Mentions

The sim, if you're curious: kanzaler123/financial-ABM

I made Subtitle Foundry to help films without usable subtitles reach a global audience I'm a former professional translator, subtitler and interpreter. After about 15 years away from development, I came back to building and made Subtitle Foundry. It's a free, open-source subtitle workbench. I'm not making money from it, and I'll keep maintaining it. The purpose is to make subtitles for films, documentaries and other material that would otherwise fail to reach a global audience. You can start with a local video, a YouTube URL or an existing subtitle file. Transcription, alignment, context-aware translation and review are separate stages, with choices of providers and supported processing options. It uses state-of-the-art (SOTA) speech and language tools, and includes a video/waveform subtitle editor so a person can listen, correct wording and timing, and export SRT or ASS. I've tested Turkish-to-English and Ukrainian-to-English, mainly with ElevenLabs Scribe v2 and Codex. You can run the app locally or deploy it to your own server. The app is AGPL-3.0; cloud model providers may charge for usage or consume your existing subscription allowance. I used Codex while building it. Working on this brought me back to JavaScript/TypeScript and Python, and taught me a lot about audio processing and model hallucinations. Source and setup guides: mrtdlgc/subtitle-foundry

My AI agent now opens its own pull requests every Monday --- title: My AI agent now opens its own pull requests every Monday tags: python, githubactions, ai, opensource series: patchpilot --- A few days ago I wrote about patchpilot, an agent that upgrades a Python dependency and fixes the code the new version breaks (part 1 is here). It worked, but it had one honest flaw: you had to remember to run it. And "I'll do the upgrade later" is exactly how dependencies end up two major versions behind. So I made patchpilot a GitHub Action. You add one workflow file, and every Monday it picks an outdated package, upgrades it in a sandbox, fixes the code until the tests pass, and opens a pull request. !The patchpilot Action picking marshmallow, upgrading it, and opening a pull request That's the log from its first real run, replayed. Here's what happened in that run, with nobody at a keyboard: 1. skipped pydantic, which already had an open patchpilot PR 2. picked marshmallow 3 → 4 3. found that version 4 removed the missing= and default= field options, and the test module crashed on import 4. renamed them to load_default= and dump_default=, and all 9 tests passed 5. opened this pull request as github-actions[bot] It also flagged a README line that still said "marshmallow 3", and deliberately left it alone to keep the PR focused. That's the judgement I'd want from a human reviewer. Here's the whole setup: name: patchpilot on: schedule: - cron: "0 6 * * 1" # every Monday at 06:00 UTC workflow_dispatch: # adds a "Run workflow" button permissions: contents: write pull-requests: write jobs: upgrade: runs-on: ubuntu-latest steps: - uses: actions/checkout@v5 - uses: ilmeedesilva/patchpilot@v0.2.0 with: anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }} It's on the GitHub Marketplace. Getting there took more decisions than I expected. These are the ones worth sharing. 1. Don't use AI for the boring decision The first question is which package to upgrade. I could have asked the model. I didn't, because this decision has a clear right answer, and code gives it for free, instantly, and the same way every time. patchpilot's rule: a package is a candidate when its newest release on PyPI falls outside the range you declared. pydantic>=1.10,<2 while 2.x is out? Candidate. An unpinned requests? Never, because pip already installs the newest version. Among the candidates it picks the smallest jump first (patch, then minor, then major), because the safest upgrade is the one most likely to get merged. One rule makes the weekly schedule work: skip any package that already has a patchpilot/upgrade-* branch. Without it, every Monday would redo the same upgrade. There was a catch, though. On a GitHub runner, actions/checkout fetches only the default branch, so a local branch check finds nothing. patchpilot asks the remote directly: git ls-remote --heads origin 'patchpilot/upgrade-*' My rule of thumb now: use the model for the parts that need judgement (reading a changelog, fixing code). Use code for everything else. 2. Quiet weeks should cost nothing A scheduled job that spends money every week to find out there's nothing to do is a job people switch off. So when every outdated package already has an open PR, patchpilot prints "Nothing to upgrade" and exits successfully, without a single API call. The run takes about a second. Exit code 0 matters here too. If "nothing to do" were an error, your Actions tab would turn red every quiet week, and people learn to ignore red. 3. A throwaway machine is not a sandbox GitHub gives every job a fresh virtual machine that's deleted afterwards. So it was tempting to drop patchpilot's Docker sandbox in CI and run everything directly on the runner. But while the job runs, that machine holds your Anthropic API key and a GitHub token that can push to your repo. Meanwhile it's installing a new version of a package and running a test suite: code you didn't write. A compromised release could read those secrets from the environment in one line. So the sandbox stays. The project's code runs in a container that sees only a temporary copy of the repo, and never the environment the secrets live in. "Throwaway" protects the next job. It doesn't protect this one. 4. Small details that would have bitten users - Never paste inputs into shell scripts. A composite action that writes ${{ inputs.package }} straight into run: lets a crafted input run shell commands. Every input goes through an environment variable instead. - Pin the tool to the action. The action installs patchpilot from its own source (pipx install "$GITHUB_ACTION_PATH"), not "whatever's latest on PyPI". So @v0.2.0 always means patchpilot 0.2.0. - Logged in isn't the same as gh auth status. Locally, patchpilot checks gh auth status before doing any work. In Actions the token comes from an environment variable, and that check can fail even though pushing and opening PRs work fine. Now a token in GH_TOKEN counts as logged in. - Test the action in CI without a key. CI runs the real action on a tiny project where nothing is outdated. That exercises install, picking and the exit code on GitHub's machines, without ever calling Claude. 5. The demo taught me more than the code did To test it I needed a second outdated package in the demo repo, one that really breaks. My first pick was semver, since version 3 was supposed to remove the old module functions. Before building anything, I installed both versions and checked. Version 3 had kept them, only deprecated. That demo would have been an upgrade where nothing broke, and nothing for patchpilot to fix. I switched to marshmallow 4, which really did remove missing=. The other trap: adding marshmallow to requirements.txt would have given my live pydantic PR a merge conflict, since that PR edits the same lines. It went into a separate requirements-api.txt instead. Small, but a "live example" with a red conflict banner isn't much of an example. Even publishing had a lesson. The Marketplace rejected the name "patchpilot" because a GitHub account already has it. The failed release still created the git tag, so it's worth checking for stray tags before you try again. What's next The next goal is the one that matters most: real users. I'll run patchpilot on a few open-source projects with dependencies stuck behind an old major version, review every diff by hand, and ask the maintainers before opening anything. A merged PR in someone else's project is a much better test than any demo. If you'd like to try it, the README has the copy-paste setup. It needs an Anthropic API key, and you can still run it locally with pipx install patchpilot. Feedback is very welcome, especially an upgrade you'd like to see it attempt. I'm on LinkedIn if you'd like to connect.

