vibehacker
News
GitHub (cursor/plugins) ·

Cursor's pstack adds a skill that has your agent formally verify the riskiest invariant in your repo

Calling /create-formal-verification-skill makes the agent pick a high-stakes property (races, retries, parsers, unsafe code), choose a tool such as TLA+, CBMC, or Kani, show the check failing on a deliberately broken variant, then leave a project-local skill so the next agent can rerun it with one command. pstack also ships into Claude Code's plugin marketplace from the same repo, and Cursor's own eval behind the skill is small (one run per repo on six open-source projects).

More news

View all

Anthropic is reportedly testing a model that infers what you meant from incomplete coding instructions

Per The Information, a tester said the unreleased model spotted broader related problems when asked for a simple bug fix, but it's unclear whether it can tell an incomplete request from work you deliberately left out. That gap matters: the Overeager Coding Agents study found Claude Code, Codex CLI, and Gemini CLI took out of scope actions in 5.4% to 27.7% of runs, versus 0.2% to 4.5% for ask first OpenHands…

OpenAI's MultiLangBench has models build SQLite from scratch in 20 languages, COBOL included

The open eval (GitHub) checks a from scratch SQLite 3.40.1 engine against 272 tests adapted from SQLite's own suite and scores pass rate alongside API cost; OpenAI says GPT 6 Astra averages 87.4% (COBOL hardest at 72.1%) vs 26.8% for GPT 5.6 Sol, while cheaper GPT 6 Luna hits 40.3% at about 78% lower cost. A separate COBOL migration eval has GPT 6.1 Sol at 97.9% on high reasoning, though all figures are OpenAI's own runs…

OpenAI

SIwithin runs Claude Code unattended inside a folder fence and a hard dollar budget

The single file, stdlib only Python tool (macOS only) confines a run to the folders you grant, blocks your home folder, and routes every API call through a loopback proxy that holds the real key, prices each response, and kills the run once the budget is spent. Its Codex CLI adapter is weaker: per the README it hasn't been tested against a live CLI and needs the key in the run's environment (write up)…

Respan open-sources a Rust AI gateway where every provider, protocol, and feature is a plugin

The YC W24 team rebuilt its LiteLLM based gateway as a tiny event dispatch core, so providers (Mistral's is 22 lines), MCP, realtime voice, fallbacks, and PII redaction are all plugins, and an OpenAI, Anthropic, or Gemini client can call any model with tools and reasoning translated. It's pre alpha, MIT/Apache 2.0, and runs locally from source (GitHub), with a paid hosted version for observability and evals…

GitHub's new package firewall screens npm installs by coding agents and CI runners before they hit your machine

Now in free public preview for GitHub Enterprise Cloud, it sits between coding agents or Actions runners and the upstream registry, checking metadata requests and downloads against admin policy (a configurable cooldown for new versions, Advisory Database malware and vulnerability alerts, attestation downgrades), with an exception request if something is wrongly blocked. It only covers npm for now, each agent or host has to be pointed at the firewall, and it will move to metered billing at GA…

GitHub Changelog

Spotted something we missed? Start a thread.