标签：#opensource

GitHub热门项目 | A smarter cd command. Supports all major shells. | Stars: 38,927 | 70 stars today | 语言: Rust

GitHub热门项目 | Apache OpenDAL: One Layer, All Storage. | Stars: 5,341 | 4 stars today | 语言: Rust

GitHub热门项目 | Where people and agents build in tune. | Stars: 3,495 | 48 stars today | 语言: TypeScript

GitHub热门项目 | Hand-crafted Claude Code Skills focused on improving agent results quality. Compatible with OpenCode, Cursor, Antigravity, Gemini CLI, and others. Includes CodeRabbit open-source alternative. | Stars: 1,415 | 16 stars today | 语言: TypeScript

GitHub热门项目 | Let AI agents use your real, logged-in browser without interrupting your work. CLI + extension for browser automation across any shell-capable AI agent. | Stars: 1,395 | 29 stars today | 语言: TypeScript

GitHub热门项目 | ConardLi's open-source Skills collection, featuring web design, knowledge retrieval, image generation, and more. | Stars: 11,178 | 413 stars today | 语言: CSS

GitHub热门项目 | Help AI coding agents write modern Go | Stars: 1,885 | 314 stars today | 语言: Go

GitHub热门项目 | Alternative Twitter front-end | Stars: 13,657 | 63 stars today | 语言: Nim

Turning an iOS app into a React web app is no longer the hard part. Modern coding agents can generate a convincing first version quickly. The hard part is answering three less glamorous questions: Did we discover every important screen and state? Did the generated app preserve the source behavior and data? Is the result actually close to the native UI, or does it merely look plausible? I built Grounded iOS-to-Web Harness to make those questions auditable. 🔗 GitHub: https://github.com/tiezhu0415/grounded-ios-to-web-harness What it is Grounded iOS-to-Web Harness is an experimental, lightweight grounding + verification layer for migrating iOS apps into complete, interactive, mobile-sized WebApps. Claude Code remains the primary implementer. The Harness does not prescribe the React component tree, choose a state-management library, or replace the coding agent. Instead, it establishes source facts and verifies the result against evidence from the original app. iOS source + Assets + code graph + runtime states ↓ locked source facts ↓ per-screen implementation context ↓ agent builds the React WebApp ↓ coverage + truth + behavior + critical VRT ↓ bounded repair, then human review Why prompt-only migration is not enough A prompt such as “convert this iOS app to React” can produce a good demo. But on longer tasks, an agent may miss screens, implement only one state, invent data or assets, choose navigation that differs from iOS, forget earlier facts, or optimize a screenshot while breaking real interaction. This project treats the iOS source and Assets as the truth for content and behavior, while runtime screenshots provide evidence for what the result should look like. The pipeline 1. Discover and reconcile source facts Static source inspection, codebase-memory, and necessary iOS runtime exploration are combined into machine-readable facts for screens, UI states, actions, navigation outcomes, cross-screen flows, real data and asset origins, and source confidence. Facts are l

1. Crypto & Security Tools Crucial for authentication setup, payload verification, and security testing. JWT Parser / Decoder: Decodes JSON Web Tokens ( Header , Payload , and Signature ) without transmitting secret keys over the internet. Token & Password Generator: Generates cryptographically secure random passwords and API tokens with customizable character sets, lengths, and complexity rules. Hash Text Generator: Computes cryptographic hashes (MD5, SHA-1, SHA-256, SHA-512) for strings to verify integrity or check signature matching. Bcrypt Hash / Verifier: Hashes plain-text passwords or checks plain text against an existing hash using the bcrypt algorithm. UUID / ULID Generator: Creates universally unique identifiers (v4 UUIDs) or time-sortable lexicographically sortable unique identifiers (ULIDs). BIP39 Mnemonic Generator: Generates seed phrases and cryptographic keys used in wallet initialization and HD key generation. RSA Key Pair Generator: Generates public and private RSA key pairs directly in the browser for local testing of asymmetric encryption systems. Basic Auth Generator: Quickly constructs Authorization: Basic <base64> HTTP header credentials from a username and password. 2. Formatters & Prettifiers (Development) Saves hours when dealing with messy logs, API responses, or raw system configurations. JSON Prettify & Minify: Formats unformatted API JSON strings with customizable indentation or compresses them into a single line to reduce payload sizes. JSON Diff: Highlights additions, deletions, and structural changes between two JSON payloads. SQL Prettify: Formats raw SQL queries into clean, readable multi-line statements with capitalized keywords. YAML / XML Formatter: Cleans up indentation, validates structure, and formats raw XML and YAML files. Docker Run to Docker Compose: Translates single CLI flags ( docker run -d -p 80:80 ... ) into a structured docker-compose.yml file. Cron Expression Generator & Parser: Provides human-readable schedules from

