# AI Hacker Daily — 2026-08-26 The approval click is being re-engineered, not removed.

An Apache-2.0 TypeScript monorepo that Cloudflare open-sourced on August 5 — "a large portion of Cloudflare's workforce" uses it daily — and that is trending again today at 9,240 stars, 1,072 forks and 36 watchers. It is three things: an agent chat UI preloaded with your company's context, sandboxed "gadgets" (every user runs a private instance of each app, in a Dynamic Worker with outbound networking switched off and a sandboxed iframe in front), and Gatekeepers, the part that belongs on this slate. A Gatekeeper is a separate Worker per external service that holds the OAuth credential, exposes a narrow Cap'n Web API, logs every action, and stands between the agent and any side effect. Sixteen ship in the repo — GitHub, Google, Slack, Notion, Linear, Confluence, Supabase, Home Assistant, email, a scheduler, an MCP bridge, Spotify, ZoomInfo and Cloudflare's own API. `pnpm run-local` runs the whole stack on `workerd` at `localhost:8787`; a deploy flow at `os.cloudflare.app/deploy` puts it in your own Cloudflare account; you pick the model provider, self-hosted included. Our August 6 note carried the announcement as the why-now for "give your agent a computer"; this is the first time the repository itself has been on the slate. The mechanism is the reason. The README states the failure it is built against: synchronous approval means "you give your agent a task, then walk away and get a coffee, only to come back and find the agent got stuck on an approval on the first step." So when an action needs approval, the Gatekeeper "will *simulate* the outcome locally," tells the agent it completed, returns simulated results if the agent reads back, and queues the real thing until you approve or reject "in bulk, or one-by-one," later. Reads need no approval; writes do; and a Gatekeeper can flag a read as so sensitive that the agent is prohibited from writing anywhere afterward — Kenton Varda, 381 of the commits, said in the launch thread that this taint rule is what let Cloudflare connect the OS to its own customer and revenue data. Our machine-facing-docs check found the invariants the README only gestures at: `REVIEW.md`, addressed to "AI reviewers reading pull requests," orders the priorities — "the kernel bar, capability-security invariants, secret leakage through logs and errors" — names `getGatekeeperClassFor()` as "the single chokepoint" before any capability is minted, and keeps auth config in environment variables "so a compromised admin session cannot change it." Then the contract itself, `packages/workshop-shared/src/gatekeeper.ts` line 731: simulation "is suggested," and "there is no strict requirement that a gatekeeper does such simulation — it is really up to the gatekeeper author." Jamie Lord's "architecture of distrust" essay read the same lines and got the philosophy right — "the agent cannot be trusted, so build so that its mistakes cannot matter" — and the Sandstorm lineage he traces is confirmed by the Sandstorm community's own maintainer turning up in the thread to call the Gatekeeper work "insanely cool." Reach for it if a team, not a developer, needs agents on company systems and the alternative is a shared MCP config with every credential ambiently available in every chat. It replaces that config, and the Slack-bot-with-a-service-account. Tradeoffs: it is a platform, not a library — the deferred gate exists only inside its workspace; "deploy to your own server using `workerd`" is marked COMING SOON, so today it is your Cloudflare account or a local wrangler loop; every Gatekeeper needs OAuth client credentials the README admits "many service providers intentionally do not make easy"; a rejected batch discards everything the agent built on the simulated world, and a Gatekeeper author is free to skip simulation entirely; it is "version 2, a complete rewrite," labeled early access; and the project is "not seeking outside contribution," for a reason worth reading in full — "external code contributions are 'donating' the easy part of the job, while creating more of the hard work."

