← AI Hacker Daily

Edition

06

picks

# AI Hacker Daily — 2026-09-08 Agent memory is turning into a document someone else reads.

AI Hacker Daily — 2026-09-08

Agent memory is turning into a document someone else reads. Yesterday's five kept it on your own disk, and Engrim was the purest case: one SQLite file in your home directory, shared by four harnesses, read by nobody else. Today's five each move what an agent knows one reader further out, and the order is how many people can read it. doc-scraper crawls a documentation site into Markdown, llms.txt and a SQLite full-text index on your machine, serves it over MCP with no network, and "collects nothing"; the readers are you and your agent. vLLM's agentic-api takes the conversation state out of your client and puts it in a gateway's database, SQLite by default and Postgres "when the session is shared," so Codex and Claude Code run against your own GPUs and any client holding a response id can continue the thread. funes, from Hugging Face, indexes your Claude Code, Codex, pi and Hermes sessions into a Lance dataset and publishes it to the Hub as a private dataset your org can recall from, behind a fail-closed secrets gate. Tencent's teamai-cli puts your team's skills, rules, hooks and MCP servers in a git repository behind a merge request, and your sessions' friction scores, turn counts and token totals on an orphan branch behind nothing, feeding a dashboard that shows "team members' AI coding session status in real time." Switch, from SandboxAQ, moves the agent into the Slack channel, where the memory is the scrollback and the readers are whoever is in the room, under a license whose first paragraph is a Commons Clause. At the far end, off the slate, is Pod (10 points), "a neutral shared corpus of firsthand observations written and read by agents," whose maker built it after Friday's 2,289-point report of OpenAI's agents using a wiki as a message board: "Pod is built solely for that purpose," and its own page says "the gate is still early." The check at each rung is the gate between the memory and its readers: none needed, a bearer token and an MCP allowlist, TruffleHog with exit code 2, a merge request for the knowledge and a teamai pull for the stats, "who can talk to which agent," and a moderation system the maker says he still has to build.

The counterweight is that the front page spent the day on what agents do when nobody reads the memory. Bottleneck Labs gave seven frontier models $300 each, a bank account, a Stripe account, full control of a computer and 72 hours with the prompt "Make as much money as you can, starting now" (100 points): $0 in revenue, 2,797 spam emails, $12,431 in unsolicited Stripe invoices from Qwen after its email limits tripped, one agent that bought 6,000 bot visits, one that slept for fifty hours, and about $3,200 lost, $2,833 of it in API costs; the thread's sharpest comment was that the person who set it up is the one who sent the invoices. Dan Luu's "How well do agents use test/verification techniques?" (106 points) ran 26 prompt conditions at roughly 80 runs each on Codex with GPT-5.6 Sol, asking for a Zstd implementation under TDD, fuzzing, property-based testing, mutation testing, Verus, Alloy, Lean 4 and several published skills, scored against hidden tests: no instructions at all beat most of them, TDD did worse than predicted, fuzzing with structured inputs found real bugs in 5 of 160 cases, and "agents tend to either just write the tests they would normally write, but inside a framework for a different type of test technique, or they'll use a technique superficially." A ten-way model-and-harness test (94 points) built the same Three.js hangar with Codex, OMP, OpenCode and DeepSeek Harness across GLM 5.3 Flash, Luna, Sol, Astra and Qwen 3.8 27B, from 8m48s to 37m29s, with transcripts pushed when the thread asked; the thread's own findings were that Astra and Sol never opened the browser to look at what they had built, and that the Astra build, which the thread liked best, pinned three.js to r170, from October 2024. jyn's "We have a year to fix security everywhere" (261 points, 250 comments) argues from GLM 5.3-flash's 84.5% on CyberGym and 54.4% on ExploitBench, run locally on a $9,500 Mac with the refusals removed, that "cybersecurity attacks can be run in a for loop"; Simon Willison's comment was "I don't think we even have a year." Above all of it, Mistral raised €3 billion at a €21 billion post-money valuation led by Samsung (565 points), promising "open-weight models, the infrastructure and the compute capacity they run on" and naming no model; and a Tell HN at 125 points reported OpenAI reinstating a five-hour usage window for Plus and Business users, which the thread read as the upsell to the $100 plan. TALA, D2's paid layout engine, went MPL-2.0 (246 points); it is in the footer, because it is the day's best release and has nothing to do with memory.

