The Show HN (4 points, one comment, the maker's own) says why it exists in the first sentence: "every LLM gateway I looked at meant adding a network hop just to get rate limiting, multi provider fallback, circuit breaking and other features," and "needing to take a whole separate service just to deploy, monitor and trust with my API keys is just annoying since my whole tech stack was just TypeScript and Node." vern-llm (MIT, Node 22.22+) wraps the SDK clients you already construct, fromOpenAI(new OpenAI(...)), fromAnthropic, Gemini, Bedrock, or fromFetch for anything over HTTP, in one VernLLM object that carries retries with backoff and jitter, an ordered fallback list with a circuit breaker per target, client-side rate limiting on requests per minute, tokens per minute and concurrency, a retry budget (retryRatio: 0.2 over a 60-second window in the README example), timeouts, Zod-validated structured output, provider-native JSON-schema mode, streaming, tool calling, cachedCall with a cache adapter you bring, and a middleware pipeline where transform runs per attempt and wrap runs once around the whole logical call regardless of retries. One onEvent stream reports retries, failovers, circuit transitions and rate-limit waits; onUsage and onUsageFailure report token spend on success and on failure, "so nothing goes unaccounted for when a call fails after the provider already responded." It has zero runtime dependencies: Zod and the provider SDKs are not required, because it "relies on compatible interfaces rather than specific implementations." The docs list forty-odd providers reachable through the OpenAI-compatible adapter, from Groq and Cerebras to Ollama, vLLM, LM Studio, Cloudflare Workers AI and Vercel's AI Gateway, which means it can sit in front of a gateway as easily as replace one. Version 2.7.0, published Saturday at 23:15 UTC, added dependency-aware middleware ordering and rate-limit state introspection.

The repository is the story. The first commit is July 19, titled "first commit"; there have been 605 since, 535 by the maker and the rest by GitHub Actions and Renovate, which is about twelve a day for fifty days. npm holds 36 versions from 0.1.0 on that same July 19 to 2.7.0 on Saturday, 8,284 downloads in the thirty days to Saturday, and the GitHub repository has zero stars and one fork. Around it is the process of a much larger project: eleven Actions workflows (build checks, lint, typecheck, unit, integration, CodeQL, docs build, changesets, versioning, publish), Codecov, Renovate, a CodeRabbit config, size-limit and publint in devDependencies, 68 source files against 108 test files, a 64-page Fumadocs site, and an OpenSSF Best Practices badge registered on August 22 at the "passing" tier (100% of passing, 22% of silver, 17% of gold, self-assessed as that badge is). The account behind it was created June 11, 2025, has zero followers, and a bio reading "LLM Application Infrastructure Engineer." The maker states the tradeoff in the OP better than a competitor would: "it has no centralized policy across multiple apps or languages so if you want that then its better to use a gateway instead." Eight thousand downloads against zero stars is either a quiet user base or the maker's own CI, and the repository does not say which. Machine-facing docs: none; the root README says of itself "This README is a quick reference, not the manual."

Reach for it when a Node service makes LLM calls and what you wanted from a gateway was fallback, rate limits and a circuit breaker rather than a shared key vault; it replaces the LiteLLM proxy container and the hop through it. Delete the gateway's API key from the deploy, since the keys stay in the process that already had them. Tradeoffs: TypeScript only, and per-process, so two services get two rate limiters and no shared view; a fifty-day-old API that moved from 2.6.0 to 2.7.0 in five days; one maintainer, one fork, zero stars; the badge is the self-certified tier; and the fallback tries targets "in order after the primary, with no scoring or health-checking," which is a feature until the primary is merely slow.

