building https://teapaw.org/t.co/flqnLSSnVk (exp users) working as backend/ml/data engineer, I like to explore and share trends, breakthroughs and interesting concepts in tech.
research
Joined May 2021
- Tweets4.2K
- Following161
- Followers159
- Likes23.2K
Pinned Tweet
10 open-source repos worth knowing if you build with coding agents or post about it on X. All updated this month.
For building:
obra/superpowers: a skills framework plus a dev methodology for your coding agent
github.com/obra/superpowers
cursor/plugins (pstack): verify-first skills behind 4,000 merged PRs in a month, by its author's count. Installs in Claude Code too. Its skills have been on my machine since last week
github.com/cursor/plugins
upstash/context7: current library docs for your agent, so it stops coding against old APIs
github.com/upstash/context7
SWE-agent/mini-swe-agent: a ~100-line agent. A new paper found it within 5 points of Claude Code on SWE-bench Verified (arxiv.org/abs/2610.04433), with an 829-token preamble vs Claude Code's 16,581
github.com/SWE-agent/mini-sw…
gitleaks/gitleaks: catches API keys before your agent commits them
github.com/gitleaks/gitleaks
Nutlope/hallmark: a design skill that keeps agent-built UIs from all looking the same
github.com/Nutlope/hallmark
For posting on X:
xai-org/x-algorithm: the code behind the For You feed. Read what it rewards before you write
github.com/xai-org/x-algorit…
gitroomhq/postiz-app: open-source scheduler for 28+ channels including X, built for agents
github.com/gitroomhq/postiz-…
remotion-dev/remotion: make videos in React, so Shorts and clips come from code
github.com/remotion-dev/remo…
excalidraw/excalidraw: hand-drawn diagrams that stay readable in a feed
github.com/excalidraw/excali…
Start with x-algorithm. It's the one that shows how your posts get ranked, and it changed how I write mine.
Your users may soon change your app with one sentence, and an agent will ship it.
Patrick Collison asks whether software built this way can be secure. In his setup, someone else has already shipped 150 improvements in a few days, so it's no longer only him typing.
Before you add a box like this to an app other people use, give the agent three limits.
1. It opens a pull request and never pushes to main.
2. It gets no production keys.
3. Every change ships behind a flag you can switch off.
I'm now building an "improvements" feature into all of my personal vibecoded applications: a freeform text input that's hooked up to an agent that yolo implements whatever is submitted.
It's an interesting experience -- the activation energy barrier to sanding any rough edge or implementing any new feature becomes extremely low. Someone else who uses one of the applications I created has already implemented 150 improvements over the course of a few days. This pattern feels like a new kind of tool -- liquid software? -- and every application that doesn't have this feature now has a slightly rigid and anachronistic flavor. Why can't I just tell it how I want it to be different?
Now, it's not obvious to me how this pattern can or should scale. Does it become unmaintainable after a while? (Maybe model intelligence improvement outstrips my feature appetite such that it's fine?) How does collaborative software work in this model? Can software designed this way be secure and reliable?
Whatever the larger questions about broader deployment, it definitely works great in a personal context. It reminds me a little of the visions of Lisp/Lisp machines, Smalltalk, and HyperCard -- systems that the user can take control of and modify. Those visions never quite worked, though: the vast majority of software today is not end-user modifiable in any useful way. So, while this "liquid" affordance is a very small touch, the way it changes one's relation to the software feels a bit transgressive and empowering in a Lickliderian and Engelbartian way.
I'm a completely noob to creating content on any social media platform stumpled upon this resource and went through few videos and I feel like I can provide better value to my followers, people here and make their life easier through my posts.
Thanks @robj3d3 started following you recently from SuperX and its really great the value you are providing.
Just grabbed The Attention Playbook by @robj3d3 theattentionplaybook.com
Context engineering is "solved" until your agent runs for 6 hours and the summary drops the one rule that mattered.
It doesn't even take hours. At a 150k compaction window, one long Opus job of mine compacted twice in its first 17 minutes. At 300k, zero.
A rule you typed mid-session lives only in the history, and each compaction rewrites that history into a summary. After the next one, ask your agent to list your hard rules back.
9 open-source repos worth knowing if you run an agent harness or you're picking one. All updated in the past week.
