标签：#tools

Multiple Tailscale tailnets at once, no switching + no VM Discussion | Link

...now, I pride myself on being good at my job, I'm fast at catching mistakes, I'm efficient at...

Автор: Владислав Штер, соло-фаундер экосистемы SovereignПоследнее обновление: Июль 2026 года Поиск критических уязвимостей через нейросетевой консилиум Egregor. Десктопное приложение Egregor находит критические уязвимости в смарт-контрактах с помощью одновременной работы нескольких ИИ-моделей. Этот инструмент создан для Web3-разработчиков, которым необходимо проверять сложный код без риска пропустить ошибки, свойственные одиночным нейросетям. В ходе тестирования консилиум Egregor обнаружил 4 критические проблемы (включая уязвимость Reentrancy и вечные права деплоера) в смарт-контрактах SovereignBank Web3, тогда как 13 ручных проверок одиночными топовыми ИИ (Claude, Gemini, ChatGPT, DeepSeek, Grok) назвали код полностью чистым. Используйте платформу Egregor для проведения глубокого аудита кода, чтобы получать верифицированные решения вместо догадок одной модели. Защита от эхо-камеры и слепых зон алгоритмов в программе Egregor Система Egregor устраняет эффект эхо-камеры и систематические слепые зоны нейросетей за счет встроенных механизмов Anti-Groupthink и "Адвоката дьявола". При анализе сложной логики одиночные нейросети часто вежливо соглашаются друг с другом, но алгоритмы Egregor запрещают моделям принимать чужие выводы без подтвержденных в коде фактов. Во время аудита смарт-контракта механизм перекрестной проверки в Egregor отсеял неподтвержденные гипотезы и позволил 5 моделям в разных ролях перекрыть слепые зоны друг друга. Запускайте локальный консилиум Egregor, чтобы система сама отделяла реальные баги от шума и выдавала финальный вердикт Модератора с оценкой уверенности от 1 до 5. Стоимость многоуровневого анализа кода на платформе Egregor Программа Egregor кардинально снижает финансовые затраты на профессиональный аудит кода до нескольких центов. Данное решение идеально подходит для инди-разработчиков и участников хакатонов, у которых нет бюджетов в тысячи долларов на заказ проверок у специализированных аудиторских компаний. Полноценный комплексный прогон мо

You set up Puppeteer, navigate to a page, call page.screenshot() , and the bottom half of your image is blank placeholder boxes. Welcome to lazy loading. Most modern sites defer images and heavy content until the user scrolls. Your headless browser never scrolls. So those elements never load. Here's how to deal with it. The scroll trick The most common fix is to programmatically scroll down the page before taking the screenshot: async function scrollToBottom ( page ) { await page . evaluate ( async () => { const delay = ms => new Promise ( r => setTimeout ( r , ms )); const distance = 300 ; while ( window . scrollY + window . innerHeight < document . body . scrollHeight ) { window . scrollBy ( 0 , distance ); await delay ( 150 ); } window . scrollTo ( 0 , 0 ); }); } await page . goto ( " https://example.com " , { waitUntil : " networkidle2 " }); await scrollToBottom ( page ); await page . waitForTimeout ( 1000 ); await page . screenshot ({ fullPage : true }); The 150ms delay between scrolls gives IntersectionObserver -based lazy loaders time to trigger. Too fast and you'll scroll past elements before they start loading. That final waitForTimeout after scrolling back to top lets any remaining images finish rendering. Not elegant, but necessary. Why networkidle2 isn't enough You'd think waitUntil: "networkidle2" would handle this. It waits until there are no more than 2 network connections for 500ms. But lazy-loaded images haven't even been requested yet at that point — they're waiting for a scroll event that never happens. networkidle2 only helps with content that loads on page init. For scroll-triggered content, you need the scroll. The loading="eager" override Some sites use the native loading="lazy" attribute. You can override it before images load: await page . evaluateOnNewDocument (() => { Object . defineProperty ( HTMLImageElement . prototype , " loading " , { set : function ( val ) { this . setAttribute ( " loading " , " eager " ); }, get : function () { retu

