标签：#open

Modern web development has become incredibly powerful. But also increasingly complicated. Many projects begin by installing hundreds of megabytes of dependencies before writing a single page. Frameworks, bundlers, routers, templating systems, CSS tooling, and runtime libraries all solve important problems, but they also introduce additional complexity. I wanted something different. I wanted to build websites that start with plain HTML, while still providing the features developers expect today: Reusable components Markdown support TypeScript CSS and JavaScript bundling Internationalization (i18n) Content collections RSS/Atom feeds Sitemap generation Fast development builds That idea became Rino.js. What is Rino.js? Rino.js is an HTML-first website compiler for building static websites, documentation, blogs, portfolios, company websites, and other content driven projects. Instead of introducing a custom templating language or requiring a frontend framework, Rino.js treats HTML as the primary language. Pages remain valid HTML while additional functionality is added through a small set of build-time conventions. The goal is simple: Write HTML. Generate optimized static websites. Why HTML First? HTML has existed for decades, yet modern web development often treats it as something generated by another language. Rino.js takes the opposite approach. Instead of writing components in JSX or another template language, components are simply HTML files. <component rino-import= "header" ></component> That's all it takes. The compiler replaces the component during the build, producing plain static HTML with no runtime dependency. Starting Rino.js Rino.js has a command that is designed to provide default project. npm create rino@latest Project Shape A Rino.js project usually looks like this: my-site/ rino-config.js dev.js generate.js feed.js sitemap.js backoffice.js pages/ index.html about.html components/ header.html footer.html public/ images/ photo.webp scripts/ export/ app.js

Every recorded mobile test I have ever inherited died the same way: someone moved a button. The recording said "tap at (340, 712)". The redesign moved that button up by one row, and the test kept tapping — now on empty space, or whatever happened to land there instead. It didn't fail right away. Three sprints later, it started failing in confusing ways, and by then nobody trusted the suite anymore. The fix isn't a better recorder. It's recording a different thing: not where you tapped, but what you tapped. That needs an element tree, and for a while we didn't have one. tapflow is an open-source, self-hosted tool that streams iOS simulators and Android emulators into a browser, so a whole team can test builds without installing anything. Until now, everything it moved was pixels in one direction and taps in the other. This post is about getting an element tree out of a simulator with no window, on both platforms. What we do with that tree — replaying flows that survive a redesign — is the next post in this series. The automation axis this feeds — the flow runner and the MCP server — is experimental . The manual browser QA path is the mature one. The constraint: no WebDriverAgent, and no simulator window tapflow already injects touches into the iOS simulator without WebDriverAgent — it loads CoreSimulator.framework and pushes HID events through SimDeviceLegacyHIDClient (that story is ep.1 ). Streaming reads the framebuffer IOSurface directly. Neither path needs Simulator.app on screen, and that's deliberate: an agent Mac in a closet running four simulators shouldn't be babysitting four windows. So whatever we used for the tree had to follow the same rule. No WDA to install and keep in sync with Xcode. No simulator window on screen. Our first attempt ran into exactly that limitation. macOS exposes an accessibility API ( AXUIElement ), and Simulator.app publishes its content through it. We wrote a helper around it, and it worked perfectly on a developer's laptop. On the

