vibehacker
News
ferstar.org ·

ZCode silently uploaded full Git histories; Z.ai says Repo Wiki fixed

A reverse-engineering write-up says Zhipu’s ZCode client packaged entire workspaces—including full .git history—and uploaded encrypted snapshots to Aliyun OSS while logged in, with no effective UI opt-out. Z.ai apologized, blamed default Repo Wiki/indexing, said the issue is fixed, and promised to open-source the client.

More news

View all

Recto is a free local canvas where Claude Code, Codex or Cursor design UI and you edit it with your mouse

Shown on HN Nov 3, the free Mac, Windows and Linux desktop app detects your installed coding agents and runs their CLIs beside a canvas of real HTML and CSS, so you can drag or restyle what they build, pin comments for them, or reprompt a selected element, with no MCP or API setup. It also covers motion, SVG and 3D, imports designs from web pages, and exports plain HTML/CSS…

Recto (Show HN)

RudderStack open-sources DevBox, the agent harness behind about 35% of its merged PRs

Shown on HN Nov 3, DevBox runs one sandbox per task with no real secrets inside, on Kubernetes or your own machine, plus a CLI that spins up dependent services for end to end checks and hooks into Slack, Linear and GitHub. RudderStack says it has merged over 1,900 PRs from it since April, mostly small to mid features, while bigger projects still go to Claude or Codex (Show HN)…

Spooler is a managed message queue with just send, leased receive and ack, plus a CLI and skills for agents

Shown on HN Nov 4, it adds atomic ack and send so queues can model state machines, writes each message to disk and replicas before a send succeeds, and ships an open source Go CLI and library plus agent skills, with an in memory Docker image for local testing. The server is closed source with no self hosting, and plans start at £29 a month after a 60 day no card trial (Show HN)…

Spooler (Show HN)

Small Print tracks when an MCP server, skill or plugin quietly changes the tool text your agent reads

Shown on HN Nov 3, it keeps every version of the tool descriptions from about 336,000 MCP servers, skills and plugins across 20 public sources and grades each change by a written rule, and npx smallprint check or the VS Code/Cursor extension checks your own setup with no account. Daily change briefs can go to email, Slack, Discord or ntfy, and the free plan keeps 25 pins (Show HN)…

Spotted something we missed? Start a thread.