标签：#rce

GitHub热门项目 | You're the boss, agents are your team. They handle tasks on their own, message each other, and review each other's work. You just watch the kanban board and give high-level commands. Codex/Claude/OpenCode/Cursor/Grok/GitHub Copilot/Kiro/Z.AI/MiniMax/Kimi(200+ models, 75+ LLM providers, free models no auth). Build your AI company with multiple teams | Stars: 1,680 | 23 stars today | 语言: TypeScript

GitHub热门项目 | A progressive Node.js framework for building efficient, scalable, and enterprise-grade server-side applications with TypeScript/JavaScript 🚀 | Stars: 76,210 | 15 stars today | 语言: TypeScript

GitHub热门项目 | Free AI with your ChatGPT account | Stars: 933 | 109 stars today | 语言: TypeScript

GitHub热门项目 | MCP servers for the UniFi suite of applications, Network, Protect, Access, and Drive | Stars: 579 | 14 stars today | 语言: Python

GitHub热门项目 | 🔥🔥🔥 AI-driven database tool and SQL client, The hottest GUI client, supporting MySQL, Oracle, PostgreSQL, DB2, SQL Server, DB2, SQLite, H2, ClickHouse, and more. | Stars: 26,906 | 399 stars today | 语言: Java

Hey folks 👋 If you've ever wanted to save a video lecture, a livestream replay, or a podcast episode for offline listening, you've probably run into the usual options: sketchy "online video parser" websites that ask you to paste your link into their server, or desktop apps that want you to sign up and upload stuff. Neither feels great when the whole point is your content. I went looking for something better and ended up working with FlowPick — an open-source, privacy-first media downloader that runs entirely in your browser. No uploads, no accounts, no telemetry. Everything (sniffing, downloading, merging, transcoding) happens client-side with FFmpeg compiled to WebAssembly. In this tutorial we'll: Clone and run FlowPick locally Download our first HLS ( .m3u8 ) and DASH ( .mpd ) stream Build and deploy it Poke at the internals so we can customize it If you just want to try it without installing anything, there's a hosted version at https://flowpick.net (more below). The full source is on GitHub: https://github.com/ezwebtools/flowpick . 🔗 Repo: https://github.com/ezwebtools/flowpick · Live tools: https://flowpick.net A 30-second primer: what are HLS and DASH? Before we touch code, two words you'll see everywhere in this space: HLS (HTTP Live Streaming) uses a .m3u8 manifest that lists small .ts (or fMP4) segments. Common for live streams and a lot of video platforms. DASH (Dynamic Adaptive Streaming over HTTP) uses a .mpd manifest; video and audio usually travel as separate .m4s tracks. YouTube and Bilibili lean on this. The key idea: the "video" isn't one file. It's a playlist pointing at dozens (sometimes hundreds) of tiny segments. A downloader's job is to fetch all the segments, decrypt them if needed, and stitch them back into one playable file. That's exactly what FlowPick does — in the browser. What FlowPick is, in one paragraph FlowPick is a Nuxt 4 app that ships in two shapes: A browser extension that sniffs media from the current tab's network requests. An

Nobody has ever asked you to upstream your dotfiles. For thirty years that was the deal with every tool we touched: if you didn't like it, you changed it, and the change lived with you. Then the tools started writing the code, and the deal quietly ended. This essay is about why the deal is back on the table. Because the thing that used to make forking expensive — the labour — is exactly what agents just made cheap. In This Article The Workbench Instinct Then the Harness Era Arrived Forking Was Always the Escape Hatch Code Got Cheap What I Shipped Into My Fork A Feature Does Not Have to Be Useful Your Desire Is the Limit The Fork Is the Destination Now the Discipline Part Bring Back the Joy The Workbench Instinct Show me a developer who has never touched their config and I'll show you someone who hasn't started yet. Vim users brag about their init.lua the way woodworkers talk about a hand plane they've had for twenty years. Emacs people wrote a whole operating system inside a text editor because they could. VS Code won partly because it shipped an extension API and got out of the way. Dotfiles repos are public artifacts, starred and forked, because the setup is part of the craft. This isn't productivity theatre. Some of it is genuine need, some of it is fixing a specific annoyance that only you have, and a lot of it is just fun. All three are valid. The workbench is where the joy lives — and nobody ever waited for permission to alias a command. Then the Harness Era Arrived Then agentic coding tools showed up and quietly changed the shape of the deal. The best-in-class agent harnesses are increasingly vendor-controlled. Claude Code is a product, not a repo you can clone and rebuild. Google announced it's retiring Gemini CLI in favour of a closed-source successor. And note where the line falls: Codex CLI is Apache-2.0 and sitting right there on GitHub, but the Codex desktop app — the thing most people actually click on — is not. The terminal stayed open. The interface

