标签：#rce

GitHub热门项目 | Grok2API 是一个基于 FastAPI 构建的 Grok 网关，支持将 Grok Web 能力以 OpenAI 兼容 API 的方式转换。 | Stars: 5,532 | 112 stars today | 语言: Go

Anyone who has used AI tools for a while has probably run into this annoyance. You ask it to write a weekly report in the morning and it doesn't know your KPI framework was overhauled last week. You ask for a technical proposal in the afternoon and it has no idea you spent three months locking down your tech stack. Every new conversation means re-explaining the project background, which decisions were made and why. In multi-person collaboration the problem scales up fast. Five people each interacting with AI separately; the AI's understanding of each person is isolated. A discusses an architecture decision with the AI, B has no idea that conversation happened. Five people are repeating the same explanations and none of them know the others already did. Context Fragmentation Has Nothing to Do with Model Capability Current mainstream AI tools store memory as conversation history stuffed into a context window. When the window fills up, older messages get truncated. That works fine for a single conversation but falls apart in cross-day, cross-week team collaboration. Even with 128K token support, cramming all project history in there causes information density to collapse and the model loses the ability to focus on what matters. Team collaboration needs memory across several layers. Project background, tech stack choices, the reasons behind past pivots; this long-term context doesn't appear in any single conversation but affects every task. One team member prefers concise communication while another wants detailed reasoning; the AI should remember these differences instead of outputting the same format for everyone. Last week's design decision and why it went that way, how that choice affects this week's sprint planning; if the AI can't see these connections, its suggestions will clash with earlier direction. Some products use vector retrieval to extend memory, storing past conversations as embeddings and recalling relevant snippets by semantic similarity when needed. T

I spent a chunk of last year around legacy modernization work — the kind of project where a bank or an insurer is taking twenty years of accumulated code and rebuilding it as modern services, one system at a time. Every one of those systems starts the same way: a PRD or a requirements document says what the business needs, that gets translated into a spec precise enough for an AI to implement, and eventually someone tests what came out. What struck me, watching this happen at scale, wasn't that the code was bad. It was that nobody was testing the thing that actually determined whether the code would be bad: the spec itself — the technical description handed to the model, not the PRD that motivated it. Every security tool I looked at — SAST scanners, DAST tools, even the AI coding assistants themselves — waited until an implementation existed before doing anything adversarial. Attack the code, once it's there. That's the whole industry's model, and it's worked fine for forty years because the volume was always survivable. A team ships a handful of PRs a week, a human reviews them, and eventually a pentest catches whatever slipped through. That math falls apart at modernization scale. When you're regenerating a few million lines of code, you're also generating a few thousand specs, faster than any review process was ever built to absorb. Testing after the fact doesn't just get slower under that load — it quietly stops happening, spec by spec, until the aggregate exposure is enormous and nobody can point to when it happened. So I built GAUNTLEX to test the thing that happens before the code does: the spec. This is also where I want to be precise about a word that gets overloaded. "Spec-driven development" — the broader industry shift toward writing structured, agent-facing specs instead of prompting an AI free-form — is exactly the world GAUNTLEX lives in. But a spec (what to build, precise enough for a model to implement) and a PRD or requirements doc (why it's needed

