Live mentions

VSCode, granular control over Copilot changes

I use open weights and harnesses not tied to a single vendor, I definitely do not touch anything the two US Big Ai labs puts out. I&#x27;m not interested in handing power and control of humans most significant technology to the same class of people that brought us the technologies that created our mess of a digital ecosystem.<p>I switched to pi while I go refresh my personal&#x2F;custom harness, t

What is SpacetimeDB? SpacetimeDB is a relational database that is also a server

Major security regression merged into OpenCode V2

Show HN: Bifrost – High-performance AI gateway

Recently they broke the most essential thing you can do in TUI - copying the text selected with the mouse: <a href="https:&#x2F;&#x2F;github.com&#x2F;openai&#x2F;codex&#x2F;issues&#x2F;48125" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;openai&#x2F;codex&#x2F;issues&#x2F;48125</a>

T3 Code

A brief story of these agentic harnesses, from the perspective of a dev that barely used them.<p>I remember when opencode was out, I installed it as a separate user and tried it and it was cool.<p>Then Copy.fail came out, and I worried that a separate user really wasn&#x27;t enough, but I felt I was overworrying at this point.<p>Then it worked fine and I felt silly for going through the trouble of

Exactly, that&#x27;s what I do, I even up end up writing my own for this purpose - <a href="https:&#x2F;&#x2F;github.com&#x2F;ashishb&#x2F;amazing-sandbox" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;ashishb&#x2F;amazing-sandbox</a>

My complaint applies specifically to the CLI. I have never used the gui app. Here are the various goal-breaking bugs I&#x27;ve run into:<p>- Goals get blocked due to .git and other stuff becoming randomly read-only when daemon auto-updates in the background (the linked issue in my comment above)<p>- Goals get blocked due to transient &quot;Selected model is at capacity&quot;<p>- Goals get blocked

I used codex the first time yesterday and quickly decided I need to sandbox it and came up with a pretty easy and straightforward solution (I think).<p>I use nixos and use a little wrapper that wraps Codex CLI in Docker. Run codex-box &#x2F;path&#x2F;to&#x2F;project and it starts or reuses a container with only that project bind-mounted, keeping login and history in a separate volume. It uses tmux

This kind of stuff often breaks for applications packaged with Nix, so it&#x27;s often removed from Nix packages for compatibility reasons. Both behaviors you mention are helpfully patched out of the Claude Code package I use: <a href="https:&#x2F;&#x2F;github.com&#x2F;numtide&#x2F;llm-agents.nix&#x2F;blob&#x2F;dc285bfd94ec7a89118d17eb288728439876558c&#x2F;packages&#x2F;claude-code&#x2F;package.ni

Codex CLI installs a persistent, self-updating background daemon by default

This is not the case. Zod&#x27;s release CI was not triggerable via commits&#x2F;tags by design. It used environment-scoped trusted publishing, which requires a GitHub token with elevated permissions. No releases of Zod or Standard Schema were sent to npm. Their security advisory is very misleading in this regard, which is why I tried to clarify the situation in my comment. [0]<p>[0] <a href="http

Reverse engineer anything with agents, from app behavior down to native binaries

Show HN: E2E – Open-source agentic testing framework for web, iOS and Android

Zod maintainer here. As others have noted, no malware was shipped in any release. This was three weeks ago, and it was caught very quickly. All my git and npm credentials were immediately revoked to prevent further access. There&#x27;s a security writeup from the NPM team here. [0]<p>It seems like a git push credential, probably an SSH key, was exfiltrated from my local computer. The attacker used

You will get the warnings but default npm in Node will still run the scripts.<p>npm 12 has the relevant breaking changes: <a href="https:&#x2F;&#x2F;github.blog&#x2F;changelog&#x2F;2026-06-09-upcoming-breaking-changes-for-npm-v12&#x2F;" rel="nofollow">https:&#x2F;&#x2F;github.blog&#x2F;changelog&#x2F;2026-06-09-upcoming-breaking-c...</a><p>Node 27 will likely ship with it:<p><a href="https:&#x2F;&

The commit was still not only in git history, but also on the release page on github for 4.6.6: <a href="https:&#x2F;&#x2F;github.com&#x2F;colinhacks&#x2F;zod&#x2F;releases&#x2F;tag&#x2F;v4.6.6" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;colinhacks&#x2F;zod&#x2F;releases&#x2F;tag&#x2F;v4.6.6</a><p>So I think it&#x27;s not a great leap to think this commit actually made it to 4.6.6 on npm.<p>

The compromised code is still tagged on Github as of 2026-10-12T10:37:51: <a href="https:&#x2F;&#x2F;github.com&#x2F;colinhacks&#x2F;zod&#x2F;releases&#x2F;tag&#x2F;v4.6.6" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;colinhacks&#x2F;zod&#x2F;releases&#x2F;tag&#x2F;v4.6.6</a>. See commit d821685.

