标签：#opensource

GitHub热门项目 | Experimental menu for GTA 5: Enhanced | Stars: 1,483 | 38 stars today | 语言: C++

GitHub热门项目 | 🤯 LobeHub is your Chief Agent Operator, organizing your agents into 7×24 operations by hiring, scheduling, and reporting on your entire AI team. | Stars: 79,951 | 51 stars today | 语言: TypeScript

GitHub热门项目 | Bonsai Demo | Stars: 1,380 | 323 stars today | 语言: Shell

GitHub热门项目 | 🦔 PostHog is an all-in-one developer platform for building successful products. We offer product analytics, web analytics, session replay, error tracking, feature flags, experimentation, surveys, data warehouse, a CDP, and an AI product assistant to help debug your code, ship features faster, and keep all your usage and customer data in one stack. | Stars: 35,625 | 58 stars today | 语言: Python

GitHub热门项目 | Apache Ossie, industry wide specification effort to standardize how we exchange semantic metadata across analytics, AI and BI platforms, providing a vendor neutral, single source of truth for semantic data | Stars: 750 | 34 stars today | 语言: Python

Every TypeORM project I've worked on grows the same few dangerous lines. I got tired of catching them by hand, so I wrote a linter that does it for me. I was reviewing a pull request a while back and nearly scrolled past this line: await manager . query ( `SELECT * FROM users WHERE id = ${ req . params . id } ` ); Looks fine at a glance. It's a SQL injection hole. The id comes off the request and lands directly in the query string. The thing that bugged me is that I only caught it because I happened to be reading carefully on that line, that day. Review catches this sort of thing a lot of the time. "A lot of the time" is how these end up in production. It's usually not only injection either. The same projects tend to collect a few other habits: synchronize: true in a data source config. It rewrites your schema on startup and can drop a column on the next deploy. A QueryBuilder delete() or update() that hits .execute() with no .where() . Forget that one line and you've changed every row in the table. Three or four writes in one function, none in a transaction, so if the second throws you're left with half-written data. On multi-tenant apps, a query that forgets the tenant filter. That's how one customer sees another customer's data. None of these really need a person to catch them. They're mechanical. A linter can do it on every commit. So I built one. eslint-plugin-typeorm-enterprise npm install --save-dev eslint eslint-plugin-typeorm-enterprise // eslint.config.js const typeormEnterprise = require ( ' eslint-plugin-typeorm-enterprise ' ); module . exports = [ typeormEnterprise . configs . recommended ]; Now those patterns are lint errors. Ten rules today, split into configs ( recommended , strict , performance , multiTenant ): raw SQL, interpolated and concatenated SQL, unsafe QueryBuilder deletes, EntityManager raw queries, writes outside a transaction, tenant scoping, and a nudge to stop counting rows when you only need to know one exists. Two things I was picky

What I learned at Zone01 Kisumu's IP training Introduction Yesterday, I attended an Intellectual Property training at Zone01 Kisumu, and it fundamentally changed how I think about the code I write. As developers, we spend countless hours building software, but how many of us truly understand the value of what we create,and how to protect it? In Kenya's rapidly growing tech ecosystem, understanding IP isn't just a legal nicety, it's a competitive advantage. Whether you're building an app, contributing to open source, or launching a startup, knowing your rights can mean the difference between owning your work and losing it. This article breaks down the essential IP frameworks every software developer should know. What is Intellectual Property in Software? Intellectual Property (IP) in software encompasses legal protections designed to safeguard the rights of creators and developers. The four primary types of IP protection relevant to software are: patents, copyrights, trademarks, and trade secrets . Copyright: Protecting Your Code Copyright is the most immediate form of protection for software developers. In Kenya, copyright protection arises automatically at the moment of creation,registration is not mandatory . This means that when you write code, you automatically own the copyright to that expression, provided the work is fixed in a tangible medium . However, a crucial distinction exists: copyright protects the expression of ideas, not the ideas themselves . This principle was reinforced in the Kenyan case of Solut Technology Limited v Safaricom Limited, where the court confirmed that without access to source code, it's difficult to prove infringement because the "expression" (the code itself) wasn't shared . Key Insight: Registering your copyright with KECOBO in Kenya provides prima facie evidence of ownership and can make enforcement faster if someone copies your work . Patents: Protecting Functionality While copyright protects the expression of code, patents pro