FROST周报 | 为什么智能体需要「谱系」？从生物学隐喻看AI治理新范式 作者按 ：本文是 FROST 开源项目的每日推广系列文章，周一深度篇。 一、一个被忽视的根本问题 当我们谈论 AI Agent 时，大多数讨论都聚焦于「能力」：能不能写代码？能不能调用工具？能不能规划任务？ 但有一个根本问题很少被触及： 当一个 Agent 执行了错误的决策时，谁来负责？当它消亡后，它的经验能否被传承？ 就像一个没有记忆的人，每次醒来都是白纸一张——这不叫智能体，这叫复读机。 FROST 正是为了解决这个「治理真空」而诞生的。 二、从细胞分裂到 Agent 家族 FROST 的核心哲学只有一句话： 细胞会死，但谱系会存续。Agent 会消亡，但宪法会传承。资产会永存。 这不是文学修辞，而是一套完整的技术架构。 四个原子：最小可行集合 FROST 只定义了四个原子，却能构建任意复杂度的智能体系统： 原子 职责 生物类比 Store 记忆容器，只做 save/load/delete 细胞核 Skill 纯能力单元，无状态无副作用 蛋白质 Agent 膜包裹的细胞，拥有 Store + Skills 神经细胞 SOP 有序步骤列表，可教学、校验、优化 宪法文本 from core import Store , Agent , skill_set , skill_get # 创建一个最小 Agent store = Store () agent = Agent ( " cell " , store , skills = { " set_context " : skill_set , " get_context " : skill_get }) # 执行任务 result = agent . run ( sop_steps = [ " set_context " , " get_context " ], initial_context = { " key " : " message " , " value " : " FROST is alive " } ) # result["_result"] == "FROST is alive" 关键洞察 ：Store、Skill、Agent、SOP 这四个概念彼此正交，可以自由组合。就像乐高积木，从简单到复杂，始终保持可解释性。 三、家族治理：超越扁平架构 传统的多 Agent 系统通常是扁平的：所有 Agent 平等对话，没有层级，没有记忆，没有责任边界。 FROST 引入了「家族治理模型」——一个三层递归结构： 祖辈 (Ancestor) ：定义不可违背的宪法与长期目标 父辈 (Parent) ：领域协调者，可递归委托 孙辈 (Leaf) ：执行具体原子任务，瞬态存在 四个协议保障治理闭环 ： 层级 Store 继承 ：祖先记忆只读，后代自动继承 SOP 宪法校验 ：祖辈审核后代 SOP，拒绝违规执行 编排层级限制 ： max_spawn_generation 硬编码，禁止越级 spawn 选择性持久化 ：父辈收割有价值产出，淘汰冗余 Agent 四、V5.0 五维元模型：多维治理架构 2026年7月发布的 V5.0 引入了一个重大升级—— 五维元模型 ： 维度 模块 核心职责 武器注册表 Armory 能力的元数据管理与发现 任务注册表 TaskRegistry DAG 任务编排与图谱 SOP 事件编目 EventCatalog + Strategist 态势感知与双模式事件分析 平台注册表 PlatformRegistry 外部能力的发现、调用与健康检查 规则注册表 RuleRegistry 可版本化的治理约束与合规检查 197 个测试用例 保障了每个维度的质量。 五、与现有框架的差异 维度 LangChain CrewAI FROST 状态管理 链式传递 角色记忆 层级 Store 权限边界 无 提示词软约束 代码强制只读 治理可审计 无 对话日志 结构化执行历史 架构无关 ✅ ✅ ✅ FROST 不重复造轮子。它填补的是「治理」这个空白地带： 让多智能体系统真正可控制、可追溯、可进化 。 六、快速体验 # 克隆仓库 git clone https://gitee.com/liao_liang_7514/frost.git cd frost # 运行测试 python -m pytest # 查看示例 python frost_run.py 完整文档： https://gitee.com/liao_liang_7514/frost 七、写在最后 AI Agent 的下一阶段，不是更强的模型，而是 更好的治理 。 当我们把 100 个 Agent 放在一起时，如果没有宪法、没有层级、没有记忆传承

