标签：#pens

GitHub热门项目 | A股自动选股系统 — 多种技术形态自动扫描，收盘后自动运行并推送飞书 | Stars: 5,919 | 195 stars today | 语言: Python

GitHub热门项目 | A modern formatting library | Stars: 23,819 | 3 stars today | 语言: C++

One of our agents ran a test suite. The suite takes four minutes. The MCP client's idle timeout is sixty seconds. You can see where this is going. At second sixty the client cancelled the call. The process kept running — nobody told it to stop — while the model, holding a cancellation where its test results should be, did the reasonable thing and ran the suite again. Two test suites, same directory, racing each other over the same build artifacts. The second one failed with a locking error, the model reported the tests as broken, and the tests were fine. In another session the same model, burned before, developed a workaround: run the build, then call sleep 240 , then look. A tool call that does nothing, held open for four minutes, so that a different tool call might have something to show. The model had reinvented polling, badly, because we hadn't given it anything better. I build octofs , an open-source MCP filesystem server, and this incident set the agenda for eleven releases in two weeks (0.10.1 through 0.14.1). The principle behind them is one I keep coming back to: an MCP server's real interface is every string it hands back to the model. These releases apply it to the slowest string of all — the one the model waits for. The shell is now event-driven. Commands start in the foreground, move to the background on their own if they outlast ten seconds, and the client gets a notification when they finish. Nothing blocks, nothing gets killed, nothing runs twice. First fix: prove the call is alive The sixty-second cancellation had a shallow cause and a deep one. The shallow one: a shell call is silent by nature. A build that's compiling says nothing on the wire for minutes, and to an MCP client silence is indistinguishable from a hung server. So 0.10.2 added liveness heartbeats — while a command runs in the foreground, octofs emits a progress notification every ten seconds, well below any sane idle timeout, so a single missed beat can't cancel the call. That stopped

Someone plugs in the HDMI cable. The room's display shows nothing, or shows 1024×768, or shows the desktop of whoever presented last week. After a minute of this, somebody says "just share your screen", and out comes AnyDesk or TeamViewer. It works. It is also the wrong shape for the problem, and noticing why turns out to be more interesting than it sounds. What remote desktop tools are actually for AnyDesk, TeamViewer and RustDesk exist to solve one problem well: reach a machine you are not near. Your parent's laptop. A server in a rack. A colleague's desktop three time zones away. Everything about their design follows from that. One person connects to one machine. That person takes the mouse. The remote screen is mirrored to them, and the whole session is framed as control — because when you are not in the room, control is the only way to do anything. Being fair about the privacy question, because it is the claim people reach for first and it is wrong: AnyDesk has a LAN mode , and in it a session goes directly between the two machines without the internet. RustDesk can be self-hosted entirely on your own infrastructure. Neither of these tools forces your screen through somebody's cloud if you configure them not to. If you have read that they do, that is not accurate. The mismatch is not privacy. It is shape. The relay, the account and the NAT traversal are not overhead — they are the product, and they are what makes reaching a machine in another country possible at all. Standing beside the machine, you pay for all three and use none of them. Where the shape stops fitting Stand in a room with four people and a Mac, and three things go wrong at once. It is one-to-one. Remote desktop is a session between two endpoints. Four people looking at one screen is not what it models, so three of them read over a shoulder. It mirrors, and mirroring is sometimes the wrong answer. Every tool in this category shows a screen that already exists. But the meeting-room problem is oft

Security controls in AI systems often end up duplicated across applications. One team adds prompt validation, secrets detection, PII filtering, authentication, logging, and rate limits to an LLM application. A second team builds similar controls around another provider. Once agents enter the mix, the organization has several implementations of policies that should be shared. An AI gateway provides a central place to enforce those controls. Traditional infrastructure already centralizes TLS termination, authentication, rate limiting, traffic routing, and observability instead of rebuilding them in every microservice. The same pattern applies to AI traffic. What is an AI gateway? Without a gateway: +--> OpenAI Application -------+--> Anthropic +--> Gemini With a gateway: Applications | v +-------------------------+ | AI Gateway | | | | Authentication | | Rate limits | | Guardrails | | Routing | | Logging / observability | +------------+------------+ | +------+------+ | | | v v v OpenAI Anthropic Gemini Products in this space include Bifrost , Kong AI Gateway , LiteLLM , and Cloudflare AI Gateway . Their feature sets differ, but each can route model traffic through a common control layer. Security policy can run at that layer before traffic reaches a provider. Why application-level guardrails become painful To prevent users from accidentally sending credentials to an LLM, a simple implementation might look like this: def ask_llm ( prompt ): if contains_secret ( prompt ): raise SecurityError ( " Potential secret detected " ) return llm . chat ( prompt ) For one application, this is reasonable. Across 30 services, enforcement starts to drift. Some services call OpenAI directly, others use Anthropic, and several teams maintain their own wrappers. One application omits the secret check, another uses an old version, and a third checks prompts but no other AI interactions. Policy enforcement now depends on convention. Moving enforcement to the gateway changes the model: Requ

Hoi hoi! I’m @nyaomaru, a frontend engineer who is surprised by how cold it is in the Netherlands...

