1. October 02, 2026
   1. 🔗 blacktop/ida-mcp-rs IDA Pro MCP Server v9.5.0-beta.1 release

      Prerelease for IDA Pro 9.5 beta. Requires IDA Pro 9.5 with valid license.

   2. 🔗 MetaBrainz Our editors: vzell rss

      This is part of a series where we talk to some of the amazing editors that have cracked one million MusicBrainz edits and qualified for super special (lousy) shirt plan.*

      These users have donated substantial amounts of their time to improve open music data, enriching open-source knowledge and culture for billions of people. Let’s find out what makes vzell click. And click and click and click!

      

      Thanks so muchvzell for agreeing to chat. Many MusicBrainz editors will know you through your MusicBrainz profile and editing - who are you offline?

      Hi, I'm from Germany (originally born in Romania, Transylvanian of German descent). I live in Drabenderhöhe—the largest Transylvanian-dominated community near Cologne—where we keep all Transylvanian traditions alive.

      I am an avid singer myself and a member of an eight-time championship-winning choir; it is my favorite hobby, right after Bruce Springsteen and MusicBrainz. I studied physics and have been retired for a year, yet I still work three days a week in the IT industry.

      How did you get started with editing MusicBrainz?

      It's all because of Bruce Springsteen dominating my life musically. As a data fetishist, I want to record every conceivable piece of information in a super database like MB.

      Ah, a MusicBrainz obsession sprouting from another music obsession. That will be familiar to many MusicBrainz editors.

      How does editing MusicBrainz fit into your everyday life and routine?

      Perfectly… as I sit in front of the computer anyway, listening and archiving Bruce and related stuff.

      Do you have any personal tricks or rules to keep a large amount of editing sustainable, healthy and fun?

      Yes… have a lot of friends to party with, a choir to sing with AND listen to Bruce during editing (a never ending story, this guy has so many bootlegs and I have them all, 30 TB on my NAS). Last but not least, stay focused and work precisely, it's worth it… and… laugh and enjoy life, there seems to be actually only one.

      Do your friends and/or family know that you edit MusicBrainz for (hopefully) fun? What do they think about it?
      
      All of them know about it and now with the T-shirt it will wide spread even more

      Actually they like it, and they know it's my habit to work precisely no matter what it is that I'm doing.

      What is your favourite thing to edit?

      Right now, entering every single Bruce bootleg on earth after I finished off (a long time ago) entering all his events (about 4,200) and works and having a lot of beer…

      What is your least favourite thing to edit?

      Bruce related Various Artist albums, but I do it anyway…

      What are your favourite editing tools? Do you have any editing tips?

      In the beginning my fingers, later on I automated as much as possible with self written Emacs Lisp routines (yes I'm an Emacs guru). Nowadays userscripts I've written with the help of AI (Claude), see [forum thread].

      One tip so, be consistent in what you're doing, every single dash/en-dash/em- dash matters… hahahaha

      Last but not least, what are your current top music recommendations!
      
      Well, do yourself a favour and listen to Willy DeVille and maybe… hahahaha… to our choir MGV Drabenderhöhe.

      And last but not least "The Boss"…

      Thanks again vzell. Happy editing!

      *If you are a million-editor and missed our emails and are keen for a shirt and/or a chat, please get in touch. If you have a million edits you should know how to reach staff, so no contact link for you! Non-million editors, you are also welcome to share your story, please get in touch (you get a link!)

   3. 🔗 anthropics/claude-code v2.1.288 release

      What's changed

      • Added $.ui.selection() for mods: returns the text you last selected in fullscreen mode and, when the selection lies within one transcript row, that row
      • Added a built-in gh api to cloud sessions whose image has no GitHub CLI, and fixed the built-in sending control characters from file names, jq filters or GitHub errors to the terminal
      • Added recovery for a prompt cleared with Ctrl+C: pressing Up on the empty prompt brings the draft back, including pasted text and images
      • Added a re-authenticate prompt when an MCP server asks for more OAuth scope during a tool call
      • Added --max-findings <n>|all to /code-review to report more or fewer findings than the usual limit; the choice is reused until you pass --max-findings default
      • Added Ctrl+F to find a session by name and Alt+↑/↓ to jump between groups in the agents view; both, and rename, can be rebound in keybindings.json
      • Added a screen reader mode announcement of the new permission mode when you approve a plan, including with Shift+Tab
      • Fixed mid-response API timeouts failing the turn: non-interactive sessions and subagents now continue from the partial response, and thinking-only responses are retried
      • Fixed long conversations failing with "Prompt is too long" instead of auto-compacting when the last reply reported zero token usage
      • Fixed --resume sometimes dropping files and other context that a compaction had just restored
      • Fixed a resumed session sometimes not saving the last response of a turn, so that the next --resume showed the prompt unanswered
      • Fixed resume occasionally loading a transcript cut short when the same session rewrote the file during the load
      • Fixed resuming a conversation started on 2.1.286 or earlier dropping the model's earlier thinking
      • Fixed session titles, memory recall and prompt hooks failing on Mantle or behind gateways that reject structured outputs; added CLAUDE_CODE_DISABLE_STRUCTURED_OUTPUTS to turn structured outputs off
      • Fixed auto mode denials pointing Claude at a Bash permission rule when the blocked tool was not Bash
      • Fixed auto mode on Bedrock and Mantle switching to the local classifier for the rest of the session after a request to an older model, such as a WebFetch summary or a sonnet subagent
      • Fixed cloud sessions that restarted on a newly picked model replying with that model after the server refused it
      • Fixed Cowork cloud sessions staying marked as waiting for input after a WebFetch permission prompt for an unapproved URL went unanswered for five minutes
      • Fixed prompt suggestions not appearing on a phone that joins a Cowork cloud session started on another device
      • Fixed a mod's button sometimes running a different button's action when pressed on a view drawn before Claude Code restarted
      • Fixed a plugin's pane showing nothing when one Code element held a diff that does not parse; it now draws as plain code
      • Fixed plugin LSP servers receiving literal ${user_config.*} and ${CLAUDE_PLUGIN_ROOT} placeholders in initializationOptions and settings instead of substituted values or manifest defaults
      • Fixed a plugin's tool.call hook making Bash fail and file searches read the wrong folder in subagents that run in a worktree
      • Fixed git-subdir plugin installs failing, or caching an incomplete plugin, on older git (before 2.39, e.g. Ubuntu 22.04's 2.34)
      • Fixed plugins loaded with --plugin-dir not showing "Configure options" in /plugin
      • Fixed background sessions ending when a plugin was reloaded or disabled while one of its timers or reads was still running
      • Fixed sandboxed heredocs with an unquoted delimiter (`python3 <
   4. 🔗 tomasz-tomczyk/crit v0.21.1 release

      What's Changed

      Daemon and approve

      • fix: stop the daemon over HTTP on approve and crit stop (#1001) by @fhucko in #1001 - Thank you!
      • fix(web): lock the finish button once the server has stopped (#1002) by @fhucko in #1002 - Thank you!
      • fix(daemon): delete the session lock file before unlocking it (#1003) by @fhucko in #1003 - Thank you!

      OpenCode

      • fix: support OpenCode v2 plugin integrations (#1007) by @tomasz-tomczyk in #1007 - Thank you @manubhai04 for reporting!
      • fix(opencode): migrate unedited v1 plugins from older releases to v2 (#1010) by @tomasz-tomczyk in #1010

      Review page

      • fix: scroll document comments within Pierre list (#1006) by @tomasz-tomczyk in #1006 - Thank you @mythosil for reporting!
      • feat(web): border each file and use the code background for comment rows (#1004) by @tomasz-tomczyk in #1004
      • feat(web): left-align file-level comments in diffs (#1008) by @tomasz-tomczyk in #1008
      • fix: wait for review list scroll before comment alignment (#1009) by @tomasz-tomczyk in #1009
      • fix(web): clean up review CSS and drop stale comment jumps (#1011) by @tomasz-tomczyk in #1011

      Internal refactors

      • ci: split e2e-windows across a 2-VM matrix (#1000) by @tomasz-tomczyk in #1000

      New Contributors

      • @fhucko made their first contribution in #1001

      Full Changelog : v0.21.0...v0.21.1

   5. 🔗 Confessions of a Code Addict How and Why fork() Uses Copy-on-Write rss

      In the last video, we learned about copy-on-write (CoW) and understood its mechanics by digging inside the mmap pathway in the kernel. This is a continuation of that where we look at the fork() system call and how it uses copy-on-write behind the scenes.

      Following is a timestamped list of chapters in the video to help you navigate quickly. Also, I recommend watching the video at a higher speed to get a better experience.

      • (00:00) Introduction : Copy-on-write with fork() and the Instagram example.

      • (02:54) Copy-on-write recap : Sharing physical frames and making private copies when a process writes.

      • (10:08) What fork() does : Creating a child process and inheriting the parent's state.

      • (13:15) A code example : Return values, inherited memory, and independent writes in parent and child.

      • (18:26) Why use copy-on-write? : The cost of copying the parent's memory.

      • (21:05) Page tables after fork() : How parent and child initially share physical frames.

      • (23:45) The shell and exec() : Why copying memory upfront would often be wasted work.

      • (26:04) Handling a write : Read-only page-table entries, page faults, VMA permissions, and copying a frame.

      • (30:01) Benefits and tradeoffs : Memory savings and the performance cost of deferred copying.

      • (33:41) Instagram 's memory-sharing problem: Shared memory gradually becoming private in Python worker processes.

      • (41:14) Python objects and reference counting : Why an expression like if x is None can cause memory writes.

      • (45:16) Inside the interpreter : How evaluating an expression changes reference counts.

      • (48:12) Immortal objects : Avoiding reference-count updates for objects that live throughout the runtime.

      • (50:19) Wrap-up : Plans for a hands-on demonstration using Linux memory debugging tools.

      If you are new to this series, it is based on my ebook called "Virtual Memory from First Principles". It is available to read for free online and also available to purchase from Gumroad (PDF/Epub) and Amazon (Kindle edition).

      Buy PDF/Epub

      Get Kindle Edition

      ---

      And, if you want to watch the previous videos in this series, the following is what has been published so far:

      • What is virtual memory and why do we need it

      • Size of the virtual address space of a process

      • Address space of a process

      • Structure of page tables and how page table walks work

      • What is inside a page table entry

      • Size of a physical address

      • Demand paging

      • Demand Paging in Action: mmap, Page Faults, and RSS

      • How Copy-on-Write Works with Memory-Mapped Files

      Share

      Read more

   6. 🔗 smol-machines/smolvm smolvm v1.22.2 release

      What's Changed

      • Follow the fetch_update rename so clippy on current stable passes by @BABTUNA in #1505
      • Let the API amend a stopped machine's egress allow list by @BABTUNA in #1501
      • Allow clippy::double_must_use on the shim's async trait by @LoganGrasby in #1508
      • Reject unknown fields on the mutating API request types by @BABTUNA in #1509
      • Bump the workspace to 1.22.2 by @BinSquare in #1513

      Full Changelog : v1.22.1...v1.22.2

   7. 🔗 HexRaysSA/plugin-repository commits sync repo: -1 plugin, +1 release, -1 release rss

      sync repo: -1 plugin, +1 release, -1 release
      
      ## New releases
      - [ida-nexus](https://github.com/hexrayssa/ida-nexus): 0.13.2
      
      ## Removed plugins
      - ida-codemode
      

   8. 🔗 backnotprop/plannotator v0.27.25 release

      Follow @plannotator on X for updates

      Missed recent releases? Release | Highlights
      ---|---
      v0.27.24 | Image previews stay in the all-files view, PR comment previews open on the commented line
      v0.27.23 | Bitbucket Cloud PR review, Question UI for answering agents in place, opt-in auto-update, viewed files remembered, review another repo or worktree
      v0.27.22 | Plans open the docs they link to, Claude review jobs locked down, Code Tour on Linux without Claude's sandbox, Pi reviews the latest plan
      v0.27.21 | Remote and phone sessions load several times faster, real Request changes on GitHub, model pickers show real names, OpenCode fixes
      v0.27.20 | Mistral Vibe support, annotate gets the full Options menu and Settings, jj Commits panel, long lines wrap in plan code blocks
      v0.27.19 | Before/After image previews in code review, file comments as GitHub file threads, forge-correct #123 links, /plannotator-last finds the right session
      v0.27.18 | Model pickers from your installed Claude and Codex (Opus 5.5, Fable 5.1, GPT-6), unsent PR review comments survive new pushes
      v0.27.17 | Diagram files open in the diagram viewer, OpenCode switches model with agent, idle review stops polling the git remote, Tree is the default review view
      v0.27.16 | Themed diagrams on Mermaid 12, comment on any node or edge, patch-file review, embedded HTML documents render
      v0.27.15 | Plannotator TUI and Herdr Annotate announcement, element context on pinpoints, HTML links open as linked documents, All files panel, Classic diff default
      v0.27.14 | Pi plan progress survives compaction, Codex threads across rollout files, WSL browser setting, Mod+E edit mode

      What's New in v0.27.25

      A fix release driven by reports from people using the last two releases: code review with a colorized git config, Bitbucket reviews on large pull requests, wide tables in Firefox, Ask AI on Windows, and a failing install. Six pull requests, two of them from community contributors.

      Code review works with color.diff = always

      If your git config set color.diff = always, a common line in dotfiles, plannotator review showed 0 files with no explanation. Git wrapped every line of the diff in terminal color codes even though Plannotator reads it through a pipe, and the diff parser skipped every line it could not recognize. Viewed-file marks also stopped saving.

      Plannotator now turns color off for every git command it runs during a review, in every runtime. Setting color.ui=never alone is not enough, because a more specific color.diff=always wins over it, so each color setting is turned off explicitly. jj gets --color=never, gh pr diff gets --color=never, and the review agents and Call Flow analysis run their own git with color off. A normal diff is byte for byte what it was before, so saved comments and viewed marks are unaffected.

      (#1662, #1663, closing #1661, reported by @sholsinger)

      Bitbucket review fixes from real use

      @Toparvion tested Bitbucket Cloud review on a large pull request with several reviewers, existing comments, and Guided Review, and reported three things:

      • "View on Bitbucket after submitting" now opens. The browser only lets a page open a tab within a few seconds of a click, and posting a large review takes longer, so the tab was blocked as a popup. Plannotator now opens the tab the moment you click submit, sends it to the pull request once the review posts, and closes it if posting fails. The Feedback Sent screen also has a plain link. This affected GitHub and GitLab too, and links now also open from the VS Code panel.
      • Your overall comment shows at the top. Bitbucket's activity feed lists the newest comment first, so the summary comment posted before the inline comments ended up at the bottom. It is now posted after them, so it lands on top. A retry after a partial failure still never posts it twice.
      • Long reviews in Claude Code. Claude Code stops a slash command's shell after about 30 minutes. That limit belongs to Claude Code, not Plannotator. The Claude Code guide now shows how to raise it with BASH_DEFAULT_TIMEOUT_MS, and the review skill tells Claude it can re-run the review in the background. Your comments come back either way, because drafts are saved.

      (#1653, from #1583, reported by @Toparvion)

      Wide tables no longer collapse in Firefox

      In Firefox, commenting inside a wide table while the action bar was pinned to the top squeezed the table into a narrow strip beside the bar. The bar was both a float and sticky, and Firefox laid the table out around where the bar sat once stuck. The bar is now sticky without being a float, and tables keep their width in Firefox, Chrome and Safari. Plan review had the same problem and is fixed too.

      (#1660, closing #1659, by @ruaridhw)

      Additional Changes

      • Ask AI dropdowns are readable in dark mode on Windows. The provider, model and reasoning-effort lists showed light text on a light background. They now use the theme's own colors (#1658, by @Aayushyaash).
      • The install script reads the latest version correctly. It found the version with a line-based text match, which picked up the wrong value when GitHub returned its answer on a single line, and the install failed with a 404. It now reads the version by name, and the Windows install.cmd parses it as JSON. This fix has been live on plannotator.ai since it merged (#1656, closing #1655, reported by @jdppettit).

      Install / Update

      macOS / Linux:

      curl -fsSL https://plannotator.ai/install.sh | bash
      

      Windows:

      irm https://plannotator.ai/install.ps1 | iex
      

      Claude Code Plugin: Run /plugin in Claude Code, find plannotator , and click "Update now".

      Pi: Update @plannotator/pi-extension to 0.27.25 and restart Pi.

      OpenCode: Clear cache and restart:

      rm -rf ~/.bun/install/cache/@plannotator
      

      What's Changed

      • fix(review): Bitbucket feedback from #1583 by @backnotprop in #1653
      • fix(install): parse the latest release tag by key, not by line by @backnotprop in #1656
      • fix(ui): stop long tables collapsing in Firefox while annotating by @ruaridhw in #1660
      • fix(ui): style Ask AI dropdown options for dark themes by @Aayushyaash in #1658
      • fix(review): keep git and jj output color-free under color.diff=always by @backnotprop in #1662
      • fix(call-flow): run CallDiff with color-free git config by @backnotprop in #1663

      New Contributors

      • @Aayushyaash made their first contribution in #1658

      Contributors

      @ruaridhw tracked the Firefox table collapse down to a sticky float, measured it across browsers, and sent the fix.

      @Aayushyaash fixed the unreadable Ask AI dropdowns on Windows dark mode, with before and after screenshots.

      Community

      • @sholsinger diagnosed the 0-files review down to colorized git output and suggested the fix in #1661
      • @Toparvion tested Bitbucket review on a real team pull request and reported the popup, comment order, and timeout issues in #1583
      • @jdppettit reported the failing install, with a workaround, in #1655

      Full Changelog : v0.27.24...v0.27.25

   9. 🔗 Rust Blog Demoting i686 Windows targets to std-only rss

      With Rust 1.100.0, the following changes to 32-bit Windows targets will happen:

      • i686-pc-windows-msvc Tier 1 with host tools target will be demoted to Tier 1 without host tools.
      • i686-pc-windows-gnu Tier 2 with host tools target will be demoted to Tier 2 without host tools.

      Builds of the standard library will continue to be distributed, but host tools such as the compiler will be no longer available. i686-pc-windows-msvc as a Tier 1 target still undergoes CI testing.

      To build 32-bit Windows binaries, cross-compiling from a still-supported host toolchain (such as a 64-bit Windows ones) will be required from now on.

      Background

      Desktop and Server 32-bit only x86 CPUs are no longer sold for over 15 years, and general 32-bit Windows support has ended in October 2025. This means that the development platforms these targets are meant for hardly exist these days, and even if they do exist they typically aren't capable enough for development.

      Even on the modern x86_64 hardware, building i686 Windows toolchains has proven to be problematic. We have encountered compiler binaries crashing when built with the i686 MSVC target, and the GNU C++ toolchain failing with OOMs during LLVM build.

      Considering all these things, cross-compiling these targets from a better supported one is what we have found to be the best solution forward. As part of that, we stopped producing host tools for these targets. For the time being, the prebuilt standard library is still available, and in case of i686-pc-windows-msvc still tested on CI.

      What Changes?

      After Rust 1.100, it will no longer be possible to install toolchains on 32-bit Windows hosts. We recommend cross-compiling from a still-supported host (such as a 64-bit Windows toolchain) instead. Other 32-bit platforms are not impacted by this change.

      For more details about these demotions, see RFC 3999 for i686-pc-windows-msvc demotion, and MCP 1020 for i686-pc- windows-gnu demotion.

   10. 🔗 New Music Releases Imminence - Axis Mundi rss

       Imminence - a new release is available:

       • 2026-10-02: Axis Mundi (Album)

       Amazon: Canada | Deutschland | France | United Kingdom | United States

       Visit muspy for more information.

