Mentions

@WillemJaap_ @theo i slopped something similiar taking inspo from theo ig aryanranderiya/pipeline-lens

Flip a switch and stop your Videos from Degrading. 50 Clip Test No Degrading at the end. Geiru Context Suite I did the thing where I nuke the first post because I forgot to do something also the title sucked and I forgot to credit literally the most important contributor in the video. Skip to 8:05 to see the results. Also, if you guys are curious you can visit this repository to read about everything I tested to get to this point. roycho87/NerdNotes Lots of information in there. Maybe you guys can read it and come up with an even better solution. If you have some good info, please leave an issue on the Github and I'll compile it all together. Any experiments you've done and the results, what you've learned etc. All of it is helpul. Geiru Context Suite: degradation protection for long MiniMax H3 chains The main part of this that allowed this to work came from Ethanfel. He created the context noise method that allowed this to work so giant shout out to him. The Clown Context Suite is now the Geiru Context Suite. She's named after the clown, and the new name keeps it from getting mixed up with ClownShark's nodes. Your old workflows still load fine. The big addition is a degradation protection switch on Geiru Context that turns three nodes on together. Geiru Keystone locks a clean frame 0 from a source clip into every shot. Geiru Late Lock tacks that clip's capstone onto the back late in the steps. Geiru Context Noise, based on ethanfel's idea, gives the held frames part of the noise instead of handing them over perfectly clean. Turn it on for long stretches of one scene and off around cuts, since scene changes reset the drift on their own. Keystone can also load its source clip straight from your latent folder now, so when the scene changes you only change one number. Also new: a context noise switch on Geiru Hybrid Windows, and a ready-to-go example workflow, noisy_clown_example. I tested it on a 50-clip chain (about 5½ minutes): running on a beach, then a café, a walk through town and a garden. The plain chain was falling apart by clip 20, while the protected one still looked clean and barely drifted in the still scenes. Side by sides and all the numbers are in my notes. It's not perfect yet, since fully static shots can still slowly darken, but it's the best I've gotten so far! remember to use this to combine your clips. https://github.com/roycho87/workflows/tree/main/workflows/seamless_video_combiner You have to clip off the last 17 frames and join at the 22nd frame with 39 frames of overlap for the settings in the workflow. Repo: roycho87/geiru_context_suite Test notes: roycho87/NerdNotes Credits (none of this exists without them): - seitanism, for the masked latent context everything here is built on: seitanism/ComfyUI-H3-Motion-Context-MultiRef - NikoDemon80, for Motion Context, the Chain node and a ton of drift testing: NikoDemon80/ComfyUI-H3-Motion-Context - ethanfel (Lumifel), for the context noise idea: ethanfel/ComfyUI-MiniMaxH3-Context-Loop - drozbay, for H3 latent masking: drozbay/MaskVidExperiments - kijai, for H3 support and context windows in ComfyUI: github.com/kijai - JalenBrunson, for Hybrid Windows: Jalen-Brunson/ComfyUI-HybridWindows - TrentHunter82, for TrentNodes, whose degrade node made the frame 0 tests possible: TrentHunter82/TrentNodes edit: Currently running a test on best settings to use for this and will update the nodes with best defaults after it's done tomorrow as it's about 19 hours of generating. You can check the nerdnotes to see the test and how it's going. After reviewing the tests i was able to determine that the best settings for noise is 1 and linear. I've changed that to the defaults.

MotionBricks: Scalable Real-Time Motions with Modular Latent Generative Model and Smart Primitives (561 stars) What it does All text below is quoted directly from the project README. >MotionBricks is a modular latent generative model that animates characters and robots in real time. This repository provides: - Pretrained models for the SOMA body model and the Unitree G1 robot. They ship as ONNX files, with the pretrained checkpoints on Hugging Face. - A Python runtime, built on Warp, Newton, and TensorRT, that chains generations into continuous motion. - Two demos: an Inbetweener that generates motion between poses you place, and a Scene Preview where a character walks, runs, vaults, ducks, and sits its way through a scene. - Two editors to author your own Smart Primitives and scenes. - Smart Primitives turn target poses into building blocks for navigation and object interaction, so behaviors like vaulting and sitting snap together like bricks, with no retraining. >The runtime uses TensorRT, which requires an NVIDIA GPU. The demos were tested on Windows and Linux (x86-64) with an NVIDIA GeForce RTX 4090. Repository NVlabs/motionbricks Repository stats |Metric|Value| |:-|:-| |Stars|561| |Forks|55| |Last release|None| |Languages|Python 100%| |Contributors|1| |AI contributor accounts (Claude / Codex / Cursor / Copilot)|None| |AI co-authored commits|None| Main contributor |Field|Value| |:-|:-| |Name|Olivier Dionne| |GitHub|@oldio| |Commits to this repo|2 (top contributor)| |Company / Location|Nvidia / QC, Canada| |Followers|14| ────────────────────────────── 📌 If you want to browse more repos like this, we've organized them by category and rankings here: bestgithubrepositories.com 🗂️ We're also archiving repos where possible, so useful projects don't disappear when they're removed from GitHub.

On the Distribution of Prime Squares and Its Applications Hamed Mousavi arxiv.org [𝚖𝚊𝚝𝚑.𝙽𝚃 𝚖𝚊𝚝𝚑.𝙲𝙾 𝚖𝚊𝚝𝚑.𝙳𝚂] 💬Code: github.com/HamedMousaviMath/lean4-paper-On-Distri… t.co

Auditing LLM Agents Against 214 OWASP AISVS Requirements: Rico Komenda and Jim Manico at Global AppSec USA 2026 OWASP's AI Security Verification Standard (AISVS) released version 1.01 on October 5, 2026, growing from 191 to 214 testable requirements, with most of the growth in its MCP security chapter. AISVS lists security requirements for applications built on LLMs, agents and retrieval-augmented generation (RAG). Writing "verify that" in a standard is easy, while checking it against a running AI system is not. In their Global AppSec USA 2026 workshop, "Hands-On AI Security Assessment with OWASP AISVS", on Friday, November 6 at 10:30 a.m. in Golden Gate, Rico Komenda and Jim Manico walk through practical assessment scenarios using the standard. Speakers: - Rico Komenda, Senior Product Security Engineer - Jim Manico, Founder, Manicode Security Participants work through real requirements from chapters on prompt injection defense, agentic action security, RAG and vector database hardening, as well as output safety controls. They learn to scope an AI security assessment and select a verification level. They then apply AISVS requirements to LLM-based applications, autonomous agents and MCP-connected tools, so a laptop is needed to follow along. AISVS has three levels. Level 1 is a baseline, Level 2 covers systems handling sensitive data or consequential decisions, and Level 3 is for high assurance. Version 1.01 includes requirements such as rejecting, rather than truncating, inputs that exceed token limits at Level 1. At Level 2, retrieved or tool content must never gain higher priority than the system's own instructions. The MCP security chapter grew from 23 requirements to 40 between versions. On October 20, 2026, the project deferred a planned 2.0 to focus on version 1.02. Rico Komenda is a Senior Product Security Engineer who works on the attack surface of AI-integrated systems. He co-leads AISVS with Jim Manico, Otto Sulin and Russ Memisyazici. Jim Manico founded Manicode Security, which trains developers in secure coding, and founded AISVS. He co-leads OWASP ASVS and wrote "Iron-Clad Java: Building Secure Web Applications." Both speakers also present the AISVS project showcase on Thursday at 10:30 a.m. in Seacliff CD. Komenda gives a talk on security chaos engineering for AI on Thursday at 1:45 p.m. The same team ran this workshop at Global AppSec EU 2026 in Vienna in June. The AISVS repository holds every released version, with requirement IDs that never get renumbered. To go deeper on the topic, start here: - ITSPmagazine podcast: Jim Manico on building AISVS (audio) - OWASP AISVS on GitHub (1.01 release and requirements) - OWASP AISVS project page - LRQA Cyber Labs: AISVS 1.0 chapter-by-chapter - VirtusLab: AISVS 1.0 requirement walkthrough Security testers asked to assess AI features without a defined test scope will practice building one from published requirements. Which AISVS verification level would your production AI features need to meet?

Show HN: Inline Logs, console.log values next to your code in VS Code

codex#45121 Everything、最近よく謎のフリーズがあるなと思ってたらOpenAI Codexの画面操作補助プロセスとの干渉が指摘されていた。画面操作中にEverythingを一時的に終了させるルールを入れて様子見中。

Neo-tree.nvim: Neovim plugin to manage the file system and other tree like structures (5.6k stars) What it does All text below is quoted directly from the project README. >Neovim plugin to manage the file system and other tree like structures. User Experience GOOD: - Neo-tree won't let other buffers take over its window. - Neo-tree won't leave its window scrolled to the last line when there is plenty of room to display the whole tree. - Neo-tree does not need to be manually refreshed (set use_libuv_file_watcher = true) - Neo-tree can intelligently follow the current file (set follow_current_file.enabled = true) - Neo-tree can sync its clipboard across multiple trees, either globally (within the same Neovim instance) or universally (across all Neovim instances). - Neo-tree is thoughtful about maintaining or setting focus on the right node - Neo-tree windows in different tabs are completely separate - respect_gitignore actually works! >The biggest and most important feature of Neo-tree is that we will never knowingly push a breaking change and interrupt your day. Repository nvim-neo-tree/neo-tree.nvim Repository stats |Metric|Value| |:-|:-| |Stars|5,637| |Forks|310| |Last release|3.42.0 (2026-09-01)| |Languages|Lua 99.8%, Other 0.2%| |Contributors|173| |AI contributor accounts (Claude / Codex / Cursor / Copilot)|@Copilot (1 commits)| |AI co-authored commits|Copilot: 1| Main contributor |Field|Value| |:-|:-| |GitHub|@cseickel| |Commits to this repo|466 (top contributor)| |Followers|21| ────────────────────────────── 📌 If you want to browse more repos like this, we've organized them by category and rankings here: bestgithubrepositories.com 🗂️ We're also archiving repos where possible, so useful projects don't disappear when they're removed from GitHub.

Finding Live Azure AD Credentials in Production JavaScript Bundles With SecretSifter: Hemanth Gorijala at Global AppSec USA 2026 In an authorized assessment of about 2,000 web applications at one enterprise, 113 were serving live credentials to any browser that loaded them. Hemanth Gorijala documented that result in a 2026 IEEE Access paper. Of 194 confirmed secrets, TruffleHog, the best static scanner tested, found 36.6 percent. His runtime scanner, SecretSifter, found 77.8 percent. Another 13.9 percent were missed by all nine production scanners and turned up only through manual review. Static scanners read source code, while credentials often enter an application later, at build time, through CI/CD variable substitution or through runtime config files. SecretSifter instead watches what the live application actually serves to a browser. In his Global AppSec USA 2026 demo lab, "OWASP SecretSifter: Passive Runtime Credential Detection in Production Web Applications", on Friday, November 6 at 10:30 a.m. in Golden Gate, Hemanth Gorijala runs three scenarios against a deliberately vulnerable app running offline. Speaker: Hemanth Gorijala, Global Penetration Testing Lead SecretSifter needs no source code access, no active probing and no credential configuration. It flags what should not be in the traffic flowing through a browser session. The first scenario collects an Azure AD app ID, app key, resource URI and API Management subscription key from JavaScript bundles loaded during normal browsing. Together, those four values can mint a bearer token that reaches protected APIs. The second finds a CryptoJS-encrypted config blob with its decryption key sitting in the same JavaScript file. The third walks through GT-194, the benchmark of 194 confirmed production secrets behind the paper's numbers. SecretSifter runs as a Burp Suite extension, a browser extension for Chrome or Firefox and a standalone desktop app. The demo shows all three. Hemanth Gorijala has 13 years of application security and penetration testing experience in a global Fortune 500 environment. He runs web application assessments and reviews enterprise bug bounty reports. He presented this research at BSides San Antonio, Secure Software by Design and BlueTeamCon in 2026. GitGuardian's Dwayne McDaniel wrote up the BSides San Antonio talk. His paper, "Secrets That Survive Everything," found that in 73.3 percent of exposed apps the full Azure AD token-minting chain sat in a single file the browser loads. CryptoJS-encrypted config defeated every static scanner tested. The SecretSifter Burp extension is MIT-licensed and ships more than 160 detection rules. The paper's results come from a single organization that relies heavily on Azure. To go deeper on the topic, start here: - Secrets That Survive Everything (paper) - SecretSifter Burp Suite extension on GitHub - SecretSifter Firefox add-on - GitGuardian recap of the BSides San Antonio 2026 talk Teams that rely on source code secret scanning will see how many credentials reach production through paths that scanning never sees. Have you checked what credentials your production JavaScript bundles hand to every visitor?

Stop Pulling a NuGet Package for zstd. .NET 11 Has ZstandardStream TL;DR: .NET 11 puts Zstandard (zstd) right next to GZipStream and BrotliStream. new ZstandardStream(output, CompressionLevel.Optimal) is the whole setup, and HttpClient can decompress zstd responses with one flag. .NET 11 is at Release Candidate 2, which ships with a go-live support license, but it is not GA yet. Everything below was run on the .NET 11 RC 1 SDK. The package nobody wanted to own zstd is everywhere now. Log pipelines, databases, and HTTP all speak it. .NET, meanwhile, made you pick a third-party wrapper, check that its native binary ships for every platform you deploy to, and hope it is still maintained next year. It is the dependency that shows up in every security review and that nobody remembers adding. What .NET 11 adds The new types live in System.IO.Compression: - ZstandardStream - a Stream, used exactly like GZipStream. - ZstandardEncoder and ZstandardDecoder - span-based, no stream needed. - ZstandardDictionary - train a dictionary for lots of small, similar payloads. - ZstandardCompressionOptions - quality, window size, checksums, long-distance matching. On the HTTP side, DecompressionMethods.Zstandard and ZstandardCompressedContent are new too. The minimal version If you have ever written a GZipStream, you already know this API: using System.IO.Compression; byte[] raw = File.ReadAllBytes("app.log"); using var output = new MemoryStream(); using (var zstd = new ZstandardStream(output, CompressionLevel.Optimal)) { zstd.Write(raw); } byte[] compressed = output.ToArray(); using var input = new MemoryStream(compressed); using var unzstd = new ZstandardStream(input, CompressionMode.Decompress); using var back = new MemoryStream(); unzstd.CopyTo(back); Swap GZipStream for ZstandardStream and the rest of your code does not notice. I ran all three built-in compressors over the same payload: 2,000 lines of fake JSON logs, 188,010 bytes, all at CompressionLevel.Optimal. | Format | Compressed size | 200 runs on my machine | |---|---|---| | GZip | 13,499 bytes | 218 ms | | Brotli | 11,936 bytes | 299 ms | | Zstandard | 11,891 bytes | 150 ms | Smallest and fastest in one row. It is a synthetic, very repetitive payload and one run on one machine, so treat the timings as a hint, not a benchmark. The .NET team's own numbers on the Canterbury Corpus are in the Preview 1 release notes linked below. Want more squeeze? ZstandardCompressionOptions takes a Quality from -131072 to 22, and the default is 3. var options = new ZstandardCompressionOptions { Quality = 19, AppendChecksum = true }; using var zstd = new ZstandardStream(output, options); At quality 19 with a checksum, the same log payload came out at 7,535 bytes. The realistic one: thousands of tiny messages Compression is bad at tiny payloads. A 150-byte JSON event has almost no repetition inside it, so there is little to squeeze. The repetition is between messages: the same keys, the same enum values, the same shape, every time. That is what zstd dictionaries are for. You train one on sample messages, then both sides use it: using System.IO.Compression; // training: byte[][] of real messages, e.g. the last 1,000 events // message: one new event as byte[] byte[] samples = [.. training.SelectMany(b => b)]; int[] lengths = [.. training.Select(b => b.Length)]; using ZstandardDictionary dictionary = ZstandardDictionary.Train(samples, lengths, maxDictionarySize: 4096); byte[] buffer = new byte[1024]; ZstandardEncoder.TryCompress( message, buffer, out int written, dictionary, ZstandardCompressionOptions.DefaultWindowLog2); byte[] restored = new byte[message.Length]; ZstandardDecoder.TryDecompress( buffer.AsSpan(0, written), restored, out int read, dictionary); I trained a 4,096-byte dictionary on 1,000 order.created events, then compressed 200 new events it had never seen: | | Average size | |---|---| | Raw JSON | 152.2 bytes | | zstd, no dictionary | 134.7 bytes | | zstd with dictionary | 38.6 bytes | Without a dictionary, zstd barely dented them. With one, the average message went from 152.2 bytes to 38.6. That is the difference between "compression is not worth it for our queue" and "why did we not do this sooner". HttpClient speaks zstd now Automatic decompression is one flag: using var client = new HttpClient(new SocketsHttpHandler { AutomaticDecompression = DecompressionMethods.Zstandard | DecompressionMethods.GZip }); string body = await client.GetStringAsync("https://example.com/api/report"); With that handler, the client sent Accept-Encoding: gzip, zstd. My local test server answered 8,000 bytes of JSON as 33 bytes of zstd, and GetStringAsync handed back all 8,000 characters. Going the other way, ZstandardCompressedContent compresses a request body while it is sent and sets Content-Encoding: zstd for you: var json = new StringContent(payload, Encoding.UTF8, "application/json"); await client.PostAsync(url, new ZstandardCompressedContent(json)); 300 copies of a small JSON object reached my test server as 36 bytes. Make sure the server actually accepts zstd request bodies before you turn this on. Can I use it? - .NET 11 only. The types ship in the shared framework; my test apps had no package references at all. - Status: .NET 11 is at RC 2 with a go-live license; GA is still ahead. Gotchas 1. The int after the dictionary is not quality. In TryCompress(source, dest, out written, dictionary, 3), that 3 is windowLog2, and the call threw ArgumentOutOfRangeException: windowLog2 ('3') must be greater than or equal to '10'. Pass ZstandardCompressionOptions.DefaultWindowLog2 (23), or set quality with ZstandardDictionary.Create(buffer, quality). 2. Both sides need the same dictionary. Decoding a dictionary-compressed message without it did not throw; TryDecompress just returned false. Version your dictionaries and ship the id with the message. 3. HttpClient does not opt in by itself. A default HttpClient sent no Accept-Encoding at all. When my test server sent zstd anyway, the default client got the 33 raw zstd bytes, not the JSON. 4. Preview samples are already stale. The Preview 1 notes use WindowLog; the RC has WindowLog2, MinWindowLog2, and MaxWindowLog2. Trust the API docs over old blog snippets, this one included once GA lands. Wrap-up Zstandard is now just another Stream in the box, with dictionaries and HTTP support on top. Grab the .NET 11 RC SDK, swap one GZipStream for ZstandardStream, and see what your payloads say. Sources - What's new in .NET 11 libraries - Microsoft Learn - .NET 11 Preview 1 libraries release notes - dotnet/core - ZstandardStream class - .NET API reference - dotnet/runtime #119575 - Zstandard compression support - dotnet/runtime #123531 - Zstandard in DecompressionMethods - .NET 11 Release Candidate 2 - .NET Blog This article was written with the help of AI and checked against the sources above.