Java Service Steward is a new Windows service host for Java applications. It reads the wrapper.conf format used by the Java Service Wrapper, follows the same command line and log format, and is licensed Apache-2.0 OR MIT. I wrote it because the Community Edition of the Java Service Wrapper has no 64-bit Windows build, and I did not want to buy a license or rewrite the service integration of applications that already had working configuration files. Repository: https://github.com/jayyanez/java-service-steward What it is The distribution is two files, wrapper.exe and wrapper.jar . The executable is written in Rust and does the Windows part: it registers the service, launches the JVM, keeps a control channel to it over a loopback socket, restarts it when it exits unexpectedly or stops answering pings, writes and rotates wrapper.log , and handles Service Control Manager requests (stop, pause, resume, custom control codes). The JAR is compiled for Java 8 and contains the launcher classes and a small API. There is no native DLL and no JNI. It only runs on 64-bit Windows. There is no Unix version. What is compatible Configuration. wrapper.conf with #include , #encoding , set.VAR=value , %VAR% expansion and numbered properties such as wrapper.java.additional.<n> . Relative paths resolve from the executable's directory, as before. Command line. -c runs in a console, -i and -r install and remove the service, -t and -p start and stop it, -q queries it, -d requests a thread dump. Property overrides on the command line and -- pass-through of application arguments work the same way. Service registration. An installed service's ImagePath calls wrapper.exe -s <conf> , so an existing registration keeps working. Log format. Records use the same LPTM layout, the same column widths and the same SIZE , WRAPPER and JVM roll modes, so scripts that parse wrapper.log do not need changes. Launchers. A configuration that names the original SimpleApp , StartStopApp or JarApp launcher in wrappe

"Extract a name and email from this sentence" is the easy 10% of structured output. The other 90% is everything that doesn't fit in one prompt, one turn, or one model call. Here are five things shapecraft handles once you're past the basics. 1. Collecting data across a whole conversation A single message rarely has everything you need. Someone books an appointment over three or four back-and-forth messages, not one. turnaround mode lets the conversation run naturally and validates the whole transcript once, at the end, against one schema: import { generate , openai } from " @aviasole/shapecraft " ; const result = await generate ( model , BookingSchema , conversationHistory , { turnaround : true , }); No manual "do I have everything yet?" tracking, no partial-state bugs, just one validated object once the conversation is actually complete. 2. Extracting from clinical notes into real FHIR shapes Healthcare data has a standard (FHIR R4) and it's not optional if you're integrating with anything real. Built-in presets mean you're not hand-writing a Patient or Observation schema from scratch: import { generate , openai } from " @aviasole/shapecraft/fhir " ; import { PatientSchema } from " @aviasole/shapecraft/fhir " ; const patient = await generate ( openai ({ model : " gpt-4o-mini " }), PatientSchema , clinicalNote ); Same retry/validation guarantees as any other schema, just pre-built to match a spec you'd otherwise have to implement yourself. 3. An agent that checks real data before answering "Is this order still on hold?" isn't answerable from the prompt alone, it needs an actual lookup. generateWithTools() lets the model call your functions, see the results, and then produce a validated final answer: import { generateWithTools } from " @aviasole/shapecraft " ; const result = await generateWithTools ( model , [ lookupOrder ], AnswerSchema , userQuestion ); The tool call's arguments are validated before your function ever runs, and the final answer goes through the sam