An MIT TypeScript CLI from Stripe, `npm i -g @stripe/link-cli`, 717 stars, 23 watchers, v0.14.0 released yesterday, and this week's steady climber on the TypeScript trending feed. The agent logs in with a device-flow phrase — `auth login --client-name "Claude Code"` shows up in the Link app as "Claude Code on my-macbook" — lists your saved payment methods, then creates a *spend request*: merchant, line items, amount, and a `context` string of at least 100 characters explaining why. `--request-approval` sends a push notification; you approve on the phone; the agent polls; what comes back is a virtual card that works on any checkout form, or a one-time Shared Payment Token for merchants speaking the Machine Payments Protocol over HTTP 402. Your real card never leaves the wallet. It runs as a local MCP server (`--mcp`), an HTTP endpoint that binds `127.0.0.1` and prints a warning if you widen it, or a skill (`npx skills add stripe/link-cli`). `--test` returns a test card and charges nothing. The limits are the product, and they are the most concrete numbers on today's slate: $500 per request, ten minutes to approve, credentials valid twelve hours, $500 a day, $20,000 per thirty days, ten approved requests live at once. The design keeps the credential out of the agent's memory as far as it can — `--output-file` writes the card to a `0600` file while stdout shows brand, last four and expiry, "to avoid leaking card credentials into agent transcripts or logs" — but the default flow still puts a card number in the agent's context, and it is the agent that types it into the form. Two things in the machine-facing files change the picture. The skill contract is stricter than the README: "DO NOT PROCEED until the user is authenticated with Link," approval URLs "must be presented to the user clearly," and the `CLAUDE.md` warns its own maintainers that README, skill, schema and itself "can easily drift apart." And `--approval-detail` exists for "delegated/pre-approved flows": an app can assert `approval_method: click`, `programmatic` or `voice`, with an optional `authentication_method` of biometric or passkey — the click, as a field in a JSON object. Yesterday's release notes add "an undocumented `--expires-at` option ... for allow-listed OAuth clients" that stretches a request to seven days. Stripe posted this to HN on April 29; it got six points and no comments. Reach for it if an agent buys anything on your behalf and its current instrument is a real card in a password manager, or a privacy.com card per bot with no per-purchase gate. Delete that card. Tradeoffs: US Link accounts only; a Link account and the phone app are mandatory, so the phone is now on the critical path of every purchase; the caps are Stripe's, not yours — there is no per-agent budget knob below them; the second bundled skill, `financial-insights`, reads your transactions and balances, a wider grant than "buy this"; the `report` command asks the agent to send purchase outcomes back "to help Stripe improve checkout"; and the delegated-approval path means the gate's strength is whatever the app claiming the click is worth.

A Go, MIT command — `brew tap runetes/maiao https://github.com/runetes/maiao.git && brew install maiao`, or a binary for Linux, macOS or Windows — that gives you `git review`: every commit on your branch becomes its own pull request, stacked on the one below it, tracked by a Gerrit Change-Id from the standard commit-msg hook, with `git commit --fixup` for review feedback and automatic rebase of the stack when a PR merges. It is a community fork of `adevinta/maiao` (2021, 159 stars, last upstream push in July) by the original maintainers, who explained in the thread that Adevinta was bought by a private-equity consortium and none of them work there anymore. v1.4.0, released yesterday, is why it is on the front page: GitLab, Gitea, Forgejo and Codeberg, Bitbucket Cloud, and — in beta — Cursor Origin, the git host Cursor launched on August 17 with Graphite's co-founder on the team. GitHub's native stacks, shipped to public preview on July 30 and footered here as "a platform feature you wait for rather than install," are treated as progressive enhancement: the tool probes the Stacks API once a day and registers the chain if it can, and the maintainer's line is that "maiao supported stacked PRs on GH before it existed as a feature." This is the review gate resized. The thread's 55 comments were the whole argument about whether that is a good idea, and it is worth reading because agents are about to decide it for everyone: "Who is creating a separate PR for each commit ... sounds like crazy town" got Steve Klabnik's "This is standard practice in the 'stacked diffs' world: one review, one commit"; `verall` put the crossover at "10–20 people actively committing," above which the Gerrit workflow wins; `bjackman` gave the reason the granularity matters — a reviewer can say "please squash this" and diff the commit before and after, so "the commits are part of the thing you are reviewing instead of just a minor detail." On July 30 our pick was a queue for 90 agent commits a day and the thread asked who reviews them; the honest answer then was "the check command." One reviewable commit per PR is the other answer, and Maiao is the version that installs. Reach for it if your branch is four logical changes and the reviewer sees one diff, or if your agents produce commits faster than anyone can read a branch. It replaces Graphite's CLI for teams that cannot pick their forge, and the rebase ritual you do by hand. Tradeoffs: 120 stars, one watcher, zero forks, and a maintainer team that just lost its employer; the workflow demands rebase-and-force-push discipline that half the thread refuses on principle; a `repo`-scoped token in an environment variable or `.netrc`; Bitbucket gets no draft state; Cursor Origin support is a beta provider for a beta host; the Gerrit *UI* is not replicated, which one commenter came for and left without; and the license file is an "AS IS" disclaimer from Adevinta, 2021.