CycloneDX 2.0 Goes Past the SBOM to Threat Models, Agent Behavior and Post-Quantum Crypto: Steve Springett at Global AppSec USA 2026 CycloneDX, the software bill of materials (SBOM) standard behind more than 300 tools, is due for version 2.0 this fall, with Ecma approval expected in December 2026. For eight years, CycloneDX has answered one question about software: what is in it? Regulators, customers or security teams now also ask what software does, what could go wrong, which controls are in place and how anyone can verify it. Version 2.0 moves CycloneDX from a bill of materials to what its maintainers call a Transparency Exchange Language. It links components, threats, risks, controls, behaviors and evidence into one graph, exchanged as a file or through an API. In his Global AppSec USA 2026 project showcase, "CycloneDX 2.0: From SBOMs to Verifiable Assurance", on Friday, November 6 at 10:30 a.m. in Seacliff CD, Steve Springett tours what 2.0 delivers and what is still in development. Speaker: Steve Springett, Creator of OWASP Dependency-Track and Chair of CycloneDX SBOM Core Working Group and Ecma TC54, ServiceNow The session traces the shift from assertions to claims to evidence, showing how 2.0 encodes each step so assurance can be verified. Hardware and material inventories can carry provenance down to the region where each material was mined. Threat models include threat scenarios, attack trees or attack paths across STRIDE, LINDDUN, MAESTRO and MITRE ATT&CK. Weaknesses are recorded as the source of risk. The risk model carries FAIR, the OWASP Risk Rating Methodology, FMEA, NIST SP 800-30 or a custom method without translation. Controls become first-class objects, so GRC teams can prescribe controls as data and publish verified control inventories. Blueprints compare an AI agent's declared behavior with its observed behavior, which exposes shadow AI activity that no inventory can see. The same approach turns a cryptographic inventory into post-quantum readiness, by showing how keys are used and whether algorithms can be swapped. Steve Springett created OWASP Dependency-Track, a platform for tracking vulnerable components across a software portfolio, and he chairs the CycloneDX Core Working Group. He leads the OWASP Software Component Verification Standard and serves on the OWASP Foundation Board. He opened the CycloneDX proposal for threat modeling in May 2024, which became the TM-BOM threat model format. He also speaks regularly on SBOM adoption, including a 66-minute BrightTALK webcast on using the standard. The OWASP announcement of CycloneDX 2.0 lists further additions. VEX data gets an eight-point exploitability scale, while a post-quantum migration program tracks the risk and owner of each crypto asset. Documents can also carry "perspectives" for 82 named domains. Existing 1.x SBOMs stay valid under 2.0. The current release is 1.7, published as the second edition of the ECMA-424 standard in December 2025. CycloneDX Attestations already let organizations publish machine-readable claims, evidence and counter-evidence against a standard. To go deeper on the topic, start here: - Steve Springett: Understanding and Using the CycloneDX SBOM Standard (BrightTALK, 66 min) - Application Security Weekly: The Future of CycloneDX and Software Transparency with Steve Springett - CycloneDX 2.0 announcement - CycloneDX Attestations (CDXA) - CycloneDX Transparency Exchange API (TEA) repository Teams that already produce SBOMs for compliance will see what else the format can carry once 2.0 ships. Beyond a component list, what would your customers or auditors want to see in machine-readable form?

@fabriciocarraro @AnthropicAI eu fiz o demi bem nessa linha: o modelo tem só uma ferramenta (a shell), vê uma linha por grupo de comandos e só lê o --help quando precisa. e quando vale paralelizar, tem subagentes: wspl/demi

mini.nvim: Library of 45+ independent Lua modules improving Neovim experience with minimal effort (9.6k stars) What it does All text below is quoted directly from the project README. >Library of 45+ independent Lua modules improving Neovim experience with minimal effort Modules: - mini.ai: Extend and create a/i textobjects - mini.completion: Completion and signature help - mini.surround: Surround actions - mini.deps: Plugin manager - mini.diff: Work with diff hunks - mini.files: Navigate and manipulate file system - mini.pick: Pick anything - mini.icons: Icon provider >Each module can be used separately without any startup and usage overhead. Repository nvim-mini/mini.nvim Repository stats |Metric|Value| |:-|:-| |Stars|9,610| |Forks|320| |Last release|v0.18.0 (2026-06-21)| |Languages|Lua 99.8%, Other 0.2%| |Contributors|85| |AI contributor accounts (Claude / Codex / Cursor / Copilot)|None| |AI co-authored commits|None| Main contributor |Field|Value| |:-|:-| |Name|Evgeni Chasnovski| |GitHub|@echasnovski| |Commits to this repo|2,183 (top contributor)| |Bio|Data science, Machine learning R, Python, Lua Neovim plugins| |Company / Location|Kharkiv, Ukraine| |Followers|1.3k| ────────────────────────────── 📌 If you want to browse more repos like this, we've organized them by category and rankings here: bestgithubrepositories.com 🗂️ We're also archiving repos where possible, so useful projects don't disappear when they're removed from GitHub.

400 Vulnerabilities SAST Missed Across 20 Production Apps, Found by an Agentic Harness: Jaiydev Gupta, Milind Daftari, Venkata Suresh Sanga and Heena Pundir at Global AppSec USA 2026 A nine-step agentic harness run against 20 large production applications at a financial services company found more than 400 verified vulnerabilities that its static analysis tool had missed. Those applications already had years of penetration testing, active bug bounty programs and static application security testing (SAST) in CI. An agentic harness is software that runs AI agents through a fixed sequence of analysis and verification steps. The missed findings clustered where pattern-based tools cannot reach. They included missing authentication gates, authorization logic that exists but never enforces, secrets in configuration files outside the scan's scope and forgeable unsigned tokens. In their Global AppSec USA 2026 talk, "When Finding Bugs Is the Easy Part: Lessons from an Agentic Vulnerability Harness", on Friday, November 6 at 10:30 a.m. in Seacliff AB, Jaiydev Gupta, Milind Daftari, Venkata Suresh Sanga and Heena Pundir share what running the harness taught them. Speakers: - Jaiydev Gupta, Staff Software Engineer, Visa VAS Innovation Labs - Milind Daftari, Cybersecurity Engineer, Visa - Venkata Suresh Sanga, Senior Cybersecurity Engineer, Visa - Heena Pundir, Lead Cybersecurity Engineer, Visa The harness also found multi-step attack chains. In one case, a session-handling weakness rated medium on its own became full account compromise, because an API leaked session IDs without an access check and fed a predictable password-derivation function. Fewer than one in six findings overlapped between the harness and SAST. SAST found about 90 true positives the harness missed, such as SQL injection deep in data-access layers and cross-site scripting in JSP templates. The first run's precision was too low to hand to developers. Fixing it took structural changes, such as adversarial verification and deterministic filtering, rather than prompt tuning. The team's main metric shifted from finding count to Mean Time to Adapt (MTTA): the time from a first signal to a validated fix in production. The talk describes the architecture in enough detail to reproduce. It names the failure modes, including hallucinated findings that survived a single verification pass and chain severity that stayed wrong until the pipeline design made it explicit. Jaiydev Gupta is a Staff Software Engineer in Applied AI at Visa VAS Innovation Labs. He builds "software factories" that combine multi-agent orchestration, model fine-tuning and automated evaluation. He played a major role in building the harness's AI capabilities. Milind Daftari is a Cybersecurity Engineer at Visa with a master's in cybersecurity from New York University. His work covers secure architecture, SAST, DAST or SCA integration in CI/CD and secure code review, using LLMs to cut noise for developers. Venkata Suresh Sanga is a Senior Cybersecurity Engineer at Visa who runs its SAST, SCA and DAST detection portfolio. His current focus is using the agentic harness to reduce scanner noise, measured by MTTA. Heena Pundir is a Lead Cybersecurity Engineer in Visa Application Security & Architecture, focused on payment systems. Her skills include threat modeling and attack surface reduction. She previously worked as an embedded security architect. Visa open-sourced the Visa Vulnerability Agentic Harness (VVAH) in June 2026 under the Apache 2.0 license. Its README describes 11 stages, where stages 1 to 9 cover detection through chain construction and reporting. An August 2026 Visa release added automated remediation with adversarial fix validation. VentureBeat reports the repository grew from 595 to more than 2,300 GitHub stars between July 20 and August 25. To go deeper on the topic, start here: - Visa Vulnerability Agentic Harness on GitHub - Visa press release on VVAH remediation and validation (August 2026) - VentureBeat: how VVAH discovers, fixes and validates (Louis Columbus) - Let's Data Science: VVAH open-source release and Glasswing context AppSec teams deciding whether AI-driven review can replace or only supplement their SAST tools will get overlap data from a real deployment. How much of your vulnerability backlog consists of findings no one has validated as exploitable?

Margin - 在菜单栏显示多个账户的 Claude Code 和 Codex 剩余用量与重置时间。 👉 Abulkosim/margin t.co

NVIDIA NeMo Speech: built for researchers and PyTorch developers working on Speech models (19k stars) What it does All text below is quoted directly from the project README. >A scalable generative AI framework built for researchers and developers working on Large Language Models, Multimodal, and Speech AI (Automatic Speech Recognition and Text-to-Speech) Updates: - 2026-07: MagpieTTS v2607 has been released with support for 3 new languages (Ar, Ko, Pt) + 9 existing languages (En, Es, De, Fr, Vi, It, Zh, Hi, Ja). - 2026-06: Nemotron-3.5-ASR-Streaming-0.6B has been released with 40 languages supported, controllable latency 80ms-1s, and 240-2400 1xH100 concurrent streams. Built on cache-aware Fastconformer architecture. - 2026-04: Parakeet-unified-en-0.6b has been released with high-quality offline and streaming (with a minimum latency of 160ms) inference in one model for English language with punctuation and capitalization support. - 2026: This repo has pivoted to focus on audio, speech, and multimodal LLMs. - 2025-06: Canary-Qwen-2.5B has been released with record-setting 5.63% WER on English Open ASR Leaderboard. >uv pip install 'nemo-toolkit[asr,tts]' Repository NVIDIA-NeMo/Speech Repository stats |Metric|Value| |:-|:-| |Stars|18,655| |Forks|3.7k| |Last release|v3.0.0 (2026-08-07)| |Languages|Python 78.6%, Jupyter Notebook 20.4%, Other 1%| |Contributors|546| |AI contributor accounts (Claude / Codex / Cursor / Copilot)|@claude (41 commits)| |AI co-authored commits|Claude: 42, Codex: 2, Cursor: 4, Copilot: 37| Main contributor |Field|Value| |:-|:-| |Name|Oleksii Kuchaiev| |GitHub|@okuchaiev| |Commits to this repo|883 (top contributor)| |Bio|Director of AI model post-training @ NVIDIA| |Company / Location|Santa Clara, CA| |Followers|317| ────────────────────────────── 📌 If you want to browse more repos like this, we've organized them by category and rankings here: bestgithubrepositories.com 🗂️ We're also archiving repos where possible, so useful projects don't disappear when they're removed from GitHub.

发现一个好东西： 开源的邮件解决方案，支持发送和接收，可直接部署在cf上，界面模仿的gmail hieunc229/mailflare t.co

CUDA Rust: NVIDIA's CUDA platform for Rust (3.9k stars) What it does All text below is quoted directly from the project README. >NVIDIA's CUDA platform for Rust. Host runtime crates plus Tile (cutile-rs) and SIMT (cuda-oxide) kernel programming models in idiomatic Rust. CUDA Rust: - cuda-oxide: A custom rustc codegen backend, cargo helper utility, and crates to help users target the traditional CUDA SIMT (Single Instruction, Multiple Threads) kernel programming model. Here users have access to every detail of device-side CUDA programming. - cutile-rs: A proc-macro plugin and crates to help users write CUDA kernels using the CUDA Tile programming model. - Runtime: cuda-bindings, cuda-core (with cuda-core-derive), and cuda-async provide a shared runtime: driver bindings, contexts, streams, device buffers, events, and lazy, composable device operations. - Both kernel programming models extend Rust's ownership rules across the GPU launch boundary: mutable buffers are partitioned into disjoint pieces before launch, immutable buffers are shared, and launchers keep those borrows alive while GPU work is in flight. - Kernels from both models interoperate: a cutile-rs Tile kernel and a cuda-oxide SIMT kernel can run on the same stream over shared device buffers. >CUDA Rust is an early-stage research project. Expect bugs, incomplete features, and API breakage. Repository NVIDIA/cuda-rust Repository stats |Metric|Value| |:-|:-| |Stars|3,901| |Forks|350| |Last release|v0.2.1 (2026-06-10)| |Languages|Rust 93.1%, Python 3%, LLVM 2.1%| |Contributors|82| |AI contributor accounts (Claude / Codex / Cursor / Copilot)|@claude (15 commits)| |AI co-authored commits|Claude: 17| Main contributor |Field|Value| |:-|:-| |GitHub|@nihalpasham| |Commits to this repo|790 (top contributor)| |Bio|Rust @NVIDIA cuda-oxide author Proof-oriented programming| |Company / Location|Nvidia / Bangalore, India| |Followers|365| ────────────────────────────── 📌 If you want to browse more repos like this, we've organized them by category and rankings here: bestgithubrepositories.com 🗂️ We're also archiving repos where possible, so useful projects don't disappear when they're removed from GitHub.

A friend built an AI brainstorming tool on the Markkula ethical decision-making framework, and it deliberately doesn’t decide anything A friend of mine made this and asked me to share it with people who teach or practise ethics. It is a Claude skill that applies the Markkula Center’s decision-making framework to a dilemma through five lenses: utilitarian, rights, justice, common good and care ethics. For each lens it gives a verdict and four options, from the completely ethical to doubling down, with a middle path that names who bears the cost. Its README says plainly that AI cannot be an ethical agent. It has no conscience and no accountability, and it can sound more certain than it should. The verdicts are prompts for your thinking, not rulings. The tool exists to surface stakeholders and angles you may have missed. Critique wanted: - Are the four options a useful way to see the range? - Does the “commit, don’t hedge” instruction produce false confidence? - What would you want a tool like this to refuse to do? Repo: g-v-s/markkula-ethics-framework-claude-skill . Credit for the framework belongs to the Markkula Center for Applied Ethics at Santa Clara University. This project isn’t endorsed by them.