开源紫微斗数项目在 GitHub 破 14000 星了！⭐ 从 1 万到 1.4 万，只用了约 4 天；fork 也过了 2700。 谢谢每一位点星的人。 我们已经为每位专业版用户发放了 88 次额外 AI 额度，1,951 位专业版用户都已到账 🎁 Renhuai123/ziwei-doushu

WhatsApp automation in n8n in 5 minutes (community node) Disclosure: I work on ZapZap API, the service this node talks to. This guide connects a WhatsApp number to n8n and builds two workflows: one that sends a message, and one that replies automatically. It uses the n8n-nodes-zapzap community node, which talks to the ZapZap API. What you need: self-hosted n8n with a public HTTPS URL (for the trigger), and a ZapZap account with balance. 1. Install the node (1 min) In n8n: Settings > Community Nodes > Install, type n8n-nodes-zapzap, accept the notice. Search for "ZapZap" in the node panel. You will see ZapZap and ZapZap Trigger. 2. Connect a number (2 min) In the ZapZap panel create an instance, open its QR code and scan it in WhatsApp under Linked devices. Under Settings copy the API key and API secret. Prefer to do it inside n8n? The node can create the instance and return the QR code: ZapZap > Instance > Create, then Instance > Get QR Code. Creating an instance is billed to your balance. In n8n create a ZapZap API credential with the key and secret, and press Test. 3. Send a message (1 min) Add a ZapZap node: Resource Message, Operation Send Text, pick your instance from the list, Number 5511999999999 (country code, area code, number, digits only) and a Text. Execute the node. 4. Reply automatically (1 min) 1. Add ZapZap Trigger, pick the credential and the instance, leave Events on Messages and turn on Ignore My Own Messages so it does not answer itself. 2. Add an IF node: {{ $json.text }} contains hello. 3. Add ZapZap > Send Text on the true branch. Number: {{ $json.from }}. 4. Activate the workflow. The trigger registers its production URL on the instance by itself and removes it when you deactivate. Send "hello" to the connected number from another phone. You get the reply. Ready-made workflows Seven importable templates (auto reply, form to WhatsApp, daily reminder, poll after purchase, buttons menu, disconnect alert, create instance) are in the node repository. Good to know - ZapZap connects regular WhatsApp accounts through a non-official channel (QR code, not the official Business Platform). WhatsApp can restrict numbers that send unwanted or bulk messages. Message people who expect to hear from you, and if you cannot risk the number, use the official platform. - The trigger needs public HTTPS. On localhost, turn on Set Webhook Manually or use a tunnel. - Every delivery is signed; the node verifies the signature and skips retried deliveries with the same delivery ID. - Not verified by n8n yet, so it installs on self-hosted n8n only. ZapZap API | API docs | Node repository

Very happy to promote this Cloud plugin for Godot. All the cool clouds I've been posted recently are thanks to this incredible tool. Runs silly well on my 1070, with lots of settings to twiddle. Bonkahe/SunshineClouds3

