标签：#rce

GitHub热门项目 | A Kubernetes TUI, reimagined in Rust - built on kube-rs and ratatui, async-first from the ground up. | Stars: 498 | 139 stars today | 语言: Rust

GitHub热门项目 | Run AI agents on real and isolated machines — own kernel, filesystem, and network — with <100ms boot. Local first, OCI compatible, pure Rust. | Stars: 3,356 | 360 stars today | 语言: Rust

GitHub热门项目 | Transcribe on your own! | Stars: 7,344 | 11 stars today | 语言: TypeScript

GitHub热门项目 | Open Science by AIPOCH is an open-source, local-first, model-agnostic AI research workbench for macOS, Windows, and Linux, with scientific agents, Python/R notebooks, data connectors, and reproducible provenance. | Stars: 3,733 | 145 stars today | 语言: TypeScript

GitHub热门项目 | Community plugin to control Blender 3D with any LLM of your choice | Stars: 27,212 | 209 stars today | 语言: Python

GitHub热门项目 | AI-powered penetration testing assistant using local LLM on linux (Parrot OS) | Stars: 3,944 | 73 stars today | 语言: Python

GitHub热门项目 | Build your autonomous hedge fund in minutes. AutoHedge harnesses the power of swarm intelligence and AI agents to automate market analysis, risk management, and trade execution. | Stars: 4,542 | 137 stars today | 语言: Python

GitHub热门项目 | The LLVM Project is a collection of modular and reusable compiler and toolchain technologies. | Stars: 40,155 | 35 stars today | 语言: LLVM

My harness flagged the model for sending the wrong arguments. It compared what the model actually...

Google has open-sourced Mantis, an AI-agent framework designed to automate the software vulnerability lifecycle, from identifying and validating vulnerabilities to reproducing and fixing them. Google says it developed Mantis to address the high rate of false positives and hallucinated vulnerabilities produced by conventional AI-powered code scanning. By Sergio De Simone

TL;DR 📌 🕰️ Then: I built google-chat-electron by hand , over months , reading tutorial after tutorial. ⚡ Now: I rebuilt the whole thing as google-chat-tauri in less than 24 hours — and I did not write the code. Claude did. 🦀 Plot twist: I don't know Rust. Not a little — at all . The AI wrote every line of it. 📦 Result: a ~ 3 MB Linux installer instead of a bundled Chromium. 🧪 Status: pre-release. Fun project. Stable version coming after real-world testing. Let's dive in. 👇 The Electron Era: Months of Honest, Manual Labour 😅 A few years ago I wanted Google Chat in a real window — with a tray icon, an unread badge and native notifications — instead of a browser tab that disappears among thirty other browser tabs. So I built it. In Electron. By hand. And it took months . Not because Electron is bad, but because every single thing was a tutorial: How do I make a tray icon that actually behaves? How do I keep the app alive when the window closes? How do I intercept a link and open it in the real browser? How do I package a .deb ? A .dmg ? An installer for Windows? Why does this work on my machine and nowhere else? 🙃 Every answer was a blog post, a GitHub issue thread, or a Stack Overflow reply from 2017 that almost applied. It shipped, people used it, and I was genuinely proud of it. The Tauri Rewrite: One Evening, One Prompt Loop 🤖 Last week I opened Claude Code and asked it to port the app to Tauri v2 . I did not open the Rust book. I did not read the Tauri docs. I described what the app should do, reviewed what came back, ran it on my actual laptop, and reported what broke. Timeline: Time What happened 15:42 git init 17:01 Full Electron → Tauri v2 port committed 17:25 Desktop notifications working < 24h later v0.0.1 tagged and released 🎉 38 commits. ~3,600 lines of Rust and JavaScript. Zero lines typed by me. This is what people mean by vibe coding — and honestly, it felt less like programming and more like directing . My job became: describe the behaviour, test it on

This is a shortened version of my original post . My wife and I have blogged about every trip since our honeymoon 10 years ago. For the people at home, for ourselves later, and by now for our children. We took turns writing, but both had photos and videos on their phones. The text was never the hard part. The photos and videos were: every day one of us sent them from the phone to the other, who had to upload them and sort them into the entry in the right order. So I wrote Texttile , an open-source blog engine built for writing together. One entry, two screens Multiple people can have the same entry open. One of them has the text and types, the other watches the words arrive and can take the text over with one click. Both can still work on the gallery. Photos and videos belong in the same gallery. Videos come from your own server. Drop one in and Texttile converts it, thumbnail included. No YouTube embed, no player from anywhere else. One container, one folder Phoenix, LiveView, ffmpeg and SQLite live in one Docker image. Everything is in /data . Move that folder and you move the blog. A reader's browser talks to your server and nothing else. No CDN, no tracker, no hosted font. What it is not There are no roles, no permission matrix, no plugins, no theme marketplace. Everybody with an account is an admin. I built it for people who trust each other, because that is who writes a blog together. You can try it or read the source . The full story includes a video showing both screens. How do you blog on the road?