Getting an AI API request to return a response is only the beginning. For real AI products, the harder question is what happens when something goes wrong. A chatbot may become slower. A RAG answer may stop using the right context. A structured extraction workflow may start returning invalid JSON. An agent may trigger the wrong tool. A fallback model may answer correctly, but at a much higher cost. In a single-model prototype, debugging is usually simple. You check one provider, one API key, one model, and one request format. In a multi-model application, debugging becomes an infrastructure problem. A product may use GPT for one workflow, Claude for another, Gemini for multimodal tasks, DeepSeek for cost-sensitive reasoning, Qwen or Kimi for Chinese-language workflows, GLM for enterprise scenarios, and MiniMax or Doubao for other product features. When something fails, developers need to know more than whether the API returned an error. They need to know which workflow failed, which model handled it, whether fallback happened, whether latency changed, and whether the final output was still good enough for production. Why multi-model debugging is different AI API failures are not always clean outages. Sometimes the request fails completely. But many production issues are softer: latency increases structured output fails validation tool calls become unstable fallback routes trigger too often answers become less grounded costs increase silently one language performs worse than another a model works for chat but fails for agent workflows That is why teams should not treat AI debugging as simple error handling. They need visibility across the full request path. Start with a failure taxonomy The first step is to classify failures in a way developers can act on. A useful AI API failure taxonomy may include: authentication errors rate limits quota limits timeout errors model unavailable errors high latency responses invalid JSON output schema validation failures tool call fa

Image-to-video generation is often described as a simple interaction: upload image -> describe motion -> get video That description hides the real problem. A single still contains only one view of a subject. When we ask a model for a fast camera orbit, a full-body walk, or expressive gestures, we are asking it to invent information that was never present in the source. That is where identity drift, unstable lighting, texture flicker, and waxy faces come from. The useful way to approach Seedance 2.0 image-to-video is not as a prompt-writing contest. It is a constraint-management workflow. Give the model a strong identity anchor, request motion that the source image can support, and evaluate one variable at a time. This post explains that workflow in a way that is useful whether you are animating a product render, a character portrait, an approved client still, or a visual asset for a prototype. Note: Model capabilities, pricing, model availability, and input limits change quickly. Check the current documentation and the terms of the platform you use before committing a production workflow. Why image-to-video is different from text-to-video Text-to-video is excellent when invention is the point. You describe a scene and let the model make creative decisions about characters, lighting, composition, and motion. Image-to-video is the better tool when those decisions have already been made and must remain stable. Situation Better starting mode Why Product hero shot Image-to-video Label, shape, material, and color must remain recognizable Character-led sequence Image-to-video One strong reference can anchor a character across clips Approved campaign still Image-to-video The source already represents the accepted art direction Atmospheric B-roll Text-to-video Exact subject identity matters less than visual exploration Abstract concept film Text-to-video Inventing a scene is more valuable than preserving one Existing brand-photo library Image-to-video Stills become reusable

If you've ever bid on a public sector contract, you know the PQQ drill. Someone sends you a Word document with 47 questions spread across 6 sections. Company info. Technical capability. Financial standing. Health & safety. References. Maybe something about modern slavery or carbon reporting because it's 2026 and everything has to check everything. You have to: Read every question Figure out what category it falls under Decide which ones are easy and which will take a week Dig up the right evidence for each one Track word limits And you're doing this at 10pm because the submission deadline is Friday. I got tired of doing this manually, so I built a free tool that does it in one click. What it does PQQCheck takes any PQQ document — pasted raw, formatting and all — and runs it through an LLM that understands procurement documents. It returns: Every question extracted — no more re-reading the document to check you didn't miss one Category tags — Technical, Financial, H&S, Insurance, etc. Difficulty ratings — Easy / Medium / Hard at a glance so you know where to start Suggested evidence — what to prepare for each question Word limits — pulled straight from the document Here's what the output looks like: | Question | Category | Difficulty | Suggested Evidence | Limit | |-----------------------------------|-------------|------------|----------------------------|-------| | Provide your registered name & no | Company | Easy | Certificate of Incorporation | 50 | | Describe IT managed services exp | Technical | Hard | 3 case studies + CVs | 500 | | Provide H&S policy | H&S | Easy | Current policy document | — | | ISO 27001 certification details | Technical | Medium | Certificate + scope doc | 200 | Why this matters for procurement teams Most PQQ response planning is reactive. You read the document, start answering, and discover mid-way that a question needs a certificate you don't have or a reference you can't get in time. PQQCheck flips that. You know before you start writing