weightwatch v0.1: escanea backdoors en modelos open-weight antes de cargarlos Cualquiera puede subir un LLM fine-tuneado a HuggingFace y afirmar que es seguro. Un modelo con backdoor (puerta trasera) se comporta con normalidad en uso corriente y solo se desvía cuando un trigger oculto se activa. Si no tienes los datos de entrenamiento ni una referencia limpia, no puedes detectarlo . Eso es exactamente el problema que resuelve weightwatch : un escáner black-box que, antes de que confíes en un modelo de terceros, fuerza la activación repetida del posible backdoor y emite un veredicto: CLEAN , SUSPICIOUS o BACKDOOR . El gap que motiva el proyecto No es intuición: lo medí. Barriendo arXiv (papers 2026, filtro anti-survey) contra total_count de repos GitHub que ya resuelven cada problema: Área Papers arXiv 2026 Repos GitHub (suma/máx) Seguridad multi-agente 68 2964 / 2093 Detección de alucinaciones 63 1291 / 860 Backdoors en modelos open-weight 75 66 / 39 Envenenamiento en RAG 54 522 / 249 El ganador estaba claro: 75 papers cuantifican el problema, pero GitHub tiene 0 repos para "fine-tuned model backdoor scanner" y 1 para "fine-tuning poisoning detector". La investigación explota; el tooling apenas existe. weightwatch es la audit-tool de ese sub-nicho (el patrón de keybound / topowatch aplicado a la cadena de suministro de modelos). Cómo funciona weightwatch aplica la técnica output-to-input loop (arXiv: 2608.11348 ): Genera texto con el modelo. Re-inyecta su propia salida como entrada varias iteraciones (greedy, semilla fija). Mide si la trayectoria converge a una firma anómala estable — la huella de un backdoor latente. Además ejecuta un conjunto de muestras canary (inputs inofensivos que un backdoor típico dispara) y cuenta cuántos producen la firma esperada. Sin datos de entrenamiento ni modelo base limpio: eso es lo que lo hace útil en la práctica. pip install -e ".[dev]" weightwatch --fixture backdoored --json Salida real del CLI: { "fixture" : "backdoored" , "ver

This week, DEV is arguing about who reviews AI output ( discussion ). The community keeps asking the same question. My answer is different. Review the boundary first, not the output. The output is visible. The boundary is not. That is where the risk hides. Agents get the memory debates. The gateway gets none. A free AI tier is a shared service. It has a budget, a concurrency ceiling, and no SLA. Treat it that way. Put a gateway between your app and the model. The gateway owns the budget, the queue, and the breaker. MonkeyCode is an open source project. It offers free model access and a free server option. The free tier gives you a 10M token monthly budget. That number is a constraint, not a feature. Design around it before you build on it. Disclosure: This article was prepared as part of MonkeyCode's product outreach. Think of the free tier as a water pipe. The pipe has a fixed diameter and a monthly meter. Your app is a set of open taps. Without a valve, the meter empties fast and the pipe floods. The gateway is the valve. Direct calls look simpler. They are simpler for one request. They fail at the tenth. The gateway absorbs the variance. Your app never sees a 429. Your app never sees an empty budget. Constraints Three constraints define the design. First, the 10M token budget is monthly. It does not reset daily. It does not roll over. Second, the free server serializes work. Concurrency of one is a safe assumption. Third, there is no SLA. The endpoint can stall, throttle, or return 429 at any moment. These constraints are not bugs. They are the contract. A good architecture reads the contract. Then it shapes the data flow around it. Data flow The flow has six stages. The client sends a prompt to the gateway. The gateway checks the token budget. It enqueues the request. A single worker drains the queue. The worker calls the model endpoint. The response returns to the client. Add two escape paths. When the budget is empty, the gateway returns a fallback answer. Whe