Pessoal, eu quase mandei uma lista de 23 "vulnerabilidades" pra mantenedores de código aberto. XSS, CORS, CSP, um SVG suspeito. O modelo tinha devolvido volume. Eu sentia que tinha trabalhado. Aí parei. Se eu fosse o cara do outro lado da issue, eu levaria isso a sério? A conta virou quando eu parei de pedir "audita meu código". Passei a escrever o contrato antes de abrir o repo. Direção (o que o modelo pode afirmar) e disciplina (o que ele não pode). Isso não deixa o LLM mais inteligente. Controla o comportamento. Em segurança, isso é o que separa auditoria de lista. O que você leva daqui: o contrato (esqueleto), por que o scanner não substitui hunt, e as três portas pra não colar relatório no tracker. Os repos no meio são prova. Não são o ponto. Tabela de Conteúdo 1. Direção e disciplina não deixam o modelo mais inteligente 2. O scanner vê o que está. O hunt vê o que falta 3. Silêncio também é resultado 4. As três portas 5. O que você monta amanhã 1. Direção e disciplina não deixam o modelo mais inteligente Esse é o ponto que eu demorei pra aceitar. O modelo já conhece OWASP. O que muda é o que ele tem permissão de afirmar. Sem isso, "audita meu código" devolve XSS fantasma, CORS, CSP, um SVG. Volume. A pergunta de segurança some: disto aqui, o que vira issue, o que vai pro e-mail privado, o que é silêncio? Direção amarra três coisas antes da leitura: Padrão externo. OWASP ASVS 5.0, com o ID do requisito. "Boas práticas" não conta. Invariante em uma frase, falsificável. "Webhooks deveriam ser autenticados" é opinião. "Todo handler de webhook de entrada verifica autenticidade do remetente antes de mutar estado" é hunt. Formato único. Finding, observação e hipótese não misturam. Disciplina é o que corta o teatro. O texto que o modelo vê antes de abrir arquivo: Padrão: OWASP ASVS 5.0, com o ID do requisito. "Boas práticas" não conta. Invariante: uma frase, falsificável. Relatório: finding, observação e hipótese não misturam. Sem arquivo:linha → não é finding. CWE inv

The AWS API has become infrastructure's common language, and a whole ecosystem has grown up around running it somewhere other than AWS. Some tools mock it for testing. Others implement it for real. Knowing which is which saves you from deploying a dev tool to production or wiring a production platform into your CI pipeline. Two categories The tools split into emulators and real cloud platforms. Emulators intercept AWS API calls and return plausible responses without provisioning real infrastructure, where state is usually ephemeral, VMs never boot, and the goal is behavioural approximation fast enough for a developer's inner loop. Real cloud platforms provision actual infrastructure where EC2 calls boot real virtual machines and block storage carries real persistence guarantees. Emulators Moto Moto ( github.com/getmoto/moto , Apache 2.0, 8,400+ stars) has been around since 2013, making it the oldest option here. It works differently from the rest because rather than running a local server, it patches boto3 calls in-process through a test decorator. A function wrapped in @mock_aws intercepts all AWS SDK calls and returns mock responses without any network traffic. This makes it fast and easy to drop into Python test suites, but it only works for Python. Teams using the AWS CLI, Terraform, or Go SDKs need a server-based option. LocalStack LocalStack ( github.com/localstack/localstack , 64,000+ stars) is the dominant name in local AWS development. It runs as a Docker container exposing the AWS API on localhost:4566 and covers over 120 services. In March 2026, LocalStack archived its Community Edition repository and moved core services behind a paid plan. A free tier remains for non-commercial use and open source projects, but the Base plan covering Cloud Pods persistent state costs $39 per month and the Ultimate plan runs $89 per month. Teams that depended on CE for commercial CI pipelines are now evaluating alternatives. Floci Floci ( floci.dev , github.com/floci-io/f

