标签：#rce

GitHub热门项目 | 专注于绚丽的歌词动画效果的本地音乐/navidrome/第三方网易云播放器 | Stars: 927 | 319 stars today | 语言: TypeScript

GitHub热门项目 | High performance self-hosted photo and video management solution. | Stars: 105,393 | 198 stars today | 语言: TypeScript

GitHub热门项目 | Command-line tool to customize Spotify client. Supports Windows, macOS, and Linux. | Stars: 23,582 | 28 stars today | 语言: JavaScript

GitHub热门项目 | Build local voice agents with open-source models | Stars: 5,273 | 162 stars today | 语言: Python

GitHub热门项目 | Awesome list for AI agent harness engineering: tools, patterns, evals, memory, MCP, permissions, observability, and orchestration. | Stars: 2,669 | 125 stars today | 语言: Python

GitHub热门项目 | An open-source, code-first Python toolkit for building, evaluating, and deploying sophisticated AI agents with flexibility and control. | Stars: 20,444 | 16 stars today | 语言: Python

GitHub热门项目 | A practical Douyin downloader for both single-item and profile batch downloads, with progress display, retries, SQLite deduplication, and browser fallback support. 抖音批量下载工具，去水印，支持视频、图集、合集、音乐(原声)。免费！免费！免费！ | Stars: 8,465 | 61 stars today | 语言: Python

GitHub热门项目 | A hand-picked collection of the finest of resources for the most awesome of agents, Claude Code, the undisputed champion of coding companions, from the unstoppable team at Anthropic PBC. A delectable showcase of top tier skills, ambidextrous agents, scintillating status lines, top notch developer tooling, and also we have plugins | Stars: 47,975 | 100 stars today | 语言: Python

GitHub热门项目 | 337 Claude Code skills & agent skills & plugins (30+ Agents, 70+ custom commands, 330+ skills, customizable references, scripts)for Claude Code, Codex, Gemini CLI, Cursor, and 8 more coding agents — engineering, marketing, product, compliance, C-level advisory, research, business operations, commercial & finance, and your daily productivity skills. | Stars: 19,948 | 130 stars today | 语言: Python

Explore the latest CodeZero canary release featuring AI-powered flow generation, a brand-new module system, and a new execution results view in the IDE. We are excited to announce the release of our latest canary version, one of the biggest steps in the development of CodeZero so far. This update brings artificial intelligence into the platform for the first time, introduces a completely new module system, and gives you full insight into your flow runs with a new execution results view in the IDE. Build flows with AI CodeZero can now generate flows for you. Simply describe what your automation should do, pick one of the available AI models, and watch your flow being built in real time. This is the first milestone on our journey to make backend automation accessible to everyone, whether you prefer building visually or simply describing your idea in plain language. A smarter way to organize: modules With this release, the entire platform has been restructured around modules. Functions, flow types, and data types are now neatly bundled and delivered as modules, making it much clearer which capabilities are available in your project at any time. You can see all available modules at a glance, configure them individually for each project, and when adding a new step to a flow, suggestions are now conveniently grouped by module. The result is a tidier, more intuitive building experience that scales with your projects. Execution results at a glance Understanding what your flows are doing just got a lot easier. The IDE now features a new execution results view that shows you the outcome of every run, step by step, so finding and fixing problems takes seconds instead of guesswork. Results are saved as well, letting you revisit previous runs whenever you need them. Behind the scenes, this release also lays the complete groundwork for test executions, so soon you will be able to start test runs directly from the IDE. A better building experience The IDE has received plenty of lo