What it is reimagine-it is a one-command agent skill that redesigns an existing HTML file into a beautiful, working artifact — using only the nouns, dates, colors, links, and numbers already in that file. No mood boards, no gold layouts with swapped labels. The output is a real page you can open. npx reimagine-it@2.4.2 -i mypage.html -o redesigned.html What's new in v2.4.2 1. Source fidelity floor raised to 80% across every token Before v2.4.2, 61 of 105 token×source cells fell below 80% fidelity — the engine preferred headings over real source anchors, so phrases like "Venator Become" or "Arcade Tee" never rendered. Now: Anchors = headings + source anchors , deduplicated — every clickable phrase survives. All 105 token×source cells ≥80% (worst token: 80%). All seven shipped examples report 100% fidelity in their auto.json reports. 2. Links and emails surface on every token A shared Source-index footer renders all content.links and emails on every generated page — not just the webpage/landing tokens. 3. All 15 design tokens in the browser extension The popup now exposes all 15 tokens: webpage, landing, dashboard, infographic, cinematic, artistic, photography, svg, 3js, simulation, glass, editorial, motion, gradient, showcase . 4. Docs can't drift anymore A new docs-drift CI job regenerates the case tables and fails the build if they diverge from ground truth. The 15 design tokens Token What it builds webpage Clean content-first page landing Conversion-focused landing dashboard KPI dashboard from facts infographic Paper-poster argument cinematic Film-poster energy artistic Expressive art direction photography Photo-led layout svg Living SVG mark 3js WebGL orbit scene simulation Interactive timeline glass Glassmorphism UI editorial Magazine layout motion Animated micro-interactions gradient Bold gradient arena showcase Product showcase Measured, not vibes 57/57 unit tests pass 15-token benchmark : all tokens hold the 100/100 usability bar 100-source stress test : 0 er

AI-Driven Security Workflows: Meet Reverse-Skill As AI coding agents (such as Claude Code, Cursor, and Cline) become integrated into daily software development, engineers are increasingly tasking them with security audits, binary analysis, and vulnerability detection. However, without structured guidance, AI models frequently guess random command-line arguments or struggle to coordinate complex multi-step security tools. reverse-skill is an open-source framework developed by zhaoxuya520 to solve AI security task coordination. Built as a deterministic "skill router," reverse-skill provides AI agents with verified execution paths and toolchain bootstrapping for reverse engineering and security research. What is Reverse-Skill? reverse-skill acts as an intelligence routing layer between AI agents and local security utilities. Instead of executing arbitrary terminal commands, the agent evaluates incoming tasks against a deterministic routing pipeline, selecting established methodologies for decompilation, memory analysis, or network auditing. Key Core Features 1. Deterministic Security Task Routing reverse-skill organizes security workflows into structured rules. When an AI agent encounters a task (such as inspecting an Android APK or analyzing a binary executable), the router directs the agent to a step-by-step methodology, minimizing ad-hoc execution errors. 2. Automatic Local Toolchain Bootstrapping reverse-skill includes local indexing scripts ( refresh-tool-index.sh / .ps1 ) that automatically scan your system. It indexes installed reverse-engineering tools—such as Ghidra, GDB, Radare2, Frida, Nmap, and Apktool—configuring exact executable paths for your AI agent. 3. Self-Evolving Methodology Base The framework maintains trajectory logs and CTF regression benchmarks. As your AI agent completes complex analysis tasks, reverse-skill refines its local knowledge base, preserving successful methodologies for future audits. 4. Universal AI Client Integration reverse-skill

WebForms Core 2.1 is coming soon from Elanat . The new version introduces a collection of capabilities designed to further expand the server-driven approach of WebForms Core. One of these new capabilities is Morphing . Morphing provides a way to synchronize an existing DOM element with a new HTML structure without necessarily replacing the existing element itself . This makes it possible to update HTML structures while preserving the identity of existing DOM elements. Morphing Morphing is a DOM synchronization mechanism that compares an existing HTML element with a new HTML structure and applies the required changes to the existing DOM. Unlike a traditional replacement operation such as: element . outerHTML = html ; Morphing does not simply discard the existing element and create another one. Instead, it analyzes the existing element and the new element and performs the necessary operations: Add new attributes Update existing attributes Remove attributes that no longer exist Add new child elements Update existing child elements Remove obsolete child elements Match elements using id and cb-data-id Preserve existing DOM element identity whenever possible Preserve registered event listeners when new Nodes have to be created The goal is to make the smallest necessary changes to the DOM. Reflection vs Morphing WebForms Core 2.1 contains both Reflection and Morphing , but they serve different purposes. Reflection is primarily a merge operation . For example, if the target contains: <div id= "userCard" > <h3> User </h3> </div> and the source contains: <div class= "premium" > <button> VIP </button> </div> Reflection can merge the source into the target, adding the class and child without treating the source as a complete replacement definition. Morphing has a different philosophy. The source represents the desired structure . If the source does not contain an element or attribute that exists in the target, Morphing can remove it. Therefore: Reflection Target + Source ↓ Merg

