今日已更新 344 条资讯 | 累计 37249 条内容
关于我们

标签：#opensource

找到 2215 篇相关文章

AI 资讯

Writing QUIC in Pure Java

I maintain gumdrop , an async, non-blocking Java server framework. Last year I wanted to add HTTP/3 support, and ran into a wall: the Java ecosystem essentially doesn't have QUIC. The JDK's own experimental support (JEP 517) is client-only. Netty gets HTTP/3 by shelling out to quiche + BoringSSL over JNI — which works, but you're back to native builds, platform-specific binaries, and a C library sitting underneath your "pure Java" framework. I used that approach first. It was clumsy enough that I went looking for a pure-Java alternative. There's exactly one: Kwik. But Kwik is blocking per connection — one thread per QUIC connection. That's a non-starter for a framework built around single-threaded selector loops handling tens of thousands of concurrent connections. So I wrote a QUIC implementation from scratch: packet protection, loss detection and NewReno congestion control, connection migration, 0-RTT, QPACK, an HTTP/3 client and server — all driven by the same non-blocking event loop as everything else in gumdrop. Collaboration note: TLS 1.3 comes from Agent15 — also from Kwik's author, Peter Doornbosch, but just the handshake layer, not the connection model. We're currently working together on making PQC — hybrid key exchange and signatures — the default there. Why the thread model matters The reason this mattered beyond HTTP/3: gumdrop isn't a web framework with QUIC bolted on, it's a general async I/O framework, and QUIC is just a transport. One thread per connection is exactly the model gumdrop exists to avoid — it caps concurrency at your thread pool, not your file descriptors, and it's the reason a "just use Kwik" fix was never really on the table. The same QUIC stack backs DNS-over-QUIC (DoQ) as a first-class DNS transport alongside DoT, DoH, UDP, and TCP — and the DNS resolver itself is fully async, with no blocking InetAddress.getByName() anywhere in the I/O path, which is its own small miracle in Java. HTTP, SMTP, IMAP, POP3, FTP, MQTT, SOCKS — it's the

2026-08-26 原文 →
AI 资讯

Testing an AI shopping agent's checkout flow? There's no sandbox for that yet — so I built one

If you're building or evaluating an AI agent that can shop and check out on its own, you've probably run into the new "agentic commerce" protocols: ACP (OpenAI + Stripe + Meta), AP2 (Google), and UCP. They define how an agent talks to a merchant to create a checkout session, apply a payment token, and get an order back. Stripe's own test mode covers the payment half fine — test cards, test API keys. But there's no hosted "fake merchant" you can point your agent at to verify the protocol half: does your agent correctly create a session, handle a 422 idempotency conflict, parse the order response, retry politely? You either mock it yourself from the spec, or risk finding out against a real merchant. So I built acp-sandbox — a small hosted mock merchant implementing the ACP checkout API, live at https://acp-sandbox.flo-voice1.com . What it does It implements the real checkout_sessions lifecycle from ACP's 2026-04-17 spec : create, retrieve, update, complete, cancel. Responses match the actual CheckoutSession / Order / Error schemas for the fields it supports — I pulled the OpenAPI spec directly rather than guessing field names. # get a test key, no signup curl -X POST https://acp-sandbox.flo-voice1.com/keys \ -H "Content-Type: application/json" -d '{"email":"you@example.com"}' # create a session against the demo catalog curl -X POST https://acp-sandbox.flo-voice1.com/checkout_sessions \ -H "Authorization: Bearer acps_test_..." \ -H "Content-Type: application/json" \ -d '{"line_items":[{"id":"item_demo_headphones","quantity":1}],"currency":"usd"}' Every request/response is logged per API key ( GET /logs ), so you can see exactly what your agent sent when something doesn't work. What it deliberately doesn't do (yet) No real payment processing — complete always succeeds once you send any payment_data . No OAuth delegate_authentication flow. No fulfillment options (shipping/pickup) — every session goes straight to ready_for_payment . Fixed demo catalog (4 items), not a rea