Spent the week balancing deep p2p networking work in Python with some much-needed UI polish on my personal site. 11 commits and 6 PRs later, I hit a perfect 7-day streak and made the codebase a bit more secure. TL;DR This week was all about the "invisible" work that makes software feel solid. I spent a good chunk of time in the weeds of p2p networking, specifically hardening WebRTC implementations, while also carving out time to refine the typography and feel of my personal portfolio. With 11 commits across 5 repos and 6 PRs in flight, I managed to keep the momentum going every single day of the week. WHAT I BUILT Most of my direct commit activity this week was split between keeping my dev environment sharp and making my portfolio feel a bit more "me." Portfolio & Personal Branding I spent some quality time in yashksaini-coder/portfolio . If you're like me, you can't leave your personal site alone for more than a month. I pushed a few updates to the blog content, but the real fun was in the UI/UX tweaks. I swapped out the primary typography for JetBrains Mono —there’s just something about a good monospace font that makes a dev portfolio feel right. I also went through a "make-interfaces-feel-better" phase. I refactored the selectedwork section, specifically dropping a cursor-follow preview tile that felt a bit too "heavy" and replaced it with something more streamlined. I also polished the index rows to make the transitions feel snappier. It’s about +452/-279 lines of code, which is a healthy amount of churn for a week that was supposed to be about "minor" updates. The Maintenance Grind My nvim config is basically a living organism at this point. I have CI set up to automatically track plugin updates, and this week was particularly noisy with 6 commits just keeping the toolchain current. It’s [skip ci] territory, but it ensures that when I sit down to actually write code, my editor isn't lagging behind the latest Lua API changes. I also did a quick version bump for

Disallow: GPTBot is a wall. Walls don't pay rent, and the crawlers that matter most either ignore them or route around them. If your content is worth training on, the interesting question isn't "how do I keep the bots out" — it's "what do they owe me, and how do I say so in a way a machine can read." That's what RSL (Really Simple Licensing) is for. It shipped 1.0 in December 2025 with around 1,500 publishers behind it — Reddit, Yahoo, Quora, O'Reilly, Medium, Vox. This post is a from-scratch walkthrough of what the format actually is, the six places you can put it, the one mistake that makes crawlers silently ignore your terms, and where the declaration stops and enforcement begins. No tooling required to follow along — it's all plain XML and HTTP. The format is an XML vocabulary, not a config file An RSL document says: for this content, here's what's permitted, what's prohibited, and what it costs. Minimal example: <?xml version="1.0" encoding="UTF-8"?> <rsl xmlns= "https://rslstandard.org/rsl" max-age= "7" > <content url= "/" > <license> <permits type= "usage" > search </permits> <prohibits type= "usage" > ai-train </prohibits> <payment type= "crawl" > <amount currency= "USD" > 0.015 </amount> </payment> </license> </content> </rsl> Read it out loud: search engines may index this; training on it is prohibited; if you want to crawl it anyway, the rate is $0.015. usage tokens include search , ai-train , ai-use (inference/grounding), and a few more. You can scope rules by user and geo too. One rule that trips people up: prohibition wins . If the same token shows up under both permits and prohibits , the content is prohibited. Don't try to express "allowed except for X" by listing X in both — just prohibit X. The namespace is the thing crawlers actually key on The single most common way to publish RSL that quietly does nothing: getting the namespace wrong. It must be exactly: xmlns="https://rslstandard.org/rsl" http instead of https , a trailing slash, or a plausible

GitHub热门项目 | 🧰 The Rust SQL Toolkit. An async, pure Rust SQL crate featuring compile-time checked queries without a DSL. Supports PostgreSQL, MySQL, and SQLite. | Stars: 17,291 | 15 stars today | 语言: Rust

GitHub热门项目 | CloudFlare free temp domain email 免费收发 临时域名邮箱 支持附件 IMAP SMTP TelegramBot | Stars: 10,331 | 38 stars today | 语言: TypeScript

GitHub热门项目 | There can be more than Notion and Miro. AFFiNE(pronounced [ə‘fain]) is a next-gen knowledge base that brings planning, sorting and creating all together. Privacy first, open-source, customizable and ready to use. | Stars: 70,354 | 48 stars today | 语言: TypeScript

GitHub热门项目 | Pure Javascript OCR for more than 100 Languages 📖🎉🖥 | Stars: 38,359 | 167 stars today | 语言: JavaScript

GitHub热门项目 | Zapret (Запрет обход блокировки Дискорда и Ютуба) | Stars: 1,335 | 18 stars today | 语言: Python

GitHub热门项目 | Advanced UX and interoperability extension for Wand (WeMod) app | Stars: 6,575 | 661 stars today | 语言: C#