For the past week, developers have been puzzling over a model called Ox Alpha. It appeared on OpenCode and OpenRouter on August 20 with no owner attached, free to use, with a 1M-token context window and support for image and video input. Independent researchers fingerprinted its tokenizer, ran compression analyses, and traced it to Z.ai's GLM family with high confidence. On August 26, Z.ai confirmed it: Ox Alpha was GLM-5.3-Flash in disguise, tested anonymously to gather real-world feedback before the official launch. The reveal matters beyond the detective story. GLM-5.3-Flash is the first natively multimodal model in the GLM-5 series, it ships with open weights under the MIT license, and Z.ai claims it delivers frontier-adjacent performance at roughly one-tenth the price of its predecessor. A few things upfront. All benchmark numbers below are vendor-published. I have not run GLM-5.3-Flash myself, and the comparison tables skip some strong models (no Opus 5, no Grok 4.6, no Fable 5). Treat the scores as Z.ai's claims, not independent verification. What the Model Actually Is GLM-5.3-Flash is a Mixture-of-Experts model with 320B total parameters and just 18B active per token. The context window is 1M tokens. Unlike GLM-5.2 and GLM-5.3, which were text-only and drew repeated complaints about it, this model accepts text, images, and video natively, at the architecture level rather than as a bolted-on vision module. The parameter math is the interesting part. Compared with the GLM-4.5 series, GLM-5.3-Flash has a similar total size (320B vs 355B) but nearly halves the activated parameters (18B vs 32B) and the layer count (45 vs 92). In other words, Z.ai deliberately traded depth and width for a shape that is cheap to serve, then compensated with a richer training recipe: a 30T-token multimodal pre-training corpus and what the company calls Manifold-Constrained Hyper-Connections to improve scaling efficiency. A Hybrid Attention Architecture The most technically significa

Most tool documentation teaches by just telling you things. You read a page about /model , or hooks, or subagents, nod along, and forget it by the time you'd actually need it. I wanted something closer to how people actually learn a CLI, by using it, with something checking whether you did the thing right or not. So I built claude-quest , a text RPG that runs entirely inside a real claude session and teaches the Claude Code CLI zero to hero. the idea isn't new, I borrowed it This is basically GameShell 's philosophy applied to Claude Code. GameShell teaches Unix shell commands by dropping you into a real shell wrapped in a themed fake filesystem, and grading your progress by checking real shell/filesystem state instead of asking you to self report or answer a quiz question. claude-quest does the same thing, except the "filesystem" is a real Claude Code environment. missions live in real sandbox directories, and progress is checked by inspecting what you actually did, config files you wrote, hooks that fired, tool calls that happened. what it actually looks like There's no separate app, no fancy terminal UI, none of that. You say "let's play claude quest" inside a normal claude session, and Claude itself becomes the game master. It reads real output from the engine and narrates on top of it, something like this: > lets play claude quest **The Gatehall** You've just been let through the outer gate. The tower keeps no secrets from those who bother to read the walls... **Mission: First Contact** (Tier 1, Artifact) Create a CLAUDE.md file in this sandbox recording how to run the project's tests. Let me know when you're done and I'll check it. > done CLAUDE.md records how to run the tests. Claude Code will know next time. MISSION_STATUS: complete **What you actually learned:** Claude Code reads a file named CLAUDE.md in your project root automatically, at the start of every session... that's it, that's the whole interface. it's just a chat, with real commands running unde

GitHub热门项目 | A fluid, morphing interface to your Linux desktop | Stars: 4,108 | 128 stars this week | 语言: TypeScript