GitHub热门项目 | Let Pi control your apps on MacOS & Windows | Stars: 1,312 | 103 stars today | 语言: TypeScript

Just shipped Timezone Convert API — DST-aware IANA timezone conversion. Free, no key, CORS-enabled. Endpoints GET /convert?time=2026-07-16T09:00&from=Asia/Kolkata&to=America/New_York GET /now?zone=Europe/London GET /offset?zone=Pacific/Auckland GET /diff?a=Asia/Tokyo&b=Asia/Kolkata GET /zones (400+ IANA zones) Try it curl "https://timezone-convert.techtenstein.com/now?zone=Europe/London" Live at https://timezone-convert.techtenstein.com — OpenAPI 3.1 spec at /openapi.json . MIT.

We open-sourced Tanso Core: a self-hosted monetization engine for B2B AI products. Usage metering, prepaid credits, entitlements, and Stripe billing in one Spring Boot service, with one property the rest of the stack doesn't have. Every metered event carries its cost. Repo: https://github.com/tansohq/tanso-oss The gap If you sell an AI product today, your monetization stack is split across two categories of tools that don't talk to each other. Billing platforms meter usage and generate invoices, but they have no idea what your inference costs. They can tell you a customer consumed 40,000 events. They cannot tell you whether you made money on them. LLM observability tools know your costs down to the token, but they don't bill anyone. They can tell you a feature costs $0.038 per run. They cannot connect that to what the customer paid for it. So margin per customer, the number that decides whether your pricing works, lives in neither system. Most teams reconstruct it in a spreadsheet, quarterly, if at all. Tanso keeps both sides in one ledger. Every event you ingest records what you billed and what it cost you: input and output tokens, model, provider. Margin per customer, per feature, per model is a query, not a project. What it allows Enforcement at ingestion, not at invoice time. Entitlement checks, usage caps, and credit limits are applied when the event comes in. If a customer is out of credits, the check fails now, not on a reconciliation job three weeks later. For AI products, where a runaway integration can burn real money in an afternoon, this is the difference between a limit and a suggestion. Credits as a first-class primitive. Prepaid credit pools per customer, with grants, deductions, expirations, and full transaction history. Most AI products end up selling some form of prepaid usage. Bolting that onto a subscription-shaped billing system is painful; here it's the core model. Stripe as a payment adapter, not the source of truth. Billing state lives in Tan