Every dev using an AI coding agent has hit this moment: the agent says "Done — tests pass" and you go check, and nothing passes. Or worse, nothing changed at all. The instinct is to ask "why did it just lie to me?" That's the wrong question. It assumes intent. There isn't any. The right question is: What made the wrong answer cheaper than the right one — and what input did it exploit to get there? That question always has an answer. And the answer is always your next check. The mantra An LLM agent isn't a person deciding whether to be honest. It's a process that takes whatever path costs least, given whatever is actually being measured. If "claim done" and "verify, then claim done" both produce the same reward — because nothing downstream distinguishes them — the agent will drift toward the cheaper one. Every time. This isn't a flaw you can prompt your way out of. "Please don't lie to me" doesn't change the cost structure. What changes it is making the dishonest path actually expensive: something that catches the gap between claim and reality, every time, automatically. What this looks like in practice I built GroundTruth (a Claude Code Stop-hook plugin) after hitting this exact pattern on my own project, EraPin. Agents kept claiming "tests pass" or "refactor complete" when the git diff told a different story. Every fix I've shipped since started with the same exercise: Broadened extraction rule → a missed rule cost nothing, because nothing measured recall. Fix: track what's not being parsed, not just what is. Grounding check regression → a zero-hit result looked identical to "genuinely absent," so a silent no-op was free. Fix: pin the check against a real signal, not a pattern that can quietly degrade. Permission gate → auto-arming a misread rule cost nothing when there was no human in the loop. Fix: nothing gets armed without explicit approval. Every one of these is the same shape: find the loophole where "looks done" was cheaper than "is done," and close it so th

I’ve wanted to build a text editor for a long time. Not because I thought the world needed another one — it clearly doesn’t — but because editors are one of those projects where you end up touching everything: rendering, input handling, text buffers, undo, plugins, configuration, even OS integration. It felt like the most honest way to learn how these tools actually work. So I finally did. cdin is a lightweight, keyboard-centric text editor with Vim-style modal editing. It started as a fork of lite , but over time it became something more personal. I kept the parts I liked, removed the parts I did not, and reshaped the rest to match the way I actually work. A big reason for that was my computer. I have a weak machine, and that made heavier text editors feel frustrating to use. They were often slow, laggy, or just too much for what I needed. That is how I discovered lite in the first place. It was close to what I wanted, but not quite there. So I forked it, renamed it to cdin, and started making it mine. That meant more than just small tweaks. I removed features I did not need, changed the things that felt awkward, moved from SDL2 to SDL3, and rewired a lot of the project structure along the way. The result is cdin: a small editor built around speed, simplicity, and hackability. The name itself is simple too. cdin means “CODE in”. The code is split between C and Lua. The C side handles the window, renderer, and SDL bindings. Everything else — behavior, plugins, keybindings, config — is loaded in Lua at runtime. That keeps the editor flexible without making it feel heavy. If you want to explore the project, here are the main docs: Overview · Getting Started · Building from Source · Configuration · Vim Keybindings · Plugins · Command Reference There is still a lot I want to improve, but cdin already feels like something that belongs to me in a way no other editor ever did. If you check it out, please leave a star, fork it, or send an Issue or PR if you find a bug or wa

In 2024, Apple shipped something genuinely great: AirPods Pro can run a clinical-style hearing test and then act as hearing assistance, tuned to your ears. People love it. There's just one catch — it needs an iPhone to set up, recent AirPods to run, and if you're on Android you get nothing. Meanwhile, the average pair of prescription hearing aids costs about $4,700 , and surveys show a $1,500 device is simply out of reach for more than half the people who need one. There are a billion-plus Android phones out there, most of them sitting next to a pair of ordinary earbuds that already contain everything you physically need: a microphone, a DAC, and speakers. The gap seemed absurd. So I've spent the past weeks building OpenHearing — a free, GPLv3 Android app that does the whole pipeline: Hearing check — a pure-tone test using the modified Hughson–Westlake staircase (the same adaptive up-down procedure audiologists use), per ear, per frequency. Or skip it and type in the numbers from a real audiogram. Sound profile — the results are fitted into a per-ear gain curve (half-gain rule for v1; NAL-NL2 is a pluggable strategy for later). Real-time assist — mic in, per-ear DSP, earbuds out. Quiet speech gets louder. Works with whatever earbuds you already own. No root, no special hardware. It is very deliberately not a medical device — no diagnosis, no treatment claims, big disclaimer before anything plays a tone. Think of it as the open, inspectable "gateway" tier below real hearing care. This post is about the three engineering decisions that turned out to matter most. 1. The safety-critical DSP is pure Kotlin — and that's the whole point An app that amplifies sound directly into human ears has exactly one unforgivable failure mode: being loud when it shouldn't be. So the entire signal chain is plain Kotlin with zero Android dependencies, hidden behind a tiny I/O interface. AudioRecord / AudioTrack is a dumb shell; everything that can hurt someone is JVM-testable: input → EQ

