Your agent session stopped being single-player today.

A terminal tool (MIT, macOS) that joins an existing, native Codex or Claude Code session running on a teammate's Mac — not a new IDE, not a cloud copy of the conversation. The host explicitly shares a session over your existing Tailscale network; the guest arrives with the full context and prompts under their own name, and the demo is a real two-Mac recording of exactly that, with Claude addressing each participant separately. Launched on Product Hunt today at #12 with 94 votes. CI and CodeQL run on every commit, which is more rigor than the repo's age would suggest: it was created Saturday and has three GitHub stars.

This is the meat-proxy complaint deleted at the mechanism level. The relay human exists because the session has one seat, so whoever holds it becomes the API between the agent and everyone else — mpai adds seats instead. It's also the most honest launch copy in the pool: a public-alpha boundary doc, "trusted teammates" named outright as the trust model, and a pinned pilot issue stating they're measuring completed rooms and week-later return, not launch votes. The honesty precedent (HART OS 07-27, kassette 07-14) says that discipline at 44 stars is a better signal than polish at four thousand; this is that bet again, one day earlier in the tool's life than we've ever placed it.

Reach for it when a teammate asks "what did Claude say" for the third time in one afternoon. Delete the transcript paste into Slack and the screen-share where one person types. Tradeoffs: one day old, three stars, alpha, and it says so on the first screen; macOS plus Tailscale only; a shared session is a capability grant — the guest is prompting an agent that holds the host's write access, which is exactly the per-collaborator ceiling the 07-23 doorbell watch asked for and nobody has shipped; and it wraps native sessions, so a harness update can break it under you.

MIT, 23,055 stars, iOS, Android and web clients. npm install -g happy, then run happy claude or happy codex instead of the bare command: when you leave the desk, the running session moves to your phone; when you sit back down, pressing any key takes it back. End-to-end encrypted by design — their description, keys on your devices — with push notifications when the agent hits a permission prompt or an error, and realtime voice. Over a year old, and commits landed this morning.

The arrived-late pattern again (witr, 07-31): twenty-three thousand stars and today is its first crossing into our pool. The why-now is in this morning's commit log — self-host publishing is being split out of the production server package, meaning the relay between your terminal and your phone is becoming a thing you can run yourself rather than an account you hold with them. Against the doorbell shelf (AgentManager 07-22, BlackFlare 07-29) it's the other category entirely: those tell you the agent wants attention; this hands you the wheel from wherever you are.

Reach for it when your agent runs longer than your attention span at the desk. Delete the SSH-from-phone gymnastics and the notifier app that can only ring. Tradeoffs: the wrapper sits in the loop of every session you route through it; the relay defaults to theirs, and the self-host path is currently being carved out in commits, not documented as a supported product; end-to-end encryption is their design claim, not an audit; and an agent with write access driven from a phone is a team-policy question before it's a convenience.

Hosted and closed; #1 on Product Hunt today at 213 votes. Launch a long-horizon agent in a cloud sandbox — Claude Code, Codex, Hermes or OpenClaw as the harness, models including Gemini, DeepSeek and Kimi K3 — and reach that same session from WhatsApp, iMessage, Telegram, Slack, Discord, the web, an A2A endpoint or a CLI, with unified history across all of them. State snapshots with backup and restore, health monitoring, managed recovery. Pricing starts at $3 a month plus usage; parked agents cost nothing; $3 of credit without a card. Claims 10,000-plus agent sessions already run through tycoon.us.

The agent-housing thread has been pricing machines (Superserve and box 07-22, agentOS 07-30); this rents one level up the stack — the unit isn't a sandbox, it's a running session with its history attached, reachable from a chat thread you already have. That's the 07-06 unified-inbox watch arriving inverted: instead of one inbox collecting many agents' questions, every messaging app you own becomes a terminal for one agent. The trust surface is stated but not showable: zero-data-retention support, isolated environments, secrets that stay local when a session is cloned — and the team behind those claims is, as far as the site says, a contact email and a Discord.

Reach for it when a long-horizon agent needs to outlive your laptop lid. Delete the tmux-on-a-VPS ritual and the "is it still running" anxiety. Tradeoffs: closed and hosted, so the repo, the transcript and every credential the agent touches live with a third party whose founders' names are not on the site; the security claims are all theirs and unverifiable from outside; $3 a month plus metered usage is an introductory shape, not an economics; and when the control channel is iMessage, the session's attack surface includes your phone number's.

A macOS app, $19.99 once, no subscription, no account. It reads the conversation stores your tools already write — Cursor, Claude Code, Zed, Codex, Kiro, Antigravity — and builds one private, on-device search index across all of them. Launched today at #17 on Product Hunt with 86 votes. Windows is "coming soon." Closed source.

This is the archive argument pointed at your own machine. Months of decisions, fixes and dead ends are sitting in per-tool JSONL and SQLite files with six different schemas and no search box over any of them. The repo-memory thread (Grepathy 07-16, CodeAlmanac 07-22, MemoryCustodian 07-29) curates memory for the agent's benefit; this is the blunt version for yours — find the session where an agent already solved this bug. The privacy pitch is the product and it cuts both ways: those transcripts hold client names, keys pasted in frustration and half your codebase, which is exactly why they shouldn't go to a search SaaS — and exactly why "local-only" from a maker who signs the site as a copyright line deserves one outbound-traffic check before you feed it everything.