2. October 01, 2026
   1. 🔗 earendil-works/pi v1.0.0 release

      New Features

      • Fullscreen by default — The TUI now runs fullscreen. Set tuiMode to "regular" to keep the terminal's normal scrollback. See Terminal and display.
      • Leaner codemode — About 40% fewer prompt tokens, and errors that tell the model how to recover. See Codemode.
      • Image generation in codemode — Scripts call models.generateImages() with the session's credentials. See Generate images and Use image models.
      • Radius in/login — Sign in with Radius and set up its MCP server in one step. See Radius.
      • Anthropic copy code login — Sign in when the browser runs on another machine. See Authenticate interactively.
      • MCP OAuth hardening — oauth.authServerMetadataUrl, RFC 9207 iss checks, credentials per server, and step-up sign-in that keeps granted scopes. See Authenticate with OAuth.
      • Header-only quiet startup — quietStartup: "header" keeps the version and key hints and hides the rest. See Terminal and display.

      Added

      • Added an oauth.authServerMetadataUrl setting for MCP servers that advertise a wrong OAuth authorization server or none. Pi uses the configured metadata document instead of discovery (#10172).
      • Added quietStartup: "header", which keeps the startup header with version and key hints but hides the model scope line and loaded-resource listing.
      • Added models.generateImages() to codemode scripts. It runs image models such as OpenRouter's with the session's credentials and returns base64 image blocks that image() attaches to the result; usage counts toward the session cost like models.classify(). Extensions can call ctx.modelRegistry.generateImages(). See Use image models.
      • Added a copy code login method to Anthropic /login for headless setups where the browser runs on another machine (#10194 by @lucasmeijer).

      Changed

      • Changed the default TUI mode to fullscreen. Set tuiMode to "regular" or pass --tui-mode regular to keep the terminal's normal scrollback.
      • /login now offers "Sign in with Radius" at the top level, as the last option, with its status. After a Radius sign-in, /login offers to configure the Radius MCP server in the global mcp.json with "auth": { "provider": "radius" } and reloads. Cancelling a login returns to the menu it was started from.
      • The provider docs page is renamed to Providers, its "Cloud Providers" section is now "Provider Specific Config", and it documents Radius first.
      • MCP OAuth credentials are now stored per server name and URL, so MCP servers with the same URL can sign in with different accounts. Credentials stored by URL alone move to the first server that uses them (#10252).
      • Codemode costs far fewer prompt tokens: with the default tools and codemode active, a GPT-5.6 request shrinks from about 5,300 to 3,300 tokens. The codemode description lists the script globals in one line each and points to the new Codemode reference for the models API, which the model reads when it needs it. Declared tools say in one line how scripts call them and what the call resolves to, instead of repeating their full declaration, and the system prompt's codemode guidance and MCP server section are shorter.
      • Codemode errors now say how to recover: reading a tool or models member that does not exist names the close matches (tools.Bash suggests tools.bash), models.classify() and models.generateImages() reject malformed arguments with the expected shape, an unknown model points to models.getAvailableOfType(), an oversized store() value explains what the store is for, and a script that generates images without showing them gets a note. Scripts that probed for a tool with typeof tools.name must use "name" in tools.
      • /login and /logout now label providers without credentials as "not configured" instead of "unconfigured".
      • OAuth browser pages now show the color Pi logo.

      Fixed

      • Fixed MCP OAuth sign-in accepting an authorization response whose iss parameter names another authorization server; the code is now rejected before it is exchanged (RFC 9207).
      • Fixed MCP OAuth sign-in failing with Invalid scope when the token response contains "scope": "", and similar failures for other empty or null optional OAuth fields (#10266).
      • Fixed the sign-in URL printed by /mcp login not being clickable when it wraps (#10186).
      • Fixed --provider without --model being silently ignored and running the default model from another provider; it now fails with an error (#10236).
      • Fixed MCP servers that ask for more scope (insufficient_scope) requesting sign-in over and over. The new sign-in requested only the missing scopes, so the new token lost access the previous one had; it now keeps the granted scopes.
      • Fixed user messages in the transcript keeping two full-width copies of every rendered line; they keep one, with identical output.
      • Fixed /login and /logout labeling every OAuth sign-in, including Radius, as a subscription; only subscription-backed providers say "subscription", other OAuth sign-ins say "account".
      • Fixed the startup header logo rendering with gaps in Apple Terminal; it now shows a colored "Pi" with the version instead.
      • Fixed deferred MCP tools that tool_search loaded being dropped on resume and /reload even when their server reconnected before the next prompt, because the session restored its tools before the MCP servers reconnected.
      • Fixed the system theme making pastel palettes such as Catppuccin Frappe much more vivid; palette colors now keep their chroma (#10255, #10293 by @dgtlntv).
      • Fixed slash command autocompletion not triggering when the input starts with whitespace (#10218 by @haoqixu).
      • Fixed color bleeding past mouse selections and search highlights in fullscreen mode when a styled token ends at the highlight boundary (#10169).
      • Fixed memory retained per rendered message in the transcript; a long assistant message keeps about a fifth of the heap it kept before.
   2. 🔗 anthropics/claude-code v2.1.287 release

      What's changed

      • Added Claude Mods: plugins may now modify deeper behavior
      • Added You should know, a built-in mod where a side agent watches your back and flags things you or Claude might miss. Turn it on with /plugin enable cc-plugin-you-should-know@builtin (for first-party sessions with telemetry on)
      • Added an n:<text> filter to the agents view that matches session names and tasks; a filter now shows matches in collapsed sections and Enter opens the first match
      • Added prompt_text to the OpenTelemetry user_prompt event, a copy of prompt for backends that nest dotted keys; drop or mask it wherever you drop or mask prompt (#70763)
      • Added URL prompts from MCP servers on the 2025-11-25 protocol, for example to sign in. If a server no longer connects after this update, add "bareElicitationCapability": true to its MCP config entry
      • Windows: Added a startup warning when denying the Bash tool also turns off the PowerShell tool, so Claude has no shell tool
      • Self-hosted runner: Added a built-in gh api (REST only) for sessions that use Anthropic-managed git on macOS and Linux machines where the GitHub CLI is not installed
      • Fixed fast mode staying off in remote sessions owned by an agent with no user account, even when the organization allows it
      • Fixed Remote Control not receiving messages for minutes at a time when a reconnect request got no response; it now gives up after 30 seconds and retries
      • Fixed hooks configured with asyncRewake waking Claude over and over with "found issues" notifications when the hook's script file is missing; the broken hook is now reported once
      • Fixed tool heartbeats not reaching SDK hosts while the model's response stream was stalled with no data arriving
      • Fixed Bedrock and Vertex startup model checks ignoring an enforced availableModels list, which could collapse /model to one Opus row
      • Fixed the Claude in Chrome browser picker showing a JSON parse error when Chrome could not be reached
      • Fixed picking Fable in /model on a claude.ai login saving the current version's id, so your saved default now follows the newest Fable like Opus and Sonnet do
      • Fixed switching between Opus 5.5 and Sonnet 5.5 (/model, opusplan) rewriting earlier MCP tool announcements, which could drop earlier extended thinking
      • Fixed Amazon Bedrock Guardrails blocks that arrive mid-response ending the turn with an API error instead of the guardrail's message when the reply began with thinking
      • Fixed a dangerous rm (such as one on / or the home directory) losing its always-ask safeguard when the same command also redirected output to a ~ or wildcard path
      • Fixed claude -p and SDK sessions repeating a model fallback on every later message after the model was switched while a reply was running
      • Fixed a folder's CLAUDE.md being attached a second time after resuming a session or after a compaction
      • Fixed background sessions that could not be reopened from claude agents after the agent exited and removed the worktree the session was started in
      • Fixed /advisor pairing checks: Sonnet 5.5 can now advise Opus 4.7 and 4.8, and advisors the API would refuse are flagged up front instead of being silently dropped
      • Fixed Bash permission prompts showing internal parser names such as "Contains simple_expansion" instead of a plain explanation
      • Fixed a cause of fullscreen sessions on slow or busy machines exiting with "Claude Code exited after an unrecoverable interface error" while a scroll key was held in a long conversation
      • Fixed organization per-tool permission ceilings being silently dropped for an MCP tool named __proto__
      • Fixed Claude being told to page large MCP results saved as JSON with Read's offset and limit, which cannot split one long line
      • Fixed the commit attribution reminder being delivered inside a tool result after a compaction
      • Fixed screen reader mode leaving the cursor away from the typed text in search boxes (such as /resume and /permissions) and sign-in code fields
      • Fixed screen reader mode refusing Enter with nothing typed on /rewind's summarize options, whose added context is optional
      • Fixed screen reader mode showing a "Tab to amend" hint on approval prompts, where Tab does nothing
      • Fixed screen reader mode listing arrow keys that do nothing in /permissions and /mcp, and saying "Select with numbers" in empty menus or while a search box has the keys
      • Fixed screen reader mode leaving out the changed lines in file edit approval prompts and other diffs
      • Fixed screen reader mode sending the claude --teleport progress screen, and an MCP form field while it is being checked, to the screen reader again on every spinner frame
      • Fixed CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS not removing the structured-output format from session-title and prompt-hook requests, which Bedrock-backed gateways reject
      • Fixed screen reader mode leaving out the top lines of a second approval prompt, a changed /config row or the rejected-plan line when the previous screen was taller than the terminal window
      • Fixed --include-partial-messages sending a cut-short reply's message_stop late or never, so apps could show the reply as still in progress
      • Fixed claude agents sometimes not showing the permission prompt a background session is waiting on
      • Fixed /ultrareview giving advice about .git/info/attributes when the upload stops on a committed .gitattributes it cannot read, such as one saved as UTF-16
      • Fixed claude remote-control failing to register behind an HTTP proxy with a misleading "Check your organization permissions" error (#97352)
      • Fixed sandboxed Bash commands on Linux inheriting an open handle on the Claude Code executable
      • Fixed the running-tool dot and three spinners still moving with the "Reduce motion" setting on, and /rewind's confirm screen updating its "ago" time while you type a note
      • Fixed times in claude agents changing every second in screen reader mode; they now change at most every 10 seconds
      • Fixed a revoked claude.ai login showing a generic API Error: 401 instead of "OAuth token revoked"; in -p mode the error now starts with "Failed to authenticate"
      • Fixed /ultrareview upload refusals advising you to copy a variable named by a repository's settings file into your own user settings
      • Fixed --output-format stream-json and the SDK not streaming the turns of a context: fork skill run by typing /<skill> as the prompt, as they do for the Skill tool's fork
      • Fixed /feedback and /bug: the pre-filled GitHub issue no longer includes your recent error messages, and the confirmation screen now lists them as part of the report
      • Fixed claude plugin marketplace add --sparse and git-subdir plugin installs failing with "transport 'http' not allowed" when the repository is served over plain http
      • Fixed cloud sessions sometimes losing the earlier conversation when the session restarted while it was being compacted
      • Fixed a plugin reload that overlapped the startup --plugin-url download corrupting the session's cached copy of the plugin archive
      • Fixed /desktop quoting partial output when opening Claude Desktop timed out or printed too much output; the error now names the cause
      • Fixed an MCP connector tool call occasionally running twice, or the connector's calls failing until restart, when its server changed which MCP protocol version it supports
      • Fixed SessionStart hooks from synced plugins not running in new cloud sessions
      • Fixed the transcript's "N hooks ran" summary and the verbose debug log's matched-hooks count including Claude Code's internal callbacks, so one configured hook no longer shows as two
      • Fixed files Claude sends from cloud and Remote Control sessions failing when the upload finished just after the 30-second timeout; it now waits 35 seconds
      • Fixed repositories added mid-session in cloud and SDK sessions not loading their skills and plugins, and loading CLAUDE.md late, after Claude changed directory
      • Fixed PNG, JPEG and WebP images over 8,000 pixels on a side failing to send from a remote session; Claude now sends a scaled-down copy
      • Fixed messages sent from the Claude apps with 17 to 20 attached files delivering only the first 16
      • Fixed headless sessions reporting an MCP server as needing authentication after one refused call, even though later calls succeed
      • macOS: Fixed Remote Control sessions started with claude remote-control stopping mid-turn when the Mac went to idle sleep
      • Windows: Fixed interactive claude hanging or crashing with "Raw mode is not supported" when its input is piped or redirected; it now says why and exits (use -p for piped input)
      • Bedrock, Vertex, Mantle: Fixed model availability checks under CLAUDE_CODE_SKIP_*_AUTH sending a different Authorization header than real requests when ANTHROPIC_CUSTOM_HEADERS repeats it
      • Improved /config: settings that cycle show ‹ › and step both ways with ←/→, narrow terminals stack each value under its label, and PgUp/PgDn page the list
      • Improved plugin marketplace errors to say in plain words why a marketplace was ignored or refused, and what to do
      • Improved plugin listings to note when a plugin's dependencies were not installed, and updating a plugin now retries an install that did not finish
      • Improved the Claude apps gateway's error when Amazon Bedrock rejects a model ID: developers now see which model is unavailable, and the gateway log names the ID that was sent
      • Improved SDK sessions so a message sent with priority "now" no longer cancels a running web fetch or web search; it keeps loading in the background
      • Improved /memory: the left and right arrow keys now flip its on/off settings, such as Auto-memory
      • Improved /skill names typed mid-message: Claude is now told they are skills, including disable-model-invocation ones
      • Improved the contrast of the prompt input border in light themes and of the ❯ before your earlier messages
      • Improved delivery of files Claude sends from cloud sessions and Remote Control: an upload that fails on a timeout, a network error or a 502, 503 or 504 is now retried once
      • Improved what Claude says when a file cannot be sent for a reason that may be temporary: it now mentions that you can ask for the file again in a few minutes
      • Improved the prompt for a held message from another session to show the message between dashed lines, matching other permission prompts
      • Improved MCP and other tool permission prompts to show the tool call between dashed lines, matching file edit prompts
      • Improved MCP startup in headless mode: a remote server whose first connect fails transiently is now retried without waiting for the slowest server to finish connecting
      • Improved files Claude sends from a remote session: large files now stream from disk instead of being read into memory, and a file over the size limit is refused with the server's limit named
      • Improved the explanation Claude gives when the server refuses a file it sends from a Remote Control or cloud session, such as an oversized image
      • Improved handling of large MCP tool results: less memory, smaller session files, and no extra upload to count tokens for results far over the limit
      • Windows: Improved Bash tool speed by removing a subshell that ran before every command
      • Changed a shell write through a repo-committed symlink onto a sensitive file or out of the working tree to name where it lands and wait for a person, on lines with a ~ target too
      • Changed Opus 4.7+ and Fable to use a 1M context window by default on Bedrock, Vertex, Foundry and the Claude apps gateway, with no [1m] suffix (CLAUDE_CODE_DISABLE_1M_CONTEXT=1 keeps 200K)
      • Changed replies from claude agents to arrive as queued messages; slash commands other than /stop sent while a turn is running now run when it ends
      • Changed whole-tool Bash allow rules and allowing hooks to prompt for, not run, shell writes to files Claude Code's file tools refuse outright (the Anthropic profile store, the host credentials file)
      • Changed right-click paste on Windows and Linux, and middle-click paste on Linux, to happen when the button is released; moving the pointer away before releasing cancels it
      • Changed MCP server alwaysLoad: false to defer all of that server's tools behind tool search
      • Changed screen reader mode to write new or changed lines without first pausing with the cursor at the start of the line; set CLAUDE_AX_PREPARK_MS=50 to restore the pause
      • Changed automatic model switches after a flagged message to keep your current effort level instead of the new model's default
      • Changed waiting permission prompts to show oldest first, so a new prompt no longer covers the one you're reading (prompts with a countdown still open on top)
      • [VSCode] Added "Run in background" to a running command or sub-agent, to move it to the background and keep working
      • [VSCode] Added the output of background shells and Monitors to their cards in the agent map
      • [VSCode] Fixed settings dialogs blaming a timeout when Claude Code's reply was too large to confirm a save
      • [VSCode] Fixed reopening a cloud session that the side bar already brought to this machine opening it again in a new tab; the side bar is shown instead
      • [VSCode] Fixed the side bar's Web tab not listing cloud sessions started after the window loaded; a failed load now says "Remote server is not connected" instead of "No web sessions yet"
      • [VSCode] Fixed a tab restored after a reload starting a second Claude process on a conversation the side bar already has open; it now shows the "still open somewhere else" notice
      • [VSCode] Fixed tool-row file links, session-list links and two hints showing in plain text
      • [VSCode] Fixed a background agent's still-running command showing as failed once the main turn ended
      • [VSCode] Fixed a user's own /usage or /context command opening the extension's dialog instead of running when picked from the command menu
      • [VSCode] Fixed file links in the plan preview tab doing nothing when clicked; they now open the file like links in chat replies
      • [VSCode] Fixed opening a tool's input or output in an editor tab failing with "Timeout waiting after 1000ms" on remote hosts such as WSL when the tab is slow to appear
      • [VSCode] Improved the Manage plugins dialog: a failed marketplace add, remove or refresh now says what went wrong
      • [VSCode] Changed the Claude in Chrome "Enabled by default" switch to also connect the editor's own sessions, which still ask before browser actions
      • [Cloud sessions] Fixed occasional failures to fetch from or push to GitHub when GitHub briefly refused a newly issued access token
      • [Claude Tag] Fixed Claude posting a failure warning, such as a spend limit notice, in a Slack thread when a background event like GitHub activity woke it and nobody was waiting on a reply
      • [Claude Tag] Fixed Claude Tag's spend limits page in admin settings leaving out recently created and private channels in organizations with many channels
      • [Claude Tag] Improved Claude's task list in long Slack threads: background work no longer reposts it as a new message on its own, so people following the thread aren't notified
      • [Code Review] Fixed finding comments and their "Why this was flagged" text stopping mid-sentence; they now end on a complete sentence
      • [Code Review] Fixed Code Review skipping a pull request after a new push when its review had failed twice on the previous commit; it now reviews the latest commit
      • [Code Review] Improved the failed-review card on a pull request whose conversation is locked: it now says the lock blocked the review and that nothing was posted or charged
   3. 🔗 The Pragmatic Engineer The Pulse: RoR creator sparks new “death of coding by hand” debate rss

      Before we start: if you happen to be in San Francisco on Thursday, 5 November, join me on the System Update with The Pragmatic Engineer event. This is an evening with OpenAI, Linear and DoorDash and myself, organized by Sentry. We get into what AI-augmented automations they're running in prod, and how it's going, in an off-the record (that is: not recorded!) and raw conversation. Seats are limited, and you can RSVP here.

      ---

      Hi, this is Gergely with a bonus, free issue of the Pragmatic Engineer Newsletter. In every issue, I cover Big Tech and startups through the lens of senior engineers and engineering leaders. Today, we cover one out of four topics from the last week 's issue of The Pulse . Full subscribers received the article below seven days ago. If you 've been forwarded this email, you can subscribe here .

      The creator of Ruby on Rails, David Heinemeier Hansson, caused quite a stir last week with comments in his Rails World keynote, when he revealed that coding by hand is dead at his company, 37signals.

      This is a big deal because 37signals created Ruby on Rails, and they are known for their software craft there, especially when it comes to code quality. It's also a business that's 27 years old and is profitable. Despite that pedigree, DHH caused a stir among the dev community, saying:

      "At 37signals, a couple of weeks ago, we made the decision that it clearly means we 're done writing code by hand. We have gone pencils down on the idea that we were gonna write code by hand, as a normal course of business creating things.