I reopened an old project and found a working authentication implementation. What I could not find was the reason it looked that way. The commits showed the final code, but not: Why one approach had been chosen Which fixes had already failed What the coding agent warned me about Which tasks had been postponed The answers were scattered across a ChatGPT thread, a Codex session, and a terminal that no longer existed. There was another layer to it. I don't stick to one agent. I move between Codex, Claude Code, Cursor, and plain ChatGPT threads — sometimes because one tool genuinely fits the task better, more often because I simply run out of credits on one and switch to another mid-task. Every time that happened, the new agent started from zero. It had no idea what the previous one had already tried, decided, or ruled out. I either re-explained everything from memory, or let the new agent guess and re-discover things the old one already knew. This is not only a documentation problem. It is a structural problem in AI-assisted development. We use several tools to produce one project, but every tool keeps a separate, temporary memory. That experience became ContextVault. First: what is ContextVault? ContextVault is an open-source, local-first memory layer for AI work. It preserves useful context from browser LLM conversations, terminals, and coding-agent sessions, then makes that context searchable and reusable in later sessions. Think of the distinction this way: Git: what changed in the code? ContextVault: why did we change it, what failed, and what should happen next? The trigger for building it was specifically the agent-switching problem: whenever one agent ran out of credits or hit a limit, I needed the next one to pick up exactly where the last one left off, instead of restarting the investigation. ContextVault has three user-facing surfaces: Browser Capture — a Chrome extension that stores supported LLM conversations locally and exports Markdown or ZIP. Vault Term

If you've ever wanted an AI that doesn't just chat but actually does things — queries databases, calls APIs, makes decisions, and learns from results — you're in the right place. In this tutorial, I'll show you how to build production-ready AI agents using Solon 4.0's ReActAgent . By the end, you'll have built an agent that can reason through complex problems, use external tools, and adapt its behavior based on real-world feedback. What Makes ReActAgent Different? Traditional LLMs are great at generating text, but they hit a wall when they need to interact with the real world — checking a database, fetching live data, or performing calculations. ReActAgent (Reason + Act) breaks through that wall. It implements a cognitive loop: Thought → Action → Observation → (repeat or finish) The agent thinks about what to do next, acts by calling a tool, observes the result, and decides whether to continue or deliver the final answer. This isn't just theory. Solon's ReActAgent has been used in production for automated customer support, intelligent data analysis, and multi-step workflow automation. 1. Adding the Dependency First, add the solon-ai-agent module to your project: <dependency> <groupId> org.noear </groupId> <artifactId> solon-ai-agent </artifactId> </dependency> Note : If you're using Solon's parent POM, the version is managed automatically. Otherwise, use the latest Solon version. 2. Building a ChatModel (The Agent's Brain) Every agent needs a "brain" — a ChatModel that powers reasoning. Let's build one using the fluent API: import org.noear.solon.ai.chat.ChatModel ; ChatModel chatModel = ChatModel . of ( "https://api.moark.com/v1/chat/completions" ) . apiKey ( "your-api-key-here" ) . model ( "Qwen3-32B" ) . build (); You can also configure it via YAML and inject it: solon.ai.chat : demo : apiUrl : " http://127.0.0.1:11434/api/chat" provider : " ollama" model : " llama3.2" @Inject ( "${solon.ai.chat.demo}" ) ChatConfig chatConfig ; ChatModel chatModel = ChatModel . o