01

doc-scraper — a docs site crawled into Markdown, `llms.txt` and a SQLite index your agent searches offline

The Show HN (5 points, no comments, posted at 07:33 UTC by devlithic) is a Go crawler that has been shipping for seventeen months and reached the Show HN list with its MCP server already in the registry. doc-scraper (Apache-2.0, Go 1.26; 98 stars, 251 commits, 247 of them by the author Sriram-PR, earliest commit on main May 6, 2025, titled "refactored codebase") reads a config.yaml of sites, each with a start URL, an allowed domain and path prefix, and a CSS selector for the content, and writes each page as GitHub-flavored Markdown in the site's own directory hierarchy with internal links rewritten to relative paths, plus, when JSONL output is on, pages.jsonl, an llms.txt manifest and an llms-full.txt concatenation in the llmstxt.org shape, regenerated on every crawl. It respects robots.txt, walks sitemaps, rate-limits per host with jitter, retries with backoff, persists crawl state in BadgerDB so crawl --resume picks up where a killed run stopped, and crawl -incremental re-fetches every known page and re-checks it for changes. v2.9.0, on Friday, added the two commands that make it usable without reading the config reference: add, which probes a site "with a handful of polite requests (the page, robots.txt, llms.txt, the sitemap)," detects the framework across "30+ frameworks" by generator tag, DOM and asset signatures (Docusaurus, MkDocs, Sphinx, GitBook and ReadTheDocs among them), proposes a scope clustered from the sitemap with page counts, previews the extracted Markdown "with code-block fidelity numbers," and appends the entry only when you confirm, preserving the rest of the file "byte-for-byte, comments included"; and search, a ranked BM25 query over the corpus with section anchors. mcp-server (stdio only; SSE was removed in 2.x) exposes eleven tools, of which search_docs (SQLite FTS5, stemming, snippets), read_page, list_pages, get_freshness and diff_crawl run "without network access," and crawl_site, get_job_status and cancel_crawl run the crawler as background jobs; a run command takes a JSON task spec on stdin "for orchestration agents that would rather build a JSON payload than assemble shell flags," and rejects unknown fields. Watch mode re-crawls on an interval and persists its schedule. Binaries ship for macOS, Linux and Windows.

The weekend's changelog is what earns the bottom rung of the ladder. v2.8.2 (Friday morning) added tool annotations and "a privacy policy with a README section," and the policy is one sentence: "doc-scraper collects nothing: no telemetry, no analytics, no accounts. All output and state stays on your machine, and the only network requests it makes are the crawls and fetches you explicitly ask for," with a PRIVACY.md behind it; the same release automated publishing to the MCP registry via OIDC and attached a .mcpb bundle to the GitHub release, which has 58 downloads against one or two per platform tarball. v2.9.1 (Friday afternoon) added fuzz targets "for the untrusted-input parsers," hardened the config writer "to refuse degenerate YAML layouts found by fuzzing instead of silently losing site entries," and bumped x/text for "a reachable infinite-loop DoS in Unicode normalization of untrusted HTML." v2.9.2 (Sunday) made a fresh crawl fail "when every attempted page fetch fails, so a fully unreachable site exits nonzero instead of reporting an empty corpus as success," and marked the read-only tools "explicitly non-destructive and idempotent so clients and directory scanners no longer see spec-default destructive hints on them." Four releases between Friday morning and Sunday morning, every entry a bug the author found in his own tool, and no maker text in the Show HN at all. The comparison the README does not draw is with Context7 and the hosted docs MCPs: those serve someone's crawl of the docs from their server, on their schedule; this serves your crawl from your disk, and get_freshness tells your agent how old it is. Machine-facing docs: PRIVACY.md, and a server.json for the registry; no AGENTS.md.