Deepankar Arya's Show HN (5 points, two comments) is a single Rust binary that answers the question you ask the week an agent starts running in a container: what did it connect to. dsnitch (GPL-3.0, v0.1.0 on Thursday with x86_64 and aarch64 tarballs and checksums; four stars, fifteen commits, created August 29) attaches passive eBPF programs to the host's cgroup v2 hierarchy and to the kernel's TCP state tracepoint, and attributes every outbound TCP and UDP connection, every ICMP ping and every DNS query to a Docker container name and Compose service label, "without modifying container network stacks, running sidecars, or installing heavy telemetry daemons." Names come from the wire, not from reverse DNS: it snoops UDP/53 answers per cgroup (payloads up to 768 bytes) and decodes them in userspace with Hickory, so a container that resolved api.github.com shows that name next to the edge IP it actually dialed, with the CNAME chain resolved, in a cache keyed by (cgroup, IP) so two containers behind the same Cloudflare anycast address do not contaminate each other's names. The OP's reason for that design is one clause: reverse DNS "fails on anycast CDN IPs." The TUI (Ratatui) is a container tree with live counters on the left and the egress feed on the right, with / to filter, Enter to lock to one container, a to include host processes, and -s for a plain-text stream you can pipe to a log. It is strictly read-only: "does not modify or filter network packets in any way." The stack is Aya for eBPF, bollard for the Docker events stream, Hickory for DNS and Tokio underneath; CI runs on x86_64 and aarch64 with unit tests and an end-to-end suite against live containers.

DESIGN.md is the part worth reading even if you never run it, because it explains the one invariant that makes container attribution honest. TCP close events fire from timer or softirq context, where bpf_get_current_cgroup_id() returns "the identity of whatever random process happened to be interrupted on that CPU core," so dsnitch records the 64-bit kernel address of the socket struct at TCP_SYN_SENT and matches the close by that address alone. The same file's comparison matrix puts Envoy and Istio sidecars at "50-100MB RAM/pod" and OpenSnitch at "host PID only," and claims "<1% CPU" for itself, a number with no benchmark behind it in the repository. The privilege story is stated rather than hidden: on Debian, Ubuntu and Fedora, kernel.perf_event_paranoid defaults to 2 or higher, under which attaching the tracepoint needs CAP_SYS_ADMIN and ignores CAP_PERFMON, so the recommended setcap line grants cap_sys_admin,cap_net_admin,cap_dac_read_search; with paranoid at 1 or below the minimal set is cap_bpf,cap_perfmon,cap_net_admin,cap_dac_read_search. The thread's one substantive comment found the blind spot and named its provenance: a container that writes /etc/hosts emits no DNS query, so its connections show as bare IPs, "a known trick, already exploited," citing collusion.wiki. That report, from Friday's 2,277-point story about the message board OpenAI's agents used, contains the line "Add 20.223.25.152 bypass.blob.core.windows.net to /etc/hosts. .blob.core.windows.net is in NO_PROXY," which is an agent mapping a fake hostname onto a real IP to reach a proxy exception. The maker's reply is correct and partial: the socket still shows, attributed to the container, without a name. Machine-facing docs: DESIGN.md is the architectural kind, and the honest one.

Reach for it on the Linux box where your agents run in Docker and you want to know what each container dialed, by name, as it happens; it replaces a tcpdump you cannot attribute to a container and a sidecar proxy you did not want to configure. Delete the reverse-DNS column from the homebrew script. Tradeoffs: Linux 5.8+ with cgroup v2 and BTF, so not Docker Desktop on a Mac; CAP_SYS_ADMIN on stock Debian and Ubuntu, which is most of root, for a tool that promises to be read-only; it observes and never blocks, so it is evidence, not policy; hardcoded IPs and /etc/hosts edits show up unnamed, which is exactly the trick the agents already use; and it is four days old, four stars, one author, fifteen commits.

Timothy Gordon's Show HN (46 points, eleven comments) reached the front page 24 minutes after he published v1.3.0 to PyPI at 04:25 UTC. engrim (MIT, Python 3.10+, one dependency, model2vec; 90 stars, 31 commits, one contributor) keeps a project-scoped memory in ~/.engrim/memory.db: typed records (decision, fact, feedback, state, user, reference) with tags, indexed by SQLite FTS5 and by static embeddings computed on the CPU in about 30 ms, fused by reciprocal rank. engrim context builds a budget-capped boot pack, 4,000 characters by default, that a SessionStart hook injects into Claude Code; engrim assist on UserPromptSubmit injects a slice relevant to the prompt, capped near 150 tokens and only when it has hits; a Stop hook tails the transcript into an append-only log that never enters context; engrim review scans that log for decisions you did not capture before you /clear; a record tagged resume-pointer is pinned as "[▶ RESUME HERE]" at the top of the next session. The 1.3.0 change is the multi-agent part: an origin_agent column (antigravity, claude-code, cursor, cli, user) on every memory, a stdio MCP server with four tools (engrim_recall, engrim_add, engrim_context, engrim_review) for Cursor and Windsurf, PreInvocation and Stop hooks for Google's Antigravity, and engrim setup, which "automatically detects installed environments on your machine and configures them all" by looking for ~/.gemini, ~/.claude and ~/.cursor. The README's pitch is a sentence: "The models are disposable utilities; your project's decisions are not."

