标签：#pens

Being a developer, we all create many projects for learning, work, and experiments. Over time my machine started filling up — not with source code, but with generated junk : node_modules target dist / build framework caches like .next , .angular , .nuxt and more of the same across every cloned repo Every few months I would hunt folders manually, delete something, free a few GB, then the same problem would come back. Only learning about “clean your disk” tips doesn’t help much. Building something for the problem does. So I ended up building ArtifactSweep — a small open-source tool for this everyday developer issue. The real problem As developers we regenerate these folders all the time: npm install cargo build ng build They are not our source of truth. But they sit on the SSD for months. The painful part is not only size. It is: Finding them across many project roots Knowing how big they are before delete Not deleting the wrong folder by mistake I wanted something that could: Scan a folder tree Show sizes Let me clean with more control Work on my day-to-day machines (Windows, Linux, Mac) Step 1: Start with a CLI I started with the command line first. Why CLI? Fast to build and test Fits terminal-first workflow Easy to script and share The CLI is called sweep . Basic usage: # Safe: only list junk under a path sweep scan . # Preview deletes sweep clean . --dry-run # Delete sweep clean . On one of my project folders alone, it reclaimed nearly 5 GB . That was enough validation: this is not a fake problem. Every active developer hits it. Step 2: Then came the desktop app CLI is great when you already know the path and trust dry-run. But sometimes I wanted to: See a list of folders and sizes Filter by type Confirm before delete Click through without remembering flags So I added a desktop app on top of the same idea (same cleanup job, different UI). Flow is simple: Choose folder Scan Review results (and filters if needed) Clean with confirmation If you like GUIs for this ki

In my previous article, I talked about Train Track, the transit app I built around Metro Manila's railway systems. This project started with a completely different problem. I kept thinking about how difficult it can be to discover hackathons and coding competitions. Not because they don't exist. They do. The problem is that they're scattered everywhere. A university might announce one. A government agency might host another. A private company might run one. A developer community might post another. And suddenly you're checking multiple websites just to figure out: What can I actually join? So I built HackForPinas. What is HackForPinas? HackForPinas is a free, public, and open-source directory for Philippine: Hackathons Coding challenges Technology competitions The idea is pretty straightforward: Make opportunities easier to discover. Events can be filtered by: Region Format Organizer type Status Organizers are categorized as: Government University Private Instead of browsing through unrelated websites, users can explore opportunities in one place. But the more I worked on it, the more I realized that the directory itself wasn't the hardest part. The data was. The Data Problem Imagine trying to collect hackathons from different websites. One might have an RSS feed. Another might use WordPress. Another might expose an API. Another might have an ordinary HTML page. And another might not have anything structured at all. So HackForPinas uses multiple scraping strategies: WordPress REST API RSS GDG Community Eventbrite HTML + Cheerio The scraper runs through a background endpoint and collects events from different Philippine technology sources. The interesting part wasn't: "Can I scrape a website?" It was: Can I turn information from completely different sources into one consistent dataset? That became a much more interesting engineering problem. I Didn't Want Anyone to Publish Directly There's another problem with a public directory. If anyone can submit an event, what s

Ever since I joined the platform, I wanted to post about a topic I was really passionate about....

The nastiest failure mode in a remote coding agent is not a bad patch. It is a permission prompt that nobody can see. You start a long-running job on a workstation, leave the desk, and check it from a phone later. The agent reaches a command that needs approval. If that request only exists as a modal in the desktop UI, the job has not technically failed. It has just stopped forever. That is worse. A failed job is observable. A hidden wait looks healthy until someone notices no work has moved. The permission prompt is protocol state The fix starts with a small change in how you model approval. A permission request is not UI state. It is durable state owned by the job that is doing the work. The lifecycle should look more like this: asked → persisted → surfaced → answered → applied → resolved The desktop dialog, phone screen, CLI, or web controller is only one view over that state. Closing a window must not erase it. Reconnecting must not create a second request. Two controllers must not be able to resolve different requests because a stale button happened to be on screen. This also changes what a remote-control protocol needs. A controller should be able to fetch job status with pending approvals, submit an answer for one request ID, and observe the resulting event. It should not become a filesystem or runtime proxy just to click “allow.” What needs to survive a disconnect At minimum, the pending request needs a stable request ID, its owning job/session, the requested action and resources, and enough ordering information to render concurrent requests deterministically. The answer also needs an identity. If request abc is pending, an answer for xyz must fail. Replaying the same answer for abc should be harmless. Replaying a different answer under the same ID should not quietly overwrite the first decision. That sounds fussy until a phone reconnects on a flaky network and retries the last command. Then it is the difference between idempotence and “the agent ran it twic

