今日已更新 63 条资讯 | 累计 20533 条内容
关于我们

标签：#rce

找到 1469 篇相关文章

AI 资讯

Three Loops, No Ship

I spent three iterations on an auto-fix pipeline that still doesn't work reliably. Here's what I learned. Loop 1 Wrote a background script. Pull tickets from Azure DevOps, run them through a local model, hand to a coding agent, push the result. Poll → triage → fix → push. Worked 40% of the time on trivial tickets. Anything that crossed file boundaries or needed real context — stalled or hallucinated. I shipped it anyway. That was naive. Loop 2 Made it smarter. Pre-selected relevant files. Broke big tickets into subtasks. Turned complex edits into atomic steps with verification between each. Got it to 55% or so. But every fix created two new edge cases. The complexity was compounding faster than the reliability. Loop 3 Went all in. Embeddings for dedup. Multi-repo routing. Auto-revert. A learning loop that fed failures back into future runs. The model server started dying. 890 memory errors in a day. Root cause: two independent consumers hitting the same local model server, each with its own retry loop. When memory filled up, retries amplified instead of staggering. The system was making itself worse. Fixes were simple in hindsight — stop retrying OOM, serialize access, use the local binary not npx. But the pattern kept repeating: add more to fix the last thing, break something else. Where I'm At The pipeline still only works on easy tickets. Hard ones need a human. After three rounds, the main thing I learned is that local models hit a wall before your ambition does — not in quality, in working memory. And adding features doesn't fix reliability gaps. It just moves them around. The 507 retry spiral taught me more than any successful deploy this year. Because it was entirely my fault. Not the model's, not the framework's. I built concurrent consumers with independent retry loops and expected them to coordinate. They didn't. What's Next I'll do a fourth loop. Smaller. A dedicated fast model for cheap work, the big model only for editing. One consumer at a time. Might

2026-06-26 原文 →
AI 资讯

How I built a free tool that shows where Claude Code burns tokens

The problem Just saying "hi" to Claude Code costs ~31,000 tokens . I was paying $500+/month in API costs and had no idea where the tokens were going. So I built tokenwise — a free CLI that shows exactly where your AI coding agent wastes tokens. What it does tokenwise audit — Scan your instruction files It scans your CLAUDE.md, AGENTS.md, and rules files, then shows: How many tokens each file costs per message Boilerplate the AI already knows ("Always write clean code") ALL-CAPS emphasis that doesn't help (NEVER, ALWAYS, MUST) Duplicate sections Unscoped rules that load when they shouldn't tokenwise scan — Analyze your sessions It reads your latest session logs and shows: Token breakdown by component (system prompt, history, tool output) Cache hit rate Top 3 "token hogs" with actionable tips Monthly cost projection The key insight Most people try to compress context (which makes the AI dumber). tokenwise measures first, then applies safe fixes. You can't optimize what you can't measure. Quick start npx @davizin713/tokenwise audit npx @davizin713/tokenwise scan Zero API calls. Zero LLM inference. 100% local. Free forever. Works with 11 agents Claude Code, OpenCode, Cursor, Aider, Cline, Codex CLI, Goose, Continue.dev, Windsurf, Augment, and Kilocode. Links GitHub: github.com/davi713albano-coder/tokenwise npm: npmjs.com/package/@davizin713/tokenwise Built with TypeScript / Node.js js-tiktoken for token counting sql.js for reading OpenCode sessions MIT licensed If you use Claude Code or any AI coding agent, try it and let me know what you think! ⭐

2026-06-26 原文 →
AI 资讯

Your AI-tool usage is invisible. Here are 4 tiny local tools to see it.

You use Claude Code, or ChatGPT, or both, every day. Quick question: how many messages did you send last month? Which model ate most of your budget? How much did prompt caching actually save you? You don't know. I didn't either. That's a weird gap. We instrument everything else — git activity, deploy frequency, test coverage — but the tool we now spend the most hours inside is a black box. The vendor dashboard, if it exists, is a billing page, not a mirror. So I built four tiny tools to fix that for myself. They all run 100% locally . No accounts, no API keys, no telemetry, no network calls. They read files that are already on your disk and print something you can look at. All four are open source on github.com/greymoth-jp — and because that's a real claim, the only thing I'll ask is that you grep the source yourself before you trust me. Here's the privacy point up front, because it's the whole design: these read your data, but your data never leaves your machine. That's not a feature I'm bolting on for a marketing line. It's the reason the tools are small enough to audit in one sitting. The one number that changed how I work Before the tools, here's what I assumed: my Claude Code bill is dominated by the prompts I write, so to spend less I should write tighter prompts. Compress the context. Trim the system message. The usual advice. I ran the numbers on my own ~/.claude transcripts and got this: component share of cost cacheRead 72% cacheWrite ~19% output the rest input ~0.3% Input — the thing everyone tells you to compress — was 0.3% of my spend. Compressing my prompts to save money would've been optimizing the rounding error. Worse: compressing a static prompt changes its bytes, which busts the prefix cache, which can make the bill go up . The real cost center was cache reads: long sessions dragging a fat context forward, turn after turn. That points at completely different levers — cache hygiene (milestone /compact , /clear before the context balloons, keeping C