2026-08-26 原文 →
AI 资讯

My 369 Merged Pull Requests On GitHub, Every Single One Linked And Verified

As of August 26, 2026, GitHub reports that 398 merged pull requests carry my name on the author line. Twenty nine of those live inside repositories that I own myself, so I removed them from this count on purpose. What remains is the number that actually matters to me: 369 pull requests merged into other people's repositories , across 33 external projects , maintained by strangers who had zero reason to trust my code. Every single one of those 369 merges is real, dated, and linked in this post. Nothing here is rounded up and nothing is claimed without proof. If you want to skip my writing entirely, open the search query in section two and run it yourself. That is the whole point of this article. You should never have to take a stranger's word about their own stats. Jump To Any Section How I Verified These Numbers | The Complete Scoreboard | 2024 The Year Of Volume | 2025 Fewer Pull Requests Higher Quality | 2026 The Year Production Code Got Merged | What 369 Merges Taught Me | Frequently Asked Questions | Where To Find Me How I Verified These Numbers I did not count these by hand. I queried the GitHub search API directly, which means the numbers come from GitHub itself, not from my memory or my ego. You can reproduce everything in this post with one click: https://github.com/search?q=is%3Apr+is%3Amerged+author%3Aaniruddhaadak80&type=pullrequests Or if you have the GitHub CLI installed: gh api -X GET search/issues -f q = "is:pr is:merged author:aniruddhaadak80" That query currently returns 398 results. I then filtered out every repository under my own account, which left exactly 369 external merges. The math is boring on purpose: 398 minus 29 own repository merges equals 369. One more honest number before we go further. I have submitted 918 pull requests in my lifetime so far. That means fewer than half of everything I ever sent got merged. Rejection is not the exception in open source, it is the price of admission, and anyone who shows you a 100 percent merge rate is

2026-08-26 原文 →
AI 资讯

When should Codex use multiple agents? A benchmark, not a slogan

More agents do not automatically produce better engineering. They usually add total tokens, duplicated context, handoff delay, and integration risk. Their defensible advantages are narrower: reduced elapsed time for independent work, isolated investigation, or specialist evidence that one agent might omit. The useful question is therefore not “Can this task use subagents?” It is: Does this task contain independent, bounded work whose value exceeds the coordination cost? Codex How To now includes a dependency-free benchmark for testing that question instead of answering it from intuition. Disclosure: I maintain Codex How To , the independent open-source project containing the benchmark, evaluator, and measurements used here. The minimum decision rule Use one agent when the change is small, the interface is unsettled, or several steps must edit the same central files. Consider bounded orchestration only when all of these are true: The task has at least two genuine ownership surfaces. Each writer can own exclusive paths. The interface between those paths is frozen before implementation. The controller retains integration, system checks, and final review. Every worker returns concise evidence rather than a narrative transcript. One external acceptance bar can evaluate every execution method. flowchart TD A["One task contract"] --> B{"Independent write surfaces?"} B -- "No" --> C["One agent or sequential work"] B -- "Yes" --> D{"Frozen interface and exclusive paths?"} D -- "No" --> C D -- "Yes" --> E["Bounded workers"] E --> F["Controller integrates and evaluates"] F --> G{"Coverage or elapsed-time value exceeds coordination cost?"} G -- "Unproven" --> H["Keep measuring"] G -- "Repeated evidence" --> I["Adopt for this task class"] Job titles are not ownership boundaries. “Backend agent,” “test agent,” and “review agent” may still collide on the same files or execute dependent stages. A useful boundary is concrete: one writer owns incident/** , another owns web/** , and n

2026-08-26 原文 →
AI 资讯

The n8n Community Node You Need Might Already Exist

You know that moment when you're building an n8n workflow and realize: “Wait… does n8n already have a node for this?” Maybe you need a specific AI provider. Or a browser automation tool. Or some obscure database. Or a service that isn't part of n8n's core integrations. The first instinct is usually to reach for the HTTP Request node. But before writing API calls yourself, there's another possibility: Someone may have already built the node. That's one of the reasons I created Awesome n8n Community Nodes . The n8n ecosystem is bigger than it looks One of the best things about n8n is that it isn't limited to its built-in integrations. Developers can create community nodes and publish them as npm packages, extending n8n with new services, triggers, actions, AI capabilities, utilities, and more. The ecosystem has grown significantly. One existing ecosystem tracker had already indexed thousands of community nodes, showing just how quickly the space is expanding. That's great for n8n users. But it creates a new problem: Discovery. Having thousands of nodes is useful only if you can actually find the one you need. So I built a directory I created: Awesome n8n Community Nodes 🔗 https://github.com/bhavyshekhaliya/awesome-n8n-community-nodes It's an open-source, curated directory for discovering community-built n8n integrations and utilities. Instead of organizing everything as one massive list, I grouped nodes around what you're actually trying to automate. 🤖 AI, Agents & Search Looking for AI, LLM, search, agent, or AI-media capabilities? There's a dedicated section for that. 🌐 Browser, Web & Scraping Need browser automation, crawling, scraping, or web extraction? You'll find those together. 💬 Communication & Messaging WhatsApp, email, chat, notifications, and other communication-related nodes have their own category. 🗄️ Data, Storage & Observability Database, storage, infrastructure, monitoring, and data-related integrations live here. 📄 Documents, Media & Productivity For

