Mentions

Building with the RockBLOCK 9704 on Zephyr? Scott Penrose built an open-source, MIT-licensed module that wraps our official 9704 library: devicetree binding, thread-safe API, shell and a simulated modem for testing. SH3D/rockblock9704-zephyr #Zephyr #EmbeddedSystems t.co

For more details, here is the full recipe: github.com/Elnaril/uniswap-universal-router-decod… @UniswapFND | @Uniswap | @UniswapBuilders

SnipToss: point at what your AI got wrong, and hand the notes straight back. Circle it, type what to change, paste into Claude Code, Codex or any AI. Now on Windows, Mac and Chrome. All free. Moy339339/SnipToss

[Update] RemoteCompanion v4.1.0 - CarPlay triggers, Apple Watch ping, NFC that keeps Apple Pay working RemoteCompanion v4.1.0 is out! If you're already using RemoteCompanion, update through Sileo or Zebra. This release adds CarPlay triggers, Apple Watch support for pinging your iPhone, a new NFC mode that works alongside Apple Pay, more control over trigger behavior, and quite a bit more. New to RemoteCompanion? RemoteCompanion is a free, open-source, Activator-style tweak for iOS 14–17, with partial iOS 26 support. It lets you assign actions to hardware buttons, gestures, NFC tags, network events, and schedules. Everything can be configured directly on your device or through the browser-based Web UI. What's new in 4.1.0 More ways to trigger actions - CarPlay Connected / Disconnected triggers, plus a CarPlay condition. - Ping iPhone / Ping iPhone (Hold) from a paired Apple Watch. No Watch app or Wi-Fi connection required. - New Home Button (Hold) and Home + Power triggers for devices with a Home button. - Keep Default Action can now be configured per trigger, allowing triggers to run alongside Siri, screenshots, Wallet, and other default button actions. - New Button Triggers action to temporarily disable hardware button triggers for 15 minutes, 1 hour, or until manually resumed. NFC and scheduled triggers remain active. More control over triggers and sequences - New When Triggered Again settings for each trigger: Run Alongside, Restart, or Ignore. - New Stop Trigger action. - Set Focus action and Focus If condition (iOS 15+). - New Accessibility Shortcut action. NFC and Apple Pay - New experimental NFC mode for XS and newer devices using iOS's background tag reader. - Apple Pay, Express Transit, and car keys continue working while this mode is enabled. - New NFC Scanner pause, resume, and toggle actions. Other changes - URL scheme support for opening specific sections using remotecompanion:// or rc nav <panel> from the CLI. - Shortcuts can now run in the background without SpringCuts installed. - Optional Run Silently mode for Shortcuts. - Long commands are no longer truncated at 1KB, with support up to 256KB. - New Web UI access controls: Any Network, Trusted Networks, and This iPhone Only. These also apply to /api/* endpoints. - New on-device Test Kit under Settings > Diagnostics, including shareable diagnostic reports. - Reworked toast editor and landscape zone fixes. Compatibility and installation - iOS 14.0–17.x, with partial iOS 26 support. - Dopamine, palera1n (rootless and rootful), and RootHide. - arm64 and arm64e. Website/Repo: saihgupr.github.io Add the repository to Sileo or Zebra to install or update. You can also download the .deb directly from GitHub. Source code and full changelog: saihgupr/remotecompanion Huge thanks to u/GoldenAppleGuy, who did most of the work on this release.

“Make it faster” needs a follow-up: which part? Open Mercy’s game store separates bot waiting from configured pauses: • 750ms after a playable draw • 1,100ms after a safe roulette draw Cut idle waiting. Leave time to read the move. github.com/alii13/open-mercy/blob/main/frontend/s…

🌊 Fluid dynamics from scratch, in Rust. flux is a Lattice Boltzmann CFD solver with Cahn-Hilliard multiphase flow, conjugate heat transfer with buoyancy, and STL import. cargo run starts a Rayleigh-Bénard setup. #rustlang quantumnic/flux t.co

