Real problems people complain about online, pulled every morning and scored out of 100. Build, validate, or skip. How scoring works
Hey HN,We got tired of browser frameworks restricting the LLM, so we removed the framework and gave the LLM maximum freedom to do whatever it's trained on. We gave the harness the ability to self correct and add new tools if the LLM wants (is pre-trained on) that.Our Browser Use library is tens of thousands of lines of deterministic heuristics wrapping Chrome (CDP websocket). Element extractors, click helpers, target managemenet (SUPER painful), watchdogs (crash handling, file downloads, alerts), cross origin iframes (if you want to click on an element you have to switch the target first, very anoying), etc.Watchdogs specifically are extremely painful but required. If Chrome triggers for example a native file popup the agent is just completely stuck. So the two solutions are to: 1. code those heuristics and edge cases away 1 by 1 and prevent them 2. give LLM a tool to handle the edge caseAs you can imagine - there are crazy amounts of heuristics like this so you eventually end up with A LOT of tools if you try to go for #2. So you have to make compromises and just code those heuristics away.BUT if the LLM just "knows" CDP well enough to switch the targets when it encounters a cross origin iframe, dismiss the alert when it appears, write its own click helpers, or upload function, you suddenly don't have to worry about any of those edge cases.Turns out LLMs know CDP pretty well these days. So we bitter pilled the harness. The concepts that should survive are: - something that holds and keeps CDP websocket alive (deamon) - extremely basic tools (helpers.py) - skill.md that explains how to use itThe new paradigm? SKILL.md + a few python helpers that need to have the ability to change on the fly.One cool example: We forgot to implement upload_file function. Then mid-task the agent wants to upload a file so it grepped helpers.py, saw nothing, wrote the function itself using raw DOM.setFileInputFiles (which we only noticed that later in a git diff). Thi
Hacker News4mo agoToolAI
I am working on a new open-source project. (My project is in AI infrastructure. It already gets SOTA results on several well-known benchmarks.) The core value is not just the code, but a fairly specific algorithmic approach that came out of many failed attempts, experiments, and design iterations.The dilemma I am facing is this:If I open-source early, I get feedback, trust, users, and maybe contributors. But I also expose the core design and algorithm. With LLMs, turning a repo into a different implementation is much cheaper than it used to be.If I keep it closed, I protect the work for longer, but I also lose the main advantages of OSS: adoption, review, community, and credibility. Worse, someone else may still build something similar and become the default project in the space.I’m a new solo dev with almost no audience. If a large org or a well-known developer sees the idea and ships a similar implementation, they can get more attention immediately than I can get in months. And in the end I get nothing for open-sourcing my project.How would you handle this as a solo dev?
Hacker News4mo agoToolAI
Hey HN! Today we're launching Agent Vault - an open source HTTP credential proxy and vault for AI agents. Repo is at https://github.com/Infisical/agent-vault, and there's an in-depth description at https://infisical.com/blog/agent-vault-the-open-source-crede....We built Agent Vault in response to a question that been plaguing the industry: How do we give agents secure access to services without them reading any secrets?Most teams building agents have run into this exact problem: They build an agent or agentic system and come to realize at some point that it needs credentials in order to access any services. The issue is that agents, unlike traditional workloads, are non-deterministic, highly-prone to prompt injection, and thus can easily be manipulated to leaking the credentials that they need to operate. This is the problem of credential exfiltration (not to be confused with data exfiltration).In response to this, some teams we've seen have implemented basic guardrails and security controls to mitigate this risk in their agentic environments including using short-lived access tokens. The more advanced teams have started to converge toward a pattern: credential brokering, the idea being to separate agents from their credentials through some form of egress proxy. In this model, the agent makes a request to a proxy that attaches a credential onto it and brokers it through to the target service. This proxy approach is actually used in Anthropic's Managed Agents architecture blog with it being that "the harness is never made aware of the credentials." We've seen similar credential brokering schemes come out from Vercel and in Cloudflare's latest Outbound Workers.Seeing all this made us think: What if we could create a portable credential brokering service plugged seamlessly into agents' existing workflows in an interface agnostic way, meaning that agents could continue to work with APIs
