今日已更新 113 条资讯 | 累计 37664 条内容
关于我们

标签：#rce

找到 2428 篇相关文章

AI 资讯

I built an invoice generator with no backend — the whole app is one HTML file

Every invoicing tool I tried wanted an account, a subscription, and a copy of my client list on its servers — then charged me monthly to put my own logo on my own invoice. So I built the opposite. Billfold is a complete invoice generator that runs entirely in your browser. No account, no backend, no build step. The whole app is a single index.html file you could email to yourself. It's MIT-licensed and the source is right here: github.com/quantum-hacker0/billfold . Here are the three parts that were actually fun to build. 1. "No server" isn't a privacy policy — it's the architecture The usual pitch is "we take your privacy seriously." That's a promise you have to trust. I wanted it to be a fact you can verify : Open DevTools → Network, create an invoice, and count the requests. It's zero. There's nothing to upload because there's nowhere to upload it. Data lives in localStorage . The app is HTML/CSS/JS inlined into one file — no framework, no bundler, no node_modules . Download it once and it works offline forever. 2. Sharing an invoice without a database — put it in the URL hash This was the interesting constraint. How do you send someone a view-only invoice when you have no server to store it on? The trick: encode the whole document into the URL hash fragment . The fragment (everything after # ) is the one part of a URL that browsers never send to the server — it stays client-side. function shareLink ( state ) { const json = JSON . stringify ( state ); const encoded = btoa ( unescape ( encodeURIComponent ( json ))) . replace ( / \+ /g , ' - ' ). replace ( / \/ /g , ' _ ' ). replace ( /=+$/ , '' ); // base64url return location . origin + location . pathname + ' #v= ' + encoded ; } The recipient's browser reads the fragment, decodes it, and renders the invoice locally. The data rides inside the link and never touches a host — not even mine. PDF export, by the way, is just window.print() with a print stylesheet. 3. Invoices as URLs — with an npm package Because the a

2026-08-04 原文 →
AI 资讯

Agent-Reach absorbed Bilibili's 412s — your agent kept working

Bilibili's 412 Incident, Explained: How v1.5.0 Absorbed It In June 2026, Bilibili quietly began rejecting yt-dlp with HTTP 412 errors. Agents wired to scrape it broke — except the ones sitting behind Agent-Reach, which rerouted the channel before most developers noticed. Agent-Reach is a local, MIT-licensed capability layer that gives shell-capable coding agents live internet access by selecting and routing to upstream CLIs rather than proxying data itself . When Bilibili started 412-blocking yt-dlp in June 2026, v1.5.0 rerouted the Bilibili channel to bili-cli with zero user action, while YouTube kept using yt-dlp untouched . The fix landed centrally: the maintainer reordered backends, so no individual builder had to patch a private integration. Quick Answer: When Bilibili began returning HTTP 412 to yt-dlp in June 2026, Agent-Reach v1.5.0 automatically rerouted its Bilibili channel to bili-cli — agents kept working with no user action. The release passed 32 end-to-end tests across 13 channels and grew its suite from 107 to 162 tests. The framing shift matters: v1.5.0 describes itself as a capability layer, not a tool collection. Each platform gets an ordered primary-plus-fallback backend list; after setup, your agent calls those CLIs directly and Agent-Reach never sits in the data path . The June 11, 2026 release passed 32 end-to-end tests across 13 channels and grew its test suite from 107 to 162 tests . Platform Primary backend Fallback Web pages Jina Reader — YouTube yt-dlp — GitHub gh CLI — RSS feedparser — Bilibili bili-cli OpenCLI (subtitles) Twitter/X twitter-cli OpenCLI Reddit OpenCLI rdt-cli XiaoHongShu OpenCLI xhs-cli LinkedIn linkedin-mcp Jina Reader Global search Exa via mcporter — "capability layer: multi-backend routing + real doctor + OpenCLI" — Agent-Reach v1.5.0 release framing (source: Agent-Reach CLAUDE.md ). The behavior is easy to model. The following minimal snippet — which was executed and returns exit 0 — illustrates the "absorb and keep wo

2026-08-04 原文 →
AI 资讯

What If Agent Tasks Were Installable Packages?

Coding agents can now inspect repositories, write tests, configure CI, migrate frameworks, and fix bugs. But the workflows we give them are often surprisingly informal. We copy prompts from old conversations, internal documents, GitHub issues, or random text files. Then we modify those prompts for the current project and hope we did not remove an important instruction. That made me wonder: What if a coding-agent task could be installed, inspected, versioned, and executed like a package? I built Clawx to explore that idea. 🔗 View Clawx on GitHub What is Clawx? Clawx is an open-source package manager for reusable coding-agent tasks. A package is a Markdown file with YAML metadata. The Markdown contains the instructions for the coding agent. The metadata describes information such as: The package name and version Required parameters Environment variables Dependencies Requested tools Supported agent providers A basic workflow looks like this: clawx search gitignore clawx info gitignore-gen clawx run gitignore-gen Before running the task, Clawx lets the user inspect what the package contains and which capabilities it may require. After execution, the run is recorded: clawx history The goal is to make agent workflows easier to discover, review, reuse, and audit. The problem with reusable prompts Saving useful prompts is already a good practice. But a text file containing a prompt usually does not answer questions such as: Which version am I running? Has the content changed? Which tools could the agent use? Which inputs are required? Does another task need to run first? What was executed last time? Can another developer reproduce this workflow? A prompt often contains the task, but not the operational structure around the task. Clawx treats agent instructions as versioned artifacts rather than disposable chat messages. What does a package look like? A simplified Clawx package could look like this: --- name : repo-health-check version : 1.0.0 description : " Analyze a repos