Who Makes Lullwood: One Founder, 19 Claude Agents, and What Broke If you let AI agents ship code, ask where a human is still required and what your checks fail to catch. Lullwood is a free browser horror game made by Independence AI Studio: one human founder and 19 Claude agents orchestrated with Paperclip. This post covers who does what, how an agent's branch becomes a live page, and two things that broke. Who is on the team One person, the founder, and a roster on a Paperclip board. On 2026-10-28 the board lists 19 agents. Nine are not paused (seven idle, two running) and ten are paused. The roles that decide how a change reaches a player: - CEO decides what gets built and why. - CTO turns that into engineering work. - Founding Engineer owns infrastructure, CI, releases and deploys. - Game Engineer owns gameplay code and the mobile controls. - Code Reviewer gates pull requests that touch risky code. - Growth Lead sets marketing strategy and is the only agent that posts to social channels. - Content Producer drafts pages and posts, including this one. - Brand Reviewer passes or fails each draft against written brand rules before it can ship. The paused roles include the Game Tester, Feature Scout, Game Economist and Backlog Keeper. The engineering half of the org chart, and why we sized review to risk, is in an earlier Lullwood devlog post. How an agent's change reaches a player Agents push branches with an SSH deploy key. The key can move branches but has no GitHub API scope, so an agent cannot open or merge a pull request itself. A workflow opens the pull request against release/next. It squash-merges once both CI checks are green, when the branch is marked ready to ship and the change is not in the highest-risk tier: engine simulation, persistence, secrets and auth, and release cuts. Those wait for a blocking review. main is protected, a pull request is mandatory, and release cuts move release/next into it. As of 2026-10-28, origin/release/next holds 1,172 commits since the first one on 2026-08-14, and more than a thousand pull requests have merged. Two caveats on those numbers. Counting pull requests from git alone is harder than it looks. Most of ours are squash-merged and never produce a merge commit, so git rev-list --merges undercounts badly. We count the union of squash subjects ending in (#N) and Merge pull request #N subjects, and even that misses merged PRs whose subject carries no number. And the log shows who opened a pull request, not who or what wrote the change, so we do not publish a human-versus-agent percentage. What the human decides Direction, and the gates that are not delegated. The founder decides what Lullwood is and approves releases. Anything that spends money, contacts a real person or posts under a personal account (Reddit, Hacker News, LinkedIn) stays with the founder. On 2026-10-27 the founder also decided that a Brand Reviewer PASS is the approval for marketing pages, so that call is made once and not page by page. What broke A future date that kept getting through. Two pages we wrote carried a future datePublished, because the publish date from the brief leaked into the markup. Both passed brand review, because that check was on nobody's list. The fix corrected the page and left a future date in the sitemap. The next version of the check looked at the app and public folders and missed lib/devlog.ts, where a devlog post's date actually lives, so a post reached production dated ahead of the calendar. Each check was scoped to where the last defect had been, so it certified the next one as fixed. The check now searches every date on the whole branch. A clip of the wrong thing. A nine-second gameplay clip cost six agent working sessions and two failed reviews, then shipped nothing, because the capture script was filming a synthetic test scene and not the game. We wrote that one up in the Lullwood devlog. What to take from it Scope a check to the class of defect, not to the last instance of it. Write down who can approve what, and keep the list short. Count things with a command you can show someone, and put the date next to the number. You can read the code at DadonStyle/LULLWOOD. To see what the team is building, play Lullwood free in your browser, or read the Lullwood credits. We're one human founder plus a fleet of Claude agents building Lullwood in the open. Who makes Lullwood: the full page with every command Play Lullwood free in the browser

The Node.js Brotli flaw: your server decompresses whatever APIs send back On October 21, Node.js fixed a flaw in its Brotli decoder, CVE-2026-111497. I went through the Node images in my projects. Two Next.js frontends are built on a tag that still ships Node 22.21.1. That tag will never get the fix. > TL;DR: a crafted Brotli stream can make Node write outside the memory it reserved. The process can crash, leak memory, or run an attacker's code. You are exposed if your server decompresses Brotli that comes from outside. Node's fetch, axios and Express 5 all do it by default. Move to Node 22.23.4, 24.22.1 or 26.12.1. Node 18, Node 20 and some Docker tags will never be fixed. Versions and source status: snapshot as of October 31, 2026. Check the latest fixes before deploying. This article is for Node.js developers and for teams that ship Node in containers. You do not need to know Brotli to follow it. Who decompresses Brotli without knowing it The flaw has one condition. Your application must decompress Brotli data supplied by someone else. So the real question is simple. Which code on your server decompresses Brotli? I read the source code of Node, undici, axios and body-parser. The table sums up what each one does. The fetch case is the quietest one. Node built it on undici, the HTTP library of the Node.js project. Over HTTPS, fetch asks the server for Brotli on its own, with an accept-encoding header that includes br. Then it decompresses the response without asking you. Changing that header does not protect you. In undici's code, the decoder depends on the response's Content-Encoding header. A hostile server can send you Brotli even if you did not ask for it. The risk comes from URLs you do not control. Think of a webhook entered by a customer, a link preview, an RSS feed or an image to download. A compromised third-party API is enough too. For incoming requests, Express 5 relies on body-parser 2. That version decompresses bodies sent with Content-Encoding: br. So any client can push a Brotli stream at you. Express 4 uses body-parser 1, which does not know Brotli. !Two paths lead to Node's Brotli decoder Two paths lead to the decoder. The responses your server receives, and the bodies it accepts. You wrote neither. An image that only builds a frontend receives no traffic. It still needs the update, but it is not the priority. What Node.js fixed on October 21 On October 21, Node.js shipped three security releases: 22.23.4, 24.22.1 and 26.12.1. The advisory lists ten flaws. Four are rated "high". Only one can lead to code execution, the one in the Brotli decoder. A server that compresses with Brotli says so with the Content-Encoding: br header. The client must then decompress the response before reading it. That is the decoder's job. The decoder reads the stream piece by piece. When it hit an invalid section, it thought it was just missing a few bytes. It waited for more instead of rejecting the stream. Meanwhile, it kept storing the next bytes in a small eight-byte buffer. It did not stop at the edge. So it wrote into the memory next to it. This is called an out-of-bounds write. Node lists three possible effects. The process can crash. It can leak part of its memory. Or the attacker can run their own code inside your Node process. Node rates the flaw "high". The CVE record, written by Google, scores it 9.2 out of 10. The NVD, the US vulnerability database, scores it 9.8. The bug comes from Google's Brotli library. Google shipped the fixed versions the same day: 1.0.10, 1.1.1 and 1.2.1. But Node ships its own copy of Brotli. I checked with ldd in two official images. The node binary loads no Brotli library from the system. So updating the packages in your image changes nothing for Node. It is the same trap as Go's eMudhra fix, which I covered yesterday. Confirmed exploitation since October 27 On October 22, the CVE record still said "Exploitation: none". CISA added the flaw to its KEV catalog on October 27. That catalog records confirmed exploitation. The assessment changed to "active" the next day. On October 30, Singapore’s Cyber Security Agency also reported a public proof of concept. These sources describe successive states. They do not give an account of a specific attack here. This snapshot ends on October 31, 2026. My lab: 14 FROM node lines, three versions that will never be fixed I listed the FROM node: lines in every Dockerfile of my projects. I count 14 of them, in 11 files. For each tag, I read Docker Hub, then ran node --version in today's image. The tag that surprised me is node:22-alpine3.21. It looks like it follows Node 22. In fact, it ships Node 22.21.1, and it has not moved in a year. Alpine is a very small Linux distribution. The alpine3.21 suffix pins its version. The team behind the Node images dropped Alpine 3.21 on December 4, 2025. Today it only builds the Alpine 3.23 and 3.24 variants. Since then, that tag gets no new Node version at all. Nothing warns you. The build passes and the image starts. One of the two repositories does have a Dependabot that watches Docker images. In May, it proposed moving to node:25-alpine3.21. It kept the suffix, so it stayed inside the frozen family. Node 25 reached end of life three weeks later, on June 1. node:18-alpine and node:20-alpine are frozen for another reason. Node 18 has been end of life since April 30, 2025, Node 20 since April 30, 2026. Their copy of Brotli is version 1.1.0, inside the affected range. Node's advisory says it plainly. These official releases remain vulnerable because their release lines received no fix. One last detail, on my laptop. The cached node:24-alpine image dates from August 3. It holds Node 24.19.0, without the fix. A build that reuses that copy makes a vulnerable image, even with an up-to-date tag on Docker Hub. Then I searched my code for anything that decompresses Brotli. No service calls the Brotli functions of zlib. None uses Express. The two Next.js frontends make no server-side fetch in production. Their API calls leave from the browser. A single route makes a server-side fetch. It only turns on in local development, toward a storage service I control. So my real exposure is low. But a grep does not see what my dependencies do. And the next server-side fetch will arrive without anyone rereading the FROM line. The Brotli version number proves nothing Node shows the version of its libraries in process.versions. I compared two Node 22 images, one vulnerable and one fixed: docker run --rm node:22-alpine3.21 node -p "process.version + ' brotli ' + process.versions.brotli" # v22.21.1 brotli 1.1.0 docker run --rm node:22-alpine node -p "process.version + ' brotli ' + process.versions.brotli" # v22.23.4 brotli 1.1.0 Both show Brotli 1.1.0. Node applied Google's fix to its copy without changing that number. Node 24 is the same, with 1.2.0 before and after. Compare the Node version with 22.23.4, 24.22.1 or 26.12.1 instead. The fix also adds a constant to zlib.constants. In my tests, it only exists in the fixed versions. It makes a quick check in a running container: docker exec my-container node -p "process.version + ' ' + ('BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH' in require('zlib').constants)" # v22.23.4 true (fixed) # v22.21.1 false (vulnerable) What to change If you cannot deploy today, two settings reduce the risk. With Express 5, the inflate: false option rejects compressed bodies with a 415 error: app.use(express.json({ inflate: false })) // a body sent with Content-Encoding: br gets a 415 error With axios, the decompress: false option turns decompression off. Your code then gets the compressed bytes, and handling them is up to you. For fetch, I found no matching setting. Only a Node update protects it. The checklist > A Node fix only protects the container where it actually runs. - [ ] List every FROM node: line in your Dockerfiles - [ ] Spot end-of-life versions: Node 18, Node 20 and older - [ ] Spot tags tied to an Alpine version that is no longer built, such as alpine3.21 - [ ] Run node -p process.version in every production container - [ ] Do not trust process.versions.brotli - [ ] Look for server-side fetch and axios calls to URLs you do not control - [ ] Look for Express 5 and direct calls to the Brotli functions of zlib - [ ] Rebuild with --pull, then redeploy The takeaway The Brotli flaw does not need you to call Brotli yourself. fetch, axios and Express 5 do it for you, on data that comes from outside. And a Docker tag can look current while it ships a version that is a year old. Open your Dockerfiles today. Look for Node 18 and 20, and for tags that pin an Alpine version. Nobody will update them for you. Want a review of your images and your build pipeline? See my DevSecOps pipeline offer, or let's talk. Dossier DevSecOps et IA Continuer sur ce sujet Voir le dossier complet, puis deux retours directement liés et le service associé. --- Sources: Node.js, October 21, 2026 security releases · Node.js 22.23.4 release notes · CVE-2026-111497 record · NVD, CVE-2026-111497 · CISA KEV catalog · Singapore CSA, alert AL-2026-154 · Brotli 1.2.1 release notes · undici 6.29.1, fetch source · body-parser 2.4.0, body reading · axios HTTP adapter · Node.js zlib documentation · Node.js release schedule · docker-node, Alpine 3.21 removal · Docker Hub, node image · docker build documentation

no, you really ideally want to yeet the agent in a vm to properly run yolo mode. there's a Bunch of agent sandbox thingies out there, i use matchlock but there's many others. here's a list but it's 4 months old so maybe ask an agent instead. fishman/awesome-agent-sandbox. u could also vibe qemu.

@oaranda para la 1 y la 5: hice demi, donde le puedes asignar un modelo distinto a cada tipo de subagente con perfiles, y rota solo entre varias cuentas de la misma suscripción conforme se van topando los límites: wspl/demi

GitHub Actions アクションのピン留めから Workflow Lockfiles に移行すると zizmor の unpinned-uses エラーが出てしまう状態だったんだけど今日リリースされた zizmor v1.32.0 でサポートされた😀（まだ実験的機能） Release v1.32.0 · zizmorcore/zizmor github.com/zizmorcore/zizmor/releases/tag/v1.32.0

@runes_leo AI 这层其实不用折腾组网。各台机器跑个小 runner 就可以直接内网穿透连回服务器，一个对话里就能直接调多台机器跑命令和转发端口。这是我在 demi 里实践过的 wspl/demi

Cloudflare publie en open source « security-audit », le skill qui transforme ton agent de code en auditeur de sécurité. cloudflare/security-audit-skill

Scalix 一応v0.1できた yy981-jp/Scalix クロスプラットフォームで動くはずではあるんだけど、まだあんまり中身がないから本当に開発中って感じ

スマホから自宅PCにSSHして作業する環境を整備した はじめに 私は普段Claude Codeを使って開発をしています。 最近はクラウド環境でClaude Codeを実行できるようになり、これはとても便利なのですが、権限周りに少しクセがあったり、自前の環境を使いたくなったりすることもあって、まだまだ自宅PC上でClaude Codeを利用する機会が多いです。 また、Claude Code Remote Controlの機能を使うと、実行中のセッションをスマホアプリから簡単に確認・操作できます。これによりスマホからでも手軽に開発を進められますが、そもそものセッションの起動・管理や、自宅PCでの細かい作業は結局PCの前で行う必要がありました。 そこで今回、スマホから自宅PCにSSH接続できる環境を整備してみました。 今回のポイントは以下です。 外出先からも安全にSSHできる：セキュリティ上、自宅ルーターのポート開放はしたくないのでVPNを活用します。 Tailscale、Termiusで実現 PCの直接操作とスマホからの操作で、相互に作業を引き継げる：自宅にいるときはPCを直接操作するので、どこからアクセスしても作業をシームレスに引き継げるのが理想です。 herdr（ターミナルマルチプレクサ）で実現 構成情報 完成図 利用ツール ツール名 概要 料金 Tailscale WireGuardベースのメッシュVPN。端末同士をP2Pでつなぐので、ルーターのポート開放なしで外から自宅PCにアクセスできる 無料（Personalプラン：非商用・6ユーザーまで） Termius iOS / Androidで使えるSSHクライアント。スマホからのSSH接続に利用 無料（Starterプラン） 有料のProは $10/月（年払い） herdr コーディングエージェント向けのターミナルマルチプレクサ。セッションをバックグラウンドで維持し、どの端末からでもdetach / attachできる 無料（OSS） Claude Code コーディングエージェント。Remote Control機能でスマホのClaudeアプリからセッションを操作できる Pro以上のプランが必要 Pro：$20/月（年払いなら $17/月）、Max：$100/月〜 ※ 料金は2026年11月時点のものです。 herdrについて補足 herdrはコーディングエージェント向けのターミナルマルチプレクサです。そもそもターミナルマルチプレクサとは、1つのターミナル画面の中で複数の仮想的な端末セッションやウィンドウ、画面分割（ペイン）を同時に管理・操作できるソフトのことです。セッションの永続化と共有が可能なので、SSH接続が途中で切れてもセッションは残り続けて作業が止まることはなく、既存のセッションにアタッチすれば作業を継続できます。 ターミナルマルチプレクサとしてはtmuxが有名で、私も以前は利用していたのですが、herdrを試してみたところ使い勝手が良かったので、今はこちらに移行しています。 herdrについてはこちらの記事が詳しいです。 zenn.dev 個人的には、GUI操作がしやすい点と、herdr自体をCLIから操作でき、公式スキルを入れておくとコーディングエージェントがペインを分けるなどの操作をしながら作業してくれる点が気に入っています。 構築手順 スマホから自宅PCへのSSH接続 SSH接続の部分については、以下の記事に今回と同様の構成がまとめられていたので、そちらを紹介して本記事では割愛します。 zenn.dev herdrのインストールと接続 自宅PCにインストール Linuxの場合、インストールは以下のコマンドで行います。 curl -fsSL releases.herdr.dev | sh 以下のコマンドで起動できます。 herdr herdrを起動すると、ターミナルは以下のようになります。左側に、開いているスペースの一覧とエージェントの状態が表示されます。 スマホ上でherdrにアタッチする スマホからherdrにアタッチするには、TermiusでSSH接続した状態で、同じくherdrコマンドを実行するだけです。 スマホ上では以下のように表示されます。縦長ですが、PCで見たレイアウトがそのまま表示されています。小さいので少し操作しづらいですが、タップでスペースの切り替えやタブの追加なども可能です。 キーボードを出すとこんな感じです。 画面は拡大・縮小でき、拡大すると以下のような表示に変わります。先ほど左側にあったスペース一覧などが消え、上部に移動しています。この「switch」をタップするとスペースを切り替えられます。 まとめ Tailscale、Termius、herdrを使って、スマホから自宅PCにSSHして作業する環境を整備してみました。 herdrのおかげで、どの端末から操作しているかを気にすることなく作業を継続できるのでとても便利です。 ただ、やはりスマホの小さい画面と打ちにくいキーボードだけで複雑なコマンド操作をするのは厳しいと感じました。Claude CodeをTermius上で操作するのも少し使いづらいので、今のところTermiusでの作業はClaude Codeのセッション管理など必要最小限にとどめ、それ以外はClaudeアプリからRemote ControlでClaude Codeを操作する形にしています。

