标签：#rce

GitHub热门项目 | Prompt as Code | GPT-Image2 工业级提示词引擎与模板库，470+ 个案例逆向工程，20+ 套工业级模板，并提炼出Skills，持续更新中 | Stars: 8,643 | 49 stars today | 语言: JavaScript

GitHub热门项目 | 基于Python的开源量化交易平台开发框架 | Stars: 43,785 | 137 stars today | 语言: Python

GitHub热门项目 | The fastest local AI engine for Apple Silicon. 4.2x faster than Ollama, 0.08s cached TTFT, 100% tool calling. 17 tool parsers, prompt cache, reasoning separation, cloud routing. Drop-in OpenAI replacement. Works with Claude Code, Cursor, Aider. | Stars: 3,351 | 18 stars today | 语言: Python

GitHub热门项目 | A powerful MCP toolkit for coding, providing semantic retrieval and editing capabilities - the IDE for your agent | Stars: 26,786 | 85 stars today | 语言: Python

GitHub热门项目 | Awesome list of 300+ agentic AI resources | Stars: 2,029 | 67 stars today | 语言: Python

Hi! I built EasyInvoicePDF because I was tired of paying for bloated invoicing tools when all I needed was a simple way to generate and send professional invoices. https://easyinvoicepdf.com https://github.com/VladSez/easy-invoice-pdf Features: No sign-up required & no ads Live PDF preview & instant download Save Seller & Buyer Profiles Flexible tax support (VAT, Sales Tax, etc.) Customizable invoice templates 120+ currencies & multi-language support and more… All feedback, questions, bug reports, and feature ideas are welcome! Demo:

Hi, my name is Dan, I'm a frontend engineer and open-source maintainer. I've spent the last couple of years building Nano Kit — a lightweight, modular state management ecosystem for modern web apps: signals-based stores , a router , data fetching , i18n , and SSR support , all built on the same tiny reactive core. It recently hit 1.0 , and in this post I want to give you four honest reasons to try it. 1. It's fast At the heart of Nano Kit is a push-pull reactivity system based on the algorithm from alien-signals — one of the fastest signal implementations in the JavaScript ecosystem. I didn't use alien-signals directly, though. Nano Kit needed things it doesn't provide, so I built a dedicated fork called Agera : Signal lifecycles — you can listen to signal activation and deactivation, which powers Nano Kit's mountable stores (run setup logic on first listener, clean up on last). Real tree-shaking — Agera is designed so that only the code you use ends up in your bundle; alien-signals is not well tree-shakable. The result keeps almost all of alien-signals' raw speed. Here is how @nano_kit/store compares to other popular state management libraries in a reactivity benchmark : Library Latency avg (ns) Throughput avg (ops/s) alien-signals 294.00 ± 2.24% 3,559,763 @nano_kit/store 303.55 ± 0.75% 3,365,816 svelte/store 428.58 ± 0.61% 2,479,118 rxjs 454.74 ± 0.07% 2,250,397 nanostores 1,373.2 ± 5.96% 952,399 mobx 3,474.7 ± 1.86% 306,094 valtio 5,041.3 ± 11.46% 254,109 jotai 9,454.6 ± 16.45% 157,853 effector 24,885 ± 11.78% 62,744 @reatom/core 59,430 ± 15.61% 22,741 Benchmark was run on AMD Ryzen 5 PRO 3400G with Node.js v24.14.1 That's ~3.5× faster than nanostores and an order of magnitude faster than most atomic state managers — while shipping lifecycles and mountable stores on top. 2. It's small Nano Kit exists largely because of Nano Stores . I love its philosophy: atomic stores, mountable resources, logic moved out of components, and an obsessive focus on bundle size. Nan

