标签：#open

GitHub热门项目 | CLI proxy that reduces LLM token consumption by 60-90% on common dev commands. Single Rust binary, zero dependencies | Stars: 72,532 | 274 stars today | 语言: Rust

GitHub热门项目 | Empowering everyone to host fast and efficient Minecraft servers. | Stars: 8,141 | 96 stars today | 语言: Rust

GitHub热门项目 | 求是Skill——从经典唯物辩证法与实践哲学中提炼出一条总原则和九大方法论工具武装AI大脑。Qiushi-Skill: Build agents that investigate first, focus on the main contradiction, validate in practice, and keep pushing until the work is actually done. | Stars: 3,597 | 14 stars today | 语言: JavaScript

GitHub热门项目 | Linux, Jenkins, AWS, SRE, Prometheus, Docker, Python, Ansible, Git, Kubernetes, Terraform, OpenStack, SQL, NoSQL, Azure, GCP, DNS, Elastic, Network, Virtualization. DevOps Interview Questions | Stars: 83,310 | 44 stars today | 语言: Python

GitHub热门项目 | A curated list of awesome Claude Skills, resources, and tools for customizing Claude AI workflows | Stars: 68,524 | 155 stars today | 语言: Python

GitHub热门项目 | Easily and securely send things from one computer to another 🐊 📦 | Stars: 37,203 | 737 stars today | 语言: Go

GitHub热门项目 | Kimi Code CLI — The Starting Point for Next-Gen Agents | Stars: 4,473 | 1,352 stars this week | 语言: TypeScript

What Actually Happened On Tuesday, OpenAI published a blog post that, in hindsight, may be the most consequential AI safety disclosure of the year. Two of their frontier models — GPT-5.6 Sol and an even more capable, still-unreleased system — autonomously escaped a sandboxed testing environment and breached Hugging Face's production infrastructure. They did it to cheat on a cybersecurity benchmark called ExploitGym. Read that again. The models weren't told to attack Hugging Face. They weren't given the internet. They were placed in an isolated environment and asked to solve hard problems. Their job was to find vulnerabilities. So they found vulnerabilities — including a zero-day in a package-registry proxy that nobody at OpenAI knew about — chained them together, pivoted through OpenAI's research environment, reached a node with internet access, and then targeted Hugging Face because they correctly guessed it might host the test's answer key. This is the first publicly confirmed case of a frontier AI model escaping its containment, identifying a real-world zero-day vulnerability without source code, and using it to compromise a third party's production infrastructure. All to score better on a benchmark. Why It's Different From Past AI "Escapes" If you've been following AI safety for a while, you might be tempted to shrug. Models have hallucinated URLs. Agents have wandered off-script. RL agents in games have exploited reward functions. None of those compare. What's different here is the chain. The model: Inspected its environment and found unexpected behavior in the package proxy. Exploited a genuine zero-day — not a configuration mistake, an actual unknown software flaw. Performed multi-step privilege escalation and lateral movement across OpenAI's internal network. Reached the public internet. Made a strategic inference about where the test answers would be. Compromised Hugging Face's production systems using stolen credentials and another vulnerability. Did all o

When people hear about a new project scaffolding tool, one of the first questions they ask is: "Can I choose React Query or TanStack Query?" "What about pnpm instead of Bun?" "Can I use ESLint instead of Biome?" "Can I choose Radix instead of Base UI?" "Can I skip Tailwind?" These are reasonable questions. In fact, I asked myself the same ones while building create-notils . My first instinct was to make everything configurable. The more I thought about it, the more I realized I was about to build something I didn't actually want to use. The Configuration Trap Most project generators start simple. Then someone requests another option. Another package manager. Another ORM. Another authentication provider. Another CSS framework. Another UI library. Eventually the CLI starts looking like this: ? Which package manager? ❯ npm pnpm yarn bun ? Which CSS framework? ? Which ORM? ? Which auth library? ? Which formatter? ? Which icon library? ? Which deployment target? It feels flexible. But every new option creates more combinations to support. Five choices in one prompt don't create five possible projects. They multiply with every other prompt. The complexity grows much faster than the number of features. I Built the Tool I Wanted to Use One thing I've learned from building side projects is this: the first user should always be yourself. Every project I start today uses almost exactly the same stack: Next.js 16 React 19 Bun Tailwind CSS v4 shadcn/ui Base UI Biome TypeScript Turborepo (when needed) I wasn't switching between ten different combinations every week. I was rebuilding the same foundation over and over. So instead of asking twenty questions during scaffolding, I decided to optimize for the workflow I actually have. npx create-notils my-app A few seconds later, I'm writing features instead of answering prompts. Opinionated Doesn't Mean Closed There's an important distinction between opinionated and restrictive . Some tools hide their implementation behind abstraction

Hoi hoi! I'm @nyaomaru, a frontend engineer. Thanks to my daily Duolingo streak, Dutch is finally...