Zero runtime dependencies in 2026: Building an npx tool users can actually trust --- title: "Zero runtime dependencies in 2026: Building an npx tool users can actually trust" published: true description: Running npx commands that touch your configuration feels risky. Here's how we built agy-powerline with zero runtime dependencies, signed build provenance, non-destructive config backups, and property-based fuzzing. tags: node, security, devops, opensource series: Building agy-powerline --- When a project's installation instructions start with npx some-tool init, what's your first instinct? If you've been in software for more than five minutes, it's skepticism. And for good reason: the npm ecosystem has suffered through supply-chain incidents, typo-squatting attacks, and deeply nested dependency trees where a single compromised sub-dependency in node_modules can exfiltrate API tokens or compromise your environment. Some statusline setups put the package manager straight into the refresh loop: "statusLine": { "type": "command", "command": "npx -y untrusted-statusline@latest" } Or worse: piped shell scripts (curl -sL ... | bash). In Google's Antigravity CLI (agy), the statusLine command runs on every refresh, many times an hour while you work. With an unpinned package or a download in that command, whatever version the registry or the server hands out next runs on your machine, with access to your files, your environment variables and your SSH keys. When I built agy-powerline, a statusline for Google's Antigravity CLI (agy), I knew users would run npx agy-powerline init or install it as an agent plugin. That tool needs to inspect the current environment, read git states, and configure Antigravity's settings.json. Asking users to run an untrusted script with write access to their dev setup is a non-starter. So from commit one, the project was designed under a strict set of non-negotiable security constraints. Here is the threat model, the architectural rules we enforced, and how we test them in CI. --- 1. The hard rule: dependencies: {} In package.json, runtime dependencies stay empty: { "dependencies": {} } CI explicitly fails if any runtime dependency is added. Everything agy-powerline does—JSON parsing, formatting, Git inspection, terminal color detection, process launching, and the interactive TUI—is built with Node's standard library and raw ANSI escape codes. Dev tools (eslint, prettier, fast-check) exist in devDependencies, but they are pinned to exact versions and are never included in the published npm package or the runtime bundle. Zero dependencies means: - Zero transitive dependency drift: What runs on your machine today runs tomorrow without an upstream maintainer slipping in analytics or an adware SDK. - Fast cold starts: Nothing to resolve or unpack in node_modules. Node opens the single bundled script directly. - Auditable: The whole runtime is about 7,500 lines of plain JavaScript, with nothing pulled in from elsewhere. Anyone can read all of it before running it. --- 2. Never trust the current working directory A subtle attack vector for CLI tools that take configuration from the local workspace: a cloned repository containing a malicious .statusline.json could execute arbitrary shell commands when rendered. To prevent this, agy-powerline never reads config from the current directory. Configuration is resolved exclusively from AGY_POWERLINE_HOME or your home directory (~/.agy-powerline/). A cloned repo cannot inject or override statusline settings. Furthermore, the statusline includes an exec widget that allows running custom shell commands. To protect users: - exec widgets only run when the config sits in the install folder (~/.agy-powerline or AGY_POWERLINE_HOME), which isTrustedInstallDir() checks. - CLI previews (such as running configure or previewing presets) never execute user commands—they display a static [cmd] placeholder instead. - If an imported config contains new shell commands, import demands explicit confirmation or --allow-exec. --- 3. Terminal injection: untrusted text is hostile A statusline displays text it didn't write: branch names, folder names, subagent roles, conversation titles and the output of shell commands. If one of them holds something like \x1b[2J\x1b[;H..., printing it raw to your terminal can trigger terminal escape sequences, disguise shell prompts, or execute arbitrary terminal emulator actions (like OSC 8 hyperlink attacks or OSC 52 clipboard hijacking). Every string originating outside our own code passes through stripControl and sanitizeDeep: function stripControl(text) { return ( String(text ?? "") .replace(/\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)?/g, "") .replace(/\x1b\[[0-?]*[ -/]*[@-~]/g, "") .replace(/\x1b[@-_]?/g, "") .replace(/[\x00-\x1f\x7f-\x9f]/g, "") // Line/paragraph separators split the bar into extra rows in some // terminals, and bidi overrides can make a branch name read as another. // Zero-width joiners and plain RTL marks stay: emoji and RTL text need them. .replace(/[

