The token that opened LiteLLM's release pipeline was sitting in a log.

Omnara (Apache-2.0, Go, about 3.1k stars, omnarad v0.2.9 on Wednesday, 86 points on Show HN) repositions a YC company that launched in February as a way to run Claude Code and Codex from anywhere. It is now an open-source answer to Claude Managed Agents. You create an agent with one API call. Stateless workers run the loop against OpenAI, Anthropic, OpenRouter, Bedrock, Ollama, LiteLLM or any compatible endpoint, and every event goes into Postgres, which is the agent's state. A crashed worker resumes from the log. Machines run an omnarad daemon that dials out, so nothing needs an inbound port. Sandboxes come from eleven providers, or your own laptop or VM. Each tool can be set to run, ask a person, or be blocked, and the platform holds the call until someone answers.

On secrets the docs are careful: values are encrypted, read endpoints never return them, and machines receive them by reference into their environment. What the docs don't say is whether a secret that turns up in a tool's output is redacted before it lands in the event log. That is exactly LiteLLM's path, and a durable, replayable log is a bigger store of it than a gateway's request log. The README also says plainly that "the local defaults are intentionally insecure." On HN the author said idle agents are "just rows in postgres" and one worker can run thousands at once, since agents mostly wait on the model.

Delete the tmux session and restart script you use to keep a long agent alive across a reboot. Tradeoffs: you build the client yourself (the author compares it to Supabase); self-hosted sandboxes need a public URL; production hardening is your job; and check what your tools print before you turn on a log that never forgets.

OpenAI's CLI (Apache-2.0, Go, v1.40.2 today, 924 stars, 147 points on HN) is a resource-shaped client for the REST API: openai responses create, openai files upload, images, models and admin endpoints. Output is readable text by default, with JSON, JSONL, YAML and GJSON extraction for scripts. It installs from Homebrew or go install, so on a day like this it is worth noting that it is not one more package in your Python environment. Keys come from OPENAI_API_KEY or a flag; admin endpoints take a separate OPENAI_ADMIN_KEY; mutual TLS is in beta.

Two defaults matter for today's theme. Values piped in on stdin that start with @ read local files, unless you set OPENAI_UNTRUSTED_STDIN=1, so piping a model's or a web page's output into the CLI can upload a file the producer named. And --debug logs full request and response bodies, which the README itself warns against sharing. On HN the thread spent most of its time on what this isn't. "Codex = agent harness," one commenter said, and this is a wrapper around the API. Another asked whether it was just curl; the reply was "Curl with token usage."

Delete the curl scripts with hand-built JSON you keep for file uploads and admin calls. Tradeoffs: OpenAI only; the repo doesn't accept pull requests from non-collaborators; set the untrusted-stdin flag in any pipeline where something else writes the input; and keep the admin key out of any shell an agent can read.

Cua (about 30.6k stars, mostly MIT, Spaces v0.13.0 today, 170 stars today on GitHub's Rust trending) gives agents computers instead of your computer. Spaces are full macOS VMs built locally on Apple's Virtualization framework, or Linux images. The Cua Driver lets agents operate native apps and browsers over a CLI, MCP or the Python, TypeScript and Rust SDKs. The part that fits today is Teleport, which moves a signed-in app such as Chrome or Slack into a Space without signing in again. The README says those sessions live in the Cua Keyvault, "encrypted on your Mac," and reach a Space only after you approve.

That puts the approval at the point where a credential moves, rather than around every action the agent takes afterward. Once a session is inside a Space, the agent has it. The project also ships CUA-S1, small form-filling models with weights on Hugging Face, and a bench for writing computer-use tasks and exporting trajectories.

Delete the second browser profile you sign into so an agent can drive it on your main desktop. Tradeoffs: Spaces needs macOS 26 and Lume needs Apple Silicon; the README makes no claims about isolation guarantees, and cua sb create ubuntu is a gVisor container, not a VM; remote hosts are reached through the cua.ai relay unless you use Tailscale or SSH; and the licensing is mixed: Spaces and the Keyvault are FSL-1.1-MIT (MIT two years after each release), and some optional parts are AGPL-3.0.

