标签：#rce

GitHub热门项目 | 网文/小说写作 skill 包，覆盖长篇与短篇网络小说的扫榜、拆文、写作、去AI味、封面图全流程 | Stars: 3,165 | 51 stars today | 语言: JavaScript

GitHub热门项目 | A script allowing you to download images and videos from Telegram web even if the group restricts downloading. | Stars: 4,656 | 69 stars today | 语言: JavaScript

GitHub热门项目 | Edit videos with coding agents | Stars: 10,432 | 216 stars today | 语言: Python

GitHub热门项目 | AI generates a real, editable PowerPoint from any document — native shapes & animations, speaker notes voiced as audio narration, and the option to follow your own .pptx template, not slide images · by Hugo He | Stars: 32,688 | 589 stars today | 语言: Python

GitHub热门项目 | CasaOS - A simple, easy-to-use, elegant open-source Personal Cloud system. | Stars: 35,603 | 502 stars today | 语言: Go

Hey DEV community! 👋 I've been building web apps for a while, and I noticed there was no good place to discover and rate web-based OS projects — those cool browser-based operating systems you can run without installing anything. So I built Web OS Community 🎉 What is it? A platform where you can: 🔍 Browse web-based OS projects (Windows XP, Ubuntu, macOS clones, and more) ⭐ Rate your favorites with a global rating system 🏷️ Filter by tags (webos, demo, linux, macos, windows...) 📤 Submit your own web OS project via GitHub PR Why I built this The existing resources were scattered — some projects on GitHub, some on random personal pages. I wanted a central hub where developers could showcase their work and users could find these cool experiments easily. Tech stack Frontend: Vanilla JS / HTML / CSS (no frameworks, keeping it lightweight) Backend: Supabase (PostgreSQL + RLS policies) Auth: Custom RPC-based authentication Hosting: GitHub Pages + Cloudflare Workers Some features Global rating system (one vote per user per project) Admin panel for managing submissions Tag-based filtering Dark mode UI 🌙 Check it out! 🔗 web-os-community.tfhy5321.workers.dev If you have a web OS project, feel free to submit it! PRs are welcome 🙌 What web-based OS have you seen that blew your mind? Drop it in the comments!

Legacy ETL modernization is often described as a conversion exercise: Informatica mapping in. Snowflake SQL out. That framing is incomplete. A real migration is not only about translating expressions. It is about preserving transformation intent, identifying what is missing, documenting assumptions, validating target behavior, and ensuring that someone is accountable for decisions before generated artifacts are released. I have been building a prototype called Data Engineering Copilot around that idea. The latest capability starts from an Informatica PowerCenter XML export and produces a governed Snowflake migration delivery packet. The workflow is: Informatica PowerCenter XML ↓ Metadata and Lineage Extraction ↓ Canonical Metadata Model ↓ Snowflake Artifact Generation ↓ Validation and Migration Risk Assessment ↓ Human Review and Approval ↓ Governed Release Package The problem with simple code conversion An Informatica mapping can contain far more than a direct field-to-field relationship. A typical mapping may include: source definitions and target definitions source qualifiers and filters expression transformations reusable transformations lookups constants and default values mapping parameters target load order connector-level lineage update strategy or sequence-generation behavior target fields with no visible incoming connector A generator that only reads source and target columns may produce SQL that looks valid but does not preserve the original delivery intent. That is risky. For example, imagine a target field that has no visible source column. It may still be populated through: a constant such as 'SOURCE_A' a default such as 'XNA' a surrogate-key lookup a runtime parameter a load timestamp a sequence generator a business decision that was never documented in the mapping If the tool silently inserts NULL , the SQL may compile while the migration is functionally wrong. The prototype approach The Data Engineering Copilot prototype accepts two starting points:

AWS has recently announced the AWS Workload Credentials Provider to automatically deliver and refresh certificates and secrets for applications. The open source tool reduces the need for custom automation, helps prevent outages caused by expired certificates, and works in both AWS and non-AWS environments. un By Renato Losio