‪-‮⁦-⁩]/g, "") ); } In order: OSC strings (hyperlinks, clipboard and title changes), CSI sequences (colors, cursor moves, screen clears), any other escape, then C0 and C1 control characters, then the Unicode characters that can split a line or reverse the reading order. Branch names, session payloads, and command outputs are sanitized before calculating column widths and before outputting to stdout. --- 4. Never lose or corrupt user settings Running init touches Google Antigravity's settings.json. Touching another application's config file requires extreme care: 1. Strict JSON parsing: If settings.json contains comments, syntax errors, or trailing commas that JSON.parse cannot safely round-trip, init refuses to modify it and prints instructions on what to add manually. 2. Permanent first backup: Before touching anything, the installer creates settings.json.agy-powerline.original.bak. This file is never overwritten on subsequent runs or upgrades. You can always roll back to your pre-install state. 3. Symlink preservation: Many developers manage dotfiles with stow, chezmoi, or yadm. Naive file writes replace symlinks with regular files, severing the link to the dotfile repo. agy-powerline resolves the symlink target and writes safely to the destination file. 4. Targeted keys only: The installer touches only the "statusLine" key, leaving every other setting intact. 5. Uninstall bounds: uninstall --delete only removes files listed in a hardcoded manifest (INSTALLED_FILES). It never runs recursive deletes on user-derived directory paths. --- 5. Signed build provenance and offline archives Publishing to npm shouldn't rely on long-lived personal API tokens stored on someone's laptop. - npm Trusted Publishing: Releases are published exclusively from GitHub Actions using OpenID Connect (OIDC) tokens with zero stored secrets. - npm provenance: Every version on npm carries a provenance statement that links it to the GitHub workflow run and commit that built it. - Signed release files: Since 1.4.0, each GitHub release also attaches the npm tarball with its signed build attestation, so you can check a download yourself: gh attestation verify agy-powerline-1.4.0.tgz -R wassim-azi/agy-powerline - Where npm is blocked: Each release since 1.4.0 also attaches plugin archives (.zip and .tar.gz) for agy plugin install, with the same signed attestation. --- 6. Property-based fuzzing and static analysis How do you guarantee a zero-dependency statusline never crashes your terminal session? - Property-based tests with fast-check: with a fixed seed and 300 runs per property, random and malformed payloads (wrong types, nulls, huge numbers, odd Unicode) go through the renderer. It must never throw, print no control characters besides its own colors, keep every row within widths from 40 to 240 columns, and never run an exec command in a preview. Random input piped into the runtime script must end in exit code 0, without a stack trace. - CodeQL & zizmor: CodeQL runs static code analysis on every push and pull request, and once a week. GitHub Actions workflows are audited with zizmor (detecting credential leaks, runner compromises, or script injection) and actionlint. - OpenSSF Scorecard: The project continuously tracks OpenSSF security best practices. --- The takeaway: a local file, not a download Instead of fetching code on every refresh, agy-powerline joins its CommonJS runtime into a single local script at ~/.agy-powerline/statusline.js. Antigravity's settings.json points directly to your machine's local node binary and that local file. On refresh: - Zero network requests. - Zero dynamic dependency resolutions. - Zero execution of remote code. Building CLI tools with zero runtime dependencies takes more upfront effort than pulling in five convenience packages from npm. But the payoff is immense: sub-second startup speed, zero supply-chain anxiety, and software you can run on your production workstation with confidence. To inspect the build and install safely: npx agy-powerline init > 🤖 One-shot install via your Antigravity agent: > ```text > Hey agy, please install agy-powerline by running npx agy-powerline init --yes, then tell me to restart agy. > ``` The code is MIT on GitHub: wassim-azi/agy-powerline. Read SECURITY.md for the full security policy, threat model, and how to report a vulnerability.