8 .gitattributes Lines That Shrink Agent Diffs and Calm Parallel-Branch Merges - Book: Thinking in Go (2-book series) — Complete Guide to Go Programming + Hexagonal Architecture in Go - Also by me: Pocket Guides for Developers — the 8-book series - My project: Hermes IDE | GitHub — an IDE for developers who ship with Claude Code and other AI coding tools - Me: xgabriel.com | GitHub --- Three coding agents, three branches, one Go service. Each agent fixed its bug and then did the polite thing: it added a bullet under ## [Unreleased] in CHANGELOG.md. The first branch merges clean. The second stops on conflict markers in a file where both sides are right. The third one bumped a dependency, so its pull request opens with a screen of go.sum checksums before you reach the code you need to read. Git merges and diffs every file the same way unless you tell it otherwise. The place you tell it is .gitattributes, and eight lines cover the files parallel agents tend to collide on: the changelog, lockfiles, generated code and snapshot fixtures. The whole file, then line by line Here it is. Commit it on main before you start the agents, so every branch cut from main carries the same rules. # 1. LF in the repo and in every worktree * text=auto eol=lf # 2-3. Function names in hunk headers *.go diff=golang *.php diff=php # 4. Keep both sides' changelog bullets CHANGELOG.md merge=union # 5-6. Lockfiles: no local diff hunks go.sum -diff linguist-generated package-lock.json -diff # 7. Codegen GitHub can't spot on its own api/gen/** linguist-generated # 8. Snapshot images: never convert, never merge testdata/**/*.png binary Two rules from the gitattributes docs explain the layout. When several patterns match a path, "a later line overrides an earlier line", and that happens per attribute. So line 8 can switch off the text that line 1 switched on, for PNGs only. And a pattern that names a directory does not match the files inside it: write api/gen/**, not api/gen/. Line 1: * text=auto eol=lf. Git decides per file whether it is text, and for text files it stores LF. With eol=lf, the working tree gets LF on checkout too, on every OS. That matters when one agent runs on Windows or one tool saves with CRLF: without the rule, a file whose endings flip shows every line as changed. Files already committed with CRLF are not converted on their own; the docs give the fix, run once from a clean tree: git add --renormalize ., then commit. To check, git ls-files --eol prints each file's endings in the index (i/), in the working tree (w/) and the attribute in force (attr/). If a Windows script needs CRLF, add *.bat text eol=crlf below line 1. Lines 2 and 3: diff=golang and diff=php. Every hunk starts with @@ -a,b +c,d @@ and then a line of context git picked as the "function name". By default that is the nearest line that "begins with an alphabet, an underscore or a dollar sign", the same rule GNU diff -p uses. Go puts func at column zero, so the default often finds it anyway. diff=golang makes the choice deliberate with a Go pattern. The docs also say each built-in language ships a word regex, so git diff --word-diff splits Go tokens properly. PHP is the case that needs it: methods sit indented inside a class, the default rule skips indented lines, and the hunk header usually names the class instead of the method. Both golang and php are in git's built-in list, so there is nothing to configure beyond the attribute. Line 4: merge=union for the changelog This is the line that ends the fake conflict in the opening. The docs describe the built-in union driver like this: "Run 3-way file level merge for text files, but take lines from both versions, instead of leaving conflict markers." !Three branch lines converging on one long page, each dropping its own new line onto it in a neat stack Three branches, one changelog: union keeps every new line instead of stopping on markers. Two agents each add a bullet under ### Added. A normal merge sees both sides inserting at the same spot and stops. Union keeps both bullets. That is what an append-only file wants. Read the warning that comes with it, though, because it is in the same paragraph of the docs: union "tends to leave the added lines in the resulting file in random order and the user should verify the result. Do not use this if you do not understand the implications." In practice that means two things for a changelog: - Union is right for added lines and wrong for edited ones. If two branches both change the same existing line, say a version number in a heading, you get both versions and no warning. - It never applies to code. Keep it on files where every line stands alone. You can try it before you commit the rule. git merge-file takes three files in the order current, base, other, and --union resolves conflicts by keeping both sides: git merge-file -p --union \ changelog-ours.md changelog-base.md changelog-theirs.md -p prints the result instead of overwriting the first file, so it is safe to run on copies. One more thing to check: whether your host's merge button honours the attribute. A GitLab issue notes that GitLab reads built-in drivers like union from .gitattributes, while custom drivers defined in git config don't run in merge requests. If branches land through a web button on your host, test it on a throwaway pull request first. Lines 5 to 7: keep lockfiles and codegen out of the way Lockfiles and generated code change for real, and you do want them committed. You don't want to read them line by line in a review, and you don't want an agent spending context on them when it runs git diff to check its own work. Two different attributes cover the two places you read diffs. -diff is for your terminal. The docs: a path with diff unset will "generate Binary files differ". So git diff and git log -p print a one-line notice for go.sum instead of hunks of hashes. The file still merges as text, because -diff says nothing about merging. When you want the content, git diff --text go.sum shows it anyway (--text means "treat all files as text"). go.sum is a good target. The Go modules reference describes it as "cryptographic hashes of the module's direct and indirect dependencies". The change a human reviews is in go.mod, which stays diffable. package-lock.json gets the same treatment if the repo has a web front end. linguist-generated is for GitHub. GitHub's docs say files marked with it are hidden by default in diffs and left out of the repository's language statistics. GitHub already spots some files without help. Linguist's generated.rb catches package-lock.json and composer.lock by name, and Go files with a // Code generated line in their first 40 lines. That is the Go convention (^// Code generated .* DO NOT EDIT\.$), so most .pb.go and other codegen output is covered already. go.sum is not on that list, which is why line 5 sets both attributes. Line 7 is for generated output that carries no such header, like a bundled OpenAPI spec or a generated TypeScript client under api/gen/. Don't reach for binary on lockfiles. It is a macro for -diff -merge -text, and with merge unset git takes the current branch's version and declares a conflict every time both branches change the file. For a lockfile, a text merge followed by go mod tidy or npm install is the better path. Line 8: binary for snapshot fixtures Image snapshots are the opposite case. A line merge of two PNGs is never useful, and a converted byte breaks the test. Under line 1 alone, text=auto leaves git to decide by itself whether each PNG is text; line 8 takes that decision out of git's hands. The docs define the macro as [attr]binary -diff -merge -text: no text diff, no line merge, no end-of-line conversion. Because it sits after line 1, it wins for these paths. testdata/ is the right home for them in Go. The go command docs say the tool "will ignore a directory named 'testdata', making it available to hold ancillary data needed by the tests." When two agents both re-record a snapshot, the merge now stops on that file, keeping your branch's copy, and you regenerate it from the merged code. For text golden files that get regenerated whole, use -merge on its own instead. You keep a readable diff in review and still get the stop-and-regenerate behaviour on merge. Prove each line applies with git check-attr A typo in a pattern fails silently. git check-attr tells you what git will actually use for a path. With -a it lists every attribute that is set, unset or given a value for each path you name: git check-attr -a -- CHANGELOG.md go.sum \ api/gen/client.ts testdata/golden/home.png The output format is <path>: <attribute>: <info>, one line per attribute. You are looking for merge: union on the changelog, diff: unset and linguist-generated: set on go.sum, and diff, merge and text all unset on the PNG. Line 1 matches every path, so each one prints at least eol: lf and a text line. If that is all a path shows, none of the specific lines matched it, so check that pattern for a typo. Add --cached to read .gitattributes from the index only, which tells you what is committed rather than what sits in your working tree. Run it once before you cut the agents' branches. Reviewing several agents' branches by file I build Hermes IDE, so weigh this section with that in mind. In Hermes, ⌘N (Ctrl+Shift+N on Windows and Linux) starts each task on its own hermes/<name> branch in its own worktree, with the task as the agent's first prompt. Those branches and worktrees are plain git, so a .gitattributes committed on the branch you start from is in every worktree. !Two agent sessions side by side in Hermes IDE, Codex on orders-types and Claude Code on orders-api, each in its own hermes/ worktree, with the sessions sidebar on the left Two agent sessions side by side: Codex on orders-types and Claude Code on orders-api, each in its own hermes/ worktree, with the sessions sidebar (status, context use, cost, branch) on the left. The Review Desk (⌘G, or Ctrl+Shift+G) shows a task's changes by turn or by file, with risk flags, and a line comment goes back to the agent that wrote that line. In either view, line 1 keeps a commit from showing every line changed over line endings, and the changed-files list lets you pass over go.sum and the changelog to spend your attention on the code. !The Hermes Review Desk in By turn view for a Claude Code task, with two turns listed, a diff of src/db.ts, the changed-files list and a drafted commit message The Review Desk (⌘G) in By turn view: two turns, turn 1's diff of src/db.ts, the changed-files list, and a commit message drafted from the turns. When a task is ready, Land commits, opens a pull request or merges locally into the branch the task started from, and it can be undone. If the remote is on GitHub, a pull request opened that way gets GitHub's collapsed view for go.sum and api/gen/. Hermes is free to download, source-available under BSL 1.1, and runs on macOS, Windows and Linux. It is not affiliated with Nous Research, Anthropic, OpenAI or any agent vendor. Download it here, and the source is on GitHub. --- If this was useful A .gitattributes file only calms the merges. Whether three agents can work on one Go service without stepping on each other comes down to how the code is split: clear packages, clear boundaries, small files that change for one reason. Thinking in Go is my two-book series on that, first the language itself, then hexagonal architecture in Go, where the domain sits behind ports and the adapters change on their own. 

@stevelacey i made demi with zero mcp. the model gets one shell tool and every feature is a cli with --help it reads when it needs to, so no human ever sets up a connector: wspl/demi

Fatortak Cloud: managed hosting, backups, updates and support — from 300 EGP/month. Code + docs → Fatortak/Fatortak_Software

built a small MCP Gateway/Proxy just so that I can use Bear Notes App MCP CLI ... since the app will only work on Mac, there is no way for my hermes agent, which is hosted on linux, to access my notes. So, I asked codex to build one and here we are zaherg/mcp-gateway

It’s been a while since “AI” that I’ve found a tool I’m interested in, so here goes! Wifit3 looks cool. derv82/wifit3

A friend made a practice tool for business ethics cases: five lenses, four options per case An interesting thing I found from my friend. For business ethics courses that use the Markkula framework, it is a Claude skill that lets you run a case through the lenses and compare the outcomes. It has an exam-ready mode that gives a short answer lens by lens, and a fuller analysis mode. It is for practice and brainstorming only. It cannot make an ethical decision for you, and it shouldn’t be used to justify one. If you’ve used the Markkula framework in a course, does the exam-ready format match what your professors expect? Repo: g-v-s/markkula-ethics-framework-claude-skill

ZDirMap – Map any folder, export it 9 ways (free & open source) ZDirMap turns any folder into a directory tree you can filter, annotate, reorder and export: an ASCII tree for your README, Markdown, JSON, YAML, CSV, HTML, Mermaid, or a WinDirStat-style treemap. Free, open source, native desktop app. ▶ Download: zsync.eu ▶ Source code: TheHolyOneZ/ZDirMap ▶ All projects: zsync.eu • Streaming scan with live progress, smart ignore (node_modules, .git, dist…) and .gitignore import • Tri-state checkboxes: pick exactly what ships in the output • Inline # comments and drag-and-drop reorder flow straight into every format • 9 output formats: ASCII, Markdown, JSON, YAML, Flat, CSV, HTML, Mermaid, Treemap • Squarified treemap with drill-in: find what's eating your disk • Snapshots + diff, and one-click "Export all" Platforms: Windows · Linux · License: GPL-3.0 · Free, no account, no telemetry #ZDirMap #DirectoryTree #OpenSource #DeveloperTools #Treemap #Tauri

Git + GitHub + AI с НУЛЯ за 7 минут. Полный гайд для новичков Git с нуля и GitHub для начинающих за 7 минут! Как пользоваться Git, сохранять код, работать с ветками и управлять AI-агентами через Claude Code, Cursor и Git Worktree — объясняю простыми словами. В этом видео ты узнаешь, что такое Git и GitHub, зачем нужны коммиты, как создавать ветки, открывать Pull Requests и настраивать автоматические проверки через GitHub Actions. Это практическое введение в Git для новичков, вайб-кодеров и всех, кто создаёт сайты и приложения с нейросетями. Даже если код за тебя пишет AI, понимать Git необходимо, чтобы не потерять результаты работы. 📦 **Git и GitHub: бесплатные инструкции и шпаргалки** 👉 github.com/rah-emil/avis-tv-tutorials/blob/master… В репозитории: - Установка Git и GitHub CLI на Windows, macOS и Ubuntu. - Основные команды Git с примерами. - Работа с ветками и Pull Requests. - Git Worktree для параллельной работы AI-агентов. - Полезные настройки и сокращения. ⏱ **ТАЙМКОДЫ:** 00:00 Зачем нужен Git при работе с AI 00:40 Что такое Git и коммиты 01:25 GitHub, push, pull и gh CLI 02:10 Ветки Git: main, develop, feature 03:00 Pull Request и merge 03:45 GitHub Actions и автоматические проверки 04:35 Git с AI: сохранения, история и безопасность 05:25 Git Worktree: несколько AI-агентов 06:35 Итоги и полезные материалы 💬 А ты уже используешь Git при работе с AI или пока доверяешь нейронке всё? Подписывайся на AVIS TV! Здесь рассказываю о программировании, AI, стартапах и IT-архитектуре понятным языком. #Git #GitHub #ВайбКодинг [en-US] Git + GitHub + AI from SCRATCH in 7 minutes. A complete guide for beginners Git from scratch and GitHub for beginners in 7 minutes! How to use Git, save code, work with branches, and manage AI agents using Claude Code, Cursor, and Git Worktree—I explain it in simple terms. In this video, you'll learn what Git and GitHub are, why commits are needed, how to create branches, open pull requests, and set up automatic checks using GitHub Actions. This is a practical introduction to Git for beginners, vibe coders, and anyone creating websites and apps with neural networks. Even if your code is written by AI, understanding Git is essential to avoid losing your work. 📦 **Git and GitHub: Free Instructions and Cheat Sheets** 👉 github.com/rah-emil/avis-tv-tutorials/blob/master… In the repository: - Installing Git and GitHub CLI on Windows, macOS, and Ubuntu. - Basic Git commands with examples. - Working with branches and pull requests. - Git Worktree for parallel AI agent execution. - Useful settings and shortcuts. ⏱ **TIMESTAMPS:** 00:00 Why do you need Git when working with AI? 00:40 What is Git and commits? 01:25 GitHub, push, pull, and gh CLI 02:10 Git branches: main, develop, feature 03:00 Pull Request and merge 03:45 GitHub Actions and automatic checks 04:35 Git with AI: saving, history, and security 05:25 Git Worktree: several AI agents 06:35 Summary and useful materials 💬 Are you already using Git when working with AI, or are you still trusting the neural network to handle everything? Subscribe to AVIS TV! Here I talk about programming, AI, startups, and IT architecture in easy-to-understand language. #Git #GitHub #VibeCoding

4/4 privacy-first, open source, self-hostable 🧡 hroomnik007/MintRadar shipping all month, updates in this thread 👇 #Cashu #ecash

laravel-trend ⭐ 1.1k Generates trend data for Laravel models, for Laravel developers. 🔗 Flowframe/laravel-trend #opensource t.co