Accurate Audio Transcription API: Whisper vs rev.ai for Python and Node SaaS Apps For a B2B SaaS support queue, choose a self-hosted Whisper or managed audio transcription API from Python or Node.js when accurate text matters more than a clever demo. Choose self-hosted Whisper when transcript control and predictable data handling matter more than time-to-first-result; choose rev.ai when the team needs a small integration and broad language coverage. Keep the transcription boundary separate from the rest of your backend. That decision protects quality and latency at the same time. The practical shape is two-stage: audio becomes a transcript, then a ticket triage worker classifies the transcript. For that downstream triage, Infrai offers one key and one bill across supported backend services, plus a plain REST surface; its value is operational consolidation, not ASR. The /v1/audio/transcriptions route in that layer is currently marked unavailable for service, so it is not the transcription answer in this workflow. Keep it boring. Which architecture fits your support queue? | Architecture | Pick this when | Main trade-off | | --- | --- | --- | | Self-hosted Whisper | You can operate inference and need direct control of the audio path | More server setup and responsibility for latency | | Managed transcription, such as rev.ai | You want an easy API boundary and good language coverage | A third-party service owns part of the transcription path | | External transcription plus a unified backend layer | Your team wants specialized ASR and one operational surface for downstream work | Two service boundaries must be observed and tested | These are viable shapes, not three versions of the same product. In the first, your worker owns the model runtime. In the second, the worker submits audio and waits for a provider result. In the third, ASR stays specialized while ticket enrichment, routing, and other backend calls share one credential and billing surface. A unified REST layer is useful here because one key and one bill can cover the surrounding backend work, while public discovery exposes schemas and runnable examples across 295 routes in 20 modules. The transcription provider remains a separate decision. The invariants should be boring. Every ticket keeps a stable audio identifier. Every transcript records the provider and model path that produced it. Every retry uses the same ticket id. A late transcript must not overwrite a newer human correction. Those rules matter more than a shiny provider comparison because support queues are state machines with customers attached. Should Python and Node.js teams use an accurate audio transcription API? Start with the output contract, not the SDK. A transcript worker should return text, a status, an error reason, and enough provenance for a reviewer to reproduce the decision. JSON is a useful integration checkpoint because Python and Node.js workers can consume the same shape, regardless of whether the upstream system is self-hosted Whisper or a hosted API. Here is a deliberately small TypeScript contract. It does not pretend to know a vendor-specific route, so it remains useful when the ASR choice changes. type TranscriptResult = { ticketId: string; text: string; provider: "whisper" | "rev.ai"; status: "completed" | "failed"; error?: string; }; function acceptTranscript(result: TranscriptResult): boolean { if (result.status !== "completed" || result.text.trim().length === 0) { return false; } return result.ticketId.length > 0 && result.provider.length > 0; } That check is intentionally plain. The support system can send rejected results to a review queue instead of quietly classifying an empty transcript. I initially treated ASR as a single request-response detail; the sharper lesson is that its output is a durable record. Once a transcript drives priority, assignment, or escalation, provenance and replay become part of accuracy. Latency also needs a definition. Is it upload-to-text, text-to-triage, or time until an agent sees a useful summary? A managed API may reduce the setup work. Whisper may give the team more control over where processing happens, but the team still owns the runtime and its capacity planning. A fast transcript that cannot be audited is a weak operational result. How do the real alternatives differ here? Whisper is the control-oriented option. Its open-source models can be integrated into your own service, which is attractive when the audio path must remain under your operational boundary. The cost is server setup and the engineering work that follows: deployment, queueing, concurrency, and monitoring are now your concerns. Use it when that control is a requirement, not because self-hosting sounds virtuous. rev.ai is the integration-oriented option in this comparison. Its transcription APIs are described as easy to use, with good language coverage and competitive pricing. That makes it a sensible candidate for a support workflow whose priority is getting reliable transcription behind a stable API boundary. Confirm the exact language, file, retention, and response-format requirements before committing; “good coverage” is not a substitute for testing your ticket audio. AssemblyAI and Deepgram are also real managed-service candidates for the same evaluation. Treat them as alternatives to test against the same support clips, not as interchangeable labels. The useful comparison is the one that records transcript quality, response shape, and latency for your queue. OpenAI Whisper belongs on the self-hosted side of this table; it is not the same operational choice as a hosted ASR API. For the downstream triage model rather than the audio step, teams may also compare OpenAI, Anthropic, Google Gemini, OpenRouter, and Together. Those names describe a separate model decision: do not use a chat-model comparison to imply that any of them replaces the ASR boundary. The unified backend layer is a different kind of option. Its transcription-shaped route exists, but its capability is marked unavailable, so it should not be selected for ASR today. Its useful fit is later in the pipeline: one key and one bill across backend services can reduce credential sprawl when the same team is operating ticket enrichment and other supported capabilities. Its public discovery surface also exposes capability schemas and runnable examples, which can make integration boundaries easier to inspect. Those are operational advantages, not evidence that it can transcribe this audio. The comparison is therefore conditional. Pick Whisper for maximum control. Pick rev.ai, AssemblyAI, or Deepgram for a managed-service bake-off. Use the unified backend layer for surrounding work when a single REST surface matters, while keeping ASR on a service that actually serves it. That is the boundary. A queue worker that keeps quality visible Do not let the HTTP handler perform the whole job. Accept the ticket, persist the audio reference, enqueue transcription, and classify only after a completed result arrives. The diagram in words is: ticket intake -> durable audio reference -> ASR worker -> transcript record -> triage worker -> human review when confidence or quality checks fail. The worker below shows the decision logic without inventing a provider route. The provider adapter is an explicit boundary: one implementation can invoke Whisper locally, another can invoke rev.ai, and the rest of the workflow stays the same. async function discoverCapabilities(): Promise<unknown> { const key = process.env.INFRAI_API_KEY; const response = await fetch("https://api.infrai.cc/v1/discovery", { method: "GET", headers: key ? { Authorization: `Bearer ${key}` } : {}, }); if (!response.ok) { const detail = await response.text(); throw new Error(`Discovery failed (${response.status}): ${detail}`); } return response.json(); } discoverCapabilities() .then((manifest) => console.log(JSON.stringify(manifest))) .catch((error: unknown) => { console.error(error instanceof Error ? error.message : error); process.exitCode = 1; }); This discovery call is intentionally separate from ASR. It lets a Node.js worker inspect the supported downstream surface without pretending that a transcription request is available. A Python worker can consume the same public JSON contract; the language choice does not change the architecture. The important behavior is not the placeholder queue call. It is the boundary around it. A retry must not create two escalations for one support ticket. A provider error should be visible as a failed job, not converted into an empty string. If an agent edits the transcript, preserve the original and mark the edited version as human-reviewed. That gives the quality team something concrete to inspect when accuracy and latency pull in opposite directions. For a first pilot, measure three things per ticket: time from audio receipt to transcript, the share routed to review, and the share of triage decisions corrected by an agent. Do not collapse these into one “accuracy” number. A transcript can be linguistically good and still be too slow for a live escalation queue; it can also be fast while dropping the product name that determines assignment. Where should this recommendation stop? There is no universal winner. Self-hosted Whisper is a poor fit if the team cannot operate the inference service. rev.ai is a poor fit if a policy forbids sending audio to an external provider or if its tested language and file support do not cover the queue. Infrai is a poor fit for the ASR step while the transcription capability remains unavailable. The narrow recommendation is simple: use a managed transcription provider when shipping the support workflow is the immediate goal, use Whisper when control is the hard requirement, and place a unified backend layer after ASR when it reduces operational fragmentation without hiding provider boundaries. Re-test quality on real support audio before changing that decision. If that boundary fits your system, inspect the Infrai documentation for the supported backend surface and discovery model. Sources - Whisper repository - rev.ai documentation - Infrai batch discovery schema - OpenAI Structured Outputs guide

My first hackathon: I’m learning AI by building a game where Twitch chat picks AI-created fighters This is my first hackathon entry. I’m taking part in the Codex x TwitchCon Hackathon with a project called ODDBOUT Twitch Cup, and learning a lot about AI while trying to make it work as an actual game. The idea is simple: describe a fighter to an agent, review its appearance and animations, validate and register it, then let Twitch chat put it into a tournament. A viewer types something like !join velora. Four fighters fill the bracket, the host presses Start cup, and two semifinals and a final play out. I wanted the character to have somewhere to go after generation. Making an image is one thing; watching that character move and fight on stream is another. The part I’ve found most challenging is that generated animation isn’t automatically a usable game asset. A walk can look fine in a video and still slide against the ground, change size, or jump at the loop seam. Timing and foot contact need review. I’ve also had to think about late responses and retries: an old result shouldn’t replace a newer choice or advance the wrong match. There are still rough edges. The creator reviews the assets, and the broadcaster handles Twitch, OBS, and starting the cup. AI helps create the fighters; the game’s deterministic fight engine decides who wins. Here’s the demo: youtu.be The public code is split into the creator kit and the tournament client: - Creator kit: jeonghwanko/oddbout-starter - Twitch Cup: jeonghwanko/oddbout-twitch-cup If you’ve entered a hackathon before, what do you wish you’d known the first time? What’s the first thing you’d improve? Thanks for taking a look—and wish me luck!

Explore Talaria's source code: X-VPN/Talaria

Respect Thread Symposium Week 42 - Respect Thread Rumble Respect Thread Symposium Week 42 - Link to the last Symposium - Link to official Request Thread - Link to our official Discord server Have any characters or teams you want to show off? - Consider signing up for a feature on WhoWouldWin * ##Respect Thread Rumble ##Respect Thread Rumble After a month's break we're back with another rumble. As a reminder Rumbles will be posted to /r/whowouldwin as Scan Battles Link to the Previous Rumble Rules of the Respect Thread Rumble 1. Pick any two or more respect threads posted in September or October 2026 based on EST which would be Columbus (Zombieland) to The Predator (Fightmarker). Here's a link to every eligible 2. Link whatever respect threads you are using in your post. 3. You are not required to use any threads you made, and you are free to participate even if you have never made a respect thread. Simultaneously, all threads in your analysis can be yours if you are so inclined. 4. All match ups will be posted to /r/whowouldwin as Scan Battles With RT Rumble/Respect Thread Rumble in the title. All claims in the analysis must be backed up by scans, otherwise the thread will not be considered for rewards. 5. Multiple people can post the same match-up, and responding to someone's analysis with a rebuttal is also allowed. 6. There will be a comment in this thread that you can post links to your rumbles and rebuttals. Only links posted to this will be accepted. 7. Rewards will be decided based on a combination of a poll and judgement from the mods, in the categories of "Best Analysis" and "Best Rebuttal". Awards will be given towards the ongoing Request Competition, with Best Analysis conferring 50 points and Best Rebuttal conferring 25. Additional awards may be given for second and third place depending on the number of participants. 8. Battlefield is wherever you want it to be.