      Writing code by hand at 37signals is now an exceptional state. It is like seeing a bug in Sentry: something here went wrong; why was the agent not able to produce what we wanted? Okay, maybe for a little while, we'll still get the old pencil out and dot it down for them, but then we fix the machine, we fix the factory, we get things going again. This is a recognition of what's already happening."

      DHH compared the maturation of AI tools into being highly capable at coding with the impact upon the craft of painting of the arrival of the camera:

      "On November 24th, 2025, we got the "Kodak Brownie" of our era. We got Opus 4.5. AI technology, accessible in a harness that many people could afford to use and experience for the first time what it's like to create software in pairing with a new form of intelligence. This was the tipping point for me. There was everything before November 24th, and then there was everything after. This is going to be the date that history books going forward will mark as the inflection point for the age of agents."

      He shared how 37signals has embraced a future where coding by hand is almost entirely absent:

      • Embracing native mobile apps instead of web: famously, 37signals is bearish on native iOS and Android apps and has built web versions instead. With AI, they are betting on native apps being much easier to be built with a small team and are already building new ones.
      • Moving backend services to Rust, not Ruby : This is due to performance reasons and because agents write good enough Rust. That's remarkable to hear from the creator of Ruby on Rails!
      • Ruby on Rails remains for web apps : 37signals is not leaving RoR behind, but only because Ruby on Rails' convention-over-configuration design makes it easy for agents to work with it.

      DHH closed by revealing that he no longer even thinks of himself as a professional programmer (emphasis mine):

      "I have retired from being a professional programmer. I think it was somewhere around 4 to 5 months ago, maybe March. I spent a quarter of a damn century chiseling code by hand and loving every moment of it. This is not something to look back upon with regret; this is something to look back upon with joy and accept that it is over.

      Writing code by hand is no longer an economically productive enterprise for the vast majority of programmers working at the vast majority of companies. On the other side of that is a new career as a professional maker of things, steering intelligence that was only available in science fiction up until a few moments ago.

      One of the things we're gonna have to revisit is everything we think we know about software architecture. The main tool that we've used for a very long time is abstractions. Abstractions don't make quite the same sense in the age of agents. The reason we did abstractions was in part not to repeat ourselves; well, now the price of repetition has gone to near zero."

      It's worth noting DHH's keynote chose a spicy topic for a conference attended by engineers who are personally and professionally invested in the craft of building software!

      Decline of coding by hand is long predicted

      In the first issue in The Pragmatic Engineer this year, on 6 January, I wrote:

      "When AI writes almost all code, what happens to software engineering? No longer a hypothetical question, this is a mega-trend set to hit the tech industry. (...)

      The bad news is that change will probably be rapid. It's barely been a year since the idea of Claude Code was born in Boris Cherny's head, and already similar tools like OpenCode, Codex, Factory, Amp, Cursor, and more capable agents are changing how software is written. Change has always been part of working in tech, but I cannot recall it being this fast, or happening across the whole industry at once!"

      I concluded that this change was on its way, based on my own experience of building software with Opus-4.6 and GPT-5.2, and from talking with experienced engineers who had resisted "AI hype" for good reason, but who had come to see that AI can now generate code that's "good enough" in many cases.

      Back then, I made a few predictions about what will happen when AI agents are producing most of the code for engineers:

      • Sloppier code
      • Weak software engineering practices hurting sooner
      • "Coders" who are not software engineers see less demand
      • Tougher work-life balance for engineers
      • Junior engineers pushed to become seniors, fast
      • Computer science education increasingly required for new hires
      • A massive explosion in code and software, for which someone must be accountable

      So far, it's a messy transition and we engineers are responsible and accountable for a lot more code that we didn't write, but which is in production anyway.

      Non-engineers also getting into agents

      At the end of January, I shared a deepdive that was pretty close to home for me: my brother's 30-person, 15-engineer startup, Craft Docs, made its own sharp pivot to AI by building their own AI harness for non-engineers - called Craft Agents - two weeks before Claude Cowork was released, and months before ChatGPT Work launched.

      Craft resisted the temptation to use AI when it did not feel productive, but with the model releases of November 2025, they found LLMs are not only useful for coding, but also for non-engineering work like customer support. In the deepdive, I went into more detail about non-engineering use cases (which engineers enabled) like:

      • Automatic triaging of bug reports with agents
      • Data enrichments added to all workflows
      • Customer support "skills" like processing feature requests
      • The marketing team building websites without devs
      • HR automating tedious work
      • Finance automating personal workflows

      Craft Docs seemed early to a trend that has become more widespread, by having both their own engineering and non-engineering folks onboard to an AI harness. Now, there are signs other companies are doing the same: at OpenAI, non- engineering units like finance, recruitment, and legal moved over to Codex in June 2026:

      Non- engineering teams moved over to use OpenAI 's AI harness, Codex (now renamed to ChatGPT Work.) Source: Inside OpenAI 's software factory

      In some ways, it could be comforting to know that it's not only software engineering where the tools and workflows are quickly changing: every other function in tech is experiencing the same!

      It 's messy right now

      Just last weekend, a rant by an anonymous engineer in Big Tech hit a nerve with many people in the industry. An engineer with the username voxium posted (emphasis mine):

      "The state of engineering right now is horrible. It has been half a month since I started a new role at a big company.

      Nobody knows anything here. The specs, code, tests, PRDs, tickets, resolution of those tickets, reports, etc., everything is made by Claude Code. Nobody on my team likes this.

      They are being forced to ship as much as they can. I have heard multiple times from higher management that pushing code is not a bottleneck, so why are we slow?

      People are working 12 to 13 hours a day just to press enter. Nobody is reading anything. Humans in corporate are doing nothing on their own.

      Everyone, literally everyone, from an L1 to an L7 engineer here is doing the same thing. Talk to Claude.

      There is no sense of victory. Nobody is resolving bugs. In reality, nobody is thinking anymore. Everything is done by LLMs. It is so soul-sucking.

      I would not mind it, to be honest, if we were at least given the time to check out the code and see what is going where. But no, the goal is to just ship. No matter what happens."

      This post rings true because it is happening at many places where there's more AI usage, engineers do "outsource" thinking to LLMs, and end up not caring about anything else except shipping something to production.

      Quality in decline

      Since the beginning of the year, the quality of software has been degrading pretty much everywhere, much of it caused by over-reliance on AI, or perhaps more accurately, the outsourcing of thinking and decision making to AI. In July, I moved my video podcast off of Spotify after a series of unexplainable outages, and Spotify's engineering team seemed to take no real pride or accountability in fixing the root causes of the issue.

      Only this week, Uber shipped a new feature to production in the Uber Eats app - a new way to select extras with your food order - with seemingly no QA testing:

      Uber Eats this week, when I attempting to order a burger. Can you spot two obvious, sloppy bugs on this page?

      Inside this new "add-ons selector" in Uber Eats, I noticed three bugs at once:

      • " Choose up to 999": no engineer, designer, or PM bothered to check what happens when a restaurant does not fill out a number on how many toppings to add, or adds a ridiculously large number. The most toppings that my screen allowed to be selected was six and not 999, so I could not even choose the option of 999 buns for my burger.
      • Sloppy overflow. A rule of thumb, during my time at Uber, was that text will never overflow, even when localized. Basilcummaynaise (basil mayo in Dutch) broke this rule but still shipped.
      • Functional bugs in the selector. I originally tried to order from my favorite Mexican place: a bowl with no rice or bulgur as the base. There's the option to select "rice", "bulgur" or "nothing" as the base, but selecting "nothing" counts as an extra side, and the app doesn't allow the ordering of a bowl with no base.

      I've used the Uber Eats app for years, and this was the first time I saw such a sloppy feature release. I assume that devs and PMs building it have all "checked out", stopped doing proper QA, and assume that the agent will take care of all of it. There's no other way to explain three bugs shipped to all customers but seemingly noticed by nobody until I posted about it. To the Uber Eats team 's credit, they reached out and are looking into fixing all three issues.

      Software engineering to be more important than ever

      I'm personally past the shock and grief stages of agents taking over the activity of coding. At first, I assumed this change would reduce the amount of work for engineers. But, counter-intuitively, that actually seems to be growing:

      • We need to understand the characteristics of LLMs better. LLMs feel familiar as they can produce text in a way only humans could do before. But they are less reliable, still prone to hallucination, suffer from capability gaslighting, and many other problems. They can also be expensive and slow.
      • New systems need to be engineered. Agentic "software factories" can now produce code, based on the input provided. But how is this code validated? How much can detecting defects or various issues be automated? This is a brand new area, and we need to build new types of systems, often based on old ideas. One such example is OpenAI's software factory, the other one is Ramp's Inspect internal coding harness.
      • Nondeterministic LLMs can generate deterministic code. An area I feel is under-explored and under-appreciated is the use of LLMs to substitute LLMs usage in agentic "software factories" with deterministic code they generate. For example: instead of running AI code review that is expensive and slow on all PR requests, could AI generate linters that catch the majority of common issues? If this is possible, complex lint rules would run faster, be more reliable and cheaper to execute than LLM calls.

      New categories of systems and products will be built by engineers who "get" LLMs and AI engineering. We are seeing the majority of venture funding pour into AI companies because AI creates new business models, new revenue streams, and disrupts "traditional" software. For example, who would have thought that companies would spend tens of thousands of dollars, per engineer, on AI coding tools? Or that the category of AI inference providers would become as massive as it already is from barely existing two years ago?

      This technological change will re-jig parts of the tech industry: the winners will surely win big, and teams and companies choosing inaction could be out- executed and displaced by nimble competitors. And in many ways, this is great news for us software engineers who keep up with the technology. Companies are now investing in innovation and are willing to pay top-of-market for software engineers who can help them build AI products or become AI-native.

      ---

      Read the full issue of The Pulse this is from, or check out this week 's The Pulse. This week's issue covers:

      1. Firebase: global outage & poor handling by Google. The Firebase iOS SDK crashed after a backend change, crashing all apps which used Firebase analytics for 2-6 hours. Google did not update the status page or offer any postmortem, which is a head-scratcher from a company known for standout incident management practices.
      2. OpenAI 's platform play from AWS playbook? OpenAI is becoming a platform where it's possible to allocate ChatGPT spend on open models and AI offerings from among 16 partners, not just OpenAI models. It's fair to ask if Anthropic will consider a similar platform play.
      3. More data on companies moving to open models. Vercel's AI gateway shows 60% of model spend goes to open weight models, and OpenRouter also shows open models are being more used than closed ones.
      4. Why CTOs and VPEs are quitting en masse: another take. What if it's not "founder mode", but about people who love building software, feeling like they can do it solo (or with a small team) with AI tools?
   4. 🔗 @HexRaysSA@infosec.exchange The IDA 9.5 Beta is live! mastodon

      The IDA 9.5 Beta is live!
      ◾ IDA MCP + Assist for agentic RE
      ◾ New TriCore, Hexagon and DEX/ODEX decompilers
      ◾ Recursive decompilation
      ◾ New Malware Analysis add-on
      ◾ And more...

      Beta members: it's in your Download Center now.

      Not in the Beta program? Join from the customer portal today.

      https://hex-rays.com/blog/ida-9.5-beta-is-available

   5. 🔗 Hex-Rays Blog IDA 9.5 Beta is available rss

      

      IDA 9.5 Beta is now available

      The IDA 9.5 Beta is live, starting today. If you're part of our Beta Program, the new build is already waiting in the Download Centerof your customer portal, so you can put it to work right now. Not enrolled yet? You can join the program in a few clicks from your customer portal dashboard, and your testing is what tells us a feature is ready for production, where a regression slipped in, and what still needs sharpening before release.

      

   6. 🔗 r/Harrogate Moving to Harrogate need advice rss

      Hey everyone moving from Manchester what area is nice I don't drive so need to be around the shops and a ideal world near a bus route and a mosque any idea what area I should I look at

      submitted by /u/AlifanofmalcomX
      [link] [comments]

   7. 🔗 r/Harrogate Harrogate in it's glory days rss

      | submitted by /u/LowGuide2746
      [link] [comments]
      ---|---

   8. 🔗 exe.dev ETOOMANYTHINGS? Run Fewer Agents rss

      At a conference last week, I sat through a bunch of software factory demos, and they were all about task management. Kanban boards, Slack interfaces, email interfaces, dependency graphs, ticketing, graphical interfaces, you name it.

      Why is everyone building task management and calling it a software factory? Agents are slow to execute. And the obvious, easy fix to latency is to hide it by starting a new agent every time you get blocked.

      But concurrency is really rough on humans. It’s stressful. It trashes flow state and thrashes our mental page caches.

      Task management isn't a solution; it's a band-aid.

      This is a call to arms. Let’s make it possible to be equally productive with fewer agents.

      Bitter Lesson to the Rescue?

      As models improve, “good enough” models will get ever faster. This will naturally reduce latency, and in turn concurrency. We’ll still have to do some old-fashioned engineering, like making tests run fast.

      But we don't have to wait! Here are some things we’ve experimented with at exe.

      Use a Fast Model for Talking With Humans

      Start tasks with a powerful model. But instead of reading a wall of text and writing an essay in response, put all the comms in the hands of a fast, competent model like Luna 6. Give Luna no coding tools, and make its context window intentionally short and focused on what the human conversation requires. Then, when you go to check in on a task, you can have real-time discussions with Luna. With a fast feedback cycle, attention doesn’t wander, and you can stay engaged for longer. Eventually, Luna exhausts its ready information, and the beefier model takes back over, with rich, substantial user feedback to work from.

      This works reasonably well. But we found that, shock of shocks, absorbing information via chat was rather constraining. It was frustrating to have communications be squeezed through a tiny pipe. Luna might be an exciting, bendy straw, but it’s still a straw.

      Screen Recording

      That led us to focus on the HCI aspects of the problem. Back when I coded by hand, I would stare intently at screens full of text, processing it slowly, navigating freely between files, thinking. But the UI that is presented by most coding harnesses is a single linearized text thread, typically interspersed with lots of irrelevant tool call noise. There’s very little human agency or control, and no organization. You can’t even rely on the most important content being at the bottom: noise from straggler subagents often drowns out the agent's primary response.

      So: How can we restore human agency and optimize for human I/O, rather than making the human adapt to the agent?

      For input, the human retina is a powerful information processing system, when given structure to work from. That is, not a wall of text. I can still pick a Go panic stacktrace out of terminal logs scrolling by at 30fps.

      For output, even for the fastest typists, typing is typically slower than speaking. Also, typing requires coordination with lots of other parts of the computer. The text input window has to be focused. Your cursor must be in the right place. It constrains the other things you can do with your keyboard and mouse and what you can look at. Many coding agents, including Shelley, worked around this with affordances for annotating text, diffs, and web pages, but it still requires clicking, and it fundamentally requires cooperation from everything else.

      We recently launched a simple show-and-tell feature in Shelley that is tailored to humans. Click the camera button. Shelley records audio so that you can think out loud as you explore, and it records your screen. Anything on screen is a thing that you can point at, talk about, refer to. Poke around, muse, backtrack, trail off, resume, change your mind, whatever. Agents are extraordinarily good at understanding rambling.

      When you stop recording, Shelley transcribes all of your audio, including word-level timestamps, and makes a contact sheet from the video. It correlates your words with what was on screen when you said it. The computer does the hard work of collating all of the feedback.

      In my experience, this form of interaction is typically deeper, richer, longer, and more engaged than chatting with an agent. This is particularly useful for UI work or anything visual.

      DOM Recording

      What if you're not working on a visual task? The same ideas can be adapted nicely to other forms of engineering work.

      Another feature of human cognition is that we work well with concrete examples, not abstract descriptions. Agents are happy to be told, but humans prefer to be shown. Humans also benefit from diagrams, charts, and visually structured diffs.

      With this in mind, I have been using a slightly different system that we haven't shipped in Shelley (yet). Instead of spewing all its output to me in raw text, the agent generates an HTML artifact. This HTML is standardized to reduce visual noise, ruthlessly reduce verbosity and complexity, structure information visually, and make navigation easy. Typical sections include notable decisions made, open questions, examples, and git diffs.

      

      This HTML artifact includes a record button. When clicked, it records audio. Instead of using screen recordings, it uses a cheaper, more precise in-page DOM tracker JavaScript that tracks what is being viewed, scroll position, where my pointer is (if there is one), what text is highlighted, where I click/tap, all with timestamps. As before, it correlates timestamps with audio and feeds it all back to the agent.

      I find that this reduces mental overhead; I am freed to focus on the content.

      More Latency Hiding

      Because really engaging with content takes time, there is an additional latency-hiding trick one can pull. I am still experimenting with this, but the idea is to take prefixes of my feedback while it is still being recorded, send them to the agent, and livestream its responses back to a tab on the very same HTML artifact I'm already looking at. By the time I’ve spent 10 minutes reading and probing, I will inevitably have asked questions and provided provisional guidance. Before I context switch away, some of my questions have answers waiting. Some of my design decisions have follow-up questions. And the camera is still rolling. This sneaks in an extra round trip with the agent without breaking my concentration.

      There’s Still Work to Do

      I am not yet at a point where I have the same net throughput with one or two agents that I do with many, but my attention is being restored to me, little by little.

   9. 🔗 smol-machines/smolvm smolvm v1.22.1 release

      What's Changed

      • Bump libkrunfw to the guest kernel with conntrack marks so nft ct mark rules load by @BinSquare in #1493
      • Stop the workload wait ticker without waiting out its sleep by @LoganGrasby in #1495
      • Pin libkrunfw to the merged conntrack-mark commit on main by @BinSquare in #1494
      • Restrict serve mTLS clients by certificate subject CN by @BinSquare in #1499
      • Speed up restored starts with --keep-identity and RAM prefetch by @BinSquare in #1497
      • Preserve HTTP machine records when storage cleanup fails by @hfiguera in #1498
      • Give machine update the --outbound-localhost-only flag create has by @BABTUNA in #1500
      • Prefetch restored RAM and allow keep-identity restores in the embedded runtime by @BinSquare in #1502
      • Bump the workspace to 1.22.1 by @BinSquare in #1496

      New Contributors

      • @hfiguera made their first contribution in #1498

      Full Changelog : v1.22.0...v1.22.1

   10. 🔗 backnotprop/plannotator v0.27.24 release

       Follow @plannotator on X for updates

       Missed recent releases? Release | Highlights
       ---|---
       v0.27.23 | Bitbucket Cloud PR review, Question UI for answering agents in place, opt-in auto-update, viewed files remembered, review another repo or worktree
       v0.27.22 | Plans open the docs they link to, Claude review jobs locked down, Code Tour on Linux without Claude's sandbox, Pi reviews the latest plan
       v0.27.21 | Remote and phone sessions load several times faster, real Request changes on GitHub, model pickers show real names, OpenCode fixes
       v0.27.20 | Mistral Vibe support, annotate gets the full Options menu and Settings, jj Commits panel, long lines wrap in plan code blocks
       v0.27.19 | Before/After image previews in code review, file comments as GitHub file threads, forge-correct #123 links, /plannotator-last finds the right session
       v0.27.18 | Model pickers from your installed Claude and Codex (Opus 5.5, Fable 5.1, GPT-6), unsent PR review comments survive new pushes
       v0.27.17 | Diagram files open in the diagram viewer, OpenCode switches model with agent, idle review stops polling the git remote, Tree is the default review view
       v0.27.16 | Themed diagrams on Mermaid 12, comment on any node or edge, patch-file review, embedded HTML documents render
       v0.27.15 | Plannotator TUI and Herdr Annotate announcement, element context on pinpoints, HTML links open as linked documents, All files panel, Classic diff default
       v0.27.14 | Pi plan progress survives compaction, Codex threads across rollout files, WSL browser setting, Mod+E edit mode
       v0.27.13 | Open a review on a specific base (--base, --diff-type), symlink containment on /api/doc, CI flake fix, Amp decision relay

       What's New in v0.27.24

       A small fix release for two code review problems found while recording a walkthrough of v0.27.23.