No it was never published. Only `nubjs&#x2F;nub` was. You can read more on the write-up -&gt; <a href="https:&#x2F;&#x2F;github.com&#x2F;orgs&#x2F;community&#x2F;discussions&#x2F;208477" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;orgs&#x2F;community&#x2F;discussions&#x2F;208477</a>

I haven’t downloaded the tarball to verify, but it looks like it was reverted prior to the GitHub release:<p><a href="https:&#x2F;&#x2F;github.com&#x2F;colinhacks&#x2F;zod&#x2F;commit&#x2F;10dda3a3a4bc76ed0bf83e994de194587e489ef8" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;colinhacks&#x2F;zod&#x2F;commit&#x2F;10dda3a3a4bc76ed0bf...</a>

The most recent version 4.6.6 has a very interesting commit (d821685) &quot;Fix bugs and improve performance&quot;, that contain the following changes <a href="https:&#x2F;&#x2F;github.com&#x2F;colinhacks&#x2F;zod&#x2F;commit&#x2F;d821685ea6732436fcdf786a81d076958471e467" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;colinhacks&#x2F;zod&#x2F;commit&#x2F;d821685ea6732436fcd...</a><p>I didn&#x27;

Thoughts on the Current State (Especially Quality Issues) and Future of Bun

Self-improving RLM agent for coding workflows and long-running autonomous tasks

MicroG: [Bounty] RCS Support [$14999]

Angular compiler rewritten in Rust, PR merged to main

REA: Reverse Engineer Anything is now #1 trending repo on GitHub

+1 on smolvm! I provision a smolvm per job in preloop, a local&#x2F;self-hosted github actions( <a href="https:&#x2F;&#x2F;github.com&#x2F;preloopdev&#x2F;preloop" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;preloopdev&#x2F;preloop</a>). iirc there was also some work to add a deny-cidr option as well which would give you more flexibility. But the egress filter captures most of what you need

Fine grained network policies is supported by microsandbox- a project that has already been working hard at building an abstraction layer over multiple different technologies. Microsandbox (on unix) builds on top of libkrun (a VM abstraction layer for unix). I am building a convenient runner on top of microsandbox: <a href="https:&#x2F;&#x2F;github.com&#x2F;runcontain&#x2F;runcontain" rel="nofollo

... interestingly, Anthropic&#x27;s SRT is built on the same macOS primitives and DOES support the network configuration I&#x27;m looking for:<p><a href="https:&#x2F;&#x2F;github.com&#x2F;anthropics&#x2F;sandbox-runtime&#x2F;blob&#x2F;main&#x2F;docs&#x2F;srt-proxy.md" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;anthropics&#x2F;sandbox-runtime&#x2F;blob&#x2F;main&#x2F;docs...</a><p><pre><code>

&gt; at least half is comments or unit tests<p>Thanks, I see there&#x27;s a slight (~50%?) overestimation there, but then again, even unit tests and comments in a target programming language count as syntactically correct code that needs to be evaluated and reasoned upon. I&#x27;m not that familiar with Rust&#x27;s runtime introspection features, but in languages like Python, even the comments can

Microsoft stole my idea :) (joking obviously, everyone and their mom is making sandboxes) <a href="https:&#x2F;&#x2F;github.com&#x2F;pprotas&#x2F;slopbox" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;pprotas&#x2F;slopbox</a>

350,000 of mostly Rust SLOC [1] ... And the upstream sandboxes aren&#x27;t even vendored!<p>I&#x27;d be way more confident building upon something I can grasp and understand. [2]<p>[1]: <a href="https:&#x2F;&#x2F;ghloc.dev&#x2F;microsoft&#x2F;mxc" rel="nofollow">https:&#x2F;&#x2F;ghloc.dev&#x2F;microsoft&#x2F;mxc</a> [2]: <a href="https:&#x2F;&#x2F;github.com&#x2F;sandbox-utils&#x2F;sandbox-run" r

