今日已更新 292 条资讯 | 累计 24578 条内容
关于我们

标签：#rce

找到 1731 篇相关文章

AI 资讯

Fix N+1 Trigger Patterns Where Lambda Functions Hammer the Same DynamoDB Partition Key

You add a sixth Lambda trigger to your OrderEvents table, deploy it, and within 20 minutes your SLA dashboard goes red. Latency on order writes jumps from 4ms to 40ms. The function itself is fine. The table is fine. The problem is that five other Lambdas are already hitting the same partition key on every write, and you just made it six. DynamoDB's internal partition throttling doesn't care that each function looks clean in isolation. This is an N+1 trigger problem, and your AI coding assistant cannot catch it. Not because it lacks intelligence, but because the fact that five Lambdas already target that table lives in your AWS account and your full codebase — not in the file your assistant has open. Infrawise · npm Why the LLM Can't See the Pattern When you ask Claude to write a new order processing Lambda, it reads the file you have open and generates code that looks correct — because in the context of that one file, it is correct. It doesn't know about ProcessRefundsLambda , NotifyFulfillmentLambda , SyncInventoryLambda , UpdateAnalyticsLambda , and AuditTrailLambda , all of which you wrote in previous sprints and which all write to the Orders table. This is a category of failure that model quality doesn't fix. A better model produces a more fluent explanation for why your latency spiked. The fact that five functions converge on the same table is a lookup, not a prediction. The source of truth is a combination of your code (which functions exist) and your infrastructure (what they access). Infrawise draws that boundary explicitly. It extracts the answer from your code using AST parsing and from your infrastructure using API calls, then hands that graph to the model as structured context — it never generates the answer. How Infrawise Traces Trigger Chains to the Same Table When Infrawise scans your repository, it uses ts-morph to walk every CallExpression in every source file. It's not searching for the string "DynamoDB" — it matches call structure against a known

2026-06-21 原文 →
AI 资讯

ctrodb: A Client-Side Database for TypeScript — Zero Dependencies

I've been working on ctrodb — a client-side database for TypeScript that runs in the browser (IndexedDB) and Node.js (in-memory). Zero runtime dependencies. It started as a personal project to stop rewriting IndexedDB wrappers. Every new client-side app needed the same boilerplate: open a connection, create object stores, handle version upgrades, write CRUD helpers. After the sixth time, I wrote it once and got it right. What it does ctrodb gives you MongoDB-like CRUD with schema validation at write time: import { Database } from " ctrodb " const db = new Database ({ name : " my-app " , schema : { version : 1 , collections : { notes : { fields : { title : { type : " string " , required : true }, body : { type : " string " }, pinned : { type : " boolean " , default : false }, tags : { type : " array " , items : { type : " string " } }, createdAt : { type : " string " , default : () => new Date (). toISOString () }, }, indexes : [{ field : " createdAt " }], }, }, }, }) await db . connect () const notes = db . collection ( " notes " ) const note = await notes . create ({ title : " Hello " , body : " World " }) const results = await notes . query () . where ( " pinned " , true ) . sort ({ createdAt : " desc " }) . limit ( 10 ) . fetch () Every record is a Model — a Proxy wrapper with typed field access. note.title works. note.update() handles writes. Direct property assignment logs a warning telling you to use .update() instead. What's included The core package ships with three plugins: Full-text search — inverted index, stop word removal, auto-indexed on create/update/delete Relations — has_many, belongs_to, has_one with lazy accessors built into every Model and eager loading via .with() Custom validation — extendable rules beyond the built-in validators (email, URL, regex) Plus React hooks (separate import, same package): import { DatabaseProvider , useQuery , useMutation } from " ctrodb/react " Signal-based reactivity. When data changes, useQuery re-fetches and your

2026-06-21 原文 →
AI 资讯

Your repo has whitespace problems you can't see — I built a zero-dep CLI that finds and fixes them all