       Image previews stay in the all-files view

       When a diff changed images, the Before/After previews in the all-files view disappeared after a short scroll, and the view jumped ahead to the code files. The list measured each image card as having no height, so it dropped the cards as soon as they left the top of the screen. The cards are now measured at their real size, so they stay in place and keep their height while you scroll up and down. Scrolling a large diff is as fast as before.

       (#1652)

       PR comment previews open on the commented line

       In the PR Comments panel, the small code preview under a comment showed the start of the changed block, not the line that was commented on. For a new file that meant lines 1 to 5, even when the comment was on line 28. This was most visible on Bitbucket, but long blocks on GitHub had the same problem. The preview now opens on the commented line and the three lines above it, or on exactly the lines of a range comment. "Show full context" still shows the whole block.

       (#1651)

       Install / Update

       macOS / Linux:

       curl -fsSL https://plannotator.ai/install.sh | bash
       

       Windows:

       irm https://plannotator.ai/install.ps1 | iex
       

       Claude Code Plugin: Run /plugin in Claude Code, find plannotator , and click "Update now".

       Pi: Update @plannotator/pi-extension to 0.27.24 and restart Pi.

       OpenCode: Clear cache and restart:

       rm -rf ~/.bun/install/cache/@plannotator
       

       What's Changed

       • fix(review): PR comment previews open on the commented lines by @backnotprop in #1651
       • fix(review): keep all-files image previews in the virtual list by @backnotprop in #1652

       Full Changelog : v0.27.23...v0.27.24

   11. 🔗 HexRaysSA/plugin-repository commits sync repo: +2 releases, -1 release rss

       sync repo: +2 releases, -1 release
       
       ## New releases
       - [ida-mcp](https://github.com/hexrayssa/ida-mcp): 20260930.0.1
       - [ida-nexus](https://github.com/hexrayssa/ida-nexus): 0.13.1
       
       ## Changes
       - [ida-codemode](https://github.com/hexrayssa/ida-codemode):
         - removed version(s): 0.6.0
       

   12. 🔗 Rust Blog Announcing Rust 1.99.0 rss

       The Rust team is happy to announce a new version of Rust, 1.99.0. Rust is a programming language empowering everyone to build reliable and efficient software.

       If you have a previous version of Rust installed via rustup, you can get 1.99.0 with:

       $ rustup update stable
       

       If you don't have it already, you can get rustup from the appropriate page on our website, and check out the detailed release notes for 1.99.0.

       If you'd like to help us out by testing future releases, you might consider updating locally to use the beta channel (rustup default beta) or the nightly channel (rustup default nightly). Please report any bugs you might come across!

       What's in 1.99.0 stable

       extern "C" variadics

       Rust 1.99.0 stabilizes defining C-ABI variadic functions with "C" and "C-unwind" ABIs. Variadic functions defined this way use a variable argument list (...) and accept an arbitrary number of arguments. Rust could already call externally-defined variadic functions (e.g., libc::printf). With Rust 1.99, these functions can now be written in Rust itself:

       /// SAFETY: must be called with (at least) 2 i32 arguments.
       unsafe extern "C" fn sum(mut args: ...) -> i32 {
           // SAFETY: guaranteed by the caller.
           let a = unsafe { args.next_arg::<i32>() };
           let b = unsafe { args.next_arg::<i32>() };
           a + b
       }
       
       fn foo() -> i32 {
           unsafe { sum(0i32, 2i32) }
       }
       

       The type of ... is VaList, which is ABI-compatible with the C va_list type across targets. What types can be read from a VaList is guarded by the VaArgSafe trait.

       For more details on c-variadic functions, see the Reference. This release also stabilizes support for defining naked variadic functions with non-"C" ABIs, which must be written via inline assembly.

       Layout information from raw pointers

       This release settles the safety requirements for retrieving the size and alignment on raw pointers to both Sized (trivially safe, already possible on stable) and non-Sized types.

       This is done by stabilizing three functions:

       • Layout::for_value_raw
       • mem::size_of_val_raw
       • mem::align_of_val_raw

       Recommend against round-trip unleaking after Box::leak

       While there are no changes to the language semantics in Rust 1.99, we have updated the documentation on Box::leak to recommend against patterns that later deallocate that memory. This was done because such code was found to have problematic interactions with current and future potential compiler optimizations, and is especially problematic with the upcoming stabilization of custom allocators. Instead, Box::into_non_null or Box::into_raw should be preferred.

       This guidance also applies to other leak functions in the standard library.

       Stabilized APIs

       • IntoIterator for Box<[T; N]>
       • IntoIterator for &Box<[T; N]>
       • IntoIterator for &mut Box<[T; N]>
       • VecDeque::retain_back
       • core::ffi::VaList
       • Box::into_non_null
       • Box::from_non_null
       • Vec::into_parts
       • Vec::from_parts
       • core::mem::size_of_val_raw
       • core::mem::align_of_val_raw
       • core::alloc::Layout::for_value_raw
       • String::from_utf8_lossy_owned
       • string::FromUtf8Error::into_utf8_lossy
       • FusedIterator for StepBy<I>
       • std::fs::set_times
       • std::fs::set_times_nofollow

       Other changes

       Check out everything that changed in Rust, Cargo, and Clippy.

       Contributors to 1.99.0

       Many people came together to create Rust 1.99.0. We couldn't have done it without all of you. Thanks!

   13. 🔗 Console.dev newsletter tinyjs rss

       Description: Native webview desktop apps.

       What we like: Not Electron, so no bundled browser - uses the system native webview (macOS WebKit, Windows WebView2, Linux WebKitGTK). Native chrome with system API access e.g. files, sockets, processes. Small app bundles (runtime is 6MB). Everything is HTML inside.

       What we dislike: Everything is HTML, so whilst the wrapper feels native, the app isn’t.

   14. 🔗 Console.dev newsletter celld rss

       Description: Self-hosted durable objects.

       What we like: Each object (server) gets its own isolated SQLite database. Supports function execution, k/v, queues, cron triggers. Backed by object storage. Compatible with Cloudflare primitives and config. Can be distributed, with state managed in storage.

       What we dislike: Still early, with limited fleet management functionality e.g. auto-scaling, etc.

   15. 🔗 Filip Filmar rules_openxc7: Open-Source 7-Series FPGA Toolchains in Bazel rss

       rules_openxc7 brings open-source FPGA synthesis and place-and-route for AMD 7-series chips into Bazel. It drives Yosys, nextpnr-xilinx, Project X-Ray, and openFPGALoader through the same target interface as rules_vivado. This post covers the toolchain architecture, how the rules translate Xilinx constraints, reproducible bitstreams, and how to swap between Vivado and open tooling in one line.

       Why open tooling in Bazel

       Building for FPGAs usually means one of two extremes. You either install a 100-gigabyte proprietary vendor suite, or you maintain fragile shell scripts around open-source tools. rules_openxc7 avoids both problems.

   16. 🔗 New Music Releases Nightwish - Tribal (live in Amsterdam 2022) rss

       Nightwish - a new release is available:

       • 2026-10-01: Tribal (live in Amsterdam 2022) (Single)

       Amazon: Canada | Deutschland | France | United Kingdom | United States

       Visit muspy for more information.

3. September 30, 2026
   1. 🔗 Quarkslab's blog Cato VPN Client: Split-Tunnel and Privilege Escalation (CVE-2026-10739) rss

      Introduction

      During a Purple Team engagement, we had to list and rank risky components across the network. One of them caught our attention: Cato Client, a VPN client program. It was installed everywhere. It runs privileged services. It talks to a GUI. It handles network configuration. From an attacker perspective, this is exactly the kind of software you want to understand. However, saying "this looks risky" is not enough. There is nothing better than PoC||GTFO. So the question was simple: can we find a real bug and turn it into something useful? This is how it started. And then my teammate sent me this message:

      💬 YV: "I have a new target for you. It has everything you like: named pipes, protobuf and .NET."

      He knows me well. That sounds like a fun challenge.

      This writeup covers a local privilege escalation in Cato Client. The bug starts in the split-tunnel upload feature, goes through a named pipe, and ends up with a SYSTEM shell.

      🧨 CVE-2026-10739

      Cato Networks SDP Client for Windows is vulnerable to Local Privilege Escalation.

      Confirmed on versions 6.2.0 and 6.4.6 on Windows. From vendor: any version before 6.12.6

      Cato & Split Tunnel

      Cato Client is the endpoint client used to connect users to Cato Cloud.

      One feature is split tunneling. Cato documentation explains that administrators can let users upload a text file to decide which IP ranges are included or excluded from the encrypted tunnel. The file contains an include or exclude mode, followed by IP ranges and masks.

      In the client UI, this feature appears as a local upload for the split tunnel configuration.

      
      Cato Client settings - split tunnel file upload.

      A minimal valid .ccst file looks like this:

      include
      10.10.10.0/24
      

      You can find more information about the split tunnel here.

      Walkthrough

      Discovery

      The first useful observation came from a normal upload.

      When a valid CCST file is uploaded, the client accepts it and the (privileged) backend creates split-tunnel state (.stp) under ProgramData.

      
      Valid CCST upload.

      So I tried the opposite: upload a file with invalid CCST content.

      The parser rejects it. That part is normal. But the cleanup path is more interesting: the generated split-tunnel file is deleted.

      
      Invalid CCST upload. The generated file is cleaned up.

      At this point, it is not yet a vulnerability. A privileged process deleting its own temporary file is not enough. Moreover, the destination directory has sane permissions. A limited user cannot just drop or replace things there:

      PS C:\ProgramData\CatoNetworks\SDPClient> icacls .\ST\
      .\ST\ AUTORITE NT\Systeme:(I)(F)
            AUTORITE NT\Systeme:(I)(OI)(CI)(IO)(M,WDAC,WO,GR,GW,DC)
            BUILTIN\Administrateurs:(I)(F)
            BUILTIN\Administrateurs:(I)(OI)(CI)(IO)(M,WDAC,WO,GR,GW,DC)
            BUILTIN\Utilisateurs:(I)(R)
            BUILTIN\Utilisateurs:(I)(OI)(CI)(IO)(R,GR)
      

      As there was no easy win in the filesystem permissions, the primitive was not "just write a symlink in ProgramData and win".

      The next question was: how does the low-privileged GUI ask the SYSTEM process to parse and delete those files?

      Named pipe time

      Our internal named pipe tool showed the answer: local IPC over a named pipe.

      
      Cato GUI talks to the service through a named pipe.

      The pipe is:

      \\.\pipe\cato-VPN
      

      The service-side process observed during the proof was:

      C:\Program Files (x86)\Cato Networks\Cato Client\winvpnclient.cli.exe
      

      and it runs as:

      NT AUTHORITY\SYSTEM
      

      Nice. A low-privileged process asks a SYSTEM process to parse a local file and delete cleanup artifacts.

      But direct access failed. We couldn't interact directly with the pipe. Sending commands from a random process to the pipe did not work.

      With the help of Ghidra, we can see the named-pipe server checks the process talking to it:

      GetNamedPipeClientProcessId(...);
      GetNamedPipeClientSessionId(...);
      

      The interesting part is what happens in the client-connected callback after that.

      The callback first checks if IPC certificate validation is enabled. If yes, it resolves the executable path from the connecting PID, then verifies the executable certificate:

      cVar2 = FUN_1401e5f20(...); // certificate check enabled?
      if (cVar2 != '\0') {
          FUN_140767200(local_88, ..., client_pid);
          cVar2 = thunk_FUN_140753b80(local_88, expected_cert, ...);
          if (cVar2 == '\0') {
              "%s: Failed to register client. Could not verify client certificate. Close connection.";
              FUN_14076fc50(...); // close pipe
          }
      }
      

      FUN_140767200 is the part resolving the client image path:

      hProcess = OpenProcess(0x1000, 0, client_pid);
      QueryFullProcessImageNameW(hProcess, 0, local_248, &local_294);
      

      The verification helper then parses the executable signature and compares certificate material:

      FUN_1407589d0(...);
      FUN_140758aa0(...);
      ...
      iVar2 = memcmp(_Buf1, expected_cert_material, size);
      

      Conclusion: a random process does not pass this check. The pipe connection needs to originate from a process image signed with the expected Cato certificate, unless certificate checking is disabled by configuration.

      Bypassing the certificate check

      This part seemed familiar. In the K7 writeup, the patch also tried to block random clients from talking to a privileged named pipe. Manual mapping a payload into a signed/trusted process was enough to get back inside the IPC path.

      Same idea here.

      The PoC starts a signed Cato process:

      C:\Program Files (x86)\Cato Networks\Cato Client\CatoClient.exe
      

      Then it manually maps a DLL payload into it. The DLL connects to:

      \\.\pipe\cato-VPN
      

      From the service point of view, the connection comes from a Cato-signed executable, so the certificate check is not a problem anymore.

      Protobuf, you said?

      The boring part was rebuilding the Protobuf messages required to talk to the service correctly. This is where AI was helpful: not to find the bug, but to automate repetitive message-building work once the protocol fields were known.

      The useful part came from the decompiled .NET client/common code. The Cato GUI ships generated Google.Protobuf classes under CatoCommon, and the service communication wrapper shows how the real client builds messages.

      From ServiceCommunication.cs:

      private void sendUiRegisterCommand()
      {
          ClientToService clientToService = CreateBasicMessage(ClientToService.Types.Commands.UiRegister);
          clientToService.UiRegister = new C2sUiRegister
          {
              UiProcessId = _processId,
              UiSessionId = _sessionId,
              UserSidString = _userSidString,
              AadUserUpn = _aadUserUpn
          };
          SendCommand(clientToService);
      }
      
      public void UploadSplitTunnelFile(string filePath, bool enabled)
      {
          ClientToService clientToService = CreateBasicMessage(ClientToService.Types.Commands.SplitTunnelUpload);
          clientToService.UploadStFile = new C2sUploadSplitTunnelFile
          {
              Filepath = filePath,
              Enabled = enabled
          };
          SendCommand(clientToService);
      }
      

      The generated protobuf classes then give the exact field layout.

      From C2sUiRegister.cs:

      public const int UiProcessIdFieldNumber = 1;
      public const int UiSessionIdFieldNumber = 2;
      public const int UserSidStringFieldNumber = 3;
      

      From C2sUploadSplitTunnelFile.cs:

      public const int EnabledFieldNumber = 1;
      public const int FilepathFieldNumber = 2;
      

      And ClientToService gives the oneof body fields and command IDs used by the PoC.

      From ClientToService.cs:

      public enum BodyOneofCase
      {
          UiRegister = 25,
          UploadStFile = 37,
          EnableLocalSt = 38,
      }
      
      public enum Commands
      {
          UiRegister = 34,
          SplitTunnelUpload = 49,
          LocalSplitTunnelEnable = 50,
      }
      

      So the actual work was mostly: extract the protobuf structure from the .NET code, identify the command IDs and body fields, then rebuild only those messages in the injected payload. The C payload source code is available here: CatoPipePayload.c.

      The bug

      After solving the pipe connection issue, the real bug is simple.

      As seen before, the .stp file is built using a user SID. However, this value is not derived from the real client token. It can be manipulated by the user inside the named pipe message. The problem: this client-supplied SID is used as part of a filesystem path.

      The generated split-tunnel output path looks like this:

      <split-tunnel-storage>\ccst_<client supplied SID>.stp
      

      That means the SID is treated as two things at the same time:

      • identity material;
      • a safe filename component.

      It is attacker-controlled, and ..\\ path components are not rejected.

      So instead of a real SID, the payload can register with something like this:

      \\..\\..\\..\\..\\..\\..\\tmp\\foobar
      

      The service then builds a path that still starts in the split-tunnel directory, but Windows normalizes the traversal and the final write reaches:

      C:\tmp\foobar.stp
      

      At this stage we have two related primitives:

      • with a valid CCST file: arbitrary file write as SYSTEM, with a forced .stp suffix ;
      • with an invalid CCST file: delete of the generated .stp path as SYSTEM.

      Obviously, the delete is the fun one.

      From delete to SYSTEM

      The cleanup path is reached when the uploaded CCST file is readable but invalid. To summarize, as a low-privileged user, the flow is:

      1. signed CatoClient.exe process origin
      2. cato-VPN named pipe certificate gate passes
      3. UiRegister with attacker-controlled UserSidString
      4. UserSidString reused in ccst_.stp
      5. path traversal escapes the split-tunnel directory
      6. SplitTunnelUpload points to an invalid CCST file
      7. parser fails
      8. cleanup deletes the generated .stp path as SYSTEM

      The last "problem" (which is not really a problem) is that we control the path for the delete operation, but the generated target has to end with .stp. Solution? Symlink, of course. We only need to redirect this privileged delete to something useful.

      The PoC uses the well-known C:\Config.Msi Windows Installer rollback technique. The idea is documented by ZDI and was also used in previous file/folder delete LPE chains.

      The Cato-specific redirection is:

      C:\poc -> \RPC Control
      \RPC Control\deleteme.stp -> \??\C:\Config.Msi
      

      Then the malicious SID points the generated .stp path to:

      C:\poc\deleteme.stp
      

      When Cato cleanup deletes that path as SYSTEM, it reaches:

      C:\Config.Msi
      

      Procmon evidence showed:

      

      After that, the Windows Installer rollback chain does the rest and gives code execution as SYSTEM.

      The autonomous proof of concept

      The final PoC is an autonomous wrapper:

      It embeds:

      • the MSI rollback payload;
      • the rollback files;
      • the Cato pipe payload DLL.

      Expected flow:

      1. Prepare the Windows Installer rollback state under C:\Config.Msi.
      2. Create the C:\poc\deleteme.stp -> C:\Config.Msi redirection.
      3. Manual-map the embedded Cato pipe DLL into signed CatoClient.exe.
      4. Trigger split-tunnel upload cleanup with invalid CCST input.
      5. Wait for C:\Config.Msi to be deleted by winvpnclient.cli.exe as SYSTEM.
      6. Run the second MSI stage and launch the configured command.

      And the result:

      
      First LPE PoC.

      
      SYSTEM shell after the Cato delete and MSI rollback chain.

      Full video with a self-contained binary: CatoEOP.mp4

      Conclusion

      This one was fun because it was not a single obvious bug. The service did have a client check. The directory permissions were not broken. The cleanup delete only happens on invalid .ccst file upload. The named pipe was not open to everyone. But the chain was there:

      1. signed process origin
      2. SID path traversal over protobuf
      3. invalid CCST cleanup
      4. SYSTEM delete operation
      5. Symlink redirection
      6. SYSTEM shell

      This is exactly why I like turning risk assessment into exploitation. "This software is installed everywhere and runs privileged code" is a useful warning. But a working 0day LPE demonstration is much better. It proves the risk is not only a line in a report. I also have to say a word about AI in this one. It wasn't useful to find the bug, but it saved me a lot of time, probably a few days, to build a working autonomous PoC based on previous work.

      Disclosure timeline

      Below we include a timeline of all the relevant events during the coordinated vulnerability disclosure process with the intent of providing transparency to the whole process and our actions.