I've been using Home Assistant for a few years and Trading212 for longer than that. It was inevitable these two things would end up connected. The Trading212 API is surprisingly good — portfolio value, individual positions, pies, dividends, all there. So I wrote a custom integration to pull it all into HA as sensors, then a Lovelace card to make it actually look decent on a dashboard rather than a wall of entity rows. The card does zero-config auto-discovery which was the bit I spent the most time on. You drop it on a dashboard and it finds your sensors automatically — no copying entity IDs, no manual config unless you want it. Five card types: portfolio overview with a sparkline, scrollable positions list, pies with goal progress, and a combined one if you want everything in one card. The sparkline was fiddly. HA's recorder only writes state changes, not regular samples, so if your portfolio value is flat between polls the chart has gaps. Had to smooth over those client-side. The part I use most though is the automations. Every weekday at 8am Alexa tells me where I stand: action : - action : notify.alexa_media_kitchen data : message : > Portfolio is worth {{ states('sensor.trading212_total_value') | float | round(0) | int }} pounds. Today you are {% if states('sensor.trading212_pnl_today') | float >= 0 %}up{% else %}down{% endif %} {{ states('sensor.trading212_pnl_today') | float | abs | round(2) }} pounds. data : type : tts And Friday at 6pm I get the weekly version with P&L for the week and which position moved the most. I like that it just tells me — if the market's had a bad week I'd probably avoid opening the app, but Alexa doesn't give me the option to ignore it. Both the integration and the card are on GitHub. The card is in HACS as a custom repo while it waits for default catalogue approval: https://github.com/Smart-Home-Assistant-UK/lovelace-trading212-card I wrote up the full setup with all the automation YAML here if you want to copy the whole thing: ful

TL;DR If the Vercel CLI keeps trying to open a dev link against your Vercel project during local next dev runs, set VERCEL_EXPERIMENTAL_DEV_SKIP_LINK=1 in the shell that launches the dev server, or add it to .env.local at the project root, and restart the process. The flag is opt-in, all-uppercase, and only affects local CLI behaviour. It never reaches your deployed build, and the production runtime on Vercel does not read it. If the CLI still tries to link after a restart, scroll to Debugging when the skip link isn't working for the version-compatibility and process-tree checks that catch the cases the basic setup misses. I have shipped this flag in three production monorepos and the same four mistakes account for almost every "I set it and it did nothing" report I see. What VERCEL_EXPERIMENTAL_DEV_SKIP_LINK actually does VERCEL_EXPERIMENTAL_DEV_SKIP_LINK is an opt-in environment variable the Vercel CLI honours when it runs alongside a local Next.js dev server. Its job is narrow: tell the CLI to skip the step where it would normally reach out to Vercel and create or refresh a dev link against your Vercel project. A "dev link", in the Vercel sense, is a local connection record that lets vercel dev and some Vercel-only local emulators (KV, Postgres, Edge Config) pull real values from a Vercel project. It is useful when you want production-shaped data during development, and a real annoyance when you do not — for example in CI sandboxes, offline laptops, monorepo workspaces that share a single project, or any time you want next dev to behave like a plain Node process without the CLI wrapping it. The variable is shipped under the VERCEL_EXPERIMENTAL_ namespace, which Vercel uses to mark features that can change between CLI versions. That has two practical consequences: the name must be uppercase with underscores, and you should not build production logic on top of it. I treat it like a local-dev knob, set per shell session, and never check it into CI as a hard dependen