📌 Free and open source (MIT) by Jakeschincariol. These skills write, you post 🔗 Jakeschincariol/linkedin-agent-skill 💾 Save this for your next content week t.co

Forecasting Visitor Demand from Open AI-Camera Counts and Weather: Lessons from Japan for Saudi Heritage Sites Amil Khanzada, Mohammed Sohail, Jana Wasfi, Ahmad Showail arxiv.org [𝚌𝚜.𝙲𝚈 𝚌𝚜.𝙻𝙶] 💬Code: amilkh/paper-icaisc-supplement t.co

Wxx - my try on using webgpu for machine learning My first big project: Wxx, an ML library with WebGPU acceleration. I love ML, but training models on CPUs is slow, and GPUs are expensive, so I decided to create my own framework. It is slow (for a GPU) and doesn't use graphics cards' ML features (like tensor cores), but it runs on any device with a GPU. GitHub: Wxx Performance: It is slow. The CPU is usually faster, and the most I achieved is about a 2x speedup on my PC (I have a Xeon CPU). I tried it on Colab, and it is about 10x slower than PyTorch on GPU. But it improved my experience significantly. API: It is similar to PyTorch. With methods to convert from tensors and ndarrays, I tried to make it as easy as possible to use if you're coming from PyTorch. AI usage: In the beginning, I planned to do everything by hand to improve my knowledge and train myself. But after the first week, I had code slower than anything you could imagine. I used AI to improve shaders, bind group creation, and other parts that I had trouble with. It hurts how much better AI is at writing and improving code than I could be. Backstory: I've been dabbling in machine learning for the last five years. I like to join Kaggle competitions and try new architectures. Lately, I've been thinking about applying to ML jobs (I know I am late to the party), and I wanted to add stuff to my CV. I am an electronics engineering grad, so most of my programming expertise is in MATLAB and Python scripting (also some embedded C, but I am not good at it), and I read that a CV should include some examples of my work. Questions: I would be happy if anyone with more experience could help me with some questions. What should I include on my CV? I know some people say you should include some implementations of architectures (like attention/transformers), but that seems so simple. What other projects should I add?

🙌 Community pick Novalie — Novalie 1.0: told nothing, it finds the laws of any world it lives in, the real one included, by one rule of evidence. Pure Python. #indiedev #opensource #python #javascript #activelearning #agi 📮 Submit yours →

Setting up Vercel Agent Desktop with Claude Code on a Mac, and where background mode stops working Agent Desktop (vercel-labs/agent-desktop, Apache 2.0) lets Claude Code use desktop apps by reading their accessibility tree instead of screenshots. Default mode runs in the background, so no mouse movement and no focus stealing. Setup on a Mac: npm install -g agent-desktop agent-desktop permissions --guide npx skills add vercel-labs/agent-desktop --skill agent-desktop claude --allowedTools "Bash(agent-desktop:*)" The Accessibility permission goes to whatever app launches Claude Code (Terminal, iTerm2, VS Code). Screen Recording is only needed for the screenshot command. Gotchas from setting it up: - that allowedTools rule doesn’t cover commands piped into grep or head, and some of those got denied - snapshots are JSON and get big fast. A File menu task used about 550k input tokens (mostly cached). --app, -i --compact and --root keep them down - anything on screen in that app ends up in Claude’s context, so name the app in your prompt and keep sensitive ones closed Where background mode worked and where it didn’t (Claude Code 2.1.316, Opus 5.5, one run per task): - reading an app and pressing buttons: worked. Calculator 128 × 46 came back as 5,888 - filling a text field: worked, it added a line in TextEdit - saving: not reliable. cmd+s couldn’t be confirmed, and Save was greyed out in the File menu while the window was in the background - selecting or styling text: needs --headed, which takes over your real mouse and keyboard Claude also handled the failures well. When an action couldn’t be confirmed or a click was refused, it said so instead of claiming it worked. Cleanup when you’re done: npm uninstall -g agent-desktop, delete the skill folder and ~/.agent-desktop, and turn off the Accessibility permission you gave your terminal. aiparabellum.com