Whitespace problems are the ones you can't see until they bite. A pull request where half the "changes" are trailing-space diffs. A shell script that breaks in CI because someone's editor saved it CRLF. A .env with a UTF-8 BOM that makes the first variable name mysteriously not match. A file with no final newline that turns one-line changes into two-line diffs forever. None of it shows up on screen. All of it shows up in git blame . Today, catching this takes three or four tools stitched together — and I got tired of that, so I built wssweep : one zero-config command that finds all the common whitespace smells and, with --fix , cleans them in place. $ npx wssweep src/app.js (2) 14: trailing-whitespace trailing whitespace - missing-final-newline no newline at end of file config.yml (1) - mixed-eol mixed line endings (CRLF×3, LF×1) ✖ 3 whitespace issues in 2 files (mixed-eol=1, missing-final-newline=1, trailing-whitespace=1) $ npx wssweep --fix # clean them It checks seven things: trailing whitespace, mixed CRLF/LF line endings, lone CRs, a missing final newline, extra trailing blank lines, a UTF-8 BOM, and tabs mixed with spaces in one indent. Non-zero exit on findings, so it's a CI gate. pip install wssweep gets the same tool in Python — byte-for-byte identical output and fixes. Why not editorconfig-checker / pre-commit / prettier? Because each does part of it: editorconfig-checker reports — but you have to author an .editorconfig first, and it can't fix anything. pre-commit 's trailing-whitespace / end-of-file-fixer / mixed-line-ending hooks do fix, but only inside the pre-commit framework, and they're three separate hooks. Nobody runs them ad-hoc on a fresh checkout. prettier fixes whitespace only as a side effect of reformatting all your code, and won't touch files it can't parse. dos2unix does line endings and nothing else. wssweep is the one npx / pip command, no config and no framework, that does the whole set at once and drops into any CI regardless of toolch

2026-06-20 原文 →
AI 资讯

I built an AI priority inbox for GitHub pull requests — and went BYOK instead of running my own AI backend

The problem GitHub shows your pull requests in whatever order they happened to be opened — not in the order they actually need your attention. A one-line typo fix and a PR touching authentication code get exactly the same visual weight in your inbox. Multiply that across a dozen open PRs and you spend more time deciding what to look at than actually reviewing. What I built PR Focus is a Chrome extension (Manifest V3) that sits on top of GitHub's PR pages. It combines three signals into a single priority queue: CI status — failing checks bubble up PR age — stale PRs don't get forgotten AI risk score (0–100) — weighted toward changes touching auth, database, or infra code Each PR also gets a plain-English summary generated from the actual diff (not the title someone wrote at 11pm), and you can generate an approve / request-changes draft review in one click, edit it, and send — without leaving the extension. Why BYOK instead of my own AI backend This was the decision I spent the most time on. Running my own AI backend would have meant: A server in the data path of every PR diff users review — a much bigger trust ask, especially for private repos. Either eating the AI cost myself (unsustainable as a solo dev) or marking it up into a subscription. Going BYOK (bring your own key — OpenAI, Groq, Mistral, or a local Ollama instance) flips both of those: Your GitHub token and AI key live in chrome.storage.local . There's no server of mine in the path — PR diffs only ever go to the AI provider you explicitly configure. Groq's free tier is generous enough to run the AI features for free for most individual workflows. You're paying provider cost directly, with zero markup, if you pay anything at all. How it's built Manifest V3 — required rethinking persistence patterns that worked under MV2's persistent background page; service worker lifecycle and content script injection needed more careful handling. GitHub REST + GraphQL APIs rather than DOM scraping — more upfront work, but

2026-06-20 原文 →
AI 资讯

Stop Competitors from Scraping Your Data! Building a Backend Defense for Your E-commerce Store

In the world of cross-border e-commerce, malicious bot scraping leading to Meta/Google Pixel pollution is a nightmare for every seller. When your store starts gaining traction, these fake traffic sources can "poison" your ad model, causing your ROAS to plummet. To combat this, I’ve developed a robust "Backend Data Isolation" architecture. The Core Defense Strategy Stop triggering ad conversion events directly from the frontend. Instead, build a "firewall" at the backend to ensure that only verified, high-quality conversion data is sent to your ad platforms. Technical Implementation By implementing server-side logic in Python, we can filter out bot requests effectively: def process_pixel_event ( request ): # Filter out bot signatures (User-Agent, IP analysis) if is_bot_signature ( request . headers [ ' User-Agent ' ]): return None # Send only high-quality data to ad platforms if is_real_customer ( request . session ): trigger_pixel_event ( request ) By leveraging this logic, we feed "private, high-quality data" to the AI. This allows the algorithm to learn only from genuine customer behaviors, creating an "immortal pixel" moat around your store. Learn More For a deep dive into full-scale anti-scraping deployments and how to leverage automated translation techniques to scale traffic in blue-ocean markets, check out my full technical guide: 👉 Read the Full Implementation & Troubleshooting Guide Here

