Today the agent got a computer; the argument is whose metal it runs on.

A TypeScript monorepo (MIT, @cloudflare/computer on npm) that gives an agent a durable workspace: a virtual filesystem living inside a Durable Object, authoritative state in SQLite, and one pluggable execution surface behind workspace.runtime.exec(). Three backends ship today: a container that FUSE-mounts the workspace and syncs back over capnweb RPC (full Linux userland, real binaries); a shell isolate running just-bash in a Dynamic Worker with no second store and no sync round trip; and a JavaScript isolate with Workspace-backed node:fs/promises plus trusted ws:git and ws:artifacts modules. Created June 5, its trajectory changed today with Cloudflare OS — the company's open-source agent platform whose apps are likewise Durable Object Facets with SQLite each. A detail to savor: the shell backend is Vercel's just-bash — the edge wars now share a bash implementation.

The reason it leads the slate: this is the sandbox thread (agentOS 07-30, Hoplite 08-04, hotcell 08-05) arriving at its destination — the sandbox stops being a place you put the agent and becomes the agent's own computer, with a disk that persists between sessions and a choice of cheap (isolate) or complete (container) execution per call. The filesystem-without-a-backend mode is quietly the best idea in the repo: agent state as a mountable, versionable object, execution optional.

Reach for it when you're building agents on Workers and the scratch directory that evaporates with the container has become your problem. Delete the S3-bucket-plus-sync-script glue holding your agent's working files, and the assumption that "the agent's environment" and "a running container" are the same thing. Tradeoffs: the README says PREVIEW ONLY — not production, APIs unstable, and the spec under docs/ is "forward-looking — read it for intent"; the container backend reintroduces exactly the sync round trip the isolate paths exist to avoid; and the agent's computer lives on Cloudflare's metal, billed as Durable Objects — which is the whole custody question, and the next pick's opening.

An open-source daemon (Apache-2.0, Rust, single binary or Docker image) from Deno that runs Cloudflare Workers and Durable Objects on your own machines. Every node embeds V8 and executes Wrangler bundles; every object is its own SQLite database, replicated continuously to an S3-compatible bucket you own; exactly-one-owner is enforced by object-storage compare-and-swap — no control plane, no consensus service, no membership protocol, no account. Idle cells hibernate to nearly nothing, releases are verifiable with gh attestation verify, and --endpoint points at any S3-compatible store — including, with a straight face, Cloudflare's R2. 1,395 stars, created April 2025: sixteen months of quiet work crossing our pool for the first time — the Soup pattern from 08-05 again, a mature tool surfacing on a news peg rather than a launch.

The pairing with the pick above is the story. Same day, same primitive, opposite custody: Cloudflare turns Durable Objects into the agent's computer on their fleet; Deno ships the primitive itself for yours. And the design answer to "what replaces the control plane" is the good kind of boring — the bucket is the source of truth, the nodes are replaceable, and the sharding argument (every object its own database, so contention is designed out rather than managed) is the same one Cloudflare has been making for years, now with a docker run in front of it.

Reach for it when you've built on the Workers/DO model and want it on hardware you control — or when the pick above appeals and the landlord doesn't. Delete the shared Postgres doing lock-contention duty for per-entity state, and the assumption that per-object SQLite requires Cloudflare's edge. Tradeoffs: a fleet runs one application, so this is an app platform, not a multi-tenant cloud; your bucket's durability is your durability, full stop; peer HTTP doesn't terminate TLS — a private network or WireGuard/Tailscale is assumed, and a public advertise address is rejected unless you insist; and self-hosting the abstraction doesn't self-host the anycast network that makes the hosted version fast.

A hosted service (YC S26, Launch HN today at 59 points) that lets coding agents debug production without touching it: Cursor, Claude Code, Codex, or Opencode drops a virtual breakpoint at a suspect file and line in your running service, the probe captures a read-only, non-blocking snapshot of live variable state when real traffic hits it, and the agent confirms the root cause against actual values instead of guessing from logs. No redeploy, no thread pauses, a claimed under-1% overhead at 3,000 RPS. Node.js, TypeScript, Java, Python, and Kotlin; alerts in from PagerDuty, Datadog, or Slack. The free tier is one service on their managed cloud; $99/service/month after that; self-hosting is enterprise-only.