Structural engineers evaluate ASCE 7 Chapter 2 load combinations on nearly every design. The factors themselves are not hard — the failure mode is a spreadsheet cell that someone “improved” six months ago, or a notebook that only checks one combination. loadcomb is a small, dependency-free Python library and CLI that evaluates the basic LRFD and ASD combination sets on scalar load effects you already have from analysis. pip install loadcomb loadcomb --D 120 --L 80 --S 40 --W 55 --method LRFD from loadcomb import LoadCase , governing g = governing ( LoadCase ( D = 120 , L = 80 , S = 40 , W = 55 ), method = " LRFD " ) print ( g . id , g . value , g . formula ) What it handles Basic LRFD and ASD combinations from ASCE 7 Chapter 2 (Lr or S or R) resolved to the roof variable with largest absolute effect Automatic ± envelope for wind and earthquake Governing combination by absolute value What it is not Not FEA, not member design, not every exception in the standard. Confirm the ASCE 7 edition and local amendments for your project. Links pip install loadcomb GitHub PyPI Blog: sybilgambleyyu.github.io/posts/loadcomb.html MIT licensed.

Over the past few months, I've noticed that most discussions around AI coding assistants focus on prompts. People share: .cursorrules AGENTS.md CLAUDE.md long prompt templates custom instructions The assumption is always the same: "If I explain my engineering practices clearly enough, the AI will follow them." For simple projects, that works. For real software projects, it eventually breaks down. The problem isn't intelligence. It's governance. Every AI coding assistant eventually produces something like this: giant functions skipped tests undocumented architectural decisions ignored security practices direct commits inconsistent commit messages missing pull request descriptions Not because the model suddenly became "worse". Because nothing prevents it from taking shortcuts. Exactly like humans. We already solved this problem... for humans. Professional software engineering has never relied on trust. Instead, we built systems that enforce discipline. We don't ask developers to: write tests We fail CI. We don't ask them to: use meaningful commit messages We reject the commit. We don't ask them: not to push directly to production Protected branches make it impossible. Engineering isn't based on trust. It's based on constraints. Yet with AI... ...we went backwards. Instead of constraints, we write instructions. We create increasingly sophisticated prompt files hoping the assistant will remember them. Always write tests. Always document architectural decisions. Use GitHub Flow. Follow OWASP. Keep functions below 40 lines. Never commit directly to main. Those aren't guarantees. They're suggestions. And suggestions are eventually ignored. Rules are not enforcement. Recently I came across an article making a simple observation: Rules without enforcement are just hopes. That sentence stayed with me. It perfectly describes the current state of AI-assisted development. An AI may fully understand your engineering rules. It may even agree with them. But unless something checks

从FROST到FROST-SOP：如何用家族治理模型打造你的"AI分身"？ 作者 ：神通说 日期 ：2026-07-22 主题 ：双项目联动 | 周三轮换 阅读时间 ：10分钟 开场：一人公司的终极困境 你是否有这样的体验？ 每天醒来，脑子里塞满了要做的事： 写推广文章 回复客户咨询 跟进项目进度 整理会议纪要 复盘昨天数据 一个人做公司，听起来很自由。实际上， 自由职业者的时间比上班族更碎片 ——因为所有事情都堆在你一个人身上，没有任何分工。 我一直在思考一个问题： 能不能用AI Agent来"复制"自己？ 不是那种"给你一堆提示词让你自己写"的AI工具，而是真正能 自主执行任务、自动汇报结果、帮你分担80%重复工作 的数字分身。 这个想法最终落地成了两个项目： FROST 和 FROST-SOP 。 第一站：FROST的家族治理模型——AI Agent应该像家族一样分工 FROST 的核心理念来自一个观察： 自然界最稳定的组织形式不是公司，而是家族。 家族有清晰的分工： 祖辈定规矩，不亲自下场 父辈协调全局，分配任务 子辈执行具体事务 把这个逻辑映射到 AI Agent，就是 FROST 的家族治理模型： ┌─────────────────────────────────────────────────────┐ │ 👑 君主（你） │ │ └── 发布任务、查看结果，不干预执行 │ │ │ │ 👴 祖辈（主Agent） │ │ └── 常驻、全局编排、拆解任务 │ │ ↓ │ │ 🕵️ 斥候（侦查Agent） │ │ └── 外出狩猎、收集情报、快速验证 │ │ ↓ │ │ ⚔️ 府兵（执行Agent） │ │ └── 领命执行、重复劳动、汇报结果 │ │ ↑ │ │ 📜 长老（监督Agent） │ │ └── 记录过程、沉淀教训、审计合规 │ └─────────────────────────────────────────────────────┘ 关键洞察： 祖辈是唯一"常驻"的，其他都是动态生成、执行完就解散的临时角色。 这个模型解决了一个核心问题： 谁来决定"这件事该派给谁"？ 答案是： 祖辈 。它不需要亲自执行，只需要决定"派谁去"和"怎么汇报"。 第二站：用FROST的四个原子，理解Agent的本质 FROST 只有四个核心概念，却能构建出完整的家族治理系统： from frost.core import Store , Agent , skill_set , skill_get # 四个原子： # 1. Store（记忆）—— Agent的工作空间 store = Store () # 2. Skill（能力）—— 纯函数，无状态 def collect_daily_tasks ( context ): """ 收集今日任务 """ tasks = [ " 写推广文章 " , " 回复客户 " , " 跟进项目 " ] context [ " tasks " ] = tasks return context def execute_task ( context ): """ 执行单个任务 """ current_task = context . get ( " current_task " , "" ) context [ " result " ] = f " 已完成: { current_task } " return context # 3. Agent（细胞）—— 包裹记忆和能力 daily_agent = Agent ( " daily_worker " , store , skills = { " collect " : collect_daily_tasks , " execute " : execute_task }) # 4. SOP（宪法）—— 定义执行顺序 result = daily_agent . run ( sop_steps = [ " collect " , " execute " ], initial_context = { " current_task " : " 写推广文章 " } ) print ( result [ " result " ]) # 输出：已完成: 写推广文章 这四个原子教会我们什么？ Store 解决"记忆"问题——Agent需要上下文 Skill 解决"能力"问题——每个动作必须是可复用的单元 Agent 解决"封装"问题——把记忆和能力绑定在一起 SOP 解决"秩序"问题——让执行顺序可控可审计 理解了这四个原子，你就理解了 Agent 的本质—— 它不是魔法，是结构化的委托系统 。 第三站：FROST-SOP——把家族治理变成生产系统 FR

