it was too late. This update directly addresses that gap. The Fix: Alert on Host Resource Pressure The recent update introduces a monitoring layer that continuously evaluates host metrics. When resource pressure thresholds are exceeded, the installer raises an alert, enabling operators to take immediate action. The fix is not just about detection; it integrates seamlessly with existing logging and monitoring infrastructure, ensuring alerts are visible in centralized systems. Key aspects of the fix: Continuous monitoring of memory usage, CPU load, and I/O metrics. Configurable thresholds to match specific hardware or workload requirements. Alerts emitted via syslog or custom handlers, supporting integration with tools like Prometheus or PagerDuty. Implementation Details The core of the fix is a lightweight monitoring module that runs alongside the installer. Here's a simplified example of how it might work: import psutil import logging class ResourceMonitor : def __init__ ( self , memory_threshold = 0.85 , cpu_threshold = 90 ): self . memory_threshold

Australia was the first country to issue a ban in late 2025, aiming to reduce the pressures and risks that young users may face on social media, including cyberbullying, social media addiction, and exposure to predators.

Agents that call tools over a network eventually retry a call they shouldn't have. If the tool isn't idempotent, that retry becomes a duplicate charge, a duplicate email, a duplicate order — quietly, with nothing in the logs to flag it. It's a decades-old distributed-systems problem wearing a new agent costume, and as far as I could tell, nobody had shipped a small, pip-installable fix for the agent-shaped version of it. So I built one. It's called latch . Worth saying up front: this is not a novel idea, and I'd rather say so myself than have someone point it out in the comments. The bug, live Here's the whole thing in one file, no library involved: def charge_card ( order_id , amount ): time . sleep ( 0.4 ) # the payment API is a little slow today ledger [ order_id ] += 1 return { " order_id " : order_id , " status " : " charged " } def agent_charge_with_naive_retry ( order_id , amount , max_retries = 2 ): for attempt in range ( max_retries ): thread = threading . Thread ( target = lambda : charge_card ( order_id , amount )) thread . start () thread . join ( timeout = 0.2 ) # the agent's own client-side timeout if thread . is_alive (): continue # "no response, let's retry" return # got a response The payment call takes 0.4s. The agent gives up waiting after 0.2s and retries. The first attempt is still running in the background — it wasn't cancelled, it can't be safely cancelled, Python threads don't work that way. So it finishes on its own time and charges the card. Then the retry charges it again. The agent's own view of the world is "everything's fine, got a response eventually." The ledger says otherwise. This is examples/naive_agent_example.py in the repo, if you want to run it and watch it happen rather than take my word for it. None of this is exotic. It's the same class of problem as "what happens when a payment gateway's webhook fires twice," which every backend engineer who's touched Stripe has dealt with. The fix has a name — idempotency keys — and it's b

I spent last month reviewing JWT implementations across 12 open-source Node.js projects on GitHub — ranging from starter templates with 2k stars to production boilerplates used by teams at real companies. I found the same 6 mistakes in almost every one. None of these projects are bad. The developers are skilled. The mistakes are subtle, copy-paste errors from tutorials that nobody questioned. Here they are. Mistake 1 — The Secret Is Literally "secret" I found this in three separate projects: const token = jwt . sign ({ userId : user . id }, " secret " , { expiresIn : " 1h " }); This secret is in every JWT tutorial on the internet. It is in the jwt.io documentation. It is in the jsonwebtoken README. Developers copy it and forget to replace it. A 6-character ASCII secret has approximately 42 bits of entropy. A GPU cluster cracks it from a dictionary in milliseconds. Generate a real secret here — it takes 3 seconds and produces a 256-bit cryptographically random key. Mistake 2 — jwt.decode() Used in Auth Middleware // DANGEROUS — this is in a production auth middleware const decoded = jwt . decode ( req . headers . authorization . split ( " " )[ 1 ]); if ( ! decoded . userId ) return res . status ( 401 ). send ( " Unauthorized " ); jwt.decode() does not verify the signature. It reads the payload regardless of whether the token is valid, expired, or forged. An attacker can craft any payload they want and it will pass this check. The fix is two characters: jwt.verify() . const decoded = jwt . verify ( token , process . env . JWT_SECRET , { algorithms : [ " HS256 " ] }); Mistake 3 — Algorithm Not Specified in verify() // Missing algorithms option jwt . verify ( token , secret ); Without { algorithms: ['HS256'] } , the library trusts whatever algorithm is in the token's header. An attacker can create a token with alg: none and an empty signature — and jwt.verify() will accept it. Always specify the expected algorithm explicitly. Mistake 4 — Secret Committed to Version Cont