Reach for it when you know some session in April already contains the answer. Delete the six separate grep -r runs over dot-directories with undocumented formats. Tradeoffs: closed, anonymous maker, and local-only is their claim — cheap to verify, so verify it; macOS-only today; one-time pricing says nothing about how updates get funded; and the index inherits every store format it reads, so any harness changing its transcript layout silently drops that archive until an update lands.

Nothing to do with the theme; too strong to footer for a third time this month. A Rust library (MIT, from Firecrawl) that classifies a PDF as text-based, scanned, image-based or mixed in 10–50 ms with a confidence score and per-page OCR routing, then does position-aware text extraction and Markdown conversion — headings inferred from font-size ratios, dual-mode table detection, CID font decoding, multi-column reading order, RTL — with no ML models and a single dependency. Bindings for Python, Node and browser WASM. 6,720 stars, and today's biggest mover anywhere in the pool at +1,769.

The routing number is the product: roughly 54% of PDFs don't need OCR at all, and this decides which ones locally in under 200 ms, so the expensive service only sees the half that earns it. The benchmark is the kind we keep asking vendors for: run on the public opendataloader-bench corpus, 200 PDFs, engine versions and method published — 0.875 overall against liteparse's 0.873, and 0.470 seconds for the whole corpus against pymupdf4llm's 17.1. Still the vendor's own run, but on somebody else's corpus with the configuration stated, which makes it the first headline number in eight editions you could re-run yourself before lunch. It crossed our pool on 05-24 and we never covered it; today is the second chance.

Reach for it when your ingestion pipeline sends every PDF to an OCR API by reflex. Delete the OCR line item for the half of your corpus that's already text. Tradeoffs: there is no OCR inside — scanned PDFs still need a service, this only tells you which ones; font-ratio headings and heuristic tables will misfire on hostile layouts; the benchmark stays the vendor's run until someone repeats it; and the company giving away the router sells the destination, so the free half and the paid half of your pipeline share an owner.

The kicker, because the picks above just added operators to your sessions — a teammate, your phone, a cloud, an indexer reading everything after the fact. dcg treats them all identically: a Rust hook (5,544 stars) that intercepts destructive git and shell commands before they execute, across Claude Code, Codex CLI, Gemini CLI, Copilot CLI, VS Code Copilot Chat, Cursor, Hermes, Grok, Posit Assistant and a longer tail via community plugins. One-line easy-mode installer on Linux, macOS and WSL; a native Windows PowerShell path that enforces a mandatory SHA256 checksum and verifies minisign signatures and Sigstore provenance when the tooling is present.

It crossed our pool on 07-12 and we never covered it, and the enforcement-beats-instruction thread runs straight through it (nono's per-tool sandboxes 07-29, valv's role scoping 07-23): the policy lives in a hook, not in a prompt, which is the only place a policy survives once a session has more than one author. The license is the strangest artifact in today's pool and it's load-bearing — MIT with a rider that strips all rights from OpenAI and Anthropic and anyone acting on their behalf. A guard that installs into Claude Code and Codex while refusing its license to the companies that make them. For you it reads as MIT; for OSI purposes it isn't open source, and GitHub's API reports NOASSERTION, so a compliance scanner will flag it.

Reach for it the moment a second person — or a second machine — can prompt your agent. Delete the belief that "never run destructive commands" in a system prompt is enforcement. Tradeoffs: a pattern guard is a seatbelt, not a sandbox — it blocks the accident, not the adversary, and anything outside its patterns walks through; false positives on genuinely intended destruction are the standing tax; and the rider means "MIT" carries an asterisk your lawyer may actually want to read, with the open irony that the vendors it excludes are the ones whose agents it guards.

Also worth knowing. mu (AGPL-3.0, micro.mu, self-hostable, from micro's Asim Aslam, 50 Show HN points) is one MCP endpoint for the real world — news, web search, mail on a real SMTP server with DKIM and an address per agent, markets, places, calendar, files, per-caller storage, a wallet — scoped per connection with ?tools=news,web,mail, the progressive-disclosure move (Ratel 07-17, OpenWork 07-27) applied to a whole utility belt. The contributor list is one human and four agents, and the thread's "who wants all this in one session" objection is answered by exactly that query parameter. OpenPencil (MIT, Rust, 4,565 stars, crossed our pool 06-28 uncovered) is an AI-native vector design tool with concurrent agent teams on one live canvas, Design-as-Code and a built-in MCP server — and its README opens by disambiguating itself from a different open-source OpenPencil, the name-collision disclosure we usually have to write arriving pre-written by the vendor. kimi3 (AGPL-3.0, 12 stars, created yesterday) is a from-scratch PyTorch implementation of the Kimi K3 architecture paper — KDA, NoPE, latent-space MoE — with the paper's Table 1 reproduced to 0.09%; the K3 arc (announced 07-27, shipped 07-28, first-party kernels 07-29) gets its first independent-reproduction beat. NixOS-DGX-Spark (MIT, 162 stars, 118 points) puts Nix and NixOS on NVIDIA's DGX Spark and the Asus Ascent GX10 with USB images and a ready module — the local-AI box acquiring a declarative OS. And two shelf one-liners: yapyap, a local-first voice and meeting recorder on Product Hunt whose name lands two letters from July's Yap spine — the dictation shelf is now naming itself after itself — and claudemon, wild Pokémon that appear while Claude Code works, the waiting-room shelf reaching its natural conclusion.