@kushmergedeck I'm building sandhiveio/sandhive-cli to draft clear, review-ready posts from our team's progress, so I can share milestones without the copy-paste grind.

許せなすぎ rust.vim#535

gRPC in Python, the FastAPI way: models in, models out Here is what a gRPC handler usually looks like in Python: # 1. write orders.proto # 2. python -m grpc_tools.protoc -I. --python_out=. --grpc_python_out=. orders.proto # 3. commit orders_pb2.py and orders_pb2_grpc.py, regenerate them at every change import grpc import orders_pb2, orders_pb2_grpc class OrdersServicer(orders_pb2_grpc.OrdersServicer): async def Get(self, request, context): if request.order_number not in DB: await context.abort(grpc.StatusCode.NOT_FOUND, "no such order") return orders_pb2.Order(order_number=request.order_number, paid=True) It works. But the messages are not your domain models, nothing validates them, the generated files drift from the schema, and every new service starts with the same servicer-class ceremony. If you have written a FastAPI endpoint, you know it does not have to be like that. This tutorial builds the same service with fastgrpc3, an open-source gRPC framework I wrote on top of my Rust protobuf codec, protoruf. By the end you will have a service, its .proto contract, a typed client, tests, and the option to run it on a Rust HTTP/2 server — without writing a single line of protobuf by hand. !Image description Install pip install fastgrpc3 Python 3.12 to 3.14. There is no protoc to install: protobuf is compiled and encoded in Rust by protoruf, which ships as a wheel. A service is a function and two models # orders.py from pydantic import BaseModel from fastgrpc3 import GrpcApp, GrpcError, GrpcService, Insecure, StatusCode class GetOrder(BaseModel): order_number: str class Order(BaseModel): order_number: str paid: bool = False DB = {"A": Order(order_number="A", paid=True)} service = GrpcService("Orders", package="orders.v1") @service.unary() async def Get(req: GetOrder) -> Order: if req.order_number not in DB: raise GrpcError(StatusCode.NOT_FOUND, "no such order") return DB[req.order_number] app = GrpcApp(address="[::]:50051", tls=Insecure()) app.add_service(service) app.enable_reflection() # so that grpcurl can discover the service The request is validated by Pydantic before your function runs; a payload that does not fit the model is answered with INVALID_ARGUMENT. The return value is checked against the response model. GrpcError becomes a real gRPC status, readable by any client in any language. Note that tls= is mandatory: Insecure() is a choice you make on purpose, not a default you forget. Run it: fastgrpc3 run orders:app And call it from the command line with grpcurl, which reads the contract through server reflection: grpcurl -plaintext -d '{"order_number": "A"}' localhost:50051 orders.v1.Orders/Get # { # "orderNumber": "A", # "paid": true # } The .proto is generated from your models Your models are the contract. Field numbers are what keeps protobuf compatible over time, so fastgrpc3 does not leave them to chance: fastgrpc3 lock pins them in a proto.lock file you commit. Adding a field later never renumbers the others, and a removed field's number stays reserved. Then export renders the contract as standard .proto files, for the teams that call you in Go, Java or TypeScript: fastgrpc3 lock orders:app # write proto.lock (commit it) fastgrpc3 export orders:app -o proto/ # proto/orders/v1/orders.proto fastgrpc3 check orders:app # CI: fail if proto.lock is out of date fastgrpc3 breaking orders:app --against main # CI: fail on a breaking change // proto/orders/v1/orders.proto syntax = "proto3"; package orders.v1; message GetOrder { string order_number = 1; } message Order { string order_number = 1; bool paid = 2; } service Orders { rpc Get(GetOrder) returns (Order); } Already have .proto files? It works the other way too: fastgrpc3 generate proto/ -o src/myapp/gen produces Pydantic models, the service contract and a typed client, all passing mypy --strict. A typed client # client.py import asyncio from fastgrpc3 import Channel, GrpcClient, GrpcError, Insecure from orders import GetOrder, Order class OrdersClient(GrpcClient): package = "orders.v1" service = "Orders" get = GrpcClient.unary("Get", GetOrder, Order) async def main() -> None: async with Channel("localhost:50051", tls=Insecure()) as channel: orders = OrdersClient(channel) print(await orders.get(GetOrder(order_number="A"))) # order_number='A' paid=True try: await orders.get(GetOrder(order_number="Z")) except GrpcError as error: print(error.code.name, error.message) # NOT_FOUND no such order if __name__ == "__main__": asyncio.run(main()) What you get back is an Order, not a protobuf message: your editor and mypy know its fields. Dependencies, FastAPI-style Real handlers need a database session, the current user, a settings object. Depends works the way you expect, including cleanup after the response for yield dependencies: from collections.abc import AsyncIterator from fastgrpc3 import Context, Depends async def session() -> AsyncIterator[dict[str, Order]]: yield DB # open a real session here, close it after the response def current_user(ctx: Context) -> str: return str(ctx.metadata.get("x-user", "anonymous")) @service.unary() async def Pay( req: GetOrder, db: dict[str, Order] = Depends(session), user: str = Depends(current_user), ) -> Order: order = db[req.order_number] order.paid = True return order Sub-dependencies, a per-call cache, @blocking for providers that do blocking I/O, and app.dependency_overrides for tests are all there. So are hooks, middlewares and exception handlers around every call. Tests against a real server # test_orders.py from fastgrpc3.testing import TestClient from orders import GetOrder, app from client import OrdersClient async def test_get() -> None: async with TestClient(app) as tc: order = await tc.client(OrdersClient).get(GetOrder(order_number="A")) assert order.paid TestClient starts the app on a free local port: you test the real wire, not a mock. Ready for production A few lines turn the service into something you can deploy: from fastgrpc3 import TLS app = GrpcApp(address="[::]:50051", tls=TLS(cert="server.pem", key="server.key")) app.enable_health() # grpc.health.v1: Kubernetes probes, grpc-health-probe app.enable_reflection() app.enable_docs() # Swagger UI on :8080 (pip install "fastgrpc3[docs]") fastgrpc3 run orders:app --workers 4 # one process per core And then: one flag, 14× more calls per core !Image description Everything above runs on grpc.aio, the standard asyncio server. It is solid, but on one CPU core it tops out around 4,400 calls per second, and most of that time is spent in the transport, not in your code. So fastgrpc3 ships a second transport, written in Rust on tonic: HTTP/2, gRPC framing, TLS and flow control run in Rust, and your Python handlers receive the calls in batches. Same handlers, same dependencies, same errors: pip install "fastgrpc3[tonic]" fastgrpc3 run orders:app --transport tonic On one core, unary calls, 64 concurrent clients: | | calls/s | CPU per call | p99 | |---|--:|--:|--:| | fastgrpc3 on tonic | 62,240 | 13 µs | 2.0 ms | | fastgrpc3 on grpc.aio | 4,430 | 226 µs | 15.9 ms | | grpc.aio + generated stubs, no framework | 4,571 | 219 µs | 18.0 ms | That is 14× the throughput, 17× less CPU per call and an 8× lower tail latency — and the 62,240 is the load generator's ceiling, not the server's. On grpc.aio, the framework itself costs about 3 % over hand-written stubs. How the Rust transport gets there is a story of its own, which I tell in a separate article. Under the hood: protoruf None of this needs generated _pb2 classes because the protobuf layer is protoruf: it compiles .proto files in memory and its codec goes straight from protobuf bytes to Pydantic models, in Rust. Encoding a 20-field message takes about 1 µs — 55× faster than going through google.protobuf and Pydantic. Try it pip install "fastgrpc3[tonic]" - Docs: edwinalkins.github.io - GitHub: EdwinAlkins/fastgrpc3 (and the transport: EdwinAlkins/fastgrpc3-transport) fastgrpc3 is at version 0.1: if you build something with it, or if it does not fit your use case, open an issue and tell me — and a ⭐ on GitHub helps other Python developers find it.