A library isn't code. A library is thirty or forty decisions somebody already made, correctly,...

I Built a Mobile Terminal Around My herdr + Codex Workflow I am building Termish , an open-source mobile remote-work tool for SSH/Mosh terminals, file management, remote screens, and AI-assisted development. The unusual part is that I built much of Termish through Termish itself. My daily workflow is: Termish on my phone → herdr on my host → Codex in the project The development environment and AI tools run on my own machine. My phone is where I enter commands, describe tasks, upload screenshots, inspect changes, and check the resulting UI. Termish is both the product I am building and a tool I use to build it. Put remote work in your pocket. Source code: github.com/ttermish/termish Why do AI-assisted coding on a phone? A phone is not a replacement for a desktop machine. Its screen is smaller. Reading a large codebase is harder. Long debugging sessions are more comfortable on a larger display. Those limitations are real. But AI-assisted development changes part of the workflow. Many tasks become: Describe a requirement. Provide context. Let an agent make changes. Review the output. Run a command or test. Decide what to change next. Some of that loop works well on a phone. For example, when I think of a feature away from my desk, I can open the project and ask an agent to start implementing it. When I find a UI problem, I can upload a screenshot to the host and ask the agent to inspect it together with the code. After the change is done, I can review the diff, run tests, and check the actual UI through a remote screen. The goal is not to write an entire application on a phone. The goal is to make a phone a useful place to start work, inspect work, and keep a task moving. Why another SSH and AI coding tool? This is a fair question. Tools such as Termius and Blink already provide strong SSH, Mosh, and file-management experiences. If you already have a setup that works well, you can run Codex, Claude Code, or other agents through a terminal today. Happy and similar produ

Struct tags are just strings — a typo'd checker name, a wrong-typed field, or a renamed cross-field target all compile fine and fail silently at runtime. checkerlint catches all three before you ship. Struct tags are string literals. The Go compiler checks that your struct compiles — it has no idea what checkers:"eq-field:Passwrd" means, so a typo in a field name, a checker applied to a field of the wrong type, or a renamed field that a cross-field rule still points at all compile fine. They fail later, at runtime, sometimes silently, sometimes as a panic in the middle of handling a request. type Registration struct { Password string `checkers:"trim required"` ConfirmPassword string `checkers:"required eq-field:Passwrd"` // typo: no such field Age int `checkers:"email"` // email is string-only } Nothing here trips go build , go vet , or a normal linter — they all treat checkers:"..." as an opaque string. The first bug only surfaces the moment someone submits a registration form and eq-field can't find a field called Passwrd . The second is worse: email assumes a string under the hood, so calling it on an int field panics at validation time instead of returning a normal error. checkerlint is a go/analysis -based static analyzer, shipped as its own module in the Checker repo, that reads these tags at build/lint time and catches exactly this class of bug before it ships: ./registration.go:3:2: checkerlint: eq-field references field "Passwrd", which doesn't exist on this struct ./registration.go:4:2: checkerlint: email requires a string, but the field's type is int What it actually checks Three things, all specific to how checkers / validate tags can go wrong: Unknown checker names. Every token in the tag has to be a registered checker, normalizer, field-relative checker, omitempty , or a name your own code registered via RegisterMaker / RegisterFieldMaker with a string literal. Typo requird instead of required and checkerlint flags it — nothing else in your toolchain w

