Zod's main branch carried a malware loader for part of September 21.

Plimsoll (Apache-2.0, Go, 22 stars, v0.21.0 on Friday, Show HN Sunday) is a daemon you run yourself that executes untrusted code, typically code an agent just wrote, and labels every result with the isolation tier it actually got: process, container, kernel or vm. The backend is configuration: WebAssembly or plain Docker on a laptop, Docker under gVisor or E2B and Docker Cloud microVMs in production, with the client code unchanged. A request can set MinimumIsolation; if the daemon can't meet it, the call fails with ErrInsufficientIsolation and nothing runs, so code that needs a VM can't quietly run on your test setup. Clients exist for Go, Python (Agno, CrewAI, Google ADK) and TypeScript (Vercel AI SDK, Trigger.dev, Mastra); go run ./examples/minimal tries it at the process tier.

The second half is credentials. Sandboxed code has no network by default. To call one of your APIs it goes through a broker outside the sandbox that checks the exact route the run was granted, attaches a token minted for that run, and enforces call and size budgets. The token never enters the sandbox. Every response carries SHA-256 hashes of request and result that the clients recompute, and a separate plimsoll-attest signs session chains and refuses one with a call missing. Each caller gets a daily allowance of paid microVM seconds, because, as the author puts it, "agents never get bored." In the thread, asked how it compares to remote sandboxes like exe.dev, the author drew the line: Plimsoll runs code for agents and MCP servers, not the agents themselves.

Reach for it if your product runs code a model wrote and you want the boundary and the API credential to be facts on the result, not a sentence in the docs. Delete the subprocess.run with an API key in its environment. Tradeoffs: pre-1.0, one contributor, and by the author's own account no other users and no outside security audit; gVisor is Linux-only, so a Mac tops out at the container tier; and the tier label comes from configuration plus startup checks, not hardware attestation.

Preloop (MIT, with the preloop serve control plane under FSL-1.1-MIT; Rust, 195 stars, five contributors, v0.34.0 on Saturday) is a self-hosted GitHub Actions engine. brew install preloopdev/tap/preloop, preloop init, preloop serve, then preloop run -f .github/workflows/ci.yml --event pull_request from a repo. It speaks the official actions/runner protocol, so GitHub's own runner works against it unchanged, and it handles expressions, matrices, reusable workflows, concurrency groups and OIDC. Each job forks a golden microVM in about 300 ms on macOS, Linux or Windows. Runs can target uncommitted changes, and --push or --create-pr sends the checks back to GitHub when you're done.

The debugging is the reason to switch. A failed step pauses instead of tearing down; fix the file in another pane, :sync, :retry, and the job continues from that step. With the DAP debugger on, the job waits at entry until a client attaches, and an agent can read the live github, env, job, steps and secrets scopes. The installer docs suggest downloading install.sh at a release tag and reading it before running it; every artifact ships with a sha256, and release binaries carry build provenance you can check with gh attestation verify. The replacement runner alone is an 11.9 MB binary against actions/runner's 434 MB. The one thread comment so far is from someone who hit their GitHub Actions minutes cap and found their five-year-old machine "easily 2x faster."

Reach for it if your CI loop is push, wait, read logs, push again. Delete the act setup that approximates Actions and drifts from it. Tradeoffs: the official runner image is about 9 GB compressed and 50 GB unpacked, so plan on 80 GB of disk; Docker actions fail on Apple Silicon with x86_64 goldens for now; the control plane's license bars running it as a competing hosted CI service; and handing a debugger the secrets scope is a grant worth thinking about before you hand it to an agent.

Pensieve (MIT, Python, 29 stars, repo created Thursday, v0.6.3 this morning, 86 points on HN) indexes your git repositories, including uncommitted changes and every worktree by branch, plus Documents, Desktop, Downloads, Obsidian vaults and your Claude Code, Codex and Qwen Code sessions. Search runs on-device, by meaning or exact phrase, from a Control-Shift panel or from any agent via pensieve mcp. pensieve integrate recommended wires up Claude Code, Codex, Cursor, Gemini CLI, Windsurf, Claude Desktop and VS Code. It also adds a "search before you grep" block to ~/.claude/CLAUDE.md and two Claude Code hooks, because agents grep out of habit.

The author published a benchmark: Claude Sonnet in Claude Code on 72 held-out code-finding tasks across four repos from 504 to 34,847 files, run twice each. With Pensieve it found the right file in 131 of 144 runs against 123 with grep alone, at 2.0 tool calls per lookup instead of 3.4 and $0.041 instead of $0.050. The page admits a single grep still wins on exact error messages, and the scripts are in bench/. On what it touches: the index lives in ~/.pensieve, its server answers only the local machine, .env files, keys and password-manager exports are skipped, and optional AI summaries are labelled Cloud when you pick Claude Code or Codex to write them. The thread was skeptical. One commenter has seen about twenty tools like it, and another argued everyone has settled on BM25 over a maintained index. A third said Cursor dropped its local index in name only, and that the hidden one in .git still goes stale.