      • 2026-06-02 : Quarkslab reported the vulnerability to Cato Networks.
      • 2026-06-03 : The vendor acknowledged our report.
      • 2026-06-15 : Quarkslab requested an update, the vendor replied on the same day that the vulnerability was pending remediation by the engineering team.
      • 2026-08-06 : Quarkslab requested a tentative timeline for remediation.
      • 2026-08-06 : The vendor informed that the vulnerability was already fixed internally and the rollout was expected at the end of August. Asked Quarkslab to hold off disclosure until then.
      • 2026-09-16 : Quarkslab asked for a status update and a clear release date too coordinate disclosure.
      • 2026-09-29 : Quarkslab asked the vendor if a CVE was assigned to the vulnerability.
      • 2026-09-30 : The vendor informed that CVE-2026-10739 was assigned to the vulnerability.
      • 2026-09-30 : The vendor published a Security Announcement to customers.
      • 2026-10-01 : This blog post is published.

      References

      • Cve.org - CVE-2026-10739
      • Cato Networks - CVE-2026-10726 & CVE-2026-10739 that Impacts Windows Client Versions Lower than 6.12.6
      • Cato Networks - Routing with the Cato Client / Split Tunnel Policy
      • GitHub - CVE-2025-48799 (used as a main reference for PoC automation, thanks!)
      • PoC payload source - CatoPipePayload.c
      • Quarkslab - K7 Antivirus: Named pipe abuse, registry manipulation and privilege escalation
      • Quarkslab - Avira: Deserialize, Delete and Escalate - The Proper Way to Use an AV
      • ZDI PoC - FilesystemEoPs / FolderOrFileDeleteToSystem
      • ZDI - Abusing Arbitrary File Deletes to Escalate Privilege
   2. 🔗 backnotprop/plannotator v0.27.23 release

      Follow @plannotator on X for updates

      Missed recent releases? Release | Highlights
      ---|---
      v0.27.22 | Plans open the docs they link to, Claude review jobs locked down, Code Tour on Linux without Claude's sandbox, Pi reviews the latest plan
      v0.27.21 | Remote and phone sessions load several times faster, real Request changes on GitHub, model pickers show real names, OpenCode fixes
      v0.27.20 | Mistral Vibe support, annotate gets the full Options menu and Settings, jj Commits panel, long lines wrap in plan code blocks
      v0.27.19 | Before/After image previews in code review, file comments as GitHub file threads, forge-correct #123 links, /plannotator-last finds the right session
      v0.27.18 | Model pickers from your installed Claude and Codex (Opus 5.5, Fable 5.1, GPT-6), unsent PR review comments survive new pushes
      v0.27.17 | Diagram files open in the diagram viewer, OpenCode switches model with agent, idle review stops polling the git remote, Tree is the default review view
      v0.27.16 | Themed diagrams on Mermaid 12, comment on any node or edge, patch-file review, embedded HTML documents render
      v0.27.15 | Plannotator TUI and Herdr Annotate announcement, element context on pinpoints, HTML links open as linked documents, All files panel, Classic diff default
      v0.27.14 | Pi plan progress survives compaction, Codex threads across rollout files, WSL browser setting, Mod+E edit mode
      v0.27.13 | Open a review on a specific base (--base, --diff-type), symlink containment on /api/doc, CI flake fix, Amp decision relay
      v0.27.12 | Unified decision control, token hover cards, local-vs-remote diff, approval notes

      What's New in v0.27.23

      This release brings Bitbucket Cloud to PR review, lets agents put questions in a plan that you answer in place, and adds an opt-in setting that keeps Plannotator up to date for you. Code review also remembers which files you have viewed, can be pointed at another repository or worktree, and several fixes land for Pi and keyboard users. It contains thirteen pull requests, three of them from community contributor @oorestisime.

      Bitbucket Cloud pull requests

      PR review used to recognize only GitHub and GitLab links. plannotator review https://bitbucket.org/<workspace>/<repo>/pull-requests/<id> now opens a Bitbucket Cloud pull request with the same review experience:

      • the diff and a local checkout for full file access
      • existing comments, with their code context
      • image previews
      • Guided Review and Code Tour

      From the review you can post general and inline comments, approve, or request changes. Bitbucket has no command-line tool like gh, so Plannotator talks to its API directly with an Atlassian API token. Set PLANNOTATOR_BITBUCKET_EMAIL and PLANNOTATOR_BITBUCKET_TOKEN; the docs list the scopes the token needs.

      Under the hood, PR mode now runs through one provider per platform. The screen shows only what that platform supports, which is why the PR Artifacts panel is absent on Bitbucket. GitHub and GitLab were moved onto the same seam and behave exactly as before. We checked this by recording every gh call against real stacked PRs on the old and new code and comparing them.

      Not yet supported on Bitbucket:

      • replying to or resolving existing threads
      • syncing viewed files back to Bitbucket
      • stacked PRs
      • Bitbucket Data Center

      (#1641, toward #1583 and #671, requested by @Toparvion and @bahayden)

      Questions in plans, answered in place

      An agent can now put questions in a plan or document as :::question blocks with checkbox choices and a Recommended: line. Plannotator draws each one as a card. You can:

      • pick an answer, type your own under "Other…", add a note, or skip it
      • take the agent's suggestion with Accept recommended

      The header shows how many you have answered, and clicking that count jumps to the next open question. The sidebar lists them all.

      Answers travel with your feedback in an "Answers to your questions" section at the top. If answering questions is all you did, the main button reads Send answers. The agent is then told you answered its questions and asked to revise the plan, rather than being told the plan was rejected. Answers are saved like any other annotation, so they survive a reload and can be undone. Question and option text stays selectable, so you can still comment on the wording.

      The /plannotator skill teaches agents the syntax, including when not to ask. A document with no questions renders and exports exactly as before. If you already used :::question as an ordinary callout, it now renders as an answerable card. One limit to know: approving a plan in Claude Code passes no message to the agent, so answers given with Approve do not reach it. Plannotator warns you before that happens.

      (#1637, #1638, #1639)

      Opt-in automatic updates

      The "new version available" notice tends to appear while you are busy with something else. You can now turn on Keep Plannotator up to date in Settings, with "autoUpdate": true in ~/.plannotator/config.json, or with PLANNOTATOR_AUTO_UPDATE=1.

      With it on, Plannotator checks for a new release at most once a day, in the background, after a session has already started. It never slows down a hook or a command. When a newer version exists and no other review is open, it runs the normal install script for that exact version and writes the output to update.log. The next time you open Plannotator it tells you what version you are on now, or that the update failed and where the log is.

      The installer now remembers the flags you installed with, such as --minimal or --skip-codex, so an automatic update installs the same way you did. The install scripts also replace the binary safely while it is running: on macOS and Linux the new file is renamed into place, and on Windows the running copy is moved aside first. Auto-update is off unless you turn it on, and it skips development builds, the OpenCode and Pi packages, and binaries in folders it cannot write to.

      (#1636, closing #1634, requested by @drj613)

      Code review remembers what you have viewed

      Files you mark as viewed now stay viewed the next time you review the same branch, including after a restart or after sending feedback. A mark is tied to the exact contents of the file you saw, so a file that changed since then comes back unviewed. This works for local Git reviews and pull requests. Each mark is a small record in ~/.plannotator/review-progress/ that holds the file's path. Turn it off with PLANNOTATOR_REVIEW_PROGRESS=0 or { "reviewProgress": false }, and plannotator uninstall --purge removes it.

      Viewed marks are now kept per diff type. Viewed marks stored in older drafts are ignored once, the first time you open a review after updating.

      (#1632, closing #1136, by @oorestisime)

      Review another repository or worktree

      plannotator review ../other-repo and /plannotator-review ./worktrees/feature now review that directory without moving your agent session:

      • A folder inside a repository reviews the whole repository.
      • A folder that holds several repositories opens the combined workspace review.
      • Everything after that follows the chosen directory: staging, drafts, viewed marks, Guided Review and the feedback label.

      Extra words still work as before. /plannotator-review please check my changes, or even look at the api/users code, reviews the current repository and tells you which words it ignored. A mistyped path given on its own, such as ./backnd, stops with an error instead of quietly opening the wrong repository. A PR link anywhere in the words now opens that PR.

      (#1644, closing #896 and #1482, by @oorestisime)

      Additional Changes

      • Keyboard scrolling works as soon as a review opens. Down, Page Down, Space, Home and End did nothing in plan review and annotate until you clicked the document. They now scroll it right away, without moving focus or interfering with shortcuts, dialogs, comment boxes or vim mode. Code review is a follow-up (#1648, closing #1647, reported by @henriquegeremia).
      • No more Pi skill conflict warning. With both the install script and the Pi extension installed, Pi warned on every start that two plannotator skills collided. The extension now adds its copy only when no other one is loaded, so extension-only users still get the skill (#1643, closing #1642, reported by @tekumara).
      • OpenCode plugin on stable packages. The plugin now builds against the published @opencode-ai/plugin for OpenCode 1 and @opencode/plugin for OpenCode 2, instead of a nightly build. The published plugin is unchanged in behavior (#1640, closing #1196, by @oorestisime).
      • OpenCode 2 checked on every change. CI now installs a current OpenCode 2 and loads the packed plugin into it (#1631).
      • Link widgets for hosts. @plannotator/ui re-exports the editor's link-widget API, so apps that embed Plannotator's editor can draw their own chips for links (#1633).

      Install / Update

      macOS / Linux:

      curl -fsSL https://plannotator.ai/install.sh | bash
      

      Windows:

      irm https://plannotator.ai/install.ps1 | iex
      

      Claude Code Plugin: Run /plugin in Claude Code, find plannotator , and click "Update now".

      Pi: Update @plannotator/pi-extension to 0.27.23 and restart Pi.

      OpenCode: Clear cache and restart:

      rm -rf ~/.bun/install/cache/@plannotator
      

      What's Changed

      • ci(opencode): smoke the v2 plugin against a current OpenCode 2 by @backnotprop in #1631
      • feat(review): persist viewed-file progress across review sessions by @oorestisime in #1632
      • feat(ui): re-export linkWidgets for host link widgets by @backnotprop in #1633
      • feat: opt-in background auto-update by @backnotprop in #1636
      • feat(ui,core): in-document question blocks, core and ui by @backnotprop in #1637
      • feat(editor): question answers, history, progress chip, Questions panel, Send answers by @backnotprop in #1638
      • feat: question answers reach the agent by @backnotprop in #1639
      • chore(opencode): migrate plugin dependencies to stable APIs by @oorestisime in #1640
      • feat(review): Bitbucket Cloud PR review behind a PR provider seam by @backnotprop in #1641
      • fix(pi): stop the plannotator skill colliding with the CLI install by @backnotprop in #1643
      • feat(review): accept repository and worktree directory targets by @oorestisime in #1644
      • fix(editor): scroll keys work on load without clicking the document by @backnotprop in #1648
      • fix(review): path-shaped prose words no longer fail the review by @backnotprop in #1649

      Contributors

      @oorestisime contributed three of this release's pull requests. They built durable viewed-file progress for code review, moved the OpenCode plugin onto the stable OpenCode packages, and added directory targets to plannotator review, each with thorough tests and clear notes on the tradeoffs.

      Community

      • @drj613 asked for automatic updates in #1634, and @nclark added that they rarely update for exactly that reason
      • @Toparvion explained how their team uses Plannotator with Bitbucket Cloud and Guided Review in #1583, and @bahayden first asked for other PR platforms in #671
      • @dm3ch asked to review a specific worktree in #896, and @ben-reitz asked to pick a repository in a multi-repo workspace in #1482
      • @tekumara reported the Pi skill conflict in #1642
      • @henriquegeremia reported that keyboard scrolling needed a click first, with exact steps, in #1647
      • @sergical opened #1196 to move the OpenCode 2 adapter to the stable plugin API
      • @ashish921998 weighed in on keeping viewed state across review iterations in #1136

      Full Changelog : v0.27.22...v0.27.23

   3. 🔗 r/Harrogate HARROGATE EVENT THIS SATURDAY - 3RD OCTOBER rss

      | Hey team! Me again :) Just another reminder of the new event running this Saturday, 3rd October, at Major toms:) 8pm - late Come along have a chat, a drink & a dance 🫶 Hope to see you there ❤️‍🩹🦎 submitted by /u/EllsMcL
      [link] [comments]
      ---|---

   4. 🔗 earendil-works/pi v0.99.2 release

      New Features

      • MCP servers stay out of the way: servers with the default codemode exposure are no longer listed in the codemode description and no longer block the first prompt. They appear in a short system prompt section, and scripts find their tools with searchTools() and describeNamespace(). See Control tool exposure.
      • More MCP authentication options: oauth.clientName for servers that only accept known OAuth clients, and "auth": { "provider": "<provider>" } to authenticate HTTP servers with a provider's /login token. See Authenticate with OAuth.
      • Anthropic workload identity federation from the Anthropic SDK environment variables. See Use an API key from the environment.
      • /reload enables tools newly added to the defaultTools setting. See Tools.

      Added

      • Added a description field for MCP servers (pi mcp add --description), shown with the server in the system prompt and used to rank its tools in tool search, and a describeNamespace(name) codemode helper that returns a namespace's instructions and tool names. describeNamespace() and searchTools() accept a namespace as mcp__dev-radius, mcp__dev_radius, dev-radius, or dev_radius.
      • Added an oauth.clientName setting for MCP servers (pi mcp add --oauth-client-name) to change the client name sent during OAuth client registration, for servers that only accept known clients (#10226).
      • Added "auth": { "provider": "<provider>" } for HTTP MCP servers to send a provider's current /login token as the bearer token instead of using MCP OAuth. The token is read on every request, so provider refreshes apply. Only allowed in the global mcp.json and from extensions, and requires https except on loopback hosts.
      • Added Anthropic workload identity federation from the ANTHROPIC_FEDERATION_RULE_ID, ANTHROPIC_ORGANIZATION_ID, and ANTHROPIC_IDENTITY_TOKEN_FILE environment variables (see Providers) (#10177, #10242 by @philfreo).
      • /reload now enables tools newly added to the defaultTools setting. Tools removed from it stay enabled, tools turned off during the session stay off unless newly added, and --tools, --no-tools, and --no-builtin-tools still override the setting (#10245).

      Changed

      • MCP servers with the default codemode exposure no longer appear in the codemode description; scripts find them with searchTools(). codemode-deferred is now an alias for codemode. Use direct exposure for tools the model should see without searching (#10212).
      • The codemode description no longer includes deferred tools, tool counts, or MCP server instructions, so it no longer changes when MCP servers connect or change their tools. The tool_search description no longer lists the servers whose tools it can load, for the same reason. Servers are listed instead in an mcp_servers system prompt section with a one-line summary, updated at the start of each prompt; a changed section is appended to the conversation. Scripts read server instructions with describeNamespace() (#10212).
      • The first prompt no longer waits for MCP servers without direct tools. They connect in the background and are waited for when a codemode script names them, a script searches tools, or tool_search runs (#10212).

      Fixed

      • Fixed new sessions intermittently ignoring the saved default model, or warning that no models are available, when it belongs to an extension-registered native provider with a stored credential (#9962, #10190 by @davidbrai).
      • Fixed the /mcp sign-in URL not being clickable when it wraps across lines, by emitting it as a terminal hyperlink with a Cmd/Ctrl+click to open line like /login (#10186).
      • Fixed codemode image() accepting malformed base64 data or unsupported image types, which persisted an invalid image block that made every later provider request fail with HTTP 400 (#10215).
      • Fixed codemode failing to start its script worker from the standalone Windows executable (#10204).
      • Fixed prompt submission slowing down with session length, because resolving the session's model selection looked up the model catalog once per assistant message (#10198).
      • Fixed model lookups slowing down for providers with a refreshed pi.dev catalog, because merging remote catalog models took quadratic time.
      • Fixed the built-in-tool-renderer.ts and minimal-mode.ts extension examples removing the built-in tools' summaries and guidelines from the system prompt (#10072, #10193 by @christianklotz).
      • Fixed context overflow detection for Z.AI CN endpoint Prompt exceeds max length errors (#10208).
      • Fixed Anthropic requests failing when a tool schema uses keywords Anthropic strict tool use rejects, such as minimum/maximum; such tools are now sent non-strict (#9953).
      • Fixed provider retries firing immediately when a Retry-After header contains an unparseable date; they now use exponential backoff (#9571).
      • Fixed extension commands registered without a string name or handler crashing pi when typing /; the extension now fails to load with an error instead (#10054).
      • Fixed collapsed codemode and MCP tool results filling the screen when the output is one long line, such as minified JSON. Like bash output, the preview is now limited to wrapped lines instead of logical lines.
      • Fixed codemode.mode: "only" listing read, bash, edit, and write in the system prompt's tool list although requests only declare codemode (#10192).
      • Fixed codemode scripts calling the wrong MCP tool when two tool names differ only in - and _, such as read-file and read_file. Like in Codex, MCP tool and namespace names now replace - with _ (mcp__my-server__x is now mcp__my_server__x), colliding tools of a server all get a hash suffix, and server names that differ only in - and _ are rejected (#10239).
   5. 🔗 anthropics/claude-code v2.1.286 release