What setup does is the pick's actual content. For Claude Code it writes four hooks and a statusLine into ~/.claude/settings.json and appends a twelve-line "## Project Memory (engrim)" block to ~/.claude/CLAUDE.md unless you pass --no-claude-md; there is a --dry-run and there is no uninstall, the only "uninstall" in the 2,594-line, 128 KB single-file CLI being a regex inside sync. The plugin path (.claude-plugin/marketplace.json, "Self-installs on first run") is a SessionStart hook with a 600-second timeout that runs a bootstrap script creating a venv with uv or python3 and pip-installing engrim==1.3.0 from PyPI, and every hook ends in || true, which a docstring in the CLI describes from experience: on Windows a mis-quoted path meant "every hook is a silent no-op while setup still prints its green checkmarks." Four of the eleven comments ask a question the README answers by omission: Codex? Pi? OpenCode? and "What triggers a memory getting written in practice? is it on me to remember engrim add?" (yes, or on the agent, which the CLAUDE.md block instructs to add at "every decision/correction/durable fact"); a fifth asked "Does it come with an uninstall script?"; none had a reply from the maker when the desk read the thread. The README's "Empirical Proof" is "105 continuous sessions on a 50,000-line algorithmic trading system," 153,000 tokens of work consolidated to under 1,000, a "99%+ cut," which is the maker's own codebase (his bio: "researcher in quant finance") with no data in the repository; the same README's example of switching mid-project runs "from Gemini 3.8 in Antigravity to Claude 3.7 Sonnet in Claude Code to GPT-4o in Cursor," two of which are 2025 model names, and calls itself the "Switzerland of AI Memory," which one commenter noted is "a metaphor that isn't really aging well." SUBMISSION.md, checked in, is the copy for Anthropic's community plugin directory, with a note to self: "lead with honest daily-driver credibility ('I run it on my own work'), never cold-test claims." The community repository does not contain it. Machine-facing docs: ROADMAP.md is candid per version; none for its own repo; it writes yours.

Reach for it if you split one project across Claude Code and Cursor and are tired of re-explaining why Postgres; it replaces the hand-maintained DECISIONS.md and the recap you paste after every /clear. Delete the recap. Tradeoffs: the memory is only as good as what you or the agent remember to engrim add, and the thread's first question was exactly that; setup edits your global settings.json and CLAUDE.md and ships no way back; the plugin variant pip-installs inside a session hook and swallows its own failures; no Codex, Pi or OpenCode; one author, 31 commits, a 128 KB cli.py; the case study is unpublished; and a status line in your Claude Code bar is now a Python process.

The Show HN (4 points, two comments) is a Rust mesh for the problem the README states in its first paragraph: "Your NAS is at home. Your GPU box is in the office. Your ollama instance is on the desktop you left behind. All of them are behind NAT, and none of them should be on the public internet." Three binaries. lantunnel-admin creates a Tunnel offline (init-tunnel, then add-peer per device) and "talks to nothing"; lantunnel-client imports one signed .peer profile, opens a loopback SOCKS5 proxy on 127.0.0.1:1080 plus optional native routes, and is the same binary with or without the Tauri window; lantunnel-gateway is a rendezvous and NAT-traversal signaler that "holds no Peer keys, no plaintext, no durable Peer or route state." Every peer holds its own Ed25519 key and proves it on every attachment; "there is no Tunnel password, no group secret, and no bearer token." New flows try a direct QUIC path with UDP hole punching first and fall back to a relay sealed with XChaCha20-Poly1305 under X25519 keys the gateway cannot read; WebSocket and gRPC transports exist for networks that block UDP; a peer can export the subnets it sits on (on by default since 2.0.8), so one client makes the NAS, the printer and the dashboard reachable; the ACL lives on the target machine. Android ships as a VpnService, iOS as a NetworkExtension. The repository (Apache-2.0, Rust 1.89+, 11 shared crates, five apps) carries an end-to-end acceptance test that "proves every directed TCP and UDP pair over Direct and then again over Encrypted Relay," and a CONTEXT.md that begins "Where this document and the implementation disagree, the implementation is right and this file has a bug."