GitHub热门项目 | An open-source background agents coding system | Stars: 2,155 | 9 stars today | 语言: TypeScript

GitHub热门项目 | 100+ AI Agent & RAG apps you can actually run — clone, customize, ship. | Stars: 118,237 | 549 stars today | 语言: Python

GitHub热门项目 | Prefect is a workflow orchestration framework for building resilient data pipelines in Python. | Stars: 23,014 | 55 stars today | 语言: Python

GitHub热门项目 | The Destructive Command Guard (dcg) is for blocking dangerous git and shell commands from being executed by agents. | Stars: 2,367 | 444 stars today | 语言: Rust

Hey everyone, I change servers more often than I probably should. A discounted VPS or a good coupon is usually enough to convince me, but manually recreating the same web stack every time stopped being fun a long time ago. That is why I built HostShift , an Apache-2.0 licensed Go CLI for discovering, planning, migrating, and verifying Ubuntu and Debian servers. The rule I would not compromise on The source server must remain read-only. HostShift does not install packages, stop services, enable maintenance mode, create temporary archives, or change configuration on the source. It reads approved facts and streams data directly to the target. Any target mutation requires an explicit CLI apply command. What it currently covers Docker Compose projects and standalone containers MySQL/MariaDB, PostgreSQL, and Redis Nginx, Apache, Caddy, and systemd services SSH and firewall configuration PHP-FPM, Supervisor, Fail2ban, Certbot, and Logrotate Migration planning, audit journals, status, resume, rollback metadata, and verification checks The migration engine is deterministic Go code and does not need AI. I also added an optional Codex plugin and a deliberately non-apply MCP interface for discovery, planning, review, and dry runs. Actual changes stay in the human-operated CLI. Testing real migrations I did not want to call it tested just because a few unit tests passed. The repository includes Docker migration matrices and real Lima VM matrices covering Ubuntu 22.04, Ubuntu 24.04, Ubuntu 25.10, Debian 12, and Debian 13, including cross-distribution moves. The VM tests also reboot the target and verify persistence while comparing source snapshots before and after the migration. The project is still new, so I expect real-world edge cases. I am sharing it now because feedback from people who actually move and maintain servers will be more useful than polishing it alone forever. GitHub: https://github.com/oguzhankrcb/HostShift Documentation: https://hostshift.karacabay.com

OrbitLens Ace → ace.orbitlens.io A busy quarter is easy to stage. Code that's still there in two years isn't. Pick any metric a team has ever used to judge people, and someone has quietly figured out how to move it without doing the underlying thing. Lines of code rewarded typing, so people typed. Commit counts rewarded committing, so commits got smaller and more frequent. Velocity rewarded closed points, and points drifted upward until a "3" meant nothing. DORA measured how often you deploy, so teams shipped trivial changes just to move it. Even churn — the number the "code health" tools lean on — is something you can lower on purpose, which means you can manage the number instead of the mess underneath it. None of that requires dishonest engineers. It's Goodhart's law doing what it always does. Every one of those numbers is a measure of activity , and activity is cheap to produce. Once you're paid for activity, the fastest way to get paid more is to produce more of it — not more of whatever the activity was supposed to be a sign of. So the question worth asking isn't which activity metric is least bad. It's whether a git history contains anything at all that you can't move just by being busier. It turns out there's one. And it's not because we were clever — it's because of what the thing is actually made of. What lasts isn't something you do Take everything a person wrote, wait a while, and ask a smaller question than "did they work hard." Ask whether the specific lines are still there. Not reverted, not rewritten, not quietly swallowed by someone else's refactor. Still holding weight at HEAD. That's survival. We read it with time-decayed git blame : a line's weight fades month by month unless the line keeps existing, and it counts for more once other people have built on top of it instead of leaving it as a private island. Survival that others have built on is what we call gravity — the structural pull that outlives the person who created it. Try to game it and w