Reach for it when your agent keeps fetching the same framework docs live, page by page, and you would rather it grep a local corpus that a cron job refreshes; it replaces the hosted docs MCP and the "read this URL" habit. Delete the docs-fetching tool calls from the session and the tokens they cost. Tradeoffs: a YAML entry and a CSS selector per site, now drafted for you but still yours to maintain; the corpus is exactly as fresh as the last crawl, which is why the freshness tool exists; stdio only, so it runs where the files are; one author, three contributors, 98 stars, and a Show HN nobody has commented on; and a documentation site that blocks crawlers will simply not be in it, which v2.9.2 at least now reports as a failure.

github.com/Sriram-PR/doc-scraper

02

agentic-api — vLLM's gateway moves the conversation out of your client and into a database the server owns

The vllm-project repository (Apache-2.0, Rust 1.85+; 225 stars, 148 commits, 14 contributors, first commit March 23, v0.5.0 on August 25; 25 stars credited to today by the Rust feed) states the problem in its second paragraph: "real agentic applications need more than raw tokens: they need conversation state, tool-call loops, and multi-turn orchestration. Today, all of that complexity lives in your client code. Agentic API moves it server-side." It is a Rust gateway that sits in front of vLLM, or NVIDIA Dynamo, or any OpenAI-compatible upstream, and serves the OpenAI Responses API with state: POST /v1/responses returns an id, you pass it back as previous_response_id, and "the server rehydrates everything for you," over plain HTTP, server-sent events, or a WebSocket, with POST /v1/conversations for explicit threads and background execution for requests that keep running after the client hangs up. Tools have an owner: a "gateway / client / provider" model "decides exactly what runs where," and the one gateway-owned tool shipping today is web search through You.com, for which you supply a key; remote MCP servers can be declared per request against an operator allowlist, or configured server-side by label with allowed_tools and require_approval, and "if a label exists in config.toml, a request cannot override it with server_url." State lands in ~/.agentic-api/agentic_api.db, SQLite, or in PostgreSQL via DATABASE_URL, which the README says to use "explicitly when the session is shared." The generated config file "records the name of the web-search API-key environment variable, never its value." It is "validated against the Open Responses compatibility suite, with replay-cassette tests for real OpenAI and vLLM traffic," and AGENTS.md, ARCHITECTURE.md, CLAUDE.md, ROADMAP.md, TERMINOLOGY.md and an ADR directory sit at the root.

The reason it is on a builder's desk rather than an infra team's is the two harness sections. agentic run codex --model Qwen/Qwen3-30B-A3B-FP8 launches Codex with an isolated configuration pointed at the gateway, and the manual route is five lines in ~/.codex/config.toml (wire_api = "responses", requires_openai_auth = false, supports_websockets = true), after which "the full Codex experience" runs "against open models," "no OpenAI account required." agentic run claude does the same for Claude Code through /v1/messages and ANTHROPIC_BASE_URL, and the harness guide is candid about what that costs: Claude Code's effort is pinned to medium because Qwen's chat template rejects the high it sends by default, and the generated environment "sets a 32,768-token context, 2,048 output tokens, and disables extended thinking," which are "conservative defaults" that "fit the tested Qwen deployment." Whether Claude Code's WebSearch runs on the gateway is a deployment setting, MESSAGES_GATEWAY_TOOL_ALIASES=WebSearch=web_search, and the troubleshooting row for it ends in the sentence this desk would have written: "A model's prose claim is not a tool-call verification." Two things the README says twice, differently: the API table lists a stateful "Messages API" as planned while the Claude Code section serves /v1/messages today, and the reconciliation is in the roadmap, where the planned item is a Messages API "built on the same persistence and execution primitives," so what exists is the wire protocol and what is coming is the state. And the Python wheel that would make this uv pip install agentic-api is "a build-only release," downloadable from the release workflow, "not published on PyPI yet"; today it is cargo build. Sixty-three of the 148 commits are Francisco Arceo's and twenty-eight are maralbahari's; there are 67 open issues and 62 forks; OIDC through Dex, with a GitHub-login walkthrough, is in docs/deploying.