We’re a small team building Sealshot, a free and open-source screenshot app for macOS. We started working on it because screenshots often become disposable files. We use them for bug reports, QA, documentation, support, and security work, but later they can be hard to find or reuse. They can also accidentally contain sensitive information such as emails, API keys, tokens, internal URLs, or customer data. Sealshot is built around a simple idea: Treat screenshots more like documents than temporary images. It supports: region, window, and scrolling capture screen recording editable annotations OCR and searchable screenshot archives sensitive information detection before sharing encrypted local storage local metadata generation Everything is processed locally on the Mac. It’s open source and free, and we’re still actively improving it. We’d really appreciate feedback, especially from developers, QA engineers, support teams, and people working in security. Website: https://seal-shot.com/ GitHub: https://github.com/ldeng83/Sealshot

Voice dictation is one of those tools that can quietly improve an entire day. OpenWhispr/openwhispr is gaining attention on GitHub, with 43 stars added today, because it treats dictation as a local-first productivity utility rather than just another cloud transcription feature. The project supports local speech-to-text models, including Nvidia Parakeet and Whisper, while also allowing cloud models through a bring-your-own-key workflow. That gives developers an important choice: keep audio on the device for privacy, or trade some privacy for potentially faster or more capable hosted inference. A practical way to start exploring the source is: git clone https://github.com/OpenWhispr/openwhispr.git cd openwhispr git log -5 --oneline For everyday use, the fastest path will usually be the project’s cross-platform release package. After installation, configure a local model if your machine has suitable hardware, or add your own provider credentials through the application settings. Keeping credentials in the app’s secure configuration storage is preferable to committing them to shell history or dotfiles. The architecture choice is especially interesting for independent developers. Local inference can reduce recurring API costs and keeps sensitive conversations away from third-party servers. The trade-off is hardware dependency: CPU-only transcription may introduce noticeable latency, while GPU acceleration can require additional drivers, memory, and model downloads. Before deploying this into a team workflow, I would watch for: Model consistency: Different Whisper or Parakeet variants can produce noticeably different punctuation, latency, and accuracy. Operational boundaries: Local processing improves privacy, but model files, logs, clipboard integration, and temporary audio buffers still need review. The strongest value proposition is not merely “speech recognition.” It is giving users control over where transcription happens. For developers who dictate code, documentati

A flat log can tell you that five things happened. It often cannot tell you which operation caused...

GitHub热门项目 | A declarative, efficient, and flexible JavaScript library for building user interfaces. | Stars: 35,948 | 47 stars this week | 语言: TypeScript

GitHub热门项目 | A slide framework built for agents. | Stars: 7,346 | 485 stars this week | 语言: TypeScript

GitHub热门项目 | Get every task and idea out of your head, then see the next thing to do. Getting Things Done (GTD) app for desktop and mobile. | Stars: 1,878 | 32 stars today | 语言: TypeScript

GitHub热门项目 | [CVPR'25 Oral] MoGe: Unlocking Accurate Monocular Geometry Estimation for Open-Domain Images with Optimal Training Supervision | Stars: 2,863 | 29 stars today | 语言: JavaScript

I maintain no_human . It's open source, and this month I'm getting it ready for outside contributors, so this post is part announcement, part ask. What it does: no_human proves the code it wrote is correct. You drop a ticket on the board (or point it at Jira or Linear) and it plans, writes the code, and opens a pull request. Before that PR reaches you, the work is checked by a second model that never saw the coder's session and is told to assume the job is not done. You get a pass/fail checklist that cites files and lines, not a score. If the agent deleted or weakened a test, a tamper guard stops the attempt. For bug fixes, the tests offered as proof have to fail on the old code and pass on the new. It's free and open-source, on your machine. If you're thinking about contributing, here's what you'd be walking into. You don't need a Claude account to work on it. The test suite is hermetic: uv sync --frozen && uv run pytest -q -n 4 runs all ~2,980 tests without ever calling a model. A credential only comes into play if you want to run the product end to end. The good first issues are scoped down to file and line, each with a repro and the command that verifies the fix. Past those, the one I most want help with is backend adapters . The implementer runs behind a narrow protocol, and I want adapters for more coding agents: opencode, Aider, Goose, Crush, Amp, Qwen Code, and a longer list in the issue. One agent per PR, and comment before you build. Some of these tools have no headless mode, and I'd rather tell you that before you spend a weekend finding out. Not everything needs Python, either. There are open invitations for UX polish on the web board — frontend and design contributions, with the rule that a sketch or screenshot comes before code — and for making the PRs the agent opens read better : the PR body is the artifact a human judges, and right now it's information-dense but plain. Fair warning about scope: only the coder seat is swappable. The reviewer, planner