In 1996, Bandai sold 82 million Tamagotchis. Kids carried egg-shaped plastic keychains everywhere, frantically pressing three buttons to feed, clean, and play with a pixelated blob that would literally die if you ignored it during math class. It was the first time millions of people felt genuine emotional attachment to a piece of software. 30 years later, I rebuilt that entire experience — in the browser, with TypeScript, zero dependencies, completely open source. No app store. No download. No install. Just open a tab and adopt your pet. And in the process, I learned more about state machines, game loops, and emotional design than any computer science course ever taught me. Why Build a Virtual Pet in 2025? Three reasons: 1. Nostalgia Is a Distribution Hack People share things that trigger childhood memories. It's not rational — it's emotional. A browser-based Tamagotchi hits a nerve that no todo app or dashboard ever will. When I shared an early prototype, the response wasn't "cool tech stack." It was: "OH MY GOD I used to cry when mine died in second grade" That emotional reaction is worth more than any Product Hunt launch. 2. Game State Machines Are Criminally Underrated Every tutorial teaches state machines with traffic lights or toggle buttons. Boring. Useless. Forgettable. A virtual pet has dozens of interconnected states , real-time decay, evolution paths, conditional transitions, and edge cases that force you to actually think about state architecture. After building this, implementing complex UI flows in production apps felt trivial. 3. Not Everything Needs to Be a SaaS The indie dev world is obsessed with "revenue-generating side projects." Sometimes you should build something purely because it makes people smile. The best projects are the ones you'd use even if nobody else existed. Meet Your New Pet When you open Tamagochi, you get an egg. It hatches. A tiny pixelated creature appears. It has needs. Meet them, and it thrives. Ignore them, and... well, game

Most bibliography failures show up the night before arXiv or the journal deadline: placeholder DOIs, year pasted into volume= , inverted page ranges, invented case reporters. The fix is a paper repo that fails closed from day one . One command pip install https://github.com/SybilGambleyyu/citesure/releases/download/v0.5.68/citesure-0.5.68-py3-none-any.whl citesure init my-paper cd my-paper citesure gate . --preset ci citesure gate . --preset arxiv citesure init writes refs.bib , pre-commit hooks ( gate --preset ci + soft-lint), .github/workflows/citesure.yml , and a short CITESURE.md for coauthors. Empty bibliographies skip hard-ID floors until entries appear. What the gate checks Soft-lint — placeholder number/issue, inverted pages, year-like volume/month/edition, unsafe keys, all-caps titles, missing venues, duplicate DOIs/titles Health — hard-ID coverage floors Promote dry-run — DOIs still buried in url= Live verify — Crossref, doi.org, arXiv, PubMed, Europe PMC, DataCite, OpenAlex, CourtListener Domain packs Fifty-five live-clean packs (demography, sociology, political science, anthropology, ML, law, ecology, …): citesure packs --gate-all citesure packs --run anthropology-classics Evidence: 256/256 integrity · 209/209 claim pairs · 55 packs. Source: github.com/SybilGambleyyu/citesure · Demo: citesure.sybilgambleyyu.workers.dev

An AI can write a perfect email in seconds. Having a real back-and-forth conversation is much harder. Sarah runs a salon. She has an AI assistant that emails her customers when a slot opens up. Last Friday, a customer canceled his booking. The assistant sent an email: "We have an opening tomorrow at 2 PM. Want it?" The customer replied in a minute: "Yes, book it!" The assistant never saw that reply. The slot stayed open. The customer never got a confirmation. This happens more than people realise — not because it's hard to receive email, but because most setups were never wired to close the loop. Sending is easy. Wiring the whole loop isn't. To be fair, receiving and parsing email isn't some unsolved problem — providers like SendGrid, Mailgun, and Postmark have offered inbound email parsing for years. Point your domain at them, and they'll hand you the clean message. But those webhooks only push the message once. There's no inbox to check back later, and no built-in way to link a reply to the right conversation. You have to build that part yourself — and you still can't run any of it on your own servers. There's a second issue too. AI assistants sometimes send a slightly odd reply — nothing harmful, just a little off. Many managed email providers watch for exactly that pattern, and can suspend an account fast. One strange sentence, and Sarah's whole booking system could go dark with no warning. What a real AI assistant needs For an assistant like Sarah's to actually hold a conversation, a few things need to work together: Replies need to land somewhere the AI can read them They need to arrive clean, not messy They need to stay linked to the right conversation The AI needs to reply back from the same email address All of it needs to run on infrastructure you control, not three different vendors This is what we built Reloop for Reloop puts that whole loop in one place, self-hosted. When Sarah's customer replied "Yes, book it!", Reloop caught the reply, cleaned it up,

