乔木改写

Sardor 在 11 月 6 日介绍了自己做的开源录屏工具 CaptureFlow：人在 Chrome 里录屏，结束后把链接发给别人；AI Agent 也可以通过 MCP 录制演示。它支持 Docker 自托管。原帖所链接的仓库 README 进一步写明，录制过程中就会上传，停止录制时分享链接已经准备好了。

能录什么，在哪里使用

CaptureFlow 可以录制浏览器标签页、窗口或整个屏幕，并加入摄像头悬浮画面和麦克风声音。观看者可以在视频里发表情、留言，录制者能看到谁看过。截图也可以加箭头、文字和模糊遮挡，再用同样的链接方式分享。

团队使用工作区管理内容，可设为公开、仅工作区成员可见或私密。托管服务按整个团队的存储量收费，不按席位收费；付费方案提供 100 GB、500 GB 或 1 TB 存储空间。作者说明，全部功能都包含在开源构建中，也可以部署到自己的 Cloudflare 账户，并把登录范围限制在公司内。

Chrome 扩展已经在 Chrome Web Store 上架。macOS 应用目前可以从源码构建，签名发行版仍是即将推出的状态；网页管理台和观看页支持现代浏览器。托管版可以先注册免费账户，再安装扩展，具体付费额度见价格页。

在原帖评论里，@progerallworld 提出的用途是让 Agent 重现 Bug、录下步骤，再附上视频。Sardor 回复说，这正是他加入 MCP 时考虑的场景。随后他又补充，也可以让 Agent 为 GitHub Pull Request 录制演示，并附到 PR 描述里；安装扩展后，审阅者可以观看演示来理解改动。这是作者对用途的说明，本轮没有连接 MCP 或试录视频。

用 Docker 部署

README 给出的 Docker 启动方式很短：先执行 cp .env.example .env，设置 APP_URL，再执行 docker compose up -d。

数据都保存在 ./data：SQLite 数据库、磁盘上的录屏文件，以及第一次启动时生成的密钥。这条部署路线不需要 Cloudflare 账户。生成转写可以使用兼容 OpenAI 接口的 Whisper 服务；Compose 也提供 --profile whisper 来运行一个这样的服务。完整说明在 Docker 部署文档。

部署到自己的 Cloudflare 账户

另一条路线使用 Cloudflare Workers、D1 和 R2。仓库提供了一键部署入口，也列出了手动步骤。

先运行 pnpm --filter @captureflow/web exec wrangler d1 create captureflow 创建数据库，再运行 pnpm --filter @captureflow/web exec wrangler r2 bucket create captureflow-recordings 创建存储桶。把数据库 ID 填入 apps/web/wrangler.jsonc 后，依次执行 pnpm --filter @captureflow/web db:apply:remote 和 pnpm --filter @captureflow/web cf:deploy。

DEPLOY.md 说明了密钥、登录服务、自定义域名，以及如何让扩展和桌面应用连接自己的实例。部署在自己的域名下会作为自托管实例运行；如果要做成公司内部工具，还需要按照配置文档设置 ALLOWED_EMAIL_DOMAINS。仓库也链接了逐步自托管教程和代配置服务。

本地开发和检查

开发环境需要 Node.js 24.13 或更新版本，以及 pnpm 10；README 提示用 corepack enable 启用。取得仓库并进入目录后，先执行 pnpm install。

完整的取代码命令是 git clone git@github.com:sardorml/captureflow.git，接着执行 cd captureflow。pnpm web 启动网页管理台和官网，地址为 http://localhost:3032；pnpm admin 启动实例管理后台，地址为 http://localhost:3034。pnpm extension 会在一个新的 Chrome 配置环境中启动浏览器扩展；macOS 录屏应用的开发命令是 pnpm --filter @captureflow/desktop dev。

仓库列出的检查命令分别是 pnpm typecheck、pnpm --filter @captureflow/web test、pnpm --filter @captureflow/extension test 和 pnpm format。这里保留的是作者提供的命令，没有把文档中的检查项写成本站已经跑过的结果。

仓库如何拆分

应用放在 apps/，共享包放在 packages/。依赖方向有明确约束：应用可以依赖共享包，共享包不能反向依赖应用，应用之间也不能互相依赖。

• apps/web 使用 Next.js 16，包含官网、博客、管理台、观看页和 API，通过 OpenNext 部署到 Cloudflare Workers。
• apps/admin 是运行在独立主机名下的实例管理 Worker，与主应用绑定同一组 D1 和 R2。
• apps/mailer 是产品邮件 Worker，通过 Resend 发送管理员编写的邮件活动，并处理退订。
• apps/extension 是基于 WXT、MV3 的浏览器录屏扩展，包含面板、离屏采集和页面内控制。
• apps/desktop 是基于 Electron 的 macOS 录屏应用；apps/docs 是 VitePress 文档站。
• packages/engine 是桌面端与扩展共用的采集引擎，包含 macOS 辅助程序、录制协议和封装处理，采用 MIT 许可。
• packages/admin 为管理后台提供认证与数据逻辑；packages/mail 负责邮件活动、渲染、退订令牌、Resend 投递和事务邮件。
• packages/quota 管理存储额度、限制与工作区；packages/shared 放各应用共享的类型和常量；packages/ui 放主题令牌，以及没有对应 HeroUI 组件的 React 组件。

macOS 采集辅助程序以编译后的二进制文件形式存入仓库。修改 Swift 源码后，需要运行 packages/engine/scripts/build-native.sh 重新构建；加上 --universal 可以同时支持 arm64 和 x86_64。

文档、贡献和许可

项目的官网、文档、自托管总览、博客、FAQ、安全说明、发行记录和 Discord 均由 README 提供入口。

作者欢迎 Bug 报告、想法和 Pull Request，可以到仓库 Issues或功能建议页提交。贡献前需要阅读 CONVENTIONS.md。发现安全问题应按照安全页说明私下报告，不要发到公开 Issue。

项目采用 AGPL-3.0-only，例外是可复用的采集引擎 packages/engine，它采用 MIT 许可。桌面应用与浏览器扩展的组合构建，整体仍适用 AGPL-3.0-only。

本文完整改写上述作者帖文、已取得的作者回复及固定版本 README；README 最近修改于 11 月 4 日，不能把 11 月 6 日的介绍帖当成当天发布新版本。文档文字按上游 AGPL-3.0-only 许可使用，许可全文随站点提供；本站中文不是官方文档。

原文附带媒体

来源附带的产品概览配图；未核验与中文具体段落的一一对应关系，集中保留于文末。

原文

CaptureFlow — author announcement, replies and complete README

Author announcement — Sardor (@sardorml)

Source: https://x.com/sardorml/status/2118616954085024133

I built CaptureFlow, an open-source screen recorder for you and your AI agents.

Record your screen in Chrome and get a link you can share with anyone. Or let your agent record the demo over #MCP.

Self-host it with Docker.

https://t.co/GwIkaJEH9C

#opensource #buildinpublic https://t.co/dlOESaA0wJ

Public reply context — @progerallworld (not the author)

Source: https://x.com/progerallworld/status/2118618493977313326

@sardorml This could be useful for bug reports too: agent reproduces the issue, records the steps, attaches the clip. Much easier to review than “I clicked around and it broke” 😅

Author reply — Sardor (@sardorml)

Source: https://x.com/sardorml/status/2118619339041755560

@progerallworld Yes, definitely. That's the use case i had in mind when i added the MCP.

Author reply — Sardor (@sardorml)

Source: https://x.com/sardorml/status/2118621775856865775

@progerallworld You can also ask it record a demo for your github pull request and it will attach it to the pr description. With extension installed reviewers can watch the demo to get a better idea of the changes.

Linked README — complete text, fixed source snapshot

Source: https://github.com/sardorml/captureflow/blob/c5792345e7d5e47084c5e829b3f11c98a432c859/README.md

<div align="center"><a name="readme-top"></a>

<picture> <source media="(prefers-color-scheme: dark)" srcset="apps/web/public/brand-mark-light.svg" /> <img src="apps/web/public/brand-mark-dark.svg" height="112" alt="CaptureFlow" /> </picture>

<h1>CaptureFlow</h1>

Open-source screen recorder with instant share links, self-hostable on your own Cloudflare account.

[![CI status][ci-image]][ci-url] [![License: AGPL-3.0][license-image]][license-url] [![Chrome Web Store][chrome-image]][chrome-url] [![Stars][stars-image]][stars-url] [![Discord][discord-image]][discord-url]

[Website][website-url] · [Docs][docs-url] · [Blog][blog-url] · [Report Bug][issues-url] · [Request Feature][feature-url]

[ci-image]: https://github.com/sardorml/captureflow/actions/workflows/ci.yml/badge.svg [ci-url]: https://github.com/sardorml/captureflow/actions/workflows/ci.yml [license-image]: https://img.shields.io/badge/license-AGPL--3.0-2563EB.svg?style=flat-square [license-url]: ./LICENSE [chrome-image]: https://img.shields.io/chrome-web-store/v/lgpgeoelaokbigdljofhkgbfnfcnmcol?label=chrome%20web%20store&color=2563EB&style=flat-square [chrome-url]: https://chromewebstore.google.com/detail/lgpgeoelaokbigdljofhkgbfnfcnmcol [stars-image]: https://img.shields.io/github/stars/sardorml/captureflow?color=2563EB&style=flat-square [stars-url]: https://github.com/sardorml/captureflow/stargazers [discord-image]: https://img.shields.io/badge/chat-discord-5865F2.svg?style=flat-square [discord-url]: https://discord.gg/qzeBCaEeNq [website-url]: https://captureflow.dev [docs-url]: https://docs.captureflow.dev [blog-url]: https://captureflow.dev/blog [issues-url]: https://github.com/sardorml/captureflow/issues/new [feature-url]: https://captureflow.dev/suggest-feature

</div>

[](https://captureflow.dev)

✨ Features

• 🔗 The share link is ready the moment you stop: the upload runs while you record.
• 🎥 Record a tab, a window or your whole screen, with camera bubble and mic.
• 💬 Viewers react with emoji and comment right on the video, and you see who watched.
• 🖼 Annotated screenshots with arrows, text and blur, shared by the same kind of link.
• 👥 Workspaces for your team, with public, workspace-only or private visibility.
• 💸 Priced by storage for the whole team, never per seat.
• ☁️ Self-host on your own Cloudflare account, with sign-in limited to your company.
• 🔓 Every feature ships in the open-source build.

🖥 Where it runs

| Surface | Status | | ------------------------- | ----------------------------------------------- | | Chrome extension | Available on the [Chrome Web Store][chrome-url] | | macOS app | Build from source; signed release coming soon | | Web dashboard and viewers | Any modern browser |

📦 Get started

• Hosted: create a free account and install the [Chrome extension][chrome-url]. Paid plans add 100 GB, 500 GB or 1 TB for the whole team; see pricing.
• Self-hosted: docker compose up on your own server, or run it on your own Cloudflare account (Workers, D1 and R2). Follow the step-by-step guide, or let us set it up for you.

☁️ Self-hosting

Docker

``bash cp .env.example .env # set APP_URL docker compose up -d ``

Everything lives in ./data: a SQLite database, the recordings on disk, and secrets generated on first start. You don't need a Cloudflare account. Transcripts can use any OpenAI-compatible Whisper server, including one compose runs for you with --profile whisper. See the Docker guide.