      What's changed

      • Added a count such as "2 of 5" to the permission prompt when several permission requests stack up
      • Added mouse support for the "N more" rows of lists in fullscreen mode: click one to jump to that end of the list, with hover and pressed states
      • Fixed several Claude Code processes and IDE extensions each opening a login browser when gcpAuthRefresh or awsAuthRefresh credentials expire
      • Fixed claude --resume and --continue sometimes losing every turn after a batch of parallel tool calls when the earlier session crashed or was killed
      • Fixed API 400 errors after a tool or hook returned an object, number or boolean instead of text, including in resumed sessions
      • Fixed cloud sessions with very large histories never waking up because the container was stopped while the transcript was still loading
      • Fixed the Claude apps gateway's spend meter pricing 1-hour prompt cache writes at the cheaper 5-minute rate, and counting only the first model call's input tokens on streamed turns that run a server-side tool such as web search
      • Fixed macOS sessions still showing "Not logged in" or "Login expired" after /login succeeds in another Claude Code window when a leftover ~/.claude/.credentials.json exists
      • Fixed every turn failing when the Anthropic API refuses the model your default or a model alias resolves to: Claude Code now retries once on the previous model of the same tier
      • Fixed Remote Control sessions (including claude remote-control) staying connected after your organization's policy turns Remote Control off; they now disconnect with a notice
      • Fixed refusal and --fallback-model retries failing when the fallback model can't run fast; they now run at standard speed, with a one-time notice in interactive sessions
      • Fixed headless sessions repeating the "MCP servers require authentication" reminder after a successful re-authentication when the MCP discovery cache is enabled
      • Fixed claude auth status reporting a Console sign-in's stored API key as claude.ai; it now reports api_key, and the VS Code extension treats that session as an API key session
      • Fixed /status listing an Anthropic profile beside an API key as if both were in effect; the profile is now marked as not in use
      • Fixed Claude not being told when a file attached to a message sent over Remote Control did not arrive, and a file sometimes getting only 10 seconds for its last download try
      • Fixed a Remote Control message that arrived while Claude Code was exiting being marked delivered and then never answered; it now stays queued for the session's next run
      • Fixed MCP error messages showing a credential's value when "Bearer" or "Basic" came before its key name
      • Fixed percent-encoded Bearer tokens being only partly masked in error messages
      • Fixed redacted logs and transcripts showing a secret whose key name has an invisible character inside, such as a zero-width space
      • Fixed logs and transcripts showing part of a URL password that contains punctuation such as ), quotes, ], & or a second @, or that runs past a / to a bracketed host such as [::1] in an ssh URL
      • Fixed the session transcript in the zip that /feedback saves to disk containing invalid JSON lines after secret redaction
      • Fixed MCP connectors listing no tools for up to a day after their server dropped the older MCP handshake
      • Fixed a repeat MCP sign-in request from Claude replacing the pending sign-in link, which could stop that link from working
      • Fixed /usage not crediting an MCP server for a tool call made while that server was still connecting or had only just connected, such as right after a restart
      • Fixed plugins enabled on claude.ai occasionally going missing from Claude Code for a session after a transient server error
      • Fixed a message typed into a running subagent showing twice in its transcript after the subagent read it
      • Fixed subagent hand-back messages showing a raw task id instead of the agent's name when the subagent had no registered name
      • Fixed foreground subagents sometimes missing the task-tracking tools (TaskCreate/Get/Update/List, TodoWrite) in sessions that have them enabled
      • Fixed subagents spawned with worktree isolation loading the project CLAUDE.md and its imports a second time from the worktree copy on their first file read
      • Fixed Workflow tool subagents being restarted from their original prompt when a connection stalled for a few minutes mid-response
      • Fixed /compact, /clear, and /rewind typed while viewing a background agent's or teammate's transcript silently acting on the main conversation: a dialog now names the target and asks first
      • Fixed background jobs showing done while waiting for your approval
      • Fixed the commit attribution reminder being re-sent inside tool output when a model fallback lasts only one turn
      • Fixed a click on the space between words of a collapsed row (such as "Thought for 4s") highlighting the row without expanding it in fullscreen mode
      • Fixed a row with no details, such as an action row with a long name, pushing every other row's details to the right in list screens
      • Fixed files with very long names not reaching a cloud session when attached to it
      • Fixed plugin errors for a marketplace Claude Code refuses to load: they now say why and how to fix it instead of "not found"
      • Fixed /plugin's Discover tab showing a marketplace name unquoted in its "Checking … for new plugins" line when its rows already show that name in quotes
      • Improved commit guidance: when your project or user skills include one named verify, Claude is now told to run it right before committing, except for docs-only and tests-only commits
      • Improved send now (ctrl+enter) in a subagent's view: it now moves the subagent's running command to the background so your message is read right away
      • Improved replies from background agents to your messages so they no longer open with a separate recap of what you said
      • Improved claude.ai artifact link reads: WebFetch now asks the same questions as the Artifact tool's read (no artifact prompt while the session's network access is on, one per artifact while it is off), and an auto-mode yes no longer counts where only you can answer
      • Improved fetch, skill, file read, sandbox network, Claude in Chrome, workflow script and notebook edit permission prompts to match the look of file edit prompts
      • Improved Bash, PowerShell and Monitor permission prompts to show the command between dashed lines, matching file edit prompts
      • Improved list scrollbars in fullscreen mode: in most lists the bar no longer shifts as the "N more" rows come and go, and it now has ↑/↓ arrows you can click or hold to scroll
      • Improved the external editor (Ctrl+G): editors that take a line number now open on the line your cursor is on in the prompt
      • Improved slash command suggestion responsiveness while typing when many skills or plugin commands are installed; command descriptions now match by word prefix
      • Improved the output style picker: it now opens on your current style instead of Default, with each style's description on the line under its name; number keys no longer pick a style
      • Improved /hooks: the closing line of a hook's detail screen now says "this hook" instead of "it"
      • Improved the model fallback notice and the autocompact-thrashing error to say when a fallback dropped the context window from 1M to 200K tokens
      • Improved responsiveness of SDK and -p sessions when a host re-sends an MCP server enable for a server that is already connected
      • Improved the protocol page a Claude apps gateway serves at /protocol: it now says not to reject unknown input and matches what Claude Code sends today
      • Changed prompts sent while nothing is running or queued to show in the normal text color right away instead of gray
      • Changed how failed API requests are retried: one limit now covers a whole model call, so with the default retry settings a failing call sends at most 14 requests
      • Changed --bare to connect only the MCP servers named on the command line, send the model no system reminders, and start no background tasks; under --bare, a shell command that reaches its timeout now stops instead of moving to the background
      • Changed the send-now key (ctrl+enter) to move a skill's own shell command to the background instead of ending it
      • Changed the WebFetch error for a rate-limited domain safety check to tell Claude not to retry it in a loop
      • Changed plugin installs to refuse npm sources that are git repositories or folders, and to install plugin dependencies only from registry packages
      • Changed list screens (/artifacts, /mcp, /skills, /hooks and others) to always line up each row's details in one column after the names
      • Changed the overflow rows of lists to read "↑ N more" / "↓ N more" instead of "N more above" / "N more below"
      • Changed /hooks to open on one list of your configured hooks grouped by event, so viewing a hook takes one Enter instead of three
      • Changed the theme picker to a scrolling list that fits your terminal instead of pushing the preview off screen; number keys no longer pick a theme
      • Changed /exit's Remove worktree to run after Claude Code stops the servers and shells it started there, which on Windows could keep the folder from being deleted
      • Changed the claude-api skill's Managed Agents examples to create environments with limited networking
      • Removed the browser link from /ultrareview and claude ultrareview output
      • Windows: Fixed claude --bg and the agents view refusing a folder that claude already trusts when its trust record was saved with different letter case
      • [VSCode] Added bookmarks: save Claude's responses and keep them in view in a Bookmarks side panel
      • [VSCode] Added the questions Claude asks and your answers to the conversation: after you answer a question card, a Questions row shows each question with your picks
      • [VSCode] Added option previews to question cards in the chat panel: the highlighted choice's mockup or snippet shows beside or under the options
      • [VSCode] Added rows under a message that open to the terminal output, browser tab, browser instructions and selected code sent with it
      • [VSCode] Fixed a second copy of a conversation opening in a tab when it was already open in the side bar; the side bar now switches to it
      • [VSCode] Fixed settings dialogs reporting a failed save, without re-checking, when Claude Code printed more than 1 MB of output
      • [VSCode] Fixed an endless "Teleporting session…" spinner when the extension stops responding
      • [VSCode] Improved the Manage plugins dialog: it says when a turned-off plugin is still on because of other settings, and explains a plugin folder clash
      • [VSCode] Changed Stop and Escape to end only the current turn; background agents keep running and can be stopped one by one from the agent map
      • [VSCode] Changed the "✻ Claude Code" status bar item to show in every window, so you can open Claude when no file is open
      • [Cloud sessions] Fixed an answered question card or approved tool call getting no reply when the session had gone idle after Claude sent a message
      • [Cloud sessions] Fixed clearing an organization environment's setup script in admin settings leaving new cloud sessions still running the old script
      • [Cloud sessions] Fixed the Runner actions menu on the self-hosted environments admin page closing on its own a few seconds after it opened
      • [Cloud sessions] Fixed routine runs whose cloud session never started showing as Succeeded in the Runs pane, the routine's page and the sidebar; they now show as Failed
      • [Cloud sessions] Fixed clicking an audio or video file in a cloud session's Outputs card opening an empty file search instead of playing the file
      • [Cloud sessions] Changed a routine's page to read "Due" with the scheduled time, instead of a next run time in the past, when a scheduled run is late and hasn't started
      • [Claude Tag] Added an Add channel button to Claude Tag's spend limits page in admin settings, so a limit can be set on any channel, including a private one, from its channel ID or Slack link
      • [Claude Tag] Fixed memory recall finding nothing in organizations that cannot use the default Sonnet model
      • [Claude Tag] Fixed a Slack channel losing its Claude settings when an Enterprise Grid admin moves it to another workspace and the first post afterward doesn't mention Claude
      • [Claude Tag] Fixed Claude in a Slack thread occasionally starting over on a fresh machine, losing work it hadn't pushed, when your reply answered a question it had just asked
      • [Claude Tag] Fixed public channel names on Claude Tag's spend limits page in admin settings showing as raw Slack IDs in larger organizations
      • [Claude Tag] Improved the titles of sessions started from Slack as shown on claude.ai: they now read as the words you typed, without Slack user IDs or escape codes
   6. 🔗 exe.dev Show and Tell: Shelley rss

      Shelley learned a new trick recently: instead of typing a prompt, you can record both your speech and your window (or screen). Once you stop recording, Shelley puts together the transcript and the matching video, and hands that off as the prompt to the agent.

      

      You have to see this to believe it. Shelley had a bug where if you sent off a “Compact and Send” and navigated to a different conversation, the navigation would revert back to the original one. I could have described it, but after it happened to me, I started a new conversation, and took the following recording:

      Your browser does not support the video tag.

      The recording is not edited except my shortcuts and URL bar are cut off, some commentary is added below, and it’s sped up. It’s painful to watch (especially for me!): all of those ums, and figuring out what to click to reproduce, and so on. And yet, the next message from me in that conversation was “push.” The agent was able to reproduce based on what it saw and fix the bug, in one-shot, and I typed nothing.

      Give it a ~~shot~~ screen recording!

   7. 🔗 Cryptography & Security Newsletter Get Ready for Seven-Day Certificates rss

      With the groundwork for the post-quantum migration of key establishment behind us, browser vendors are increasing their efforts on the remaining parts: post-quantum authentication. (If you haven’t been following the events surrounding post-quantum migration, our newsletter from two months ago has a quick recap. Read it before continuing here.)

   8. 🔗 smol-machines/smolvm smolvm v1.22.0 release

      What's Changed

      • Seed image machines on macOS and in the SDKs by @BinSquare in #1486
      • Serialize the tests that depend on SMOLVM_MACHINE_NAME by @BABTUNA in #1490
      • Seed ephemeral machine run from the shared image seed by @BABTUNA in #1491
      • Let a machine stop itself when its workload exits by @BinSquare in #1444
      • Cache recent checkpoint restores and add checkpoint-warm by @BinSquare in #1492
      • Bump the workspace to 1.22.0 by @BinSquare in #1487

      Full Changelog : v1.21.1...v1.22.0

   9. 🔗 smol-machines/smolvm smolvm v1.21.1 release

      What's Changed

      • Stream macOS checkpoints sparsely so saves scale with memory in use by @BinSquare in #1484
      • Reword the README description, add an SDK example, and explain shared responsibility by @BinSquare in #1483
      • Bump the workspace to 1.21.1 by @BinSquare in #1485

      Full Changelog : v1.21.0...v1.21.1

4. September 29, 2026
   1. 🔗 smol-machines/smolvm smolvm v1.21.0 release

      What's Changed

      • Let machine update change a stopped machine's egress allow list by @BinSquare in #1471
      • Bump the Nix package to 1.20.2 by @BinSquare in #1472
      • Support Windows memory checkpoints and frozen branches by @BinSquare in #1474
      • Restore a checkpoint's layered disk as a copy-on-write top instead of copying its top layer by @BinSquare in #1475
      • Let a stopping server finish in-flight requests for a configurable grace by @BinSquare in #1473
      • Cut machine exec latency: wake on exit, stop crun re-cloning itself, fork less in the wrapper by @LoganGrasby in #1479
      • Speed up cold checkpoint restore by hashing during extraction by @BinSquare in #1480
      • Let embedders create detached machines and list every machine by @BinSquare in #1478
      • Key a restored machine's VMM uid on its own data dir by @BinSquare in #1476
      • Treat an empty machine start body as no body by @BinSquare in #1481
      • Start registry-image machines on a shared seed of their image by @LoganGrasby in #1477
      • Bump the workspace to 1.21.0 by @BinSquare in #1482