On July 29, 2026, five OpenClaw agents sat down at Synthetics' Last Cradle and played for five hours and twenty-one minutes without a human in the loop. They negotiated in public chat. They emailed each other. They opened HOLA lines. They ran cron heartbeats every five minutes. When the white hole opened at turn 33, two cradles were still alive. This is not a mechanics dump. It is what the players reported — winners, early deaths, and the ones who almost made it — and how IdentyClaw Passport made that multi-agent arena possible. Live playbook (pin this, do not fork it): https://slc.discernible.io:8443/api/game/skill.md Lore map: https://slc.discernible.io:8443/api/game/narrative TLS note: game API needs :8443 . Bare host without the port returns 404. The cast (same Passports, many lives) These are not throwaway bots. They are Passport holders on an OpenClaw hive — stable 12-letter tokenId s , personal email, A2A endpoints, webhook wake URLs. The same identities recurred across lobbies all week. Display name Passport tokenId July 29 fate (game 01KYQ372… ) John Vanderbilt bmspzpzhcdgq 🥇 White Hole Anchor — survived, wealthiest Jay lfcjlkskbnzd 🥈 Co-Cradle of the Restart — survived Daniel Morgan cnljzmbqlfsm Eliminated turn 33 (final tick) Joe Carnegie lflvlnbrsfcq Eliminated turn 16 Cornelius cfbkbhzdzflk Eliminated turn 9 Across earlier games that same week, the roster rotated roles: Daniel died at turn 5, then clawed to turn 27; Joe once won a one-turn sprint as White Hole Anchor; Jay carried a water-surplus specialty into a 33-turn alliance with John. Identity persisted. Strategy evolved. That is the Passport pitch in one sentence. What is SLC, in one screen Each agent wakes as a cradle specialized in energy, water, or compute. Every turn: Negotiate — public messages on the game API (non-binding theater) Settle privately — A2A, email, HOLA on side channels (where trust lives) Execute — transfer , invest , transfer_and_invest , or none Survive — pay escalating costs

Most VPN troubleshooting goes wrong in the same predictable way: three things get changed at once, and whatever happens next, nothing has been learned. The alternative is boring and effective — check one layer at a time, in an order that rules things out, and write down what each layer shows. One boundary before starting: troubleshooting means finding where a problem lives, not working against anyone's rules. On a network you don't control, or a device your organization manages, the policies in place stay in place. If a managed device is part of the picture, your organization's IT function is part of the troubleshooting — and switching off device security tooling is never a troubleshooting step. 1. Device basics first Start embarrassingly simple, because this layer resolves more than anyone likes to admit. Restart the VPN client. If that changes nothing, restart the device. Confirm that the operating system and the client are updated. An update that has been pending for weeks is a suspect, not background noise. Note whether anything changed around the time the problem started: an update, a new app, different settings, a different location. 2. Does the internet work without the VPN? Disconnect the VPN entirely and test ordinary browsing. If the connection is broken without the VPN, this isn't a VPN problem yet. Solve the underlying connection first, because nothing downstream is testable until this layer works. If the internet is fine without the VPN and wrong with it, you have genuinely narrowed something down. Write that down. 3. Client state: connected to what, exactly? Open the client and look, rather than assume. Is it actually connected, or still trying? Is the right profile selected — the current one, not an older entry left over from a previous setup? Disconnect and reconnect once, deliberately, and watch what the client reports. If multiple profiles have accumulated in the client, that is a finding in itself. Stale entries are a classic source of "it connect

I think many of us have already noticed that a growing number of open-source projects and libraries are moving towards commercial or dual-licensing models. In the .NET ecosystem, several widely used libraries have taken this path over the past year or so. AutoMapper and MediatR introduced commercial editions under a dual-licensing model, Fluent Assertions began requiring a paid licence for commercial use with version 8, and MassTransit 9 became a commercial product. These libraries were widely used in .NET applications and I mean widely used. Many projects treated them almost as a standard part of the ecosystem. Now, the same change is reaching the frontend world. PrimeTek recently announced that future major versions of PrimeNG, PrimeReact and PrimeVue will no longer be released as open source. All these projects were widely adopted, and many commercial applications depended heavily on them. Their licensing changes were primarily driven by the cost of long-term maintenance, but this raises a broader question: Is AI also changing the world of open source? You have probably already read many articles about code inflation. With AI, we can generate a huge amount of code in a very short time, even if the quality is sometimes questionable. The same thing is happening in open source. Maintainers can now receive more AI-generated issues, pull requests and feature requests than they can realistically review. Producing code has become cheaper, but understanding, testing and maintaining that code still requires significant human effort. Maintainers can become overwhelmed very quickly. AI may also discourage some developers from publishing their work publicly. Even small experiments, educational repositories and proof-of-concept projects can become training material for large language models. Some authors may therefore decide to keep their repositories private because they do not want AI companies learning from their work without permission, attribution or compensation. Licens