느린 LLM 호출 중 DB connection을 잡지 않는 이유 AI 기능의 latency는 모델 응답 시간으로만 끝나지 않습니다. 요청이 LLM이나 embedding API를 기다리는 동안 데이터베이스 session까지 긴 범위로 유지하면, 느린 외부 호출이 DB connection pool의 압력으로 전파될 수 있습니다. 이 글은 AI memory OSS인 Honcho의 변경 이력과 pinned source를 읽으면서, 외부 호출과 DB transaction/session 경계를 어떻게 분리했는지 추적한 기록입니다. Scenario Honcho의 dialectic 경로(저장된 memory를 근거로 사용자 질문에 답하는 질의 경로)는 답하기 전에 다음 작업을 수행합니다. peer·session·workspace 확인 -> 관련 memory 검색 -> embedding·LLM 호출 -> 필요하면 tool로 추가 조회·기록 -> 답변 생성 여기에는 짧은 DB 조회와 상대적으로 느리고 변동성이 큰 외부 호출이 섞여 있습니다. 두 작업을 하나의 session scope로 묶으면, DB가 필요하지 않은 대기 시간까지 session lifetime에 포함됩니다. 변경 전에는 무엇이 묶여 있었나 PR #477 직전의 agentic_chat 은 하나의 tracked_db context 안에서 peer와 설정을 읽고, 그 session을 DialecticAgent 에 전달한 뒤, agent.answer() 가 끝날 때까지 같은 context를 유지했습니다. streaming 경로도 같은 형태였습니다. 구조를 단순화하면 다음과 같습니다. DB session open -> preflight read -> DialecticAgent receives session -> embedding / memory tools / LLM answer DB session close commit 0533c6d 의 제목도 이 문제를 dialectic held connection 으로 기록합니다. 다만 이번 분석에서는 실제 pool checkout 시간이나 장애를 재현하지 않았습니다. 여기서 확인한 것은 코드의 session scope와 변경 의도입니다. SQLAlchemy의 session 객체를 만들었다고 곧바로 connection을 점유하는 것은 아닙니다. 하지만 이 경로처럼 SQL을 실행해 transaction이 시작되면 session은 pool에서 빌린 connection을 commit·rollback까지 유지합니다. Honcho의 tracked_db 는 종료할 때 rollback() 과 close() 를 호출하므로, SQL 실행 뒤 이 context를 LLM 대기까지 유지하던 범위를 줄이는 것은 이 경로의 connection 점유 구간도 줄이는 일입니다. 어떻게 경계를 줄였나 변경 후에는 tracked_db("dialectic.preflight") 가 본 작업 전 검증과 설정 조회(preflight), 즉 peer 존재 여부, session/workspace 설정, peer card를 읽는 구간만 감쌉니다. context가 끝난 다음에 DialecticAgent 를 만들고 LLM 답변을 생성합니다. Agent 생성자에서도 DB session 인자가 제거됐습니다. short DB preflight -> 필요한 값 읽기 DB session close agent execution -> embedding / LLM / tools tool needs DB -> tool-owned short DB session -> close 핵심은 DB 사용을 없앤 것이 아닙니다. 요청 전체가 session을 소유하는 대신, DB가 필요한 작업이 자기 범위의 session을 소유하도록 바꾼 것 입니다. pinned current code에서도 유지되는가 분석 기준 commit 85239a6 에서도 이 경계는 유지되고 더 구체화돼 있습니다. src/dialectic/chat.py 의 일반·streaming 경로 모두 preflight context를 닫은 뒤 agent를 실

Every agent-security vendor tells you what they block. Nobody tells you what they miss. That gap is the whole problem. "We stop prompt injection" is a claim you cannot check. You cannot run it, and you cannot tell it apart from the next company saying the same sentence. So security engineers do the rational thing and discard all of it. I published the opposite. It is called the ARE Incident Database , and it is public: https://aredb.org What is in it 32 agent failures that actually happened, each with a real source. A production database dropped during a code freeze. Twenty-five thousand documents deleted in the wrong environment. Credentials read and shipped to an external sink. A budget burned to zero in a loop. Each one gets a stable id ( ARE-2026-001 through ARE-2026-032 ), and each one is mapped to its category in the OWASP Agentic Security Initiative Top 10 , which is the peer-reviewed catalog of what goes wrong with agents. AREDB does not compete with it. OWASP owns the map. This is the cited incidents underneath it. The part that makes it uncomfortable to publish Every entry carries a coverage flag, and the flag is about our own product . We block 23 of the 32 today. Two more are partial, and they say partial. That leaves six of the ten OWASP categories covered at the action layer, and four that we do not cover: ASI06 Memory and context poisoning. We strip the hidden characters attackers use to smuggle instructions into text. We do not read the meaning of the text itself, so this one is only partial, and we mark it partial. ASI07 Insecure inter-agent communication. This is about how agents talk to each other over the network, which a firewall that sits in front of actions never sees. Not ours. ASI09 Human-agent trust. This is a design and disclosure problem. There is no action for a firewall to catch. Not ours. ASI10 Rogue agents. We stop the dangerous actions, but we do not diagnose the misbehavior itself. Partial. A firewall that claimed all ten would be l