Building Profitable Niche Lifestyle Stores: A Developer's Guide to E-Commerce Essentials Launching a niche lifestyle e-commerce store is more than just setting up a storefront—it's a technical challenge that requires thoughtful architecture, performance optimization, and strategic content planning. Whether you're building a store for outdoor gear, fashion accessories, or humor products like humor24.se , here's what developers need to know. Choose the Right Tech Stack Most profitable niche stores run on WordPress + WooCommerce + a performance-focused theme (like Blocksy). This combination offers: Flexibility : Extend functionality without rewrites SEO-friendly : Built-in structured data support Cost-effective : No complex deployment infrastructure needed Content integration : Blog + products on the same platform Use a headless CMS approach only if you have compelling reasons (high-traffic requirements, complex frontend needs). For 99% of niche stores, the overhead isn't worth it. Core Web Vitals = Revenue Google's Core Updates consistently penalize slow stores. Prioritize: LCP (Largest Contentful Paint) < 2.5s : Optimize images (WebP/AVIF format), lazy load below-fold content, defer non-critical CSS INP (Interaction to Next Paint) < 200ms : Minimize main thread blocking, defer JavaScript CLS (Cumulative Layout Shift) < 0.1 : Use fixed image dimensions, avoid late-loading ads/widgets # Generate WebP variants of product images convert image.jpg -quality 80 image.webp # Check your Core Web Vitals # Use PageSpeed Insights API or Lighthouse CI in your deployment pipeline Each 0.1s improvement in LCP can yield 3-5% conversion uplift. Performance is a feature. Structured Data Wins Traffic Rich snippets dramatically improve click-through rates. Implement: Product schema : name , price , availability , image , brand , AggregateRating BreadcrumbList : Navigation structure FAQ schema : If you have FAQs (47% higher CTR for FAQ snippets) { "@context" : "https://schema.org/" , "@t

Most code that calls an AI model works like a conversation: ask, wait a second, get a reply. Fine-tuning doesn't. You hand off a job and walk away, checking back every few seconds to see if it's finished. DSPy is a framework for building programs that call language models. Instead of hand-writing and endlessly tweaking prompt strings, you declare what you want in terms of inputs and outputs, and DSPy turns that into the actual prompt. It can even optimize those prompts for you automatically, so getting a better result doesn't mean rewording things by hand. Here's something I didn't know starting out: DSPy already knows how to talk to almost any AI model, Together AI included. Asking a question and getting an answer back is handled by a shared layer that works for everyone, so no new code is needed there. Fine-tuning (the "hand off a job and walk away" thing from the top) is the exception. Every company does fine-tuning its own way, so DSPy needs a small custom piece, called a Provider, to handle each one. Building the Provider for Together AI is what my PR does. Why does this matter? Together AI is one of the cheaper, more popular places to fine-tune open-source models like Llama, so a lot of people building with DSPy end up wanting to use it. Before this, they had to step outside the framework: fine-tune on Together by hand, then wire the finished model back into their DSPy program themselves. With the provider in place, fine-tuning becomes a first-class option. You point DSPy at your training data, and it handles the upload, the job, the waiting, and hands back a model you can drop straight into the rest of your pipeline. That is the whole point of a framework, taking a fiddly manual process and making it one clean step, and adding a provider is how that gets extended to one more company. The Provider does one job from start to finish: take your training examples and hand back a fine-tuned model. Under the hood, that's five steps: Check your training data is in a