Video transitions are one of those details that quietly shape the feel of an edit. In Reel Quick issue #13 , the goal was simple: let users control how long a scene transition lasts instead of forcing a fixed value. Issue URL: https://github.com/ronin1770/reel-quick/issues/13 The problem The app already supported transition effects between scenes, but the duration was fixed. That meant creators could choose what transition to use, but not how long it should run. For short-form video, that matters a lot: fast transitions create a snappier pace longer transitions feel smoother or more cinematic some edits need no transition at all The feature The new behavior adds a configurable transition duration: minimum: 0.0 seconds maximum: 4.0 seconds step: 0.5 seconds A slider in the frontend lets the user choose the duration, and that value is sent to the backend for FFmpeg video generation. If the value is 0.0 , transitions are disabled entirely. The FFmpeg math When two clips are joined with a transition, the transition overlaps the end of the first clip and the start of the second clip. So the final duration is: final length = clip 1 + clip 2 - transition duration Example 1 Clip 1 = 7 seconds Clip 2 = 8 seconds Transition duration = 4 seconds Math: 7 + 8 - 4 = 11 seconds Final video length: 11 seconds Example 2 Clip 1 = 7 seconds Clip 2 = 8 seconds Transition duration = 0.5 seconds Math: 7 + 8 - 0.5 = 14.5 seconds Final video length: 14.5 seconds Why validation matters This feature also needs guardrails. The backend validates that: the duration is between 0 and 4 the duration is a multiple of 0.5 clips are long enough for the selected transition That last point is important. A 4 second transition cannot work safely if a clip itself is only 3 seconds long. Implementation notes The implementation touches both frontend and backend: Frontend add a transition duration slider show the selected value beside it send transition_duration in the video creation request show inline vali

Most MCP servers I see in the wild start as a quick script and stay that way — no validation, no structured logging, no tests, and a deploy story that means shipping node_modules around. I got tired of rebuilding the same scaffolding every time a client project needed a Model Context Protocol server, so I open-sourced the template I now start every one from: 🚀 mcp-server-template It's a production-ready TypeScript/Node.js foundation for building MCP servers that connect AI agents like Claude Desktop and Cursor to your tools, data, and workflows. 𝗚𝗲𝘁𝘁𝗶𝗻𝗴 𝘀𝘁𝗮𝗿𝘁𝗲𝗱 𝘁𝗮𝗸𝗲𝘀 𝗳𝗼𝘂𝗿 𝗰𝗼𝗺𝗺𝗮𝗻𝗱𝘀: git clone https://github.com/qmmughal/mcp-server-template.git cd mcp-server-template && npm install cp .env.example .env npm run dev That spins up a working server in watch mode. npm test runs the Vitest suite, npm run build bundles everything into a single dist/index.js with esbuild — no node_modules to deploy. 𝗪𝗵𝗮𝘁 𝗮 𝘁𝗼𝗼𝗹 𝗮𝗰𝘁𝘂𝗮𝗹𝗹𝘆 𝗹𝗼𝗼𝗸𝘀 𝗹𝗶𝗸𝗲: Every tool gets a Zod schema, a definition, and a handler — so a malformed AI payload gets rejected with a clean error instead of crashing your process: const schema = z . object ({ text : z . string (). describe ( " The text to process " ), repeat : z . number (). int (). min ( 1 ). max ( 10 ). optional () }); export async function handleExampleTool ( args : unknown , service : ExampleService ) { return withErrorHandling ( " process_text " , async () => { const { text , repeat } = validateArgs ( schema , args ); const result = await service . processText ( text , repeat ); return { content : [{ type : " text " , text : result }] }; }); } 𝗘𝘅𝘁𝗲𝗻𝗱𝗶𝗻𝗴 𝗶𝘁 𝗳𝗼𝗿 𝘆𝗼𝘂𝗿 𝗼𝘄𝗻 𝘁𝗼𝗼𝗹𝘀: Drop a new file in src/tools/ following the same schema → definition → handler shape Register it in src/tools/index.ts — add your definition to the tools list and a case to the switch statement that routes CallToolRequest to your handler Put your real logic in src/services/ so the protocol layer stays thin and your business logic stays unit-testable in isolation Resources (data the