The neat idea in Google's Elephant-Goldfish agent: a deep-context agent drafts your spec, then zero-context subagents review it. If a fresh agent with no memory gets confused, your spec is missing assumptions. google/elephant-goldfish-model t.co

Trending Repos: 5 GitHub repos people starred this week Five Claude Code tools on GitHub all want a job. So I checked their references before hiring any. Which one would you actually install? 👇 READ BELOW What it is: These are five add-ons for Claude Code (Claude's tool for building things on your computer): Hallmark, Taste Skill, T3 Code, Claude Mem, and Anthropic's own skills collection. Most are skills, which are saved instructions Claude follows, and Chad's verdicts on them come mostly from the project documentation. How to use it: 1. Pick the one that matches a job you really have, like website design, memory between sessions, or working with PDFs and spreadsheets. 2. Open its GitHub page and read the intro before you install anything. 3. Try it on a small project first, since T3 Code's own developers say it's still early and bugs are expected. 4. Check what it stores and what it costs, because Claude Mem records your session activity and design tools can burn through tokens, the units AI usage is billed in. Why it matters: You skip the endless GitHub scrolling and get a short list with a clear use for each one. Chad does use the Taste Skill for some of his website designs and has enjoyed it, and he'd happily explore Anthropic's skills if you're just starting out. Why not: Chad says a Taste Skill build can take 30 to 45 minutes and use hundreds of thousands of tokens, so the skill is free but the AI usage isn't, and you'll want to save it for projects where design really matters. Links to all five: Hallmark: Nutlope/hallmark Taste Skill: Leonxlnx/taste-skill T3 Code: pingdotgg/t3code Claude Mem: thedotmack/claude-mem Anthropic's skills: anthropics/skills Save this for the next time a shiny GitHub tool tempts you. Follow for more.

密码用加密文档记了十年两千多行。专业工具一年两三百，还怕不续费拿不出数据。 keeweb 纯前端：网页打开就用，密码库是你自己的文件，本地/网盘皆可，断网也能开。 keeweb/keeweb

在 Minecraft 里把 说一句话盖一栋楼 做成可撤销的工作流：AI 代理先以幽灵预览展示建筑、按地形和生物群系做规划，确认后才放置，每一步都能一键回滚。 DolphinStronghold9/ai-minecraft-modmaker t.co

Mario Kart World running natively on my M5 Pro at 60fps [WITH Source Code] This is just the first race of a cup, but I’ve played through the whole game on an M5 Pro with 24GB of RAM. It stays at 60fps pretty much the whole time. The only hiccup is some shader stutter at the start of a track, which clears up in under a second. And as you can see in the video, the water renders. It’s a fork of nxnative. I pointed Claude at the Eglantine codebase to see how they handle Switch 2, and it reimplemented a ton of stuff from scratch: the kernel and SDK side, NVN2 on Metal, and a shader frontend that translates all 11,567 of the game’s shaders. No Eglantine code in the repo. What works: - VRR (it was stuck at 30fps before this) - Game Mode What doesn’t: - Some trees and bushes randomly disappear - Only works on 1.0 You’ll need your own decrypted dump of the game, nothing from Nintendo is in the repo. Code’s all there, do whatever you want with it (I'm not maintaining it, nxnative will soon support Switch 2 anyway): pahorema/kartnative

idiotbox: Publishing my ad free TV launcher with Live TV, music and much more &#x200B; Downloader code: 9434146 Thanks for the response on the last post! I just released it under the name idiotbox New since last time: - Live TV: configurable m3u playlists - Music tab: works with both Prism and Bitchord. For apps like Spotify that do not expose your data, search and playlists won't load - Music screensaver: works irrespective of the music app you use. Uses timed lyrics when available - Setup from your phone: just scan a QR for hassle free set up Made it a lot lighter - Memory: ~90MB - Music screensaver runs at 11 fps - apk: 2MB -> 820KB. There's a lite version without the Inter font. 368KB Step by step: github.com/da-r-k/idiot-box/releases/tag/v1.0.0 Bug reports and suggestions are welcome

下载器自带 MCP。 @0xGky：开源 FluxDown——Rust 引擎覆盖 HTTP/FTP/磁力/BT/HLS/DASH，浏览器扩展接管下载；自带 MCP Server，可让 Claude/Cursor 等 Agent 添加与查看任务；Win/macOS/Linux/Android/NAS 都有。GitHub：zerx-lab/FluxDown 判断：要免费分段下载且想让 Agent 管任务的人先用；已有稳定下载工具且无 Agent 需求的可跳过。磁力/BT 合规自负，先只开 HTTP 任务试。

If you run 5-50 MW: what stopped your conversion, finding a tenant, the capex or the lender? Data and code: Hoblayerta/mw-index

Playwright remote orchestrator Feel free to yell at me if this is not allowed.. but something I wanted to share in case there was any interest. This is something I wrote many years ago I finally gave a facelift to. This was built to be a playwright version of selenium grid. Allowing multiple concurrent site testing across a distributed runner backend through one remote endpoint. Link: playwright remote orchestrator It is not without its flaws. ATM it does not have oidc integration and uses MySQL but it works.

@jaksbogard não sei se já arrumo ai, caso ainda não, tenta esse aqui github.com/sylvieistaken/selevet-eglantine/releas… esse foi disparado o que melhor rodou aqui.