Harnesses:
strands-agents/harness-sdk: AWS's harness. One create_harness() call gives you tools, memory and context management. In AWS's own 94,000-trial test it cost about 34% less than other harnesses on the same models
github.com/strands-agents/ha…
anomalyco/opencode: the open-source coding agent. In that same test it had the best accuracy on open-weight models
github.com/anomalyco/opencod…
badlogic/pi-mono: pi, a minimal harness you can make your own. JetBrains' new ThinkRail IDE runs on it
github.com/badlogic/pi-mono
Around the harness:
vercel-labs/agent-desktop: computer use for any agent through the OS accessibility tree, not screenshots. Works in the background without moving your mouse
github.com/vercel-labs/agent…
browser-use/browser-harness: connects your agent straight to your real browser. One outside 4-task test found it fed the agent about 10x less text than Playwright snapshots, same results
github.com/browser-use/brows…
stablyai/orca: send one prompt to five agents, each in its own git worktree, then merge the best
github.com/stablyai/orca
vercel-labs/durable-harness: if the machine crashes mid-turn, the agent picks up from the log on another one. Still experimental
github.com/vercel-labs/durab…
Keeping it safe:
NVIDIA/SkillSpector: scans a skill for prompt injection and data exfiltration before you install it
github.com/NVIDIA/SkillSpect…
huggingface/safeagents: a local proxy that checks every tool call and blocks ones that hit URLs nobody mentioned
github.com/huggingface/safea…
Read the Strands 94,000-trial writeup before you pick one. On the same Claude models, cost per task ran from $0.74 to $1.57 just by changing the harness.
Handling 1M requests a second is mostly about keeping them away from your database.
Say 10% are writes. Here's what each layer passes on.
1. CDN
Cacheable GETs are answered at the edge. If 60% are, 400,000 req/s reach your servers.
2. Load balancer + stateless app servers
No session state on the box, so any server can take any request. At 10,000 req/s each, that's 40 servers, plus spare for a zone going down.
3. Redis in front of reads
At a 95% hit rate, 300,000 reads become 15,000.
4. Kafka in front of writes
100,000 writes a second go into a log. Consumers insert them in batches of 100, so the database sees 1,000 inserts. The user gets an OK before the row lands, so only queue writes that can wait a second.
5. The database
Reads go to replicas, writes to shards split by user id.
1,000,000 at the door, about 16,000 at the database. Size each layer by the number it passes on.
A 1-trillion-parameter model runs on one Mac, at 15 tokens a second.
That's Hugging Face's own test of Mistral Large 4, whose weights went up on 29 Oct. Only 49B parameters work on each token, but all 1T have to sit in memory, so memory decides what box you need.
Hugging Face measured three setups.
One 512 GB M3 Ultra Mac at 2-bit, 15 tok/s
Four RTX 6000 Pro cards at 4-bit, 32K context, about 10 tok/s
Eight H200s at FP8, 131K context, about 65 tok/s
Pick the box by memory first, speed second.
One line tells you whether your agent's safety hook blocks anything at all.
echo '{"tool_input":{"command":"rm -fr ~"}}' | ~/.claude/hooks/pre-tool-check.sh; echo $?
A 0 means your agent would run it. The hook from a 42k-star Claude Code guide returns 0 here. It blocks `rm -rf /` but not the same command with the flags swapped, pointed at your home folder. (pre-tool-check.sh in luongnv89/claude-howto)
String blocklists match text, not intent.
All you need is 3 designs to get cache writes right in your apps.
Only one of them can lose a write you already told the user was saved.
1. Write-through
The app writes to the cache and the database together, and the write only counts once the database has it. Amazon's DynamoDB cache, DAX, works this way. It writes the table first, then the cache, and the write fails unless both succeed. The price is two writes every time.
Use it for users, orders and balances.
2. Write-back
The app writes to the cache only and marks the key dirty. A background job flushes dirty keys to the database later, often folding many updates into one write. Writes are fastest, but flush every 5 seconds and a crash can cost you up to 5 seconds of writes.
Use it for like counts and view counters.
3. Write-around
The app writes straight to the database and drops the cached copy. The next read misses, loads from the database and fills the cache, so the cache only holds what people actually read. The first read after each write is slow.
Use it for logs and audit trails.
Don't pick one for the whole app. Pick one per kind of data.
Your system may be compromised.
Cursor just confirmed that a tampered build of the Claude Code extension, 2.1.313, sat in its marketplace for about 11 hours on 29 Oct and reached at most 5,000 users. Cursor says Anthropic didn't build it.
Opening your editor was enough. 66 lines ran before the real extension, added an SSH key labelled svc-telemetry, set up a startup entry and sent your machine's details to the attacker. Turning on SSH needs admin rights, so on most Macs and Windows PCs the attacker couldn't log in, and their server is now offline. The key and the startup entry survive an uninstall.