An MIT skill — two Node lifecycle hooks and a ruleset — that makes a coding agent stop at the first rung that holds before it writes anything: does this need to exist, is it already in the codebase, does the stdlib do it, does the platform, does an installed dependency, can it be one line, and only then the minimum that works. It has 111,832 stars, 6,140 forks and 280 watchers, adds about a thousand stars a day, ships plugin manifests for twenty harnesses (`/plugin marketplace add DietrichGebert/ponytail` then `/plugin install ponytail@ponytail` in Claude Code; `codex plugin add ponytail@ponytail`; Cursor, Windsurf, Kiro, OpenCode, OpenClaw, Devin, Grok Build and the rest), and has never once crossed our pool — the largest first appearance on record. The rule is not fewest tokens; `AGENTS.md`, which *is* the product, says trust-boundary validation, data-loss handling, security and accessibility "are never on the chopping block," and ends: "Yes, this file also applies to agents working on the ponytail repo itself. Especially to them." It is on this slate for the gate, and it stays for what happened to its number. The README claims −54% code, −22% tokens, −20% cost, −27% time. That is the second claim. The first was "80–94% less code," and it lasted four days: Colin Eberhardt filed issue #126 on June 16 — "baseline scores are ~7 times better" — showing the bare-model baseline was padding its answers with prose and options. The author's reply is the sentence of the thread: "thanks for actually running the benchmark, most people just guess." Two days later the benchmark was rebuilt as real headless Claude Code sessions editing a pinned FastAPI + React repo, scored on the `git diff` left behind, with a limitations section titled "so this can't be the next thing someone debunks" — one model (Haiku 4.5), n=4, "safety is a floor." Then the third party arrived. JetBrains ran 80 paired SkillsBench tasks on Sonnet 5 for $246.09 and measured −15% code, −10.3% cost, −11% time, no detectable quality change — "roughly a quarter to a half of what is advertised," and still "the first tool in this series with a statistically solid cost-saving signal," after caveman (advertised −65%, measured −8.5%) and rtk (advertised −60–90%, measured +7.6%). Their read of where the cut lives matches the author's: it "only shows up where there was room to over-build." A commenter on #126 is still not satisfied — the "YAGNI + one-liners" control is a seven-word paraphrase, not a fair compact rival — and that is the right open question. Reach for it if your review queue is full of date-picker wrappers and the diff is three times the ticket. Delete the "keep it simple" paragraph in your `CLAUDE.md` and use a ruleset that someone has measured. Tradeoffs: the honest number is JetBrains' −15%, on one benchmark and one model, and the README itself says a terse reasoning model "can go the other way (on GPT-5.5 it does)"; the safety claim rests on six tasks; the last commit was August 7, nineteen days ago, under a "Something's coming — join the waitlist" banner, which is what 111,000 stars look like the month before a product; and the rung it climbs to is marked only by a `ponytail:` comment naming the ceiling, so the shortcuts it takes are yours to grep for.

