标签：#rce

GitHub热门项目 | | Stars: 7,489 | 66 stars today | 语言: TypeScript

GitHub热门项目 | The open source coding agent. | Stars: 167,404 | 385 stars today | 语言: TypeScript

GitHub热门项目 | Playwright is a framework for Web Testing and Automation. It allows testing Chromium, Firefox and WebKit with a single API. | Stars: 89,864 | 85 stars today | 语言: TypeScript

GitHub热门项目 | The React Framework | Stars: 139,608 | 19 stars today | 语言: JavaScript

GitHub热门项目 | CodeVibe is an interactive learning platform designed to help beginners understand programming through simple lessons and hands-on practice. It includes structured course sections, coding examples, and a built-in HTML compiler that lets users write and test code directly in the browser, making learning web development practical, engaging. | Stars: 28 | 2 stars today | 语言: JavaScript

GitHub热门项目 | Automated auditing, performance metrics, and best practices for the web. | Stars: 30,276 | 10 stars today | 语言: JavaScript

GitHub热门项目 | A Claude Code plugin that shows what's happening - context usage, active tools, running agents, and todo progress | Stars: 24,110 | 76 stars today | 语言: JavaScript

GitHub热门项目 | Open-source alternative to AI video platforms — Free AI image & video generation studio with 200+ models (Flux, Midjourney, Kling, Sora, Veo). No content filters. Self-hosted, MIT licensed. | Stars: 17,522 | 138 stars today | 语言: JavaScript

GitHub热门项目 | Apache Airflow - A platform to programmatically author, schedule, and monitor workflows | Stars: 45,602 | 13 stars today | 语言: Python

GitHub热门项目 | Eagle: Frontier Vision-Language Models with Data-Centric Strategies | Stars: 1,556 | 124 stars today | 语言: Python

GitHub热门项目 | VoxCPM2: Tokenizer-Free TTS for Multilingual Speech Generation, Creative Voice Design, and True-to-Life Cloning | Stars: 22,616 | 658 stars today | 语言: Python

Aider is the best terminal AI coding tool I've used. But by default it sends every diff through your OpenAI or Anthropic key, which gets expensive fast on real refactors — a single 100-file repo map can torch a few dollars before Aider even reads your prompt. This post shows how to run Aider against any LLM provider — Ollama for free local runs, OpenRouter for mixed-provider routing, AWS Bedrock for the enterprise plate — through a single OpenAI-compatible endpoint. I'll use Lynkr , the self-hosted gateway I maintain, but the pattern works with any OpenAI-compatible proxy. Full disclosure: I build Lynkr. I'll point out where it loses to LiteLLM and OpenRouter further down so you can make an honest call. The setup in three commands # 1. Start the gateway npx lynkr@latest # 2. Point Aider at it export OPENAI_API_BASE = http://localhost:8081/v1 export OPENAI_API_KEY = any-value # 3. Run Aider with any model name Lynkr knows about aider --model openai/gpt-4o That's it. Aider speaks the OpenAI Chat Completions protocol; Lynkr speaks it back and quietly translates the call to whichever upstream provider you've configured (Ollama, Bedrock, Anthropic, Azure, OpenRouter, Databricks, llama.cpp, LM Studio, ...). Aider has no idea it's talking to a router. Why bother? The cost math Aider's own leaderboard shows GPT-4o and Claude 3.5 Sonnet at the top — but you don't need a $3-per-million-tokens model to rename a variable. You need it for the architecture decisions. Lynkr's tier routing splits the work: Aider call type Routes to Cost Repo map summarization qwen2.5-coder:7b (Ollama, local) $0 File edits, single-function diffs gemini-flash-1.5 (OpenRouter) ~$0.075/M Architecture / multi-file refactors claude-3.5-sonnet (Anthropic) $3/M On a typical 4-hour Aider session, 80–90% of the calls are repo-map and small-diff calls. Routing those to local + cheap models while keeping Claude Sonnet for the hard reasoning has cut my own Aider spend by roughly 70%. Your mileage will vary base