Up to 9.5× faster than vLLM/SGLang | We built Flide, a local Jev inference engine i.redd.it Hi everyone! We built an inference engine for running Jev-like decision models locally. Compared with LLM frameworks like vLLM and SGLang, it is up to 9.5x faster on decision tasks. We already supports 30+ Jev models, and more are being added. It's open source and installs with pip: pip install flide Docs: docs.flide.org Code: OmniJev/Flide Site: flide.org i.redd.it preview.redd.it Feel free to give it a try! We'd love to hear your feedback.

@oi_sady I'm building SandHive to turn daily updates into ready–to–review posts. Boosts visibility, cuts the copy hassle! sandhiveio/sandhive-cli

Our production JavaScript ships no source maps, so I identified 1.2 MB of it by its copyright strings --- title: Our production JavaScript ships no source maps, so I identified 1.2 MB of it by its copyright strings published: true description: A page of static prose on our site references 19 script files. None of them has a source map, one of them is 112 KB your browser never downloads, and 126 KB of it I still cannot name. tags: javascript, webdev, nextjs, performance --- Our FAQ page is static prose. One heading, a definition list of questions and answers, a header, a footer, and a 606 byte logo. Its HTML is 12,550 bytes over the wire. It also references 19 JavaScript files totalling 1,237,376 bytes uncompressed. We wanted an inventory of what those actually are, and there are no source maps to ask. Step one: confirm there is nothing to ask $ for u in $(the 19 chunk URLs); do curl -s -o /dev/null -w '%{http_code}\n' "https://pub-trivia.app$u.map" done 403 403 403 ... 19 times And zero of the 19 files contains a sourceMappingURL comment. productionBrowserSourceMaps is not set in next.config.mjs, so none are emitted for the browser, which is the default and a reasonable one. The 403 is worth a note of its own. A missing file under /_next/static/ on Vercel answers 403, not 404, so "no source map" and "wrong URL" are indistinguishable from the outside. We spent a minute checking we had not typo'd the filenames. Step two: notice that one of the 19 is free Reading the script tags rather than just their src attributes: <script src="/_next/static/chunks/0cz1d0mv5g_q7.js?dpl=dpl_..." noModule=""> That one file is 112,594 bytes, and it is the biggest single thing in the list after the React chunk. Any browser that understands ES modules, which is every browser anyone reading this uses, skips nomodule scripts entirely. It is never fetched. What is in it? Its own copyright string: 2014-2024 Denis Pushkarev (zloirock.ru) license: https://github.com/zloirock/core-js/blob/v3.38.1/LICENSE core-js 3.38.1. Next builds a legacy polyfill bundle, marks it nomodule, and modern browsers ignore it. Worth knowing before you panic about a 112 KB polyfill chunk in your HTML, and worth knowing that the pinned version is readable from the minified output even without a map. Which lets us reconcile the numbers, and that reconciliation is how we know the method is sound: | measurement | bytes | | --- | --- | | all 19 chunks, brotli, measured with curl | 399,148 | | the nomodule core-js chunk, brotli | 41,343 | | what a modern browser should therefore fetch | 357,805 | | what the browser reports: sum of encodedBodySize over its 18 script requests | 357,997 | 192 bytes apart. The browser fetches 18, not 19, exactly as the attribute says. Incidentally, gzip of all 19 is 388,162 bytes against brotli's 399,148. Brotli is the larger of the two, which is the same thing we measured on this site's HTML a while back. Vercel serves brotli when you offer it. Step three: fingerprint the rest With no maps, identification means finding strings that only one library ships. Useful ones: | library | string that gives it away | | --- | --- | | react-dom | Minified React error | | scheduler | unstable_scheduleCallback | | core-js | the zloirock.ru copyright | | framer-motion | projectionNodeConstructor, MotionConfigContext | | Radix UI | data-radix, DismissableLayer | | tailwind-merge | conflictingClassGroups, classGroupId | | next/navigation | next-router-state-tree | | React Compiler output | react.memo_cache_sentinel | Run that over the 19 files: | bytes | identified as | | --- | --- | | 429,957 | react-dom, scheduler, theme switcher, error client | | 113,457 | next/navigation router | | 112,594 | core-js (nomodule, not downloaded) | | 93,523 | framer-motion | | 91,780 | framer-motion | | 53,922 | error reporting client | | 52,608 | unidentified | | 46,456 | Radix UI | | 45,255 | unidentified | | 37,211 | Radix UI, lucide icons, theme switcher | | 34,276 | react-dom, next/navigation | | 28,925 | tailwind-merge, clsx | | 28,129 | unidentified | | 26,678 | framer-motion, Radix UI | | 19,724 | Radix UI | | 11,015 | bundler runtime | | 8,373 | bundler runtime | | 1,928 | error reporting client | | 1,565 | bundler runtime | Totals by library, uncompressed, for one page of prose: - framer-motion: 185,303 bytes across two chunks, plus a share of a third. - Radix UI: 130,069 bytes across four chunks. - react-dom and the scheduler: the 429,957 byte chunk, shared with everything else. - tailwind-merge and clsx: 28,925 bytes, to resolve class name conflicts at runtime. react.memo_cache_sentinel appears in 5 of the 19, which is the React Compiler's memo caches showing up in the output. We have written about those separately. What the inventory says The 185 KB of animation library on this page exists for a footer wordmark that fades as you scroll, is aria-hidden, and is hidden md:flex so it does not render on a phone at all. We have written about that one before and it is still there. The 130 KB of Radix is the header's dropdown menu plus a toast notification system mounted in the root layout, on a marketing site where nothing public ever raises a toast. Neither of those is a crime. Both are what happens when a component library is adopted once, in the root layout, and then every page inherits it whether or not the page has any interaction in it. The FAQ page has no form, no button that does anything, and no state. It downloads 358 KB of compressed JavaScript to arrive at that conclusion. And the honest limit of the method Three chunks totalling 125,992 bytes, about 10 per cent of the total, carry no signature we could match. They have no application strings in them either: no "PubTrivia", no "quiz", nothing from our own code. They contain bundler runtime markers, a few Suspense references, and otherwise nothing that names itself. That is the real cost of shipping without source maps. Not that an attacker cannot read your code, because they can read all of it, but that you cannot either. Ten per cent of what we send to every visitor is a byte count and nothing more. If we wanted to know, the answer is not a cleverer grep, it is turning on productionBrowserSourceMaps for one build, taking the inventory, and turning it off again. Reproduce it View source on pub-trivia.app and count the <script src="/_next/static/chunks/..."> tags. There are 19. Find the one with noModule on it. Then pick any chunk URL, append .map, and watch it answer 403. Then open the Network panel, filter to JS, and count 18 requests instead of 19. If you want a page with slightly more JavaScript on it, the round planner is a working tool with no backend, and it is one chunk and 4,711 bytes heavier than the FAQ page. The tool is not what the bundle is for.