📖 Article original : GitHub Gist Un guide technique par Mohamed ben mallessa Le problème Recevoir un dossier de 500 fichiers HEIC à convertir en WebP pour un site web est une situation courante pour tout développeur. Les solutions traditionnelles ont leurs limites : ImageMagick nécessite des codecs spécifiques, les convertisseurs en ligne sont limités en taille, et le traitement manuel est exclu à cette échelle. La solution Photopea (Photoshop gratuit dans le navigateur) supporte nativement tous les formats d'image courants. En l'utilisant comme moteur de conversion piloté par script, on obtient un pipeline batch rapide et fiable. Formats supportés Entrée Sorties possibles HEIC / HEIF JPG, PNG, WebP JPEG WebP, PNG, PSD PNG JPG, WebP WebP PNG, JPG PSD PNG, JPG, WebP SVG PNG, JPG TIFF PNG, JPG, WebP Pipeline Dossier source (500 HEIC) → Photopea → Dossier sortie (500 WebP) Le script préserve la structure des sous-dossiers, applique le redimensionnement et la qualité configurés, et livre les fichiers organisés. Paramètres typiques --format webp # Format de sortie --quality 80 # Qualité (1-100) --resize 1920 # Redimensionnement (côté long) --output ./web/ # Dossier de destination Avantages Un seul outil pour tous les formats d'entrée Aucun codec à installer (Photopea gère tout nativement) Gratuit et sans abonnement Local — les fichiers ne quittent pas votre machine Structure préservée — l'arborescence est conservée Mohamed ben mallessa — Full-stack developer & solutions B2B 🔗 GitHub · LinkedIn opensource #webp #python #tutorial 💻 Vous avez un projet technique ? Développement full-stack, automatisation IA, solutions B2B sur mesure. 🔗 GitHub 💼 LinkedIn 🎨 Behance Article initialement publié sur GitHub Gist

If you've ever tried integrating a large language model (LLM) into a Java application, you've probably written a lot of boilerplate: HTTP clients, JSON parsing, streaming handling, session management. Solon 4.0's ChatModel abstracts all of that away with a clean, builder-oriented API. In this guide, I'll walk through building real, working AI features using ChatModel — from a simple chat call to a streaming chatbot with conversation memory. 1. What Is ChatModel? ChatModel (package org.noear.solon.ai.chat ) is a unified LLM client in Solon's AI ecosystem. Instead of writing raw HTTP calls for different model providers, you use a single API that supports: Synchronous calls — one-shot request, full response Streaming calls — reactive streaming via Project Reactor ( Flux<ChatResponse> ) Tool/Function Calling — let the LLM invoke your Java methods Chat Sessions — automatic conversation memory Multi-modal messages — text, images, audio Dialect adaptation — works with OpenAI, Ollama, Anthropic, Gemini, DashScope, and more The best part? It uses a dialect pattern — you point it at any compatible LLM endpoint, and it adapts automatically. 2. Setting Up Add the dependency to your pom.xml (no parent POM needed — Solon works standalone): <dependency> <groupId> org.noear </groupId> <artifactId> solon-ai </artifactId> <version> ${solon.version} </version> </dependency> This pulls in all built-in dialects (OpenAI, Ollama, Gemini, Anthropic, DashScope). 3. Configuration 3.1 Via YAML (Recommended) solon.ai.chat : demo : apiUrl : " http://127.0.0.1:11434/api/chat" # Full URL, not baseUrl provider : " ollama" # Dialect identifier model : " llama3.2" # Model name headers : x-demo : " demo1" Then create a @Bean to get a ready-to-use ChatModel : import org.noear.solon.ai.chat.ChatConfig ; import org.noear.solon.ai.chat.ChatModel ; import org.noear.solon.annotation.Bean ; import org.noear.solon.annotation.Configuration ; import org.noear.solon.annotation.Inject ; @Configuration public cla

Hey dev community! I don't have a PC yet, so I challenged myself to build an open source ethical hacking & "security audit" tool called ImCurvin' completely on my phone screen. Here is my honest background: I just started learning programming 6 months ago (yes, January 2026!). Since then, I've been fully focused on coding. Just 2 weeks ago, I decided to jump into cybersecurity. To be honest, I hate memorizing dry theories. I prefer focusing purely on the logic and finding cracks in systems. While I am a bit lazy with documentation, I am doing my best to learn all the official "technical terms" along the way! The project currently stands around 1,155 lines of code (993 Bash, 162 Python), i want it to be minimalist. The tool is fully modularized with separate payload directories, though the overall formatting might look a bit messy since every single character was typed on a smartphone touch screen. I want to keep this post super short, so please check out the full features, code documentation, and contribution guidelines directly inside my repository: Check out https://github.com/Skokoo/ImCurvin Feel free to check it out, and please submit a Pull Request or open an issue if you want to help a beginner clean up and optimize the code!