Background : In migration projects involving different databases, incompatibility of SQL syntax is often encountered. Question : If there is a large amount of code that needs to be rewritten, manual processing would be time-consuming and prone to errors. Is it possible to achieve automatic conversion of code syntax in large quantities through tools? Solution : The open-source tool ZGLanguage can be utilized to perform automated conversion of SQL code in large batches. For example： Suppose SQL PIVOT function is as follows : SELECT * FROM ( select country , state , yr , qtr , sales , cogs from table111 ) PIVOT ( SUM ( sales ) AS ss1 , SUM ( cogs ) AS sc FOR qtr IN ( 'Q1' AS Quarter1 , 'Q2' AS Quarter2 , 'Q3' AS Quarter3 , 'Q4' AS Quarter4 ) ) tmp ; Using the ZGLanguage conversion rule, execute the conversion to obtain the result : SELECT * FROM ( select ### , ### , ### SUM ( case when qtr = 'Q1' then sales else null end ) AS Quarter1_ss1 , SUM ( case when qtr = 'Q2' then sales else null end ) AS Quarter2_ss1 , SUM ( case when qtr = 'Q3' then sales else null end ) AS Quarter3_ss1 , SUM ( case when qtr = 'Q4' then sales else null end ) AS Quarter4_ss1 , SUM ( case when qtr = 'Q1' then cogs else null end ) AS Quarter1_sc , SUM ( case when qtr = 'Q2' then cogs else null end ) AS Quarter2_sc , SUM ( case when qtr = 'Q3' then cogs else null end ) AS Quarter3_sc , SUM ( case when qtr = 'Q4' then cogs else null end ) AS Quarter4_sc from ( select country , state , yr , qtr , sales , cogs from table111 ) where qtr IN ( 'Q1' , 'Q2' , 'Q3' , 'Q4' ) group by ### , ### , ### ) tmp ; The conversion rule is as follows : __DEF_FUZZY__ Y __DEF_DEBUG__ N __DEF_CASE_SENSITIVE__ N __DEF_LINE_COMMENT__ -- __DEF_LINES_COMMENT__ /* */ __DEF_STR__ __IF_KW__ <1,100> [1,1]ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz [0,100]ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_ [NO] XXX __DEF_PATH__ __FROM_PIVOT_1_1__ 1 : frm @ %__IF_KW__ | from : tab @ | __TABLE_NAME__ : ssl @

How to turn struct-tag validation failures into a standard "application/problem+json" response — the RFC 9457 format — with one method call, no hand-rolled error envelope. Most Go APIs invent their own validation error shape. One team returns {"errors": [...]} , another {"field_errors": {...}} , a third just a flat {"error": "message"} and hopes the client parses it. Every one of those is a private contract the client has to learn from your docs, because there's no shared shape for "here's what's wrong with your request." RFC 9457 — Problem Details for HTTP APIs — is the IETF standard that fixes this: a application/problem+json body with type , title , status , and room for problem-specific extensions. Checker now builds one of these directly from a failed struct validation, via CheckErrors.ProblemDetails() . The shape RFC 9457 defines four base members — type , title , status , detail , instance — and lets a specific problem type add its own. For validation errors, RFC 9457 §3.1 sketches exactly this extension: an invalid-params array listing which fields failed and why. That's what Checker produces. From a failed struct to a problem+json body Take a struct with a missing required field: type Person struct { Name string `checkers:"required"` } person := & Person {} errs , ok := checker . CheckStruct ( person ) if ! ok { data , _ := json . Marshal ( errs . ProblemDetails ()) fmt . Println ( string ( data )) } { "type" : "about:blank" , "title" : "Your request parameters failed validation." , "status" : 400 , "invalid-params" : [ { "name" : "Name" , "reason" : "Required value is missing." , "code" : "REQUIRED" } ] } One method call — errs.ProblemDetails() — turns the same CheckErrors you'd otherwise call .JSON() on into a *ProblemDetails value, ready to marshal. type defaults to "about:blank" (RFC 9457's own default for "no more specific problem type registered"), status defaults to 400 , and each invalid-params entry carries the field name , a localized human-readab

🇪🇸 Leer este post en Español I spent months watching my agent re-solve the exact same problems, over and over, because I never sat down and wrote them up once so anyone else could reuse them. That's the kind of technical debt nobody ever puts on a roadmap. So I published alpha-skills : eight installable Agent Skills and my first MCP server on npm . Where the published skills live The installable catalog lives in skills/ , split into three categories: external/ for third-party APIs, local/ for homelab and workflows, and general/ for cross-project utilities. All three are public: one skill in external/ , one in local/ , and six in general/ . local/ describes the use case. skills/ ├── external/ │ └── nextdns-api/SKILL.md ├── local/ │ └── progressive-search/SKILL.md └── general/ ├── agent-context-generator/SKILL.md ├── nestjs-iam-patterns/SKILL.md ├── nestjs-advanced-patterns/SKILL.md ├── nestjs-graphql/SKILL.md ├── tuning-claude-code/SKILL.md └── obsidian-second-brain/SKILL.md <DIAGRAM 02: 02-public-skills-structure-en.png> The eight skills Three categories: external/ for third-party services, local/ for homelab infrastructure and personal workflows, general/ for cross-cutting utilities that don't depend on any one service. Skill Category Use it for nextdns-api external NextDNS API progressive-search local Code and documentation search agent-context-generator general Project context nestjs-iam-patterns general Authentication and permissions nestjs-advanced-patterns general NestJS internals and architecture nestjs-graphql general Code-first and schema-first GraphQL tuning-claude-code general Claude Code configuration obsidian-second-brain general Note organization and review Each command installs one skill. Run the command for the one you need. 1. nextdns-api A full reference for the NextDNS REST API: profiles, security/privacy/parental-control settings, denylist and allowlist management, analytics, query logs. This is the one the MCP server below is built directly agai