If you've ever stared at a 15,000-file monorepo wondering "what actually breaks if I touch this...

Following Anthropic's confirmation that all text generated by its new Claude models will carry an invisible watermark in order to identify that the text has been generated by AI. Read more about this measure at: https://support.claude.com/en/articles/16266773-how-claude-marks-ai-generated-content Today, developer Guillaume Meyer published "watermarks-remover" on GitHub: an open-source project that cleans those signals generated by LLMs, such as Claude, Gemini, OpenAI and others, removing invisible Unicode characters, C2PA metadata and more. 🔗 Repository link: https://github.com/guillaumemeyer/watermarks-remover

Everyone is building AI memory systems. But how do we know which ones actually work? As AI agents...

If you work with library data, you work with MARC21 — the length-prefixed binary record format catalogues have run on since the 1960s, complete with a directory of field offsets, subfield delimiters, and a pre-Unicode character encoding called MARC-8 that needs a lookup table with thousands of entries to decode. In Python that problem is solved: pymarc is mature, complete, and pleasant to use. In Go it wasn't. gomarc is a port of pymarc to Go. It covers the binary MARC21 transmission format, MARC-8 to Unicode conversion, MARCXML, and MARC-in-JSON — and on real catalogue exports it runs 4x to 11x faster than the library it was ported from. go get github.com/beyto1974/gomarc@v0.1.0 It reads like pymarc If you know pymarc, you already know this API. Iterate records, pull the fields you want: reader := marc . NewReader ( f ) for { record , err := reader . Next () if errors . Is ( err , io . EOF ) { break } if err != nil { log . Println ( err ) // permissive: bad records are skipped, not fatal continue } title , _ := record . Title () fmt . Println ( title ) } Title , Author , ISBN , ISSN , Subjects , Publisher , PubYear and more are there as methods. For anything else, go at the tag and subfield directly: value , ok := record . Get ( "245" ) . Subfield ( "a" ) for _ , f := range record . GetFields ( "650" ) { fmt . Println ( f ) } Build records, modify them, write them back: record . Get ( "245" ) . SetSubfield ( "a" , "The Zombie Programmer : " ) writer := marc . NewWriter ( out ) writer . Write ( record ) And convert to the formats the rest of your stack can actually read — both use UTF-8 throughout instead of MARC-8, so standard tooling works: s , err := record . AsJSON () // MARC-in-JSON records , err := marc . ParseXML ( r ) // MARCXML Large MARCXML files stream one record at a time via marc.NewXMLReader rather than loading into memory. The numbers Two real catalogue exports — 138,076 records, 166 MB. AMD Ryzen 5 3600, Go 1.25.12, CPython 3.13.5, gomarc v0.1.0, pym

GitHub热门项目 | Fast, Declarative, Reproducible, and Composable Developer Environments using Nix | Stars: 7,275 | 54 stars this week | 语言: Rust

GitHub热门项目 | Web dashboard for Hermes Agent — multi-platform AI chat, session management, scheduled jobs, usage analytics | Stars: 10,123 | 321 stars this week | 语言: TypeScript

GitHub热门项目 | | Stars: 622 | 370 stars today | 语言: Rust

GitHub热门项目 | VS Code in the browser | Stars: 78,771 | 56 stars today | 语言: TypeScript