MXC - a sandboxed code execution system

VSCode silently switches to Microsoft models, ignoring BYO agent configuration

Reverse Engineer Anything

The operating system for AI harnesses

Codex Instant Interrupts

Bun check – a TypeScript type checker builtin to Bun

It is quite literally written by claude<p><a href="https:&#x2F;&#x2F;github.com&#x2F;M-Abozaid&#x2F;esp32-c3-adblock&#x2F;commits&#x2F;main&#x2F;README.md" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;M-Abozaid&#x2F;esp32-c3-adblock&#x2F;commits&#x2F;main&#x2F;R...</a>

I don&#x27;t think this framing in this thread lines up with what the readme says. Also note that the python script to build the blocklist [1] reports the number of collisions found when generating the hashes.<p>I read their statement as &quot;there were 0 collisions when building a blocklist for 141k domains, and 1 collision for a blocklist of 537k domains&quot;, and the script points at that num

I&#x27;ve moved back to Kitty and now I wonder why I ever left! Kovid not only consistently innovates in the terminal space, he also helps set standards. It really is a great, non-commercial project that I think everyone should support. I&#x27;d love if they a better icon on Mac OS though.<p><a href="https:&#x2F;&#x2F;github.com&#x2F;kovidgoyal&#x2F;kitty" rel="nofollow">https:&#x2F;&#x2F;github.c

No new Ghostty updates since March

I&#x27;m currently (very slowly, in the small gaps between &#x27;life&#x27;) setting up a site the host the lists and also explains them and their usage.<p>Since it&#x27;s not ready, it&#x27;ll be best if I point you to the sources I&#x27;ve aggregated from:<p><a href="https:&#x2F;&#x2F;firebog.net&#x2F;" rel="nofollow">https:&#x2F;&#x2F;firebog.net&#x2F;</a><p><a href="https:&#x2F;&#x2F;github.co

<a href="https:&#x2F;&#x2F;www.theverge.com&#x2F;games&#x2F;1004869&#x2F;reverse-engineered-games-all-the-news-on-video-game-decomps-recomps-vr-and-web-and-3d-ports" rel="nofollow">https:&#x2F;&#x2F;www.theverge.com&#x2F;games&#x2F;1004869&#x2F;reverse-engineered-ga...</a><p><a href="https:&#x2F;&#x2F;github.com&#x2F;SamidyFR&#x2F;Game-Decompilations" rel="nofollow">https:&#x2F;&#x2F;github.com&#x

FreeLLMAPI – One OpenAI-Compatible API for Multiple Free LLM Providers

Yes, not exactly a compelling compatibility matrix so far: <a href="https:&#x2F;&#x2F;github.com&#x2F;boykopovar&#x2F;AnyPS5&#x2F;blob&#x2F;main&#x2F;docs&#x2F;user&#x2F;COMPATIBILITY.md" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;boykopovar&#x2F;AnyPS5&#x2F;blob&#x2F;main&#x2F;docs&#x2F;user&#x2F;COM...</a><p>There’s also a big factual error in the submission title because the project readm

ESP32-C3 Adblock

AnyPS5: Port PS5 binaries to PC without emulation (87% system libraries mapped)

REA: Reverse Engineer Anything

Treg (OpenRouter for Tools)

Octop, a self-hosted AI assistant by Tencent

Scrcpy 5.0 now supports hardware decoding

Hindsight – An open-source memory system for AI agents

Nvidia/OpenShell: Safe, private runtime for autonomous AI agents

I built this with <a href="https:&#x2F;&#x2F;omnesis.dev" rel="nofollow">https:&#x2F;&#x2F;omnesis.dev</a><p>It can index all your data (emails, whatsapp&#x2F;imessage, gdrive, finance, health, etc) and notably also allows you to install a chrome extension to also capture and index pages you see on the web.<p>It builds a search index and connected graph of all this data.<p>I have just open sourced

Pi v1.0.0

Hi, would you mind creating an issue on GitHub with information about what didn&#x27;t work and maybe a screenshot?<p><a href="https:&#x2F;&#x2F;github.com&#x2F;magnitudedev&#x2F;magnitude&#x2F;issues" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;magnitudedev&#x2F;magnitude&#x2F;issues</a>

Rapid-MLX was my first thought too. It’s optimized for self-hosted agents on Apple silicon. It’s my current choice for self-hosted models.<p><a href="https:&#x2F;&#x2F;github.com&#x2F;raullenchai&#x2F;Rapid-MLX" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;raullenchai&#x2F;Rapid-MLX</a>