If you've been working with cognitive architectures that rely on structured memory injection, you likely know the pain of corrupted or incomplete embedding spaces. The latest update to hermes-memory-installer directly addresses a brittle failure mode: missing embeddings in the gbrain module. This fix introduces an automatic, targeted repair mechanism that detects and rebuilds only the affected subset of embeddings, rather than triggering a full reinstall. Here’s what changed, why it matters, and how to benefit from it. The Problem: Silent Degradation in gbrain In a typical setup, hermes-memory-installer populates the gbrain—a specialized long-term memory store—with precomputed embeddings for core concepts, episodic traces, and procedural patterns. These embeddings are the numeric backbone that allows the agent to query, retrieve, and associate memories efficiently. However, under certain conditions—partial upgrades, concurrent memory imports, or incomplete network transfers—the gbrain’s embedding table ended up with holes. Specific embeddings for targeted contexts were simply missing. The agent would still boot, but retrieval quality degraded silently: queries returned null vectors or fell back to generic responses, breaking fine-grained recall. Users reported that their agents "forgot" recent conversations or failed to recognize learned skills, yet no obvious error was raised. Previously, the only remedy was a full reinstall of the memory installer, which wiped and rebuilt the entire gbrain. That was slow, wasteful, and could erase customized embeddings that were working correctly. The Fix: Targeted Auto-Repair The new update ( v2.1.0 onwards) adds a dedicated repair pass during the installation and upgrade routine. Instead of scanning the entire gbrain, the installer now maintains a lightweight manifest of expected embedding keys for each memory context. During setup, it checks the actual embedding store against this manifest. If any keys are missing, it triggers

🔒 ATLOCK v4 — I stopped trusting my own app's encryption, so I rebuilt it TL;DR — ATLOCK is a...

Every GEO ("generative engine optimization") tool, including ours until recently, sells some version of the same pitch: fix your robots.txt, add Schema.org markup, write FAQ schema, and AI engines will cite you more. We build one of these tools — Causabi scans sites for AI-crawler readiness and generates fix files (robots.txt, llms.txt, JSON-LD, FAQ blocks). As part of validating our own scoring weights, we ran the numbers on whether the score actually predicts getting cited. Short version: it mostly doesn't, once brand prominence is in the picture. What we measured We scored 44 domains on a 6-category on-site readiness algorithm: robots.txt (AI bots allowed or blocked) Schema.org (Organization/LocalBusiness JSON-LD completeness) FAQ schema (FAQPage markup, 3+ entries) content depth/structure brand/NAP signals freshness (dateModified, recency) Then we checked how often each domain actually got cited by an AI engine (Claude, via its web-search tool, one measurement window, a fixed prompt set per domain). What we found On-site score vs. citation rate: Pearson r ≈ -0.08, Spearman ρ ≈ -0.03. Functionally no correlation — if anything, a very slight negative one, which is more likely noise than a real inverse relationship at this sample size. 86% of the 44 domains got zero citations in the window, independent of their score. The domains that did get cited clustered almost entirely by brand prominence — well-known domains got cited at a noticeably higher rate (~0.16 of prompts) than everyone else (~0 for the rest of the sample), regardless of how well-optimized their markup was. Why I'm not overselling this n=44 is small. This is an internal validation exercise for our own product, not a peer-reviewed study, and I don't want it read as one. Specific caveats: Single engine (Claude) this round. Citation behavior differs meaningfully across ChatGPT, Gemini, Grok, and Perplexity — we haven't run the same check across all four yet. One time window, no longitudinal before/after.