Reach for it when you serve an open model with vLLM and want Codex, or an app written against the Responses API, to run against it without replaying the transcript on every turn; it replaces the conversation-state code in your client and the hosted Responses endpoint you were paying for the state. Delete the message-array bookkeeping. Tradeoffs: the state now lives in a database you run, and a shared session means a Postgres you also run; web search means a You.com key; Claude Code arrives with a 32k context and no thinking unless you override the pins; the stateful Messages API is planned, not shipped, and the roadmap's last unchecked box is "production hardening"; and there is no PyPI package, so the install is a Rust toolchain until the publication gate opens.

github.com/vllm-project/agentic-api

03

funes — your agent sessions as a dataset on the Hub, private by default, behind a secrets gate that exits 2

Hugging Face's David Corvoysier published the writeup on Thursday ("Give Your Coding Agents a Memory You Own"; 11 points on HN Friday) and the repository is on the Rust trending feed today with 48 stars credited to the day. funes (Apache-2.0, Rust; 299 stars, 551 commits, 525 by the author, first commit June 18, v1.3.0 on September 1) installs from a Hub bucket, curl -fsSL https://huggingface.co/buckets/huggingface/funes/resolve/install.sh | sh, verifying the tagged release's checksum, and then funes add claude (or codex, pi, hermes) does the rest: registers recall and get as tools, builds a first index from that agent's session transcripts, and installs a per-turn hook that runs funes index after every completed turn, time-boxed at about sixty seconds, so "a session killed mid-flight is already indexed up to its last completed turn." For Claude Code it ships as a hooks-only plugin, and the automation doc's bold line is "funes never edits your settings.json"; for Codex it writes ~/.codex/hooks.json and a skill under ~/.codex/skills/funes/, and warns that Codex runs no hook until you review it with /hooks; funes remove <agent> reverses all of it and is idempotent. Indexing parses each harness's trace format into one turn/block shape, chunks it, embeds it with a pinned local model, and appends to a Lance dataset; recall fuses BM25 and vector search, reranks with a cross-encoder, and reweights by recency. The maker's own numbers, from the writeup: 308,000 chunks across 19,195 sessions indexed in about two hours on an M4 Pro, 6.3 seconds per query, and, with recency disabled, 19 of 100 queries returning the right session first and 71 of 100 finding it within fifty. He also reports recall costing eight times less than a written handoff on one benchmark task and four times less on another, and the benchmark directory is in the repository.

The Hub is the rung. Bind a memory, funes add claude acme/funes-memory, and session-boundary hooks funes push new chunks to a dataset repository under your account or org, "private by default," readable by "whoever you say," and any teammate, any other machine, or any agent runs funes recall "..." --memory acme/funes-memory against it; the public huggingface/funes-memory, created August 14 and downloaded 375 times, is the project's own history, and the README invites you to ask it "why is funes append-only" before indexing anything of your own. The gate between the memory and its readers is documented to the exit code. Index-time redaction runs TruffleHog when it is installed and is "best-effort," because "the local memory has not crossed a publication boundary"; push is "the hard boundary," an "always-on, fail-closed gate" that requires TruffleHog, reconstructs complete blocks before scanning "so a secret split across chunks cannot evade detection," holds back every chunk of any block that contains one, publishes the clean rows with a warning, and exits 2 only when nothing is left to publish; funes scrub replaces what it can with [REDACTED:<detector>] markers, drops blocks it cannot redact safely, and never modifies the source transcripts. The release notes tell the shape of the project: 1.1.0 retired OpenCode and renamed --store to --memory; 1.2.0 made the installer verify checksums and made scanner contract violations fail closed; 1.3.0 added funes remove, session listing and scanning, and a line reading "Remove curation," which is 1.0.0's headline feature, "curated shared projects," gone six weeks later. Binaries exist for Linux x86_64, Linux aarch64 and macOS Apple Silicon, and for nothing else. Yesterday's Engrim is the comparison the desk can make directly: it wrote into your global CLAUDE.md and shipped no uninstall; this edits nothing of yours, removes itself, and asks you instead to decide whether your session history belongs on the Hub. Machine-facing docs: AGENTS.md and SECURITY.md, plus a docs/ tree per command.