Cloudflare


Or manually:

```bash pnpm --filter @captureflow/web exec wrangler d1 create captureflow pnpm --filter @captureflow/web exec wrangler r2 bucket create captureflow-recordings

paste the database id into apps/web/wrangler.jsonc, then:

pnpm --filter @captureflow/web db:apply:remote pnpm --filter @captureflow/web cf:deploy ```

[DEPLOY.md](./DEPLOY.md) is the full runbook: secrets, sign-in providers, custom domains, and pointing the extension and desktop app at your own instance. A deployment on your own domain runs as a self-hosted instance; to make it a private company tool, set ALLOWED_EMAIL_DOMAINS as described in the configuration docs.

⌨️ Development

Requires Node.js 24.13 or newer and pnpm 10 (corepack enable).

``bash git clone git@github.com:sardorml/captureflow.git cd captureflow pnpm install pnpm web # dashboard and landing on http://localhost:3032 pnpm admin # instance admin on http://localhost:3034 pnpm extension # browser extension, in a fresh Chrome profile pnpm --filter @captureflow/desktop dev # macOS recorder ``

Checks:

``bash pnpm typecheck pnpm --filter @captureflow/web test pnpm --filter @captureflow/extension test pnpm format ``

<details> <summary>Monorepo layout</summary>

`` apps/ web/ Next.js 16 landing, blog, dashboard, viewers and API → Cloudflare Workers (OpenNext) admin/ Instance-admin Worker on its own host, bound to the same D1 and R2 mailer/ Product-email Worker: sends admin-written campaigns via Resend, handles unsubscribe extension/ Browser recorder (WXT, MV3): panel, offscreen capture, in-page controls desktop/ Electron screen recorder (macOS) docs/ VitePress documentation site packages/ engine/ Capture engine shared by desktop and extension: macOS sidecars, record protocol, mux (MIT) admin/ Admin auth and data logic behind apps/admin mail/ Campaigns, email rendering, unsubscribe tokens, Resend delivery, transactional sends quota/ Storage quota, limits and workspace logic shared/ Types and constants shared across the apps ui/ Theme tokens and the React components with no HeroUI equivalent ``

Apps depend on packages, never the reverse, and never on each other.

The macOS capture sidecars are committed as built binaries. After editing the Swift sources, rebuild them with packages/engine/scripts/build-native.sh (add --universal for arm64 + x86_64).

</details>

🔗 Links

• Website
• Documentation
• Self-hosting docs
• Blog
• Pricing
• FAQ
• Security
• Releases
• [Discord][discord-url]

🤝 Contributing 

Bug reports, ideas and pull requests are all welcome. Open an [issue][issues-url], [suggest a feature][feature-url], or send a pull request. Read [CONVENTIONS.md](./CONVENTIONS.md) first: it's the standard every change follows.

Found a security issue? Please report it privately as described on the security page, not in a public issue.

📄 License

[AGPL-3.0-only](./LICENSE), with one exception: the reusable capture engine in [packages/engine](./packages/engine) is [MIT-licensed](./packages/engine/LICENSE). Combined builds (the desktop app and the browser extension) are AGPL-3.0-only as a whole.

<div align="right"><a href="#readme-top">Back to top ↑</a></div>

原文链接：https://x.com/sardorml/status/2118616954085024133

相关链接：https://github.com/sardorml/captureflow/blob/c5792345e7d5e47084c5e829b3f11c98a432c859/README.md

乔木改写

Nelson Chu 在 11 月 6 日介绍了自己做的 checkwash：一个在本地读取 Git diff、检查测试是否被改弱的开源工具。它不调用大模型，分析时不联网，也不会执行被检查的代码。测试通过并不一定意味着检查仍然有效，例如把 assert total == 105.3 改成 assert total > 0，许多错误的金额也会被放行。checkwash 会标记这类改动，包括编程 Agent 写出的改动，交给人审阅。

下面的使用方式和限制来自作者仓库的完整 README。文档推荐的 CLI 和 Action 均为 v0.11.0，说明它是公开发行文件已经核验的版本；本轮阅读了文档，没有安装或执行 checkwash，也没有把文档自述当成本站的独立测试结果。

接入 Claude Code：停止时检查，部分编辑前询问

环境需要 Python 3.11 或更新版本、Git 和 Claude Code。在仓库根目录执行 pipx install checkwash==0.11.0，再执行 checkwash hook install --agent claude-code --local。安装器把钩子写入本机的 .claude/settings.local.json。

Stop 钩子在 Claude 准备停止时，将工作区与 HEAD 比较。如果发现达到阻断条件的问题，就阻止停止，并把发现交给 Claude。同一配置文件中的 SessionStart 钩子记录每个会话的起点，因此 Stop 钩子也会检查该会话已经提交的改动。

从 0.11.0 起，本地安装还加入 PreToolUse 询问。当通过 Edit、Write 或 MultiEdit 编辑 Python 测试文件，会使下列五种弱化规则中的某项仍处于 high 严重性时，它会在编辑前询问：ASSERT_WEAKENED、ASSERT_REMOVED、TEST_DISABLED、TOLERANCE_LOOSENED、BROAD_EXCEPT_ADDED。在 claude -p 模式下没有人可以回答，这类编辑会被拒绝。README 同时明确，交互式询问尚未在任何模式下验证。

0.11.0 默认采用本地安装；--shared 则写入 .claude/settings.json，不加入 PreToolUse 询问。这些都是作者一侧的检查：通过 Bash 做的编辑不会经过这道询问。Stop 钩子无法分析改动时，通常只报告情况、不阻止停止，工作区改动文件超出大小限制是下文说明的例外。它们都不能阻止别人合并 PR；真正的合并门禁需要 CI 中的必需状态检查。钩子的已知限制另见 0.11.0 已知问题。

先在熟悉的改动上试用

只使用 CLI，需要 Python 3.11 或更新版本和 Git。作者建议先下载单文件程序，运行离线示例。

Windows PowerShell，包括 5.1，下载命令是 curl.exe -LO https://github.com/taipei49314/checkwash/releases/download/v0.11.0/checkwash.pyz。随后执行 python checkwash.pyz --version 和 python checkwash.pyz demo。PowerShell 5.1 会把 curl 当成 Invoke-WebRequest 的别名，因此这里特意使用 curl.exe。

macOS、Linux 或 Git Bash 的下载命令是 curl -LO https://github.com/taipei49314/checkwash/releases/download/v0.11.0/checkwash.pyz，之后运行相同的版本与 demo 命令。也可以用浏览器下载该文件。

进入至少有两次提交的仓库根目录，执行 python checkwash.pyz check HEAD~1..HEAD，检查最近一次提交。未提交的改动使用 python checkwash.pyz check。评审分支时，python checkwash.pyz check BASE...HEAD 从共同祖先开始比较，BASE..HEAD 则直接比较两个指定快照。

从 v0.8.0 起，在子目录运行 check 也会从 Git 根目录分析整个仓库，并在标准错误输出中说明。更早版本需要在仓库根目录运行。JSON、SARIF 输出和更多用法，见嵌入指南与稳定性契约。

CI 必须设成必需检查，才会阻止合并

只安装工具或添加工作流，不会强制执行检查结论。需要把 checkwash 状态上下文设为仓库分支规则中的必需检查，并保持这个任务无条件运行。

README 给出的 .github/workflows/checkwash.yml 在 pull_request 时运行，权限仅为 contents: read，任务名为 checkwash，执行环境为 ubuntu-latest。它固定了三个 Action 的提交：

• actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1，标注 v7.0.1，设置 fetch-depth: 0 和 persist-credentials: false。
• actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97，标注 v7.0.0，Python 版本为 3.12。
• taipei49314/checkwash/action@257150319fca15235185fc629d8b9c21c17166ca，标注 v0.11.0。

工作流运行后，在 GitHub 的 Settings → Rules → Rulesets 中要求 checkwash 状态检查。完整 YAML 保留在本页原文中，也可以直接打开固定版本 README。

如果是仓库管理员，且已取得项目提供的规则文件，还可以运行 gh api repos/OWNER/REPO/rulesets --method POST --input action/required-ruleset.json 添加规则集。这是新增规则，不会替换既有规则。checkwash doctor 可以检查本地工作流，但不能验证线上分支保护是否生效。

版本顺序也有要求。doctor 0.11.0 接受上面推荐的提交和 v0.10.0 的提交；0.10.0 的 doctor 只接受它内置的 v0.9.0 Action 提交，会把上面的 SHA 报成不支持，显示“workflow analysis incomplete”并以 1 退出。因此应先升级 CLI 和本地钩子，再升级 Action 固定提交。

怎样理解一次阻断

退出码 0 表示在当前配置下没有需要阻断的发现，正常测试和评审仍要继续；退出码 1 表示需要阅读发现与 diff，可能是验证被削弱，也可能是误报；退出码 2 表示输入或分析出错，必须先解决错误，才能依赖结果。默认阻断阈值是 high，所以报告中看得见的 warn 仍然可能通过。

每条发现会给出规则、严重性、文件和测试名。例如，前面的金额断言若是 tests/test_billing.py 中 test_invoice_total 的全部 diff，报告会显示 ASSERT_WEAKENED、HIGH，断言强度从 EXACT_VALUE(90) 变成 BOUND(40)，原因是 NO_PROD_CHANGE_IN_DIFF，且没有应用降级条件，并列出修改前后的断言。

这里的 90 是断言强度等级，不是测试期待的数值。why high 解释严重性为什么升高：这份 diff 没改生产文件，也就没有生产代码变化可以解释为什么要弱化测试。需要机器可读输出时，可用 checkwash check --format json。

如果测试被误改弱，应恢复测试；恢复后失败，就修代码。确有理由放宽测试时，报告会给出包含该发现指纹的 checkwash allow 命令，以及需要提交的豁免账本文件。命令格式为 checkwash allow "<the fingerprint from the report>" --reason "why the weaker test is correct"。

配置和豁免从 diff 的基础版本读取，因此一个改动不能给自己豁免。豁免条目要先经过评审、进入基础版本，才对下一份 diff 生效。自 v0.10.0 起，新生效的 .checkwash 配置或豁免还会与 BASE 侧原有的 .greenwash 对照，避免一次迁移同时批准自己的放宽。每项豁免必须给出理由，默认 90 天过期，最长 180 天；作者建议对 .checkwash/ 和 .greenwash/ 设置代码所有者。

从 0.11.0 起，Stop 钩子会告诉 Claude 不要自行添加豁免，而应向人说明是哪项发现阻断、为什么阻断；PreToolUse 询问也只应在弱化确有必要时批准。具体规则见企业配置说明。

遇到合理改动被阻断，作者要求先查失败账本，再使用“checkwash blocked honest work”模板报告 Issue，附上 diff 和 checkwash check --format json 输出。报告会变成回归样例，账本会署名感谢报告者。

Alpha 阶段仍会漏检，也会误报

checkwash 仍是 Alpha。一次通过不能证明改动正确，也不能证明改动诚实。Python 是主要支持语言，JS/TS 只覆盖有限的测试模式。

一个没有实际效果的改动，例如在测试调用的函数里加 + 0，或只改一行模板、AUTHORS，仍可能让被弱化的 Python 或 JS/TS 测试停留在 warn，从而通过默认阈值。#419 虽已关闭，处理方式是记录残留风险，并未修复。REPAIR_EVIDENCE 只表示同一 diff 内存在相关改动，不证明修复正确；无实效的编辑也可能获得这个标记。

要阻断这类改动，可以把 Action 的 fail-on 设为 warn。此时 checkwash doctor 会报告“workflow analysis incomplete”并以 1 退出，这是文档说明的预期行为，因为它只证明没有 with: 配置的 checkwash 步骤。另一种方式是自己添加 CLI 步骤，执行 checkwash check --task，配合基础版本中的 oracle_freeze 契约；Action 本身没有 task 输入。这两条路线都会额外阻断一些合理改动。

对于本地安装，0.11.0 的 PreToolUse 钩子在那五项弱化规则处于 high 时，会在 Python 测试文件的 Edit、Write、MultiEdit 前询问，不受工作区其他修复证据影响。它自身的边界仍应按已知问题文档理解。

JS/TS 的参数表支持也分版本。v0.8.0 不扫描 test.each、it.each 和 test.for 的表格，表内断言弱化或删除、修改一行数据、删除整张表，都可能通过。v0.9.0 开始把每张这样的表视为一个测试单元，并在能够计数时读取数据行：包括内联数组、标签模板，或同文件中只作为表使用的 const。describe.each 的数据行仍不读取，标题由计算产生的表也不会被视为测试单元，见 #428。

合理重构可能被误报。冻结的历史重构样本中，60 项有 22 项被阻断，占 36.7%。另一次独立的预发行源码回放中，60 项有 4 项被阻断；其中 57 项严格符合限定的案例里，有 2 项被阻断，仍有三个既有样例错误。这些都是经过挑选的样本，不能当成一般误报率。v0.10.0 账本在 D-185 处置后保留了 6/60 的静态源码阻断，其中包括另外两项已知的合理重构误报；这是后来对源码的重新核查，没有改写历史运行结果。

文件过大时，哪些情况会停止分析

变更文件超过 1,000,000 字节就不会被完整读取。图片、数据、锁文件、文档，以及非 Python 的生产源码超出该限制时，会在标准错误输出中报告，也不会获得修复证据。

从 v0.9.0 起，这类未读文件还会出现在 JSON 的 unread 中；SARIF 使用工具执行通知报告；终端报告增加 ! 行，没有其他发现时以“analysis incomplete”开头。Stop 钩子的 JSON 和 --emit-ir 不会列出这些文件名。

如果超限的是检测器必须读取的文件，就以退出码 2 停止，并指出文件。这包括测试、conftest、CI、护栏、快照、JS 设置、运行脚本、测试命令文件，以及分析所需的其他上下文。超限的 .py 模块不论新增、删除、重命名或编辑，也会停止分析；任意层级的 pytest 配置同样如此，包括 pytest.ini、.pytest.ini、pytest.toml、.pytest.toml、tox.ini、setup.cfg 和 pyproject.toml，因为它们可能改变测试导入模块时解析到的对象。根目录 scripts/ 中为分析 pytest 命令而读取的非生成文件，也受同样约束。

Shell shebang 会让文件被视为运行脚本，不受文件名影响；.py 模块和 JS/TS 测试文件则有自己的规则。v0.9.0 起，程序读取超限一侧的前 200 字节，只用于识别文件类型；Git 中的那一侧会以流式读取，并核对对象 ID。如果这些字节显示 shell shebang，就会指出具体哪一侧并停止。没有扩展名的文件——包括 .envrc 这样的点文件——若没有 shebang，例如 README 或 LICENSE，通常按文档搁置，除非被其他规则判定为必读文件。

v0.8.0 不读取超限文件的任何字节，所以那时所有超限、无扩展名文件都会停止分析。v0.9.0 不会流式读取 Git 中超过 64,000,000 字节的一侧；若无扩展名文件有这样大的一侧，仍会停止。带扩展名的文件如果 shebang 只存在于这一超大侧，则仍会被搁置。

超限文件导致停止时，v0.9.0 起 JSON 会在标准输出中给出 {"unread": [...]}，只列拒绝读取的那一侧，而不是完整的 findings 文档；终端和 SARIF 输出仍为空。使用比较范围时，若被拒读的是符号链接指向的 pytest 配置目标，且没有检测器必须读取该目标，JSON 输出也仍为空。

build/、dist/、node_modules/ 等生成产物通常按生产源码搁置，但 Python 模块、pytest 配置、CI 文件、运行脚本，以及 shebang 未知的无扩展名文件仍是例外。基础版本根目录中超限的 poetry.lock 或 uv.lock 会被跳过，并在标准错误输出提示；这次跳过不进入 unread。如果 diff 本身也改了该锁文件，超限的变化侧仍按一般规则列出。

基础版本根目录的 pyproject.toml 或 requirements*.txt 如果超限，则每次运行都会停止，指出文件；终端、JSON、SARIF 都以 2 退出，只在标准错误输出中报文件名。Claude Code Stop 钩子使用 --format hook-json，一般把包括这种情况在内的引擎错误报告为不阻断的“not analysed”，在标准输出中引用错误，并以 0 退出。

还有一个较窄的例外：从 v0.9.0 起，如果停止原因是钩子 diff 改动的文件，并且该文件的工作区一侧超限，钩子就会阻止停止，要求缩小、拆分或还原文件。若只是基础版本一侧超限、基础版本根清单超限，或在停止前已经把填充后的文件提交，仍只给出消息。完整分类见检查对象完整性说明。作者因此建议，在设为必需检查之前，先拿自己的改动试用。

Action 的信任边界和固定提交

直到 v0.7.0，已发布的 Action 都在 PR 检出的目录中运行 python -m pip，随后运行 checkwash。这样，PR 中的模块，例如顶层 pip 包，可能替换安装器和检查器，使 PR 干预对自身的评判。按项目的威胁模型，这适用于它检查的每个 PR。v0.8.0 修复了这一问题，README 推荐固定 v0.11.0 Action。继续使用 v0.7.0 或更早版本时，只能把通过结果当成参考，合并前审阅 PR，并关闭 comment-pr。

开发分支源码可能比已发布 CLI 更新。release/advertised.toml 记录安装命令背后的版本、提交和下载字节。新改动需要自己的候选证据，在发布记录核验之前仍未发行；候选 CI 通过，不代表推荐的 Action 提交已经包含该改动。

固定提交的选法从 v0.11.0 起也有变化。此前推荐的是 tag 指向的提交，可用 git rev-parse 'vX.Y.Z^{commit}' 查看；从 v0.11.0 的 D-194 起，推荐的是发行版的 Action 提交，即 tag 第二个父提交的父提交，可用 git rev-parse 'vX.Y.Z^2^1' 查看，不能直接拿 tag 指向的提交代替。

发行 PR 的最后一笔提交只把 doctor 自身的 Action pin 改为那个 Action 提交，所以 tag 与 Action 提交只有这一行差异。Action 只运行 checkwash check，不会导入 doctor。从 v0.11.0 起，一个发行版的 doctor 接受两个 pin：上一版推荐的，以及本版自己的 Action 提交。

README 还说明，Dependabot、Renovate 按 # vX.Y.Z 注释跟踪更新，会建议使用 tag 提交，而 doctor 会拒绝它；zizmor 的 ref-version-mismatch 审计也可能报告这条注释。这些判断是根据相关工具文档推导的，没有实际运行。Action 在两种提交上执行的检查相同，本身不受影响。推荐的 v0.11.0 Action 包含 2026 年 11 月 4 日发布的引擎；升级 CLI 不会自动升级已有 Action，仍应先升级 CLI 和本地钩子，再更新 Action pin。

安装选项、测量记录和剩余边界

除了固定 PyPI 版本，也可以从 tag 安装：pipx install git+https://github.com/taipei49314/checkwash@v0.11.0。随后用 checkwash check HEAD~1..HEAD 检查最近提交。checkwash demo 或 python checkwash.pyz demo 会离线回放八个真实篡改案例和一个正常修复案例，用来说明已知模式，不是覆盖能力保证。

历史六仓库扫描中，1800 项有 46 项被阻断，占 2.56%；其中 31 项是假阳性，占全部样本的 1.72%，15 项是合理的策略阻断，占 0.83%。这些归档产物使用 v0.3.0 引擎，是 2026 年 9 月 7 日对发行提交的扫描；检测器曾用这份语料调优，所以它不是留出的独立评测结果。

语料中有 24/1800，即 1.33%，记录了不透明的生产改动。这个标记不能证明每项判断都受到了影响，也不能证明每份 diff 都没有被分析。人工评审方式也不统一：三位评审者的一致性研究只覆盖更早的 35 份 diff，并非全部 46 项阻断。单独的 22/60 重构结果是带日期的 v0.3.1 快照，属于不同样本群；一般提交的比例不能预测重构结果。

原始材料入口包括测量说明与源数据、生成结果和失败账本。README 还链接了 v0.11.0 发布核验记录、发行指南、发行历史、断言覆盖、发现格式、贡献、安全报告，以及尚未达到的 1.0 标准。这些是后续查证入口，不代表本轮已经逐份打开或复现实验。

checkwash-corpus 和 smallestlie 保存相关评测工作。包里还带有针对覆盖率、Ruff 和 mypy 配置审查的有限质量预览；冻结的历史字节比较仍未通过，发布本身不能证明它已在自然案例中获验收，或真正形成有效门禁。

该项目采用 Apache-2.0，零运行时依赖，文档列出 22 个检测器与 22461 项测试；后一个数字是测试收集数量，不是本轮执行通过数。

本文完整改写作者原帖及固定版本 README；README 最近修改于 11 月 5 日（中国标准时间），没有用公告时间替换发行日期。README 文字按上游 Apache-2.0 许可使用，许可全文随站点提供；本站中文不是官方文档。

原文

checkwash — author announcement and complete README

Author announcement — Nelson Chu (@kartg123451)

Source: https://x.com/kartg123451/status/2118550260104769565

I built checkwash because a green CI run can still hide a weaker test. It reads a Git diff locally — no LLM, no network — and flags when an edit weakens or removes an assertion, disables a test, or loosens a tolerance.

https://t.co/J7eBvvMKBK

Linked README — complete text, fixed source snapshot

Source: https://github.com/taipei49314/checkwash/blob/0ebd5ad890c252b4546dbd692ac0414fdbc201cc/README.md

checkwash

  

Check whether a code change weakens your tests.

A test can pass after it stops checking something useful. checkwash reads your Git diff and flags known patterns such as deleted assertions, skipped tests, relaxed expectations, and CI checks that stop failing.