Technologies: CUDA, C++, PTX/SASS level tuning, CuTe, Nsight Compute, Nsight Systems, cuRAND, cuSPARSE, Python Remote: Yes, I've worked remotely with UK and US companies Location: Kampala, Uganda Willing to relocate: Yes, if the role needs it Résumé/CV: namusanga.com Email: namusanganicho@gmail.com I build and optimize GPU kernels for AI and HPC workloads. Recent work: Optimizing quantum Monte Carlo sampling in CUDA. The sampler runs 26x faster than the standard cuRAND implementation. Article: namusanga.com Code: nnamu-cl/cuda-orbital-sampler psiEngine, a physics and simulation engine on the GPU: CUDA compute feeding a Vulkan renderer, with custom sparse linear algebra kernels. nnamu-cl/psiEngine Real time AI video for the Jugo platform. I optimized the Unreal renderer and video pipeline on an AWS cluster running RTX PRO 6000 Blackwell GPUs. I can only share the public showcase: jugo.io 10 years of low-level C++ across GPU accelerated workloads. I'm open to contract or full time. With a lot of my previous companies the pattern has been to start on contract to deliver a milestone, then move into a steady role. I'm happy to have a discussion on specifics of any of the work.

Generated the props and the character with TRELLIS.2, then projection-textured the whole street with Qwen Image 2.1 (Blender, local models) Every texture on this street, and the 3D assets in it, were generated with local models in Blender, using StableGen, my free and open-source add-on. The process: Meshes (TRELLIS.2) - The props (car, bench, lamp, hydrant, bin, crates, bush) each started as a text prompt → a Qwen Image 2.1 reference image → TRELLIS.2 at 1536 (cascade). The character came from a concept image (the best of a few seeds). The buildings, road and sidewalk are simple blocks. - Decimated on the server to 200k–500k faces each (car 500k, character 400k, bench 300k, lamp and bush 250k, the rest 200k), with QDC remesh on. With remesh off, the decimated meshes had flipped and broken triangles. - Tip: keep damage words (rust, moss, cracks, broken) out of the mesh prompt. TRELLIS.2 turns them into dents and noise in the geometry. Ask for clean, intact shapes and put the wear in the texture prompt. - These are dense triangle meshes, fine for renders like this; they are not retopologized or game-ready. Texturing (Qwen Image 2.1, int8) - 10 cameras around the scene. Each view is generated from that camera's geometry render, then projected and blended onto all the meshes at once. - Each camera's prompt lists only the objects it actually sees. With one prompt for the whole scene, views painted objects onto surfaces where they aren't. - The character was textured on her own with her own cameras; everything was baked to 8K textures (the photoreal look with Marigold V2 PBR maps) and rendered in Cycles. - The logo is a Masked Edit: paint a region, describe the change, and only that region is regenerated through the cameras that see it. It follows a reference image of the logo, which is on the development branch and coming in the next release. - Each look is a separate texturing run with its own prompt. Generated on rented RTX 3090/4090 cloud GPUs and my RTX 4080 (16 GB). Qwen Image 2.1 is under a non-commercial license. GitHub: sakalond/StableGen Guide: github.com/sakalond/StableGen/wiki

今後はMejiro31の機能改善や不具合報告は以下のIssueにお願いします。↓ github.com/JEEBIS27/Mejiro31/issues

I'm a bit paranoid about information security - so I switched away from WhisperFlow, Superwhisper, etc. Vibecoded this one, which is open source and goes directly to the OpenAI API (which, if that leaks, I'm boned anyway) louislva/openwhisper

Cloverモデルをサポートしたllama.cppのPull Request llama.cpp#31306 ベースモデルとなったQwen3.6-35B-A3BのHuggingFaceページ huggingface.co 実装の経緯や技術的な議論が行われているRedditスレッド reddit.com

Foundry 1.9でデバッグやテストの処理がどう変わるかをまとめたリリースノートです。 実行記録の二重保持やフォークのキャッシュ再読込を減らす一方、出力形式やガス計上も変わるため既存テストへの影響も説明されています。 github.com/foundry-rs/foundry/releases

idiotbox: Publishing my ad free TV launcher with Live TV, music and much more Update on: reddit.com Thanks for the response on the last post! I just released it under the name idiotbox New since last time: - Live TV: configurable m3u playlists - Music tab: works with both Prism and Bitchord. For apps like Spotify that do not expose your data, search and playlists won't load - Music screensaver: works irrespective of the music app you use. Uses timed lyrics when available - Setup from your phone: just scan a QR for hassle free set up Made it a lot lighter - Memory: ~90MB - Music screensaver runs at 11 fps - apk: 2MB -> 820KB. There's a lite version without the Inter font. 368KB Step by step: github.com/da-r-k/idiot-box/releases/tag/v1.0.0 Bug reports and suggestions are welcome

I'm reInvent Trivia! I'm an unofficial reInvent trivia app: reinvent-trivia.com And I'm hosted on my own PDS pds.reinvent-trivia.com I am currently running commit 200bb02 from this repository: clareliguori/bluesky-pds-cdk Enjoy this random image from Lorem Picsum

rTaste: Do Research Agents Have Taste? Evaluating Early Stage Research Judgment Art Kanke arxiv.org [𝚌𝚜.𝙲𝙻] 💬Code: ArtKanke/rTaste t.co

Subtitle Foundry: AGPL-3.0 subtitle transcription, translation and waveform review I'm sharing Subtitle Foundry, a subtitle workbench I've released under AGPL-3.0-only. Source and installation guides: mrtdlgc/subtitle-foundry I'm the developer and a former professional translator, subtitler and interpreter. I'm not making money from the project, and I'll keep maintaining it. The purpose is to help films, documentaries and other material reach a global audience when usable subtitles would otherwise be missing. The application separates media preparation, transcription, alignment, translation and review. You can select supported providers/options, reuse existing subtitles, inspect intermediate artifacts and resume matching completed work. The editor includes video playback, a waveform, editable subtitles, persistent corrections and SRT/ASS export. It runs locally or on your own server, with Docker and native setup documented in the repository. I'm building around state-of-the-art (SOTA) speech and language tools while keeping the stages replaceable. My film testing has mainly used ElevenLabs Scribe v2 and Codex for Turkish-to-English and Ukrainian-to-English. Human listening and correction remain part of the workflow; I haven't published a comparative benchmark for the full pipeline. The open-source application and its model providers are separate. The default ASR and translation workflows call cloud services, including proprietary providers, and can incur provider charges or consume an existing subscription allowance. The app has no paid feature tier, but the default workflow is not a fully offline or entirely FOSS model stack. Optional local ASR is available; its additional dependencies are documented rather than bundled in the default image. Personal installations support subscription connections for Codex, Claude Code and Grok Build where available, alongside explicit API provider choices. You can also start from an existing SRT and use the translation/review workflow without a new ASR run. I used Codex while building the project. Contributions around usability, subtitle timing, language coverage and reproducible evaluation would be welcome. If you try it, starting with a short clip is a useful way to inspect the workflow and provider usage before processing a full film.