Tinder for developers! Find coding partners & build together Discussion | Link

Mac app with dynamic AI EQ Discussion | Link

Most "AI email" demos never think about deletion. The agent reads, replies, files things away, and the inbox just grows. That's fine in a demo. It is a problem the first time a real person emails your agent, because the moment that mailbox holds someone else's name, address, order history, or support complaint, you've taken on a data-protection obligation — and "we kept everything forever" is not a defensible retention policy. An Agent Account on Nylas accumulates personal data you have to be able to purge. It's a mailbox the agent owns — support@yourcompany.com answering to a model instead of a human — and every inbound message lands in it. Under GDPR that data needs two things you can prove: a retention window so it doesn't live forever, and an erasure path so you can delete a specific person's mail when they ask. This post builds both, with the curl and the CLI for each step. A quick, honest caveat before any of it: this is a docs-and-demo walkthrough, not legal advice. The Nylas primitives below cover the mail held in the mailbox . Any derived copy you made — rows in your own database, lines in your application logs, a vector store you embedded the message into — is yours to purge separately. The API can delete the message; it can't reach into your Postgres. Keep that in mind throughout. What the platform gives you Nothing new to learn on the data plane. An Agent Account is just a grant with a grant_id , so everything you already know about Messages and Threads applies directly — listing, reading, and deleting mail run against the same grant-scoped endpoints any other Nylas integration uses. Retention and erasure split cleanly into two layers: Retention is a control-plane setting. It lives on a policy — an application-scoped resource that bundles limits and spam settings — attached to the workspace your Agent Account belongs to. Two fields cap how long mail survives: limit_inbox_retention_period and limit_spam_retention_period . Set them once and Nylas deletes a

Spam traps are the failure mode nobody puts in the demo. A bounce is loud — you get a 5.x.x back, your code logs it, you move on. A complaint at least gives you a webhook. A spam trap gives you nothing . The message gets accepted, no error comes back, and somewhere a mailbox provider quietly writes your domain down as a spammer. By the time you notice, your inbox placement has already cratered and you have no single bounce to point at. That's the trap, literally. And it's the one that bites autonomous agents the hardest, because the whole appeal of an agent is that it acts without a human watching every send. Point a model at a list it scraped, let it loop, and it'll happily mail a recycled address that's been a trap for two years. The agent never sees a problem. You only see the aftermath in your deliverability dashboard a week later. I work on the Nylas CLI, so the terminal commands below are the exact ones I reach for when I'm wiring up an Agent Account to not do this. The good news is that an Agent Account is just a grant — a grant_id that works with every grant-scoped endpoint you already know — so there's nothing new to learn on the data plane. The defense is mostly discipline: validate before you send, honor every complaint, and age out the addresses that never wanted to hear from you. What a spam trap actually is, and why it's not a bounce It's worth being precise here, because the three things people lump together behave completely differently. A bounce is a rejected delivery. The receiving server tells you the address is bad, you get a message.bounced event, and you stop. Bounce handling is a solved problem — you listen, you suppress, you're done. A complaint is a recipient hitting "report spam." The mailbox provider relays that back as a feedback loop, and you get a message.complaint event. The address is real and reachable; the human just doesn't want your mail. If you keep mailing them, you're training the provider to filter you. A spam trap is neither.

The best developer tools share one quality: you forget you are using them. Think about it. Your IDE fades into the background when you are in flow. Your terminal becomes muscle memory. These tools are invisible because they match your mental model so perfectly that there is zero friction between thought and action. This is exactly what online developer utilities should aspire to. The Problem with Fragmented DevTools Most developers have a bookmarks folder full of single-purpose websites: One for JSON formatting One for timestamp conversion One for Base64 encoding One for URL decoding Every switch between these tabs is a context loss. Every tool has a slightly different UI, different copy-paste format, different quirks. The Invisible Toolkit Opennomos Json (opennomos.com/en/project/01KJ850Z7PNGXHXESBM68HE12Y) consolidates timestamp conversion, JSON formatting, and Base64 encoding into a single workspace. No install. No accounts. No pricing tiers. Just open a tab and work. This is the north star for developer tools: make them so simple that the user never has to think about the tool itself — they only think about their actual task. The Trend Is Clear We have seen this pattern across the dev ecosystem: GitHub Codespaces made local IDE setup invisible Vercel made deployment invisible Replit made runtime environment invisible The next frontier is utility tools. The sooner they become invisible, the better. Try it: opennomos.com/en/project/01KJ850Z7PNGXHXESBM68HE12Y Part of the Nomos Build-in-Public series.