Reach for it if your agents spend their first several turns grepping a big repo, or you want to search old agent sessions. Delete the rg round trips at the top of every session. Tradeoffs: the benchmark is the author's own, on Sonnet only, measured on 0.5.6; the app is not notarized and needs Apple Silicon; three releases shipped in under an hour this morning; and the install is a prompt that tells your agent to curl | sh and edit your agent config.

BetterWispr (Apache-2.0, Swift, 253 stars, repo created Wednesday, v0.1.5 this morning, 196 points and 117 comments on Show HN) puts dictation behind Option-Space in any app: hold, talk, let go, and the text lands where your cursor was. It ships nine on-device models from Apple speech, Parakeet (English, Japanese and 25 European languages) and Whisper Large v3 Turbo. There is no account and no cloud fallback, unless you add your own Sarvam, Smallest AI or OpenAI-compatible key. Light cleanup, the default, drops English ums, repeats and false starts. A per-app tone setting decides capitals and final periods for Messages versus email. "Scratch that" deletes the last sentence, and corrections you make in History become learned words. A meeting mode labels your mic "Me" and other apps "Them" and summarizes with Apple Intelligence or Ollama, on the machine.

Updates arrive from GitHub Releases through Sparkle and install only when their EdDSA signature matches, so a push to the repo alone can't ship a build to you. In the thread, most replies compared it to Handy, VoiceInk and FluidVoice. The author called Handy "bloat" and was asked for reasons rather than a verdict. One commenter warned that Wispr Flow's cleanup once turned "DON'T" into "DO," a risk to weigh before turning on Medium, which rewrites for clarity with a local model. Several people now dictate prompts to Claude Code all day for the ergonomics.

Reach for it if you dictate prompts to coding agents and won't send every recording to a server. Delete the Wispr Flow subscription, if its accuracy has slipped for you the way the author says it did for them. Tradeoffs: five days old and at v0.1; macOS 14 or later only, with Apple Silicon recommended; the field is crowded with free local alternatives this does not clearly beat; and macOS's own dictation is good enough for some commenters.

Atticus (MIT, 34 stars, one contributor, repo created Saturday, 25 points on Show HN) is a menu-bar assistant from a ninth-grader: hold Control-Option-Space, say what you need, let go. Simple asks never touch a model. Opening an app takes 0.08 seconds, and windows, web searches and Spotify run locally. Anything harder goes to Claude Code via claude -p on the Pro or Max plan you already have, which the README puts at about 0.14 cents of plan usage per ask at API list rates. An action that works once is saved and replayed without AI the next time: "Open Calculator and Chess" went from 5.5 seconds to 0.4. "Tell me when Codex is done" watches the agent's log every five seconds at no cost.

On permissions, the README is specific. Safe mode runs the model's commands in Claude Code's sandbox, writable only to a scratch folder. Atticus asks before anything deletes, sends, buys or changes a file, "Reply: sounds good" types the text but never sends it, and rm, sudo, disk tools and shutdown are always blocked. Every exact command lands in an ask log, and speech is transcribed on-device. Updates are the opposite. The app fetches the repo's main, fast-forwards, rebuilds and restarts itself when idle, with no release or signature step, so a push like Zod's would reach every install by default. In the thread, one commenter had already forked a Windows version.

Reach for it if you live in macOS and already pay for Claude, and want voice control that costs nothing for the asks it has learned. Delete the Raycast or Shortcuts glue you wrote for "put Code on the big screen." Tradeoffs: macOS 26 only; two days old, one maintainer; turn off self-update in Settings → About & Updates if you care where your code comes from; and a daily anonymous ID goes to PostHog unless you switch it off.

Verification notes: star, license, creation, contributor and release data are from the GitHub API on 2026-10-12. HN points and comments are from the Algolia API. The Zod, standard-schema and nub commit times, the Ethereum-resolved loader, the deploy-environment and npm-scanning outcomes, the workflow_dispatch migration and the "permission management" reply are from GitHub community discussion 208477 and Colin McDonnell's reply in it; the reverted commit under the v4.6.6 tag and the "never made it to npm" correction are from HN item 50052814. Plimsoll's tiers, floor, broker, run records, attest tool and stated limits are from its README and the author's Show HN post; the exe.dev exchange is from HN item 50049388. Preloop's protocol, microVM, pause/retry, DAP scopes, install verification, runner sizes, disk needs, Apple Silicon gap and licensing are from its README; the GitHub-minutes comment is from HN item 50049531. Pensieve's sources, MCP setup, CLAUDE.md block, hooks, privacy rules and benchmark are from tedhaley.ca/pensieve; the twenty-tools, BM25 and Cursor-index comments are from HN item 50049508. BetterWispr's models, cleanup, tones, commands, meeting notes and Sparkle signing are from betterwispr.com; the Handy exchange, the DON'T-to-DO report and the Claude Code dictation comments are from HN item 50042333. Atticus's speeds, plan-usage cost, Safe mode, blocked commands, watcher and telemetry are from its README; the self-update behavior is from the Updater in Atticus.swift and install.sh; the Windows fork is from HN item 50049588. Pipeline health: today's pool held 65 rows, against the ~280 the compose prompt assumes. github:trending returned zero rows, and Reddit returned zero again, 156 days since its last nonzero day on May 9.