```diff

• assert total == 105.3

+ assert total > 0 ```

The new assertion accepts many incorrect totals. checkwash can flag changes like this for review, including changes written by coding agents.

Runs locally. No LLM. No network during analysis. Never executes your code.

The install commands and Action pin below name v0.11.0, the latest release whose public files are verified (release history).

Start in one of three ways, each below: Claude Code hooks, the CLI on a repository, or the GitHub Action as a required check.

Use it with Claude Code

You need Python 3.11+, Git and Claude Code. Install the CLI, then run the hook installer from the root of your repository:

``bash pipx install checkwash==0.11.0 checkwash hook install --agent claude-code --local ``

This writes checkwash's hooks to .claude/settings.local.json, the machine-local Claude Code settings.

• The Stop hook checks the working tree against HEAD when Claude is about

to stop. On a blocking finding it blocks the stop and gives Claude the finding. A SessionStart hook in the same file records where each session starts, so the Stop hook also checks what the session commits.

• From 0.11.0, a local install also adds a PreToolUse ask.

When an Edit, Write or MultiEdit of a Python test file would leave a finding of one of five weakening rules (ASSERT_WEAKENED, ASSERT_REMOVED, TEST_DISABLED, TOLERANCE_LOOSENED and BROAD_EXCEPT_ADDED) at high, the hook asks you before the edit is made. In a claude -p run nobody can answer, so such an edit is denied; the interactive prompt is not verified in any mode. From 0.11.0 a local install is the default, and --shared writes .claude/settings.json with no PreToolUse ask.

Both hooks are author-side checks. An edit made through Bash never reaches the ask. When the Stop hook cannot analyse a change, it says so and does not block the stop, except for a changed file over the size limit (see "Know the limits"). Neither hook can stop someone else's merge: the required check under "Use it in CI" is the gate. The 0.11.0 hooks' limits are in the 0.11.0 known issues.

Try it on a repository

You need Python 3.11+ and Git. Download and try the offline examples first.

Windows PowerShell (including 5.1):

``powershell curl.exe -LO https://github.com/taipei49314/checkwash/releases/download/v0.11.0/checkwash.pyz python checkwash.pyz --version python checkwash.pyz demo ``

PowerShell 5.1 aliases curl to Invoke-WebRequest; use curl.exe as written. macOS/Linux or Git Bash:

``bash curl -LO https://github.com/taipei49314/checkwash/releases/download/v0.11.0/checkwash.pyz python checkwash.pyz --version python checkwash.pyz demo ``

Then, from the root of a repository with at least two commits:

``bash python checkwash.pyz check HEAD~1..HEAD ``

This checks your last commit. Start with a change you already understand. You can also download the file in your browser. For uncommitted changes use python checkwash.pyz check. For a branch review, use python checkwash.pyz check BASE...HEAD to compare from the merge base; BASE..HEAD compares the two named snapshots directly.

From a subdirectory, check analyses the whole repository from its Git root and says so in one line on stderr (since v0.8.0, #416). Before v0.8.0, run it from the repository root.

For JSON/SARIF output and more examples, see the embedding guide and the stability contracts.

Use it in CI

To stop a merge, make the checkwash status check required in your repository's branch rules. Installing the tool or adding a workflow alone does not enforce its verdict.

<a id="required-check--the-only-configuration-that-blocks-a-merge"></a>

Save this as .github/workflows/checkwash.yml:

```yaml

.github/workflows/checkwash.yml

on: [pull_request]

permissions: contents: read

jobs: checkwash: runs-on: ubuntu-latest steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 persist-credentials: false - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.12" - uses: taipei49314/checkwash/action@257150319fca15235185fc629d8b9c21c17166ca # v0.11.0 ```

After the workflow runs, open Settings → Rules → Rulesets and require the checkwash status context. Keep the job unconditional.

If you administer the repository and have this project's ruleset file, you can instead create the rule with:

``bash gh api repos/OWNER/REPO/rulesets --method POST --input action/required-ruleset.json ``

This adds a ruleset; it does not replace existing ones. checkwash doctor can inspect the local workflow, but cannot verify live branch protection. doctor 0.11.0 accepts the pin above and v0.10.0's. doctor 0.10.0 accepts only the Action pin built into it, v0.9.0's, so it reports the pin above as an unsupported SHA ("workflow analysis incomplete", exit 1): upgrade the CLI and its local hooks before the Action pin.

When checkwash blocks

| Result | What to do | |---|---| | Pass · exit 0 | No finding requires blocking under your configuration. Keep running your normal tests and review. | | Block · exit 1 | Read the finding and the diff. It may be weakened verification or a false positive. | | Error · exit 2 | Resolve the input or analysis error before relying on the result. |

The default threshold is high: a visible warn can still pass.

Read the finding. Each finding names its rule, its severity, and the file and test it is in. If the change at the top is the whole diff, made in test_invoice_total in tests/test_billing.py, the finding reads:

``text ASSERT_WEAKENED HIGH tests/test_billing.py :: test_invoice_total test_invoice_total: assertion strength EXACT_VALUE(90) -> BOUND(40) why high: NO_PROD_CHANGE_IN_DIFF no de-escalator applied before assert total == 105.3 after assert total > 0 ``

EXACT_VALUE(90) -> BOUND(40) ranks the assertion's strength before and after; 90 is not the value the test expected. why high names what raised the finding: here the diff changes no production file, so no production change explains the weaker test. checkwash check --format json gives the same findings as JSON.

Fix the change, or record a reviewed exemption. If the test was weakened by mistake, restore it, and fix the code if the restored test fails. If the weaker test is intended, the report also prints a checkwash allow command with the finding's fingerprint, and the ledger file to commit:

``bash checkwash allow "<the fingerprint from the report>" --reason "why the weaker test is correct" ``

Configuration and exemptions are read from the base side of the diff, so a change cannot exempt itself: commit the entry through review, and it applies to the next diff once it is on the base. Since v0.10.0, a newly winning .checkwash config or allowance is compared with its BASE .greenwash predecessor, so a change cannot approve its own relaxation either. An entry needs a reason and expires after 90 days by default, 180 at most. Keep .checkwash/ and .greenwash/ behind code owners. From 0.11.0, the Stop hook tells Claude not to add an exemption itself but to tell you which finding blocks and why, and the PreToolUse ask asks you to approve only if the weaker test is intended. Exemption rules

Report a false block. If the change is honest and checkwash blocks it, look for it in the failure ledger first, then open an issue with the checkwash blocked honest work template, giving the diff and the checkwash check --format json output. A report becomes a regression fixture, and the ledger credits the reporter.

Know the limits

checkwash is alpha. A pass does not prove that a change is correct or honest. Python is the main language supported; JS/TS support covers a limited set of test patterns. Known gaps remain.

An edit that changes nothing, such as + 0 in a function a test calls or one line in a template or AUTHORS, can still hold a weakened Python or JS/TS test at warn, which passes at the default threshold. #419 is closed as a documented residual, not fixed (what still passes and how to block it). Read the 0.11.0 known issues and the earlier limits they build on before relying on a pass.

REPAIR_EVIDENCE describes related changes in the same diff; it does not prove a repair is correct, and an edit that changes nothing can earn it (#419). To block such changes, set the Action's fail-on: warn (checkwash doctor then reports "workflow analysis incomplete" and exits 1, which is expected: it proves only a checkwash step with no with:), or run checkwash check --task in a CLI step of your own with a base-side oracle_freeze contract (the Action has no task input); both block more honest changes too. From 0.11.0, on a local hook install, the Claude Code PreToolUse hook asks before an Edit, Write or MultiEdit of a Python test leaves a finding of its five weakening rules at high, whatever repair evidence the rest of the working tree holds; its limits are in the 0.11.0 known issues.

In v0.8.0, JS/TS test.each, it.each and test.for tables are not scanned: an assertion weakened or deleted in one, an edited row or a deleted table passes. In v0.9.0, each such table is a test unit, and its rows are read when they can be counted (an inline array or a tagged template, or a same-file const read only as a table). The rows of a describe.each table stay unread, and a table with a computed title is not a unit (#428).

Legitimate refactors can be flagged. The frozen historical corpus records 22 blocks out of 60 (36.7%). A separate pre-release source replay records 4/60 blocks, including 2/57 strictly qualified cases; three existing fixture errors remain. These are selected examples, not a general false-positive rate. The v0.10.0 ledger retains 6/60 static source blocks after the D-185 dispositions, including two additional known legitimate-refactor false blocks. This is a later source readback, not a rewrite of the historical runtime results.

A changed file over 1,000,000 bytes is not read. An image, data file, lockfile, document or non-Python production source that large is reported on stderr and earns no repair evidence.

<details> <summary>Which files over the limit stop the run, and how each output and the Stop hook report them</summary>

Since v0.9.0 (#454), --format json also lists it under unread, SARIF names it in a tool execution notification, and the term report adds a ! line and, when there is no finding, opens with "analysis incomplete"; the Stop hook's JSON and --emit-ir do not name it. A file a detector must read (test, conftest, CI, guardrail, snapshot, JS setup, runner script or test-command file) that large stops the run with exit 2, naming it. So do a .py module that large, whether added, deleted, renamed or edited, and a pytest configuration file (pytest.ini, .pytest.ini, pytest.toml, .pytest.toml, tox.ini, setup.cfg, pyproject.toml) at any depth: either can change the module a test's import resolves to. So do any non-generated file under the root scripts/ directory, read for the pytest commands it runs, and any other changed file that large the analysis needs as context. A shell shebang gives a file the shape of a runner script, whatever its name, except a .py module or a JS/TS test file. Since v0.9.0 (#455), checkwash reads the first 200 bytes of a side over the limit to tell, and uses them for nothing else; a Git side is streamed and checked against its object id. Where those bytes are read, a file that large whose side starts with a shell shebang stops the run, naming that side, whatever its suffix (a .py module or a JS/TS test file that large stops the run anyway, by its own rule). A file with no extension (a dotfile such as .envrc counts) without one, such as a README or a LICENSE, is set aside like any document, unless another rule above makes it one a detector must read. v0.8.0 reads no byte of such a side, so every file with no extension that large stops the run there. In v0.9.0 a Git side over 64,000,000 bytes is not streamed, so its first bytes are not known: a file with no extension still stops the run when one of its Git sides is that large, and a suffixed file whose shebang is only on such a side is still set aside. When a file that large stops the run, since v0.9.0 --format json prints {"unread": [...]} on stdout instead of nothing: one unread entry, for the side the run refused. It is not a findings document, and term and SARIF output stay empty. With a range, json output stays empty too when the refused file is a symlinked pytest configuration's target that no detector must read. Generated output (build/, dist/, node_modules/ and the like) is set aside like a production source unless it is a Python module, a pytest configuration, a CI file, a runner script or a file with no extension whose shebang is not known. A root poetry.lock or uv.lock that large at the base is skipped with a note on stderr, and the skip is not listed under unread; when the diff also changes that lockfile, the change's sides over the limit are listed like any other. A root pyproject.toml or requirements*.txt that large at the base stops every run, naming it: term, json and SARIF output exit 2 and name it on stderr only. The Claude Code Stop hook (--format hook-json) reports an engine error, this one included, as a non-blocking "not analysed" message on stdout that quotes the error, and exits 0. Since v0.9.0, when the run stops on a file the hook's diff changes and that file's working-tree side is over the limit, the hook blocks the stop instead, naming the file and asking to shrink, split or revert it (#456). A file whose base side alone is over the limit, a root manifest over it at the base, and a padded file committed before the stop keep the message; the full list is in subject integrity.

</details>

Try it on your own changes before making it required. Coverage and limitations · Known gaps

CI details: doctor and the pin

The recommended Action and the CLI above are both v0.11.0. Record which version you use. Full setup and exemptions

Development snapshots: the source in this checkout may be newer than the published CLI. The advertised-release manifest records the version, commit and download bytes behind the installation commands above. New changes require their own candidate evidence and remain unreleased until the publication record verifies them; candidate CI success does not mean that the recommended Action pin includes them.

Advisory: Action trust boundary. Every published Action release up to and including v0.7.0 runs python -m pip and then checkwash with the pull request's checkout as the working directory, so a module in that checkout (for example a top-level pip package) can replace the installer and then the checker, and the pull request can tamper with the result it is judged by. Under checkwash's threat model that applies to every pull request it judges. v0.8.0 fixes it (#372); pin the v0.11.0 Action above. If you stay on v0.7.0 or earlier, treat a pass as advisory, review the pull request before merging and keep comment-pr off. Known issue

Which commit is the recommended pin? A release cannot embed its own commit SHA. Up to v0.10.0, the recommended pin is the commit the tag points to: git rev-parse 'vX.Y.Z^{commit}'. From v0.11.0 (D-194), it is the release's Action commit, the tag's second parent's parent: git rev-parse 'vX.Y.Z^2^1'. It is not the commit the tag points to. The release pull request's last commit changes one line, doctor's own Action pin, to that Action commit, and the tag differs from the Action commit only in that line. The Action runs only checkwash check, which does not import doctor. From v0.11.0, a release's doctor accepts two Action pins: the one recommended before the release and the release's own Action commit.

Pin updaters such as Dependabot and Renovate follow the # vX.Y.Z comment, so they will propose the tag's commit, which doctor rejects (inferred from those tools' documentation, not run). For the same reason zizmor's ref-version-mismatch audit can report the comment (inferred, not run). The Action itself is unaffected: it runs the same check at either commit. doctor 0.10.0 does not accept the 0.11.0 pin, so upgrade the CLI and its local hooks first, then the Action pin. The recommended v0.11.0 Action includes the engine published on 2026-11-04 Asia/Taipei. A CLI upgrade does not update an existing Action. Action reference

More options and evidence

<a id="install"></a> <details> <summary>Install as a CLI or try the included examples</summary>

If you already use pipx, install the fixed version:

```bash pipx install checkwash==0.11.0

or from the release tag:

pipx install git+https://github.com/taipei49314/checkwash@v0.11.0

checkwash check HEAD~1..HEAD checkwash demo # 8 real tampering cases, blocked, offline ```

checkwash demo replays eight real tampering cases and one honest fix. It illustrates known patterns; it is not a coverage guarantee. You can run the same examples with python checkwash.pyz demo.

</details>

<a id="measured-not-asserted"></a> <details> <summary>Read the measurements and their limits</summary>

The historical six-repo sweep recorded 46 / 1800 = 2.56% blocks: 31 false positives (1.72%), 15 legitimate policy blocks (0.83%). The tracked artifacts record engine v0.3.0 (the release commit, swept 2026-09-07) on a corpus used to tune the detectors, not a held-out result.

1.33% of the corpus (24/1800) records opaque production changes. That flag does not establish that each verdict changed or each diff was unanalyzed.

Review methods vary: the three-rater agreement study covers an older 35-diff cohort, not all 46 blocks. The dedicated 22/60 refactor result (benchmarks/refactors/results-latest.json, a dated v0.3.1 snapshot) is a separate population; the general-commit rate does not predict it.

Measurements and source data · Generated results · Failure ledger

</details>

| Looking for… | Start here | |---|---| | Installation checks, versions and first use | v0.11.0 publication record · v0.11.0 release guide · Release history | | JSON/SARIF contracts and upgrades | Stability · Embedding guide · Findings schema | | Assertion support, coverage warnings and artifact checks | Assertion coverage | | Required checks and reviewed exemptions | Enterprise setup | | Contributing or reporting a problem | Contributing · Issues · Security reports | | Readiness for 1.0 | Criteria — not met |

Related projects: checkwash-corpus and smallestlie hold evaluation work.

The package also includes a limited quality preview for coverage, Ruff and mypy configuration review. Setup and CI adoption guide. Its frozen legacy-byte comparison remains red; publication does not establish natural-case acceptance or effective enforcement.

Alpha pre-release. 22 detectors, 22461 tests (collection denominator). Zero runtime dependencies. Apache-2.0.

原文链接：https://x.com/kartg123451/status/2118550260104769565

相关链接：https://github.com/taipei49314/checkwash/blob/0ebd5ad890c252b4546dbd692ac0414fdbc201cc/README.md

乔木改写

Cursor 宣布，现在可以在 Cursor 中构建可运行的线上 App，并通过链接分享。

它在介绍中指出，Agent 已经让写代码更容易，但大多数应用仍停留在 localhost。用户描述自己需要的工具后，Cursor 会构建应用、设置数据库、运行确定性的安全检查和 Agent 安全检查，再完成部署。

原文

You can now build live apps in Cursor and share them with a link

You can now build live apps in Cursor and share them with a link.

Agents have made it easier to write code, but most apps never make it off localhost. Describe the tool you want - Cursor will build it, set up a database, run deterministic and agentic security checks, and deploy.

原文链接：https://x.com/cursor_ai/status/2118458629091426304

相关链接：https://cursor.com/docs/cloud-agent/apps

乔木改写

Guillermo Rauch 认为，持续替用户处理事情，是 Agent 的杀手级应用。

他举了 Muse 和 Instinct 的例子：它们会在夜间整理记忆，早上提醒用户，并在距离上一次互动过了 N 天后发来消息。

谈到配套基础设施，Rauch 将 Vercel Schedules 形容为加强版 Cron。按他的介绍，任务可以在运行时定义，能够无限扩展，而且调度系统位于 Sandbox 之外，因此可以按需调用计算资源，以更低的成本运行。

原文

Doing stuff for you over time is the killer app of agents

“Doing stuff for you over time” is the killer app of agents.

Muse and Instinct consolidate memories at night, remind you of stuff in the morning, message you after N days passed since your last interaction…

Vercel Schedules are like Cron on steroids. They can be defined at runtime, scale infinitely, and sit outside of the Sandbox, which means you can cost-efficiently invoke compute as needed.

原文链接：https://x.com/rauchg/status/2118440831355068671

相关链接：https://vercel.com/blog/introducing-vercel-schedules

乔木改写

OpenAI 发布 GPT-6 Cyber，称其在增强安全研究能力的同时，也改进了模型对齐。

按 OpenAI 的介绍，该模型用于其前一天公布的 Linux 内核研究。Mozilla、Palo Alto Networks、Calif、Cisco 等公司的安全团队，以及 OpenAI 自己的安全团队，已经在使用它。

目前，GPT-6 Cyber 向部分 Daybreak Red 客户开放，访问范围将逐步扩大。完整公告见 OpenAI 原文。

原文

Introducing GPT-6 Cyber

Introducing GPT‑6 Cyber: a major advance in security research that pairs stronger capabilities with better model alignment.

The model powered the Linux kernel research we announced yesterday, and security teams at companies like Mozilla, Palo Alto Networks, Calif, and Cisco—alongside our own at OpenAI—are already putting it to work.

GPT-6 Cyber is available to select Daybreak Red customers and we are expanding access over time.

https://openai.com/index/introducing-gpt-6-cyber/

原文链接：https://x.com/OpenAI/status/2118390190246879554

相关链接：https://openai.com/index/introducing-gpt-6-cyber/

乔木改写

以下依据本站保存的视频文字摘录整理，并非完整逐字稿。视频介绍了 DeepSeek 发布的 Super Agent。一些人将它称为对 Claude Code 的回应；视频作者更关注它的构建方式：整个系统由加入 DeepSeek Harness 的一组插件组成。

Super Agent 会监听团队已经使用的 GitHub 和飞书。当获得许可的成员在 Issue、PR 或相关对话中提出需求时，它建立工作项，开启独立会话完成任务，再返回结果，通常是一个 PR。它不要求用户先打开一段新的 Agent 对话。

项目随代码发布了一篇 X 文章，题为 Exploring Super Agent Design: Towards a More Autonomous Agent System。项目方明确说明，它是研究原型，并非 DeepSeek 的官方产品；不少设计想法和工程实现也由编码 Agent 编写。

同一个模型，换九套 harness

视频引用了 Frontier Harness Eval：固定使用 Kimi K3，比较九套编码 Agent harness。Codex 的通过率为 66.7%；DeepSeek Harness 的 creator 配置与 Claude Code 都为 63.3%。每完成一个成功任务，DeepSeek 约花费 $3.28，Claude Code 约为 $18.34。该测试中，最便宜与最贵的 harness 成本相差约 17.5 倍。

这些结果涉及通过率、成本、缓存和速度，即使模型不变，harness 也会影响这些表现。这些结果来自合成基准测试。

视频还提到，在 VentureBeat 的 Beyond the Pilot 播客中，Instacart 和 Box 的 CTO 都表达过当前 harness 比模型更重要的看法。

DSH 的插件结构

DeepSeek Harness（DSH）在八月发布，采用 MIT 许可，提供 Web UI，并不限定使用 DeepSeek 模型。它的设计原则是所有东西都可以成为插件：router、工具注册、会话日志，甚至 Agent loop 本身。

底层使用 Cordis 的时空可组合能力。时间维度上，卸载组件会撤销它做过的更改；空间维度上，组件依赖关系决定它们何时启用或停用。

DSH 有 standard、PTC、minimal、creator 等模式，对应不同的插件组合。creator 模式允许用户在聊天中描述一个插件，由 Agent 编写并安装。

router 与 worker 如何配合

Super Agent 通过 cordis.patch 接入，包含核心 Super Agent 插件、GitHub watcher 和飞书 watcher。上层是一段长期运行的 router 会话，下层是彼此隔离的 worker 会话。外部触发先经过白名单等确定性门禁，再交给模型处理；工作单会携带任务授权。

worker 使用精简的插件配置，不包含提问、规划、网页抓取或子 Agent，长时间运行的 shell 任务则转入后台。worker 还会直接订阅认领任务的对话，因此后续 PR 评论不必再经过 router。按材料中的测试，启用这一机制时，router 的决策次数比未启用时减少约 30%。

负载测试把触发量从每分钟 1 次提高到 40 次。通过批量处理，每次决策所需时间从 6.4 秒降至 1.6 秒。视频据此介绍了一种分工：router 可以使用更便宜、更快的模型，把更强的模型留给 worker。

这套设计希望尽量少占用人的注意力，同时提供尽可能多的价值。插件化也让开发者可以在不 fork 核心代码的情况下继续扩展 harness。

它仍有明确限制：只是研究原型，公开代码不等于内部使用的代码；接入范围主要是 GitHub 和飞书，评测是合成基准，提示注入、凭证等安全问题尚未完全解决。

原文

视频原文摘录，非完整逐字稿；请以原视频为准。

DeepSeek Super Agent and why the harness matters

DeepSeek Super Agent and why the harness matters

Source: YouTube https://www.youtube.com/watch?v=OrcsMi2-IcM

Okay, so this past weekend, DeepSeek released something that a lot of people out there are calling the answer to Claude Code. It's an agent that sits on a GitHub repo. It watches the issues and pull requests, and when someone on your team asks it to do something, It then goes off into its own session, does the work, and comes back with a PR Now, while that's cool in itself, that's not really the part that I want to talk about here. The part that I find really interesting is how they built it. The whole thing is just a set of plugins dropped into their agent harness.

When the DeepSeek Harness came out back in August, the plugin architecture is really cool. The new thing DeepSeek launched is called Super Agent. Along with the repo, they've written an article on X called Exploring Super Agent Design: Towards a More Autonomous Agent System. They're upfront that this is a research prototype, not an official DeepSeek product. Ideas and engineering were often written by coding agents themselves.