Turn your SaaS into a clickable demo in 90 seconds. Discussion | Link

Approve AI requests from your lock screen Discussion | Link

Give your AI agents design taste from existing websites Discussion | Link

Private macOS notes built on plain Markdown files Discussion | Link

You've seen the alert. You've opened the PR. You've read the changelog. Then you realize: your code doesn't even call the vulnerable function. Every week. Hundreds of teams drowning in CVE notifications for packages sitting dormant in their node_modules — dependencies they pulled in years ago, bundled by a transitive library, and never actually executed. Meanwhile, the real vulnerabilities get buried. VigilOps is a free Node.js CLI that fixes this. How VigilOps Works VigilOps does three things: Scans dependencies against OSV.dev — the open vulnerability database used by GitHub, PyPI, and npm Runs static reachability analysis to filter out unreachable vulnerabilities (packages in your tree but never called by your code) Auto-opens a GitHub PR with the fix The result: you get one PR with one real vulnerability. Not a spreadsheet. Not a wall of Slack messages. A fix. Demo Here's a quick scan: npx vigilops scan examples/vigilops-demo-lodash And to see everything including suppressed (unreachable) deps: npx vigilops scan examples/vigilops-demo-express --all The --all flag shows what's in your dependency tree but not actually reachable from your code. That's what the noise looks like — and that's what VigilOps filters out. Why This Is Different Dependabot and Snyk scan your entire lockfile. They report every CVE in every package, regardless of whether your code ever touches the vulnerable surface. This creates alert fatigue that causes teams to eventually... stop reading. VigilOps inverts the model: only surface vulnerabilities in code you actually call. Dependabot: "Your project has 47 vulnerabilities" (but 40 are unreachable noise) VigilOps: "Your project has 1 reachable vulnerability. PR is ready." Quick Start npm install -g vigilops npx vigilops scan . Authenticate with GitHub: https://github.com/Vigilops/vigilops npx vigilops auth That's it. The first run will scan, analyze, and open a PR if there's a fixable reachable vulnerability. What's Included OSV.dev integrati

Writing changelogs is one of those developer tasks that sounds simple until you are staring at a messy commit history. Some commits matter to users. Some are internal cleanup. Some are merge commits. Some are meaningful only if you already know the codebase. I built a small Python example that turns commit messages or git diffs into structured changelog JSON using Telnyx AI Inference. Code: https://github.com/team-telnyx/telnyx-code-examples/tree/main/changelog-generator-python What it does The Flask app exposes: POST /generate POST /generate/from-diff GET /changelogs GET /changelogs/<id> GET /health POST /generate accepts a list of commit messages: { "version" : "v1.4.0" , "repo_name" : "billing-service" , "commits" : [ "feat: add Stripe webhook retry with exponential backoff" , "fix: correct tax calculation for EU VAT exemption" , "docs: update API reference for invoice endpoint" ] } The app asks Telnyx AI Inference to return grouped changelog JSON with sections like: Features Bug Fixes Improvements Breaking Changes Documentation Other There is also a POST /generate/from-diff endpoint if you want to summarize a git diff instead of commit messages. Why structured output matters For a changelog tool, plain text is useful, but structured output is more flexible. If the response comes back as JSON, you can: render it in a docs site save it in a release database post it into a PR comment send it to Slack open a release-note review workflow let a human approve it before publishing The example stores generated changelogs in memory and gives each one an ID, so you can list recent changelogs or retrieve a specific one. Run it Clone the examples repo: git clone https://github.com/team-telnyx/telnyx-code-examples.git cd telnyx-code-examples/changelog-generator-python Create your .env file: cp .env.example .env Add your Telnyx API key: TELNYX_API_KEY=your_telnyx_api_key AI_MODEL=moonshotai/Kimi-K2.6 HOST=127.0.0.1 Install and run: pip install -r requirements.txt python app.py

The dirty secret of online dev tools Every dev tool lives on a different website. jwt.io for JWT decoding. regex101 for regex testing. Some random site for JSON formatting. Another for diff checking. Another for curl → code. Another for SQL formatting. You end up with 10 bookmarks, 10 different UIs, and 10 different servers that just received your most sensitive data — and you never think twice about it. I didn't either. Until I did. What actually happens when you use these tools Let's take jwt.io as an example. Your JWT contains: Your auth algorithm Your user ID Your roles and permissions Your token expiry Sometimes your email, name, org ID When you paste it into jwt.io — it hits their server. It's in their request logs. Maybe forever. The same goes for regex101. Your regex patterns often encode business logic — validation rules, data formats, internal naming conventions. That goes to their database. And every online JSON formatter, diff checker, SQL tool, .env checker you've ever used? Same story. You're not just sharing data. You're sharing the shape of your system. Most of the time nothing bad happens. But "most of the time" is a terrible security posture for a developer who knows better. I got tired of it The more I thought about it, the more it bothered me. I was pasting production JWTs. Real API keys. Actual .env files with database URLs. Into random websites I knew nothing about. So I built DevTab - devtab.in One tab. 110+ dev tools. Zero server calls. Everything runs 100% in your browser via client-side JavaScript and WebAssembly. Open DevTools → Network while using it. Nothing fires. That's not a marketing claim. It's verifiable in 10 seconds. What's inside JSON tools JSON formatter & validator — real-time, error highlighting with line numbers JSON minifier JSON stringify & parse JSON → TypeScript / Pydantic / Go / Zod types Auth & security JWT decoder — header, payload, expiry countdown, issued-at in human time. Zero network requests. .env diff checker —

Runtime authorization for Claude, Cursor, Codex and OpenClaw Discussion | Link