A maintainer once watched an AI assistant confidently recommend merging a pull request that deleted a test file. The prompt had included the entire issue thread, the last three commits, and a README from another branch. The model trusted every word because the prompt gave it no reason to filter. The result was a confident but false analysis. The root cause was not a bad model. It was context pollution: unrelated diffs, stale comments, and duplicate code snippets pushed the actual change below the model's attention threshold. For open source reviewers on a free tier, every wasted token also makes the loop slower. The fix is not a bigger context window. It is a smaller, better one. Why Full Context Collapses AI Reviews Long paste sessions fail for reasons that have little to do with model quality. The following failure modes appear regularly in OSS review flows when someone dumps everything into a chat: Issue threads contain outdated suggestions that contradict the current implementation. Full-file dumps include boilerplate that drowns the one-line semantic change. Old test output from another environment appears as evidence even when it no longer applies. Models weigh every token relatively evenly, so irrelevant lines consume attention that the diff deserves. Earlier articles on this account covered the reproduce-patch-test loop, but the missing discipline is context slicing. Slicing means choosing exactly which lines the AI sees, and nothing more. The Three Layers of Slicing The practice breaks into three layers, each with a clear source for truth: Patch layer — the diff and commit message only, not the full conversation history. Code layer — the definitions and tests touched by the diff, not every import in the project. Environment layer — exact commands and expected outputs, not historical logs from an old CI run. Together those layers describe "what changed, what it touches, and how to prove it works." That is enough for a reviewer model to produce a focused anal

A real model's write, escrowed before it landed What I can honestly claim here, and only this: I put an escrow membrane in front of a real OpenClaw gateway as a before_tool_call plugin, watched a real LLM's tool call go through it, and confirmed the whole loop end to end, escrow, admit, commit, undo, with a byte-for-byte restore. That's it. I've read 0.077 percent of the OpenClaw source (29 of 37,659 files, counted cumulatively across three separate rounds of this work), the Escalate branch has never fired in a real run, and I haven't found one confirmed example of a ClawHub-distributed plugin using this hook. None of that changes what happened on 2026-09-01. All of it belongs in the same paragraph as the claim, not three screens down where nobody reads it. The project behind this is gx (TraceFold, Apache-2.0), a layer that treats every effect an agent produces as something you escrow, gate, and can invert, rather than something you log after the fact and hope you can undo by hand. OpenClaw is steipete and vincentkoc's agent runtime, MIT-licensed, npm-distributed (204.8 MB unpacked at 2026.8.1), with a plugin hook called before_tool_call that fires before a tool's execute() runs and can block it outright. Four ways to fail before you fail correctly I want to write the failures first, because they're the part that actually shows how the system works. The id was a filename, not an identifier. gx writes receipts to disk with underscores in the filename ( gx1_smxcmcdm...json ), because colons aren't safe in filenames on every platform. The identifier gx undo actually wants uses colons ( gx1:smxcmcdm... ). I copied the filename straight into the undo command and got VALIDATION_ERROR: not a gx1: id . The right string was sitting in an index file two directories over. I hadn't checked. I trusted --offline to mean less than it means. I wanted a verification that touched nothing but the receipt itself, so I ran gx receipt verify --offline --project <bed> and got back valid:f

Before publishing: set published: true , and check canonical_url — the article must exist at that URL on the site first. Without it this competes with the original in search instead of pointing at it. Tags are from the verified top-1,000 list; mcp was not in that cache and is not used here. A session ends. Your agent had worked out, over forty minutes, that the retry logic lives in one service and the thing that gives up on it lives in another, that the queue name is spelled two different ways, and that the person to ask about any of it left last year. Tomorrow you open a new session and it knows none of that. Neither does your colleague's session. Neither does the agent reviewing the pull request that comes out of it. It is the same forty minutes a new engineer spends in week one, and the same forty minutes the README would have saved if it were still true. It is why a manager asking "where is this up to" has to interrupt someone who knows. The knowledge exists; it has nowhere to live but in people and chat logs. The reflex is to reach for memory. That reflex is worth interrogating, because there are two different problems hiding under one word, and only one of them is what memory servers are for. What MCP actually specifies It helps to be exact, because "MCP memory" gets said as though it were a feature of the protocol. It is not — and the current revision makes that harder to miss rather than easier. Read the base protocol's own three-line summary in revision 2026-07-28 : JSON-RPC message format, stateless, self-contained requests , per-request capability negotiation. Servers offer three features — Resources, Prompts and Tools. Clients offer one: Elicitation. Sampling and Roots, which used to make that three, were deprecated in this same revision under SEP-2577, along with Logging and Dynamic Client Registration; the migration note against Sampling reads "integrate directly with LLM provider APIs". There is no memory primitive and no persistence primitive. There

I own two laptops. A 2020 Intel MacBook Air, 8GB RAM, no unified memory, gifted by my sister. And a...