Hacker News4mo agoToolAI
Hi HN, I built VidStudio, a privacy focused video editor that runs in the browser. I tried to keep it as frictionless as possible, so there are no accounts and no uploads. Everything is persisted on your machine.Some of the features: multi-track timeline, frame accurate seek, MP4 export, audio, video, image, and text tracks, and a WebGL backed canvas where available. It also works on mobile.Under the hood, WebCodecs handles frame decode for timeline playback and scrubbing, which is what makes seeking responsive since decode runs on the hardware decoder when the browser supports it. FFmpeg compiled to WebAssembly handles final encode, format conversion, and anything WebCodecs does not cover. Rendering goes through Pixi.js on a WebGL canvas, with a software fallback when WebGL is not available. Projects live in IndexedDB and the heavy work runs in Web Workers so the UI stays responsive during exports.Happy to answer technical questions about the tradeoffs involved in keeping the whole pipeline client-side. Any feedback welcome.Link: https://vidstudio.app/video-editor
Hacker News4mo agoToolAI
ctx is a local SQLite-backed skill for Claude Code and Codex that stores context as a persistent workstream that can be continued across agent sessions. Each workstream can contain multiple sessions, notes, decisions, todos, and resume packs. It essentially functions as a /resume that can work across coding agents.Here is a video of how it works: https://www.loom.com/share/5e558204885e4264a34d2cf6bd488117I initially built ctx because I wanted to try a workstream that I started on Claude and continue it from Codex. Since then, I’ve added a few quality of life improvements, including the ability to search across previous workstreams, manually delete parts of the context with, and branch off existing workstreams.. I’ve started using ctx instead of the native ‘/resume’ in Claude/Codex because I often have a lot of sessions going at once, and with the lists that these apps currently give, it’s not always obvious which one is the right one to pick back up. ctx gives me a much clearer way to organize and return to the sessions that actually matter.It’s simple to install after you clone the repo with one line: ./setup.sh, which adds the skill to both Claude Code and Codex. After that, you should be able to directly use ctx in your agent as a skill with ‘/ctx [command]’ in Claude and ‘ctx [command]’ in Codex.A few things it does:- Resume an existing workstream from either tool- Pull existing context into a new workstream- Keep stable transcript binding, so once a workstream is linked to a Claude or Codex conversation, it keeps following that exact session instead of drifting to whichever transcript file is newest- Search for relevant workstreams- Branch from existing context to explore different tasks in parallelIt’s intentionally local-first: SQLite, no API keys, and no hosted backend. I built it mainly for myself, but thought it would be cool to share with the HN community.
Hacker News4mo agoToolAI
Hi HN — we built Broccoli, an open-source harness for taking coding tasks from Linear, running them in isolated cloud sandboxes, and opening PRs for a human to review.We’re a small team, and our main company supplies voice data. But we kept running into the same problem with coding agents. We’d have a feature request, a refactor, a bug, and some internal tooling work all happening at once, and managing that through local agent sessions meant a lot of context switching, worktree juggling, and laptops left open just so tasks could keep running.So we built Broccoli. Each task gets its own cloud sandbox to be executed end to end independently. Broccoli checks out the repo, uses the context in the ticket, works through an implementation, runs tests and review loops, and opens a PR for someone on the team to inspect.Over the last four weeks, 100% of the PRs from non-developers are shipped via Broccoli, which is a safer and more efficient route. For developers on the team, this share is around 60%. More complicated features require more back and forth design with Codex / Claude Code and get shipped manually using the same set of skills locally.Our implementation uses:1. Webhook deployment: GCP 2. Sandbox: GCP or Blaxel 3. Project management: Linear 4. Code hosting & CI/CD: GithubRepo: https://github.com/besimple-oss/broccoliWe believe that if you should invest in your own coding harness if coding is an essential part of your business. That’s why we decided to open-source it as an alternative to all the cloud coding agents out there. Would love to hear your feedback on this!
Hacker News4mo agoToolAI
AI applications and agents forget context and data across sessions, hindering long-term functionality and scalability without dedicated memory solutions.