GitHub热门项目 | | Stars: 1,130 | 395 stars today | 语言: Rust

用 FROST 家族治理模型，构建你的「AI 第一性原理」 作者 ：神通说 日期 ：2026-07-23 主题 ：双项目联动 | 周四代码教程 阅读时间 ：12分钟 前言：为什么你需要「第一性原理」？ 埃隆·马斯克推崇「第一性原理」思维——从物理学的最基本定律出发，而不是类比他人的做法。 在 AI Agent 开发领域，大多数人都在用 LangChain、CrewAI、AutoGen 这些现成框架。它们很好用，但你是在用别人的「家族结构」，而不是理解为什么需要家族结构。 FROST 的目标是让你从第一性原理理解 AI Agent： 为什么需要治理结构？为什么需要记忆传承？为什么需要层级分工？ 然后，FROST-SOP 帮你把第一性原理变成可运行的系统。 一、从细胞分裂看 AI Agent 本质 想象一个细胞分裂的场景： ┌─────────┐ │ 细胞 │ ← 拥有细胞核（记忆）、蛋白质（能力） └────┬────┘ │ 分裂 ┌────┴────┐ │ 细胞A │ │ 细胞B │ ← 各自独立，但共享DNA └─────────┘ └─────────┘ FROST 的四个原子就是生命的四个基本元素： 原子 生命类比 技术实现 Store 细胞核 记忆容器，持久化状态 Skill 蛋白质 无状态能力单元 Agent 细胞膜 包裹 Store + Skills 的执行单元 SOP DNA 序列 有序的操作指令集 # FROST 的最小可用示例：50行代码理解 Agent 本质 from frost.core import Store , Agent , skill_set , skill_get , skill_del # 1. 创建记忆容器 store = Store () # 2. 定义能力（蛋白质） skills = { " set " : skill_set , # 存记忆 " get " : skill_get , # 取记忆 " del " : skill_del # 删记忆 } # 3. 创建 Agent（细胞） agent = Agent ( " my_cell " , store , skills ) # 4. 定义 SOP（DNA 序列） sop_steps = [ " set " , # 存一个值 " get " , # 读回来 " del " # 删掉 ] # 5. 运行 result = agent . run ( sop_steps = sop_steps , initial_context = { " key " : " name " , " value " : " FROST " } ) print ( result [ " _result " ]) # 输出: "FROST" 这 50 行代码展示了 FROST 的核心： Agent = Store + Skills + SOP 。 二、为什么需要「家族」？从独居细胞到多细胞生物 单细胞生物可以独立存活。但复杂生命需要多细胞协作——肝脏细胞、心脏细胞、神经细胞各有分工，协同维持生命。 AI Agent 也是如此。简单任务一个 Agent 够了，但复杂系统需要多 Agent 协作。 FROST 的家族模型： ┌─────────────────────────────────────────────────────┐ │ 君主（Human Agent） │ │ 最高决策者，只发布任务不看执行 │ └─────────────────────────────────────────────────────┘ │ ▼ ┌─────────────────────────────────────────────────────┐ │ 祖辈（Ancestor） │ │ 全局编排、宪法定义、任务拆分、资源分配 │ │ ⚠️ 不亲自执行，只做调度 │ └─────────────────────────────────────────────────────┘ │ ┌─────────────┼─────────────┐ ▼ ▼ ▼ ┌──────────┐ ┌──────────┐ ┌──────────┐ │ 斥候 │ │ 斥候 │ │ 斥候 │ │ (侦察) │ │ (侦察) │ │ (侦察) │ └────┬─────┘ └────┬─────┘ └────┬─────┘ │ │ │ ▼ ▼ ▼ ┌──────────┐ ┌──────────┐ ┌──────────┐ │ 府兵 │ │ 府兵 │ │ 府兵 │ │ (执行) │ │ (执行) │ │ (执行) │ └──────────┘ └──────────┘ └──────────┘ │

Tired of squinting at VS Code’s stacked merge editor? MergeForge brings a JetBrains-style three-pane conflict resolver to VS Code and Cursor — and pairs it with an AI assistant that actually reads your repository before it suggests a fix. The problem We’ve all been there. You’re halfway through a rebase. Git stops. Twelve files are conflicted. You open one in VS Code… and get that familiar stacked layout: Incoming, Current, and a result pane that somehow still feels like a puzzle with half the pieces missing. If you ever used WebStorm or IntelliJ, you know how good merge tools can feel: Your side on the left Their side on the right The result in the middle Gutter arrows that just… work In VS Code land, that flow never quite arrived. You click Accept Current, Accept Incoming, Accept Both, and hope nothing important got flattened. Word-level diffs? Authorship? A clear “who wrote this chunk?” signal? Often missing when you need them most. And when AI entered the chat, a lot of tools treated conflicts like isolated text blobs: “Here are the <<<<<<< markers. Good luck.” But real merges need context. What was the branch trying to do? What does the surrounding file look like? Who touched this last? Without that, “AI resolve” is just confident guessing. I wanted the JetBrains merge experience — inside VS Code and Cursor — with an assistant that behaves more like a careful teammate than a slot machine. So I built it. The solution: MergeForge MergeForge is an open-source VS Code / Cursor extension that turns conflicted files into a proper three-pane visual merge. Layout: Left Center Right Yours (local) Result (editable, seeded from the merge base) Theirs (incoming) Panes scroll together. Chunks connect with bands. Gutter controls let you accept, ignore, or blend sides without fighting the UI. When you’re done, Apply writes the result and stages it with git. If you prefer Cursor, you’re covered too. The editor works the same; for AI features you plug in your own provider key (