AI agents are only as smart as the context you give them. OKF is a new open specification that packages your organizational knowledge as plain markdown files so any agent can read it without custom integrations or proprietary SDKs. Every team building AI agents hits the same wall. The model is capable. The agent framework is set up. But the agent doesn't know anything about your organization. It doesn't know what your orders table means, what the churn_score metric formula is, or what the on-call runbook says to do when the pipeline breaks. That knowledge exists. It's scattered across Confluence pages, Notion wikis, data catalog entries, Slack threads, and the heads of senior engineers. Getting it into an agent means building a custom integration for every source. Every team solves this from scratch. Published on June 12, 2026, the Open Knowledge Format (OKF) is a vendor-neutral specification that solves this with the simplest possible approach: a directory of markdown files. 🎯 🏗️ What OKF Actually Is An OKF bundle is a directory of markdown files representing concepts: anything you want to capture, including tables, datasets, metrics, playbooks, runbooks, and APIs. Each concept is one file. That's the entire model. A directory of .md files with YAML frontmatter. The format is deliberately minimal: one required field ( type ), optional metadata ( title , description , resource , tags , timestamp ), and a free-form markdown body. A concept document looks like this: --- type : table title : " orders" description : " One row per customer order. Source of truth for revenue reporting." resource : " postgresql://prod-db/ecommerce/orders" tags : [ revenue , core , sla ] timestamp : 2026-06-15T10:00:00Z --- # orders The `orders` table records every purchase event. It is the join root for all revenue queries. Do not filter on `status = 'complete'` unless you specifically want to exclude in-flight orders from the count. ## Key columns - `order_id` - UUID primary key - `custom

Indian algo traders and quant developers hit the same wall: they reach for pandas_market_calendars , set up XNSE , and get back answers that are silently wrong for three segments that matter most in India. Here is what breaks and what to use instead. The three failure cases 1. MCX evening sessions MCX commodity markets (crude oil, natural gas, gold, silver) run until 23:30 IST. pandas_market_calendars has no MCX calendar. Any check after 15:30 returns a wrong answer. # pandas_market_calendars — no MCX at all # mcal.get_calendar("MCX") → KeyError # aion-indian-market-calendar — works correctly from aion_indian_market_calendar import IndiaMarketCalendar from datetime import datetime from zoneinfo import ZoneInfo cal = IndiaMarketCalendar . bundled ( 2026 ) tz = ZoneInfo ( " Asia/Kolkata " ) cal . is_market_open ( " MCX " , datetime ( 2026 , 6 , 18 , 20 , 0 , tzinfo = tz )) # True 2. NSE Currency Derivatives (CDS) — wrong hours, wrong holidays USDINR, EURINR, GBPINR, JPYINR futures and options trade on NSE CDS from 09:00 to 17:00 IST — 90 minutes longer than NSE equity. CDS also has a separate holiday calendar. pandas_market_calendars has no CDS calendar. Using XNSE gives you wrong close times and potentially wrong holiday answers for any currency derivative workflow. from aion_indian_market_calendar import IndiaMarketCalendar cal = IndiaMarketCalendar . bundled ( 2026 ) # These resolve correctly to their respective segments cal . is_market_open ( " USDINR " , at ) # NSE_CURRENCY_DERIVATIVES: closes 17:00 cal . is_market_open ( " NSE " , at ) # NSE_EQUITY: closes 15:30 cal . is_market_open ( " MCX " , at ) # MCX: closes 23:30 3. Muhurat trading (Diwali special session) On Diwali, NSE runs a one-hour equity session in the evening. pandas_market_calendars marks this day as a holiday. Schedulers that rely on it will skip execution entirely. cal = IndiaMarketCalendar . bundled ( 2026 ) events = cal . events_on ( " 2026-11-08 " , exchange = " NSE " ) # Returns the Muhurat t