@stephysiu github.com/emexlab

Midtown Madness 3 Recompilation If you remember Midtown Madness 3 (the 2003 Xbox exclusive developed by DICE), this dev is working on ⁠mm3-recomp⁠, an open-source static recompilation project aiming to bring MM3 natively to modern systems (Windows & Linux / SteamOS). This allows the original executable to run natively on x86_64 architecture without traditional emulation overhead ,opening the door for high framerates, widescreen support, native Linux/Vulkan integration, and low-latency input. lakshya16157/midtown-madness-3-PC-Native

@justonedev @MohdAna62 Thanks for checking. If you'd like Pageree in HOL Guard's hosted MCP catalog, here's the contribution guide: github.com/hashgraph-online/hol-guard/blob/main/d…

🚀 Tired of missing out on great second-hand deals? This AI-powered Playwright monitoring system tracks listings and analyzes products automatically. Usagi-org/ai-goofish-monitor #OpenSource #Python #AI t.co

做社工查人的时候，真正让人绷不住的点，从来就不是查不到东西，而是你一慌，唰地开了二十来个烂站点，满屏广告加陷阱，折腾半天手上还是空的。 我挖到一个 OSINT 的总入口库，2.9 万星，看得我眼都直了： 🔗 jivoi/awesome-osint 姓名、邮箱、手机号、社交账号，全按工具归好类了，省得你自己瞎摸索。 但别一门心思想着去扒别人，搞不好先把自己折进去。真正该先查明白的，是你自己： 1️⃣ 邮箱有没有被泄露过 2️⃣ 那些旧账号还挂在哪儿、一直没删

I built TALO this week for the Meta Global AI Developer Hackathon. Banks’ fraud models quietly drift. Auditing them is Code: ImeMonday/talo-engine

Point your agent at fursund/weight-space-harness then you can use it to improve weights on your own

"The repository contains the complete bootable system, controller, native services, Linux compatibility implementation, hardware paths, build tools, architecture specifications, and QEMU test harnesses."

I wasn't following the history completely, as this all took a while, but IIUC it started with this: lighthouse#16539 Which led to this (amongst other things): lighthouse#16782 Which Connor finished off as: chromium-review.git.corp.google.com

@nicbstme congrats, this is awesome! 🔥 built something similar ~2 months ago, a 3D rack digital twin with H200s. seeing NVLink link GPUs at 900 GB/s, skipping PCIe, changes how you think about inference scale 0xsidzsh/interactive-3d-rack-twin

Bulk editing in WooCommerce can add categories and brands, but can’t remove them. This PR fixes that, while preserving mixed assignments you leave untouched. Demo below 👇 woocommerce#70226 t.co

Seven things happened in AI today; the one worth your attention is Reflex. 💰 Reflex 🔬 Kakeya conjecture 🚀 GPT-6.1 Terra 💰 Anthropic 🔐 New York’s RAISE Act Full post · Follow me: LinkedIn · GitHub · Bluesky · X · dev.to · Facebook #AI #GenAI #AIEngineering

@samruby @stefanomaz Made a PR(s)! roundhouse#1755 t.co

HeyPuter / everything 是一個野心勃勃的開源專案，目標是從零開始重新打造全世界的商業與專業軟體，為所有昂貴的專有軟體（Proprietary Software）提供免費且開源的替代方案。 開發進度：目前已在 8 大領域中規劃並建構了 49 個 軟體應用。 HeyPuter/everything

嫌 Playwright 发小红书 / 抖音要天天维护 Cookie？我做了个 Chrome 扩展 + Native Messaging 的多平台分发工具，支持 Claude Code Skill 我是开发者，分享一个自己在用的工具：快推 EasyPost 。 痛点很直接：用 Playwright / Puppeteer 这类无头浏览器发视频，要配 Python 环境、下浏览器、手动导出 Cookie ，Cookie 一过期就得重来，还容易被平台识别成自动化脚本，滑块和验证码一卡就是半天。 EasyPost 换了一条路，不走无头浏览器： - 跑在创作者日常用的真实 Chrome 里，复用浏览器当前登录态，不导出 Cookie 、不向工具交账号密码； - CLI 通过 Chrome Native Messaging 跟扩展通信，扩展在 Isolated World 里填内容； - fill 模式是自动填好标题、正文、标签和素材，最后一步发布由自己真鼠标点，发布前可以核对。 README 里的平台矩阵包括小红书、抖音、微信视频号、B 站、快手、微博、X 、Instagram ，CLI 是纯 JSON 输入输出，也带了 Agent Skill ，可以这样装： npx skills add gybin02/easypost --skill easypost 开源部分是 MIT ，CLI 、Skills 和文档在仓库里，仓库 docs/ 下有 anti-risk-principles.md 、rpa-vs-extension.md 、tools-comparison.md 三篇横评，讲了和 Playwright 、传统 RPA 的架构差异。 提醒一句：这只是降低被识别为自动化脚本的概率，不是零风险，仍需遵守各平台规则，内容也请只发自己的或已授权的。 仓库： gybin02/easypost Chrome 商店： chromewebstore.google.com 官网： easypost.tihub.com