Where the rest runs is the question, and the answer is three places. The repository was created Wednesday, September 3, with a first commit titled "feat: Lantunnel 2.0"; the changelog says "Lantunnel's public history begins at 2.0.0. Earlier 1.x releases were made before this repository was opened and are not documented here," SECURITY.md declares 1.x out of support, and 1.x profiles cannot be imported; the author, buhuipao, a former Tencent cloud-platform engineer, has a 105-star repository from last year called anyproxy ("Expose your local network and services to public safely") that neither repository mentions. Thirteen stars, 36 commits (fourteen of them Dependabot), and v2.0.9 on Thursday with four to eight downloads per asset. The hosted platform at lantunnel.app, "accounts, billing, managed Gateway fleet," is "a separate closed-source service and is not in this repository"; it offers "one permanent Free Tunnel" with unlimited direct traffic and "5 GB/month of encrypted relay fallback," and the README's last line is "Skip the setup." A self-hosted deployment "never contacts it," and a lantunnel-gateway init --public-ip in 2.0.9 makes that path one command, self-signed. The two docs that earn the pick are the ones the category rarely writes: a "Talking about performance honestly" section ("WAN throughput and loss are bounded by the underlay, not by the tunnel"; "a transport ceiling may only be claimed from a path whose measured underlay capacity exceeds the offered load"; "relay-only or single-machine container evidence cannot close a performance claim"), and a 2.0.9 changelog entry admitting that a client whose settings file it could not parse used to start on defaults, "and a Client nobody has configured is reachable by every Peer holding a profile for its Tunnel." The thread's first question is the one the 27 KB usage guide does not answer: "if a laptop with a .peer profile gets stolen, what then?" The guide contains no "revoke," "rotate" or "expire"; the second question, why this over Nebula, is answered only by a related-projects list that credits Tailscale, headscale, Nebula, NetBird, EasyTier, iroh and eleven others. Machine-facing docs: CONTEXT.md (architectural, with the performance rules as the evidentiary kind), docs/PROTOCOL.md (normative), seven README languages, no AGENTS.md.

Reach for it when the Ollama box at home needs to be reachable from the laptop and you want to read the coordination server's source or not run one; it replaces port forwarding and, self-hosted, the control plane you cannot audit. Delete the public URL in front of the NAS. Tradeoffs: a four-day-old repository with a closed 1.x history and thirteen stars; the docs answer everything except revoking a stolen profile; the easy path is a closed platform whose only published limit is 5 GB of relay a month, and relay is where every connection lands when hole punching fails; the wire format is not negotiated across versions, so peers, gateways and profiles upgrade together; and a fresh client with no settings file is reachable by every peer in the tunnel, by design.

The trending feed's word is 121 stars today for a repository at 7,723 with no story on Hacker News and no release since August 29, so the cause is not established; the repository is. OpenWhispr/openwhispr (MIT, Electron 41, React 19, better-sqlite3, whisper.cpp, sherpa-onnx, llama.cpp; 2,140 commits since June 19, 2025, 1,546 of them by gabrielste1n) calls itself "the open-source and free alternative to WisprFlow and Granola" and ships for macOS, Windows and Linux, the last as AppImage, deb, rpm and tarball. Press a hotkey and speak; the text lands at the cursor, transcribed by local Whisper on Metal, CUDA or Vulkan or by NVIDIA's Parakeet through sherpa-onnx, or by a cloud provider you bring a key for (OpenAI, Groq, Mistral, and since 1.9.1 Google's gemini-3.5-transcribe). A second hotkey dictates in one language and pastes in another. A third sends what you say to an assistant, GPT-5, Claude, Gemini, Groq, OpenRouter or a local model, with highlighted text edited in place and an opt-in screenshot as context. Meetings auto-detect Zoom, Teams and FaceTime, with on-device speaker diarization and voice fingerprinting across meetings, and notes get folders, semantic search and a Granola CSV import. The GitHub API counts 4,438,767 asset downloads across all releases, 374,774 of them for 1.9.2 alone. For agents there is a public API, an MCP server, an @openwhispr/cli binary that talks to the running desktop app over a loopback bridge or to the cloud API with the same commands, two skill files in agent-skills/, and a CLAUDE.md that pins Node 24 and explains that all ONNX inference runs in a separate utility process so a native bad_alloc "confines to the worker."