      Full Changelog : v1.20.2...v1.21.0

   2. 🔗 anthropics/claude-code v2.1.285 release

      What's changed

      • Added CLAUDE_CODE_DISABLE_WEB_FETCH environment variable to turn off the WebFetch tool
      • Added claude --desktop to open the Claude desktop app on the current directory, or on a session with --continue / --resume <id>
      • Added claude plugin configure <plugin> to show a plugin's options and which are unset, or save new values read from stdin with --values-stdin
      • Added <server>.<key>=<value> to claude plugin install --config, so a bundled .mcpb MCP server's own settings can be set at install time and it starts without visiting /plugin → Configure
      • Added allowedProviders managed setting to limit which API providers a machine may use (Anthropic API, a custom endpoint, Bedrock, Mantle, Vertex AI, Foundry, Claude Platform on AWS, or a Cloud gateway)
      • Added CLAUDE_CODE_NONSTREAMING_TIMEOUT_RETRIES environment variable to cap re-sends of a non-streaming fallback request that timed out
      • Fixed claude -p with CLAUDE_CODE_FORK_SUBAGENT=1: a subagent's own Agent call now runs in the foreground, so the subagent gets the child's result
      • Fixed plugin and marketplace installs and updates over SSH ignoring the ssh program set in GIT_SSH or in your git config's core.sshCommand
      • Fixed Claude Code refusing to start when the OS denies reading the managed settings file; it now warns and starts without that file's policies. Other read errors and unparseable files stop every session
      • Fixed cloud sessions that restarted after their conversation was compacted refusing the next update to an artifact the session had already read or published
      • Fixed claude plugin disable and enable with a full name@marketplace id changing a settings entry in another letter case instead of the installed plugin's own
      • Fixed files attached to a message sent over Remote Control being left out after a single failed download; a network error, timeout or server error is now retried up to twice
      • Fixed switching models mid-session with a set_model request (such as the Agent SDK's setModel) leaving the new model on the built-in output-token limit and auto-compact window until restart
      • Fixed redacted logs and transcripts showing part of a URL password that contains @, or all of it when the URL writes its @ as %40
      • Fixed SSH passphrase and new-host prompts from worktree and /teleport fetches taking over the terminal; these fetches now fail fast instead of asking
      • Fixed switching off an MCP server added mid-session in SDK and -p sessions leaving its tools available
      • Fixed claude -p --permission-prompt-tool: a background subagent's permission request now goes to the prompt tool instead of being auto-denied
      • Fixed claude mcp list and claude mcp get, and the not-found error of claude mcp remove, login and logout, printing line breaks and terminal escape sequences from MCP server names and values
      • Fixed sandbox auto-allow asking for approval on every run of many inline scripts (python3 -c, node -e) just because they contain =
      • Fixed fork subagents not keeping the session's plan mode or dontAsk mode: a fork now runs under its parent's permission mode and cannot exit plan mode
      • Fixed claude remote-control --help saying --[no-]chrome defaults to the machine's /chrome setting; spawned sessions keep Claude in Chrome off unless --chrome is passed
      • Fixed background subagents in auto mode prompting a second, redundant reply after each report
      • Fixed cloud session creation and /remote-env reading only the newest 20 of an account's environments
      • Fixed Remote Control marking a message as read as soon as it arrived instead of when Claude started on it, and losing a message still queued when the terminal quit (it now arrives on the next resume)
      • Fixed installing a plugin with claude plugin install or /plugin putting it into an installed plugin's cache or data folder when their ids differ only in ., -, @ or (macOS, Windows) capitals; the install is now refused
      • Fixed hooks and SDK permission callbacks seeing a missing or outdated plan on ExitPlanMode when the plan was written in the same response
      • Fixed the first reply in cloud sessions arriving tens of milliseconds late, a regression in 2.1.283
      • Fixed sessions that authenticate with ANTHROPIC_AUTH_TOKEN against the Anthropic API never loading the organization's policy
      • Fixed a failed agent(), parallel() or pipeline() call that a workflow script awaits later, or not at all, being treated as an unhandled promise rejection, which could end a background session
      • Fixed synchronous hooks hanging Claude Code while a background process the hook started (for example some-daemon &) kept its output open; the hook now finishes shortly after its own process exits
      • Fixed WebFetch reporting a rate-limited domain safety check as a network or enterprise policy block
      • Fixed the fullscreen ctrl+o transcript freezing briefly when opened on turns with hundreds of file reads or searches; tool calls still running when the transcript opens now show their results when they finish
      • Fixed Amazon Bedrock mid-stream modelTimeoutException and serviceUnavailableException errors showing a raw JSON body instead of the error message
      • Fixed /autofix-pr and /schedule saying the Claude GitHub App is not installed on a repository whose install status had not been checked yet
      • Fixed dismissing a row (x) in /artifacts unlinking its file from the artifact, so publishing the same file again created a new artifact instead of updating it
      • Fixed Artifact tool publishes after a conversation rewind (Esc Esc) overwriting a file's newer content that Claude had read only in the rewound turns; the publish is now refused until Claude re-reads the file
      • Fixed an Artifact allow rule ("don't ask again") letting the Artifact tool publish a file outside the working directories without asking; add the file's folder with --add-dir for the rule to cover it
      • Fixed /cost and SDK modelUsage reporting a turn under the wrong model when the server answered a refusal with a different fallback model than the client expected
      • Fixed the Artifact tool so that publishing a page no longer lets Claude overwrite its source file without re-reading it when Claude's earlier read was cut short or the file had changed since
      • Fixed auto mode skipping its classifier for Artifact tool asset uploads and reads of someone else's artifact when you had approved that artifact earlier in another permission mode
      • Fixed a misleading "core.worktree is set" error from /ultrareview when the project folder briefly could not be read
      • Fixed /ultrareview on macOS and Linux failing to upload the working tree from a git worktree whose per-worktree config sets core.longpaths
      • Fixed the Artifact tool sometimes reporting a publish as a conflict with another session after retrying a temporary server error, when the first attempt had actually succeeded
      • Fixed /ultrareview uploads including uncommitted changes to credential files whose name has a colon before the extension, such as server:8443.key
      • Fixed a rare auth failure when two sessions recover a login refresh lock left by a crashed process at the same time
      • Fixed the PowerShell tool's permission check skipping deny and ask rules, and caching that failure for later checks, when its command parser failed to start (for example when the machine was out of memory)
      • Fixed /ultrareview uploads on macOS and Linux running slowly on some unusual file names, and their credential-file check missing file or folder names with many backup or editor marks
      • Fixed a cancelled shell command or hook still starting, and running to its end, when the cancel arrived while it was being set up
      • Fixed vim mode: after editing in the external editor (Ctrl+G), x or r in NORMAL mode no longer breaks a pasted-text placeholder at the end of the prompt
      • Fixed responses blocked by the API's output content filter being re-sent and retried, sometimes for minutes, instead of showing the filter's error right away
      • Fixed plugins silently skipping a bundled .mcpb MCP server that still needs configuration: /plugin, the install message and claude plugin install now say so and point to Configure
      • Fixed compacting or resuming a session failing, opening without its history, or crashing when its saved transcript holds a compaction marker or loop wakeup entry with missing or malformed fields
      • WSL: Fixed /ultrareview refusing to upload a checkout on a Linux volume when a changed file's name has a colon or ends in a dot or space
      • Fixed CLAUDE_CODE_RESUME_INTERRUPTED_TURN re-running a turn that had ended at --max-turns
      • Fixed sign-in that could wait forever after the browser showed success
      • Windows: Fixed /ultrareview uploading a linked worktree of a repository rooted at your home folder in some cases
      • Fixed cloud sessions reporting the uploads folder as missing before any file had been uploaded
      • Fixed a reply sent from claude agents to a background session waiting on a permission prompt sometimes approving the pending command
      • Fixed claude attach, logs, stop, respawn and rm starting a new session with the command name as its prompt when options came before it, such as from a shell alias
      • Fixed claude mcp list leaving out WebSocket (ws) MCP servers; each is now listed with its URL and health status
      • Fixed claude mcp get showing no Type, Command, Args, or Environment for stdio servers whose config entry omits the type field
      • Fixed .claude/settings.local.json allow rules being held back outside a git repository when git's trace2 output is configured
      • Fixed the /claude-api eval runner scaffold and report builder writing through a symlink or hard link planted at an output file
      • Fixed the /claude-api eval runner scaffold counting responses cut off at max_tokens in the score averages; they are now marked truncated and counted separately
      • Fixed   showing as literal text in the terminal when a reply uses it to indent text, such as row labels in a markdown table
      • Fixed a brief freeze (up to a second) partway through long sessions outside fullscreen mode, which came back after /clear or /compact
      • Fixed an approved Edit never going through when its target is a device, such as a file symlinked to /dev/null, and the approval came from the IDE diff view or changed the edit
      • Fixed a failing API request being retried up to 21 times when streaming kept failing; the non-streaming fallback now shares the request's retry budget instead of getting a fresh set of retries
      • Improved Claude in Chrome: the native host now reports your computer's name, so connected browsers can be labeled by computer instead of "Browser 1" / "Browser 2"
      • Improved Bedrock and Vertex AI sessions to switch to an older available model of the same tier, instead of failing, when an admin removes access to the default model; session titles and summaries now fall back with it
      • Improved plugin marketplace errors to name why a git address is refused instead of citing enterprise policy
      • Improved validation of git URLs for plugins, marketplaces and the current repository's remote
      • Improved Artifact tool results: they now suggest publishing in the same step as writing or editing the page, which can save a round trip
      • Improved Remote Control: a /btw side question asked of a session hosted by an app such as Claude Desktop now sees the turn in progress, not only the last finished one
      • Improved pictures Claude sends as BMP, HEIC, HEIF, AVIF or TIFF files: the Claude apps now show a preview where Claude Code can convert them
      • Improved subagents in auto mode: a subagent's run now ends as soon as it hands its report back to its caller, instead of taking extra turns that reach no one
      • Improved Bedrock and Vertex start-up model checks: models your account cannot use are now remembered for up to a day instead of being re-checked on every launch
      • Improved Artifact tool publish results to use fewer tokens: the note on updating an artifact is shorter, and where to find your artifacts is no longer repeated after every publish
      • Improved SDK liveness during a non-streaming fallback request: with partial messages on, a ping stream event is now sent every 30 seconds on the Anthropic API, Claude Platform on AWS and gateways
      • Improved /resume and claude --resume on a session that is running in the background: they now open that session instead of refusing, and a prompt given with claude --resume <id> "prompt" is sent to it as its next turn
      • Improved per-turn performance when many permission deny rules and MCP tools are configured
      • Improved responsiveness when leaving the ctrl+o transcript view in long sessions when fullscreen rendering is off
      • Improved Bedrock, Vertex and Mantle start-up model checks to send the same User-Agent, x-app and session ID headers as regular requests
      • Changed MCP tools so a tool that sets its own _meta['anthropic/alwaysLoad'] to false stays deferred when its --mcp-config, Agent SDK or plugin server is set to alwaysLoad
      • Changed background Bash and PowerShell commands to stop after a time limit (their timeout with run_in_background, default 30 min, max 2 h); Claude is notified when one is stopped
      • Changed Code Review's pull request reviews and /ultrareview to run when disableWorkflows is on, unless the machine running the review has it set by its own administrator (MDM or the managed-settings file)
      • Changed sessions behind a custom ANTHROPIC_BASE_URL to use the 1M context window of models that have one (Opus 4.7+, Sonnet 5+, Fable); run /autocompact 200k if your gateway stops at 200K
      • Changed Team and Enterprise sessions, and sessions whose sign-in plan Claude Code can't determine, to withhold WebFetch until the organization policy loads if it couldn't be loaded at startup
      • Changed /memory so that Auto-memory can no longer be turned on from a background session or from a session one of Claude Code's own tools started; turning it off there still works
      • Changed the one-time offer to make auto mode your default permission mode to also show on third-party providers and with telemetry off, when your user settings default to another mode
      • Changed claude -p and Python Agent SDK sessions on third-party providers or with telemetry off to start in auto mode when no permission mode is configured, like interactive sessions; --permission-mode still overrides it
      • Changed Bedrock, Mantle and Claude Platform on AWS requests to a base URL with a non-default port to include the port in the SigV4-signed Host header
      • Changed the MCP server name widgets to be reserved in cloud sessions and on self-hosted runners: your own server under it, or a close spelling such as widgets_, no longer loads, so rename it
      • Changed /ultrareview on macOS and Linux to leave symbolic refs out when uploading a local checkout; a checkout whose current branch is a symbolic ref is now refused with an explanation
      • Windows: Changed project and local settings env to no longer set ALLUSERSPROFILE, SystemDrive, or the CommonProgramFiles variables; set them in user or managed settings instead
      • Changed /tasks to fold background work Claude Code runs for itself under one "System tasks" row; press Enter on it to show those tasks
      • Changed /ultrareview on macOS and Linux to require git 2.31 or newer to upload a local repository; checkouts made with --separate-git-dir are now refused instead of being uploaded with an older method
      • Changed /ultrareview uploads on macOS and Linux to send a partial clone as a working-tree snapshot on git 2.31 or newer, instead of falling back or refusing when git's version looked too old
      • Changed /ultrareview uploads on macOS and Linux to refuse, instead of fetching, a partial clone missing some of its working tree's files on older git versions; a clone made without --filter uploads
      • Changed Bedrock, Vertex and Mantle start-up model checks to identify themselves as Claude Code, like other Claude Code requests
      • Changed claude mcp get to hide the command, arguments, and environment values of stdio MCP servers provided by plugins; variable names are still shown
      • Changed /claude-api so it can no longer be run from Remote Control clients
      • Changed /config chrome=true to direct you to the /config panel instead of enabling Claude in Chrome by default; /config chrome=false still turns it off when it was on
      • Changed sandbox settings so project settings cannot widen or turn off an admin-required sandbox, replace the proxy behind a managed deny list, extend a strict allowlist, or reopen managed read-denies
      • [VSCode] Added a note under a restored tab's last message when a window reload interrupted it and no reply will follow
      • [VSCode] Added a plugin options form to Manage plugins: installing a plugin that has options asks for the unset ones, and a gear on its row changes them later
      • [VSCode] Added an on-demand diagnostics tool so Claude in the panel can read the Problems panel's current errors and warnings at any time, not only right after it edits a file
      • [VSCode] Fixed pressing Enter after typing a slash command running an unrelated menu item picked by fuzzy match, or doing nothing
      • [VSCode] Fixed an open agent transcript losing the agent's newer messages during a long session
      • [VSCode] Fixed a message that quotes a Claude Code or IDE tag losing the rest of its text in the chat
      • [VSCode] Fixed a message sent while Claude was working disappearing from the conversation after the session was reopened
      • [VSCode] Fixed the session list's Web tab showing the previous account's sessions after an account switch
      • [VSCode] Fixed restored tabs re-running an interrupted turn when VS Code was started with CLAUDE_CODE_RESUME_INTERRUPTED_TURN set, even with Continue After Reload off
      • [VSCode] Fixed Escape stopping the running turn instead of closing the command menu after clicking one of its rows
      • [VSCode] Fixed opening Past conversations replacing a live conversation with its saved copy
      • [VSCode] Fixed a Claude tab reloaded after an extension restart staying blank instead of saying how to recover
      • [VSCode] Fixed opening a conversation that is already open in another window or app starting a second copy of it without warning; it now asks first
      • [VSCode] Fixed a hook's reason for blocking or stopping a prompt disappearing after a window reload
      • [VSCode] Fixed tabs stuck on a conversation that can't be resumed: the error now says so and offers to start a new conversation
      • [VSCode] Fixed every file Read, Write and Edit stalling for ten minutes and then being skipped when the editor stops responding to the extension's automatic save before the tool runs
      • [VSCode] Fixed the agent map labeling a sub-agent with the session's model instead of the model it actually ran on (e.g. under CLAUDE_CODE_SUBAGENT_MODEL_FORCE or an agent's own model)
      • [VSCode] Fixed uninstalling a plugin from the Manage plugins dialog, which removed the wrong installation or failed for a plugin installed for the project
      • [VSCode] Fixed sign-in staying on the authorization-code step after going back and choosing the same sign-in method again
      • [VSCode] Fixed the chat panel stalling when a long session trims its oldest rows
      • [VSCode] Fixed the conversation disappearing from a session when many agents run
      • [VSCode] Fixed the editor tab keeping an old name after a session was renamed with /rename, by a SessionStart hook, or on claude.ai
      • [VSCode] Fixed the agent map's transcript view leaving out messages sent to a running agent
      • [VSCode] Improved the Manage plugins dialog: a failed plugin action now opens a popup that explains it and, where there is one, offers the fix
      • [VSCode] Changed the Manage plugins dialog to ask before removing a marketplace or turning off a plugin that your project's shared .claude/settings.json turns on
      • [Cloud sessions] Fixed Run now on a routine showing internal error text when the run is refused before it starts; it now shows the same explanation as the routine's failure notification
      • [Cloud sessions] Changed MCP_DISCOVERY_CACHE=1, when set in your cloud environment's variables rather than a settings file, to reuse your connectors' tool lists after a session restart; other MCP servers are no longer cached and connect at startup
      • [Claude Tag] Added direct messages with Claude for members on an Enterprise plan Standard or Usage-Based Chat seat who also have Cowork; a seat that includes Claude Code is no longer required
      • [Claude Tag] Fixed the Default model setting in admin settings and a channel's Configure page offering models your organization can't use, which made saves or new sessions fail
      • [Claude Tag] Fixed the note under Claude's Slack messages saying it answered on a fallback model, and why, disappearing when Claude later edited that message
      • [Code Review] Fixed the organization menu in Code Review's "Add a repository" dialog showing only a few of your GitHub organizations; it now loads more as you scroll
      • [Code Review] Improved the Code Review check run to say when your repository's REVIEW.md wasn't applied, for example on a very large pull request or when REVIEW.md is a symbolic link
   3. 🔗 earendil-works/pi v0.99.1 release

      New Features

      • GPT-6.1 Sol — Available on OpenAI, Azure OpenAI, and OpenAI Codex, and now the default OpenAI Codex model. See Select a model.

      Added

      • Added GPT-6.1 Sol (gpt-6.1-sol) to the OpenAI, Azure OpenAI Responses, and OpenAI Codex providers.

      Changed

      • Changed the default OpenAI Codex model to GPT-6.1 Sol (gpt-6.1-sol).

      Fixed

      • Fixed /login with OpenAI failing in the bundled release with a missing openai-chatgpt.js module error.
   4. 🔗 Evan Schwartz Please add prompt caching to Jev-style models rss

      If you're building a Jev-style "System One" model, please add prompt caching or reusable question sets to your API 🙏. This would make batch use cases even more efficient, so you could amortize the cost of many questions asked over the same input. (This was also proposed in typesafe-ai/typesafe-sdk-js#10.)

      TL;DR: after a week of tweaking my Jev calls, my questions are ~88% of the input tokens. I'm asking 54 questions of ~1.1 million documents per month. Jev makes certain types of classification tasks easy and cheap, but prompt caching would make batch workflows even more cost effective. For me, the total dollar amount is still reasonable (less than $150 per month), but I'm sure others will hammer these APIs even harder.

      Context

      I work on Scour. It’s a personalized content feed where you describe topics you’re interested in and it finds articles and blog posts related to them.

      For some time, I’ve wanted to ask slightly fuzzy questions of each piece of content Scour pulls in. What level of experience does this assume? Will this still be worth reading after a week, or is it news that goes out of date quicker? However, running the >1 million pieces of content Scour ingests each month through even the cheapest LLM would be prohibitively expensive for a bootstrapped project. System One models make this kind of use case feasible.

      TrAiN yOUr OwN cLaSsIfiEr

      Yes. I could. I might. But having a kind of general purpose classifier that I can ask a barrage of questions and add more questions to over time without retraining is very interesting.

      Tuning the question set

      I’ve spent a good chunk of the last week running experiments with Jev, tuning questions, comparing Jev's answers to panels of LLM judges and spot checking the results. The questions help me weed out junk that was hard to spot deterministically, figure out the expertise assumed by posts (to hide beginner content from advanced readers), and more.

      Following TypeSafe's advice about atomic questions and sending all questions in one request, v28 of my question set includes 54 questions: 50 nouls, 3 choices, and 1 score. I also reworded most of my questions to remove as much of the criteria description as I could without losing too much accuracy on the results.

      This set of questions is approximately 2,150 tokens, including Jev’s fixed overhead that seems to be around 260 tokens (judging from the token count for a trivially short question). When I send this set of questions in with the post’s title, URL, and summary or first snippet of text, my questions represent ~88% of my input tokens. The questions are sent verbatim with every request.

      Note that I don't send multiple posts in the same request because of the warning that "Accuracy falls as the state grows with content unrelated to the decision."

      Prompt caching or "Register-once questions"

      To TypeSafe and all the other labs that follow with these types of models, please add prompt caching or the ability to register sets of questions and criteria and reuse them.

      I don't know enough about how these models are served and whether there are caching efficiencies to be gained on the backend, but this would help increase Jev's effective "intelligence-per-dollar".

      With cheaper repeated questions, I'd put back some of the criteria I cut down, and probably add even more questions.

      As another alternative, an API that takes multiple questions and multiple inputs and gives you the results for each question evaluated for each input would give some of these savings without taking the accuracy hit from packing multiple inputs into one request.

      Batch mode?

      Async batch mode probably makes sense for super high-volume, fully offline use cases. It's less relevant for me because I want newly ingested content to be available soon after Scour reads it. But others will probably find plenty of use for it.

      Thanks

      Keep up the great work! This is a very exciting development.

   5. 🔗 earendil-works/pi v0.99.0 release

      New Features

      • Codemode and MCP — Connect MCP servers and let models run JavaScript that calls tools in parallel. See MCP Servers and Enable codemode.
      • System theme — Pi's colors now come from your terminal's own palette by default. See Use your terminal's colors.
      • Sign in with ChatGPT — Use a ChatGPT subscription with the OpenAI provider through /login openai. See Authenticate interactively.
      • Virtual models — Extensions can route each request to a different physical model. See Virtual Models.
      • Classifier models — Run Jev classifiers from codemode scripts, or use any llama.cpp model as a classifier. See How codemode works and Classification.

      Added

      • Added codemode, tool search, and MCP support as built-in extensions. The codemode tool runs model-written JavaScript in a QuickJS sandbox that calls pi's tools; enable it with defaultTools or --tools and configure it with codemode.mode and codemode.inlineBudget. tool_search finds tools that are not declared to the model and declares them. MCP servers over stdio or streamable HTTP, with OAuth, come from mcp.json (global, or per project once trusted) or pi.registerMcpServer() and are managed with /mcp and pi mcp add|remove|list|login|logout. See MCP Servers and Enable codemode (#10040).
      • Added extension tool APIs for orchestrating tools: exposure (direct, model-only, codemode, deferred, or hidden), namespace, annotations, outputSchema with structuredContent, isError results, prepareLoadout(), and ctx.executeTool() for nested tool calls, which emit events with parentToolCallId and are recorded as bounded nestedCalls on the calling tool's result. See Tool exposure.
      • Added a warning when an extension that registers the same tool, command, or flag replaces a built-in extension (#10174 by @cristinaponcela).
      • Added experimental virtual models: extensions register them with pi.registerVirtualModel() and pick a physical model and thinking level for each request. The footer shows the routed model, /session lists cost per physical model, and examples/extensions/jev-router.ts routes with the Jev classifier. See Virtual Models.
      • Added Sign in with ChatGPT to the OpenAI provider in /login, which uses a ChatGPT subscription with the OpenAI API. Pi stores a stable deviceId in the global settings for this login and omits it from bug reports.
      • Added the system theme, now the default, which derives pi's colors from the terminal's reported foreground, background, and ANSI palette and rebuilds them when the terminal switches between light and dark. See Use your terminal's colors.
      • Added #rgb, oklch(), and okhsl() colors and an optional appearance field to theme files, and theme.style(), theme.colors, and theme.appearance for extensions. See Themes and TUI.
      • Added a classifier model for every llama.cpp chat model, answered from next-token label probabilities. See Classification.
      • Added inherited Jev classifier models on OpenRouter, Cloudflare Workers AI, Vercel AI Gateway, and OpenCode Zen.
      • Added the fullscreenWheelScrollLines setting and /settings entry for fullscreen mouse-wheel scrolling. The default "auto" accelerates fast wheel spins outside local macOS terminals (#9758).
      • Added per-input disposition to successful RPC prompt, steer, and follow_up responses, AgentSession.steer()/followUp(), and RpcClient.prompt()/steer()/followUp(); RpcClient.prompt() also accepts streamingBehavior (#9098, #9803).
      • Added image generation to ModelRuntime: generateImages() with runtime-resolved auth (stored credentials, OAuth, runtime API keys, models.json headers), plus getModelsOfType(), getModelOfType(), getAvailableOfType(), getAllModels(), and getAllAvailable(). OpenRouter image models are listed under the openrouter provider and share its credential; an upstream ID can have separate chat and image entries. models.json providers and extension registrations without a model list keep built-in image generation. Extension model lists can include discriminated chat, image, and classifier entries with operation implementations; when supplied, they replace the provider catalog across every operation. Chat-facing reads (getModels(), getAvailableSnapshot(), the model picker) are unchanged.
      • Added classifier support to ModelRuntime, including classify(), classifier model accessors, runtime-resolved authentication, and the built-in TypeSafe jev-latest model.
      • Added types=chat,image,classifier to pi.dev model catalog requests so remote refreshes overlay every supported model type; entries of unknown model types are ignored.
      • Added the provider_stream_event extension event for observing parsed provider events before normalization, with an opt-in /debug-provider example viewer (#9784, #9901 by @davidbrai).
      • Added a show/hide toggle (H) in HTML exports for custom messages marked display: false. Messages remain hidden by default and can also be revealed from the sidebar (#8896, #10020 by @rwachtler).
      • Added inherited Claude Sonnet 5.5 support for Anthropic with adaptive thinking and a 1M context window.
      • Added a Built-in section in pi config to disable the built-in mcp, llama.cpp, codemode, and tool-search extensions globally or per project, stored as -builtin:<name> in the extensions setting. SDK inline extensions opt in with builtin: true.
      • Added +name and -name entries to the defaultTools setting to add or remove tools without repeating the defaults, for example "defaultTools": ["+codemode"]. Project entries of this form apply on top of the user setting. Documented how to enable codemode without MCP and how to use classifier models such as Jev from codemode scripts.
      • Added the token usage and cost of codemode models.classify() calls to the codemode tool result, so they count toward the session cost; the codemode result shows each call's cost.

      Changed

      • Switched the build from the TypeScript native preview to TypeScript 7.0 with an ES2024 target, and replaced tsx with Node's built-in type stripping for running from source (#9965).
      • Removed the [Themes] section from the startup banner. Custom themes remain available in /settings, and theme conflicts are still reported.
      • Changed the startup header to show the pi logo with the version instead of the app name.
      • Changed the built-in dark and light themes to the revised pi colors, written in OKHSL.
      • Changed light/dark terminal detection to use the reported background color first, then the terminal's light/dark report, then COLORFGBG. The first-time setup no longer shows the detected appearance.
      • Renamed the inherited OpenAI Codex provider to "OpenAI Codex (legacy)"; Sign in with ChatGPT on the OpenAI provider supersedes it.
      • Changed inherited terminal detection to treat TERM=*-direct as truecolor.
      • Built-in extensions and tools are named builtin:<name> (for example builtin:mcp and builtin:read) in errors, diagnostics, RPC source info, and bug reports, instead of <inline:name> and <builtin:name>. Their slash commands no longer carry a [t] autocomplete tag.
      • --no-extensions also disables the built-in extensions, including the llama.cpp provider. Load one explicitly with -e builtin:<name>, for example pi -ne -e builtin:mcp.
      • Tool calls without a custom call renderer, including direct MCP tool calls, now show their arguments: as key=value pairs on the title line when collapsed and one key: value line per argument when expanded. MCP calls are titled server/tool and their results collapse to 5 lines.
      • bash and powershell structured results, which codemode scripts receive, now hold up to 1 MiB of output instead of the model-facing 2000 lines or 50KB, and add truncated and full_output_path. Longer output keeps its first and last 512 KiB. Empty output is "" instead of (no output).