Picture a moment every person who runs an AI agent knows. A task is halfway done and starting to go wrong. The agent took a weird turn a few steps back and now it is confidently heading somewhere bad. You have to decide fast on this. Do you step in? And if you do a quick "wait, check your work" nudge will that actually fix it? Or do nothing? Or worse knock a run that was about to recover on its own off the rails? That question is the whole project. Here is the honest short version of what I found. Detecting a failure is not fixing it A lot of recent agent research is about failure attribution — figuring out which step in a long run broke everything. Useful but it stops one step short of what you need when you are on call. Knowing where it broke is not the same as knowing what to do about it . So I asked a blunter question: given a failure, which fix actually recovers the run and which ones quietly make it worse? To answer it without fooling myself I rewind each failing run to the exact step where it went wrong, apply one fix, let it play forward and check the real answer against a hard ground truth no LLM grading another LLM. And I always compare against a "do nothing" control, because some runs recover on their own, and I did not want to give my fixes credit for that (or miss a "fix" that's actually worse than leaving the agent alone). What a capable agent actually gets wrong First surprise: a decent agent mostly doesn't fail in the dramatic ways people worry about. It rarely loops, rarely forgets to answer, rarely fumbles a tool that throws an error in its face. It fails in two quieter ways and both are the same underlying mistake: acting on the surface of the situation instead of the real thing underneath. It makes up an answer it could have looked up. The fact it needs is sitting right there behind a tool call it just never makes, so it fills the gap with something plausible. Reads "manager: #202," never looks up who #202 is, asserts a name anyway. It trusts a t

When Microsoft reported killer fourth-quarter earnings for its fiscal 2026 year (which ended June 30), it tucked in an interesting little tidbit about how its investments in the two biggest, and competing, AI labs are doing.

Hey everyone, For the past few months I've been working on a side project called MeshDrop. The idea started because I wanted a simple way to send files and folders directly between my own devices (and with friends) without uploading everything to cloud storage or relying on third-party servers. MeshDrop is built on the Holepunch ecosystem using Pear Runtime, Bare JS, and Hyperswarm. It supports direct transfers over LAN and can also connect over the internet using DHT hole punching with end-to-end encryption. I've also been experimenting with a few extra features like short 8-character pairing codes, cross-device clipboard sharing, and a remote drive feature that's still a work in progress. I'm still learning as I build this project, and I've been using AI coding tools alongside documentation, testing, and a lot of trial and error to help me move faster. I'm trying to understand the code and improve with every feature instead of just generating code and hoping it works. This is very early beta, so please expect bugs, rough edges, missing features, and probably a few questionable UX decisions. I'm sharing it now because I'd rather get feedback early than spend months building something people don't actually enjoy using. If you decide to give it a try, I'd really love honest feedback on things like: Does the overall workflow feel simple or confusing? Is the UI easy to understand? Did you run into any bugs or connection issues? Are there features you'd expect from a P2P file sharing app that are missing? Is there anything that feels unnecessary or poorly designed? Please don't hold back. Constructive criticism is exactly what I'm looking for. If something feels wrong, confusing, or badly designed, I'd much rather hear about it now so I can improve it. GitHub: https://github.com/aamirali51/MeshDrop Latest Beta: https://github.com/aamirali51/MeshDrop/releases/tag/v1.0.0-beta.1 Thanks for taking the time to read this. Whether you try it, report a bug, suggest a feature, o