🇺🇸 Read this post in English Llevo meses haciendo que mi agente resuelva los mismos problemas una y otra vez porque nunca me tomé el tiempo de escribirlos una sola vez, bien, y dejar que otros los reusaran. Ese es exactamente el tipo de deuda técnica que nadie pone en un roadmap. Así que publiqué alpha-skills : ocho Agent Skills instalables y mi primer servidor MCP en npm . Dónde están las skills publicadas El catálogo instalable vive en skills/ , separado en tres categorías: external/ para APIs de terceros, local/ para homelab y flujos de trabajo, y general/ para utilidades transversales. Las tres son públicas: una skill en external/ , una en local/ y seis en general/ . local/ describe su ámbito de uso. skills/ ├── external/ │ └── nextdns-api/SKILL.md ├── local/ │ └── progressive-search/SKILL.md └── general/ ├── agent-context-generator/SKILL.md ├── nestjs-iam-patterns/SKILL.md ├── nestjs-advanced-patterns/SKILL.md ├── nestjs-graphql/SKILL.md ├── tuning-claude-code/SKILL.md └── obsidian-second-brain/SKILL.md Las ocho skills Tres categorías: external/ para servicios de terceros, local/ para infraestructura de homelab y workflows propios, general/ para utilidades transversales que no dependen de ningún servicio en particular. Skill Categoría Para qué sirve nextdns-api external API de NextDNS progressive-search local Búsqueda de código y documentación agent-context-generator general Contexto de proyecto nestjs-iam-patterns general Autenticación y permisos nestjs-advanced-patterns general Internals y arquitectura de NestJS nestjs-graphql general GraphQL code-first y schema-first tuning-claude-code general Configuración de Claude Code obsidian-second-brain general Organización y revisión de notas Cada comando instala una skill. Ejecuta el de la que necesites. 1. nextdns-api Referencia completa de la API REST de NextDNS: perfiles, seguridad/privacidad/control parental, listas de bloqueo y permitidas, analíticas, logs de consultas. Es la que respalda al MCP server que desc

Since 2026 every Shopify storefront answers an agent-commerce endpoint at POST /api/ucp/mcp , advertised at GET /.well-known/ucp . Merchants did not turn it on and it is not in their admin. It speaks the Universal Commerce Protocol over JSON-RPC, and the tool that matters is search_catalog : an AI shopping agent asks a store for its catalogue and gets structured product data back - integer prices in minor units with a currency, variants, SKUs, canonical URLs, and a Shopify taxonomy category per product. Fetch the tool list from any store and search_catalog declares catalog.filters.categories , an array of strings documented as "category filters combined with OR logic", next to catalog.filters.price.{min,max} . So an agent should be able to ask for running shoes and get running shoes. We were about to write a paragraph about what it costs a merchant to leave the category field blank. Then we tried it. Method 200 stores, drawn deterministically from a corpus of 10,099 known Shopify storefronts: sort the hostnames, take every Nth. Reproducible, so nobody has to take "we picked 200 stores" on trust. Run on 2 September 2026. Every store got the same five calls, 10 products requested each time: # Call Filter sent A working filter would 1 Control none return products 2 Impossible category gid://shopify/TaxonomyCategory/zz-99-99-99 return nothing 3 The store's own category a category the control's products carry return at least that product 4 Same, unwrapped the bare id without gid://... the other form an agent would try 5 Price control price.max = 1 return nothing - nothing costs a cent Calls 2 and 3 only mean something together. Call 2 alone cannot distinguish "the filter is ignored" from "the filter rejects everything". Those are opposite findings, and both happen. The query matters more than it looks. Generic words ("gift", "set", "new") surface a catalogue's odd corners rather than its catalogue, and produce numbers that are measured honestly and still wrong. Every que