@ceccon_me yep, seems to be at github.com/PostHog/hoglakehttps://github.com/Post….

github.com/SIP-01

mmmh, sadly, having both the marketing, admin and app pages within a single app with Nuxt in Cloudflare is a little bit tricky 😢 workers-sdk#16672

개발자센터: developers-apps-in-toss.toss.im 개발자 커뮤니티: techchat-apps-in-toss.toss.im 블로그: toss.im 하네스: toss/apps-in-toss-harness

HeyPuter / everything 是一個野心勃勃的開源專案，目標是從零開始重新打造全世界的商業與專業軟體，為所有昂貴的專有軟體（Proprietary Software）提供免費且開源的替代方案。 HeyPuter/everything

Metro 1.5 is here 🎉 My Windows 8-style Android TV launcher got some big upgrades: • Bing wallpapers + screensaver • Greeting with live weather • HDMI/input switcher • Move tiles freely • Layout backups • In-app updates Still under 100 KB loneelephant32-lang/metro-tv-launcher t.co

@M_GamaIEldin Which card was that on? Your 0.2.9 against 0.2.10 numbers do not test the 12 GB point, which is 0.2.7 against 0.2.8. The reserve tip could explain the 3090's 13.0 against 15.8 GB: worth testing in #4841 before anyone calls it the cause. Strata#4841

🚀 I just open-sourced RealityLab AI! Take a photo of a broken object → AI analyzes it, identifies possible faults, and suggests safer next steps. Built for the Meta AI Hackathon using Muse Spark 🧠 🌐 realitylab-fix-anything.vercel.app ⭐ sameerahmad86232/Realitylab

YMM4「射出エフェクトプラグイン」Ver2.2.0 を公開しました！ ・グループ制御内のアイテムを個別に射出する機能を追加 🚀インストール／更新 配布サイト：tanazun/EjectEffectPlugin またはプラグインポータルより 🔰初見の人向け動画（内容はVer1.0.0） nicovideo.jp #YMM4 #YMM4Plugin t.co

flossdroid - background template one of you requested for r/flossdroid background template, and also this is the font that i use github.com/zhizdev/fonts/tree/main/Android%20Eucl… feel free to use it for your post!

labelのrecord表現だそうで。まあ確かに組み分けとか実績系のlabelerは公開したい場合もありそうではあるが。 atproto#5799

💡 Tired of cloud emulators with paid walls and forced auth tokens? Floci gives you a totally free, open-source local AWS stack for seamless testing. No accounts or feature gates needed, just spin it up with Docker. floci-io/floci #OpenSource #AWS #Java

I built IntentChord to put human approval back into AI-assisted coding AI coding agents can modify code, run tests, and report success. But a passing test doesn't necessarily mean every change was authorized. That's the problem I've been working on with IntentChord. It's an experimental, local-first project designed to connect human intent, verified source context, confirmed execution scope, and evidence review. The idea is simple: when an AI agent discovers that it needs to change something outside the approved scope, that discovery shouldn't automatically become permission. The repository includes work on workspace indexing, AI context mapping, execution contracts, and evidence handling, with profiles for tools such as Codex, Claude Code, and Gemini CLI. It's still under development, and I’m not presenting it as a fully validated, production-ready system. I've made the source available for developers to inspect, challenge, and contribute to. GitHub: hesham-m/IntentChord License: PolyForm Noncommercial 1.0.0 (source-available, not OSI-approved open source). I'd especially welcome feedback from developers building with AI agents: how do you prevent an agent from expanding the scope of a change without explicit approval?

@0xManiac_Man sometimes i wonder how many people actually care so much that they read their own terminal emulator's code and understood it meanwhile, my bots go brrrr github.com/fiorix/chan/commit/01188e21d0d45de346a…

Niko1221/Strata Strataはたしかにすごくて、いままでDesktopで動いたことがないような大きなモデルが動いて驚いたんですが、でもそれまでなんだよな…… IQ2_Sとかのモデルが高速で動いたってあんま役に立たない、個人的にはQ6_K_XL以上で動かないとCodingには厳しい

if yall havent tested the new bbhost yet, latest updates have given it a fresh launcher gui and phenomenal performance increases, incredibly high fps at native res even before we implement DLSS/FSR very smooth experience with precompile shaders option too. github.com/droogie/bbhost/releases t.co

มึงบอกลา EDR/AV แบบเก่าได้เลย ตัวนี้เทคนิคโหดกว่าสัสเลยล่ะ SilentisVox/SyscallRevenant