You have a project with 20 dependencies. Half of them are outdated. Running ncu -u or pip install --upgrade upgrades all of them at once — and when something breaks, you have no idea which package caused it. So you don't upgrade. The deps rot. Security patches pile up. loopgrade fixes this. It upgrades one dependency at a time, runs your test suite after each upgrade, commits if it passes, reverts if it fails, and moves on to the next one. When it's done, it gives you a full report of what was upgraded, what failed, and why. GitHub: https://github.com/Sagar-S-R/loopgrade PyPI: https://pypi.org/project/loopgrade/ Open for Contributors #Python #LangGraph #opensource

I gave one model the same 44-node architecture twice. The first time I asked for raw SVG — place every box, route every edge, hand me the coordinates. The second time I asked it to describe the same system as typed JSON and let a layout engine draw it. Same model, same session, same brief. The only thing I changed was the output boundary. The boxes are fine in both. I want to be upfront about that, because the usual version of this pitch is out of date. Models place labeled boxes well now. If you ask a current frontier model for a six-box flowchart as SVG you get a clean six-box flowchart, and if that's what you need, go do that — it's the right tool and I'm not going to pretend otherwise. What broke was the edges. With no routing algorithm the model just drew long diagonals straight through unrelated boxes. Not a few — everywhere the graph got dense. And when I changed one node, the entire hand-placed coordinate layout had to be regenerated, and came back different. That second part is the one that actually annoyed me. It's not a rendering bug you can squint past. The picture is a dead artifact: you can't diff it, you can't edit one box, you can't get the same one twice. Every change is a full regeneration and a fresh roll of the dice. This isn't a "wait for a better model" problem Here's the part I'd push back on if someone else wrote it, so let me make the case. Routing a connector around obstacles across a nested graph is global constraint optimization. It's the specific thing layout engines like ELK exist to solve. A model emitting SVG has to commit to an x/y for every point, in order, with no way to backtrack once it sees the whole picture — it's predicting the next token, not solving a layout. So a better model gives you nicer boxes, not untangled edges . The failure is structural, and I'd expect it to reproduce across models past a couple dozen nodes. If you don't buy that, the honest move is to test it: throw a 40-node architecture at whatever model you tru

pinto lets teams manage Scrum backlogs as plain text. Every backlog change can be inspected with git diff , carried across a branch, merged, and reviewed in a pull request—just like source code. The backlog follows the same lifecycle as the product it describes. pinto is local-first: no server, account, or hosted database is required. It works with AI agents, but never depends on them. And unlike a generic CLI to-do list, its core model is Scrum: Product Backlog Items (PBIs), Sprints, Kanban, and the metrics teams use to inspect and adapt. Why pinto exists Jira, Asana, and Notion are capable products. But as more features accumulate, the process can start serving the tool instead of the other way around: Creating one ticket means navigating required fields and workflow settings. Running a Sprint begins with configuring permissions, automations, or dashboards. Even a small status change feels expensive when the tool is slow to open. Scrum is meant to be a lightweight framework for rapid inspection and adaptation . When maintaining the board becomes work in its own right, the tooling has lost sight of that goal. The name pinto comes from the Japanese word ピント “focus.” That is also the design intent: keep the team's attention on the Product Backlog, the Sprint, and the work flowing across the board. pinto deliberately stays small. It starts quickly, keeps dependencies and vocabulary limited, stores durable data as readable files, and excludes project-suite features such as Gantt charts and CRM. Your backlog belongs in the repository Running pinto init creates a .pinto/ directory beside your code. Each PBI is a Markdown file with TOML frontmatter. Here is a real item from pinto's own backlog: +++ id = "P-2" title = "Investigate and fix Windows CI while retaining Windows support" status = "done" rank = "j" labels = ["ci", "windows"] created = "2026-07-15T06:24:58.731847Z" updated = "2026-07-15T09:34:50.653786Z" +++ # Summary Investigate, verify, and fix the current Windo

GitHub热门项目 | The programming language for agents | Stars: 8,544 | 6 stars today | 语言: Rust

GitHub热门项目 | A lightweight desktop app to manage, sync, and organize AI agent skills across 15+ coding tools — Cursor, Claude Code, Codex, Copilot, and more. | Stars: 3,051 | 51 stars today | 语言: Rust