7 GitHub Repos That Make Claude Code Better #ClaudeCode Seven GitHub repos that make my Claude Code much better, all installed on my system right now. 🎁 Free Claude Code starter kit, sent to your inbox: genaiunplugged.substack.com 🆓 Free live lesson with me: genaiunplugged.com 🎓 Claude Code Builder, my 6-week live cohort: maven.com 👥 Train your team on Claude Code: genaiunplugged.com Research and video: last30days reads Reddit, X, YouTube and Hacker News. HyperFrames renders HTML as an MP4. Process and documents: agent-skills runs spec, plan, build and review. Anthropic's skills repo covers Word, PDF, PowerPoint and Excel. Automation: n8n-skills, playwright-skill and Google Workspace CLI. Which repo should be number eight? Tell me in the comments. Repo number one: mvanhorn/last30days-skill #Shorts #ClaudeCode #AIWorkflow [ar] 7 مستودعات GitHub تجعل برمجة Claude أفضل #ClaudeCode سبعة مستودعات على GitHub تُحسّن أداء Claude Code بشكل ملحوظ، جميعها مُثبّتة على جهازي الآن. 🎁 مجموعة أدوات Claude Code للمبتدئين مجانًا، تُرسل إلى بريدك الإلكتروني: genaiunplugged.substack.com 🆓 درس مباشر مجاني معي: genaiunplugged.com 🎓 دورة Claude Code Builder التدريبية المباشرة لمدة 6 أسابيع: maven.com 👥 درّب فريقك على Claude Code: genaiunplugged.com البحث والفيديو: Last30days يقرأ Reddit وX وYouTube وHacker News. HyperFrames يُحوّل HTML إلى MP4. العمليات والوثائق: agent-skills يُشغّل المواصفات والتخطيط والبناء والمراجعة. مستودع مهارات Anthropic يُغطي Word وPDF وPowerPoint وExcel. الأتمتة: n8n-skills، وplaywright-skill، وGoogle Workspace CLI. أيّ مستودع يجب أن يكون رقم 8؟ شاركونا آراءكم في التعليقات. المستودع رقم 1: mvanhorn/last30days-skill #Shorts #ClaudeCode #AIWorkflow [bn] যে ৭টি গিটহাব রেপো ক্লোড (Claude) কোডকে আরও উন্নত করে #ClaudeCode সাতটি গিটহাব রিপো যা আমার ক্লড কোডকে আরও উন্নত করে, সবগুলোই এই মুহূর্তে আমার সিস্টেমে ইনস্টল করা আছে। 🎁 বিনামূল্যে ক্লড কোড স্টার্টার কিট, আপনার ইনবক্সে পাঠানো হবে: genaiunplugged.substack.com 🆓 আমার সাথে বিনামূল্যে লাইভ লেসন: genaiunplugged.com 🎓 ক্লড কোড বিল্ডার, আমার ৬-সপ্তাহের লাইভ কোহর্ট: maven.com 👥 আপনার টিমকে ক্লড কোডে প্রশিক্ষণ দিন: genaiunplugged.com গবেষণা এবং ভিডিও: last30days রেডিট, এক্স, ইউটিউব এবং হ্যাকার নিউজ পড়ে। HyperFrames এইচটিএমএলকে MP4 হিসেবে রেন্ডার করে। প্রক্রিয়া এবং ডকুমেন্ট: agent-skills স্পেক, প্ল্যান, বিল্ড এবং রিভিউ চালায়। Anthropic-এর স্কিলস রিপো ওয়ার্ড, পিডিএফ, পাওয়ারপয়েন্ট এবং এক্সেল কভার করে। অটোমেশন: n8n-skills, playwright-skill এবং Google Workspace CLI। আট নম্বর রিপো কোনটি হওয়া উচিত? কমেন্টে জানান। এক নম্বর রিপো: mvanhorn/last30days-skill #Shorts #ClaudeCode #AIWorkflow [de-DE] 7 GitHub-Repos, die Claude-Code besser machen #ClaudeCode Sieben GitHub-Repos, die meinen Claude Code deutlich verbessern – alle aktuell auf meinem System installiert. 🎁 Kostenloses Claude Code Starter-Kit direkt in Ihren Posteingang: genaiunplugged.substack.com 🆓 Kostenlose Live-Lektion mit mir: genaiunplugged.com 🎓 Claude Code Builder, mein 6-wöchiger Live-Kurs: maven.com 👥 Schulen Sie Ihr Team in Claude Code: genaiunplugged.com Recherche und Video: last30days analysiert Reddit, X, YouTube und Hacker News. HyperFrames rendert HTML als MP4. Prozesse und Dokumente: agent-skills führt Spezifikationen, Planung, Entwicklung und Überprüfung durch. Das Skills-Repository von Anthropic deckt Word, PDF, PowerPoint und Excel ab. Automatisierung: n8n-skills, playwright-skill und Google Workspace CLI. Welches Repository sollte Nummer acht sein? Schreibt es mir in die Kommentare. Repository Nummer eins: mvanhorn/last30days-skill #Shorts #ClaudeCode #AIWorkflow [es-US] 7 repositorios de GitHub que hacen que el código de Claude sea mejor #ClaudeCode Siete repositorios de GitHub que mejoran notablemente mi código Claude, todos instalados en mi sistema. 🎁 Kit de inicio gratuito para el código Claude, enviado a tu correo electrónico: genaiunplugged.substack.com 🆓 Clase en vivo gratuita conmigo: genaiunplugged.com 🎓 Claude Code Builder, mi curso intensivo de 6 semanas: maven.com 👥 Capacita a tu equipo en el código Claude: genaiunplugged.com Investigación y vídeo: last30days analiza Reddit, X, YouTube y Hacker News. HyperFrames convierte HTML a MP4. Procesos y documentos: agent-skills gestiona la especificación, el plan, la compilación y la revisión. El repositorio de habilidades de Anthropic abarca Word, PDF, PowerPoint y Excel. Automatización: n8n-skills, playwright-skill y la CLI de Google Workspace. ¿Qué repositorio debería ser el número ocho? Díganmelo en los comentarios. Repositorio número uno: mvanhorn/last30days-skill #Shorts #ClaudeCode #AIWorkflow [fr-FR] 7 dépôts GitHub qui améliorent le code de Claude #ClaudeCode Sept dépôts GitHub qui améliorent considérablement mon utilisation de Claude Code, tous installés sur mon système. 🎁 Kit de démarrage Claude Code gratuit, directement dans votre boîte mail : genaiunplugged.substack.com 🆓 Cours en direct gratuit avec moi : genaiunplugged.com 🎓 Claude Code Builder, ma formation en ligne de 6 semaines : maven.com 👥 Formez votre équipe à Claude Code : genaiunplugged.com Recherche et vidéo : last30days analyse Reddit, X, YouTube et Hacker News. HyperFrames convertit le HTML en MP4. Processus et documents : agent-skills gère les spécifications, la planification, le développement et la revue. Le dépôt de compétences d'Anthropic couvre Word, PDF, PowerPoint et Excel. Automatisation : n8n-skills, playwright-skill et l’interface de ligne de commande Google Workspace. Quel dépôt devrait être le huitième ? Dites-le-moi en commentaire. Dépôt numéro un : mvanhorn/last30days-skill #Shorts #ClaudeCode #AIWorkflow [hi] 7 GitHub रिपोस जो Claude कोड को बेहतर बनाते हैं #ClaudeCode सात GitHub रिपॉजिटरी जो मेरे Claude Code को और भी बेहतर बनाती हैं, ये सभी मेरे सिस्टम पर अभी इंस्टॉल हैं। 🎁 मुफ़्त Claude Code स्टार्टर किट, आपके इनबॉक्स में भेजी जाएगी: genaiunplugged.substack.com 🆓 मेरे साथ मुफ़्त लाइव लेसन: genaiunplugged.com 🎓 Claude Code Builder, मेरा 6-सप्ताह का लाइव कोहोर्ट: maven.com 👥 अपनी टीम को Claude Code पर प्रशिक्षित करें: genaiunplugged.com अनुसंधान और वीडियो: last30days Reddit, X, YouTube और Hacker News पढ़ता है। HyperFrames HTML को MP4 के रूप में रेंडर करता है। प्रक्रिया और दस्तावेज़: agent-skills spec, plan, build और review चलाता है। Anthropic की स्किल्स रिपॉजिटरी Word, PDF, PowerPoint और Excel को कवर करती है। ऑटोमेशन: n8n-skills, playwright-skill और Google Workspace CLI। आठवें नंबर पर कौन सी रिपॉजिटरी होनी चाहिए? मुझे कमेंट्स में बताएं। पहली रिपॉजिटरी: mvanhorn/last30days-skill #Shorts #ClaudeCode #AIWorkflow [id] 7 Repo GitHub yang Membuat Kode Claude Lebih Baik #ClaudeCode Tujuh repositori GitHub yang membuat Claude Code saya jauh lebih baik, semuanya terpasang di sistem saya saat ini. 🎁 Paket pemula Claude Code gratis, dikirim ke kotak masuk Anda: genaiunplugged.substack.com 🆓 Pelajaran langsung gratis bersama saya: genaiunplugged.com 🎓 Claude Code Builder, kelompok langsung saya selama 6 minggu: maven.com 👥 Latih tim Anda tentang Claude Code: genaiunplugged.com Riset dan video: last30days membaca Reddit, X, YouTube, dan Hacker News. HyperFrames merender HTML sebagai MP4. Proses dan dokumen: agent-skills menjalankan spesifikasi, perencanaan, pembangunan, dan peninjauan. Repositori keterampilan Anthropic mencakup Word, PDF, PowerPoint, dan Excel. Otomatisasi: n8n-skills, playwright-skill, dan Google Workspace CLI. Repositori mana yang seharusnya menjadi nomor delapan? Beri tahu saya di kolom komentar. Repositori nomor satu: mvanhorn/last30days-skill #Shorts #ClaudeCode #AIWorkflow [it] 7 repository GitHub che migliorano il codice di Claude #ClaudeCode Sette repository GitHub che migliorano notevolmente il mio Claude Code, tutti installati sul mio sistema in questo momento. 🎁 Kit di avvio gratuito per Claude Code, inviato alla tua casella di posta: genaiunplugged.substack.com 🆓 Lezione live gratuita con me: genaiunplugged.com 🎓 Claude Code Builder, il mio corso live di 6 settimane: maven.com 👥 Forma il tuo team su Claude Code: genaiunplugged.com Ricerca e video: last30days analizza Reddit, X, YouTube e Hacker News. HyperFrames converte l'HTML in MP4. Processi e documenti: agent-skills esegue specifiche, pianificazione, sviluppo e revisione. Il repository di competenze di Anthropic copre Word, PDF, PowerPoint ed Excel. Automazione: n8n-skills, playwright-skill e Google Workspace CLI. Quale repository dovrebbe essere all'ottavo posto? Ditemelo nei commenti. Repository numero uno: mvanhorn/last30days-skill #Shorts #ClaudeCode #AIWorkflow [iw] 7 מאגרי GitHub שהופכים את הקוד של Claude לטוב יותר #ClaudeCode שבעה מאגרים של GitHub שהופכים את Claude Code שלי להרבה יותר טוב, כולם מותקנים על המערכת שלי עכשיו. 🎁 ערכת התחלה חינמית של Claude Code, נשלחה לתיבת הדואר הנכנס שלך: genaiunplugged.substack.com 🆓 שיעור חי חינמי איתי: genaiunplugged.com 🎓 Claude Code Builder, קבוצת הסטודנטים שלי בת 6 שבועות: maven.com 👥 הכשרה של הצוות שלך ב-Claude Code: genaiunplugged.com מחקר וסרטון: last30days קורא את Reddit, X, YouTube ו-Hacker News. HyperFrames מעבד HTML כקובץ MP4. תהליך ומסמכים: agent-skills מפעיל מפרט, תכנון, בנייה ובדיקה. מאגר המיומנויות של Anthropic מכסה Word, PDF, PowerPoint ו-Excel. אוטומציה: n8n-skills, playwright-skill ו-Google Workspace CLI. איזה מאגר צריך להיות מספר שמונה? ספרו לי בתגובות. מאגר מספר אחת: mvanhorn/last30days-skill #Shorts #ClaudeCode #AIWorkflow [ja] Claudeのコーディングが劇的に向上するGitHubリポジトリ7選 #ClaudeCode 私のClaude Codeをより使いやすくしてくれる7つのGitHubリポジトリを、現在すべてシステムにインストール済みです。 🎁 無料のClaude Codeスターターキットをメールでお届けします：genaiunplugged.substack.com 🆓 私との無料ライブレッスン：genaiunplugged.com 🎓 Claude Code Builder（6週間のライブコホート）：maven.com 👥 チーム向けClaude Codeトレーニング：genaiunplugged.com リサーチと動画：last30daysはReddit、X、YouTube、Hacker Newsを読み込みます。HyperFramesはHTMLをMP4に変換します。 プロセスとドキュメント：agent-skillsは仕様、計画、構築、レビューを実行します。AnthropicのスキルリポジトリはWord、PDF、PowerPoint、Excelに対応しています。 自動化ツール：n8n-skills、playwright-skill、Google Workspace CLI。 8番目におすすめのリポジトリはどれでしょうか？コメントで教えてください。 1番目のリポジトリ：mvanhorn/last30days-skill #Shorts #ClaudeCode #AIWorkflow [ko] Claude의 코딩 능력을 2배로 높여주는 깃허브 저장소 7곳 #ClaudeCode 제 Claude Code 실력을 훨씬 향상시켜주는 7개의 GitHub 저장소를 소개합니다. 모두 현재 제 시스템에 설치되어 있습니다. 🎁 무료 Claude Code 스타터 키트를 이메일로 받아보세요: genaiunplugged.substack.com 🆓 저와 함께하는 무료 라이브 강의: genaiunplugged.com 🎓 Claude Code Builder, 6주 라이브 코호트: maven.com 👥 팀원들에게 Claude Code 교육을 제공하세요: genaiunplugged.com 리서치 및 비디오: last30days는 Reddit, X, YouTube, Hacker News를 읽어줍니다. HyperFrames는 HTML을 MP4로 렌더링합니다. 프로세스 및 문서: agent-skills는 사양, 계획, 구축 및 검토를 실행합니다. Anthropic의 스킬 저장소는 Word, PDF, PowerPoint, Excel 관련 내용을 다룹니다. 자동화: n8n-skills, playwright-skill 및 Google Workspace CLI. 여덟 번째 저장소는 어떤 것이 좋을까요? 댓글로 알려주세요. 첫 번째 저장소: mvanhorn/last30days-skill #Shorts #ClaudeCode #AIWorkflow [ml] Claude-ന്റെ കോഡിംഗ് മെച്ചപ്പെടുത്തുന്ന 7 GitHub റിപ്പോകൾ #ClaudeCode എന്റെ ക്ലോഡ് കോഡിനെ കൂടുതൽ മികച്ചതാക്കുന്ന ഏഴ് GitHub റിപ്പോകൾ, എല്ലാം ഇപ്പോൾ എന്റെ സിസ്റ്റത്തിൽ ഇൻസ്റ്റാൾ ചെയ്തിട്ടുണ്ട്. 🎁 സൗജന്യ ക്ലോഡ് കോഡ് സ്റ്റാർട്ടർ കിറ്റ്, നിങ്ങളുടെ ഇൻബോക്സിലേക്ക് അയച്ചു: genaiunplugged.substack.com 🆓 എന്നോടൊപ്പം സൗജന്യ തത്സമയ പാഠം: genaiunplugged.com 🎓 ക്ലോഡ് കോഡ് ബിൽഡർ, എന്റെ 6-ആഴ്ച ലൈവ് കോഹോർട്ട്: maven.com 👥 ക്ലോഡ് കോഡിൽ നിങ്ങളുടെ ടീമിനെ പരിശീലിപ്പിക്കുക: genaiunplugged.com ഗവേഷണവും വീഡിയോയും: കഴിഞ്ഞ 30 ദിവസം റെഡ്ഡിറ്റ്, എക്സ്, യൂട്യൂബ്, ഹാക്കർ ന്യൂസ് എന്നിവ വായിക്കുന്നു. ഹൈപ്പർഫ്രെയിംസ് HTML ഒരു MP4 ആയി റെൻഡർ ചെയ്യുന്നു. പ്രോസസ്സും ഡോക്യുമെന്റുകളും: ഏജന്റ്-സ്കിൽസ് സ്പെക്ക്, പ്ലാൻ, ബിൽഡ്, അവലോകനം എന്നിവ പ്രവർത്തിപ്പിക്കുന്നു. ആന്ത്രോപിക്കിന്റെ സ്കിൽസ് റിപ്പോയിൽ വേഡ്, PDF, പവർപോയിന്റ്, എക്സൽ എന്നിവ ഉൾപ്പെടുന്നു. ഓട്ടോമേഷൻ: n8n-സ്കിൽസ്, നാടകകൃത്ത്-സ്കിൽ, ഗൂഗിൾ വർക്ക്‌സ്‌പേസ് CLI. ഏത് റെപ്പോയാണ് എട്ടാം നമ്പർ ആയിരിക്കേണ്ടത്? അഭിപ്രായങ്ങളിൽ എന്നോട് പറയുക. റെപ്പോ നമ്പർ വൺ: mvanhorn/last30days-skill #Shorts #ClaudeCode #AIWorkflow [nl-NL] 7 GitHub-repositories die Claude-code verbeteren #ClaudeCode Zeven GitHub-repositories die mijn Claude Code-ervaring aanzienlijk verbeteren, allemaal momenteel geïnstalleerd op mijn systeem. 🎁 Gratis Claude Code-startpakket, rechtstreeks in je inbox: genaiunplugged.substack.com 🆓 Gratis live les met mij: genaiunplugged.com 🎓 Claude Code Builder, mijn live cohort van 6 weken: maven.com 👥 Train je team met Claude Code: genaiunplugged.com Onderzoek en video: last30days leest Reddit, X, YouTube en Hacker News. HyperFrames zet HTML om naar MP4. Processen en documenten: agent-skills voert spec, plan, build en review uit. De skills-repository van Anthropic omvat Word, PDF, PowerPoint en Excel. Automatisering: n8n-skills, playwright-skill en Google Workspace CLI. Welke repository moet nummer acht zijn? Laat het me weten in de reacties. Repository nummer één: mvanhorn/last30days-skill #Shorts #ClaudeCode #AIWorkflow [pa] 7 GitHub ਰਿਪੋਜ਼ਟਰੀਆਂ ਜੋ Claude ਦੇ ਕੋਡ ਨੂੰ ਬਿਹਤਰ ਬਣਾਉਂਦੀਆਂ ਹਨ #ClaudeCode ਸੱਤ GitHub ਰਿਪੋ ਜੋ ਮੇਰੇ ਕਲਾਉਡ ਕੋਡ ਨੂੰ ਬਹੁਤ ਬਿਹਤਰ ਬਣਾਉਂਦੇ ਹਨ, ਸਾਰੇ ਮੇਰੇ ਸਿਸਟਮ 'ਤੇ ਹੁਣੇ ਸਥਾਪਿਤ ਹਨ। 🎁 ਮੁਫ਼ਤ ਕਲਾਉਡ ਕੋਡ ਸਟਾਰਟਰ ਕਿੱਟ, ਤੁਹਾਡੇ ਇਨਬਾਕਸ ਵਿੱਚ ਭੇਜੀ ਗਈ: genaiunplugged.substack.com 🆓 ਮੇਰੇ ਨਾਲ ਮੁਫ਼ਤ ਲਾਈਵ ਸਬਕ: genaiunplugged.com 🎓 ਕਲਾਉਡ ਕੋਡ ਬਿਲਡਰ, ਮੇਰਾ 6-ਹਫ਼ਤੇ ਦਾ ਲਾਈਵ ਸਮੂਹ: maven.com 👥 ਆਪਣੀ ਟੀਮ ਨੂੰ ਕਲਾਉਡ ਕੋਡ 'ਤੇ ਸਿਖਲਾਈ ਦਿਓ: genaiunplugged.com ਖੋਜ ਅਤੇ ਵੀਡੀਓ: last30days Reddit, X, YouTube ਅਤੇ ਹੈਕਰ ਨਿਊਜ਼ ਪੜ੍ਹਦਾ ਹੈ। HyperFrames HTML ਨੂੰ MP4 ਦੇ ਰੂਪ ਵਿੱਚ ਰੈਂਡਰ ਕਰਦਾ ਹੈ। ਪ੍ਰਕਿਰਿਆ ਅਤੇ ਦਸਤਾਵੇਜ਼: ਏਜੰਟ-ਹੁਨਰ ਸਪੈੱਕ, ਪਲਾਨ, ਬਿਲਡ ਅਤੇ ਸਮੀਖਿਆ ਚਲਾਉਂਦੇ ਹਨ। ਐਂਥ੍ਰੋਪਿਕ ਦਾ ਹੁਨਰ ਰਿਪੋ ਵਰਡ, PDF, PowerPoint ਅਤੇ Excel ਨੂੰ ਕਵਰ ਕਰਦਾ ਹੈ। ਆਟੋਮੇਸ਼ਨ: n8n-skills, playrayer-skill ਅਤੇ Google Workspace CLI। ਕਿਹੜਾ ਰੈਪੋ ਨੰਬਰ ਅੱਠ ਹੋਣਾ ਚਾਹੀਦਾ ਹੈ? ਟਿੱਪਣੀਆਂ ਵਿੱਚ ਮੈਨੂੰ ਦੱਸੋ। ਰੈਪੋ ਨੰਬਰ ਇੱਕ: mvanhorn/last30days-skill #Shorts #ClaudeCode #AIWorkflow [pl] 7 repozytoriów GitHub, dzięki którym Claude koduje lepiej #ClaudeCode Siedem repozytoriów GitHub, które znacznie ulepszyły mój Claude Code, wszystkie zainstalowane w moim systemie. 🎁 Darmowy zestaw startowy Claude Code, wysłany do Twojej skrzynki odbiorczej: genaiunplugged.substack.com 🆓 Darmowa lekcja na żywo ze mną: genaiunplugged.com 🎓 Claude Code Builder, moja 6-tygodniowa grupa na żywo: maven.com 👥 Szkolenie zespołu z Claude Code: genaiunplugged.com Badania i materiały wideo: last30days czyta Reddita, X, YouTube i Hacker News. HyperFrames renderuje HTML jako MP4. Proces i dokumenty: agent-skills tworzy specyfikację, planuje, buduje i recenzuje. Repozytorium umiejętności Anthropic obejmuje Worda, PDF-y, PowerPointa i Excela. Automatyzacja: n8n-skills, playwright-skill i Google Workspace CLI. Które repozytorium powinno być ósme? Dajcie znać w komentarzach. Repo numer jeden: mvanhorn/last30days-skill #Shorts #ClaudeCode #AIWorkflow [pt-BR] 7 Repositórios do GitHub que deixam o código do Claude melhor #ClaudeCode Sete repositórios do GitHub que melhoram muito meu Claude Code, todos instalados no meu sistema agora mesmo. 🎁 Kit inicial gratuito do Claude Code, enviado para sua caixa de entrada: genaiunplugged.substack.com 🆓 Aula ao vivo gratuita comigo: genaiunplugged.com 🎓 Claude Code Builder, meu curso ao vivo de 6 semanas: maven.com 👥 Treine sua equipe em Claude Code: genaiunplugged.com Pesquisa e vídeo: last30days lê Reddit, X, YouTube e Hacker News. HyperFrames renderiza HTML como MP4. Processos e documentos: agent-skills executa spec, plan, build e review. O repositório de habilidades do Anthropic abrange Word, PDF, PowerPoint e Excel. Automação: n8n-skills, playwright-skill e Google Workspace CLI. Qual repositório deveria ser o número oito? Deixe sua opinião nos comentários. Repositório número um: mvanhorn/last30days-skill #Shorts #ClaudeCode #AIWorkflow [ru] 7 репозиториев GitHub, которые улучшают код Claude #ClaudeCode Семь репозиториев GitHub, которые значительно улучшают мой код на Claude Code, установлены прямо сейчас в моей системе. 🎁 Бесплатный стартовый набор Claude Code, отправляемый на вашу электронную почту: genaiunplugged.substack.com 🆓 Бесплатный онлайн-урок со мной: genaiunplugged.com 🎓 Claude Code Builder, мой 6-недельный онлайн-курс: maven.com 👥 Обучите свою команду работе с Claude Code: genaiunplugged.com Исследования и видео: last30days читает Reddit, X, YouTube и Hacker News. HyperFrames преобразует HTML в MP4. Процесс и документы: agent-skills запускает спецификацию, планирование, сборку и проверку. Репозиторий навыков Anthropic охватывает Word, PDF, PowerPoint и Excel. Автоматизация: n8n-skills, playwright-skill и Google Workspace CLI. Какой репозиторий должен быть под номером восемь? Напишите в комментариях. Репозиторий номер один: mvanhorn/last30days-skill #Shorts #ClaudeCode #AIWorkflow [ta] Claude-இன் குறியீட்டை மேம்படுத்தும் 7 GitHub களஞ்சியங்கள் #ClaudeCode எனது கிளாட் கோட்-ஐ மிகவும் மேம்படுத்தும் ஏழு கிட்ஹப் ரெப்போக்கள், அனைத்தும் இப்போது என் சிஸ்டத்தில் நிறுவப்பட்டுள்ளன. 🎁 இலவச கிளாட் கோட் ஸ்டார்டர் கிட், உங்கள் இன்பாக்ஸிற்கு அனுப்பப்படும்: genaiunplugged.substack.com 🆓 என்னுடன் இலவச நேரலைப் பாடம்: genaiunplugged.com 🎓 கிளாட் கோட் பில்டர், எனது 6-வார நேரலைக் குழு: maven.com 👥 உங்கள் குழுவிற்கு கிளாட் கோட் பயிற்சி அளியுங்கள்: genaiunplugged.com ஆராய்ச்சி மற்றும் வீடியோ: last30days, ரெட்டிட், எக்ஸ், யூடியூப் மற்றும் ஹேக்கர் நியூஸ் ஆகியவற்றைப் படிக்கிறது. HyperFrames, HTML-ஐ MP4 ஆக ரெண்டர் செய்கிறது. செயல்முறை மற்றும் ஆவணங்கள்: agent-skills, ஸ்பெக், பிளான், பில்ட் மற்றும் ரிவ்யூ ஆகியவற்றை இயக்குகிறது. Anthropic-இன் ஸ்கில்ஸ் ரெப்போ, வேர்ட், PDF, பவர்பாயிண்ட் மற்றும் எக்செல் ஆகியவற்றை உள்ளடக்கியது. ஆட்டோமேஷன்: n8n-skills, playwright-skill மற்றும் Google Workspace CLI. எட்டாவது ரெப்போவாக இருக்க வேண்டியது எது? கமெண்ட்களில் சொல்லுங்கள். முதல் ரெப்போ: mvanhorn/last30days-skill #Shorts #ClaudeCode #AIWorkflow [te] Claude కోడ్ నాణ్యతను పెంచే 7 GitHub రిపోలు #ClaudeCode నా క్లాడ్ కోడ్‌ను మరింత మెరుగ్గా చేసే ఏడు గిట్‌హబ్ రిపోలు, అన్నీ ప్రస్తుతం నా సిస్టమ్‌లో ఇన్‌స్టాల్ చేయబడి ఉన్నాయి. 🎁 ఉచిత క్లాడ్ కోడ్ స్టార్టర్ కిట్, మీ ఇన్‌బాక్స్‌కు పంపబడుతుంది: genaiunplugged.substack.com 🆓 నాతో ఉచిత లైవ్ పాఠం: genaiunplugged.com 🎓 క్లాడ్ కోడ్ బిల్డర్, నా 6-వారాల లైవ్ కోహార్ట్: maven.com 👥 క్లాడ్ కోడ్‌పై మీ బృందానికి శిక్షణ ఇవ్వండి: genaiunplugged.com పరిశోధన మరియు వీడియో: last30days రెడ్డిట్, X, యూట్యూబ్ మరియు హ్యాకర్ న్యూస్‌లను చదువుతుంది. HyperFrames HTMLను MP4గా రెండర్ చేస్తుంది. ప్రక్రియ మరియు డాక్యుమెంట్లు: agent-skills స్పెక్, ప్లాన్, బిల్డ్ మరియు రివ్యూలను నడుపుతుంది. Anthropic యొక్క స్కిల్స్ రిపో Word, PDF, PowerPoint మరియు Excelలను కవర్ చేస్తుంది. ఆటోమేషన్: n8n-skills, playwright-skill మరియు Google Workspace CLI. ఎనిమిదవ స్థానంలో ఏ రెపో ఉండాలి? కామెంట్లలో తెలియజేయండి. మొదటి రెపో: mvanhorn/last30days-skill #Shorts #ClaudeCode #AIWorkflow [uk] 7 GitHub-репозиторіїв, що роблять Claude Code кращим #ClaudeCode Сім репозиторіїв GitHub, які значно покращують мій Claude Code, всі встановлені на моїй системі прямо зараз. 🎁 Безкоштовний стартовий комплект Claude Code, надісланий на вашу електронну пошту: genaiunplugged.substack.com 🆓 Безкоштовний урок у прямому ефірі зі мною: genaiunplugged.com 🎓 Claude Code Builder, моя 6-тижнева когорта з живою когортою: maven.com 👥 Навчіть свою команду Claude Code: genaiunplugged.com Дослідження та відео: last30days читає Reddit, X, YouTube та Hacker News. HyperFrames рендерить HTML у форматі MP4. Процес та документи: agent-skills виконує специфікацію, планування, збірку та рецензування. Репозиторій Anthropic з навичками охоплює Word, PDF, PowerPoint та Excel. Автоматизація: n8n-skills, dramaturg-skill та Google Workspace CLI. Який репозиторій має бути восьмим? Розкажіть мені в коментарях. Репозиторій номер один: mvanhorn/last30days-skill #Shorts #ClaudeCode #AIWorkflow