**Also on the board.** Today's top Show HN was off-theme, not off-quality: *LatticeDB* (162 points, MIT, Zig, 402★) is "like SQLite but for graph databases" — one file, Cypher, HNSW vectors and BM25 text in one query, `pip install latticedb`, 0.83 ms vector search at a million vectors on an M1 by its own reproducible benchmark. Its comparison page states the fact the category has been avoiding: Kùzu, the reference embedded graph engine, was archived after Apple acquired its creators in October 2025 and "has received no commits since." The author shipped hot backup overnight because one commenter asked, tagged v0.12.0 at 00:05 UTC, and this morning's commits lock the file so two processes cannot share it — a single-writer database learning its first lesson in public. The Claude-in-the-contributors question got a straight answer: "I used claude extensively (as well as codex)." • *cursor-byok* (2,533★, MIT, Rust, v0.1.2 this morning) is "a local implementation of Cursor's backend": your keys, your providers, tool calling and MCP preserved, "not affiliated with or endorsed by Cursor." Sunday's harness-as-component thread has its most literal instance — the harness *backend* swapped — and its most obvious terms-of-service question, which the README does not raise. • *TeXbrain* (103 points, MIT, 142★) compiles LaTeX to PDF in the browser with a WebAssembly pdfTeX, loads CTAN packages on demand, and runs git through isomorphic-git on your real folder. "No servers" carries an asterisk the README supplies itself — pushes go through a CORS proxy — and folder mode is Chromium only. • *CarWatch* (143 points, AGPL-3.0) runs Qwen3.6-35B-A3B at 3.5 tokens a second on a Raspberry Pi 5 in a Mercedes, which is real and measured; the README also says "Unverified against the real car" about its own OBD layer, and the thread's best line was "I scanned this README looking for the part written by a human and gave up." • *pktscope* is Wireshark's three panes in a terminal on eBPF, installed through `yeet`, a JS runtime for eBPF from a company of the same name; the license habit fired — no LICENSE file, "Dual BSD/GPL declared in the BPF program." • *Actually Queryable Executables* (203 points) is the follow-up to July's SELF: a web server that is a SQLite file and stores its visitor log in the file it runs from. An idea, not an install, and still the best one on the page. • Product Hunt was quiet: *Warren* ("infrastructure for coding-agent workloads," first crossed June 11) and *LoupeKit* (a page inspector that "scores how much of the page reads as raw AI output") were the two rows worth a click. • Dropped per rubric: Apple's M6 and M5 Ultra (1,155 points) and the Mac Studio and Mac mini that carry them (770 and 502) — hardware news, though the M5 Ultra is the local-inference desk of the year; Nitter and XCancel's cease-and-desist (977); SemiAnalysis on OpenAI's Jalapeño chip (498); Z.ai confirming Ox Alpha is a GLM release (53) — a model launch. *Verification note: stars, watchers, forks, licenses, creation dates, release tags and commit logs come from the GitHub API on 2026-08-26. The Gatekeeper simulation contract was read from `packages/workshop-shared/src/gatekeeper.ts` (lines 731–737 and 1156) rather than from the blog or the essay quoting it; the taint rule and read/write split are Kenton Varda's own comments in the August 5 thread. Link CLI's limits table, `--output-file` semantics and `--approval-detail` fields are from the README at v0.14.0, the "DO NOT PROCEED" rule from `skills/create-payment-credential/SKILL.md`, and the seven-day `--expires-at` from the v0.14.0 release notes. Maiao's provider list is the v1.4.0 changelog; the Cursor Origin launch date and Graphite lineage are Cursor's August 17 changelog and the Origin developer's own thread comment. ponytail's numbers were not reproduced on this desk; the independent figures are JetBrains' July 29 writeup (80 pairs, Sonnet 5, $246.09), and the retraction history is issue #126 and `benchmarks/results/2026-06-18-agentic.md`. The machine-facing-docs check ran on all four picks: candid on Cloudflare OS (`AGENTS.md` and a `REVIEW.md` addressed to AI reviewers that states the security invariants), procedural-with-a-drift-warning on Link CLI (`CLAUDE.md`) plus a stricter agent contract in the skill, absent on Maiao, and constitutive on ponytail (the `AGENTS.md` is the product). Seen-before SQL: Cloudflare OS first crossed August 6 as the launch post and was footered in that day's note; cursor-byok crossed July 1; GitHub's stacked-PR preview was footered July 31; ponytail, Maiao, LatticeDB, TeXbrain, pktscope and CarWatch are first-time; hister, yesterday's pick, re-trended at +98. Today's pool was 79 — hn:front 30, hn:show 11, producthunt 23, github:trending 15 rows across five feeds with rust at three, and Reddit dark for the twenty-second consecutive week.*