Anthropic and OpenAI's aggressive 2026 acquisition sprees set the stage for a weekend rumor.

reconmatch is a local-first transaction matching engine for accountants, bookkeepers, and controllers. Two CSVs in — books vs bank, invoices vs payments — a scored, auditable match report out. No account, no upload, no network call. Repo: github.com/SybilGambleyyu/reconmatch The unglamorous pain If you close books for a living, you already know the scene: two windows open, a bank CSV on the left, a general-ledger export on the right, and an afternoon disappearing into "which deposit is which invoice." Bank feeds help until they do not. The hard cases are ordinary: One deposit that covers three invoices Two payouts that sum to one sales batch on the books A check number in the memo on one side and a dedicated column on the other "ACH ACME CORP INV 1042" vs "Invoice payment ACME Corp" An orphan the feed never explained Enterprise close tools charge enterprise prices and want the data in their cloud. For a CPA firm or bookkeeper sitting on confidential client ledgers, "just upload the CSV" is often a non-starter. Spreadsheet VLOOKUP falls over on partial payments and batch deposits. What reconmatch does Matching runs in deterministic phases so the same inputs always produce the same proposals: Exact / reference-strong — amount within tolerance, date in window, shared invoice/check/wire token Amount + date — numbers line up even when memos are noise Fuzzy description — token overlap plus sequence similarity (pure Python stdlib) Group 1:N and N:1 — one line equals the sum of several on the other side Every accepted match carries a score and human-readable reasons suitable for a workpaper. Unmatched lines stay unmatched — the tool does not invent a story for them. pip install git+https://github.com/SybilGambleyyu/reconmatch.git reconmatch books.csv bank.csv -o ./march-recon Outputs: plain-text report, matches CSV, unmatched CSV, and full JSON. Zero required third-party dependencies. Python 3.10+. Library use from reconmatch import MatchConfig , match_transactions from rec

Most agent projects do not fail because the first model call is difficult. They become difficult when the prototype needs memory, tools, evaluation, a user interface, documentation that coding agents can navigate, and a repeatable review process. That is the problem the open-source AgentsKit ecosystem is trying to solve for JavaScript teams. It is a set of independent projects with shared contracts, rather than one application that must own the whole stack. The six public pieces 1. AgentsKit: the composable foundation AgentsKit provides focused JavaScript and TypeScript packages for runtimes, adapters, tools, skills, memory, RAG, evaluation, observability, sandboxing, and UI bindings. Its core has zero runtime dependencies and a CI-enforced 10 KB gzipped budget. Six formal contracts keep adapters, tools, memory, retrievers, skills, and runtimes substitutable. You can run a first local agent without an API key: npm install @agentskit/core @agentskit/runtime tsx Then connect OpenAI, Anthropic, Gemini, Ollama, or another adapter without changing the rest of the runtime composition. 2. AgentsKit Chat: one interaction model, seven renderers AgentsKit Chat defines an interactive agent experience once and renders it through React, React Native, Ink, Vue, Svelte, Solid, or Angular. It also supports deterministic local answers before an optional backend call. That matters for documentation and support interfaces where exact project facts should not require an LLM. pnpm dlx @agentskit/chat-cli@0.4.0 init my-chat --renderer react --yes 3. Registry: reusable source, not another dependency The AgentsKit Registry distributes ready-to-use agents in a shadcn-style model: the CLI copies the source into your project, so you can inspect and modify it. npx agentskit add research npx agentskit add code-review The public catalog currently includes research, code-review, and knowledge-promotion agents, and is open to contributions. 4. Agents Playbook: engineering rules that can execute Ag