title: sqlex — A Modern Drop-in Replacement for jmoiron/sqlx published: false description: sqlex is a fully API-compatible modernization of jmoiron/sqlx that fixes 20+ long-standing bugs, adds pluggable hooks, auto IN expansion, and more. Built for Go 1.21+. tags: go, database, sql, opensource If you use sqlx, this is worth 3 minutes of your time jmoiron/sqlx has been the go-to SQL extension library for Go for years. Struct mapping, named parameters, IN clause expansion — it made database/sql actually pleasant to use. I've used it in almost every Go project I've worked on. But here's the reality: its activity has been modest at best, and has slowed to a crawl in recent years. Hundreds of issues sit untouched. PRs go unanswered. Bugs reported years ago are still there, waiting to cause production incidents. This isn't a knock on sqlx — it's a great library with solid design. But an unmaintained foundational library is a liability. So we built sqlex sqlex is a drop-in replacement for jmoiron/sqlx that is 100% API-compatible . All sqlx methods ( Get , Select , Exec , NamedQuery , Preparex , etc.) work identically. Migrating takes 30 seconds — just change the import path: - import "github.com/jmoiron/sqlx" + import "github.com/go-sqlex/sqlex" 🐛 20+ bug fixes from sqlx, all fixed 🚀 New features sqlx never had Auto-Rebind — write ? everywhere, works on PostgreSQL ($1), MySQL (?), SQLite (?), SQL Server ( @p1 ). No more manual db.Rebind(). SQL parsing fixes — colons in strings, :: type casts, ? in comments are correctly handled. Silent bugs from sqlx are gone. Auto IN expansion — slices in IN (?) are detected and expanded automatically on all methods. Hook system — pluggable SQL interceptors for logging, tracing, metrics (onion model). JSONValue[T] — generic JSON column type with auto serialize/deserialize. StrictMode — lenient by default (matching sqlx Unsafe()), optionally strict for debugging. Unified interfaces — Ext / ExtContext / NamedExt / BindExt with compile-time

I Built 9 AI Agents to Run a Gym. Here's the Architecture. The thesis that changed everything Most people think AI in business means: a chatbot → a dashboard → a few automated emails. I think it means: an entire organization runs on specialized AI agents, coordinated by a constitution, accountable to an independent auditor — with one human founder providing direction and warmth. Not a demo. Not a simulation. A real fitness studio in Dongguan Wanjiang, China. Real members. Real revenue. Running since April 2026. Here's the architecture. One Brain, Two Faces, Four Layers Let me start with the big picture, because the architecture is the strategy. ZWISERFIT = AI Operating System for Physical Businesses │ ├── 【Kernel】 9-Agent Enterprise OS (24×7 · full-stack autonomous) │ ├── 【Application Layer】 Saros & Melody │ Saros = Momo(Brain) + SaaS Stack → Digital Store Manager (B2B) │ Melody = Momo(Brain) × 3-Layer Metabolism → Personal Coach (B2C) │ ├── 【Data Layer】 KinTwin │ Hardware sensors + Nova behavioral streams + Ethan ZK proofs │ └── 【Protocol Layer】 Zeus Protocol Cross-domain agent communication + automated data transactions Fitness is the first vertical. Once the protocol runs, insurance, corporate health, and cross-industry data markets come online sequentially. The same architecture, different verticals. The 9 Agents: A Department Store for the AI-Native Company Each agent has domain expertise, a constitution (SOUL.md), identity (IDENTITY.md), memory (MEMORY.md), and cross-validation rules. They don't run on prompts. They run on governance. 🎯 Shuyu — Commander-in-Chief Orchestrates all 9 agents on the founder's behalf. Reads every agent report, coordinates across departments, makes daily strategic calls. The founder sets direction; Shuyu ensures execution 24×7. Role: COO + Chief of Staff, AI-native Output: Daily operational reports, cross-agent coordination logs Constitutional scope: Has authority over all agent scheduling but cannot modify the constitution 💰 Zeus —