Basic idea: instead of you opening a session and talking to an agent, the agent listens to where your team already works — GitHub, and Feishu. When someone allowed asks it for something, it opens a work item, spins up its own session, does the work, replies back usually with a PR.

On the VentureBeat podcast Beyond the Pilot, CTOs of Instacart and Box both said the harness matters more than the model right now.

Frontier Harness Eval: same model (Kimi K3) through nine coding agent harnesses. Codex 66.7% pass rate; DeepSeek Harness creator config and Claude Code both 63.3%. DeepSeek ~$3.28 per successful task vs Claude Code ~$18.34. Gap cheapest to most expensive ~17.5x. Harness changes cost, caching, speed, and success rate even with model held constant.

DeepSeek Harness (DSH) MIT licensed, web UI, not locked to DeepSeek models. Tagline: everything is a plugin — router, tool registry, session log, even the agent loop. Built on Cordis (spatiotemporal composability): temporal (unload reverses everything) and spatial (dependencies activate/deactivate).

Modes: standard, PTC, minimal, creator — different plugin sets. Creator: describe a plugin in chat and agent writes/installs it.

Super Agent integrates via cordis.patch: core Super Agent plugin, GitHub watcher, Feishu watcher. Workers: stripped preset, no questions/plan/web fetch/sub-agents; long shell jobs backgrounded. Architecture: long-running router session + isolated worker sessions. Triggers go through a deterministic gate (allow-list) before the model. Tickets carry a mandate. Workers subscribe to conversation so PR comments skip the router (30% fewer router decisions when on).

Under load (1→40 triggers/min), batching made time per decision drop 6.4s→1.6s. Router can use a cheap/fast model; stronger models for workers.

Philosophy: take as little human attention as possible and give as much value as possible.

Caveats: prototype; published code ≠ internal; narrow (GitHub/Feishu); synthetic benchmarks; security (prompt injection, credentials) not fully solved.

Bigger point: harnesses evolving fast via composable plugins without forking the core.

原文链接：https://www.youtube.com/watch?v=OrcsMi2-IcM

乔木改写

Tibo 翻出十八年前 Dropbox 创始人录制的一段屏幕演示，称它是硅谷历史上最成功的发布视频。他说，这段视频让 Dropbox 的候补名单一夜间从 5000 人增长到 75000 人。

在他看来，视频有效有五个原因：

1. 它展示了真实产品完成承诺的那件事：把文件放进一个文件夹，文件就会出现在另一台电脑上。
2. 视频中有许多目标受众才懂的内部笑话。
3. 创始人把视频发在用户已经聚集的地方：更早的版本发在 Hacker News，这个版本则发在 Digg。
4. 它解释了一个新概念，却没有使用术语。
5. 它让人看到了尚未开放使用的产品。Dropbox 当时还没向公众开放，视频先证明它能工作，之后由候补名单承接需求。

Tibo 的建议是，当大家都在用 Claude 制作精致的视频时，也可以只录一段简单的屏幕演示。在他看来，这样反而会显得真实十倍。

原文

The most successful launch video in Silicon Valley history

this is the most successful launch video in Silicon Valley history

18 years ago, the founder of Dropbox recorded his screen to make this demo

it took their waitlist from 5,000 to 75,000 overnight

imo, here's what made it work:

1. it showed the real product doing the one thing it promised. you drop a file into a folder and it shows up on your other computer

1. it was full of inside jokes for the exact audience he was trying to reach

1. he posted it where his users already were. an earlier version went on Hacker News, and this one went on Digg

1. it explained a new idea without any jargon

1. it let people see something they couldn't use yet. Dropbox wasn't open to the public, so the video showed it working and the waitlist did the rest

while everyone is doing super fancy video with Claude, you can do a very simple screen recording

you will look x10 more authentic

原文链接：https://x.com/tibo_maker/status/2118289869428380138

乔木改写

Anthropic 介绍，其生物学研究团队与 Claude 合作，解析了来自细菌生命的 vault 颗粒的首个三维结构。

Vault 颗粒呈桶状，是人体细胞中最大的蛋白质结构之一。Leonard Rome 和 Nancy Kedersha 于 1986 年发现了它，但它的功能至今仍不清楚。

此前，人们只知道动物、植物等复杂生物的细胞中存在 vault。团队这次证明，细菌以及感染细菌的病毒中的类似蛋白，也能组装成 vault。在这些更简单的生命形式中找到相应结构，可能有助于研究它在人类细胞中的作用。

Anthropic 将这一项目同时视为 AI 加速科学研究的潜力与局限的展示。团队估计，这次如果靠人工确定颗粒结构，原本需要数周到数月的细致工作，借助 Claude 则只用了几天。但 Claude 也犯了一些简单错误，生物学团队与机器学习研究人员合作处理了这些问题。

本站保存的是这份研究介绍；详细过程可见 Anthropic 的完整文章。

原文

Investigating vault particles with Claude

We’re sharing how our biology research team worked with Claude to map the first 3D structure of a vault particle from bacterial life.

Vault particles are a longstanding mystery. They are barrel-shaped objects, among the largest protein structures found in our cells. They were first discovered by Leonard Rome and Nancy Kedersha in 1986, but their function remains unknown.

With Claude, we’ve found results that might bring us closer to solving that mystery.

Until now, vaults were only known in the cells of complex things like animals and plants. We have shown that similar proteins from bacteria (and the viruses that infect them) can also assemble into vaults. Finding the structures in these simpler forms of life may make it easier to investigate their function in our own cells.

For our life sciences team, the project was also a demonstration of the potential (and the limitations) of using AI to accelerate science.

In our full piece, we discuss how Claude was able to dramatically speed up some stages—manually determining the vault particle’s structure would have taken weeks to months of painstaking work, but here it took days. We also discuss how Claude made some simple mistakes along the way, and how we collaborated with our machine learning researchers to address them.

Read more: https://www.anthropic.com/research/investigating-vault-particles-with-claude

原文链接：https://x.com/AnthropicAI/status/2118073665296228863

相关链接：https://www.anthropic.com/research/investigating-vault-particles-with-claude

乔木改写

几年前，Sarah Guo 怀疑是否真有很多非工程师想自己制作或修改个人软件。现在，她改变了看法，觉得自己当时想错了。

她列了几种人们想做个人软件的理由：

• 自己也能做软件，感觉很有力量。
• 没人会替自己做出需要的工作流或个性化设置。
• 想当几周产品经理，修好那个一直让自己烦躁的地方。

她回头看觉得，这其实不难理解：只要工具容易上手、能力又够强，人们当然会愿意做自己的软件。

原文

Non-engineers do want to make personal software

a few years ago, I started out skeptical that many non-engineers really wanted to make/mod their own personal software -- but I've come around, think I was wrong. range of desires from:

• I feel so powerful
• no one will make me the workflow/personalization I need
• can I just PM the product for a few weeks and fix this thing that is driving me crazy

obvious in retrospect, but if the ease:power ratio is good enough, of course people will make their own software

原文链接：https://x.com/saranormous/status/2118052772637704376

乔木改写

Guillermo Rauch 说，他一直期待 Vercel 的这次发布。公司内部有一个昵称为 @𝚑𝚊𝚌𝚔𝚎𝚛 的安全 Agent，每一行代码都会自动接受审计；他认为这个工具的效果非常出色。

现在，外部用户也能在自己的所有仓库中启用相同能力，无论项目是否托管在 Vercel。Rauch 表示，它能发现其他 Agent 遗漏的问题，让使用者更安心。

他给出的理由很具体：不能只指望工程师已经安装某个安全技能，也不能只在提示词里写一句请把代码写安全，更不能寄希望于模型第一次生成的代码就足够可靠。

这套产品完全由 Vercel 的安全团队开发。Rauch 推测，不少公司正在急着扩充安全人员；在他看来，如果希望把安全团队变成可以直接获得的软件，这已经是目前很接近的一种形式。

原文

Vercel internal security agent @hacker now available

I've been looking forward to this day, because Vercel has an internal security agent that is astonishingly effective (lovingly called @𝚑𝚊𝚌𝚔𝚎𝚛). Every single line of code gets audited, automatically.

You can now get the same power. Just enable it on all your repos (this product works whether you host on Vercel or not) and your peace of mind will increase tremendously. You'll see it catch things that every other agent misses.

Why: you cannot just bank on your engineers having a skill installed, prompting "please make secure", or rolling the weights' dice that the code is good out of the gate.

The other cool thing about this is that this was entirely developed by our security team. A lot of companies out there are probably in a mad rush right now trying to staff up. If you wanted to 'download a security team' as software, this is the closest you get today.

原文链接：https://x.com/rauchg/status/2117734833824948373

相关链接：https://vercel.com/blog/vercel-security-review

乔木改写

Victor Cardenas 说，Slash 上个月的年化总收入超过了 5 亿美元，去年约为 1.5 亿美元，再前一年约为 5000 万美元。公司规模在扩大，增长也在加快，团队却不到 100 人。他写这篇文章时 25 岁。

他将 Slash 称为有史以来增长最快的金融科技公司之一，并把增长几乎全部归因于：比竞争对手更擅长为真正的 AI 原生创业者开发和销售产品。他用 100 倍来形容这种优势。

文章围绕三件事展开：SuperSMB 的兴起，如何找到并卖给这些客户，以及如何为他们做产品。SuperSMB 指的是团队非常精简、收入却很高的企业。

SuperSMB 是什么样的公司

Victor 认为，AI 正带来创业者数量的快速增长。他列出了几组数据：美国新设企业申请数在 2025 年约为 560 万份，比 2019 年的 350 万份增加约 60%；每隔 26 秒，就有一家 Shopify 商店获得第一笔销售；2025 年的 Stripe Atlas 创业公司在成立后头六个月的收入中位数，比 2024 年对应公司高 39%。在他看来，从零快速增长到数千万美元的现象已经不限于科技公司，其他行业的企业也在加速成长。

Slash 客户每月支出数十亿美元，平台上存放的资产也达到数十亿美元。Victor 用自家平台的数据描述这批创业者：

• 他们很年轻。平台超过 88% 的资产来自创始人未满 35 岁的企业，这类企业也贡献了 72% 的支出。
• 他们常常同时经营多家公司。Slash 上 40% 的公司，其所属创业者在平台上还拥有至少另一家公司。
• 业务增长很快。每月经 Slash 流转的数十亿美元支出中，65% 来自过去三年、也就是 ChatGPT 推出后成立的公司，25% 来自过去十二个月成立的公司。
• 雇员很少。Slash 客户的中位画像是每月有数十万美元的卡支出，但只有几名员工。
• 他们来自世界各地。AI 与互联网让全球企业主都能向美国消费者和企业销售，越来越多创业者以美元做生意，Slash 为他们提供服务。

Victor 相信，这批企业将在未来十年变得非常重要。他预测，到 2035 年，美国银行持有的企业存款中，超过一半会来自 ChatGPT 推出后才注册成立的公司。他认为，包括银行在内，今天不少主流产品并非为 AI 原生创业者设计，也跟不上他们的需求，因此为这一快速成长群体开发专门产品存在机会。

怎样找到他们并完成销售

Victor 看重 SuperSMB 同时具备的两项特点：公司收入可观，交易金额可以很大；没有复杂官僚层级，销售又能很快完成。他认为，这改变了传统 B2B 销售周期与年度合同价值之间的取舍：企业客户通常成交慢但金额高，普通中小企业成交快却金额小，SuperSMB 有机会兼得两者。

但这些公司并不好找。Slash 不用 Clay 或 ZoomInfo，也不做陌生电话销售或冷邮件。Victor 提出了三项做法：

1. 赢得客户信任，让客户带来转介。只靠 LinkedIn，很难找出哪些两到十人的团队已做到数千万美元收入；客户需要成为最好的销售者。
2. 深入行业。加入重要群聊，关注关键论坛，参加会议。有些行业的 SuperSMB 明显更多，如果不成为行业专家，就会被甩在后面。
3. 从第一天就让客户获得真人服务。不能按客户的员工数设置高级支持门槛；这批创业者一开始就需要受到重视。

他还说，一个销售人员在一年里带来超过 1 亿美元收入是可能的，并举团队中的 @nickbruhman 和其他同事为例。

怎样为 SuperSMB 做产品

Victor 说，Slash 的每一部分产品都围绕 SuperSMB 设计，主要包括以下方向。

从一开始就面向全球。 全球创业者可以用 Cursor 开发软件，通过 Shopify、Amazon 向美国消费者卖实物，再用 Meta 投广告，他因此质疑他们为什么还难以便捷地使用美元。Slash 将其美国市场标准的产品向全球互联网创业者开放，活跃客户已覆盖 40 多个国家。他建议，从第一天就把全球市场纳入设计。

让 Agent 也能使用。 用户在 Slash 仪表盘上能完成的每一个动作，都可以通过 API 或 MCP 完成。Victor 认为，SuperSMB 是 API 和 MCP 的重度用户，并不想为了操作而登录界面，产品应允许他们通过 Agent 调用。

理解行业。 营销代理机构、医疗美容机构、数据标注公司和批发商的财务流程、营运资金需求并不相同。Slash 为已进入的细分行业开发互补的专用工具；Victor 认为，这比横向通用产品能节省更多时间和资金。他判断，如今开发软件已经容易，缺乏行业差异化的产品很难成功，SuperSMB 期待的是面向自身行业的价值。

尽量在一个平台解决完整需求。 企业主想把时间用于改进产品和获得客户，不想花时间管理后台事务。Slash 因此提供四类会计产品：开票、账单支付、费用管理和会计自动化；同时把支付处理、银行服务、稳定币支付、外汇和发卡放在同一平台，并提供多实体管理体验。

Victor 说，过去二十四个月，Slash 作为客户主要银行业务合作方的比例，从不足 20% 升至超过 80%。在他看来，这批客户希望少用工具而非多用工具，又倾向于自己开发；外部产品必须能一次解决很多问题，才值得考虑。Slash 希望为他们解决的是完整的财务需求。

积极定价，靠降低内部成本增加利润。 SuperSMB 经常没有外部融资，很在意盈利能力。Victor 认为，不能傲慢地假设自己的价格可以高于竞争对手。Slash 自身团队也很精简，因此能够提供有竞争力的费率；他的建议是通过降低内部成本增加利润，而不是向最终客户涨价。

Slash 接下来要做什么

Victor 将公司的目标描述为成为全球最受欢迎的企业银行业务平台。他说，这个使命很直接，但极难实现；公司正在招聘有抱负、愿意努力工作的人，有意者可以按原文地址 victor @ slash . com 联系。

原文特别注明：Slash 是金融科技公司，不是银行；银行服务由 FDIC 成员 Column N.A. 提供。

原文

Slash hit 500m annual revenue with 88 people. We invented a new playbook:

Last month, we crossed $500m in annualized gross revenue, up from roughly $150m last year and $50m the year before. Our business is getting larger, and our growth is accelerating. Slash is one of the fastest growing fintech companies of all time, and we have a team of under 100 people.