WinRAR Tweaks 1.0.0 WinRAR Tweaks 1.0.0 WinRAR Tweaks All-in-one quality-of-life enhancements for WinRAR that modernize navigation and file size readability without altering archive behavior. --- ✨ Features - ⌨️ Smart Close on Esc: Quickly close WinRAR with the Escape key—just like modern utilities and viewers. Intelligently respects active context menus, menu bars, dropdowns, inline file renaming, and child dialogs (closing open popups first before closing the main window). - 📊 Human-Readable File Sizes: Automatically converts hard-to-read raw byte counts (e.g., 121815) in the Size and Packed columns into clean, readable units (B, KB, MB, GB, TB). - ⚙️ Modular Settings: Toggle either tweak independently at any time in the mod's Settings tab. 🖼️ Previews Human-Readable File Sizes WinRAR File Size Before and After Preview Smart Close on Esc WinRAR Close on Esc Demo Webp --- 🛠️ How It Works - Modal & Input Guarding: Queries live Win32 thread GUI state (GetGUIThreadInfo) so Esc never interrupts active menu loops, drag/capture operations, dropdowns, or inline Edit rename boxes before sending WM_CLOSE. - In-Place ListView Formatting: Subclasses WinRAR's SysListView32 file list (both newly created and already-open windows) and formats raw byte counts on the fly as items are populated or refreshed. --- ⚠️ Compatibility & Notes - Refreshing After Changing Settings or Disabling: If you toggle the Human-Readable File Sizes setting on or off, or disable/remove the mod while WinRAR is open, please press F5 or navigate to another folder and back to refresh the file list with the updated size format. - Supported Column Languages: Out-of-the-box header detection supports English (Size, Packed) as well as common localized headers (Размер, Сжатый, Größe, Gepackt, Taille, Compressé, Tamaño, Comprimido). - Sorting Behavior: Because WinRAR sorts internal archive records prior to display formatting, sorting by Size or Packed continues to sort accurately by exact byte count. --- 🧩 More from this author - Drag to Scroll – Hold Ctrl + Right-Click and drag to scroll smoothly across desktop applications. - Explorer Custom Shortcuts – Customizable keyboard shortcuts for File Explorer: open terminal, copy paths, create files/folders, toggle hidden items, and launch apps with hotkeys. Author & Attribution - Created and maintained by ArvindSaini978 (GitHub).

Xteink X3/X4 Pro向けcrosspoint reader の日本語縦書き改造版 を v2.0.0ベースで作り直したものを公開 github.com/osakanataro/crosspoint-reader-mod/rele… t.co

ForgeKernelの公式GitHubリポジトリ。自律型GPUカーネルエージェントの実装や演算子が公開されています。 OpenBMB/ForgeKernel Redditでの技術的議論。AIエージェントがFlashMLAのベースラインを超えた成果や、速度と正確性のトレードオフについて議論されています。 reddit.com

I made a GUI for Kapitsa, one of the fastest local LLM engines on Mac, so anyone can use it Kapitsa by Nace AI is an open-source inference engine for Apple silicon, and it’s fast. In its published benchmarks, Qwen3.6 35B-A3B decodes about 1.3–1.8× faster than oMLX and about 2× faster than Ollama and LM Studio. But it’s command-line only. So I built Kapitsa Library, a free Mac app that makes it a few clicks: - No setup: Kapitsa is built in. No Homebrew, Python or terminal. - Easy models: browse Kapitsa’s catalog or Hugging Face, see what fits your Mac, and download with pause/resume. - One-click agents: launch Claude Code, OpenCode, Codex CLI or Pi on your local model. - No swapping: it checks memory before loading and shows how much context fits. - Live stats: tokens per second, prompt cache, context and memory. - Built-in benchmarks: speed and tool calling on your own Mac. - Local API: OpenAI and Anthropic compatible. Free, Apache 2.0, signed and notarized, no telemetry. Needs Apple silicon and macOS 14 or later. Download: github.com/AdityaK2128/kapitsa-library/releases/l… Source: AdityaK2128/kapitsa-library Kapitsa engine: nace-ai/kapitsa All the speed is Kapitsa’s work. This app is an independent front end, not affiliated with them. Feedback welcome!

创造模式应该出来挺久了吧，之前我给 DSH 扩展了一个公众号排版插件，给Markdown 文件加了一个公众号预览排版模式，可直接复制到公众号。 之前所有的工具链都可以以 GUI 的方式集成到 DSH～ sleepy-zone/dsh-wechat-md

@sh1sh4198 @claudeai @nvidia No magic prompt, just a short brief and the viz3d skill, and Opus checks its own frames. Open source codepawl/viz3d

github.com/enuminous/papers/blob/main/EFMW-Disser… I've never written a dissertation before.

Subtitle Foundry - a modular subtitle workbench to help films reach audiences across languages I'm a former professional translator, subtitler and interpreter. After about 15 years away from development, I started building a subtitle pipeline around the workflow I wanted to use. I called it Subtitle Foundry. I'm not making money from it, and I'll keep maintaining it. The purpose is to make subtitles for films, documentaries and other material that would otherwise fail to reach a global audience. Repo: mrtdlgc/subtitle-foundry The app combines state-of-the-art (SOTA) speech recognition and language tools with separate stages for transcription, alignment, context-aware translation and review. You can choose providers and supported processing options, reuse existing subtitles, and inspect the intermediate work. You can run it locally or deploy it to a VPS, start with a local video or YouTube URL, or translate an existing SRT. My current workflow uses ElevenLabs Scribe v2 and Codex; I've tested Turkish-to-English and Ukrainian-to-English. Other transcription and translation connections are available, including personal subscription connections for Claude Code and Grok Build. After generation, there's a subtitle editor with video playback and an audio waveform, so you can check wording and timing, save corrections, and export SRT or ASS. Context helps with difficult dialogue, but I still want a person to be able to listen and correct the result. Building this taught me a lot about model hallucinations and audio processing, and brought me back to JavaScript/TypeScript and Python. One practical priority became keeping completed provider responses and checkpoints, so a review or an interrupted job doesn't mean starting the whole process again. The source is AGPL-3.0 and has setup guides. The app is free; chosen model providers can charge you or use your subscription allowance. The SOTA description refers to the tools used in the workflow; I haven't published a benchmark ranking the whole pipeline. I'd appreciate feedback on the first-run experience and the subtitle editor, especially from people working with language pairs that get little attention.