为什么我要造一个500行的Agent轮子？ 你好，我是 FROST 的作者。 2026年了，Agent 框架多得能让人挑花眼：LangGraph 有 34.5M 月下载量，Dify 在 GitHub 斩获 129.8K Stars，各大厂商都在疯狂推自己的 SDK。这种环境下，再写一个"轮子"，是不是有点多余？ 说实话，我也纠结了很久。 一个困惑：新学者的两难困境 事情要从一次失败的辅导说起。 我帮一个朋友入门 Agent 开发，推荐了 LangChain。结果他学了两个月，还在和 chain.invoke() 搏斗，脑子里依然没有"Agent 到底是怎么工作的"这个概念。 问题出在哪？ 现在的框架太强了，强到把所有的复杂性都藏了起来。 你可以三行代码跑起来一个 Agent，但你也永远不知道它内部发生了什么。就像学开车，你学会了踩油门转弯，但发动机是怎么工作的、变速箱怎么换挡，一概不知。 而对于想真正理解 Agent 本质的人来说，这是一个巨大的 Gap： 需求 现有选项 快速开发产品 LangChain/CrewAI 理解底层原理 论文 + 源码 入门级教学框架 ❌ 空白 这个空白，就是 FROST 存在的原因。 FROST 的设计哲学：Less is More FROST 不是一个生产级框架，它是一个 教学框架 。 这意味着它刻意放弃了： ❌ 复杂的依赖生态（不需要 LangChain） ❌ 丰富的工具集成（没有 100+ 内置工具） ❌ 分布式部署能力（就是单机 Python） 它只保留了三个核心概念： \ `python Store - 记忆容器（类似神经细胞的存储功能） class Store: """存储上下文、记忆、状态""" def init (self): self.data = {} Skill - 纯函数变换（类似神经细胞的处理功能） class Skill: """输入→处理→输出，无状态""" def call (self, store, *args, **kwargs): pass Agent - 执行单元（类似神经细胞本身） class Agent: """调用 Skill，操作 Store，完成目标""" def init (self, skills: list[Skill], store: Store): pass ` \ 是的，就这么简单。 三个类，不超过 500 行代码。 但正是这种简单，让"理解"变得可能。 一行代码跑起来的 Agent \ `python from frost import Agent, Store, Skill 定义一个"搜索助手"技能 class SearchSkill(Skill): def call (self, store, query): result = web_search(query) # 这里是你的搜索实现 store.set("last_search", result) return result 创建 Agent 并运行 store = Store() agent = Agent(skills=[SearchSkill()], store=store) response = agent.run("北京今天天气怎么样") print(response) ` \ 对比一下用 LangChain 实现同样的功能： \ `python from langchain.agents import AgentExecutor, create_react_agent from langchain_openai import ChatOpenAI ... 还有十几行初始化代码 ` \ FROST 让你从第一行代码开始，就知道自己在做什么： Agent 是执行者 Skill 是它的能力 Store 是它的记忆 没有魔法，没有黑箱，只有清晰的数据流。 为什么叫 FROST？ FROST 的全称是 Fractal Remote Organ of Scalable Thoughts ——可扩展思维的分形远程器官。 这个名字源于它的设计灵感： 神经细胞（Neural Cell） 。 在生物学中，每个神经细胞都很简单： 接收信号 处理信号 发出信号 但当 亿万个神经细胞 连接在一起，就涌现出了智能。 FROST 试图在软件层面复现这个过程： Neural Cell → Agent Synapse → Skill Long-term Memory → Store Brain (Emergence) → Multi-Agent System 这不是在模仿大脑，而是在学习生物界的智慧： 简单单元 + 清晰连接 = 复杂行为。 我的踩坑日记 作为一个从零开始写框架的人，踩的坑比代码行

Most poker solvers answer one question very well: given a single hand and a single decision tree, what is the equilibrium strategy? (Yes, there is subgame solving, node locking, and plenty more — but the default frame is still one hand, one equilibrium.) I kept getting stuck on a different one. What if the same kind of spot shows up over and over, and a player can commit to a fixed strategy across those repetitions? In a few toy games I had a hunch, worked out by hand, that committing to a fixed strategy could change its value relative to the one-shot picture. I wanted a tool that could make that commitment value precise — to actually analyze it rather than just believe it. (Whether any of this rises to a repeated-game equilibrium is a much stronger claim, and one I am deliberately not making here.) I'm still learning software engineering, so until recently I couldn't implement this — I was stuck reasoning about toy games on paper. AI tooling made the analysis feasible, so I finally started building it: repeated-poker-analysis . It's a small research project: write one narrow model down, run small examples, and record what the model does and doesn't justify. What repeated-poker-analysis is It is an experimental Python toolkit for small abstract poker games. The current MVP covers: fixed Hero commitment candidates, exact Villain best-response diagnostics in small finite trees, candidate generation and filtering, T_deadline , an economic adaptation deadline, local T_detect , an observable-distribution sensitivity estimate, analysis reports and Markdown summaries. It is small on purpose. It is not a full solver and it is not wired to real solver ranges. It starts from one toy game — a river spot — that is tiny enough to inspect and test by hand. That toy spot is one where showdown always chops but rake still bites. In a single-hand view, putting more money into a raked pot can be locally unattractive. Across repeated occurrences the same spot raises a commitment questi