When Your AI Code Reviewers Disagree: Inside the 'AI Debate' That Finds Hidden Bugs Discover how a new paradigm of code review automation pits two AI agents against each other in a structured AI debate, using agent consensus to uncover nuanced bugs that single-agent systems miss. See a real example of AI pair review in action. The End of the Single Perspective Code Review Traditional automated code review tools often operate from a single, deterministic rule set. They flag violations of style guides, potential security flaws, or common anti-patterns with a yes/no verdict. But this approach fundamentally misses the nuance of software development: context. Is a seemingly risky pattern actually a carefully considered workaround? Is a deviation from the norm a brilliant optimization or a latent bug? This is where the old paradigm fails, treating code as static text rather than a dynamic system of intent and consequence. Imagine a different approach. Instead of one monolithic AI passing judgment, what if you deployed two specialized AI agents to review the same code change? Their core directive: engage in a rigorous, technical **AI debate**. One agent is programmed to be a strict adherent to best practices and correctness. The other is trained to understand historical code patterns, developer intent, and often-overlooked performance trade-offs. This is the foundation of **AI pair review**, a method that moves beyond simple flagging and into the realm of collaborative analysis. The Scenario: A Performance Bottleneck with a Catch Let's examine a concrete example. A developer submits a change to a data processing pipeline in a Python application. The core function now includes a caching layer to avoid redundant, expensive database calls. The code change looks clean at first glance. def process_user_data(user_ids): # Cache to avoid repeated DB hits for the same ID in a batch user_cache = {} results = [] for uid in user_ids: if uid not in user_cache: # Simulate an expensive D

Let’s be honest: manual diet tracking is a chore that almost nobody finishes. We start with good intentions, but typing "150g of grilled chicken" and "half a cup of brown rice" into an app every day is a recipe for burnout. But what if you could just snap a photo and let Multimodal AI do the heavy lifting? 📸 In this tutorial, we are building a production-ready automated nutrition logging system. We will combine the surgical precision of the Segment Anything Model (SAM) with the reasoning power of GPT-4o Vision . By the end of this post, you'll know how to transform raw pixels into a structured JSON of calories, macros, and portion sizes using FastAPI and Pydantic . We'll cover key concepts in Image Segmentation , Computer Vision , and LLM Structured Outputs . The Architecture: From Pixels to Proteins To get accurate results, we can't just toss a messy photo at an LLM and hope for the best. We need a pipeline that identifies individual food items, isolates them, and then performs a multi-step inference. graph TD A[User Uploads Food Image] --> B[FastAPI Backend] B --> C[SAM: Segment Anything Model] C --> D[Generate Individual Food Masks] D --> E[GPT-4o Vision: Multi-crop Analysis] E --> F[Pydantic Validation] F --> G[Structured Nutrition Report] G --> H[User Dashboard] Prerequisites To follow along, you'll need: Python 3.10+ OpenAI API Key (with GPT-4o access) FastAPI & Uvicorn (for the web layer) Segment Anything Model (SAM) weights (or a hosted inference API) Step 1: Defining the Nutrition Schema The secret to a reliable AI system is Structured Output . We don't want a "chatty" response; we want data our database can consume. We'll use Pydantic to define exactly what a "Meal" looks like. from pydantic import BaseModel , Field from typing import List class FoodItem ( BaseModel ): name : str = Field ( description = " Name of the food item " ) estimated_weight_g : float = Field ( description = " Weight in grams " ) calories : int = Field ( description = " Total calorie