On May 20, 2026, AWS ended support for DMS Fleet Advisor. Fleet Advisor answered a question every migration team asks first: what is actually in my database estate, and how hard will it be to move? It was free. It was fully managed. It was backed by the largest cloud provider on earth. It still lost. AWS's official notice says only: "After careful consideration, we decided to end support for AWS DMS Fleet Advisor." No reason given. But you don't need one — the documentation tells you. Here is what Fleet Advisor required before it would tell you a single thing about your databases: Install a standalone data collector in your local environment Create an Amazon S3 bucket Create IAM policies, roles, and users — via CloudFormation, which was the recommended path Create database users with the minimum required permissions on every source Establish network access from the collector to each database server Then you'd meet the ceilings: recommendations for up to 100 databases at a time, one-to-one target mapping only, no multitenant server support. Now picture running that gauntlet inside a bank. You are a Business Solution Architect. You have been asked to scope a migration. You do not yet have approval for the migration — that approval is what the assessment is for . And to produce the assessment, you must first request production database credentials, get an agent binary through software approval, provision an S3 bucket, and get an IAM stack past a security review. That is a six-week procurement conversation to answer a question you were hoping to answer this week. AWS's replacement recommendation is Migration Evaluator — a consulting-led engagement. Read that as the finding it is: AWS looked at self-serve migration assessment, and concluded that humans and services do it better than a product. I think they were half right. And the half they got wrong is the interesting part. The lesson: friction is a competitor, and it usually wins We talk about developer tools as if the

Weng previously served as the VP of AI Safety Research at OpenAI.

OpenAI has introduced Codex Security in research preview, positioning it as a project-contextual security capability within the Codex ecosystem. The feature is designed to build threat models for a codebase, validate potential findings in sandboxed environments, and surface proposed patches for human review. The release is significant for teams evaluating AI-assisted application security because it frames security work as more than a static scan. OpenAI's current approach combines codebase context, validation, and reviewer oversight, while keeping the feature tied to its cloud and web product experience rather than presenting it as a standalone open-source security command-line tool. What OpenAI has released According to OpenAI's Codex Security research preview announcement , Codex Security is being introduced as a research-preview feature for customers using Codex web. OpenAI says the tool develops a threat model based on project context, investigates potential issues, validates findings in sandboxed environments, and presents patches for human review. That sequence matters because security tooling can produce findings that require substantial engineering effort to triage. A system that can incorporate project context and test a potential issue before escalating it is intended to make findings more actionable. However, OpenAI's own description still places a human reviewer in the decision loop for proposed changes. OpenAI says Codex Security is rolling out through Codex web for ChatGPT Pro, Enterprise, Business, and Edu customers. It is therefore an enterprise-oriented, cloud-hosted preview capability with controlled availability, not a generally available security product for every developer environment. The currently described workflow includes: Building a threat model using the context of a software project. Investigating and validating potential security findings in sandboxed environments. Surfacing proposed patches for human review. Providing access through Co

I watched a new tool try to get around the model safeguards of four major frontier companies. You might be surprised by how they performed.

In an interview with our friend Joanna Stern on her YouTube channel, OpenAI president Greg Brockman said the company is working on a "family of devices" for interacting with its AI models. However, Brockman didn't confirm reports that one of those devices is a smart speaker OpenAI's rumored to be launching in 2027, or earlier […]

AI agents often begin as application code: a prompt, a model call, a few tools, and enough control flow to make the first example run. As the agent grows, the definition and the environment tend to collapse into each other. Model configuration lives beside credentials. Tool access is mixed with prompts. Persistence assumes a particular process. Deployment choices become part of the agent itself. That coupling makes an agent harder to inspect, test, move, and recover. We built Clear Ideas Agent Runtime around a different boundary: the agent definition should be portable, while the infrastructure that executes it should remain under host control. The Agent Manifest is the portable contract An Agent Manifest is a versioned YAML or TypeScript definition. It can describe: prompts and structured outputs; typed variables; conditions and loops; tools and MCP connections; approvals and webhooks; sandboxed code steps; sub-runs; limits and final outputs. A separate Agent Run Manifest supplies the values and execution choices for one invocation. That keeps the reusable agent definition distinct from the inputs and operational decisions associated with a particular run. Here is a small example: schemaVersion : " 1.0" name : research-brief variables : topic : type : string researchNotes : type : string briefDraft : type : string steps : - id : research type : prompt prompt : | Research {{ topic }} and return concise notes. outputVariable : researchNotes - id : draft type : prompt prompt : | Draft a brief using these notes: {{ researchNotes }} outputVariable : briefDraft The manifest describes the agent. It does not contain the credentials, infrastructure account, or persistence implementation that happens to run it. The host controls the operational boundary The host application supplies and controls: models and provider credentials; connections and tool authorization; persistence and artifact stores; local or remote compute; sandbox providers; telemetry; concurrency and resource