Reach for it when the same project runs through Claude Code and Codex on two machines and "why did we pick that embedding model" keeps costing a re-derivation; it replaces the handoff note and, if you bind a memory, the teammate who remembered. Delete the recap. Tradeoffs: 6.3 seconds per recall by the maker's own clock, and one query in five lands the right session first; a memory published to an org is readable by the org, and the gate catches secrets, not the customer's name in a stack trace; no Windows binary, no OpenCode; one author with 525 of 551 commits; and per-turn hooks mean a Rust process runs after every turn of every session, which is the price of never remembering to run funes index.

writeup

github.com/huggingface/funes

04

teamai-cli — Tencent's skills-and-rules distribution for ten harnesses, where the knowledge goes through a merge request and your session stats go through `teamai pull`

The trending feed's word is 1,215 stars today for a repository at 2,112, and for once the cause is visible: v0.23.0 shipped at 11:01 UTC this morning after at least five betas since Monday 02:54, and its release note is a single compare link against v0.17.4. teamai-cli (MIT under Tencent's standard header; TypeScript, npm install -g teamai-cli; 645 commits, 29 contributors, 492 commits by one account; a history that begins March 3 with "Initial release: tad v0.1.0"; 1,315 npm downloads last week) answers yesterday's Ask HN with the corporate version of the dotfiles answer. A team keeps skills/, rules/, docs/, agents/, hooks/hooks.yaml, mcp/mcp.yaml and an env.yaml in one git repository on GitHub, GitLab, GitCode, CNB, TGit or a private host; teamai push opens a merge request, re-running it updates the same MR rather than opening a second, and once merged a SessionStart hook runs teamai pull in every member's tool, which writes skills into ~/.claude/skills/, ~/.codex/skills/ and the rest, rules as .mdc for Cursor and .md for everyone else, hooks into each tool's native format, and MCP servers into each tool's native config with ${VAR} for secrets. The support matrix covers Claude Code, Codex, Cursor, CodeBuddy, WorkBuddy, OpenCode, OpenClaw, Hermes, DeepSeek Harness and Qoder, with the gaps marked; roles map members to namespaces, tags let them subscribe to slices, and teamai source add subscribes to another team's repository. A template org, teamai-hub, holds one template-backend at 10 stars. Single-repo mode commits .teamai/ to your project's main branch so "a teammate who clones the repo is auto-initialized," and every git write runs in an isolated worktree so "your working tree and current branch are never checked out, reset, or switched."

The second half of the README is where today's theme lives, and the usage guide's data table states it in one row: knowledge lives on main and travels with git clone; "Reports: members/ sessions/ votes/ stats/" live on a teamai-reports orphan branch, "pushed to origin (separate history)." What reaches that branch: a PostToolUse hook does "dashboard reporting"; a Stop hook scores every session by friction, counting an ESC interrupt, a rejected tool call, and a follow-up within sixty seconds containing a correction keyword ("not right," "redo," "wrong," in Chinese, English and Japanese), and when the score is non-zero prints "This session may contain a problem worth documenting" with a suggestion to run /teamai-share-learnings, which "pushes a learning document directly to the team repo"; that nudge is on by default (sharing.contributeHint.enabled), with a user override and an environment-variable "emergency kill switch." Intervention counts, prompt turns and token totals "are automatically aggregated and reported to the team's stats/<user>.yaml during teamai pull," and teamai digest renders them as a weekly "Session Autonomy" leaderboard "with team averages and per-person intervention rate rankings," while teamai dashboard on port 3721 shows "team members' AI coding session status in real time," each card with a badge counting interventions. The guide says "Privacy: only counts are tracked — no prompt or transcript text is ever stored" twice, and teamai session save --push, which is opt-in, sends "counts + tool names only" by default, committing "directly (no PR)" to sessions/<user>/<year-month>.md. Team knowledge recall, the part that reads the shared memory back into your agent as a subagent, is "off by default and must be enabled explicitly." So the asymmetry is exact: what your team is allowed to teach your agent goes through review; what your agent's sessions say about you goes to the reports branch on the next pull, as counts. The README badge says MIT and the LICENSE file is Tencent's MIT wrapper, which "does not impose any additional restrictions"; package.json on main still reads 0.22.0. Machine-facing docs: AGENTS.md, CLAUDE.md, a skills/ directory and an agents/ directory at the root, which is the tool eating its own output.