GitHub热门项目 | PLANKA is the Kanban-style project mastering tool for everyone | Stars: 12,331 | 10 stars today | 语言: JavaScript

GitHub热门项目 | JavaScript Style Guide | Stars: 148,133 | 15 stars today | 语言: JavaScript

GitHub热门项目 | RAGFlow is a leading open-source Retrieval-Augmented Generation (RAG) engine that fuses cutting-edge RAG with Agent capabilities to create a superior context layer for LLMs | Stars: 87,381 | 85 stars today | 语言: Go

✓ Human-authored analysis; AI used for formatting and proofreading. SadCloud is an open-source Terraform project by NCC Group that deploys misconfigured AWS resources. Security teams use it to test their tooling: if your scanner can't find the misconfigurations in SadCloud, it can't find them in production. We pointed Stave at SadCloud. Then at BishopFox's IAM Vulnerable. A lab focused on IAM privilege escalation paths. The numbers tell a story about what happens when you move from per-resource scanning to compound attack path analysis. The raw numbers Metric SadCloud (NCC Group) IAM Vulnerable (BishopFox) Assets evaluated 36 31 Atomic violations 992 837 Compound chains firing 84 instances (13 unique) 70 instances (6 unique) Near-miss chains 785 instances (40 unique) — A per-resource scanner (Prowler, ScoutSuite, Checkov) would show 992 findings for SadCloud. Each finding stands alone: this bucket is public, this role is overpermissioned, this trail isn't logging. The operator opens a dashboard with 992 items sorted by severity and starts scrolling. Stave's compound-only default output shows 84 findings across 13 named attack paths. Same underlying data. Different composition. The 992 atomic violations still evaluated. They're the detection infrastructure. The 84 compound chains are the findings that reach the operator. That's a 12x reduction by composition. Compound chains Each compound chain fires when multiple controls fail simultaneously on related assets, matching a named attack pattern: Chain Severity Instances What it means iam_escalation_undetected critical 36 IAM roles can escalate privileges and no detective control monitors the escalation path iam_boundary_governance_failure critical 36 No permission boundary constrains IAM principals in the account — any role can reach any resource iam_session_opacity high 2 IAM session activity isn't logged at the detail level needed to detect credential abuse s3_ssec_ransomware_path critical 1 S3 bucket is vulnerable t

I spent a few days writing a satellite ground station daemon in Crystal, with an empty dependency list and a hard rule against third-party code. It works, it ships as one file, and it sits at 1.9 MB of memory at rest. This is what the language was like to use, and what it cost. The project is kozai : it reads orbital elements, propagates them with SGP4/SDP4, predicts passes over a ground station, serves a JSON API and an offline web interface, and drives a rotator and a radio through hamlib. About 9,000 lines of source and 6,400 lines of specs, on Crystal 1.21.0. None of that matters here except as the load under which the language was tested — this is a report on the tool, not on the satellites. What the language actually delivers The headline claim of a compiled language with a garbage collector is that you get Ruby's ergonomics and a binary at the end. In 2026 that claim holds, and the numbers are the part worth quoting: Docker image, FROM scratch 7.41 MB Static binary, musl, arm64 6.9 MB Dynamic binary, release 1.9 MB Memory at rest, 2 satellites 1.9 MB Memory at rest, 97 satellites 4.3 MB Memory after a day of serving, 97 satellites 19.3 MB, flat Build steps before crystal build none Runtime files outside the binary none The last two rows are the ones that changed how the project was built. There is no Node in this repository, no bundler, no asset pipeline, and no postinstall . The web interface — HTML, CSS, JavaScript, and a 66 KB SVG of the world's coastlines — is read at compile time by {{ read_file(...) }} and lives inside the executable ( src/assets.cr ). Deploying is scp . The standard library covered the whole surface of a network daemon with six imports: http/server , http/client , json , log , socket , option_parser . That list is not an aspiration; CI fails if a seventh appears. The type system earned its keep in the numerical core. Predicting a week of passes for a hundred satellites is on the order of ten million propagator calls, and the hot loop a

Hoi hoi! I'm @nyaomaru, a frontend engineer who is trying to lose weight. 🐖🙀 I maintain a type...