2026-06-25 原文 →
AI 资讯

The Missing Check After Your Database Query

We have tools for checking whether a query is injectable. We have linters, scanners, ORMs, parameterized queries, and database policies. But after the database returns rows, most applications simply trust that the result set matches the operation that asked for it. queryguard starts there. The query may be safe. The result may still be wrong. SQL injection taught us to distrust query construction. Parameterized queries answered the question: Did the user control the query structure? That question is well understood. The tooling is mature. But it is a different question from the one queryguard asks: Did this operation receive only the rows and fields it was allowed to receive? Those two questions are not the same. A perfectly safe parameterized query can still return the wrong row — because a predicate was dropped, a join widened the result, a developer selected a column they shouldn't have, or a query was rewritten without updating its scope contract. queryguard is not a database firewall. It is not a SQL injection scanner. It is not an ORM plugin. It is a contract check for observed result sets. Where it sits The hook position is the core design decision. queryguard sits immediately after cursor execution — before any result shaping, filtering, serialization, or response mapping. cursor = conn . execute ( sql , bindings ) rows = [ dict ( row ) for row in cursor . fetchall ()] evidence = queryguard . run_check ( contract , { " contract_id " : " user_profile_lookup " , " contract_version " : " 0.1.0 " , " params " : { " user_id " : user_id }, " session " : { " tenant_id " : tenant_id }, " result " : rows , }) if evidence [ " verdict " ] != " PASS " : raise QueryguardViolation ( evidence ) return rows Not at the HTTP layer. Not inside the ORM. Not at the API gateway. Immediately after the cursor returns rows — while the result is still raw, before anything shapes or discards it. This is intentional. If rows are shaped before queryguard sees them, queryguard cannot det

2026-06-25 原文 →
AI 资讯

What actually changed in two weeks

I built a large feature. That's not what this is about. What changed is the baseline — the standards, docs, and automation that exist now and didn't two weeks ago. Everything after this will be built on top of it. Automated tests now ship with new features QA testers were testing. The product was covered. What didn't exist was automation — no E2E suite, no unit tests for new work, no repeatable spec. Now it does. The manual QA cycle stays. The automation catches what humans miss on the tenth pass. Quality leap going forward. Human hours saved. The next feature ships with both. The baseline is set Knowledge lives in the repo. Bug catalog with root causes — so the same thing doesn't get fixed twice. Tech debt inventory with a phased plan. Testing strategy documented, not assumed. GraphQL schema committed and validated against — drift gets caught before it ships. Pre-commit hooks that enforce the standards automatically. The frontend and backend documentation are cross-referenced as single sources of truth. The agent instructions point to the right places. Everything new builds on what's already written. Schema-first development The workflow is now: if the schema accommodates the new field, reuse what exists. If it doesn't, the schema update creates the new structure, the data migrates, and everything stays consistent. No guessing. No drift. One source of truth for what the data looks like. The feature is what you see. The baseline is what you don't — and it matters more.

2026-06-25 原文 →
开源项目

🔥 NanmiCoder / MediaCrawler - 小红书笔记 | 评论爬虫、抖音视频 | 评论爬虫、快手视频 | 评论爬虫、B 站视频 ｜ 评论爬虫、微博帖子 ｜ 评论爬

GitHub热门项目 | 小红书笔记 | 评论爬虫、抖音视频 | 评论爬虫、快手视频 | 评论爬虫、B 站视频 ｜ 评论爬虫、微博帖子 ｜ 评论爬虫、百度贴吧帖子 ｜ 百度贴吧评论回复爬虫 | 知乎问答文章｜评论爬虫 | Stars: 52,587 | 347 stars today | 语言: Python

2026-06-25 原文 →
← 上一页 下一页 →