Our growth can be almost entirely attributed to the fact that we are 100x better at building for and selling to truly AI native entrepreneurs than our competitors. In this article I’m going to talk about three things that helped me build a half a billion dollar revenue business by 25: The rise of the “SuperSMB”, very lean companies with tons of revenue. How to find and sell to the “SuperSMB”. How to build product for the “SuperSMB”. Bookmark this, my promise is that this will be the MOST valuable read of your week.

THE RISE OF THE SUPER-SMB AI is causing a Cambrian explosion of entrepreneurs. In the last three years: U.S. business applications reached roughly 5.6 million in 2025, up about 60% from 3.5 million in 2019. Every 26 seconds, a Shopify store makes its first sale. The median Stripe Atlas startup generated 39% more revenue in its first six months in 2025 than its 2024 counterpart. The “fastest from $0 -> $XXm” isn’t a phenomenon that’s restricted to tech companies. Businesses are growing faster in every sector of the economy. These entrepreneurs are young. Slash customers spend billions of dollars every month, and hold billions of dollars on platform: Over 88% of the assets on the Slash platform belong to businesses with founders under the age of 35. 72% of the spend on Slash is done by businesses with founders under the age of 35. These entrepreneurs start many businesses. 40% of the companies on Slash are owned by an entrepreneur that has at least more than one more business on the platform. Their businesses grow incredibly fast. 65% of the billions of dollars in spend that flow through the Slash platform every month come from businesses that were started in the last 3 years (post ChatGPT!), and 25% come from businesses that were started in the last 12 months. They don’t employ that many people. The median Slash customer spends hundreds of thousands a month on their card, but only has a few employees. And they’re from all over the world. AI and the internet have made it possible for business owners all over the world to sell to the US consumer and business. Entrepreneurs worldwide are increasingly doing business in dollars, and Slash is powering all of them. We believe they are going to be running the world in 10 years I predict that by 2035, over half of all the business deposits held in US banks will come from businesses incorporated post the launch of ChatGPT. The most popular products of today – including banks – were not built for, and cannot keep up with the AI native entrepreneur. You have a massive opportunity to build a product tailored to this ultra fast growing sector of the economy.

HOW TO SELL TO SUPER-SMBs Selling to SuperSMBs is a cheat code if you want your business to grow quickly. They are businesses that can both make you a lot of money (because they are big) and are fast to close (because they are not bureaucratic at all). This is unprecedented in the history of business. Typically, B2B companies had to trade off between sales cycle and ACV: Enterprises = take long to close, but make you a lot of cash. SMBs = faster to close, but don’t make you that much money. You do not have to make that tradeoff if you sell to SuperSMBs.

However, it is not that easy to find them. Slash does not use Clay or Zoominfo. Slash does not do any cold calling or cold emailing. Without giving away all of our secret sauce, you have to at least do these three things: Earn your customers’ trust so you can unlock referrals. You are going to have a brutal time trying to find which 2-10 person teams are doing multiple 8 figures in revenue by checking LinkedIn. Your customers need to be your best sales people. You need to be on the ground. Join every big group chat, stay on top of every important forum, and go to every conference. There are some industries with many more SuperSMBs than others. If you are not an industry expert, you will be left behind. Put a human in front of your customers. You cannot gate premium support to businesses with a certain amount of employees. You must roll out the red carpet for these entrepreneurs on day 0. It is physically possible for one salesperson to bring in > $100m in revenue in a year. @nickbruhman and others on our team are living, breathing examples of that:

HOW TO BUILD FOR SUPER-SMBs Every part of the Slash product was engineered with SuperSMBs in mind. Build a global product from day 0 Entrepreneurs globally can use Cursor to create amazing software, Shopify/Amazon to sell physical goods to the US consumer, and Meta to advertise to them. So why can’t they easily access the dollar? Slash makes its American-caliber product available to internet entrepreneurs all over the world, and has active customers in over 40 countries. SuperSMBs are everywhere. Be global from day 1. Be agent ready Every action a user can perform via the Slash dashboard they can perform via our API or MCP. Nobody wants to log into your UI. SuperSMBs are API and MCP power users. Make your product available to them agentically. Be industry aware Marketing agencies, med spas, data labeling companies, and wholesalers all have different financial workflows, and different working capital needs. Slash builds bespoke, complementary tooling for all the niches it has a presence in, saving our customers much more time and money than our horizontal competitors. Making software is trivial now. Products with no industry differentiation will never make it. SuperSMBs expect you to deliver differentiated value for their niche. Be an all-in-one Business owners want to spend all of their time making their products better and getting more customers. They do not want to spend any time thinking about their back office. Slash eliminates the need for that by offering: 4 accounting products (invoicing, bill pay, expense management, accounting automation) Processing, banking*, stablecoin payments, FX, and issuing via one platform A delightful multi-entity experience. As a result, we’ve gone from being the primary banking partner for less than 20% of our customers to over 80% of them in the last 24 months. SuperSMBs want to consume less tools not more. They have a bias towards building, and so won’t consider your solution unless it solves a lot of their problems. In our case, they solve all of finance for them. Price aggressively SuperSMBs are often bootstrapped and care about profitability. Don’t be arrogant and think you can charge more than your competitors. Slash has some of the best rates out there, and we're able to price so aggressively because we are a very lean company ourselves. Grow your profit by cutting your internal costs, not jacking up prices for your end user.

WHAT’S NEXT FOR SLASH We have a straightforward, but extremely difficult mission of becoming the most popular business banking platform in the world. If you’re ambitious, incredibly hard working, and want to help us build the world’s next great financial services business, we’re hiring. Email me at victor @ slash . com if interested.

• Slash is a financial technology company, not a bank. Banking services provided by Column N.A., Member FDIC.

原文链接：https://x.com/victorcardenas/status/2117729738160496778

乔木改写

Pieter Levels 更新了自己的业务开销：常规部分已降到约 $300/月。这些网站和 App 每年服务约 20000 名付费客户、2.52 亿访客，处理 24 亿次请求，消耗 2.4 PB 带宽。

这个 $300/月的口径不包括 Photo AI。该项目的 GPU 费用约为 $7000/月，R2 存储约为 $800/月；把它算上，总开销约为 $8000/月。Levels 解释，Photo AI 单个项目的体量就远高于其他网站之和，因此在前面的数字中单独排除，但已经计入原帖图表。

他认为 Claude Code 很擅长自主寻找节省成本的办法。这次列出的节省合计接近 $34000/月，具体包括：

• GPU：约省 $29000/月。Photo AI 改用更好、更便宜的视频模型；原先的视频成本一直很高，因为他长期没有更新相关模型。部分图片任务转到有 Google Cloud Credits 可用的 Google Cloud，另一些任务转到按市场成本销售 AI 模型的 Sume。GPU 账单由 $36000/月降至 $7000/月。
• 服务器：约省 $3000/月。合并服务器，取消 DigitalOcean 和 Linode，将服务迁往 Hetzner。
• Backblaze B2 备份：他将这项节省记为约 $1100/月，并给出了账单从 $1200/月降到 $26/月的变化，称便宜了约 50 倍。此前保留了无限版本，没有限制的生命周期策略让服务器文件版本积累了十多年；现在改为保留 30 天。
• Cloudflare R2：约省 $400/月。为 Photo AI 的存储桶增加生命周期策略，让图片在 90 天后自动转入更便宜的 Infrequent Access。桶里已积累多年的照片，账单因此从 $1200/月降到 $800/月。
• 域名：约省 $118/月。Claude 检查了他在 Cloudflare 的域名注册，找出许多不再使用、没有必要继续付费的域名。Levels 还认为，其中一些项目在他所说的后 AGI 世界里已没有太多保留意义；他特别提到，.io 域名续费已达 $50/年，数量一多就会累积成明显支出。
• Claude 订阅：约省 $100/月。Claude 分析了自己的订阅使用量，发现他用不到 Max 20x 套餐的上限，于是将套餐从 $200/月降到 $100/月。

Levels 说，即便计入 Photo AI，他的总成本也比去年降低了约 90%，接近十年前刚开始做项目时的业务开销水平。

他也谈到对这些节省的看法：AI 很擅长发现可以削减的成本，短期内对经济未必有利，但长期可能去掉多余开支，为更好的投资腾出资金。在他看来，成本会随时间悄悄增加，人们往往没意识到钱花到了哪里；AI 能帮助逐项梳理，个人生活的开销也一样。

原文附带媒体

原文附带媒体；未核验其与具体段落的对应关系。

原文

Biz expenses down to ~$300/mo

💸 Update: My total biz expenses have now dropped to just ~$300/mo!

This is to run all my websites/apps serving per year:

• 20,000 paying customers
• 252 million visitors
• 2.4 billion requests
• 2.4 petabyte (PB) in bandwidth

(~$8,000/mo if you add the $7,000/mo GPU bill and $800/mo R2 storage I pay for Photo AI, I exclude it above because it's one project that's so much more expensive in size than all the other sites together, but included in the chart below)

Claude Code helped me to find smart ways to save more money, AI is just really really really good at finding cost savings by itself, which is not so great for the economy short-term, but long term it trims all the fat and opens up spending for better investments I think

Anyway here's what it saved me in money, almost $34,000/mo:

• $29,000/mo - switched to better and cheaper video models on Photo AI, video was very expensive and since I didn't update it ever it stayed expensive, also routed some image jobs to Google Cloud where I have some Google Cloud Credits, and also routed some jobs to Sume which sells AI models at market cost, very cool! This made my GPU bill go from $36,000/mo to $7,000/mo

• $3,000/mo - consolidated my servers, cancelled Digital Ocean and Linode and moved everything to Hetzner saving about $3,000/mo

• $1100/mo - analyzed my Backblaze B2 server backups, I had infinite versioning and lifecycle policies, that's reduced now to 30 days, this literally pushed the bill from $1,200/mo to $26/mo, about 50x cheaper! I had essentially versions of files for all my servers for over a decade, crazy!

• $400/mo - similarly added Lifecycle Policies to my Cloudflare R2 bucket for Photo AI, pics are automatically put in cheaper Infrequent Access after 90 days, there was years of photos in there so this reduced the R2 bill from $1,200/mo to $800/mo

• $118/mo - Claude analyzed all my Cloudflare Domain registrations, lots of domains I didn't use and didn't make sense to keep paying for, lots of things that also don't really make sense anymore in a post-AGI world, renewals for .io TLD are now $50/year which adds up fast!

• $100/mo - Claude also analyzed my Claude subscription (yes!) and discovered I don't even use the Max 20x plan limits, so I downgraded from $200/mo to $100/mo

Even including Photo AI, I have now cut my costs by 90% from last year, getting me close to my biz expenses amount from a decade ago when I started building things

Costs slowly creep up over the years and you don't realize all the things you're spending on but AI is nice to help you figure all that out (also in your personal life!)

原文链接：https://x.com/levelsio/status/2117694259558293692

乔木改写

Amjad Masad 发布了一份安全建议，认为运行在员工终端上的 AI Agent 正成为企业和政府的系统性安全风险。一些机构已经开始限制 Claude Code 等工具；原文提到，据报道高盛采取了这样的措施。Replit 提出的办法，是让 Agent 默认运行在专用、受组织控制的云环境中，只访问完成当前任务所需的资源。

建议书认为，供应链攻击原本就能侵入开发者电脑，并调用已安装的 AI 工具搜索企业敏感信息。Agent harness 往往拥有广泛权限，而人工监督正在减少，使其越来越值得攻击者关注。无人值守的自动化同样可能被 GitHub Issue 或邮件中隐藏的指令引向私有数据和未授权操作。

个人 Agent 会进一步放大这类风险：它们主要由个人控制，组织管理不足，防护措施不一致，又被鼓励主动行动。读取每封邮件和日历邀请，也意味着每次互动都可能接触提示注入。Replit 因此主张，继续采用 Agent 的同时，要为会读取不可信内容、运行代码、代表用户行动的软件提供专门的执行环境；凭证、权限、网络访问和生产变更的控制应放在 Agent 无法自行改变的位置。

使用增长快于治理

原文引用 Stack Overflow 调查：使用或计划使用 AI 工具的受访者比例，从 2023 年的 70% 升至 2024 年的 76%，再到 2025 年的 84% [1][2]。这些数据反映的是不同年度样本中 AI 工具的采用与使用意向，并不是自主 Agent 使用率。

Salt Labs 在其客户环境中检测到 MCP 相关基础设施的比例，从 2026 年 1 月的 16.7% 升至 8 月的 21.6%，增加 4.9 个百分点 [3]。原文提醒，这只是该供应商客户环境的观察，能否代表整个行业、前后客户样本是否一致，都还没有确定。

部署与控制之间的差距更值得注意。在 Salt Security 2026 年 10 月的调查中，86.4% 的受访者说组织内至少有一个 Agent 在运行，但只有 17.5% 能自动停止在生产中出现异常行为的 Agent，只有 12.5% 能持续追踪所有 Agent 的完整执行路径 [3]。

另一项 Cloud Security Alliance 研究中，47% 的受访者称过去一年发生过 Agent 相关安全事件，54% 称组织内有 1 到 100 个未经批准的 Agent，只有 31% 称组织正式采用了 Agent 治理政策 [4]。这项研究在 2025 年 9 月和 11 月调查了 445 名 IT 与安全专业人员，于 2026 年 4 月发布；Zenity 提供经费并参与设计问卷。原文认为，它支持治理存在缺口的判断，但不能把它与 Salt 的结果拼成一条事件率趋势。