2026-06-20 原文 →
AI 资讯

Tracking token usage across OpenAI, Anthropic, and Gemini: every streaming gotcha I hit

OpenAI, Anthropic, and Gemini each report token usage differently, and it stops being trivia the moment you track LLM cost. I build Spanlens, an open-source LLM observability tool that sits in front of all three as a proxy and records every call with its model, latency, tokens, and cost. To do the cost part I read the token usage back out of every response, including the streaming ones. I assumed the three providers would report usage in roughly the same way. They send the same kind of data, after all: input tokens, output tokens, maybe a cached count. How different could it be. Pretty different, it turns out. Here is the whole thing in one table, then each gotcha in detail with the real parser code from the repo. Provider Where usage lives (streaming) Cache accounting Field names OpenAI final chunk, needs stream_options: { include_usage: true } prompt_tokens includes cache prompt_tokens / completion_tokens Anthropic split across message_start + message_delta input_tokens excludes cache, so add it input_tokens / output_tokens Gemini usageMetadata , two stream formats not applicable promptTokenCount / candidatesTokenCount Gotcha 1: the usage numbers live in different places in the stream For a non-streaming call this is boring. Every provider hands you a usage object on the response body and you read it. Streaming is where it gets weird, because the token counts are not in the content chunks. They show up somewhere else, and "somewhere else" is different for each provider. OpenAI puts the usage in a final chunk, after all the content, right before [DONE] . You only get it if you ask for it with stream_options: { include_usage: true } . Miss that flag and you stream the whole response and end up with no usage at all. export function parseOpenAIStreamChunk ( line : string ): Partial < ParsedUsage > | null { if ( ! line . startsWith ( ' data: ' )) return null const data = line . slice ( 6 ). trim () if ( data === ' [DONE] ' ) return null const json = JSON . parse ( data

2026-06-20 原文 →
AI 资讯

Hermes Agent Skills — Self-Evolving, Persona-Aware Skill Collection for Hermes Agent

Body: Hey everyone 👋 I've been building hermes-agent-skills — a production-grade skill collection for Hermes Agent that does three things no other skill pack does: 1. Self-Evolving Skills Skills aren't static YAML. The built-in EvolutionEngine tracks 5 health dimensions (usage frequency, success rate, user corrections, freshness, command validity), assigns a health score, and tells you which skills are rotting. Think of it as npm audit for your AI assistant's capabilities. 2. SOUL.md Persona Awareness Drop a SOUL.md in your Hermes config — naming conventions, comment density, architecture preferences, commit style — and every skill that touches code output adapts to it. hermes-skill soul generate bootstraps one in one command. The persona-aware-coding skill reads it at runtime so your agent writes code that actually looks like you wrote it. 3. CLI Toolchain hermes-skill create my-workflow # scaffold a standards-compliant SKILL.md hermes-skill validate skills/ # validate against the Agent Skills Standard hermes-skill list skills/ -f json # enumerate with health metadata hermes-skill soul generate # bootstrap a persona file What's in the box (v1.1.0): | Skill | Phase | Hermes-only Feature | |---|---|---| | requirement-analyzer | Define | Persistent memory across sessions | | spec-driven-dev | Spec | /skills chain forming workflows | | test-driven-dev | Build | delegate_task parallel test execution | | debugger-coordinator | Verify | browser + terminal + vision tri-tool | | code-quality-guardian | Review | patch auto-fix + /curator tracking | | cicd-orchestrator | Ship | cronjob scheduling + webhook triggers | | skill-curator | Evolve | Direct /curator integration | | persona-aware-coding | Identity | Native SOUL.md persona system | Why this is different: Most agent skill collections are portable but shallow — they can't use any platform's unique superpowers. These skills go deep on Hermes specifically: slash commands, delegate_task, persistent memory, vision+browser+t

2026-06-20 原文 →
← 上一页 下一页 →