When I started programming, Git was hard for me — like anything new is at first. Over time I noticed something: most of the best resources for learning it are in English. And for a lot of people just starting out, that's one more obstacle they shouldn't have to deal with. So in my spare time I built the thing I wish I'd had back then: Commitea . What is it? Two pieces, designed to complement each other: An open source repo with the full documentation in Spanish — from what a commit actually is, to how to get yourself out of trouble with rebase , a cherry-pick , or a push you regret. Every entry follows the same format: the concept in one sentence, a real example with commands, and "how this breaks" (the typical mistake people make). A web app with an interactive visualizer ( commitea-web.vercel.app ) where you type real Git commands and watch, live, what happens to the branch/commit graph. It doesn't touch any real repo — it's an in-memory simulator, but the engine actually replicates real Git behavior: fast-forward vs. merge commit detection, history rewriting on rebase, blocking a branch switch when you have uncommitted changes (just like real Git does), etc. What's in it right now 7 built-in scenarios you can run with one click and watch play out step by step: branch + merge, fast-forward, rebase, cherry-pick + reset --hard, fixing a commit made on the wrong branch, several branches merging in sequence, and stashing changes. Full command support : branch , checkout , commit , merge , rebase , cherry-pick , reset --hard , stash (with an edit helper command to simulate uncommitted changes, since the simulator has no real filesystem), status , and log . Site-wide search (⌘K), powered by Pagefind, indexing only the actual article content — not nav or boilerplate. A feedback widget on every article ("was this helpful?") that stores vote counts in Redis, so I know which content needs work without guessing. Light/dark mode , respecting system preference by default. A ch

Every "run this model locally" guide tells you to grab a Q4 GGUF and move on. That advice is fine right up until you try a long-context run and your machine starts swapping. The weights are the part everyone budgets for Quantization maths is straightforward. A model's weight footprint is roughly params x bits / 8 : Quant Bits/param 12B model Quality note Q8_0 ~8.5 ~12.8 GB Near-lossless, rarely worth it Q6_K ~6.6 ~9.9 GB Very close to Q8 Q4_K_M ~4.8 ~7.2 GB The usual sweet spot Q3_K_M ~3.9 ~5.9 GB Noticeable degradation Below Q4 the loss stops being subtle. Instruction-following degrades before raw perplexity does, which is why benchmark numbers can look fine while the model quietly stops respecting your system prompt. The KV cache is the part that bites Here is what the guides skip. The KV cache scales with context length , and it is not quantized by default: kv_bytes ~= 2 (K and V) x layers x kv_heads x head_dim x seq_len x dtype_bytes The practical consequence: a model that loads in 7 GB can need well over twice that at long context. Grouped-query attention helps a lot — kv_heads is much smaller than attention heads — but the term still grows linearly with sequence length while your weights stay fixed. Two knobs matter more than picking a fancier quant: --ctx-size : do not allocate 128K if your prompts are 8K. You are reserving memory you will never touch. KV cache quantization ( q8_0 for K/V): roughly halves cache memory for a quality hit most workloads never notice. Underused. A decision order that works Start at Q4_K_M Set context to what you actually use, not the model maximum If you are still tight, quantize the KV cache before dropping to Q3 Only move up to Q6/Q8 if you have headroom left over That ordering matters: dropping to Q3 to buy context is the most common mistake, and it trades a permanent quality loss for memory you could have gotten from the cache instead. Per-quantization benchmarks and deployment notes for the Gemma 4 family are collected at ge