We just closed the finalization record for Directions 1 through 3 in our knowledge and memory management subsystem. This covers the core pipeline: ingestion, storage, retrieval, and context integration. Here’s what that actually means for the architecture, why we made specific tradeoffs, and how to use it in your own stack. The project has been iterating on how to decouple knowledge persistence from runtime memory while maintaining a unified query interface. Directions 1-3 form the foundation: a document store, a vector index, and a structured memory buffer that combines both. No more ad hoc caching or reinventing the retrieval loop. Everything lives behind a single KnowledgeGraph interface. Direction 1: Raw Document Ingestion and Storage We settled on a partitioned document store backed by a local SQLite database with a blob column for serialized content. Each document entry stores a UUID, source URI, raw text or bytes, a content hash, and a timestamp. The ingestion pipeline deduplicates by hash and runs through an optional extractor chain (e.g., PDF parser, markdown splitter, code chunker). The design decision is to separate storage from indexing entirely. The store is dumb—it only handles CRUD and metadata queries. This keeps the ingestion path simple and testable. Direction 2: Vector Index with Filtered Search Instead of building our own vector database, we wrapped existing infrastructure—Pinecone and a local FAISS fallback—behind an abstraction layer. The finalization record specifies a mandatory metadata filter set that must be packed into every upsert and query call. Each vector embedding carries a document UUID, chunk index, and a free-form tags map. This enables queries like “retrieve all chunks where module == 'networking' and version >= '2.0' ” without scanning unrelated vectors. The finalization also enforces a max-k retrieval of 50 with a similarity threshold of 0.65. Below that, the system returns an empty set rather than noisy garbage. We decided to p

Hi everyone,I just released my first package — strides/laravel-api-module.The idea was simple: stop copying the same boilerplate code every time you create a new API resource. So I made a generator that creates a clean module structure using the Action + Repository + Transformer pattern.What you get with one command:Action classes Repository with interface Transformer (using spatie/laravel-data) Model and migration Routes file The package is well documented with examples.Would love to hear your feedback and suggestions!Links:Documentation: https://strides-hovo.github.io/Laravel-api-module/ GitHub: https://github.com/strides-hovo/Laravel-api-module Packagist: https://packagist.org/packages/strides/laravel-api-module

Lessons from wrapping grok-build — the architecture, the traps, and why we picked Tauri over Electron. TL;DR grok-build is xAI's open-source Rust coding agent. It ships as a TUI. We wrote a native desktop client for it — Tauri 2 (~8 MB binary), React frontend, Rust runtime that spawns the CLI as a child process and talks to it over ACP/JSON-RPC 2.0. This post is the architecture deep-dive: how the pieces fit together, what surprised us, and the parts we'd build differently next time. The full source is at github.com/timexingxin/grok-gui . MIT-licensed. Demo GIF in the README. The problem grok-build is genuinely good at code work — comparable to Claude Code for my workflow. But it ships as a Rust TUI. After six months of cmd+tab between the terminal and my browser tabs, I wanted a real desktop UX without losing what makes the CLI good. The naive options all had problems: Wrap it as a tmux session in a webview. Doesn't help — you're still reading scrollback. Use a community-built web wrapper. They all wrap the OpenAI Chat Completions API directly. They don't talk to the actual agent runtime, so they miss tool calls, plan updates, permission requests, and the streaming event surface that makes coding agents feel responsive. Write a desktop GUI from scratch. Means re-implementing the agent loop, the model integration, the tool calling. Six months of work, plus the resulting client would always lag the upstream. The right answer was staring at me: grok-build already has a JSON-RPC 2.0 over stdio interface called the Agent Client Protocol (ACP). That's the protocol I should be a client of. My job is just to write the client. What is ACP? ACP is a JSON-RPC 2.0 protocol that coding-agent CLIs expose over their stdin/stdout. The agent emits notifications (text deltas, tool calls, plan updates, permission requests, session lifecycle); the client sends requests (user prompts, permission responses, model switches, session loads). If your agent speaks ACP, you can write a client

Hello DEV Community! 👋 I wanted to share my latest open-source project: Hunter-Base-Intelligence (v17 Plus). It is a fully local-only cryptocurrency intelligence dashboard that scans DEX tokens on the Base blockchain, scores them using a multi-factor logic, and simulates a paper-trading shadow portfolio. 🛡️ Why Local-Only? Most on-chain analytics tools require sensitive private keys, leak user data, or rely heavily on slow, paid external infrastructure. I engineered this tool to be fully local —it requires no wallets, no seed phrases, and sends your data nowhere. Pure local analysis using Python , Flask , and SQLite . ⚙️ How It Works (Core Architecture) The ecosystem runs on a continuous ~60-second scan cycle: scanner.py : Discovers active and newly created tokens using DexScreener, BaseScan, and direct EVM RPC factory logs. scorer.py : Every token is evaluated across 6 independent dimensions (Momentum, Manual Trade Feasibility, Execution Reality, Money Flow, Multi-Timeframe Pulse, and Composite Rank). hunter_court.py : A proprietary "Court" analytics engine that runs a risk-free paper-trading shadow portfolio with realistic gas, fee, and slippage simulation. It evaluates its own past decisions to continuously calibrate scoring thresholds! 📊 System Features Adaptive Exit Parameters: Automated position sizing and execution simulation ( exit_engine.py ). System Guardian: Keeps the system running 24/7 with auto-restart on crashes and automatic local database backups ( system_guardian.py ). Beautiful Dashboard: Clean, real-time local web interface for tracking active simulated trades and market analytics. 📂 Explore and Contribute The project is licensed under the MIT License and is open for contributions. Whether you want to optimize the scoring algorithms, expand the web API endpoints, or improve the dashboard frontend, feel free to dive in! 👉 Check out the Repository here: https://github.com/shbadrconsulting-source/Hunter-Base-Intelligence I would love to hear your fe