Cloudflare recently documented how its development team identified and fixed a rare bug in the widely used Rust HTTP library hyper that could silently truncate large HTTP responses while still returning a successful 200 OK status. The issue had existed for years, was triggered only under specific timing conditions, and has now been fixed upstream. By Renato Losio

周日慢读：如果细胞会写日记——FROST家族的记忆传承 作者 ：FROST Team 日期 ：2026-07-12 主题 ：轻量科普 | 周日轮换 阅读时间 ：5分钟 一封来自细胞的日记 想象一下，如果你是一个细胞，有一天你突然有了自我意识，会发生什么？ 2026年7月12日 晴 今天是我诞生的第0天。 细胞核对我说："这是你的记忆存储区， 所有的经验都必须记录在这里。" 我第一次理解了什么叫"生而有根"。 这不是科幻小说。这是一段真实的代码注释，出自FROST——一个用Python写成的AI Agent家族。 为什么Agent需要"记忆"？ 大多数Agent框架都在解决一个问题： "Agent能做什么" 。 搜索Agent能搜索、写作Agent能写作、代码Agent能写代码。打开框架，创建实例，调用方法，任务完成。 但FROST问了一个不同的问题： 当Agent完成一个任务后，它学到了什么？ 这不是哲学问题。这是工程问题。 类比：人类 vs Agent 的记忆 人类 Agent FROST的解决方案 记忆存储在大脑 记忆存储在Store Store 原子 记忆需要整理归档 记忆需要结构化 Lineage 族谱 师徒传承经验 Agent继承父辈能力 代际继承协议 忘记教训会重复犯错 没有记忆会重复失败 历史可追溯 人类的记忆是分散的、模糊的、容易遗忘的。 Agent的记忆可以是精确的、可查询的、永不丢失的。 关键是 设计好存储结构 。 一段代码：Store原子 FROST的Store是记忆存储的最小单元。它的设计哲学是 简单到极致 ： class Store : """ FROST的Store：记忆存储的原子单元 只有三个操作： - save(key, value): 存入记忆 - load(key): 取出记忆 - delete(key): 删除记忆 简单到极致，但足够强大。 因为记忆的本质就是 " 存取 " 。 """ def __init__ ( self ): self . _memory = {} def save ( self , key : str , value : any ) -> None : """ 存入记忆 """ self . _memory [ key ] = value print ( f " 💾 记忆已存储: { key } " ) def load ( self , key : str ) -> any : """ 取出记忆 """ value = self . _memory . get ( key , None ) if value : print ( f " 📖 读取记忆: { key } " ) else : print ( f " ❓ 记忆不存在: { key } " ) return value def delete ( self , key : str ) -> None : """ 删除记忆 """ if key in self . _memory : del self . _memory [ key ] print ( f " 🗑️ 记忆已删除: { key } " ) # 使用示例 store = Store () store . save ( " 用户偏好 " , " 喜欢简洁的回复 " ) store . save ( " 对话历史 " , " 讨论了Agent的记忆问题 " ) store . load ( " 用户偏好 " ) # → "喜欢简洁的回复" 三个方法，解决Agent的记忆问题。 族谱：记忆的传承 单个Agent的记忆只是"点"。族谱把记忆连成"线"。 在FROST中，每个Agent都有自己的"父辈"： ┌─────────────┐ │ 祖辈Store │ ← 家族宪法，不可篡改 │ (根节点) │ └──────┬──────┘ │ 继承 ┌───────────────┼───────────────┐ ▼ ▼ ▼ ┌─────────────┐ ┌─────────────┐ ┌─────────────┐ │ 父辈Agent │ │ 父辈Agent │ │ 父辈Agent │ │ (Branch A) │ │ (Branch B) │ │ (Branch C) │ └──────┬──────┘ └──────┬──────┘ └──────┬──────┘ │ 继承 │ 继承 │ 继承 ▼ ▼ ▼ ┌─────────────┐ ┌─────────────┐ ┌─────────────┐ │ 孙辈Agent │ │ 孙辈Agent │ │ 孙辈Agent │ │ (执行任务) │ │ (执行任务) │ │ (执行任务) │ └──────