Nextjs Admin Dashboard Tutorial: 5 Screens, Phone-Ready TL;DR Build a Next.js admin dashboard as five screens in one App Router route group: an app shell layout, a home page with KPIs, list pages with a server-side data table whose state lives in the URL, a settings page and a team page with roles. Pages fetch through a server-only data access layer, and every change goes through a Server Action that checks the session itself. On phones the sidebar becomes a drawer with a bottom tab bar, table rows become cards and menus open as bottom sheets. Most admin dashboard tutorials stop at a sidebar, four stat cards, a chart and a table that scrolls sideways on a phone. A back office needs more: list pages that filter on the server, a settings page that keeps what someone typed when a save fails, a team page with roles, loading and error states on every route, and a layout that works when the person approving an invoice is on a phone. This nextjs admin dashboard tutorial builds all of it on the Next.js App Router with React 19 and Tailwind CSS v4, screen by screen, with the code. We build Wingo UI and the examples use our blocks, so we are not neutral; the App Router patterns work with any component library, and the last section compares the free starters. What does a Next.js admin dashboard need? Five screens and two states: a shell around a home page, list pages, a settings page and a team page, each with a loading and an error state. The React admin dashboard components we use for each, and their phone behavior: | Screen | Its job | Built with | On a phone | | --- | --- | --- | --- | | Shell | Navigation, search, the account | App Shell with Sidebar | The sidebar moves into a drawer, a tab bar takes the bottom edge | | Home | What changed, what needs attention | Admin Dashboard Page or KPI Dashboard | KPIs two per row, panels in one column | | Lists | Find, filter and act on records | Data Table in server mode | Rows become cards, menus become bottom sheets | | Settings | Profile, account, billing, security | Settings Page | A list that pushes each section in, like iOS Settings | | Team | Members, roles, audit log | Users Admin Page | Member cards, one role at a time in the matrix | | Loading and errors | Every route | loading.tsx, error.tsx and each block's loading prop | Skeletons in the phone layout | How should you structure the App Router for an admin dashboard? Put every admin route in one route group with its own layout. A folder in parentheses does not appear in the URL, so app/(admin)/clients/page.tsx serves /clients while the group's layout.tsx wraps it in the shell. Sign-in lives in its own group and never sees the sidebar. app/ layout.tsx root: html, body, <Providers> providers.tsx LinkProvider (next/link) and the Toaster (auth)/ sign-in/page.tsx no shell (admin)/ layout.tsx the shell: AppShell, Sidebar, Topbar nav.tsx sidebar groups and phone tabs error.tsx the admin error boundary page.tsx /: the home with KPIs dashboard-home.tsx actions.ts order actions for the home clients/ page.tsx reads the URL, fetches one page clients-table.tsx query.ts loading.tsx [id]/page.tsx one client settings/ page.tsx settings-view.tsx actions.ts team/ page.tsx team-view.tsx actions.ts server/ dal.ts "server-only": verifySession, getUser, requireAdmin Three rules hold it together: 1. Pages fetch, views render. Each page.tsx is a server component that loads data. The blocks are client components, so function props (a save handler, a router call) live in a small *-view.tsx next to the page. 2. Auth lives in the data access layer. Layouts do not re-render on navigation, so a layout check misses route changes. Call verifySession() from a server-only module in every page and every Server Action; the data security guide says to treat each Server Action as reachable by a direct POST request. 3. The URL holds the view. Period, filters, page, open tab: if it changes what the screen shows, it goes in the search params, so a link reproduces the screen. How do you build the app shell for a Next.js admin dashboard? Render one AppShell in the group's layout with a Sidebar and a Topbar, and read the sidebar's cookie on the server so the first paint is right. The shell shows the sidebar beside the page on desktop, and a drawer plus a bottom tab bar on phones. It switches with CSS, so the server HTML is already right. First, the router wiring: the Wingo UI navigation links render through LinkProvider, so one client provider turns them all into next/link: // app/providers.tsx "use client"; import type { ReactNode } from "react"; import Link from "next/link"; import { usePathname, useRouter } from "next/navigation"; import { Toaster } from "@/components/ui/toast"; import { LinkProvider } from "@/lib/navigation"; export function Providers({ children }: { children: ReactNode }) { const router = useRouter(); return ( <LinkProvider component={Link} currentPath={usePathname()} navigate={router.push}> {children} {/* phones have a tab bar at the bottom, so toasts drop from the top */} <Toaster mobilePosition="top" /> </LinkProvider> ); } The sidebar and the tab bar share the NavItem shape, so one file feeds both: // app/(admin)/nav.tsx import { House, Settings, ShieldCheck, Users } from "lucide-react"; import type { SidebarNavGroup } from "@/components/ui/sidebar"; import type { NavItem } from "@/lib/navigation"; export const nav: SidebarNavGroup[] = [ { items: [{ label: "Home", href: "/", icon: <House /> }] }, { label: "Sales", items: [{ label: "Clients", href: "/clients", icon: <Users />, badge: 3 }] }, { label: "Workspace", items: [ { label: "Team", href: "/team", icon: <ShieldCheck /> }, { label: "Settings", href: "/settings", icon: <Settings /> }, ], }, ]; export const tabs: NavItem[] = [ { label: "Home", href: "/", icon: <House />, match: "exact" }, { label: "Clients", href: "/clients", icon: <Users /> }, { label: "Team", href: "/team", icon: <ShieldCheck /> }, { label: "Settings", href: "/settings", icon: <Settings /> }, ]; And the layout, a server component: // app/(admin)/layout.tsx import type { ReactNode } from "react"; import { cookies } from "next/headers"; import { AppShell } from "@/components/ui/app-shell"; import { Sidebar } from "@/components/ui/sidebar"; import { Topbar } from "@/components/ui/topbar"; import { getUser } from "@/server/dal"; import { nav, tabs } from "./nav"; export default async function AdminLayout({ children }: { children: ReactNode }) { const [store, user] = await Promise.all([cookies(), getUser()]); // the shell writes `${persistKey}-collapsed` ("app-shell" by default) as "true" or "false" const collapsed = store.get("app-shell-collapsed")?.value === "true"; return ( <AppShell defaultCollapsed={collapsed} mobileBreakpoint="lg" sidebar={<Sidebar groups={nav} filter user={{ name: user.name, email: user.email, avatar: user.avatarUrl }} />} topbar={<Topbar title="Northwind" />} tabs={tabs} > {children} </AppShell> ); } Mod+B (Cmd on a Mac, Ctrl elsewhere) folds the sidebar into a 64px icon rail and stores that in the app-shell-collapsed cookie. Without the server read, a user who collapsed it sees it expanded on every first paint and then snap to the rail after hydration. Use the literal cookie name on the server: the persistedCookieName helper lives in a hook file that imports client-only React hooks, which a server layout cannot import. Below the breakpoint the sidebar becomes a drawer that closes on navigation, Escape, a tap outside or a swipe back, and focus returns to the menu button. A "Skip to content" link is the first Tab stop. We pass mobileBreakpoint="lg" (1024px) on purpose. At md (768px), an 820px tablet in portrait keeps a 256px sidebar and 564px for the page, too little for a table. At lg it gets the phone layout and the full width. Keep the awaits in this layout cheap: a slow await here holds every page behind it. A cookie read and a cached session lookup are fine; a dashboard query is not. For comparison, the shadcn/ui Sidebar (as of October 2026) stores its open state in a sidebar_state cookie for seven days and renders a Sheet when its useIsMobile hook reports a phone. It has no bottom tab bar, so on a phone every destination is two taps away. For the whole back office layout in one block, the Admin Shell adds a workspace switcher, a global search on /, notifications, a command menu on Mod+K and a five-tab bar whose More tab opens the drawer. Our React command palette guide covers that menu's shortcuts, nested pages and phone sheet. How do you build the dashboard home with KPIs? Fetch the numbers in the page for the period in the URL, and pass them to a dashboard block as props. The Admin Dashboard Page is the home of an orders business (four KPIs, revenue against the previous period, recent orders, what needs attention, team activity); the KPI Dashboard suits a B2B or analytics app. The page reads the period, defaults to the last 30 days and fetches: // app/(admin)/page.tsx import { isValid, parseISO, startOfDay, subDays } from "date-fns"; import { getDashboard } from "@/server/dashboard"; import { getUser } from "@/server/dal"; import { DashboardHome } from "./dashboard-home"; function readPeriod(from?: string, to?: string) { const today = startOfDay(new Date()); const end = to ? parseISO(to) : today; const start = from ? parseISO(from) : subDays(end, 29); return isValid(start) && isValid(end) ? { from: start, to: end } : { from: subDays(today, 29), to: today }; } export default async function HomePage({ searchParams }: { searchParams: Promise<{ from?: string; to?: string }> }) { const { from, to } = await searchParams; const period = readPeriod(from, to); // { kpis, revenue, orders, tasks, activity, topProducts } for the period const [user, data] = await Promise.all([getUser(), getDashboard(period)]); return <DashboardHome firstName={user.firstName} period={period} data={data} />; } The view writes a new period back to the URL and sends order actions to Server Actions: // app/(admin)/dashboard-home.tsx "use client"; import { useRouter } from "next/navigation"; import { format } from "date-fns"; import { AdminDashboardPage } from "@/components/blocks/admin-dashboard-page"; import type { DashboardData } from "@/components/blocks/admin-dashboard-page-data"; import type { DateRange } from "@/components/ui/date-range-picker"; import { runOrderAction } from "./actions"; type Props = { firstName: string; period: DateRange; data: DashboardData }; export function DashboardHome({ firstName, period, data }: Props) { const router = useRouter(); return ( <AdminDashboardPage {...data} userName={firstName} defaultPeriod={period} onPeriodChange={({ from, to }) => { if (!from || !to) return; const params = new URLSearchParams({ from: format(from, "yyyy-MM-dd"), to: format(to, "yyyy-MM-dd") }); router.replace(`/?${params}`, { scroll: false }); }} onOrderAction={async (action, order) => { const { error } = await runOrderAction(action, order.id); if (error) throw new Error(error); }} /> ); } The period is uncontrolled on purpose (defaultPeriod): the date field updates the moment someone applies a range, and the panels follow when the server answers. onOrderAction is optimistic: the status changes at once, the row shows a spinner while the promise runs, and a rejection rolls it back with an error toast, which is why the handler throws on an error. One catch: after a cancel, the toast's Undo restores the row on screen only and calls none of your code, so the next server render shows the order as cancelled again. Rewrite labels.cancelDescription so users know a cancel is final; its default text promises an email and a refund, which only your server can keep. > Live demo: Admin Dashboard Page. The original article embeds an interactive demo here (Pick another period in the date field, then click an order in Recent orders to open its sheet. This frame is narrower than 1024px, so you see the phone layout: the sidebar sits behind the menu button and the tab bar holds the bottom edge). Try it live on wingo-ui.com or open the Admin Dashboard Page docs. Install: npx wingo-ui@latest add admin-dashboard-page On a phone the KPIs sit two by two, recent orders become cards with Load more, and the date field and the order details open as bottom sheets you drag down to close. When should you use the KPI Dashboard instead? When the home is about analytics more than orders: revenue over time, sales by source, a conversion funnel, top salespeople and invoices. It takes one data object and hides a widget whose data is missing, so it fits a company with no funnel. It has the controls an analytics page needs: onRefresh (a promise spins the button and announces the update), onExport with CSV and PDF, a widgets list to pick and order panels, and widgetErrors with onWidgetRetry to show an error and a Try again button inside the one widget whose query failed, so the rest of the page stays up. Its grid uses container queries: one column, two from 672px and three from 1152px of its own width. Inside a shell that matters, because a 1280px window with a 256px sidebar leaves about 1000px, and viewport breakpoints would lay the grid out for space it does not have. The DashboardWidget and KpiDashboardGrid parts are exported for your own panels. Can you render KPI cards from a server component? Yes, as long as every prop is data. The Stat Card takes numbers, strings and icons, so a server component can render a row directly: // app/(admin)/reports/page.tsx import { FileText, Timer, UserPlus, Wallet } from "lucide-react"; import { StatCard, StatGroup } from "@/components/ui/stat-card"; import { getKpis } from "@/server/reports"; export default async function ReportsPage() { const k = await getKpis(); return ( <StatGroup variant="joined"> <StatCard label="Revenue" icon={<Wallet />} value={k.revenue} format="currency" delta={k.revenueChange} deltaLabel="vs. last month" sparkline={k.dailyRevenue} goal={k.revenueGoal} locale="en-US" /> <StatCard label="Invoices issued" icon={<FileText />} value={k.invoices} delta={k.invoicesChange} deltaFormat="number" locale="en-US" /> <StatCard label="New clients" icon={<UserPlus />} value={k.newClients} delta={k.newClientsChange} locale="en-US" /> <StatCard label="Time to payment" icon={<Timer />} value={k.secondsToPay} format="duration" delta={k.timeToPayChange} invertTrend locale="en-US" /> </StatGroup> ); } The server HTML holds the final numbers, the count-up runs on the client when a card scrolls into view, and screen readers hear one sentence with the final value and the change. invertTrend makes a drop in time to payment green. Two limits: a function prop such as formatDelta needs a client file, and href renders a plain anchor (a full page load in Next.js), so linked tiles need a client wrapper whose onClick calls event.preventDefault() and then router.push. How do you build list pages with a server-side data table? Run the Data Table in server mode, keep its query in the URL, and let the page fetch one page at a time. In mode="server" the table does no sorting, filtering or paging itself: data is the current page, rowCount the total, and every change arrives in onQueryChange as one object (page, pageSize, sorting, globalFilter, columnFilters). One module translates it to and from the search params: // app/(admin)/clients/query.ts import type { DataTableQuery } from "@/components/ui/data-table"; type Params = Record<string, string | string[] | undefined>; const one = (value: string | string[] | undefined) => (Array.isArray(value) ? value[0] : value) ?? ""; export function readQuery(params: Params): DataTableQuery { const [sortId, dir] = one(params.sort).split("."); const status = one(params.status); const size = Number(one(params.size)); return { page: Math.max(1, Number(one(params.page)) || 1), pageSize: [10, 25, 50, 100].includes(size) ? size : 25, sorting: sortId ? [{ id: sortId, desc: dir === "desc" }] : [], globalFilter: one(params.q), columnFilters: status ? [{ id: "status", value: status.split(",") }] : [], }; } export function writeQuery(query: DataTableQuery): string { const params = new URLSearchParams(); if (query.page > 1) params.set("page", String(query.page)); if (query.pageSize !== 25) params.set("size", String(query.pageSize)); if (query.globalFilter) params.set("q", query.globalFilter); const sort = query.sorting[0]; if (sort) params.set("sort", `${sort.id}.${sort.desc ? "desc" : "asc"}`); const status = query.columnFilters.find((filter) => filter.id === "status")?.value; if (Array.isArray(status) && status.length) params.set("status", status.join(",")); return params.toString(); } The page parses the URL and queries one page: // app/(admin)/clients/page.tsx import { listClients } from "@/server/clients"; import { ClientsTable } from "./clients-table"; import { readQuery } from "./query"; type Search = Promise<Record<string, string | string[] | undefined>>; export default async function ClientsPage({ searchParams }: { searchParams: Search }) { const query = readQuery(await searchParams); // checks the session, whitelists sort ids and filter values before building SQL const { rows, total } = await listClients(query); return <ClientsTable rows={rows} total={total} initial={query} />; } The view starts from the URL and writes changes back in a transition, so isPending drives the refreshing bar: // app/(admin)/clients/clients-table.tsx "use client"; import { useTransition } from "react"; import { useRouter } from "next/navigation"; import { DataTable, createColumns, type DataTableQuery } from "@/components/ui/data-table"; import { writeQuery } from "./query"; export type ClientRow = { id: string; name: string; city: string; status: string; balance: number; lastInvoice: string | null }; const STATUSES = ["Active", "Overdue", "Prospect"]; const col = createColumns<ClientRow>(); const columns = col([ col.accessor("name", { header: "Client", mobile: "title" }), col.accessor("city", { header: "City", mobile: "subtitle" }), col.accessor("status", { header: "Status", type: "badge", badge: { Active: { tone: "success" }, Overdue: { tone: "danger" }, Prospect: { tone: "info" } }, filter: "multi-select", // server mode only sees one page, so list every option yourself filterOptions: STATUSES.map((status) => ({ value: status, label: status })), mobile: "meta", }), col.accessor("balance", { header: "Balance", type: "currency" }), col.accessor("lastInvoice", { header: "Last invoice", type: "relative" }), ]); type Props = { rows: ClientRow[]; total: number; initial: DataTableQuery; loading?: boolean }; export function ClientsTable({ rows, total, initial, loading }: Props) { const router = useRouter(); const [pending, startTransition] = useTransition(); return ( <DataTable data={rows} columns={columns} mode="server" rowCount={total} defaultPage={initial.page} defaultPageSize={initial.pageSize} defaultSorting={initial.sorting} defaultGlobalFilter={initial.globalFilter} defaultColumnFilters={initial.columnFilters} onQueryChange={(query) => { const search = writeQuery(query); startTransition(() => router.replace(search ? `/clients?