AI agents pass tests while producing sloppy thinking. They say "should work" without evidence. They present partial work as complete. They embellish. I built a tiny tool that catches this. It checks any text across four dimensions: Completeness, Consistency, Groundedness, and Honesty. Install pip install self-audit Usage echo "Should work fine. Ready to ship." | self-audit --verbose Completeness: FIXED Groundedness: FIXED [should work fine] FAIL Zero dependencies. Python 3.8+. Stdlib only. 60 lines of core logic. The Four Dimensions Dimension Question What it catches Completeness Did I answer everything? Missing requirements Consistency Did I contradict myself? A-and-not-A patterns Groundedness Did I show evidence? "should work" claims Honesty Am I honest about limits? Embellishment, TODO stubs The dimensions are grounded in Anthropic Constitutional AI framework — Completeness (helpfulness), Groundedness (harmlessness), Honesty (truthfulness), Consistency (rule alignment). Try it on your own output After any AI-assisted coding session, pipe the agent text through self-audit before shipping. You will be surprised what it catches. GitHub: https://github.com/YuhaoLin2005/self-audit Claude Code skill: https://github.com/anthropics/skills/pull/1361

Corgi became embroiled in controversy when Papermark accused it of stealing its software. Corgi says it did not, raising new questions about vibe coding.

I kept correcting AI agents in the same ways: "too long," "answer first," "use a diagram," "assume I know the jargon." Each correction improved the current exchange, but the preference was not represented as durable system state. I built /calibrate-comms to make that state explicit. It is an open-source skill inside an Obsidian vault, used by both Claude Code and Codex. The model: nine operational dials The skill does not try to discover a personality type. It calibrates nine choices that directly change how an answer is rendered: Dial Practical question Density Tight sections or full reasoning? Sequence Answer first or chronological build-up? Modality Prose or diagrams for relational content? Abstraction Concrete example or principle first? Tradeoff One recommendation or several options? Detail Main path or edge cases too? Jargon Define terms or assume expertise? Tone Casual, neutral, or formal? Context-giving Should the agent extract missing context or split an overloaded brief? Prior → calibration → directives The workflow has three stages: L1 PRIOR → L2 SAMPLE REACTION → COMPILE → CLAUDE.md hypothesis empirical override shared by both agents Quick mode asks one bespoke forced-choice proxy per axis. Those questions are deliberately labelled as proxies, not validated psychometrics. Deep mode must fetch the exact items from supported open-access instruments before use; if the source cannot be obtained, the skill stays in Quick mode and makes no validation claim. The prior is then challenged through pairwise samples. For sequence, the contrast looks like this: Build-up first: We traced the latency spike to N+1 queries, then found lazy loading in a loop—so the fix is eager loading. Answer first: Fix: eager-load the association. Why: lazy loading in a loop caused N+1 queries and the latency spike. The user's pick is revealed preference. If it contradicts the prior, the sample wins. The compiler is the useful part The final profile is not a score report. A deterministi

I'm building LOOM — a small open-source language that is a machine-checked trust layer for AI-written code. I don't write it by hand anymore: an organism I built grows it, day and night, on my own machine. This is Day 6, and the whole day went to one thing — WebAssembly . Why this was a real test LOOM already runs three ways: an interpreter, and backends that compile checked code to Python and JavaScript. The thesis is "trust survives translation" — effects and provenance, proven once, hold the same on every target. WebAssembly is the strongest test of that: a low-level stack machine with linear memory, nothing like Python or JS. And there was a constraint. This machine's clang has no wasm target, and I install nothing paid or heavy. So I don't compile to wasm through a toolchain — I emit the wasm bytes myself (LEB128, the type / function / memory / global / export / code sections, the i32 stack machine) and run them through node's built-in WebAssembly . Zero dependencies. From fib to a value runtime, in a day Every step was prototyped and proven (wasm output == interpreter output) before it touched the kernel: The integer core — arithmetic, comparison, if , first-order calls and recursion. fib(10) becomes 61 bytes of real WebAssembly and returns 55, identically on the interpreter, Python, Node and wasm. A value runtime — let and integer lists in a real linear-memory heap (a bump pointer + a $cons cell allocator; head / tail are i32.load , empty is i32.eqz ). A list sums and folds by recursion, inside wasm. Sum types — (variant Tag e) becomes a tagged cell [tag-id | payload] ; match loads the tag, compares, binds the payload, branches. You can watch it: the live playground has a Compile → WAT button and WASM · fib / list-sum / match examples. Type a program, see it become real assembly, in your browser. Honest scope: ints, let , integer lists and sum types compile to wasm today. Records, closures and effects are the next frontiers (closures are the hard one — a func