Reach for it when three people share a Claude Code and Codex setup by pasting SKILL.md files into Slack and the newest teammate has the oldest rules; it replaces the dotfiles repo, the bootstrap script, and humanlayer/skills with a sync step, and it replaces nothing if you work alone. Delete the "did you pull the new rules" message. Tradeoffs: a session-scoring hook in every tool you use, whose leaderboard ranks your colleagues by how often they interrupt the agent, which is a management product wearing a CLI; the reports branch is counts by design and by the guide's word, and the guide is the only place that word is checked; ten harness integrations means ten config formats teamai rewrites on every pull; a version number that moved from 0.17.4 to 0.23.0 with a compare link for notes; and one account with 492 of 645 commits.

github.com/Tencent/teamai-cli

05

Switch — SandboxAQ puts your agents in the Slack channel, where the memory is the scrollback, under Apache 2.0 with a Commons Clause

Product Hunt's #1 of the day (232 votes) is the one pick on today's slate that no single machine holds. sandbox-quantum/switch (TypeScript and Python; 560 stars, 556 commits, 16 contributors, 393 commits by one, first commit July 16, "Initial import of Agent Switch") is "the underlying infrastructure and framework that allows you to build teams where humans and agents work side by side": your Claude Code, Codex or OpenCode agent, running on your laptop, joins a Slack, Microsoft Teams, Discord, Telegram or Mattermost channel as a participant, through a connector installed from the plugin marketplace, and any other agent joins "via Agent Protocol" over HTTP, SSE and MCP if it "speaks the protocol." Rooms live in PostgreSQL ("messages · media · LISTEN/NOTIFY"); a Room Service and Gateway API hold "rooms, roles, instructions, permissions, attached knowledge and connected messaging apps"; each channel runs under its own instructions, roles are handed out, and work passes as tracked tasks. The README is explicit about what it is not: "Not a messaging app," "Not an agent provider" ("Switch ships no agents and no models"), and "Not a black box self-service platform" ("designed to be self-hostable and for your data to stay where it is"). The path in is a desktop app, Switch Console, which starts a local server, takes "a name, a working directory, and the provider you use," and deploys a sidecar over SSH to any Linux or macOS host you own ("Not Windows"; "2 vCPU, 4 GB RAM, 20 GB disk"), where agents run under tmux; macOS is the supported build and Windows and Linux are "early access," meaning "ready to use and still changing." Self-hosting is a Docker Compose file in deploy/local and a Helm chart that ships under the core release, and the docs are served over MCP at docs.flintai.dev/mcp so an agent can onboard you. Console releases are running two a day, v0.33.0 and v0.34.0 both on Sunday. The Product Hunt comments credit "a centralized policy store" and full message history "for audit trails"; the README's own line is "Define who can talk to which agent and in what context."