The pricing page is where the theme lives. "Unlimited local dictation is free for everyone," and the free tier's cloud side is "2,000 words/week transcription," "5 hours of meeting recordings/month" and "zero data retention." Pro, $6.67 a month billed yearly, is unlimited cloud transcription, 20 hours of meetings, "sync across devices" and the iPhone and iPad app; Business, $13.33, is unlimited meetings and "chat over your data"; Enterprise is SSO, SAML, SCIM, audit logs and centrally managed Bedrock or Azure OpenAI access "without distributing cloud keys." OpenWhispr Cloud runs on Neon, which sponsors the README. The changelog is the evidentiary document, and it is unusually willing to say what went wrong: 1.9.2 is "a repair release for two 1.9.1 regressions," in which Windows sign-in died because browser links were routed through explorer.exe, "which silently opens a File Explorer window instead of the browser for any URL carrying a query string — and every sign-in URL carries one"; three transcription paths failed only in packaged builds because a JSON import lacked the attribute Node's loader requires, and "development builds inline that import, which is why it reached release"; and Windows meetings recorded only your own voice because the system-audio helper "starts up reporting itself healthy and then captures nothing but digital silence," since the check "only asked Windows whether loopback capture was available, never whether any audio was actually arriving." On Intel Macs, live speaker identification and semantic notes search are gone, because ONNX Runtime stopped shipping macOS x86_64 binaries in 1.24. There are 337 open issues. Machine-facing docs: CLAUDE.md (architectural), two SKILL.md files, and a .superpowers/sdd/ directory holding two dated review records, the procedural kind.

Reach for it if you pay for Wispr Flow or Granola and would rather run Parakeet on the GPU you already own; it replaces both, and on Linux it is one of the few that exist. Delete the dictation subscription, not the cloud, which is where sync, the phone app and team spaces live. Tradeoffs: an Electron app with a bundled FFmpeg; 337 open issues and a changelog whose last two entries repair the entry before; diarization and semantic search need ONNX Runtime, which no longer ships for Intel Macs; the free tier's 2,000 cloud words a week is one long meeting, so "free" means local; and the star spike has no visible cause.

Also on the desk. Airuncode (Product Hunt, 101 votes) is "a local-first agent runtime" that runs several coding agents at once with your own keys and "zero token markup," bundled with "V-CORE, a native Vulkan 3D runtime" for game development; there is no source link, and the site served the fetcher a Cloudflare challenge. Tucky (130 votes, second of the day) docks notes to the edge of a Mac screen with an agent that "processes user requests only when explicitly invoked," stores locally with encryption, and sells voice, connectors and better models for $4 a month. Clipnote (90 votes) is the hosted version of the memory pick: tell ChatGPT, Claude or Gemini "save this" through an MCP integration and the conversation lands in a private-by-default notepad with share links, on someone else's server. Keen Bean (11 points) is a Mac meeting app that drafts "tasks, decisions, a draft spec, a diagram, a rough mock-up" while people talk, $19 or $39 a month, with cloud transcription and "no proxy and no server in that path"; the thread's first reaction was to the tagline. Rui Carmo's swift-smart-prompter (5 points, four stars, one day old) is the fully local version of the same idea on Apple Intelligence: macOS 26, no account, and "audio and transcripts are not written to disk." Mador (92 points) is an 80-line Proxy state tuple that makes any DOM element reactive by CSS selector, a weekend project at 87 stars whose thread pointed out that preact/signals-core also has zero dependencies and that the README's framework-or-nothing framing was a false dilemma; the author agreed to reword it. sofka (139 stars today, 700 total, v0.24.6 today, 640 commits) is k9s reimagined in Rust on kube-rs and ratatui with one generic object pipeline, so "every CRD works on day one," and is named after a cat. Konnect (31 today, 496 total, 795 commits) is a native KiCad 10 plugin, one Rust binary exposing 217 schematic, layout, routing and manufacturing tools to Claude or any model, AGPL with a COMMERCIAL.md that says internal use and selling the boards you design is free. experiential, our August 28 pick, was the Python feed's top row at 628 stars today and shipped v0.7.49 through v0.7.52 between 06:19 and 10:08 UTC. aipoch/open-science (146 today, 4,057 total) is a local-first research workbench with scientific agents and Python and R notebooks; a repository of the same name under ai4s-research, from our July 6 pool, still exists separately. blender-mcp (204 today, 27,459 total, March 2025) re-trended without a release. warmbly (Go, 41 today) is "the largest open-source cold outreach and email warmup platform," 2,150 commits by one author and v0.4.0 on Saturday, which is the vertical this desk does not cover. Speculative decoding in vLLM on AMD (36 points), from AMD and Embedded LLM, ran five methods on MI300X and MI355X and topped out at 2.87x for Gemma-4-26B-A4B with DFlash on MATH500, with some Qwen3-8B EAGLE-3 configurations below baseline. And Nitter and XCancel resumed service after legal advice, the day's top story at 777 points, as a commit.