Criei um gerenciador de downloads desktop em Python e quero feedback da comunidade! O PyFlowDownloader é um app desktop feito com Python + PySide6 que usa yt-dlp para baixar vídeos e áudios de forma assíncrona do youtube. Algumas coisas que ele já faz: Fila de downloads com progresso em tempo real Cancelamento de downloads ativos ou pendentes Suporte a MP4 e MP3, de 144p até 1080p Histórico com exportação para CSV Interface desktop com tema visual via QSS Build para Windows via PyInstaller + pipeline de release no GitHub Actions Está na versão v0.3.0 e ainda tem muito espaço pra crescer. Repositório: https://github.com/Vinny00101/PyFlowDownloader Se você puder **testar e deixar sua opinião nos comentários, ficaria muito grato! Quer saber: O que achou da experiência de uso? Algum bug que encontrou? O que você adicionaria ou melhoraria no projeto? Todo feedback é bem-vindo!

A practical, slightly opinionated Hermes Agent use case: an always-on chief of staff that remembers your work, schedules itself, uses tools, and reports back with receipts.

The problem I often switch between Codex, OpenCode, Cline, Claude Desktop, scripts, and terminals. The annoying part is not starting a new tool. The annoying part is explaining the same workspace state again: what changed what is still pending what should not be touched what tests passed what the next agent should read before editing What I built AgentContextBus (acb) is a local-first CLI for handing off workspace context between coding agents. It saves a local handoff packet, then lets the next agent read it through: paste-ready prompts brief prompts a local dashboard JSON output explicit MCP tools First run npx @xiaoshuo1988/acb verify first-run For Chinese output: npx @xiaoshuo1988/acb verify first-run --lang zh-CN A normal handoff From the agent that has context: acb handoff --from codex --summary "Ready for the next agent" --git From the receiving side: acb receive --latest After the receiving agent summarizes the packet: acb ack --latest --by opencode What ACB intentionally does not do no hidden prompt injection no traffic interception no third-party client config mutation no cloud sync no background daemon Why local-first I want the user to be able to inspect the packet store, copy text manually, and decide exactly when context crosses from one agent to another. What I want feedback on Is the handoff packet concept clear? Is verify first-run enough to understand the tool? Is receive --latest the right receiving-side command? Which client path needs the most work? Would you trust this workflow in a real project? Repo: https://github.com/xiaoshuo1988130/acb Feedback discussion: https://github.com/xiaoshuo1988130/acb/discussions/1

I lost more than 60 days but I made a huge update All OnemanBSD OS is now 64 bits. I also removed all bloat like Rust, Wayland and Qt dependencies from all app ports used in the system. (mpv was changed to gnome-mplayer because of that). New apps included (+ fixed source code of everything): audacity (audio editor) godot (game editor) deadbeef (mp3 player) ted (word processor) Also some bug fixes. Here is the link again: http://bialamusic.com/onemanBSD/ Here are my thoughts: I feel that we as humans are loosing control over technology that was created by humans. This is rising some serious and strange questions. I think we now need tools to power the individual so we can fight back. Not corporations. Not governments. Not organizations. Consider this my bullet in this battle. It is now in your hands so you can be active developers not just passive users.

The tech industry is currently in a frenzy. Everyone is rushing to build the next big AI application, slapping a chatbot interface onto a database and calling it a day. But in this gold rush, we are leaving something critical behind: Enterprise Security. Living in a Kali Linux environment and spending time hunting vulnerabilities teaches you one fundamental truth: security is entirely about context. Hardcoded API keys, undocumented access escalations, and compliance blind spots remain the number one cause of major data breaches. Security teams don’t just need a chatbot that can answer questions; they need a single pane of glass. They need a Security Operations Center (SOC). For the Pirates of the Coral-Bean Hackathon (hosted by Coral and WeMakeDevs), I decided to tackle this massive industry problem. Over the course of 4 sleepless nights, I built CoralSec Copilot—an AI-powered, unified Enterprise SOC platform. Here is the complete Captain's Log of my entire journey, the architecture, the roadblocks, and a reproducible guide so you can build and run it yourself. Day 1: The Brainstorm, Grok, and Cursor AI When the hackathon was announced, my initial thought was basic: "I'll build a CLI agent that scans code." I fired up my IDE, opened Cursor, and started bouncing ideas around. I even looked into some AI models like Grok to understand how they process vast amounts of real-time data. But while brainstorming the architecture, I hit a wall. Scanning a GitHub commit for a leaked AWS key is great, but what if the AI also knew whether the developer who pushed that commit had recently escalated their admin privileges? What if it knew the exact SOC2 compliance policy from our company’s Notion workspace? To do this traditionally, I would have to write dozens of messy REST API integrations. I'd have to handle rate limits, write custom Python scripts for GitHub, another set for Slack, another for Notion, and then build fragile ETL (Extract, Transform, Load) pipelines to bring all