Check a Mac in one line:
grep svc-telemetry ~/.ssh/authorized_keys; ls ~/Library/LaunchAgents/com.apple.sysmond.plist ~/.config/.smt 2>/dev/null
No output means none of the known markers are there. On Windows, look for a scheduled task named SysMon. Cursor's notice has cleanup scripts for both and says to rotate credentials from another machine. OpenSourceMalware's copy came from Open VSX, so VSCodium and Windsurf users should check too.
X treats you like a playlist treats an artist. It won't play you twice in a row, but it doesn't hold a big catalogue against you.
On my account, 65 posts in 9 days, about 7 a day, got a median of 65 views. The 19 days before had a median of 36. The later posts were also better written, so it's not a clean test.
X's published ranking code explains why nothing broke. When it builds one person's feed, each extra post from the same author is multiplied by a shrinking factor, down to a floor. It describes no penalty on your account for posting often.
So if you have three good posts, post all three. The worst case is that the second and third sit lower in a follower's feed than the first.
And if you're small, the code lifts posts from authors with few impressions toward a set spot in the feed.
From mid-December, your messages in big public dev communities can show up on Google.
Discord announced it on 27 Oct. Its 63,000+ Discoverable servers (1,000+ members) get public web pages and AI summaries from Nov 16, and public channel messages go into web search from mid-December, without usernames.
It's on by default in India and the US, and off by default in the EU, UK, Canada, Brazil, Australia and South Korea. Two settings fix it, and each takes under a minute.
For your own messages, go to User Settings > Data & Privacy and turn off "Show my message content from Discoverable channels on web pages".
If you run a server, Server Settings > Web Presence lets you drop the help and support channels, where the logs, configs and the odd API key get pasted. Only admins can turn off the AI summaries.
Anything you send while it's on stays up unless you delete it, so do it before December.
The "Claude writes 53% less code" repo going around is real. The 53% is the author's own test.
JetBrains ran an earlier version on 80 tasks of their own: 15% less code, 10% cheaper, no quality drop they could detect. The only one of 3 token-savers in their series that clearly cut the bill.
The savings show up where the agent over-builds. In the author's test, plain Claude wrote 335 lines for a date picker. Ponytail reused the repo's input with type="date": 10 lines. In JetBrains' run, lean tasks barely moved.
Two catches before you install:
- Use the plugin. Copied in as a plain SKILL.md, it activated 0 times in 10 sessions.
- 176k stars draws copies. The author says install only from DietrichGebert/ponytail; the real one never ships .exe or .dll files.
/plugin marketplace add DietrichGebert/ponytail
/plugin install ponytail@ponytail
4 free tools I'd install before paying for a bigger Claude plan:
1. You can't see where your tokens go.
→ ccusage reads your local logs and breaks usage down by day, session and 5-hour limit window.
npx ccusage@latest
2. Your agent greps through your repo to find one function.
→ Serena gives it IDE-style tools: jump to a symbol, find references, rename across files.
3. It starts coding before anyone agreed what "done" means.
→ GitHub's Spec Kit makes the spec come first, then the code.
4. It trusts every MCP server you install.
→ Snyk Agent Scan checks your MCP servers and skills for prompt injection and tool poisoning.
uvx snyk-agent-scan@latest
Start with #1. You can't cut what you can't see.
Gave Claude Code my Tamil film app and one command: /brag. 25 minutes later, this launch video.
It read the code and used the site's real UI, colours and font. No stock clips. It even wrote the soundtrack, in a Carnatic raga.
First thing it said: "You're on Opus 5.5, so I'm using /brag-slim: I build the whole video myself." On other models it hands the render to HyperFrames.
Install in Claude Code:
/plugin marketplace add latent-spaces/brag
/plugin install brag@brag
It's someone else's instructions your agent will follow, so read the SKILL.md first.
github.com/latent-spaces/bra…
Your agent says "done, tests pass." In the SlopCodeBench paper, the best agent passed every test on just 14.8% of steps.
3 checks before you believe "done":
1. Run the whole suite, not just the new tests. The top agents passed the spec's own tests on about 2 in 3 steps. The gap is everything else, including tests from earlier steps.
2. Test your AI judge on work it passed, not only work it failed. Mine rejected both videos I'd rated 6/10. That shows what it blocks, not what "pass" means.
3. Before you quote a pass rate, check what it counts. That paper counts steps, not tests.
Give this to your agent it will optimise itself.
manosec.github.io/blog/claud…