${search}` : "/clients", { scroll: false })); }} refreshing={pending} loading={loading} quickFilters={[{ id: "overdue", label: "Overdue", columnFilter: { id: "status", value: ["Overdue"] } }]} onRowClick={(row) => router.push(`/clients/${row.id}`)} caption="Clients" locale="en-US" /> ); } Details that save debugging time: onQueryChange does not fire on the first render (the server already sent that page), the search arrives debounced (300ms), and the page resets to 1 when the search, a filter or the sort changes. The table is uncontrolled (default* props), so the search box never lags behind a server round trip. The trade-off: the back button changes the data while the toolbar keeps the last query. If your users live on the back button, control page, sorting, globalFilter and columnFilters from the URL instead. > Live demo: Data Table. The original article embeds an interactive demo here (Search, sort or click the Overdue chip: in server mode the table hands your code one query object, printed under the pager. Below 768px every row is a card you can long press to select). Try it live on wingo-ui.com or open the Data Table docs. Install: npx wingo-ui@latest add data-table On a phone the columns become cards: mobile: "title" is the heading, subtitle the line under it, meta the badge in the corner. Sorting, filters and the row menu open as bottom sheets, and with selectionMode on, a long press starts selection. Server mode keeps a compact pager on phones; client mode uses Load more. Server mode is not always the right call. When one request can load every row a user may see, client mode filters instantly and needs no query API. We switch to server mode past a few thousand rows, or when permissions decide which rows exist for a user. To build the table yourself on TanStack Table instead, with the same server pagination, follow our TanStack Table v9 data table tutorial. How do you build a settings page that never loses input? Let one block own the drafts, and save through Server Actions that return their errors. The Settings Page has six sections (profile, account, notifications, billing, security, danger zone). A text change slides up a save bar with Discard and Save (or Mod+S), switches save on their own, a failed save keeps the draft and shows the message, and leaving a section with unsaved changes asks first. Next.js recommends modeling expected errors as return values in Server Functions, and in production the client does not get the original message of a server error, so a thrown "This workspace address is taken" would arrive as a generic error: // app/(admin)/settings/actions.ts "use server"; import { verifySession } from "@/server/dal"; import { saveSettings } from "@/server/settings"; export type ActionResult = { error?: string }; export async function saveSection(section: string, values: unknown): Promise<ActionResult> { const { userId } = await verifySession(); // validates with zod and returns { error } for anything the user can fix return saveSettings(userId, section, values); } // savePreference(preference, value) has the same shape. verifyEmailCode(email, code), // verifyTwoFactorCode(code) and checkWorkspaceAddress(slug) check the session too // and resolve to a boolean (true: the code is right, the address is free) The view turns a returned error into the rejection the block listens for, and replaces the block's demo checks with real ones: // app/(admin)/settings/settings-view.tsx "use client"; import { SettingsPage, type SettingsPageProps } from "@/components/blocks/settings-page"; import { checkWorkspaceAddress, savePreference, saveSection, verifyEmailCode, verifyTwoFactorCode, type ActionResult, } from "./actions"; type Props = Pick< SettingsPageProps, | "profile" | "account" | "notifications" | "billing" | "plans" | "sessions" | "passwordChangedAt" | "defaultTwoFactorEnabled" | "twoFactorSecret" | "twoFactorUri" | "backupCodes" >; const LABELS = { codeHint: "Enter the 6-digit code." }; async function check(result: Promise<ActionResult>) { const { error } = await result; if (error) throw new Error(error); } export function SettingsView(props: Props) { return ( <SettingsPage {...props} onSave={(section, values) => check(saveSection(section, values))} onPreferenceChange={(preference, value) => check(savePreference(preference, value))} verifyEmailCode={verifyEmailCode} verifyTwoFactorCode={verifyTwoFactorCode} checkWorkspaceAddress={checkWorkspaceAddress} labels={LABELS} /> ); } Pass every data prop from the page: anything you leave out falls back to the block's sample data. The security defaults are demo values on purpose. Without verifyEmailCode and verifyTwoFactorCode, the code 123456 passes; without twoFactorSecret, twoFactorUri and backupCodes, the setup dialog shows sample ones; and the default codeHint label reads "In this demo, the code is 123456." Generate the secret and backup codes on the server for the signed-in user. The dialogs take handlers with the same promise contract (onEmailChange, onPasswordChange, onTwoFactorChange, onSessionRevoke, onPlanChange, onDeleteAccount). One naming detail: the section ids are internal (profil, cont, notificari, facturare, securitate, pericol), so map them to your own segments if each section gets a URL through onSectionChange. > Live demo: Settings Page. The original article embeds an interactive demo here (Open Profile, edit the full name and press Save. This demo drops the first save on purpose: the bar shows the error and your edit stays, and the next Save goes through. In a frame this narrow the sections are a list that pushes each one in). Try it live on wingo-ui.com or open the Settings Page docs. Install: npx wingo-ui@latest add settings-page From 768px the sections are a column on the left (or tabs with nav="tabs"). On a phone each section pushes in with a back button and a swipe back, dialogs open as bottom sheets, and the save bar is pinned above the tab bar. The block validates each form before it calls onSave: invalid fields turn red and the first one takes focus, the pattern our React form components guide covers field by field. How do you build the team and roles page? Treat every control on it as a request the server can refuse. The Users Admin Page has three tabs: Members (the team and pending invitations against your seats, a role picker per row), Roles and permissions (a matrix with a save bar) and Audit log (a filterable history with CSV export). The server decides who may manage and enforces the rules the interface shows: // app/(admin)/team/actions.ts "use server"; import { requireAdmin } from "@/server/dal"; import { changeMemberRole } from "@/server/team"; export async function changeRole(memberId: string, role: string): Promise<{ error?: string }> { const admin = await requireAdmin(); // refuses to demote the last administrator, the same rule the picker shows return changeMemberRole(admin.workspaceId, memberId, role); } // invite, removeMember and savePermissions follow the same shape // app/(admin)/team/team-view.tsx "use client"; import { UsersAdminPage, type UsersAdminPageProps } from "@/components/blocks/users-admin-page"; import { changeRole, invite, removeMember, savePermissions } from "./actions"; type Props = Pick< UsersAdminPageProps, "companyName" | "members" | "invites" | "roles" | "permissionRoles" | "permissionGroups" | "defaultPermissions" | "auditEvents" | "seats" | "canManage" >; async function check(result: Promise<{ error?: string }>) { const { error } = await result; if (error) throw new Error(error); } export function TeamView(props: Props) { return ( <UsersAdminPage {...props} onInvite={(input) => check(invite(input))} onRoleChange={(member, role) => check(changeRole(member.id, role))} onRemove={(member) => check(removeMember(member.id))} onPermissionsSave={(value) => check(savePermissions(value))} /> ); } The page computes canManage from the session and passes it with the data. With canManage={false} the block turns read-only and says why, which beats hiding the page from people who only need to see who has access. The interface guards the obvious mistakes: the last administrator cannot be demoted, nobody removes themselves or the owner, and invitations hold a seat. Those guards are for the person clicking; your actions enforce them again, because a Server Action cannot tell which button sent the request. Likewise the block adds this page's changes to the top of the audit log as feedback, but the real audit rows are the ones your server writes in the same transaction. On a phone, members become cards with the role picker inside, the invite dialog is a bottom sheet, and the matrix shows one role at a time with chips, because five role columns do not fit 390px. The parts also ship alone: Members Table, Permissions Matrix and Audit Log. How do you handle loading and error states in the admin? Give every route a loading.tsx that renders the same component with its loading prop, and the group one error.tsx. loading.js shows its fallback immediately on navigation while the shell stays interactive, and a skeleton in the real layout means nothing jumps when the data arrives: // app/(admin)/clients/loading.tsx import { ClientsTable } from "./clients-table"; import { readQuery } from "./query"; export default function Loading() { return <ClientsTable rows={[]} total={0} initial={readQuery({})} loading />; } The Data Table draws skeleton rows in its column layout (cards on phones), and the dashboard, settings and team blocks have the same prop. A route without its own loading.tsx falls back to the nearest parent's, so one group-level skeleton would flash the same layout before every page. For errors, Next.js 16.3 made the retry prop of error.js stable; it re-fetches and re-renders the segment: // app/(admin)/error.tsx "use client"; import { Button } from "@/components/ui/button"; export default function AdminError({ error, retry }: { error: Error & { digest?: string }; retry: () => void }) { return ( <div role="alert" className="mx-auto flex max-w-md flex-col items-center gap-3 px-4 py-16 text-center"> <h2 className="text-lg font-semibold">This page did not load</h2> <p className="text-sm text-muted-foreground">If it keeps failing, send us this reference: {error.digest ?? "none"}</p> <Button onClick={retry}>Try again</Button> </div> ); } Empty states belong in the components: the Data Table's emptyState for a list with no rows yet and noResultsState when filters match nothing, so "No clients yet" and "Nothing matches" never get mixed up. How do you make every admin screen usable on a phone? Change behavior as well as layout, and check each screen at 390px on a real phone. People open a back office on phones to approve an expense, check an order or answer a client. The checklist we hold every admin screen to: - Navigation: everything in a drawer behind the menu button, plus a tab bar for the three to five daily destinations; tablets in portrait get the phone layout. - One bar on the bottom edge: the tab bar pads the home indicator and publishes its height as --bottom-bar-offset, and the settings and team save bars read it to sit above the tab bar. - Numbers: KPIs two per row, with values that shrink to fit 360px instead of wrapping. - Tables: rows become cards (title, subtitle, badge, up to four fields); nobody should scroll sideways to read one record. - Overlays: menus, filters, date pickers and detail views open as bottom sheets you can drag down; confirmations stay centered. - Container queries: inside a shell, measure the container (as the KPI grid does), so a sidebar never squeezes a layout built for the viewport. - Touch: 44px targets on coarse pointers, no hover-only actions, and every gesture backed by a visible button. Our mobile-first React components guide covers the bottom sheets, touch targets, safe areas and phone tables in depth, with code, and the React bottom navigation bar guide covers the tab bar and when the sidebar alone is enough. Should you start from a Next.js admin template or build it yourself? Start from a free starter to learn the App Router or when you already use its stack; build from blocks when settings, roles and phone layouts must work on day one. Before you pick a "nextjs admin template" or a "shadcn admin dashboard", compare these free starting points with the blocks in this guide (as of October 2026): | Option | Price and license | What you get | What is left to you | | --- | --- | --- | --- | | Next.js Learn dashboard course | Free | A financial dashboard with Postgres, Server Actions, search and pagination in the URL, NextAuth.js and Proxy; its invoices table turns into cards on phones | Settings, team and roles; it teaches the patterns and leaves the screens to you | | shadcn/ui dashboard-01 block | Free, MIT | Inset sidebar, summary cards, an interactive area chart and a TanStack data table (npx shadcn add dashboard-01) | Settings, team pages, auth; the table keeps its rows on a phone and scrolls sideways | | next-shadcn-dashboard-starter | Free, MIT | Next.js 16, shadcn/ui on Base UI, Clerk auth, product and user tables with URL state, team, billing and profile pages | Team, roles and billing come from Clerk's prebuilt components, so they need Clerk | | Wingo UI blocks (this guide) | Pro: $8 a month, $80 a year or $150 lifetime | App Shell, Admin Shell, the two dashboards, Data Table, Settings Page and Users Admin Page, all with phone layouts | Your data layer and auth; the blocks are UI only | Where the free options win: to learn, take the Next.js course, which teaches the data and auth side this guide skips. If you run shadcn/ui and need a dashboard tonight, dashboard-01 is one command and you own the code, which makes it the shortest path if you searched for "nextjs admin dashboard shadcn"; for desk-only internal tools a sideways-scrolling table is acceptable. If you already use Clerk, the Kiranism starter wires organizations, team management and billing through Clerk's prebuilt components. Wingo UI earns its price when phone users matter and you do not want to build the settings, team and table behaviors yourself. For libraries in general, our shadcn alternatives comparison covers fourteen with dated prices. What should you build first? Build the shell first, then one list page, then the home. The shell sets the navigation and phone layout every screen inherits, a list page exercises the server path (URL, query, Server Actions) that settings and team reuse, and the home is easiest once real data exists. The admin blocks in this guide are part of Wingo UI Pro. With it, start with npx wingo-ui@latest add app-shell (it brings the Sidebar, Topbar, Bottom Tab Bar and the hooks along) and drop it into app/(admin)/layout.tsx as above. The free basics they build on, such as the Button, Card, Badge, Dialog and Toast, install without an account. For back offices that bill Romanian customers, two tutorials go deeper: e-Factura VAT calculation computes VAT per rate the way ANAF validates it, with an editable invoice, and the Romanian address format guide builds a delivery address form with county, locality and postal code checks. More screen-by-screen tutorials live in Build it: screens and apps. Components in this post - App Shell (Pro): The whole admin layout in one component: a collapsible, resizable sidebar, a top bar and the page; a drawer and a tab bar on phones. Install: npx wingo-ui@latest add app-shell - Admin Dashboard Page (Pro): The home of a back office: greeting and period, four KPIs, revenue against the previous period, recent orders, alerts and team activity. Install: npx wingo-ui@latest add admin-dashboard-page - KPI Dashboard (Pro): The first screen of a back office: KPI tiles with deltas, revenue against the last period, sources, funnel, top sellers, invoices, activity. Install: npx wingo-ui@latest add kpi-dashboard - Data Table (Pro): The admin table on TanStack Table v9: search, filters, sorting, bulk actions, pinning, resizing, virtualization and cards on phones. Install: npx wingo-ui@latest add data-table - Sidebar (Pro): The admin sidebar: grouped links with icons, nested sections, badges, a sliding active pill, an icon rail with flyouts and a filter. Install: npx wingo-ui@latest add sidebar - Stat Card (Pro): The KPI tile of a dashboard: a label, a big number that counts up, a delta pill that knows good from bad, a sparkline and a goal bar. Install: npx wingo-ui@latest add stat-card - Settings Page (Pro): The account settings of a back office: profile, account, notifications, billing, security and a danger zone, with a save bar. Install: npx wingo-ui@latest add settings-page - Users Admin Page (Pro): The team page of a back office: members and invitations with seats, roles with a permissions matrix and a save bar, and the audit log. Install: npx wingo-ui@latest add users-admin-page FAQ How should I structure a Next.js App Router project for an admin dashboard? Put every admin route in a route group such as app/(admin) whose layout renders the shell, and keep sign-in in a separate group without it. Pages are server components that fetch through a server-only data access layer, and each route gets its own loading.tsx. Is there a free shadcn admin dashboard for Next.js? Yes. As of October 2026 shadcn/ui ships a free dashboard-01 block (npx shadcn add dashboard-01) with a sidebar, summary cards, a chart and a data table, but settings, roles and a phone layout for the table are left to you. The MIT next-shadcn-dashboard-starter adds Clerk auth, product and user tables, and team, billing and profile pages built on Clerk's prebuilt components. Should an admin data table filter on the server or in the browser? Filter in the browser when one request can load every row the user may see; it is instant and needs no query API. Filter on the server when the data grows past a few thousand rows or permissions decide which rows a user sees, and keep the page, sort, search and filters in the URL. Where do auth checks go in a Next.js admin dashboard? In a server-only data access layer that every page and every Server Action calls. A check in the layout or in proxy.ts alone is too weak: layouts do not re-render on client navigation, and Server Actions can be called with a direct POST request. How do I make an admin dashboard usable on a phone? Move the sidebar into a drawer with a bottom tab bar, show KPIs two per row, turn table rows into cards, open menus and detail views as bottom sheets, and keep a single bar on the bottom edge above the safe area. Test at 390px on a real phone, because a narrowed desktop window has no touch and no on-screen keyboard. Which Wingo UI admin components are free? None of the admin blocks in this guide: the App Shell, Sidebar, Data Table, Stat Card, KPI Dashboard, Admin Dashboard Page, Settings Page and Users Admin Page are Pro. The free basics, such as Button, Card, Badge, Dialog, Select, Tabs and Toast, install with the CLI without an account. --- This article was originally published on the Wingo UI blog: Nextjs Admin Dashboard Tutorial: 5 Screens, Phone-Ready. The original has the live, interactive demos and is kept up to date.