TMX: The open standard AI agent memory has been waiting for The problem no one talks about: your agent's memories are prisoners. If you build an AI agent today using Mem0, your memories are locked in Mem0. Switch to Zep? You lose everything. Move to a new framework? Start from zero. This is exactly the problem email had in 1970. Every system had its own format. You couldn't send an email from one system to another. Then SMTP was invented. And email became universal. Today I'm publishing TMX v0.1 — the SMTP of AI agent memory. What is TMX? TMX (Truvem Memory eXchange) is an open, model-agnostic JSON format for storing, exporting, and importing AI agent memories across any platform, framework, or provider. It looks like this: { "tmx_version" : "0.1" , "exported_at" : "2026-06-26T20:00:00Z" , "source" : "truvem" , "agent_id" : "my-agent" , "memories" : [ { "id" : "550e8400-e29b-41d4-a716-446655440000" , "content" : "User prefers dark mode and concise responses" , "created_at" : "2026-06-01T08:30:00Z" , "updated_at" : "2026-06-01T08:30:00Z" , "expires_at" : null , "tags" : [ "preference" , "ui" ], "source_model" : "gpt-4o" , "metadata" : {} } ] } That's it. Plain JSON. Human-readable. Portable. Why this matters Right now, the AI agent ecosystem is exploding. Every week there's a new memory provider, a new framework, a new cloud service. But every one of them uses a proprietary format. This means: Developers are locked to their first choice forever Agent memories can't travel between clouds Switching providers = losing everything your agent learned This is the biggest hidden tax in the agentic AI stack. TMX fixes it with a single open spec that anyone can implement — for free, with no approval needed. The 5 core principles 1. Open — No license required. Implement TMX in any product, commercial or otherwise. 2. Model-agnostic — Works with GPT-4, Claude, Gemini, Mistral, Llama, or any future model. 3. Framework-agnostic — LangChain, CrewAI, Mastra, AutoGen — doesn't matter

Hello everyone! For many years, I have been developing equipment control software and long-term support products using .NET/C#. Based on the experiences gained through working with various development teams, I would like to talk about why I created CALM (Cooperative Async Lock-free Messaging) , an open-source library for .NET. The Magic of UI Thread + Event-Driven + async/await My journey with .NET/C# began around the days of .NET Framework 4.0. At the time, code-behind in Windows Forms was incredibly intuitive. It allowed me to join the development team and become productive in a very short period. Back then, executing time-consuming operations on a separate thread and returning the results to the UI thread via callbacks was painful and error-prone. However, the introduction of async/await in .NET Framework 4.5 completely shifted the paradigm. The SynchronizationContext magically handled thread marshaling behind the scenes, and our code became amazingly simple. "Running asynchronous operations safely on a single thread (the UI thread) via an event-driven approach" — this seamless developer experience was my starting point. Divide and Conquer, Dependency Management, and CQS As our product evolved, the codebase grew, and the development team expanded beyond a certain size. Suddenly, the software became exponentially complex. Following industry best practices, we introduced MVP and MVVM patterns to separate the UI from the business logic. We also refactored our domain models based on Domain-Driven Design (DDD) and Clean Architecture principles, alignment with the team's domain knowledge. While this helped organize the logic within individual models, it introduced a new nightmare: complex dependencies between models. We struggled heavily with initialization, especially with models that had circular or mutual dependencies. To break this web of tight coupling, we introduced a mechanism that combined the Observer pattern (inspired by Android's EventBus) with the philosoph