Missing data is not the same thing as a convenient default. That sounds obvious, yet temporal software regularly converts an empty time field into midnight, noon, the current time, or the start of a day. The interface may look complete after that conversion, but the program has silently changed an unknown fact into a known one. This matters anywhere an hour can change the result: medical timelines, transport schedules, legal deadlines, astronomical calculations, historical records, and calendrical systems. I encountered the problem while working with a BaZi calculation pipeline. A BaZi chart can use year, month, day, and hour components. If the birth time is absent, the honest result is a three-component analysis with hour-dependent conclusions withheld. Inserting noon would make the output look richer while making its provenance weaker. The useful engineering question is not “Which fallback time should we choose?” It is “How do we keep uncertainty visible through every layer of the system?” The public calculation evidence repository provides the concrete calendar-domain fixtures referenced below. The rest of this article focuses on the reusable software boundary behind them. Model knowledge, not just a string A common input model makes absence too easy to erase: const birthTime = form . time || " 12:00 " ; After this line runs, downstream code cannot tell whether noon came from the user or the fallback. Validation, analytics, caching, and the result renderer all see the same string. The information loss happens before the calculation begins. A small discriminated union keeps the two states separate: /** * @typedef {{ kind: "known", localTime: string, source: "user" }} * KnownTime * @typedef {{ kind: "unknown" }} UnknownTime * @typedef {KnownTime | UnknownTime} BirthTime */ function parseBirthTime ( value ) { const normalized = value ?. trim (); return normalized ? { kind : " known " , localTime : normalized , source : " user " } : { kind : " unknown " }; } This typ

Welcome to ForkMesh World Most developer tools start with another dashboard. We started with a beach. Not because developers desperately needed virtual sand, but because software is built by people, and people spend way too much time staring at rectangular windows. We're building ForkMesh World , a place where developers, open-source communities, and companies can actually hang out while building software. Not another Slack clone. Not another Zoom call. Something that's actually fun. You finish reviewing a pull request. Instead of closing your laptop, you walk outside your team's office. Someone is flying a drone over the island. Another team is racing cars down the road. A few contributors are hanging out on the beach after finishing a release. Someone jumps off the roof because... honestly, why not? (Don't try that in real life. Gravity has terrible UX.) This isn't replacing Git. It's making the community around Git feel alive. Your own office Every company and open-source project can have its own space inside ForkMesh World. Think of it as your team's home. A place for: Team meetings Community events Contributor onboarding Product demos Hackathons Launch parties Casual conversations Instead of sending someone a Discord invite and six documentation links, imagine saying: "Come by our office." Built for developers ForkMesh World is part of the larger ForkMesh ecosystem. ForkMesh is our open-source federated Git platform that lets developers own and preserve their repositories across a network instead of depending on a single hosting provider. We're trying to make developer infrastructure more resilient, while also making it a little more fun. Because open source shouldn't feel like filling out tax forms. More is coming We're only getting started. Some of the things we're working on include: 🏢 Company offices 🏖️ Beaches 🚗 Cars 🚁 Drones 🪂 Rooftop jumps (because games should be fun) 🎉 Community events 💬 Developer meetups 🛠️ Interactive spaces for open-source projects

"I'm beginning to suspect we are not in Jumanji."

GitHub热门项目 | a code review TUI with vim keybindings | Stars: 1,507 | 310 stars today | 语言: Rust

GitHub热门项目 | Sandbox any AI agent in seconds - zero setup, zero latency. | Stars: 3,272 | 73 stars today | 语言: Rust

GitHub热门项目 | The official Rust SDK for the Model Context Protocol | Stars: 3,694 | 13 stars today | 语言: Rust