I'm a scrum master. I was a developer ten years ago. I have enough background to discuss design and trade-offs with an LLM — but three months ago I made a deliberate bet on my solo project: I would never read the code. The specs define the tests. The tests control the code. The code is a black box. I'm not claiming this is what everyone should do. But it's my bet, and it forced a system into existence: when nobody reads the code, the process has to carry the trust that a code-reading human normally provides. I've just published that system as a reference implementation: backlog-as-data — the full writeup, the Claude Code skills translated to English, and the CLI source, verbatim from my daily setup. Here's the short version. The backlog is git data, not a document Most agent task-management tools store tasks in a dedicated place — a tasks.json , a database, a backlog/ folder. My bet is different: the backlog is the YAML frontmatter of my spec files. One file per ticket, and the ticket's status is a field — never a location in a document. --- id : PARSE-07 title : Tolerate CRLF in decklist import type : ticket status : todo priority : should exec : model : sonnet effort : think review : light matured : 2026-07-22 --- # PARSE-07 — Tolerate CRLF in decklist import The spec body: design, contracts, test cases. The ticket file IS the spec. Everything below the frontmatter is the spec — written by the LLM, after it has challenged the need I expressed in conversation. The frontmatter is data — owned by a small CLI, mutated only through it. Same file, so they can never drift apart. Why it matters: "move it to Done" is not an operation. LLMs (and humans) mangle documents when a state change means relocating text. Making status a field makes every transition a one-line, idempotent, testable mutation. The board I look at (a small web page on my server, with GitHub deep links to each spec) and the readable markdown view are generated projections , locked by a do-not-edit sentin

If you've ever had to check code or infrastructure against a compliance framework, you know the drill: someone reads a 100-page PDF, then reads your codebase, then makes a judgment call. It's slow, inconsistent, and it can't be automated. So I built a pipeline to fix that — for real. The problem CMMC Level 1 and NIST SP 800-171 Rev 2 are two of the most common compliance frameworks small defense contractors and government-adjacent companies have to meet. Both exist only as dense regulatory text. There's no official machine-readable version. That means every compliance check is manual. Every AI coding assistant reviewing your infrastructure has zero built-in awareness of these requirements. Every CI/CD pipeline has to skip compliance checks entirely or rely on someone remembering to look. ** What I built** A Python pipeline that: Pulls the real regulatory source data — NIST's official CPRT export for SP 800-171, and the verbatim text of 48 CFR § 52.204-21 for CMMC Level 1 Normalizes it into a structured SQLite schema Generates a JSON rule for every single control, with a machine-actionable instruction attached Here's what one rule actually looks like: \ json { "rule_id": "nist_sp_800-171_rev_2_3.1.1", "framework": "NIST SP 800-171 Rev 2", "control_id": "3.1.1", "title": "ACCESS CONTROL — 3.1.1", "requirement": "Limit system access to authorized users, processes acting on behalf of authorized users, and devices.", "agent_guidance": "When generating or reviewing code/infrastructure, ensure compliance with NIST SP 800-171 Rev 2 control 3.1.1. Flag any implementation that does not satisfy: Limit system access to authorized users, processes acting on behalf of authorized users, and devices.", "generated_at": "2026-07-15T16:42:56.026218+00:00" } \ \ That agent_guidance field is the interesting part — it's written specifically to drop straight into an AI coding agent's system prompt as a compliance guardrail. Three ways to actually use this 1. AI coding agent system prompt