不同攻击中的边界失效

建议书逐项列出了事故和研究案例，分别说明证据范围。

个人 Agent 接入敏感系统。 WIRED 报道，一名 Accenture 承包商将个人 Claude Code 账号接入美国国防部的敏感环境，凭证和系统信息似乎流向了第三方服务 [5]。Accenture 否认这些指控，称独立调查认为指控没有根据。WIRED 也表示，没有迹象说明攻击者访问了机密或绝密系统。原文用这一争议案例说明敏感基础设施与个人 Agent 工具之间出现失控连接的风险，而非将争议当成定论。

开发者电脑上的恶意扩展。 WIRED 报道，经 Cursor 市场分发的一个被篡改的 Claude Code 扩展，最多被 5000 名用户下载；它不是 Anthropic 发布的版本 [6]。Cursor 介绍，该扩展收集主机信息，并尝试安装持久化 SSH 后门 [7]。实现错误限制了后门在大部分受影响 macOS 和 Windows 主机上的效果，但仅卸载扩展不一定能移除持久化机制。原文提醒，不能依赖攻击者下次仍犯同样的错误。

恶意软件包调用 AI 工具寻找密钥。 在 2025 年 8 月 Nx 的 s1ngularity 攻击中，恶意软件包利用电脑上已有的 Claude、Gemini 和 Q 命令行工具辅助侦察。Wiz 观察到数百起成功的 AI 辅助活动，以及超过 1000 个有效 GitHub token 泄露。后续攻击使用这些 token，将超过 5500 个私有仓库公开，影响了 400 多名用户或组织；开发者电脑和部分构建流水线都受到了影响 [8]。

合法工具也可能成为数据外传通道。 Invariant 演示了如何通过一个恶意公开 GitHub Issue，诱导使用 GitHub MCP 的 Agent 读取私有仓库资料，再将其写入公开 PR [9]。演示中的 MCP 服务器本身没有被攻破。这证明了一条可能的攻击路径，原始来源并未报告大规模泄露；获准使用的工具和目的服务，仍可能承载未经授权的数据转移。

工具跑出了预期沙箱。 CodeRabbit 确认，研究人员于 2025 年 1 月发现 RuboCop 在沙箱外运行 [10]。公司称，它在 12 小时内完成了全面修复，没有发现客户数据被访问或存在恶意活动的证据。原文据此强调，隔离范围必须覆盖每一个可执行工具和子进程，不能只覆盖主要 Agent 运行时。

云端 Agent 暴露关联账号凭证。 Salt Labs 演示了如何用恶意邮件内容，诱导 Manus 在云沙箱中执行代码；关联服务的 token 当时可被读取，安全警告却在载荷执行后才出现 [11]。Salt 称漏洞后来已修复。这也是云托管本身不等于安全的一个反例。

合法签名权限被滥用。 Elliptic 对 10 月 29 日 Binance 失窃事件的分析认为，攻击者可能诱使 Binance 自身系统签署未经授权的交易。Binance 最初提到 DevOps 笔记本可能失陷，后来又披露其他入侵点，完整路径仍未确定。在以太坊上，签署的 EIP-7702 授权将热钱包的行为委托给攻击者控制的合约，而且委托在最初那笔交易后仍然有效 [12]。原文明确说明，这不是 AI Agent 攻击的证据；它体现的是另一项控制要求：即便凭证没有被直接窃取，只要失陷的调用方能用它授权有害操作，保护凭证本身也不够。

原文将这些案例中的共同问题归为三类：不可信软件带着过大权限执行、不可信内容被当作指令，以及控制措施未能阻止最终操作。

为什么主张受管云环境

员工工作站可能同时拥有浏览器会话、SSH key、云凭证、私有仓库、内网访问和其他业务数据，远多于多数 Agent 任务所需的权限。

专用云环境可以把 Agent 执行与工作站分离。组织能够只配置必要工作区，集中实施访问控制，独立记录操作，并在需要时停止或重建环境，而不必重建员工电脑。要获得这些收益，执行、策略实施和可观测性都必须真正进入受控环境。

本地扩展即使把提示词发给云端模型，仍可能在本机执行代码。同样，把生产凭证复制到远端、给远端 Agent 不受限的网络访问，只是把风险挪了地方。目标是将失陷的 Agent 或依赖限制在一个权限有限的工作区内，组织政策对它的约束不应取决于员工本人拥有多大的权限。

原文图 2 的文字说明描绘了这种边界：Agent 与工具运行在组织控制、任务限定的专用沙箱内，与员工设备的广泛权限分离；独立系统代理凭证，约束权限及流向获准资源的数据。审计、审批和遏制措施必须在 Agent 控制之外执行，而且这些保护需要经过验证，不能仅靠云托管的名称。

需要独立实施的控制

建议书要求将 Agent 执行视作不可信，并列出以下控制项：

• 经过验证的执行隔离。 Agent、安装脚本、工具和依赖都应运行在专用沙箱内，安全实施机制放在其控制之外；不继承员工主目录、浏览器会话或不受限的企业网络权限。
• 经纪式凭证与独立身份。 外部服务凭证不应出现在 Agent 可读的内存、文件或环境变量中。请求通过代理授权，并绑定 Agent、发起人、组织和具体任务。
• 逐步提权授权。 隔离凭证还不够，操作、目标资源、目的地和委托权限的变化，都需要独立检查。高影响操作必须明确批准；拥有合法身份或能访问签名服务，不等于已经获准执行某项操作。
• 任务范围内的权限。 每次运行只获得需要的资源和操作权限，Agent 不得提升自身权限，也不得修改约束自己的政策。
• 网络与数据流限制。 对 DNS、直接 IP 访问、云元数据访问和外部请求加以控制；即使在同一个获准服务内部，也要区分操作和数据目的地。允许访问 GitHub，不等于允许把私有数据发布到 GitHub 任意位置。
• 独立的生产边界。 Agent 可以提出改动，但不应长期持有生产写入权限。重要变更由可信的审批与部署系统实施，并向审批者展示真正将被授权的操作。
• 受控的软件供应链。 核查来源、固定获准版本、审阅工具和 MCP 配置的变化；安装依赖时不带生产凭证。
• 独立审计与遏制。 在 Agent 无法修改的位置记录操作及实施决策，不依赖 Agent 配合就能自动遏制或撤销权限。遏制还必须撤销已授予下游的委托与权限，而不只是停止最初进程或轮换凭证。

组织可以先做什么

Replit 建议，把获准的受管云 Agent 环境作为自主开发的标准路径；盘点现有本地 Agent 和扩展，移除不必要的访问，并禁止个人 Agent 账号连接敏感生产系统。

供应商应实际证明这些边界：Agent 读不到服务凭证，不能绕过网络控制、扩大权限、修改审计记录或未经批准改动生产。遏制能力也应经过实测，包括紧急停止开关是否真的能停止 Agent 活动。

可能受影响的 Cursor 安装，应先按供应商事件响应指南处理。把未来工作移到云端，并不能修复一台已经失陷的终端 [7]。监管行业和政府业务则应只使用获准处理相关数据与系统的环境，并检查模型端点、日志、存储和外部工具是否满足数据驻留、保留、合同及认证要求。

建议书最后说明，它推荐的是有可验证安全控制支撑的云执行。所引资料并未建立本地 Agent 与云 Agent 之间可比的泄露率；它们说明的是隔离、有限权限、凭证分离和独立实施为何重要。每个 Agent 的访问都应按具体任务划定。

原文另推荐 Replit 提出的 Agent Habitat Architecture 及其基于证据的成熟度分级，作为评估独立权限、经纪式凭证、受控数据流和带外遏制的参考框架。每一款云 Agent 产品仍需单独核查实际实现了哪些控制。

原文参考资料

以下资料由原文列出，查阅日期均为 2026 年 11 月 1 日；本站未在本轮重新核验这些外部材料。

1. Stack Overflow：AI | 2024 Developer Survey。
2. Stack Overflow：AI | 2025 Developer Survey。
3. Salt Security：Nearly half of enterprises report an AI agent took an unauthorized action last year，2026 年 10 月 13 日。
4. Cloud Security Alliance：More than half of organizations experience AI agent scope violations，2026 年 4 月 16 日。
5. V. Elliott：A defense contractor gave their personal AI agent access to a secure Pentagon system | WIRED。
6. L. H. Newman：A supply chain attack put malicious Anthropic Claude extensions on thousands of devices | WIRED。
7. Cursor：Claude Code extension security notice，2026 年 10 月 30 日更新。
8. M. Bar、R. McCarthy：s1ngularity: Supply chain attack leaks secrets on GitHub | Wiz，2025 年 8 月 27 日发布、8 月 29 日更新。
9. Invariant Labs：GitHub MCP vulnerability research。
10. H. Gill：Our response to the January 2025 Kudelski Security vulnerability disclosure | CodeRabbit，2025 年 8 月 19 日。
11. Salt Labs：How we hijacked an AI agent with a single email，2026 年 10 月 1 日。
12. T. Robinson：The largest theft in history: North Korea behind the $6.4 billion Binance hack | Elliptic，2026 年 10 月 30 日发布、11 月 1 日更新。

原文

Security advisory: Make managed cloud environments the default for AI agents

AI agents running on employee endpoints are becoming a systemic security risk for enterprises & governments.

Some are responding by restricting tools like Claude Code, as Goldman Sachs reportedly has.

In this security advisory, we outline the risks and recommend a path forward.

Security advisory: Make managed cloud environments the default for AI agents

AI agents should operate in dedicated, organization-controlled environments with limited access to the resources each task requires. Recent security incidents [5], [6] and research demonstrate why this is a growing necessity. Supply-chain attacks have always been able to compromise developer machines and recruit installed AI tools to search for sensitive corporate information and data. Agent harnesses are typically given broad privileges and have a shrinking amount of human oversight. Combined, these two effects are making agents an increasingly interesting target for attackers. Even unattended automations are being targeted: instructions hidden in a GitHub issue or email can redirect an agent toward private data and unauthorized actions. The rise of personal agents increases the risk even more, since they are insufficiently managed by organizations, mostly controlled by individuals, run with an inconsistent set of guardrails, and are incentivized to be proactive above all else: they read every email, every calendar invite; Every interaction is an opportunity to get prompt-injected. There is a better way forward: Organizations can continue adopting agents by giving them execution environments designed for software that reads untrusted content, runs code, and acts on a user’s behalf. In a world where agents are becoming more prevalent, @Replit believes that organizations must make managed, isolated cloud agents the default for autonomous development, with credentials, permissions, network access, and production changes controlled outside the agent’s reach. Adoption is growing faster than control AI development tools are becoming standard. Stack Overflow reports that the share of respondents using or planning to use AI tools rose from 70% in 2023 to 76% in 2024 [1] and 84% in 2025 [2]. This establishes the scale of AI-tool adoption and intent across annual respondent samples. Autonomous-agent usage falls outside the specific scope of this measure. Agent infrastructure is also expanding. Salt Labs [3] detected MCP-related infrastructure in 16.7% of its customer environments in January 2026 and 21.6% in August: a 4.9-percentage-point increase. These observations are limited to the vendor’s customer environments. Their applicability to the wider industry and the consistency of the customer cohort remain unestablished. The more consequential finding is the gap between deployment and control. In Salt Security’s October 2026 survey [3], 86.4% of respondents reported at least one agent operating in their organization, but only 17.5% could automatically stop an agent behaving unexpectedly in production. Only 12.5% could consistently trace complete agent paths across all agents.