Founder Journal #1 — The Beginning of NAEOS "Great software isn't built on great code alone. It's built on great foundations." The AI Revolution Is Here In just a few years, artificial intelligence has transformed the way software is built. Today, developers can ask AI to generate functions, refactor code, write tests, explain bugs, and even build entire applications. Tools like ChatGPT, Claude Code, GitHub Copilot, Cursor, Gemini CLI, and many others have fundamentally changed software development. The question is no longer: "Can AI write code?" The answer is clearly yes . The real question has become: "Can AI engineer software?" And that is a very different challenge. Writing Code Is Easy. Engineering Software Is Hard. Generating code is only one small part of software engineering. A production-ready system requires much more: Understanding business requirements Software architecture Coding standards Documentation Security policies Testing strategies Version control CI/CD Deployment Observability Team collaboration Long-term maintainability These are not isolated tasks. They form a connected engineering system. Most AI tools today excel at generating code, but they still rely heavily on humans to provide context, rules, and architectural direction. Without those, AI becomes inconsistent. The Hidden Cost of Every New Project Every time I started a new software project, I noticed the same pattern. Before writing meaningful business logic, I spent hours—or even days—recreating the engineering foundation. I had to: Decide on the architecture. Create folder structures. Define coding conventions. Write prompt libraries. Configure AI agents. Build documentation. Establish workflows. Create engineering rules. Configure quality gates. Explain the project to AI over and over again. The project changed. The technology changed. The AI model changed. But the engineering work kept repeating. Again. And again. And again. AI Can Remember Conversations. But Projects Need More Than

Building Astra: A Modern Shell in Rust I've been working on a personal project called Astra , an interactive shell written in Rust. The goal isn't to replace every existing shell overnight. Instead, I'm building a clean, modular foundation that's easy to understand, extend, and contribute to. Some of the features currently in development include: Interactive shell loop Customizable prompt system TOML-based configuration Built-in themes Git-aware prompt Command history Tab completion Alias support Plugin framework (early development) Alongside the shell itself, I'm also putting together the surrounding ecosystem—documentation, packaging, examples, tests, and GitHub automation—so contributors have a solid starting point. This project has been a chance to learn more about Rust, shell design, and how larger open-source projects are organized. It's still early, but it's reached the point where the foundation is in place and I'm beginning to focus on expanding features, improving reliability, and increasing test coverage. Check out the project here: astra-shell / astra-shell A custom shell for mac OS! █████████████░░░░░░░░ 65% Astra Shell A modern shell built in Rust for Unix-like systems, with macOS as the primary development platform. Astra is an interactive command-line environment focused on a clean interface, customization, and a better terminal experience. It combines the power of traditional Unix shells with a modern prompt system, configuration, and extensibility. Warning Astra Shell has not gone through extensive testing yet. Wait until the first stable release before using it as your primary shell. Table of Contents Features Screenshots Installation Requirements Usage Themes Why Astra? Contributing License Status Features Interactive Rust shell Configurable prompt engine Multiple built-in themes Git-aware prompt information Command history Tab completion Alias support TOML configuration Built-in shell commands Modular architecture Plugin framework (in developmen