Writing Takes 40 Minutes, Publishing Takes 30 — How I Solved It Last Wednesday, 22:00. I just finished writing a tutorial on Python async programming — 2200 words, clean Markdown, syntax-highlighted code blocks. 22:03, open Juejin. Paste title. Paste content. Code highlighting gone. Fix manually. Pick tags. Publish. 22:08, open Zhihu. Paste title. Paste content. The Draft.js editor merged async def into asyncdef . Fix line by line. Publish. 22:15, open CSDN. Paste title. Content looks fine. But the category dropdown has 50 options and "Python" is buried. Publish. 22:20, open Cnblogs. Must add [Markdown] tag to categories or the whole article renders as garbled HTML. Publish. 22:25, open SegmentFault. Search tags for "Python async" — zero results. Type manually. Publish. 22:30, open Dev.to. Translate title. Translate content. Publish. Forty minutes to write. Thirty minutes to publish. 22:35, all done. But the next morning, I wanted to check stats — another round of logging into each platform's dashboard one by one. I'm Not Alone Searching forums and social platforms, I found many developers share this pain: "Every time I publish an article, I open 7-8 tabs, copy-paste 7-8 times, fix formatting 7-8 times. The joy of writing gets killed by the drudgery of publishing." "I usually only publish on one platform now. It's just too much work to do more. But then search engine exposure suffers." Why "Just Copy-Paste" Doesn't Work Each platform has a different editor: Platform Editor Markdown Handling Juejin Custom Markdown Good, but code highlighting sometimes breaks Zhihu Draft.js rich text No Markdown support, eats line breaks CSDN Dual-mode Mode switching corrupts formatting Cnblogs TinyMCE Must add [Markdown] tag or disaster SegmentFault Markdown Okay, but tag system is painful Dev.to Markdown Best experience, but English-only audience The same Markdown renders differently everywhere. Copy-paste doesn't solve it. What I Built I spent two weeks of evenings building PolyPos

AGENTS.md vs CLAUDE.md: Where Agent Context Actually Lives If you have opened three different repos this month and found three different context files (AGENTS.md in one, CLAUDE.md in another, both in a third, out of sync), you are not imagining the mess. AGENTS.md is now an open, vendor neutral standard that most major coding agents read, but CLAUDE.md has not gone away, and knowing which file wins where saves you from an agent quietly following stale instructions. What AGENTS.md actually is AGENTS.md started as a proposal from Sourcegraph's Amp team to fix a specific problem: every coding agent invented its own context file, so teams ended up maintaining CLAUDE.md, .cursorrules, .windsurfrules, and whatever else, all describing the same project. OpenAI and Google backed the standard, and it has since moved under the Linux Foundation's Agentic AI Foundation. Guides tracking adoption report 28+ supporting tools and more than 60,000 open source repos containing the file (secondary source, treat the exact counts as approximate, not audited). The pitch is simple: one Markdown file, one format, every agent reads the same source of truth instead of you hand syncing five files that drift within a week. Which tools actually read it This is the part that matters when you are deciding whether to migrate. Tools with native AGENTS.md support include: GitHub Copilot coding agent Cursor Amp Factory RooCode Zed Warp Notice what is not confirmed on that list. Reports that Claude Code reads AGENTS.md natively circulate in comparison guides, but I could not verify this against Anthropic's own changelog, so I am stating it qualitatively here rather than as fact: treat it as unconfirmed until you see it in Anthropic's own docs, and keep CLAUDE.md in place as your safety net if you rely on Claude Code specifically. AGENTS.md vs CLAUDE.md vs the well known directory Three layers get conflated constantly, and they solve different problems. Layer What it is Scope AGENTS.md Vendor neutral p