X5mo agoToolAI
For almost two years, we've been developing Charlie, a coding agent that is autonomous, cloud-based, and focused primarily on TypeScript development. During that time, the explosion in growth and development of LLMs and agents has surpassed even our initially very bullish prognosis. When we started Charlie, we were one of the only teams we knew fully relying on agents to build all of our code. We all know how that has gone — the world has caught up, but working with agents hasn't been all kittens and rainbows, especially for fast moving teams.The one thing we've noticed over the last 3 months is that the more you use agents, the more work they create. Dozens of pull requests means older code gets out of date quickly. Documentation drifts. Dependencies become stale. Developers are so focused on pushing out new code that this crucial work falls through the cracks. That's why we pivoted away from agents and invented what we think is the necessary next step for AI powered software development.Today, we're introducing Daemons: a new product category built for teams dealing with operational drag from agent-created output. Named after the familiar background processes from Linux, Daemons are added to your codebase by adding an .md file to your repo, and run in a set-it-and-forget-it way that will make your lives easier and accelerate any project. For teams that use Claude, Codex, Cursor, Cline, or any other agent, we think you'll really enjoy what Daemons bring to the table.
Hacker News4mo agoToolAI
Hi, I’m Jakub, a solo founder based in Warsaw.I’ve been building GoModel since December with a couple of contributors. It's an open-source AI gateway that sits between your app and model providers like OpenAI, Anthropic or others.I built it for my startup to solve a few problems: - track AI usage and cost per client or team - switch models without changing app code - debug request flows more easily - reduce AI spendings with exact and semantic caching How is it different? - ~17MB docker image - LiteLLM's image is more than 44x bigger ("docker.litellm.ai/berriai/litellm:latest" ~ 746 MB on amd64) - request workflow is visible and easy to inspect - config is environment-variable-first by default I'm posting now partly because of the recent LiteLLM supply-chain attack. Their team handled it impressively well, but some people are looking at alternatives anyway, and GoModel is one.Website: https://gomodel.enterpilot.ioAny feedback is appreciated.
Hacker News4mo agoToolAI
Seeking an AI development environment (ADE) app that includes browser, filesystem access, bring-your-own-key (BYOK), and good UI, beyond existing options.
X5mo agoToolAI
Overwhelmed by lists of many AI tools across categories like writing, coding, agents, etc., needing a way to manage them effectively.
X4mo agoToolAI
Hi HN, I'm Alon, and I'm building Alien, an open-source platform for deploying your software into your customer's environment and keeping it fully managed.In my previous startup, I heard the same question from every single enterprise customer over and over again: "My data is sensitive. Can I deploy your product to my own cloud account?"Self-hosting is becoming very popular because it lets users keep their data private, local, and inside their own environment. Unfortunately, self-hosting breaks down when someone starts paying for your software. Especially if it's an enterprise customer.Customers usually don't actually know how to operate your software. They might change something small — Postgres version, environment variables, IAM, firewall rules — and things start failing. From their perspective, the product is broken. And even if the root cause is on their side, it doesn't matter... the customer is always right, you're still the one expected to fix it.But you can't. You don't have access to their environment. You don't have real visibility. You can't run anything yourself. So you're stuck debugging a system you don't control, through screenshots and copy-pasted logs on a Zoom call. You end up responsible for something you don't control.I think there's a better model of paid self-hosting: the software runs in the customer's environment, but the developer can actually operate it. It's a win-win: for the customer, their data stays private and local, and the developer still has control over deployments, updates, and debugging.Alien provides infrastructure to deploy and operate software inside your users' environments, while retaining centralized control over updates, monitoring, and lifecycle management. It currently supports AWS, GCP, and Azure targets.GitHub: https://github.com/alienplatform/alienGetting started: https://alien.dev/do
Hacker News4mo agoToolAI
I'm building a P2P crowdshipping marketplace, basically BlaBlaCar but for packages instead of passengers. Travelers going between cities/countries carry items for people who need to send stuff.About to launch the MVP and hitting the classic chicken-and-egg problem.Travelers won't sign up without packages to carry, senders won't post without travelers available. Every marketplace founder says "focus on one side first" but nobody gets specific about how they actually did it, especially when you can't fake supply like you can with a SaaS landing page.For those who've built P2P platforms or two-sided marketplaces: what actually worked for your first 50-100 transactions? Did you manually match people? Subsidize one side? Constrain to one route/city?