TL;DR: We checked Halonyx — our self-hosted E2EE messenger implementing X3DH + Double Ratchet — against the EU's Chat Control, US EARN IT Act, India's IT Rules 2021, the UK's Online Safety Act + Investigatory Powers Act, and the UN Cybercrime Convention. Here's the honest answer for each. When you implement end-to-end encryption from scratch, you spend a lot of time thinking about cryptographic threat models. Key substitution attacks. OPK exhaustion. WebRTC IP leakage. The adversaries you model are largely technical. At some point, you have to model a different kind of adversary: the legal one. We built Halonyx — a self-hostable E2EE messenger implementing the Signal Protocol (X3DH key exchange, Double Ratchet, Safety Numbers, WebTorrent P2P file transfer). The server architecturally cannot read your messages — not by policy, but because it holds no decryption keys and no plaintext. We wrote a STRIDE threat model across 17 attack surfaces. We did not write a legal threat model. So we did. This is what we found across five jurisdictions. None of this is legal advice. All of it is current as of July 2026, in a policy landscape that is actively moving. Quick Architecture Recap Before the jurisdiction breakdown, a one-paragraph recap of what Halonyx actually does, because the architecture is what determines the legal exposure. The relay server stores and forwards only AES-256-GCM ciphertext. It holds no private keys, performs no cryptographic operations on behalf of users, and has no mechanism to identify message content or originators. User identity is a pseudonymous 256-bit USID — the server stores only SHA-256(USID) . Files transfer peer-to-peer via WebTorrent; the server receives only a magnet URI. This architecture — which we call Federated Relay Architecture (FRA) — is what creates the legal situation described below. 1. European Union — Chat Control / CSAR Current status: No conflict with anything currently in force. The EU's Child Sexual Abuse Regulation (CSAR),

In 2017 the National Archives and Records Administration (NARA) released the JFK files in an unsearchable manner 🔍. I tried doing manual research 🕵🏻. I relied on their provided CSV file of metadata to look for relevant documents to discover something - but I was looking for a needle in the haystack. I didn't know where to begin - but at the very least, I wanted to be able to search the contents therein. At least the National Archives allowed me to bulk download the PDFs. From that, I was able to birth the Apario Writer . In 2020, I began with rails new phoenixvault 🐦‍🔥 and I proceeded on a Zoom call with DJ Nicke - a former animator at Disney - to watch me build the proof of concept of the crowd sourcing declass utility that I envisioned. You see, when I was 7 years old, I had a dream after watching a space focused science program on TV that involved me sitting at the home computer, but interacting with an advanced interface that would help me uncover the mysteries of the day and time of the era. In Stargate SG-1, this concept was explored with the Tolan where Nareem was shocked to discover what Teal'c found in the records buried within a full text interface. Connecting it back to the JFK files released by NARA, they were unsearchable. Agenda on why aside, what could I do about it? This proof of concept grew into a SaaS platform that cost me $7,000 per month to operate over 12 bare meta servers in a private cloud using ESXi. This interface worked, but it was going to be replaced by a cost saving solution architected from the ground up in Go to reduce the dependency graph of the SaaS solution down to a single binary . In order to do this, I needed to create a pipeline. Looking at the SaaS model, I had a series of sidekiq jobs that compiled the assets. In order to improve the performance of that process, running off from Ruby code, I needed to build a new binary from the ground up using Go. I took the course on YouTube from Matt Holiday called Programming In Go and wa

Run two AI coding agents on the same repo and the first thing that breaks is not the code. It is coordination. Agent A starts refactoring auth. Agent B, running in parallel, has no idea and starts the same thing. Neither remembers what it did last session, because each one boots fresh with an empty context window. The usual fixes are worse than the problem: a state file in the repo pollutes every diff and conflicts on merge, and an external issue tracker means API tokens, rate limits, and a hard dependency on the network for something that should be local. So I built grite : an issue tracker that lives inside your git repository as an append-only event log, with deterministic CRDT merging so two writers never conflict. No server. No database. No merge conflicts. Just git. The core idea: issues are events, git refs are the log Grite does not store issues as files in your working tree. It stores them as an append-only write-ahead log inside a git ref, refs/grite/wal . Every action, a create, a comment, a label change, is one immutable CBOR-encoded event appended to that log. Your working tree stays completely clean. The only tracked file grite ever writes is AGENTS.md , and that is on purpose, so agents discover the tool automatically. Because the state lives in a git ref, it travels with your code. It branches when you branch. It merges when you merge. It syncs when you git push . If you can push to a remote, you can sync issues. There is no new account, no new infrastructure, no new protocol to learn. How it works Three layers, cleanly separated. The git WAL is the source of truth. Events are appended as CBOR chunks, each identified by a content-addressed EventId that is a BLAKE2b hash of the event body. Content addressing is what makes the log tamper-evident: change one byte of an event and its ID no longer matches, which breaks the chain. Signing is optional Ed25519 per event, so you can prove which actor created what. The materialized view is a sled embedded key-