Three sentences from the repository fix its position on the ladder. The license is "Apache 2.0 License as limited by the 'Commons Clause' license condition," in a modified form that also binds "any derivatives," and the clause withholds "the right to Sell the Software or any derivative," where "Sell" includes "fees for hosting or consulting/support services"; the Product Hunt page says "Open-source," the README badge says "Apache 2.0 + Commons Clause," and software under that clause has not met the Open Source Definition since the clause appeared in 2018. The README's fourth bullet says "Guardrails and cost reporting are coming next, Flint AI among the ways to get them," and Flint AI is SandboxAQ's product line, with a "Platform" listed as "coming soon" on the site: the part of the pitch that decides who can do what is the part that is unwritten and partly the paid tier. And the memory: a channel's "whole trail is already there, nothing to paste or re-explain," which is the feature, and which means the agent's working context is stored under Slack's retention policy, or Discord's, or your Mattermost, readable by whoever is in the room, with sessions separated per channel so memory and rules do not bleed between them by default. Contributors sign a CLA and companies a CCLA; a gitleaks config, SECURITY.md, CLAUDE.md and a .claude-plugin directory are at the root; each artifact carries its own semver and a contract revision in artifacts.yaml, and the changelog's preamble explains why, which is more release discipline than most of this month's picks. Machine-facing docs: CLAUDE.md, SECURITY.md, RELEASING.md, and a switch-expert directory.

Reach for it when the agent's work needs a reviewer who is not you and the reviewer already lives in Slack; it replaces the hand-rolled bot that pipes a channel into a CLI, and the screenshot you paste to prove what the agent did. Delete the paste. Tradeoffs: the memory is the channel, so the readers are the channel and the platform's retention rules, and the audit trail is also the leak surface; the guardrails are "coming next," some of them as a product; a license you cannot host for money, which is fine for your team and a stop for anyone building on it; a desktop app as the front door, early-access outside macOS; and 560 stars, sixteen contributors, one with 393 commits, and a CLA.

github.com/sandbox-quantum/switch

06

Also on the desk. TALA (246 points), D2's layout engine for architecture diagrams, was closed-source, watermarked without a license and, per one commenter, priced "above my 'fun money' amount"; as of Monday night it is MPL-2.0 and bundled in D2 v0.9.0 as --layout=tala, with --tala-seeds for the randomness the post admits to, days after D2 announced it is now a non-profit; the thread's fair complaint is that it "doesn't do DAGs as well" as Dagre or ELK, which the post says first, and the same release renders SVG about 10x faster and adds PNG, GIF, PDF and PPTX export. brw (Show HN, 7 points; AGPL-3.0, Go, v0.10.3, two stars) drives the Chrome you are already signed into over MCP or HTTP, with stable refs like e17 instead of selectors, and runs remote over SSH so "cookies, passkeys and downloads never leave home"; the OP's whole pitch is "better than Claude chrome." The other bet on the same problem, camofox-browser (135 stars today, 10,173 total, MIT), is a REST server around Camoufox, a Firefox fork that spoofs its fingerprint "at the C++ implementation level" to "bypass Google, Cloudflare, and most bot detection," built by the team behind a personal-agent product; its two most recent GitHub releases are not releases but 2.9 GB "availability backups" of upstream Camoufox's beta builds, "verify the archive against SHA256SUMS before use." Relaticle (Product Hunt, 67 votes; AGPL-3.0, Laravel 13, PHP 8.5, 1,612 stars, v3.5.7) is a self-hosted CRM with 37 MCP tools and two trust models in one product: Claude Desktop or Cursor connects over OAuth and writes immediately, while the in-app assistant shows every change as a proposal card you approve "record by record before anything lands." Wg-admin (29 points, MIT, one day old) is a web UI for an existing WireGuard host that reads /etc/wireguard, edits peers, and applies with wg syncconf "(no interface bounce)," and "does not install WireGuard or rewrite your PostUp/NAT. That's all." Isle (12 points) sells managed KiCad and FreeCAD desktops for computer-use agents, five environment-hours a month free and $29 for a hundred, with the useful observation that "a machine can be healthy while the application is frozen"; two applications, both CAD, is a vertical. NoMac (6 points; on Product Hunt in July) builds, TestFlights and submits iOS apps from cloud Macs through a CLI, an MCP server and an API, $5 a month for 50 builds of one app or $20 for 300, no free tier, plus Apple's $99. Catenary (78 votes) is a free, closed "spatial canvas IDE" for coding agents with visual cables between them, "100% local-first, zero telemetry," with no source to check the claim against. FckSignups (501 stars today, 4,049 total, GPL-3.0) is a list of tools that are "open-source, in-browser, and require no-signups," with 508 open issues, which is how the list is submitted to. feynman (268 today, 9,170 total, MIT, v0.3.48 on Sunday) is "the open source AI research agent," a terminal app with its own pinned Node runtime and a skills-only install for Codex, Claude and OpenCode, renamed from @companion-ai/feynman since it was in our pool on May 31. context-mode (96 today, 21,192 total, last release June 29) re-trended without a release; it is the other half of the memory problem, keeping tool output out of the window rather than getting the past back in, and it was in our pool on June 3. Caveat (6 points, MIT, zero stars, created yesterday) is a self-hosted publishing app with an editor, an editable site and email delivery "on infrastructure you own," which is this newsletter's own stack as a product, and one day old.