Hacker News4mo agoToolAI
Eight years ago, my then-fiancée and I decided to get a prenup, so we hired a local mediator. The meetings were useful, but I felt there was no systematic process to produce a final agreement. So I started to think about this problem, and after a bit of research, I discovered the Nash bargaining solution.Yet if John Nash had solved negotiation in the 1950s, why did it seem like nobody was using it today? The issue was that Nash's solution required that each party to the negotiation provide a "utility function", which could take a set of deal terms and produce a utility number. But even experts have trouble producing such functions for non-trivial negotiations.A few years passed and LLMs appeared, and about a year ago I realized that while LLMs aren’t good at directly producing utility estimates, they are good at doing comparisons, and this can be used to estimate utilities of draft agreements.This is the basis for Mediator.ai, which I soft-launched over the weekend. Be interviewed by an LLM to capture your preferences and then invite the other party or parties to do the same. These preferences are then used as the fitness function for a genetic algorithm to find an agreement all parties are likely to agree to.An article with more technical detail: https://mediator.ai/blog/ai-negotiation-nash-bargaining/
Hacker News4mo agoToolAI
### Feature request ## Is your feature request related to a problem? Yes, it's a UX problem where my users get confused about where to manage their purchases. I'd like them to only know about my platform to avoid this confusion. Also, receiving Polar's order confirmation email and mine adds to the confusion. When they buy my product. ## Describe the solution you'd like I'd like to be able to disable Polar's communication with my users, as well as the customer portal. ## Describe alternatives you've considered 1. Being able to set the link shown in the email from Polar. 2. Being able to use Polar as merchant of record, but something like Stripe to handle payments. ## Additional context Link to the original [discord question](https://discord.com/channels/1078611507115470849/1422931380085587978)
GitHub11mo agoToolAI
I’ve spent roughly the last decade and some change as a software engineer, and recently decided to start a solo consultancy.I’m focused on helping SMEs sort out the messy back-office parts of the business: spreadsheet glue, brittle internal workflows, poor reporting, awkward integrations, backend/platform problems, and AI workflows that need to do real work rather than just look good in a demo.I’m not really interested in becoming a generic agency. I’d rather work with businesses that already feel operational pain and need someone technical to help untangle it properly.For those of you who’ve made this jump:* how did you get your first real project? * what kind of outreach actually worked? * did your first few clients come from network, content, cold outreach, partnerships, subcontracting, or somewhere else?Also, if anyone knows SMEs or operators dealing with this sort of mess, I’d be glad to chat.As a gesture of goodwill, I’m offering the first 5 clients 10 hours free to help get an initial project moving.You can find me over at https://crescita.cc
Hacker News5mo agoToolAI
We built AI Subroutines in rtrvr.ai. Record a browser task once, save it as a callable tool, replay it at: zero token cost, zero LLM inference delay, and zero mistakes.The subroutine itself is a deterministic script composed of discovered network calls hitting the site's backend as well as page interactions like click/type/find.The key architectural decision: the script executes inside the webpage itself, not through a proxy, not in a headless worker, not out of process. The script dispatches requests from the tab's execution context, so auth, CSRF, TLS session, and signed headers get added to all requests and propagate for free. No certificate installation, no TLS fingerprint modification, no separate auth stack to maintain.During recording, the extension intercepts network requests (MAIN-world fetch/XHR patch + webRequest fallback). We score and trim ~300 requests down to ~5 based on method, timing relative to DOM events, and origin. Volatile GraphQL operation IDs are detected and force a DOM-only fallback before they break silently on the next run.The generated code combines network calls with DOM actions (click, type, find) in the same function via an rtrvr.* helper namespace. Point the agent at a spreadsheet of 500 rows and with just one LLM call parameters are assigned and 500 Subroutines kicked off.Key use cases:- record sending IG DM, then have reusable and callable routine to send DMs at zero token cost- create routine getting latest products in site catalog, call it to get thousands of products via direct graphql queries- setup routine to file EHR form based on parameters to the tool, AI infers parameters from current page context and calls tool- reuse routine daily to sync outbound messages on LinkedIn/Slack/Gmail to a CRM using a MCP serverWe see the fundamental reason that browser agents haven't taken off is that for repetitive tasks going through the inference loop is unnecessary. Better to just record once, and