A separate Cloud Security Alliance study reinforces the concern [4]: 47% of respondents reported an agent-related security incident in the preceding year, 54% reported between one and 100 unsanctioned agents, and only 31% reported formally adopted agent-governance policies. The study surveyed 445 IT and security professionals in September and November 2025 and was published in April 2026. Zenity financed the research and co-developed the questionnaire. These findings corroborate a governance problem; they should not be combined with Salt’s results into a single incident-rate trend. Different attacks, recurring boundary failures The evidence extends beyond any one model, vendor, or delivery mechanism. Sensitive-system access through a personal agent. WIRED reports that an Accenture contractor connected a personal Claude Code account to a sensitive Department of Defense environment and that credentials and system information appear to have reached a third-party service [5]. Accenture disputes the allegations, saying an independent investigation found them without merit. WIRED reports no indication that attackers accessed classified or top-secret systems. The risk illustrated is an uncontrolled connection between sensitive infrastructure and personal agent tooling. A malicious extension on developer machines. WIRED reports that a tampered Claude Code extension distributed through Cursor’s marketplace was downloaded by at most 5,000 users [6]. It was not an Anthropic-published release. Cursor describes host-information collection and attempts to install a persistent SSH backdoor [7]. Implementation errors limited the backdoor’s effectiveness on most affected macOS and Windows hosts, but uninstalling the extension alone may not remove its persistence mechanisms. We cannot rely on attacker mistakes in the future. Compromised packages recruiting AI tools to find secrets. In the August 2025 Nx “s1ngularity” campaign, malicious packages used previously-installed Claude, Gemini, and Q command-line tools to assist reconnaissance. Wiz [8] observed successful AI-assisted activity in hundreds of cases and more than 1,000 valid GitHub tokens exposed. A subsequent phase used leaked tokens to make over 5,500 private repositories public, affecting more than 400 users or organizations. Developer machines and some build pipelines were affected. Private data leaked through legitimate tools. Invariant [9] demonstrated that a malicious public GitHub issue could persuade an agent using GitHub MCP to retrieve private-repository information and publish it in a public pull request. The researchers demonstrated this attack using an uncompromised MCP server. The demonstration establishes a possible attack path; the source reports no mass breach. An approved tool and destination can still carry an unauthorized data transfer. A tool running outside its intended sandbox. CodeRabbit confirmed that researchers discovered RuboCop operating outside its sandbox in January 2025 [10]. The company says it deployed a comprehensive fix within 12 hours and found no evidence of customer-data access or malicious activity. The lesson is that isolation must extend from the primary agent runtime to every executable tool and subprocess. A cloud agent exposing connected-account credentials. Salt Labs demonstrated that malicious email content could induce code execution in Manus’s cloud sandbox, where connected-service tokens were accessible [11]. A security warning appeared after the payload was executed. Salt says the flaw has since been resolved. This research is an important counterexample to the idea that cloud hosting alone provides security. Compromised infrastructure misusing legitimate signing authority. Elliptic’s analysis of the October 29 Binance theft suggests attackers induced Binance’s own systems to sign unauthorized transactions. Binance initially reported a possible compromised DevOps laptop and later disclosed additional breach points; the full intrusion path remains unresolved. On Ethereum, signed EIP-7702 authorizations delegated a hot wallet’s behavior to an attacker-controlled contract, with delegation persisting beyond the initial transaction [12]. This is not evidence of an AI-agent attack. It illustrates a relevant control requirement: protecting credentials is insufficient if a compromised caller can use them to authorize harmful actions. Together, these cases illustrate three recurring problems: untrusted software executing with excessive access, untrusted content being treated as instructions, and controls that do not prevent the resulting action. Why managed cloud agents are the better default An employee workstation may contain browser sessions, SSH keys, cloud credentials, private repositories, internal-network access, and unrelated business data. That is far more access than most agent tasks require. A dedicated cloud environment makes it possible to separate agent execution from that workstation. The organization can provision only the necessary workspace, enforce access centrally, record actions independently, and stop or rebuild the environment without rebuilding the employee’s laptop. Realizing that benefit requires moving execution, policy enforcement, and observability into the controlled environment. A local extension that sends prompts to a cloud model still executes local code. Likewise, a remote agent with copied production credentials and unrestricted network access reproduces the same risks elsewhere. The objective is to contain a compromised agent or dependency within a limited workspace. Organizational policy must govern the agent’s access independently of the employee’s broader authority. 📷 Fig. 2. A conceptual security boundary for autonomous agents. The agent and its tools run in a dedicated, task-scoped sandbox within an organization-controlled environment, separate from the employee device’s broader authority. Independent controls broker credentials and govern permissions and data flows to approved resources. Audit records, approval gates, and containment are enforced outside the agent’s control. Cloud hosting requires verified controls to provide these protections. Required controls It is recommended to treat agent execution as untrusted and enforce boundaries independently of the agent’s cooperation. Organizations should require: Verified execution isolation. Keep agents, installation scripts, tools, and dependencies inside dedicated sandboxes. Place security enforcement outside their control. Do not inherit employee home directories, browser sessions, or unrestricted corporate-network access. Brokered credentials and distinct identities. Keep external-service credentials out of agent-readable memory, files, and environment variables. Authorize requests through a broker, bound to the agent, initiating principal, organization, and task. Step-up Authorization: Credential isolation must be paired with independent checks on the requested operation, target resource, destination, and any change in delegated authority. Require explicit approval for high-impact actions; possession of a valid identity or access to a signing service is not sufficient authorization. Task-scoped permissions. Give each run only the resources and operations it needs. Agents must not be able to raise their own permissions or alter the policy that governs them. Network and data-flow restrictions. Control DNS, direct-IP traffic, cloud-metadata access, and external requests. Distinguish permitted operations and data destinations within approved services; allowing GitHub must not imply allowing private data to be published anywhere on GitHub. A separate production boundary. Let agents propose changes without standing production-write authority. Apply consequential changes through trusted approval and deployment systems that display the actual action being authorized. Controlled software supply chains. Verify provenance, pin approved versions, and review tool and MCP configuration changes. Install dependencies without production credentials. Independent audit and containment. Record actions and enforcement decisions somewhere the agent cannot alter. Support automatic containment and revocation without depending on the agent’s cooperation. Containment must also revoke downstream delegations and permissions already granted, not just stop the initiating process or rotate its credentials. Recommended action Make approved, managed cloud-agent environments the standard path for autonomous development. Inventory existing local agents and extensions, remove unnecessary access, and prohibit personal agent accounts from connecting to sensitive production systems. Require vendors to demonstrate their boundaries: that an agent cannot read service credentials, bypass network controls, expand its permissions, modify audit records, or make unapproved production changes. Verify containment through practical tests, including whether the kill switch actually stops agent activity. For potentially affected Cursor installations, follow the vendor’s incident-response guidance now. Moving future work to the cloud does not remediate an already compromised endpoint [7]. For regulated and government workloads, use only environments authorized for the relevant data and systems. Assess model endpoints, logs, storage, and external tools against residency, retention, contractual, and accreditation requirements. The recommendation is cloud execution backed by verified security controls. The sources reviewed do not establish a comparative breach rate for local versus cloud agents. They establish why isolation, limited authority, credential separation, and independent enforcement matter. Agents’ access should be scoped to the requirements of each task. For a concrete framework to evaluate these controls, see Replit’s proposed Agent Habitat Architecture and its evidence-based maturity scale. It provides a reference architecture for independently enforced permissions, brokered credentials, controlled data flows, and out-of-band containment. Each cloud-agent product should be assessed separately to verify which controls it implements. References [1] Stack Overflow, “AI | 2024 Developer Survey”. Accessed: Nov. 1, 2026. [Online]. Available: https://survey.stackoverflow.co/2024/ai [2] Stack Overflow, “AI | 2025 Developer Survey”. Accessed: Nov. 1, 2026. [Online]. Available: https://survey.stackoverflow.co/2025/ai [3] Salt Security, “Nearly half of enterprises report an AI agent took an unauthorized action last year, Salt Security research finds,” Oct. 13, 2026. Accessed: Nov. 1, 2026. [Online]. Available: https://salt.security/press-releases/state-of-agentic-ai-and-api-security-2h-2026 [4] Cloud Security Alliance, “More than half of organizations experience AI agent scope violations, Cloud Security Alliance study finds,” Apr. 16, 2026. Accessed: Nov. 1, 2026. [Online]. Available: https://cloudsecurityalliance.org/press-releases/2026/04/16/more-than-half-of-organizations-experience-ai-agent-scope-violations-cloud-security-alliance-study-finds [5] V. Elliott, “A defense contractor gave their personal AI agent access to a secure Pentagon system | WIRED”. Accessed: Nov. 1, 2026. [Online]. Available: https://www.wired.com/story/a-defense-contractor-gave-their-personal-ai-agent-access-to-a-secure-pentagon-system/ [6] L. H. Newman, “A supply chain attack put malicious Anthropic Claude extensions on thousands of devices | WIRED”. Accessed: Nov. 1, 2026. [Online]. Available: https://www.wired.com/story/trojan-malware-targets-thousands-of-anthropic-claude-developer-systems/ [7] Cursor, “Claude Code extension security notice,” updated Oct. 30, 2026. Accessed: Nov. 1, 2026. [Online]. Available: https://cursor.com/blog/claude-code-extension-security-notice [8] M. Bar and R. McCarthy, “s1ngularity: Supply chain attack leaks secrets on GitHub: Everything you need to know | Wiz Blog,” Aug. 27, 2025, updated Aug. 29, 2025. Accessed: Nov. 1, 2026. [Online]. Available: https://www.wiz.io/blog/s1ngularity-supply-chain-attack [9] Invariant Labs, GitHub MCP vulnerability research. Accessed: Nov. 1, 2026. [Online]. Available: https://invariantlabs.ai/blog/mcp-github-vulnerability [10] H. Gill, “Our response to the January 2025 Kudelski Security vulnerability disclosure: Action and continuous improvement,” CodeRabbit, Aug. 19, 2025. Accessed: Nov. 1, 2026. [Online]. Available: https://www.coderabbit.ai/blog/our-response-to-the-january-2025-kudelski-security-vulnerability-disclosure-action-and-continuous-improvement [11] Salt Labs, “How we hijacked an AI agent with a single email,” Salt Security, Oct. 1, 2026. Accessed: Nov. 1, 2026. [Online]. Available: https://salt.security/blog/how-we-hijacked-an-ai-agent-with-a-single-email [12] T. Robinson, “The largest theft in history: North Korea behind the $6.4 billion Binance hack,” Elliptic, Oct. 30, 2026, updated Nov. 1, 2026. Accessed: Nov. 1, 2026. Available: https://www.elliptic.co/insights/binance-largest-hack-in-history/

原文链接：https://x.com/amasad/status/2117504072416890937

乔木改写

Pieter Levels 说，他反编译了可能是自己最喜欢的游戏《Battlefield 1942》，把它放到网页上，并加入多人联机。可试玩的是免费 shareware demo，地址为 bf1942.pieter.com。

按他的介绍，这次比之前移植 Quake 和 DOOM 困难得多：后两者已有大量开源项目和前人的工作可用，而《Battlefield 1942》没有这样的基础。他说，之前没人做过这个移植，也没有可用的开源引擎；开发商不像 id Software 对 Quake 3 那样开放过引擎源码。

他在半年前试过一次，基本放弃了。这次使用 Opus 5.5，重新请它尝试把文件夹中的 BF1942 demo 移植到网页。Levels 坦言，虽然说是自己和 Claude Code 合作，大部分工作实际由 Claude Code 完成。

他列出的步骤包括：

• 反汇编原始 x86 机器码，识别出约 57000 个 x86 函数。
• 把每个 x86 函数翻译成 C 函数，例如将 mov eax, [esi+0x110] 转为 eax = READ32(esi + 0x110)。他也承认自己并不理解这些代码的含义。
• 生成约 100000 行 C 代码。
• 用 Emscripten 编译为 WebAssembly。
• 将游戏使用的约 300 个 Windows 和 Direct3D 函数重写为 WebGL 2、OpenGL 对应实现，使其能在网页上运行。
• 自行构建网络栈，通过 WebSocket 连接多人服务器。

Levels 说，他并不清楚 Claude 是怎么完成这些工作的，但结果似乎能运行。他邀请读者试玩，并到原帖反馈发现的问题。

原文

Battlefield 1942 decompiled to the browser

I decompiled probably my favorite game ever: Battlefield 1942 and I put it on the web with multiplayer for you to play here:

👉 https://t.co/6C8H8KtSaU 👈

(It's the free shareware demo)

It was way harder than the other ports like Quake and DOOM I did because they already had lots of open source projects and work behind them

In case of Battlefield 1942 there was literally absolutely nothing to work on top of, nobody had ever ported it and there was no open source engine for it, nor did the makers ever open source it (like id Software did with Quake 3)

I tried it 6 months ago and essentiay gave up but I tried it today again with Opus 5.5 asking "can you try port the BF1942 demo in this folder to web"

So me and Claude Code (well let's be honest mostly Claude Code) did crazy shit today:

• it disassembled the x86 raw machine code to find 57,000 x86 functions
• it translated each x86 function into a C function (mov eax, [esi+0x110] becomes eax = READ32(esi + 0x110), I have no idea what any of this means btw)
• it outputed 100,000 lines of C
• it then compiled that to WebAsswmbly with Emscripten
• there were 300x Windows and Direct3D functions used which we had to rewrite to WebGL 2 and OpenGL to work on the web
• then we had to build our own network stack so it could connect to our multiplayer server via WebSockets

I have no idea how it did any of this but it did it and it seems to work! 😊

Come play and report any bugs here!

原文链接：https://x.com/levelsio/status/2117374984192512391

相关链接：https://bf1942.pieter.com

乔木改写

Andrej Karpathy 不满 YouTube 的推荐，于是做了一个周末项目 HackerTube。他让 Claude 从 Hacker News 二十年来约 4300 万条评论中，筛出反复被推荐的 6454 个视频。按他的说法，整个项目用 Opus 5.5 花了约两小时，观看体验明显更好。

他列出了几个设计选择：

• 不登录也能获得推荐，使用状态保存在本地浏览器会话中。
• 缩略图选取视频中段有代表性的一帧，而非上传者经过大量 A/B 测试优化的封面。
• 评论分析的底层数据打包为一个 zip 文件，其他人可以把它交给 Claude，要求制作自己的版本。
• 另有 HackerTube Longs。

他也介绍了制作过程。默认工具是 Mac 版 Claude Code 桌面应用，模型为 Opus 5.5，使用 Medium effort。他只与 Claude 对话，让它完成工作；自己配合做的手动操作都在浏览器中：从 Google Cloud 界面创建查询 YouTube 视频元数据所需的 API key、启动用于提供服务的 VPS，以及购买域名。他提到，这种配合方式让他想起 MenuGen。

VPS 启动后，他把 IP 交给 Claude，让它更新系统、处理安全加固、部署并优化代码。他说，Claude 完成了这些工作。

Karpathy 感慨，一些过去需要数周甚至数月的项目，如今吃顿早饭的工夫，用少量提示就能做出来。他想知道，还有哪些项目是大家尚未想到的。原帖中的项目链接是 HackerTube。

原文附带媒体

原文附带媒体；未核验其与具体段落的对应关系。

原文

Weekend hack: HackerTube

Weekend hack: HackerTube. I was annoyed with YouTube's recommendations so I had Claude filter down 43M comments over 20 years of HN to 6,454 videos that keep being recommended. Significantly better viewing experience, ~2 hours with Opus 5.5: https://t.co/JIhXN7OSh1

• Excellent recs without any logins (state is kept in local browser session)
• Thumbnail is a representative frame from middle of the video instead of the super duper A/B test hyper-optimized user uploads
• Underlying data from the comment analysis as one zip file, point your Claude at it and ask for your own version
• HackerTube Longs ✊

A bit more on the process: I use Claude Code (desktop app for Mac), Opus 5.5 on Medium effort as my default. I only talk to Claude and have it do everything, the only "manual work" I helped with in tandem was in the browser (reminiscent of MenuGen): 1) I had to create some kind of API key from Google Cloud UI to query YouTube for video metadata, 2) I booted up a VPS box for serving and 3) I bought the domain name. Once the box was up I gave Claude the IP and told it update, secure, harden, deploy and optimize the code, and it did the whole thing.

Many awesome projects that would have normally taken weeks/months even can now be few-shotted for breakfast. What else are we not thinking of.

原文链接：https://x.com/karpathy/status/2116957135661945283