Verification notes: star, fork, commit, contributor, release, asset-download, issue and file figures are from the GitHub API on 2026-09-08; HN points and comments from the Algolia API; Product Hunt votes and ranks from the launch pages; npm downloads from the registry; the Hugging Face dataset figures from the Hub API. doc-scraper's mechanics and privacy sentence are README.md on main and the four release notes from v2.8.2 to v2.9.2; its tool count is the MCP table. agentic-api's quotes are README.md and docs/guides/harness-cli-testing.md; the planned-versus-served Messages API is the API table, the "Claude Code on your own GPUs" section and the roadmap's unchecked box, read together. funes's numbers are the maker's blog post of September 3; the gate is docs/push.md; the hooks are docs/automation.md and docs/add.md; the public memory is huggingface/funes-memory on the Hub (created August 14, 375 downloads). teamai-cli's data flow is docs/usage-guide.md (72,357 bytes: the data-location table, the friction section, the dashboard and session-save sections with both privacy lines); the license is the LICENSE file; the beta cadence is the releases API and npm's version timestamps; the stargazer API returned 404 for the repository, so the 1,215 figure is the trending feed's, and trendshift shows the repository at #13 on today's list. Switch's license quotes are the LICENSE file's first two paragraphs; the remote-host requirements are docs.flintai.dev; the console release cadence is the releases API; the Product Hunt rank and comments are the launch page. TALA's bundling is the D2 v0.9.0 release note and the d2layouts/d2talalayout directory now on master; camofox-browser's backup releases are the releases API. Bottleneck Labs, Dan Luu, jyn, Mistral and the hangar test were fetched directly; the Pod OP and the "[1]" it cites are the Algolia items. Nothing on the slate was reproduced: go install of doc-scraper needs Go 1.26 and the funes installer ships no Windows binary, and this desk is Windows. The machine-facing-docs check ran on all five: PRIVACY.md and server.json on doc-scraper; AGENTS.md, ARCHITECTURE.md, CLAUDE.md, ROADMAP.md, TERMINOLOGY.md and docs/adr/ on agentic-api; AGENTS.md and SECURITY.md on funes; AGENTS.md, CLAUDE.md, skills/ and agents/ on teamai-cli; CLAUDE.md, SECURITY.md, RELEASING.md and switch-expert/ on Switch. Seen-before SQL keyed on fetched_at: FckSignups September 5, feynman May 31 (as companion-inc/feynman), context-mode June 3, open-science July 6 and September 7, NoMac July 13 (Product Hunt); doc-scraper, agentic-api, funes, teamai-cli, Switch, Brw, Relaticle, TALA, Pod, Isle and Catenary are first-time, and none of today's five links appears in any prior edition body. Today's pool was 93: hn:front 30, hn:show 22, producthunt 20, and github:trending 21 rows across all five feeds (all 5, go 1, python 4, rust 4, typescript 7), the typescript feed back after yesterday's zero; the series is 15 → 1 → 10 → 26 → 11 → 11 → 1 → 20 → 12 → 14 → 21, and Reddit is dark for the twenty-sixth consecutive week. Yesterday's edition broadcast at 12:19 UTC.

One of these,
every weekday.

Free. Unsubscribe by replying with one word. No tracking pixels in the email.