Hacker News5mo agoToolAI
I've been thinking about this one recently in the context of trivy's [ongoing issues](https://github.com/aquasecurity/trivy/discussions/10425): it's good to hash-pin actions, but a lot of actions internally just fetch whatever "latest" version of a binary is available as a GitHub release. Consequently, even hash-pinned actions can be a vector for distributing malicious builds, since "latest" is always a mutable concept (and without immutable releases, previous tags may also be mutable). So, we should have an audit for this. Like with `cache-poisoning`, we'll probably want to use the coordinate API and start with a fixed set of well-known actions that are known to install binaries. Some good initial candidates: - `aquasecurity/trivy-action` - `taiki-e/install-action` Each of these will require slightly different coordinates/nuances. For example `trivy-action` has the `version:` input, but `version: latest` should still be flagged. In contrast `install-action` has no `version:` input, but the `tool:` input should have a `@version` suffix. Those are the relatively easy cases; it might also be nice to be able to flag actions like `astral-sh/setup-uv`, but the wrinkle with those is that they also support a `version-file` input and by policy zizmor doesn't attempt to parse files outside of workflows/actions/etc. for supporting information. So `setup-uv` and similar would be subject to higher false positive rates. There are also actions that never make sense to flag, like our own `zizmor-action`: `zizmor-action` has a `version:` input that defaults to `latest`, but under the hood `latest` is actually hash-pinned within the repo itself and is therefore immutable and changes only when the action itself changes. By way of example, here would be some steps that an audit here should flag: ```yaml - uses: aquasecurity/trivy-action@whatever # FLAG: no `version:` input - uses: taiki-e/install-action@whatever with: tool: cargo-hack # FLAG: no `@version` prefix - uses
GitHub5mo agoToolAI
I've noticed AI tools have made me lazier. I used to think and reason through problems deeply, writing out my thoughts, going back and forth on items. With LLMs so easily available, I find myself having a conversation with Claude instead. I'm concerned that I'm not exercising my deep thinking muscles much.Anyone else feel this? And more specifically — what deliberate practices are you using to keep your reasoning sharp?
Hacker News5mo agoToolAI
Hey HN! We're Charles and Dean, and we're building Stage: a code review tool that guides you through reading a PR step by step, instead of piecing together a giant diff.Here's a demo video: https://www.tella.tv/video/stage-demo-1pph. You can play around with some example PRs here: https://stagereview.app/explore.Teams are moving faster than ever with AI these days, but more and more engineers are merging changes that they don't really understand. The bottleneck isn't writing code anymore, it's reviewing it.We're two engineers who got frustrated with GitHub's UI for code review. As coding agents took off, we saw our PR backlog pile up faster than we could handle. Not only that, the PRs themselves were getting larger and harder to understand, and we found ourselves spending most of our time trying to build a mental model of what a PR was actually doing.We built Stage to make reviewing a PR feel more like reading chapters of a book, not an unorganized set of paragraphs. We use it every day now, not just to review each other's code but also our own, and at this point we can't really imagine going back to the old GitHub UI.What Stage does: when a PR is opened, Stage groups the changes into small, logical "chapters". These chapters get ordered in the way that makes most sense to read. For each chapter, Stage tells you what changed and specific things to double check. Once you review all the chapters, you're done reviewing the PR.You can sign in to Stage with your GitHub account and everything is synced seamlessly (commenting, approving etc.) so it fits into the workflows you're already used to.What we're not building: a code review bot like CodeRabbit or Greptile. These tools are great for catching bugs (and we use them ourselves!) but at the end of the day humans are responsible for what gets shipped. It's clear that reviewing code hasn't scaled the sam
Hacker News5mo agoToolAI