GenOffice (Apache-2.0 outside its ee/ directory, TypeScript, about 10.4k stars since its July 31 launch, v0.11.919 on Monday, 191 stars today) is Docs, Sheets, Slides, PDF, Markdown and HTML editors for macOS, Windows and Linux, from Genspark. It ships a genoffice CLI, an agent skill and an MCP server, so Claude Code or Codex can create and edit real .docx, .xlsx and .pptx files. Untouched parts of a file are preserved byte-for-byte, and AI edits arrive as tracked changes or diffs with one-click rollback. Editing, conversion and file indexing run locally; only AI calls leave the machine.

The key question has two answers. You can bring your own key for Claude, OpenAI, Gemini, DeepSeek, OpenRouter or any OpenAI-compatible endpoint, including a local server. Or you can sign in with Genspark for "keyless" access, which means there is no key on your disk because every call goes through Genspark. The README says one key, for the optional Jev reranker, "is stored only on this device," and doesn't say where the others go. Official builds also send usage analytics by default (Settings → General).

Delete the python-docx script your agent writes every time it needs a Word file with real formatting. Tradeoffs: headless MCP hosts need the app installed and a virtual display for rendering and PDF conversion; scanned-page OCR uses the system's, documented for macOS and Windows; and decide which of the two key paths you're on before your agent starts writing contracts.

Opposable (free Android app, 15 points on Show HN) runs GUI-Owl 1.5 2B, a Qwen3-VL fine-tune from Alibaba's Mobile-Agent team, at 4 bits through llama.cpp on the device. It's a 1.5 GB download from the app's settings. The vision encoder runs on the NPU, GPU or CPU; on a Galaxy S25's Snapdragon NPU it takes 236 ms, against 3.9 s on an M2 CPU. The writeup says that when no cloud agent is connected, the loop runs "with no server involved," so screenshots of your apps don't leave the phone.

The numbers are the author's own, and modest. The model got 27 of 36 graded screens right at 400 image tokens. On eight held-out emulator tasks, whole-task attempts succeeded 4 and 3 times over two rounds, and checking each subgoal before moving on raised that to 6 in both. That verification step is the useful idea: a 2B model that checks its own subgoals beats one that doesn't.

Delete the cloud phone-automation service you'd otherwise send screenshots of your banking app to. Tradeoffs: no standard benchmark such as AndroidWorld; only Snapdragon has an NPU build, so Pixel, MediaTek and Exynos phones fall back to GPU or CPU; the writeup doesn't state a license for the app or say what is collected when a cloud agent is connected; and 8 tasks is a demo, not an evaluation.

Also today: WorldTUI (283 points on HN) is a 360M-parameter Qwen2.5-Coder fine-tune, trained on 336k recorded terminal sessions, that predicts screen updates from keypresses well enough to run vim, tmux and a file written in one session and read back later. It runs in the browser over WebGPU as a 208 MB download; weights are promised "soon." Anthropic also opened a waitlist for Claude Duet (427 points), a research-preview background agent for US Pro and Max users that works on its own cloud computer with your connected apps and asks before sending messages or paying.

Verification notes: star, license, creation, release and language data are from the GitHub API on 2026-10-22; trending star counts are from today's github:trending rows. HN points and comments are from the Algolia API. The LiteLLM payload, affected versions, timeline and stolen-data list are from SafeDep's post; the token-in-logs path, the exposed gateway, the three developer credentials and the defeated release controls are from LiteLLM's incident post; the attestation quote is from HN item 50181114. Railway's details are from its October 21 disclosure, which names no product or package. Omnara's architecture, permissions and insecure-defaults note are from its README; secret handling is from docs.omnara.com/organization/secrets, which does not address redaction from the event log; the author's comments are from HN item 50183892. The OpenAI CLI's install paths, environment variables, untrusted-stdin mode and debug-logging warning are from its README; the comments are from HN item 50191507. Cua's components, Keyvault, relay and licensing are from its README. GenOffice's features, key options, analytics default and limits are from its README. Opposable's model, timings and task results are from its October 21 writeup. WorldTUI's figures are from its author's post; Claude Duet's availability and approvals are from its product page. Pipeline health: today's pool held 81 rows, against the ~280 the compose prompt assumes. github:trending returned 7 rows from three feeds (all 3, rust 2, typescript 2), with python and go empty, and Reddit returned zero again, 166 days since its last nonzero day on May 9.