AI agents can reason about the web. But giving an agent unrestricted browser or network access creates a serious authority problem. The obvious solution is to restrict the tools available to the agent. Then I kept running into the opposite problem: Once the tool became sufficiently restricted, it lost many of the capabilities required to complete real work. I wanted both sides: Enough power to crawl, render, navigate, extract, capture, and investigate the web Explicit operator control over origins, credentials, budgets, browser hooks, profiles, and evidence So I built Cockroach Crawler . It is an open-source Node.js and TypeScript toolkit for AI agents, RAG pipelines, documentation indexing, research, QA, and web-data workflows. I connected it to OpenClaw and Codex , and the difference was honestly wild. Instead of giving the agents one narrow search tool, I gave them a bounded web-research layer that could crawl websites, inspect JavaScript applications, extract structured data, process PDFs, take screenshots, generate PDFs, inspect public sources, and return evidence with provenance. And for many public workflows, I did not need to configure a separate API key for every source. GitHub: https://github.com/AjnasNB/cockroach-crawler Documentation: https://cockroachcrawler.com/docs/ npm: https://www.npmjs.com/package/cockroach-crawler What changed after I connected it to OpenClaw and Codex? Before this, the agents could reason well, but their web access was limited. They could answer questions, write code, and work with the context I gave them. But once a task required deeper live-web investigation, I still had to manually combine several tools. After connecting Cockroach Crawler, they could: Crawl public websites Render JavaScript-heavy pages Follow sitemaps Search and map documentation sites Extract readable Markdown Extract structured fields with CSS, XPath, or restricted regular expressions Read local and remote PDFs Generate PDFs Take screenshots Handle bounded c

When ChatGPT, Claude or Perplexity answers a question about your product, it is not consulting a decade of PageRank. It fetches a handful of pages and tries to work out what your site is. That is a very different retrieval problem from classic search, and most sites are accidentally hostile to it. Why sitemaps are the wrong mental model A sitemap optimises for coverage — every URL, every paginated archive, every tag page. That is correct for a crawler with a huge budget and a ranking model to sort the noise afterwards. An LLM landing on your site has neither. It has a limited context window and one shot. If the first thing it ingests is 400 URLs of ?page=17 and /tag/misc , your three genuinely useful guides are buried. llms.txt inverts this. It is a small markdown file at your root that optimises for priority : # Your Product > One-line description of what this actually does. ## Docs - [ Quickstart ]( https://example.com/docs/quickstart ) : Install and first request in 5 minutes - [ API Reference ]( https://example.com/docs/api ) : Every endpoint with request/response examples Two rules make or break it: Every link carries a description. The colon-suffix annotation is what lets a model decide whether to fetch a page. A bare link list is barely better than a sitemap. Omit aggressively. If a page does not answer a question someone would ask, it does not belong. llms-full.txt and the context tradeoff llms-full.txt inlines expanded content rather than linking out, so a model can ingest everything in one request. This is genuinely useful for compact docs — and actively harmful for large sites, where you will blow the context window and get truncated mid-document. Rough heuristic: if your docs exceed roughly 50k tokens, ship llms.txt alone and let models fetch selectively. The part nobody mentions: it rots This is where most implementations quietly fail. You write the file, ship it, and three months later half the descriptions describe features you renamed and two links 4

Anduril is said to be raising a new round of funding that may push its valuation up to about $100 billion, per Reuters.

GitHub热门项目 | Solution for long term memory for agent coding CLIs and to facilitate handoff between different agent vendors | Stars: 1,212 | 186 stars this week | 语言: Rust

GitHub热门项目 | Self-hosted audiobook and podcast server | Stars: 13,677 | 111 stars this week | 语言: JavaScript

GitHub热门项目 | A network diagnostic tool | Stars: 7,361 | 56 stars today | 语言: Rust

GitHub热门项目 | Modern server management panel built with Rust and React. Sites, databases, Docker apps, Git deploy, mail, DNS, monitoring, backups, and security — all in one panel. | Stars: 467 | 13 stars today | 语言: Rust

GitHub热门项目 | Route, manage, and analyze your LLM requests across multiple providers with a unified API interface. | Stars: 1,456 | 6 stars today | 语言: TypeScript

GitHub热门项目 | Crawlee—A web scraping and browser automation library for Node.js to build reliable crawlers. In JavaScript and TypeScript. Extract data for AI, LLMs, RAG, or GPTs. Download HTML, PDF, JPG, PNG, and other files from websites. Works with Puppeteer, Playwright, Cheerio, JSDOM, and raw HTTP. Both headful and headless mode. With proxy rotation. | Stars: 24,963 | 69 stars today | 语言: TypeScript

GitHub热门项目 | 💾 Self-hosted online file converter. Supports 1000+ formats ⚙️ | Stars: 17,911 | 240 stars today | 语言: TypeScript

GitHub热门项目 | High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, AVIF and TIFF images. Uses the libvips library. | Stars: 32,496 | 9 stars today | 语言: JavaScript

GitHub热门项目 | 🌐 Make websites accessible for AI agents. Automate tasks online with ease. | Stars: 106,530 | 270 stars today | 语言: Python