The week's containment tools (hotcell, cMCP) ration what an agent may do; HyperProbe is the inverse construction — grant the agent production access that is read-only by shape, so there is nothing to ration. Eyes, not hands. The same front page carried the argument for caring: Atlassian's Rovo agent exfiltrating data past its controls (240 points, dropped as a writeup) is what agent-in-prod looks like when scope is policy instead of construction.

Reach for it when the incident is live, the agent has the repo but not the runtime, and the printf-redeploy cycle is your current debugger. Delete the ritual of pasting log excerpts into the agent and asking it to imagine the state. Tradeoffs: closed and hosted, so live production variable values transit their cloud unless you're on the enterprise plan; "read-only" and "under 1% overhead" are the vendor's own launch-day claims, unverified by anyone; and the free tier's single service is a demo, not a deployment.

A lossless GPU codec for BF16 tensors, shipped inside OpenLake (Apache-2.0, Rust, 2,307 stars) — a storage engine for offloading KV cache to remote disk and memory. The trick is exponent alignment: BF16 exponent fields repeat heavily in real tensors, and ExANS's asymmetric-numeral-systems coder exploits that on-GPU. Measured on an H100: 1.5154x compression, 622.1 GB/s median decode, 390.7 GB/s encode — decode running at 12.76x the theoretical 50 GB/s payload of a 400 Gb/s link, which is the whole point. The codec stops being the bottleneck, the network is, and the compressed cache crosses it 1.5x faster. Fourteen points on Show HN; the pool slept on it.

The streaming thread spent two weeks moving weights across the storage hierarchy (TurboFieldfare 07-30 through Soup 08-05); ExANS is the same move for the other big tensor — the KV cache, which for a long-running agent session is the working memory that outgrows the card first. And where Soup had to prove bit-exact logits to earn "streaming fails silently," lossless is ExANS's entire contract: there is no quality argument to audit, which in a category full of int8-KV quality debates is a position, not a feature gap.

Reach for it when your serving stack already offloads KV cache and PCIe or NIC bandwidth is the visible wall in your time-to-first-token. Delete the quantize-the-cache-and-argue-about-quality step for the offload tier. Tradeoffs: 1.5x is the physics of the exponent trick, not a capacity miracle — this buys bandwidth, not a bigger cache; it's BF16-specific by construction; the numbers are H100 numbers; and none of it matters until your cache actually leaves the GPU — resident-only workloads gain nothing.

An MCP server (Apache-2.0, Python) exposing labgrid — Pengutronix's veteran hardware-in-the-loop framework for embedded Linux CI — to LLM agents: 47 tools over coordinator gRPC and labgrid's client driver stack, covering power-cycling, serial consoles, GPIO, firmware flashing, USB muxing, and SSH to targets. Standalone and coordinator-agnostic; if your lab already runs a labgrid coordinator, an agent can now reserve a board, cut its power, watch it boot over UART, and flash it. Three stars, created six days ago — the bridge is new, but the framework on the far side has years of production embedded CI behind it.

The kicker, because it ends the week's fence-building where it gets serious. hotcell rations credentials, cMCP notarizes tool calls, mcpscore grades the server across the wire — all built for agents whose worst case is spending money or leaking data. This server's tool list is the physical world: power-off and flash are one schema apart, and the blast radius is a bricked board, not a bad API call. The agent's computer acquiring a serial port is exactly why the fences exist.

Reach for it when "board doesn't boot" currently means a human copy-pasting UART logs into a chat window. Delete the human-in-the-middle between the agent and the console output it's debugging. Tradeoffs: three stars, one author, six days old; it assumes an existing labgrid deployment — this is a bridge, not a lab in a box; and 47 tools of physical authority deserve the strictest policy gate you own before an agent holds them unattended.