Here's something nobody talks about. .gitignore doesn't encrypt your secrets. It just hides them from git. They're still sitting on your laptop as plaintext. Every tool you install can read them. Every script that runs can read them. One accidental commit and your database password is public on GitHub forever. So I built dotlock — an encrypted .env vault with a terminal UI, written in Go. Before and after Before dotlock DATABASE_URL = postgres://localhost/myapp # plaintext, readable by anything STRIPE_KEY = sk_live_abc123 # one grep away from anyone After dotlock # .dotlock file on disk — looks like this: [ encrypted binary — unreadable without your private key] How it works under 10 seconds cd my-project dotlock set DATABASE_URL # prompts for value, input is masked dotloc # opens the terminal UI Secrets are encrypted with age — X25519 key agreement and ChaCha20-Poly1305 authenticated encryption. The same primitives serious security engineers use. No master password. No cloud. No telemetry. 100% offline. What it looks like Two panels — profiles on the left, secrets on the right. Values are masked by default. Press v to reveal for 30 seconds, then it hides itself automatically. Switch between dev , staging , and prod profiles. Run a diff before deploying to catch missing variables before they break your app. The interesting technical bit The hardest part wasn't the encryption — filippo.io/age makes that straightforward. It was the TUI. BubbleTea uses the Elm architecture — Model, Update, View. Everything is a message. A keypress is a message. A timer firing is a message. Your Update function receives messages and returns a new model. The 30-second auto-hide on secret reveal works like this — no time.Sleep , no goroutines: type secretReveal struct { key string value [] byte expire time . Time // Now() + 30 seconds } On every render, check if time.Now() is past the expiry. If it is, zero the bytes and clear the display. Simple once you understand the model but it took

E-food delivery is a trillion-dollar market . And most of that trillion is not going to farmers, store owners, or the people who actually move food around. It's going to the infrastructure layer sitting between them — the platform tax, the per-order cut, the SaaS subscription that charges you to exist inside someone else's garden. The walled garden isn't accidental. It's the product. What if food delivery was a protocol, not a platform? Not an app. Not a marketplace. A protocol — like HTTP, like SMTP — that any node can speak, that no single company owns, and that costs near zero to run. That's what DIFP is. The Djowda Interconnected Food Protocol. An open wire format for connecting food ecosystem participants — farms, stores, restaurants, wholesalers, delivery nodes, end users — directly to each other, without a platform in the middle extracting rent at every step. The spec covers: Presence & discovery — participants announce themselves to their spatial cell, others find them by location Orders, asks, and donations — not just commerce, but demand signals and surplus distribution in the same protocol Spatial routing — the MinMax99 grid maps the entire planet into ~500m cells; every message knows where it's going Decentralized registry — nodes find each other through a federated lobby system, no central server required Version 0.4 of the spec dropped a few weeks ago. Today we're publishing the first working implementation. The gRPC preview — what we built DIFP-gRPC is a skull implementation of the full protocol stack over gRPC. Thin, end-to-end, every domain wired — nothing production-hardened yet, everything clearly marked for what it is. What's inside difp.proto — the entire DIFP v0.4 spec as a single protobuf file. Two services, 30+ message types, the full DifpEnvelope wrapper with a oneof payload that covers every domain: message DifpEnvelope { string id = 1 ; string type = 2 ; // "trade.ask" | "presence.announce" | "node.ping" | … string version = 3 ; MessageSen