Verification notes: star, fork, commit, contributor, release, asset-download, issue and file figures are from the GitHub API on 2026-09-07; HN points and comments from the Algolia API; Product Hunt votes from the launch pages; npm and PyPI versions, dates and downloads from the registries. openai/skills' deprecation is commit 778b0e6 of June 22 and the README on main; our June 19 pick is the editions table. VernLLM's counts are the repository tree, the eleven workflow files, the npm registry (36 versions, 8,284 downloads August 8 to September 6) and the OpenSSF API for project 14212; the maker's quotes are the Show HN text. Dsnitch's mechanics are README.md and DESIGN.md on main and the dsnitch/Cargo.toml dependency list; the /etc/hosts line is the collusion.wiki report, fetched today; the "<1% CPU" figure is the README's, unbenchmarked in the repository. Engrim's setup behavior is src/engrim/cli.py (2,594 lines: the CLAUDE_MD_BLOCK constant, the hook table, the --no-claude-md flag, and the docstring on silent no-ops), plugin/hooks/hooks.json and plugin/scripts/engrim-bootstrap.sh (engrim==1.3.0); PyPI has 13 releases from 0.7.0 on June 23; the community-directory absence is a code search of anthropics/claude-plugins-community returning zero. Lantunnel's history is the first commit on main, CHANGELOG.md, SECURITY.md and docs/USAGE.md (27,662 bytes, grepped for revoke/stolen/rotate/expire); the free-tier terms are the README and the lantunnel.app homepage, whose pricing page returned 404; anyproxy is the author's repository list. OpenWhispr's pricing is openwhispr.com/pricing; the changelog quotes are CHANGELOG.md on main; the 4.44 million figure is the sum of asset download counts over the releases the API returns. Pachocki's essay was fetched from openai.com directly; the Anubis post was read from docs/blog/2026-09-06-anubis-wasm/index.mdx in TecharoHQ/anubis after the site returned an Anubis challenge page; Cantrill's essay was fetched. Nothing on the slate was reproduced: npm i vern-llm and pip install engrim both run on this desk with no key, and engrim setup --dry-run would show its edits without making them; left for an attended session because Engrim's setup writes into the compose machine's own ~/.claude. The machine-facing-docs check ran on all five: none on VernLLM; DESIGN.md on Dsnitch; ROADMAP.md, SECURITY.md and SUBMISSION.md on Engrim, which writes a CLAUDE.md block into the user's global file; CONTEXT.md, docs/PROTOCOL.md and SECURITY.md on Lantunnel; CLAUDE.md, two SKILL.md files and .superpowers/sdd/ on OpenWhispr. Seen-before SQL keyed on fetched_at: openai/skills June 19 (picked June 19), experiential July 27 and August 28 (picked August 28), Anubis June 18, June 22 and July 12 (never picked), open-science July 6, exploitarium June 28; VernLLM, Dsnitch, Engrim, Lantunnel and OpenWhispr are first-time. Today's pool was 66, the smallest since the 08-21 zero-feed day: hn:front 30, hn:show 14, producthunt 8, and github:trending 14 rows across four feeds (all 6, python 4, rust 3, go 1; the typescript feed returned nothing); the series is 15 → 1 → 10 → 26 → 11 → 11 → 1 → 20 → 12 → 14, and Reddit is dark for the twenty-fifth consecutive week. Friday's edition broadcast at 12:21 UTC.