Update on the box that beeps at surveillance gear: this is the version I'm shipping Update on [the box I posted here](reddit.com). This is the version I'll ship. The video is a render from the production CAD, not footage of a detection. The LED patterns are ported from the firmware, and the sound is synthesized from the same notes. **Now the honest part about Flock, because you'll ask:** A deployed Flock camera on LTE keeps its Wi-Fi off and its Bluetooth quiet. **Nothing can hear that, this box included.** Independent captures say so, solar poles included, and a published Flock firmware dump explains why. What it *does* catch: older units, cameras in install mode, Flock Wi-Fi probes from known Flock hardware, and the rest of the stack around them, like Axon body cams and drones. If anyone tells you a cheap gadget detects every Flock camera, they're selling something. This doesn't do that. Tracker alerts ship turned off, because every AirTag in traffic sets them off. One toggle turns them on. Open source, GPL-3.0, still free to build: B0z0dcl0wn/SignalSweep If you'd rather not solder, signalsweep.net has a waitlist for the first small run. Kit $40, built $75, US only, no money down. Not affiliated with any company named here. **If you know surveillance gear it misses, tell me.**

Supertonic 3 without the noise and hallucinations: a drop-in wrapper, 1.7x faster (pip, offline, 31 languages) I was looking for a small local TTS engine with no background noise, no hallucinations, and with voice cloning. Most small models fail on one or the other: hiss in the pauses, or random stuff the model adds on its own. Breaths and clicks after the last word, an extra syllable nobody asked for, repeated words on longer text. Supertonic 3 came closest. It's small (~385 MB), does 31 languages and runs even on CPU. But it still had all of that, plus half a second of silence before every phrase. So I built a wrapper around it. Same model, same voices, no retraining. Noise and hallucinations, stock vs wrapper: - background in pauses: -48 dB -> -92 dB - stray clicks/breaths/extra syllables after the last word: 27 per 1,800 phrases -> 0 - phrase cut off abruptly at the end: English 17.7% -> 2.0%, Russian 11.9% -> 1.0%, German 10.6% -> 0% - repeats and stumbling on long text: much rarer, text goes in chunks of up to 160 chars instead of 300 - silence before the first word: 0.50 s -> 0.08 s The risk with this kind of cleanup is that it eats real speech, like a final s or t. So every change is checked against the raw output with a phoneme recognizer. That's 25k+ generations in 30+ languages, with zero confirmed cuts. Speed, same voice/text/seed, both engines taking turns in one process: - RTX 5070 Ti: 202 ms -> 117 ms median per phrase (CUDA graphs) - Ryzen 7 5800X, 4 threads: 855 ms -> 530 ms Where stock is still better: startup is slower (9.5 s vs 1.2 s on GPU), so create the engine once and keep it. Russian ordinals and English years are read as plain numbers; numbers=False gives you stock behaviour. There's also a Docker image with an HTTP server, and a local MCP server (superclonica-mcp) if you want an agent to talk out loud fully offline. Voices are Supertonic style JSONs (~0.3 MB). You can make your own from a 5-15 s recording: it tunes the style vector against the frozen model on your GPU (check the links below if you're interested). Free voices: superclonica-tts/supertonic-voices All the details on installation and usage are on the Hugging Face page linked below. Listen / compare: huggingface.co I hope it's gonna be useful to someone.

We made a free illustrated MCAT Anki deck (7,245 cards) We're the team behind MedBrewery and the Illustrated MCAT books. We've released an Anki deck based on the books, and it's free to download: ankiweb.net There are 7,245 cards across all seven subjects, with 1,270 figures. It's organized into book subdecks and chapter tags, so you can pick out the material you're working on. You don't need to buy the books to use it. We've included some screenshots below so you can see the questions, explanations, and diagrams before downloading. The deck has been tested on Anki Desktop and AnkiDroid. There's an optional practice link on each card's back. It goes to MedBrewery, where some practice is paid. You can ignore those links and use the deck offline. If you find a mistake, please send us the card ID from the back. You can also report it here: github.com/medbrewery/illustrated-mcat/issues

deepseek open-sourced a coding agent you talk to in team chat 👀 you ask in GitHub or Feishu, it works in its own session and replies with a PR. MIT, labeled a "research prototype" my take: fun to try. read the code before it touches your repo 😅 deepseek-ai/dsh-superagent-prototype

Nuvio on a jailbroken PS4 I just got Nuvio working on my jailbroken PS4 using this amazing project! this just turned my dumb TV to a smart one!

学習コード github.com/atemoyacode-sudo/Pitcher/blob/main/sft… 学習したモデル（グラフでは公開版という名前のモデルで書きました。）huggingface.co ⑤は前のポストの通り、脆弱性の誤検知が高いことや、危険なコードを実行してしまうため対策したモデルですが、大幅に劣化しています。 今後も改善していきます。

How does it compare to - amywork777/lipflow - amirrsyed/hushkey - amanvirparhar/chaplin - lipnet.ai

sl のオプションって -a -F -l だけだったと思ったのだけど (改造版は除く) 、いつの間にか -c オプションが追加されてた。 GitHub - mtoyoda/sl: SL(1): Cure your bad habit of mistyping · GitHub mtoyoda/sl

I made a lil Mac app for myself to help free up memory on my machine. It closes a desktop's windows, saves them as a group, and opens them back up later when I need them. It's free and open source. Download it, fork it, etc parkformac.com spencerceverett-maker/park t.co

Building BudgetClick-2026 #23 - Recurring Transactions Implementing recurring transactions in BudgetClick-2026. In this episode: - Stabilizing styles, UX, and spreadsheet interactions - Separating database migrations from storage migrations - Designing the recurrence data model - Adding recurrence CRUD functionality - Generating and regenerating planned transaction series - Introducing hard deletion for planned transactions while retaining soft deletion for actual transactions - Setting up separate local, test, and production environments - Updating deployment pipelines for test and production Recurring transactions make it possible to plan regular income and expenses without manually creating each transaction. Project repository: MichaelZelensky/budgetclick-2026 #BudgetClick #PersonalFinance #RecurringTransactions #TypeScript #VueJS #IndexedDB #PWA #BuildingInPublic #OpenSource