2026-08-04 原文 →
AI 资讯

Mendapi 0.5.5: the one bug we shipped on purpose, now fixed

The 0.5.4 release notes carried an unusual section: Known issue shipped with 0.5.4 . We had spent that whole release fixing the first minute of using the CLI — twelve corrections to help text, exit codes, path handling, and MCP behaviour — and in the middle of it we found one more that did not make the cut. mendapi scan -h did not print help. It ran a scan. Every other subcommand normalized -h to --help before dispatching. scan did not, so the short flag fell through to the scanner, which happily ignored an unrecognized argument and started working. Nobody loses data over this. But it is exactly the kind of thing that makes a first-time user close the terminal, and we had just shipped a release about first impressions. We wrote it down rather than quietly patching over it, because a tool whose entire premise is upstream changes should be visible before they surprise you does not get to hide its own. What 0.5.5 does One change. -h is normalized to --help before any subcommand spawns, so all nine subcommands behave identically: $ npx mendapi@0.5.5 scan -h Usage: mendapi scan --repo <path> --provider <name> --change-id <id> --out <file.json> --json --quiet --include-prereleases The regression gate that covers this now asserts on all nine subcommands, plus a negative control that fails if the assertion ever becomes vacuously true. That second part matters more than the fix: a test that passes because it stopped testing anything is worse than no test. Also in this release The MCP registry entry has been refreshed. com.mendapi/mendapi now carries an icon set and a website URL alongside the package metadata, so clients that render a server picker have something to render. Nothing else changed. scan , fix , deps , review , and pr still run entirely on your machine. No network primitives exist in those files at all, and the build fails if any appear. Install npx mendapi@latest scan Or wire it into an agent: claude mcp add mendapi \ -- npx mendapi mcp Requires Node.js 22.13 o

2026-08-04 原文 →
AI 资讯

OpenAI's Astra Solved 10 Open Math Problems — and the Price Tag Is the Real Story

Every once in a while an AI announcement lands that isn't about a chat UI or a new benchmark, but about the actual substance of what these systems can now do. OpenAI's announcement of ten new results in mathematics and theoretical computer science — produced by an internal version of Astra, their next major model — is one of those moments. Here's what happened, why it matters beyond the math community, and where the honest caveats are. The results The ten problems span high-dimensional geometry, coding theory, arithmetic circuit complexity, group theory, operator algebras, quantum complexity, lattice cryptography, and extremal combinatorics. Highlights include: Non-sofic groups — a construction establishing their existence, addressing a central open question in group theory. Connes's rigidity conjecture — a disproof of a longstanding conjecture about von Neumann algebras. Quantum parallel repetition — an exponential parallel repetition theorem for general two-player quantum games. Multicolor Ramsey numbers — a superexponential lower bound, resolving Erdős problem 183. Closest vector problem — polynomial-factor hardness of approximation, a foundational lattice question tied to post-quantum cryptography. Each argument was prepared into a manuscript by humans working with the model, then formalized by the model into a Lean certificate (the proofs are public on GitHub). OpenAI also released the model's narration of its own thinking process for each solution. The price tag that reframes everything The most striking number in the announcement isn't the math — it's the cost. The total tokens needed to find these solutions would cost roughly $2,000 at Sol API rates . Think about that for a second. Two thousand dollars of compute to resolve open problems that mathematicians have worked on for decades. Some of these (like non-sofic groups) have been open for over a decade of intense effort. We're not talking about a moonshot lab budget — we're talking about the price of a mid

2026-08-04 原文 →
AI 资讯

I Built an Open-Source AI Agent That Actually Controls Your Computer

AI agents are everywhere in 2026. Most of them can answer questions, generate code, or automate simple workflows. But once you ask them to interact with a real computer—browsers, desktop applications, terminals, files, and external services—things quickly become unreliable. That was the motivation behind HeyAgent . The Problem Most autonomous agents fail for one of three reasons: They declare success before the task is actually finished. They lose context during long, multi-step workflows. They aren't designed to work with a real desktop environment. I wanted to build an agent that behaves more like a real assistant instead of just another LLM wrapper. What HeyAgent Does HeyAgent is an open-source autonomous AI agent for computer control and workflow automation. It can: 🖥️ Control desktop applications 🌐 Work inside browsers 📂 Read and manage files 💻 Execute terminal commands 🔗 Connect with external services 📱 Be controlled through CLI, Desktop UI, or Telegram 🧠 Plan and execute multi-step workflows ✅ Verify results before marking tasks as completed Instead of blindly executing prompts, the agent plans, executes, validates the outcome, and only then reports success. Reducing False Task Completion One of the biggest problems I noticed in existing AI agents is false task completion. Many agents click a button, assume everything worked, and immediately report success. In reality, something may have failed several steps earlier. HeyAgent performs additional verification after critical actions to reduce false positives and improve reliability during long-running workflows. Built with AWS Support HeyAgent has been significantly accelerated thanks to the support of AWS. AWS has provided the project with cloud infrastructure, GPU computing resources, and access to modern AI services that made rapid experimentation possible throughout development. From running GPU workloads to evaluating different LLMs and AI models, AWS has been an important part of the engineering process.

2026-08-03 原文 →
← 上一页 下一页 →