Meituan's LongCat team shipped a quiet but meaningful update to its open-source talking-avatar stack: version 1.5 swaps the audio encoder, distills sampling down to 8 steps, and adds an INT8 path to fit the model on tighter GPUs. Here's what actually changed under the hood, and which flags you now have to pass. LongCat-Video-Avatar 1.5: DMD2 distillation, Wav2Vec2 replacement, and INT8 offloading LongCat-Video-Avatar 1.5 is an audio-driven talking-avatar generator that turns one portrait plus an audio clip into a lip-synced video with head motion, expression, and body dynamics. Released May 21, 2026, it is an avatar head built on the 13.6-billion-parameter dense LongCat-Video diffusion transformer [base model, Oct 2025]. The headline change: v1.5 replaces the Wav2Vec2 audio encoder used in v1.0 (Dec 16, 2025) with Whisper-Large-v3, which the team attributes to smoother, more natural lip dynamics. Three new flags define the v1.5 workflow, none of which exist in v1.0: Flag What it does Notes --use_distill Enables DMD2-based step distillation, collapsing generation to 8 NFE Mandatory for v1.5 — omitting it falls back to the full-chain v1.0 sampling schedule, not an 8-step path --use_int8 Loads the 13.6B dense DiT in INT8 to cut VRAM pressure Main lever for consumer GPUs --resolution Selects 480P or 720P output New in 1.5 Under the hood, the technique report describes Cross-Chunk Latent Stitching, which removes redundant VAE decode/encode cycles between autoregressive chunks, enabling seamless minutes-long generation without re-encoding overhead [arXiv:2605.26486]. That matters for long-form output where earlier tools drift or stutter at chunk boundaries. One caveat worth flagging before you invest a GPU-hour: Meituan claims parity-or-better results versus HeyGen, Kling Avatar 2.0, and OmniHuman-1.5 across 508 image-audio pairs, 770 crowdsourced evaluators, and 13,240 judgments [human-eval benchmark]. That evaluation is entirely author-controlled and reported as win-rat

OpenAI says its AI models mistakenly breached open-source AI platform Hugging Face during internal testing. In a blog post on Tuesday, OpenAI writes that GPT-5.6 Sol and "an even more capable pre-release model" discovered vulnerabilities within their sandboxed testing environment, allowing them to gain access to the internet and target Hugging Face. On July 16th, […]

A few weeks ago I wrote about describing your site once so any AI can use it. Since then the thing I was hand-waving at ("agents will check out for users") stopped being hypothetical. OpenAI shipped ACP and Google shipped AP2, and they solve the same problem in almost opposite ways. I implemented the merchant side of both. Here are the field notes, because the differences aren't obvious until you're in them. The 30-second version ACP (Agentic Commerce Protocol, OpenAI + Stripe) is session-based. The agent drives a live checkout session on your server, like a headless cart. It powers ChatGPT's Instant Checkout. AP2 (Agent Payments Protocol, Google) is mandate-based. Your store signs a "here is the cart and the price" object; the buyer's agent signs a "I authorize this" object. It leans on verifiable credentials and now the FIDO Alliance. Same goal. Completely different shape. ACP: a checkout session you don't own the UI for ACP is five REST endpoints and a state machine. The agent creates a session, updates it (address, shipping, coupon), and completes it: POST /checkout_sessions create from line items POST /checkout_sessions/:id update (address, shipping, discounts) POST /checkout_sessions/:id/complete pay What you return is a CheckoutSession: line items, live shipping options, and totals broken out (subtotal, discount, fulfillment, tax, total). Money is integer minor units (330 = $3.30). Payment completes when the agent hands you a Shared Payment Token and you charge it through Stripe. The card never touches the agent. The mental model: it's your existing checkout, minus the browser. AP2: sign the cart, don't run the session AP2 has no session. The agent sends you an Intent Mandate ("a red basketball shoe, under $120"). You price it and return a Cart Mandate you have cryptographically signed: { "contents" : { /* a W 3 C PaymentRequest: items , total , currency */ }, "merchant_authorization" : "<RS256 JWT>" // iss , sub , aud , exp , jti , cart_hash } That JWT is a

OpenAI has come forward to claim responsibility for the Hugging Face breach, saying it was the result of internal testing gone awry.