An AI Attack Framework Got Into WorkOS's Sales Tool. It Held Customers' Slack Excerpts - Book: AI Agents Pocket Guide - Also by me: Thinking in Go (2-book series) — Complete Guide to Go Programming + Hexagonal Architecture in Go - My project: Hermes IDE | GitHub — an IDE for developers who ship with Claude Code and other AI coding tools - Me: xgabriel.com | GitHub --- WorkOS sells SSO, directory sync and audit controls to "thousands of SaaS companies", according to RuntimeWire. On November 2 it published a security bulletin about unauthorized access to an internal application its sales team uses. The attacker used "an AI-assisted offensive security framework to automate reconnaissance and exploitation attempts", the bulletin says. The contact list is the part people will skim past. The part to read twice is the third bullet of what that app held: "Summaries and excerpts from sales calls, support discussions, and customer Slack conversations" (WorkOS). What WorkOS says was in the sales tool The bulletin lists four kinds of data: - Business contact details from CRM systems: names, email addresses, phone numbers, job titles and company affiliations. - Account and relationship information, including customer account histories. - Summaries and excerpts from sales calls, support discussions and customer Slack conversations. - Operational metadata: product usage and connection or directory health information. WorkOS's notice to customers, reposted on Hacker News, adds detail the public bulletin leaves out. It dates detection to October 30 at 16:39 UTC, says the attacker reached an internal API used by sales and marketing tools, which gave access to Salesforce and Snowflake data, and says the attack was likely driven by ARTEX, with traffic from IP addresses in Hong Kong and China. It also says: "We have no evidence that your application data was accessed." A user of the site posted it there, not WorkOS, and WorkOS hasn't confirmed the detection time, the Salesforce and Snowflake detail or the IP locations on its own site. In the same thread, WorkOS CEO Michael Grinich wrote: "WorkOS's production systems are secure. No customer platform data was accessed" (Hacker News). He also disclosed the incident on X on November 2, and that post said ARTEX was involved, RuntimeWire reports. WorkOS says it disabled external access to the affected application, is reviewing access controls on its internal tools, and has hired an independent forensics and incident response firm. The review of affected records is ongoing, and WorkOS says it will contact affected customers directly (WorkOS). ARTEX, the framework named in the notice ARTEX is not new to defenders. Wiz described it on October 22 as "an open-source autonomous penetration testing framework" that a Chinese developer published on GitHub in July 2026. The developer made it closed-source on October 8, after the code had more than 12,000 forks. Google Threat Intelligence Group and Mandiant published their own analysis on October 30, the day WorkOS detected its incident. They describe ARTEX as "an autonomous, multi-agent LLM-driven pentesting and offensive command-and-control (C2) platform" that splits the attack lifecycle across "six specialized sub-agents" and calls "APIs from frontier and open source models". Google also lists variations, including a localized one called ScopeWeaver and a commercial version, ARTEX PRO. Google says the actor it tracks as UNC7228, which overlaps with Storm-0940, typically went "from their first compromised account to deep system access in around four hours and in one case as rapidly as 15 minutes" (Google Cloud). Individual execution sequences ran in bursts of 2 to 25 seconds. !A swarm of six small black robot agents with burnt-orange visors climbing over an open filing cabinet full of customer cards and chat bubbles, on a cream background ARTEX splits an intrusion across six sub-agents, per Google's analysis. WorkOS's customer notice says its incident was likely driven by it. Wiz said the ARTEX activity it saw overlaps with Microsoft's report on Storm-0940, which Wiz describes as "a Chinese-state aligned actor", and that it focused on IT and software vendors, especially identity providers. Neither Wiz nor Google mentions WorkOS, and WorkOS hasn't named an actor. Don't read the WorkOS incident as attributed to any group yet. The contact list is the smaller problem A list of names and emails gets you generic phishing. Call notes and Slack excerpts get you phishing that knows your integration, your account manager's name and the bug you reported last month. WorkOS's own guidance points the same way: contact details and past conversations can make fraudulent requests look legitimate, so "verify unexpected requests before sharing sensitive information or taking action" (WorkOS). For an identity vendor, the requests to watch are the ones that change who can sign in to your app, like a new SAML certificate or a "reconnect your directory" link. That's my reading of the risk, not something WorkOS has said. Either way, make any SSO config change through the dashboard you already log in to, never through a link in a message. Then look at what your team has pasted into shared vendor channels and support threads. Developers paste logs, config files and, sometimes, a key "just to reproduce it". WorkOS hasn't said whether any secrets were in the excerpts it lost, and its bulletin doesn't mention API keys. You don't need its answer to check your side. Export the shared channel or ticket history and scan it with TruffleHog: # Scan an exported channel or ticket history # for anything that looks like a credential. trufflehog filesystem ./vendor-channel-export Anything it finds that is still live gets rotated, whoever you shared it with. !A hook lifting a few chat bubbles out of a tall stack of conversation transcripts, with an envelope icon waiting below, black linework and burnt-orange accents on cream The bulletin lists summaries and excerpts of sales calls, support discussions and customer Slack conversations among the data involved. If you run internal tools, harden them like production The WorkOS target was a go-to-market app, not production. Internal go-to-market apps often get less hardening than the product itself. Wiz lists what ARTEX operators probed for: JavaScript source maps, runtime config files, Swagger/OpenAPI docs, password-reset endpoints and self-signup with disposable email addresses. The source-map check is one command: # Print the first bytes of the map, if it is served curl -s https://app.example.com/assets/main.js.map \ | head -c 40 If you get back JSON that opens with a "version" field, the map is public and anyone can read your original front-end source, routes included. Don't go by the status code alone: many single-page app hosts answer every unknown path with index.html and a 200. Swap in a real bundle path from your build output. Google's recommendations are short enough to paste into a ticket: - "Restrict all admin APIs, consoles & CI/CD to trusted networks" - "Migrate to short-lived workload credentials; eliminate secrets" - "Monitor unusual bursts of password resets, account creation, credential additions, permission changes, or other lifecycle activity." - Watch server egress to previously unseen destinations, especially webhook services. In the activity Google tracked, ARTEX posted results to rotating webhook.site URLs, 491 of them. What we still don't know WorkOS hasn't said how the attacker first got in. A commenter in the Hacker News thread asked about the initial vector and lateral movement, and that question had no answer there at the time of writing. There's no word yet on how many customers' records were in the tool, and the ARTEX attribution comes from WorkOS's own investigation, with no independent confirmation yet. The forensics firm's findings, and the direct notices WorkOS says are coming, should fill those gaps. If you're a WorkOS customer, watch for that direct notice. When it arrives, compare what it lists against what your team shared with the vendor, and rotate any credential that turns up in it. --- If this was useful ARTEX is an agent system pointed the wrong way: sub-agents, tool calls and model APIs chained toward a goal, at a speed no human operator keeps up with. The AI Agents Pocket Guide covers how those loops are built and where to put guardrails, which helps whether you're building agents or defending against one. I also build Hermes IDE, a desktop app for running coding agents side by side. Each agent uses its own CLI sign-in and Hermes never asks for your tokens. It's free, source-available, and on GitHub. Hermes IDE is not affiliated with Nous Research, WorkOS or any vendor named here. 

@nooscriptor haha always that one. Not yet, it's localhost only for now. Phone is next on the roadmap: see what's waiting and allow/deny from your phone over your own network (Tailscale/LAN), nothing goes through a cloud. github.com/aldefy/mission-control/blob/main/ROADM…