2026-08-26 原文 →
AI 资讯

From community review to a shipped security hardening with Codex

I’ve been building a small open-source TypeScript toolkit called Tenant Evidence Kit for private, multi-tenant evidence workflows on Supabase. The project started from a very specific problem: How do you attach photos, documents, or other evidence to a business object without making files public, leaking tenant data, or duplicating authorization logic across the application? The toolkit keeps that infrastructure deliberately small and domain-agnostic. It currently provides: private Supabase Storage; evidence metadata separated from file bytes; tenant isolation with Row Level Security; short-lived signed URLs; compensating cleanup when metadata persistence fails; reference migrations for tenant membership and evidence authorization. But the interesting part of the latest release was not the original implementation. It was the review loop. A community review found real problems I shared the project with the Supabase community and received a detailed security review. The feedback raised several important questions: roles existed, but authorization was still too close to flat membership; evidence deletion needed a more explicit privilege boundary; the lack of UPDATE support needed to be intentional rather than accidental; RLS assumptions around service_role , table owners and BYPASSRLS needed to be documented; authorization needed behavioral tests, not only static SQL assertions. That feedback was good enough that I didn’t want to treat it as a documentation exercise. I turned it into an implementation task. Using Codex as the implementation loop Instead of asking Codex something broad like: “Improve the security.” I gave it a tightly scoped issue with explicit acceptance criteria. The workflow became: community review → scoped issue → Codex implementation → human review → correction pass → CI → release The first implementation was useful, but the review still found problems. For example, it initially changed existing INSERT behavior and modified only the original migra

2026-08-26 原文 →
AI 资讯

The Hallucinating Camera: Directing a Model That Has No Lens

You do not have a camera. You have a machine that dreams a short motion out of a single still image, and it dreams badly the moment you ask it for something the still does not already contain. I learned this across a 10-episode series, and every rule below was paid for in failed generations. None of it is theory. The medium's real physics A real camera moves through a space that exists whether or not you point at it. The model has no space. It has one flat image and a statistical guess about what "zoom out" tends to look like in its training data. When the frame widens, the model is not revealing more of a room that was always there. It is inventing pixels to fill the new area, drawn from everything it has ever seen. That single fact reorganizes everything you know about directing: There is no coverage. Every "angle" is a separate generation from a separate still. Continuity is not captured; it is engineered, frame by frame. Nothing survives the cut for free. The model does not know that shot 12 and shot 13 are the same character in the same room. Anything you want to persist (damage state, light, color) must be re-declared or re-anchored every single time. The model abhors an empty frame. Its deepest reflex is to resolve ambiguity: a silhouette becomes a face, fog becomes a mountain range, a clean retro interior grows drips and cobwebs because "analog" reads as "abandoned". Spawn pressure is constant. Background figures flicker into existence in any populated-looking scene. Every motion prompt in my pipeline ends with an anti-spawn guard: "Do not add extra characters. Keep everything as pictured." Drop that guard and the figures come back. A widening or traveling frame is an invitation for the model to hallucinate. Direct this camera and you are not choosing what to show. You are choosing what to withhold from its imagination. The classical grammar, re-pointed If you carry film vocabulary, it all still applies. The mechanism just changes completely. Classical tool

2026-08-26 原文 →
AI 资讯

Stop asking your AI agent to follow rules. Enforce them.

You've written it a hundred times. In your CLAUDE.md , in your system prompt, in ALL CAPS: NEVER put "use client" at the page level. NEVER commit @ts-ignore without a reason. And your agent does it anyway. Not always — that would almost be easier to deal with. It follows the rule for the first 50k tokens, then quietly stops. Or Sonnet follows it and Haiku doesn't. Or it follows nine rules and forgets the tenth. Here's the thing I finally accepted: a rule in a prompt is a request. The model can decline it. So I stopped asking, and started enforcing. TL;DR Prompt adherence is probabilistic. It degrades with context length and with model size. But half of my coding rules never needed a model at all — they're grep-able. Claude Code hooks + exit 2 turn those rules into a deterministic reviewer that runs after every single edit , costs zero tokens when nothing is wrong , and fires at 100% regardless of which model wrote the code. Once the mechanical rules are enforced from below, you can safely downgrade the model doing the typing. That's the real payoff. Everything below ships in ccteams v0.3.0 , but the pattern takes 30 minutes to build yourself. Two kinds of rules Some background in three lines: I run Claude Code with orchestrated agent teams — a builder writes code, a reviewer verifies it, and both get a stack-specific "playbook" of rules distilled from the mistakes mid-tier models actually make. It works well. I wrote about the prompt-engineering side of it before. But rereading my playbooks, I noticed the rules split cleanly into two categories. Rules that need judgment: Trace the Server/Client boundary by hand. Don't write a fix until you can state the root cause. These need a model. Prompts are the right place for them. Rules that are just string matching: "use client" at the top of app/**/page.tsx → wrong. process.env.SECRET in a client file → wrong. @ts-ignore with no justification → wrong. Why was I asking a language model to remember these? A regex doesn't get

2026-08-25 原文 →
← 上一页 下一页 →