Documentation is often the last thing developers think about—until a broken link frustrates users or a README sends someone to a 404 page. I wanted a simple way to automatically verify links in Markdown documentation during CI, so I built urldn-link-check. It's an open-source GitHub Action and CLI that scans your documentation and reports issues before they're merged. Features ✅ Detect broken links (404/500) ↪️ Detect redirect chains 🔒 Detect insecure HTTP links 📏 Find overly long URLs 📄 Scan Markdown & MDX files ⚡ Fast concurrent scanning 💬 GitHub PR summaries 📊 JSON & Markdown reports Installation npm install -D urldn-link-check or npx urldn-link-check . GitHub Action uses: urldn/link-check@v1 That's it. Every push or pull request can automatically verify your documentation. Why I Built It While maintaining documentation, I noticed that broken links often go unnoticed until someone reports them. Instead of checking them manually, I wanted a lightweight tool that integrates directly into GitHub Actions and fits naturally into a CI workflow. Open Source The project is MIT licensed and contributions are welcome. ⭐ GitHub: https://github.com/urldn/link-check 📦 npm: https://www.npmjs.com/package/urldn-link-check https://www.npmjs.com/package/urldn-link-check This is the first developer tool in the URLDN ecosystem, with more open-source projects planned in the future. If you have ideas or feedback, I'd love to hear them.

Java is everywhere in backend systems, enterprise applications, and production environments. But when it comes to numerical computing, data manipulation, and scientific-style operations, Python's NumPy ecosystem has become the standard. I wanted a similar experience in Java: a lightweight, dependency-free library for working with multidimensional arrays and linear algebra. That idea became NumPy4J. What is NumPy4J? NumPy4J is an open-source numerical computing library for Java inspired by NumPy. It provides: Multidimensional arrays (NDArray) NumPy-style broadcasting Array creation utilities Reshaping and slicing Element-wise operations Linear algebra operations Example: NDArray A = NDArray . of ( new double []{ 1 , 2 , 3 , 4 }, 2 , 2 ); NDArray B = NDArray . ones ( 2 , 2 ); NDArray C = A . add ( B ); Matrix operations: NDArray result = LinearAlgebra . matmul ( A , B ); Solving equations: NDArray x = LinearAlgebra.solve(A, b); Why build another numerical library? There are already excellent Java math libraries available. The goal of NumPy4J is different: Provide a NumPy-like API experience Make multidimensional arrays a first-class concept in Java Keep the API simple and approachable Create a foundation for future scientific computing features Testing approach To make sure behavior stays consistent, NumPy4J uses Python NumPy as a reference implementation. Test cases are generated with NumPy and validated against the Java implementation, covering: Broadcasting Matrix operations Reshaping Transpose Linear solving Element-wise calculations What's next? The roadmap includes: More NumPy-compatible operations Matrix decompositions (QR, LU, Cholesky) Eigenvalue computation More statistics functions Performance improvements Try it out If you work with Java and need NumPy-style numerical operations, I would love for you to try NumPy4J, provide feedback, and contribute ideas. GitHub: https://github.com/darius1973/numpy4j Documentation: https://darius1973.github.io/numpy4j/inde

LLM-written bibliographies do not stop at arXiv preprints. Law review drafts invent reporter cites; multilingual papers mangle Chinese titles. citesure 0.2 extends the integrity gate into those failure modes. US case law via CourtListener References that look like court cases — @jurisdiction entries, Plaintiff v. Defendant titles, or reporter strings such as 347 U.S. 483 — are resolved against Free Law Project CourtListener. Ranking prefers an exact reporter cite over companion orders, so Brown lands on 347 U.S. 483 rather than a later procedural listing. @jurisdiction { brown1954 , title = {Brown v. Board of Education} , year = {1954} , howpublished = {347 U.S. 483} , } citesure check examples/packs/us-case-law.bib citesure warm-cache cases.bib Optional COURTLISTENER_TOKEN for higher rate limits. Law-review CI: templates/journal/law-review.yml . CJK-aware matching NFKC + fullwidth folding; character-level similarity for CJK-heavy titles; CJK bigrams in claim scoring so Chinese claims are not silently empty. Evidence Integrity bench 242/242 (US cases + Chinese titles + multi-domain set) Claims mini-bench 29/29 Eight domain packs including us-case-law Install pip install "git+https://github.com/SybilGambleyyu/citesure.git[pdf]" Source: github.com/SybilGambleyyu/citesure · Demo: workers.dev