ran one command on my laptop and found 77 python venvs i’d forgotten about. 15.8 GB venvctl scan does that across every drive on windows. free, open source Kcodess2807/venvctl

AI isn't replacing developers. It's replacing developers who refuse to give their architecture some love. 💀 Give Taikai a ⭐ enofex/taikai

AI Footprint - AI 编程工具残留监控与管理应用 用于查看 AI 编程工具在 Mac 上占用的磁盘空间、后台进程、MCP 服务和登录启动项，并记录每次变更。免费、只读且完全离线运行。 👉 stanczykwyatt/ai-footprint t.co

Your CI/CD Pipeline Is the Easiest Way Into Your Repo (And Nobody's Checking It) Your CI/CD Pipeline Is the Easiest Way Into Your Repo (And Nobody's Checking It) Your code gets reviewed. Your dependencies get scanned. But your CI/CD pipeline — the thing with access to your secrets, your deployments, and your production credentials — usually gets copy-pasted from a tutorial and never looked at again. That's the gap plumber-linter was built for. The problem hiding in plain sight Here's a workflow file that looks completely normal. It's also a security incident waiting to happen: name: CI on: [push] permissions: write-all jobs: build: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - uses: some-random-action/setup-node@main - run: | echo "Deploying..." curl -H "Authorization: Bearer AKIAIOSFODNN7EXAMPLE" https://api.example.com/deploy Three problems, zero warnings from your CI: 1. permissions: write-all — the workflow can do everything: push code, read secrets, modify releases. A compromised step inherits all of it. 2. An unpinned action (@main) — you're running whatever the maintainer pushes next, sight unseen. If that repo gets hijacked, so does your pipeline. 3. A hardcoded secret in a run step — it now lives in your git history forever, and anyone with repo access can read it. Most teams find these during an incident review. plumber-linter finds them before that. What plumber-linter does plumber-linter scans your CI/CD pipeline configs — GitHub Actions and GitLab CI — and flags: - Hardcoded secrets in workflow files - Overly broad permissions like write-all - Unpinned third-party actions that can change under you - Missing branch protections that let unreviewed code straight into main And instead of cryptic rule IDs, it explains each finding in plain English — what the risk actually is, and how to fix it. So even if you're not a security person, you know exactly what to change and why. Get started npm install plumber-linter Point it at your pipeline configs, fix what it flags, and your next deploy is already safer than your last one. Why I built it Pipeline security tools exist, but they're usually heavy, noisy, or written for security teams. I wanted something a regular developer could run in a minute and actually understand the output of. No 200-page report — just the real risks, explained like a person would explain them. plumber-linter is at v1.1.0 now, and it's already got 800+ total downloads on npm. It's still early — if you run it on your repo and it catches something embarrassing, that's the whole point, and I'd genuinely love to hear about it. Try it, break it, and tell me what it missed. Feedback welcome. --- npm: npmjs.com Website: plumber-7dv.pages.dev GitHub: parasraju/plumber Built for GitHub Actions / GitLab CI. npm install plumber-linter

@hardkoded @pelotasplus I ended up with just some shell scripts of my own. github.com/hhariri/Tidbits/blob/master/MultipleCl…

【SENSESメイカーの安全性について】 安心してご利用いただけるよう、プログラムの安全性について確認を行い、ソースコードと検査結果をGitHubで公開しています。 第三者の方にも内容をご確認いただけます。 8109Jimny/SENSES-maker

dirkstranger/ThinkPad-X12-Detachable-Gen1-Keyboard-Remap: Lenovo ThinkPad X12 Detachable Gen 1 フォリオキーボード用ファームウェア キー入れ替え・無効化ツール dirkstranger/ThinkPad-X12-Detachable-Gen1-Keyboard-Remap 長いけど、とりあえず公開しました。 いちおうWindows 11用ということでお願いｼｬｽ

@rikiyatakehi @a1zhang @lateinteraction @jayden_teoh_ @akhaliq Did you cite this earlier work, or were you aware of it? areu01or00/Tensor-Slayer

This week, I’ve been tweaking the font rendering, and added support for color emojis. This was implemented by switching between R8Unorm and Rgba8UnormSrgb texture atlases. I also spent some time cleaning up the renderer, as it was starting to get bloated. Alongside wgpu, michiu leverages DirectComposition. This unlocks a lot of interesting possibilities, though it can be quite tricky to tame. Feel free to check it out! Any feedback or thoughts are more than welcome: eto0202/michiu 

Recomp of Nintendo wii console to run on natively Raspberry Pi 5 60fps I started this project to save my half-dead Wii. Now I'm trying to recompile the entire console to run natively on ARM. My original goal was simple: get Wii Fit Plus running on a Raspberry Pi because my old Wii is slowly dying, and our new TV only has HDMI ports. But the project gradually grew into something much more ambitious. I'm building wii-recomp, a project whose long-term goal is to run the entire Wii system natively on ARM hardware, such as the Raspberry Pi — not just emulate the console, and not just port individual games. The idea is that, eventually, you could have something approaching a $50 Wii replacement that runs games at 1080p and 60 FPS on inexpensive hardware. And here's the exciting part: Wii Fit Plus is already running at 1080p/60 FPS on a Raspberry Pi 5 with 8 GB of RAM. There's still a long way to go before the entire Wii system is supported, but the progress so far has been exciting enough that I wanted to share it. GitHub: Zontex/wii-recomp I'd love to hear what you think, especially from people interested in static recompilation, emulation, and low-level systems development.