      Fixed

      • Fixed X11 clipboard text being misidentified as an image when the clipboard owner accepts unadvertised image targets (#9786).
      • Prevented managed git packages from automatically installing Pi peer dependencies and added warnings for extension packages that list host-provided modules in dependencies (#9863).
      • Fixed pinned git extensions loaded with -e continuing to use the first downloaded commit after the ref changes (#9982).
      • Fixed RpcClient skipping the next event listener when a listener unsubscribes while handling an event, which could make waitForIdle() time out after collectEvents() (#9990).
      • Fixed full-file read calls rendering as :1 when models send null for omitted offset and limit (#9996).
      • Fixed new sessions being lost when pi exits before the first assistant response. The session file is now created when the first user message is sent (#10000).
      • Fixed unloaded llama.cpp autoload presets overwriting a cached runtime context window with the GGUF training context (#10077, #10158 by @cristinaponcela).
      • Fixed custom themes ignoring terminal.trueColor and other terminal capability overrides and rendering with 256 colors (#9973, #10039 by @christianklotz).
      • Fixed pasting files copied in Finder inserting the file icon image instead of the file paths; paths are quoted in bash mode (#9999, #10136 by @christianklotz).
      • Fixed the startup header, loaded resources, and chat notices keeping their old colors after a theme change.
      • Fixed the Fireworks default model pointing at the removed Kimi K2.6 model; it now defaults to Kimi K3.
      • Fixed the OpenCode Go default model pointing at the removed Kimi K2.6 model; it now defaults to Kimi K3.
      • Fixed the Together default model pointing at the removed Kimi K2.6 model; it now defaults to Kimi K3.
      • Reduced CPU use while streaming in long sessions and when previewing themes: the footer caches session usage totals, collapsed bash results cache their preview, and sanitizeBinaryOutput() no longer splits output into per-character arrays.
      • Fixed the usage of tools called through ctx.executeTool(), for example from codemode scripts, being dropped from the session cost; it is now added to the calling tool's result usage.
      • Fixed inherited /skill autocomplete appearing empty when loaded skill names did not contain the letters in skill (#9944).
      • Fixed inherited path and @ autocomplete not working after opening wrappers such as (, [, {, <, or a backtick.
      • Fixed inherited image stretching in terminals that use the Kitty graphics protocol (#8938, #9957 by @rwachtler).
      • Fixed inherited shell cursor staying hidden after exit when an extension closed an overlay during shutdown (#10026).
      • Fixed inherited keyboard input being lost after a mouse click in a /settings submenu closed it.
      • Fixed inherited 1-hour Anthropic cache writes through Vercel AI Gateway being priced at the 5-minute rate (#9210).
      • Fixed inherited model-level samplingParams being dropped by direct stream()/complete() calls on OpenAI-compatible APIs (#9506).
      • Fixed inherited Mistral GLM requests failing with "Expected at most one leading ThinkChunk" after empty content deltas (#9674).
      • Fixed inherited OpenAI Fast mode requests being priced at the standard rate (#10034).
      • Fixed inherited Mistral reasoning models ignoring the requested thinking level (#9678).
      • Fixed inherited OpenCode Zen and OpenCode Go qwen3.8-flash thinking being replayed as plain text on later turns (#10047).
      • Fixed inherited OpenAI Responses streams from servers that omit output_index, such as llama.cpp, running mixed-up tool calls; such streams now end with an error (#9974).
      • Fixed inherited Anthropic and OpenAI Codex browser sign-in waiting indefinitely after the provider redirected with an authorization error, and Anthropic sign-in failing when its callback port is in use.
      • Fixed inherited GitHub Copilot Claude Opus 5.5 offering unsupported thinking levels when upstream model metadata is incomplete.
   6. 🔗 HexRaysSA/plugin-repository commits sync repo: +1 plugin, +2 releases rss

      sync repo: +1 plugin, +2 releases
      
      ## New plugins
      - [mcrit-ida](https://github.com/familiary/mcrit-plugin) (2.0.0)
      
      ## New releases
      - [ida-mcp](https://github.com/hexrayssa/ida-mcp): 20260929.0.1
      

   7. 🔗 Simon Willison OpenAI DevDay 2026 live blog rss

      I'm at OpenAI DevDay today, in Fort Mason, San Francisco. Same as last year I'll be live blogging the keynote and some other notes during the day.

      OpenAI gave me a free ticket and a seat in the "creator" area for the keynote.

      You are only seeing the long-form articles from my blog. Subscribe to /atom/everything/ to get all of my posts, or take a look at my other subscription options.

   8. 🔗 smol-machines/smolvm smolvm v1.20.2 release

      What's Changed

      • Resize CPUs, RAM and disks of a running machine in one command by @BinSquare in #1466
      • Let a stopped machine's egress policy be replaced by @BinSquare in #1449
      • Give a machine that is still starting time before the ephemeral sweep reaps it by @BinSquare in #1470
      • Bump the Nix package to 1.20.1 by @BinSquare in #1469
      • End a foreground packed run's VM with its CLI, and watch its mounts from the CLI by @BinSquare in #1467
      • Bump the workspace to 1.20.2 by @BinSquare in #1468

      Full Changelog : v1.20.1...v1.20.2

   9. 🔗 smol-machines/smolvm smolvm v1.20.1 release

      What's Changed

      • Bump the Nix package to 1.20.0 by @BinSquare in #1463
      • Count file-backed cache as headroom for live RAM growth on macOS by @BinSquare in #1464
      • Bump the workspace to 1.20.1 by @BinSquare in #1465

      Full Changelog : v1.20.0...v1.20.1

   10. 🔗 backnotprop/plannotator v0.27.22 release

       Follow @plannotator on X for updates

       Missed recent releases? Release | Highlights
       ---|---
       v0.27.21 | Remote and phone sessions load several times faster, real Request changes on GitHub, model pickers show real names, OpenCode fixes
       v0.27.20 | Mistral Vibe support, annotate gets the full Options menu and Settings, jj Commits panel, long lines wrap in plan code blocks
       v0.27.19 | Before/After image previews in code review, file comments as GitHub file threads, forge-correct #123 links, /plannotator-last finds the right session
       v0.27.18 | Model pickers from your installed Claude and Codex (Opus 5.5, Fable 5.1, GPT-6), unsent PR review comments survive new pushes
       v0.27.17 | Diagram files open in the diagram viewer, OpenCode switches model with agent, idle review stops polling the git remote, Tree is the default review view
       v0.27.16 | Themed diagrams on Mermaid 12, comment on any node or edge, patch-file review, embedded HTML documents render
       v0.27.15 | Plannotator TUI and Herdr Annotate announcement, element context on pinpoints, HTML links open as linked documents, All files panel, Classic diff default
       v0.27.14 | Pi plan progress survives compaction, Codex threads across rollout files, WSL browser setting, Mod+E edit mode
       v0.27.13 | Open a review on a specific base (--base, --diff-type), symlink containment on /api/doc, CI flake fix, Amp decision relay
       v0.27.12 | Unified decision control, token hover cards, local-vs-remote diff, approval notes
       v0.27.11 | OpenCode server leak fix, durable local feedback archive, unknown-subcommand fix
       v0.27.10 | Auto-viewed files on scroll, annotation undo/redo, OpenCode 2 slash commands restored, npm 12 agent terminal fix

       What's New in v0.27.22 A fix release. Plans can open the documents they link to, Claude review jobs are locked down more tightly, Code Tour works on Linux machines where Claude Code's sandbox cannot start, and Pi no longer reviews an outdated plan. Eight pull requests, two of them from community contributors, answering four reports. Plans can open the documents they link to Claude Code saves plans in ~/.claude/plans/, outside your project. Plannotator only looked inside the project for linked files, so a plan that linked or [[notes]] to a file saved beside it showed a link that went nowhere. Plan review now also looks in the plan file's own folder, but only for files the plan actually links to, matched by exact name. Every plan you have ever made lives in that folder, so a plan can open its own notes without being able to reach any other plan. Links inside code blocks do not count, and plans kept inside the project still fall back to the project root as before. If a file beside the plan has the same name as a project file, the one beside the plan wins. (#1620, closing #1443, by @bendrucker) Claude review jobs are locked down

       Code review, Code Tour and Guided Review run Claude Code with a list of read- only commands they are allowed to use. That list had grown looser than its purpose: a few entries accepted options that could run other programs or write files, and the review prompt contains the diff under review, which is untrusted text. For most people, Claude Code's own sandbox is off, so that list was the only thing standing between a hostile diff and the machine.

       The list is now narrowed to the commands the prompts actually use, shared by all three job types, with the risky options explicitly refused. Jobs also no longer read a repository's own .claude/settings.json, so a pull request you are reviewing cannot add permissions or hooks to the job. Your personal Claude Code settings and any managed settings still apply. Jobs no longer load your MCP servers either; before, a Code Tour could wander into tools from your IDE.

       (#1628, #1629)

       Code Tour on Linux when Claude Code's sandbox cannot start

       If your Claude Code settings enable its sandbox and the machine lacks bubblewrap and socat, the sandbox fails to start and Claude refuses every command. Code Tour then ended with "Tour blocked: git access is unavailable" and no hint why.

       Now, when a Claude job has every ordinary git command refused, the Agents tab shows a warning explaining what happened. You can install those two packages, or turn Claude's sandbox off for Plannotator's jobs only with PLANNOTATOR_CLAUDE_SANDBOX=0 or { "claudeSandbox": false } in ~/.plannotator/config.json. Plannotator never turns the sandbox off on its own, since that would quietly override a choice you made.

       (#1628, closing #1627, reported by @Infeligo)

       Pi reviews the plan you just wrote

       Pi runs all the tool calls in one assistant message at the same time. When the agent edited the plan and submitted it in the same message, the submit could read the file before the edit landed, so the review opened on the previous version and version history recorded it. The submit tool now tells Pi to run its batch in order, so the edit always finishes first. Every Pi version the extension supports honors this.

       (#1623, closing #1622, reported by @bugs-wkettlitz)

       Additional Changes

       • Claude reviews no longer fail after producing findings. Recent Claude Code versions can end one run with several result messages when the model uses background subagents, and the last one is often empty. Plannotator read only the last message, so about one code review in three was marked failed even though Claude had returned findings. Review, Code Tour and Guided Review now read the newest message that carries results (#1630).
       • VS Code tabs follow a changed data folder. Plannotator looked up VS Code's connection file once at startup, so setting PLANNOTATOR_DATA_DIR later made opening a review in VS Code quietly fall back to the browser. It now looks the file up each time (#1621, closing #1502, by @gwynnnplaine).
       • Tests stay out of your data folder. Running the test suite from a package directory wrote drafts, history and saved plans into the real ~/.plannotator, and a personal config could make tests fail. Every package now uses the same temporary data folder the root run does (#1624, #1626).

       Install / Update

       macOS / Linux:

       curl -fsSL https://plannotator.ai/install.sh | bash
       

       Windows:

       irm https://plannotator.ai/install.ps1 | iex
       

       Claude Code Plugin: Run /plugin in Claude Code, find plannotator , and click "Update now".

       Pi: Update @plannotator/pi-extension to 0.27.22 and restart Pi.

       OpenCode: Clear cache and restart:

       rm -rf ~/.bun/install/cache/@plannotator
       

       What's Changed

       • fix(server): resolve the VS Code IPC registry path per call by @gwynnnplaine in #1621
       • fix(plan): open docs linked beside the plan file by @bendrucker in #1620
       • fix(pi): run plannotator_submit_plan sequentially so it never reads a stale plan by @backnotprop in #1623
       • test(pi): sandbox review-server tests from the user's config by @backnotprop in #1624
       • test: sandbox the data dir when tests run from a package directory by @backnotprop in #1626
       • fix(agents): hermetic Claude review jobs + sandbox opt-out for Linux by @backnotprop in #1628
       • security(agents): narrow Claude job command allowlists to what the prompts use by @backnotprop in #1629
       • fix(agents): read structured output from any Claude result event, not just the last by @backnotprop in #1630

       Contributors

       @bendrucker made plans able to open the notes and documents saved next to them, a gap every Claude Code user with multi-file plans ran into.

       @gwynnnplaine tracked down the last module that froze the data folder at startup and fixed it with tests that reproduce the bug.

       Community

       • @bugs-wkettlitz diagnosed the Pi race down to pi's parallel tool execution and proposed the exact fix in #1622
       • @Infeligo reported Code Tour failing on Linux, with the full tool log, in #1627

       Full Changelog : v0.27.21...v0.27.22

   11. 🔗 HexRaysSA/plugin-repository commits sync repo: -1 plugin, -4 releases rss

       sync repo: -1 plugin, -4 releases
       
       ## Removed plugins
       - mcrit-ida
       

   12. 🔗 smol-machines/smolvm smolvm v1.20.0 release

       What's Changed

       • Bump the Nix package to 1.19.3 by @BinSquare in #1441
       • Add opt-in exact and wildcard egress host patterns by @ankrgyl in #1438
       • Keep a paused machine's disks in place, and share backing copies across pauses by @LoganGrasby in #1442
       • Stream sparse RAM into stored checkpoints by @BinSquare in #1443
       • Quote --at '~N' in hints and docs so zsh doesn't expand it by @BinSquare in #1446
       • Stop decoding pause archives after resume inputs by @BinSquare in #1445
       • Remove duplicate reads and RAM copies from pause resume by @BinSquare in #1447
       • Parse checkpoint indexes from memory so saves and restores stop slowing down as history grows by @BinSquare in #1448
       • Layer a macOS branch over a restored disk with an absolute backing path so it can boot by @BinSquare in #1451
       • Bump libkrun to live resource resizing and branch pause fixes by @BinSquare in #1450
       • Create machines from an unchanged private pack without re-reading it by @BinSquare in #1455
       • Stop re-extracting VM-mode packs on every launch by @BinSquare in #1456
       • Let a non-root resume ignore the root-only restore tmpfs it cannot read by @BinSquare in #1452
       • Bump libkrun to the macOS branch pause fix by @BinSquare in #1460
       • Re-extract a pack entry whose image layers were removed after extraction by @BinSquare in #1459
       • Grow running machines without rebooting by @BinSquare in #1319
       • Boot the children of concurrent branches from one frozen source together by @BinSquare in #1457
       • Pause packed machines in place and stop their pause from crashing the VM by @BinSquare in #1461
       • Bump the workspace to 1.20.0 by @BinSquare in #1462

       Full Changelog : v1.19.3...v1.20.0

   13. 🔗 Filip Filmar Vreteno: a RISC-V core written in TxHDL rss

       Vreteno is a 32-bit RISC-V processor core designed in TxHDL. TxHDL is a hardware description language implemented as a native Rust library. The core implements the RV32IMC instruction set architecture: the base integer set, standard multiply/divide extensions, and compressed instructions. It supports traps, hardware interrupts, and system memory access via an AXI bus. Lockstep verification checks core state against a reference model on every cycle, while gate-level netlists match cycle-accurate Rust simulations. This article details the core microarchitecture, verification strategy, and FPGA implementation.

   14. 🔗 Filip Filmar wdbcvt: Bundling Waveform Test Corpora and Daily Nightly Releases rss

       wdbcvt now publishes two new release archives with every build: a documentation bundle and a waveform corpus. The waveform archive packages the test suite’s .wdb files, ground-truth .fst conversions, and HDL source files together. Nightly builds now run daily, check the repository forge for new commits, and publish all build artifacts to Forgejo and GitHub.

       Why a standalone waveform corpus matters

       Tool developers who study Vivado’s .wdb format need test cases. Vivado is a multi-gigabyte software package. Running simulations requires licenses and tool setups that many open-source developers do not maintain. The wdbcvt repository already contains dozens of simulated test cases across VHDL, Verilog, and SystemVerilog. Previously, these test cases stayed inside the repository tree alongside intermediate simulation files. Developers of external tools had to clone the full repository or run Vivado locally to obtain sample waveforms.

   15. 🔗 Armin Ronacher Deser: Rethinking Rust Serialization rss

       Serde is an amazing serialization library for Rust and it has been a huge reason why I felt productive with it for years. However already while at Sentry I got quite frustrated with some of the limitations with it but actually replacing Serde is tricky because of the might that it has in the ecosystem. Also because it's quite hard to actually do better without also making some potentially painful compromises.

       Here are three examples of Serde corner cases that show poor interactions of Serde features or unexpected limitations:

       A number that is a map

       An internally tagged enum, with serde_json's arbitrary_precision feature turned on:

       #[derive(Deserialize)]
       #[serde(tag = "type")]
       enum Shape {
           Circle { radius: f64 },
       }
       
       serde_json::from_str::<Shape>(r#"{"type": "Circle", "radius": 1.5}"#)
       // error: invalid type: map, expected f64
       

       Serde's data model has no place for arbitrary precision numbers, so serde_json uses in-band signalling with a map with a magic key. The enum has to buffer the fields until it has seen the tag, and the buffer does not know about the magic key. Because Cargo features are unified, it's enough for any crate in your dependency graph to turn the feature on.

       Flattening breaks integer keys

       #[derive(Deserialize)]
       struct Stats {
           scores: HashMap<u32, u32>,
       }
       
       #[derive(Deserialize)]
       struct Report {
           name: String,
           #[serde(flatten)]
           stats: Stats,
       }
       
       serde_json::from_str::<Report>(r#"{"name": "x", "scores": {"42": 23}}"#)
       // error: invalid type: string "42", expected u32 at line 1 column 35
       

       Stats on its own parses {"scores": {"42": 23}} just fine. JSON keys are always strings, and serde_json only turns them into integers if the type asks for one. However once flatten buffers the value, "42" is just a string. The error also points at the end of the document rather than at the key.

       Adapters do not compose

       fn from_hex<'de, D: Deserializer<'de>>(d: D) -> Result<u32, D::Error> { ... }
       
       #[derive(Deserialize)]
       struct Theme {
           #[serde(deserialize_with = "from_hex")]
           primary: u32,
           #[serde(deserialize_with = "from_hex")]
           accent: Option<u32>,
       }
       
       //error[E0308]: `?` operator has incompatible types
       //  |
       //  |     #[serde(deserialize_with = "from_hex")]
       //  |                                ^^^^^^^^^^ expected `Option<u32>`, found `u32`
       //  |
       //help: try wrapping the expression in `Some`
       //  |
       //  |     #[serde(deserialize_with = Some("from_hex"))]
       //  |                                +++++          +
       

       A function cannot be passed as a type parameter, so there is no way to apply from_hex to the inside of an Option, a Vec or a map. You write another function for every wrapper, and once you have from_opt_hex the field is no longer optional unless you also remember to add #[serde(default)].

       None of these are bugs that are easy to fix in Serde. They fall out of its design, and that design is protected by Serde's stability guarantees.

       Back in 2022 I started an experiment called Deser. It's a serialization library for Rust that takes the user experience of Serde and puts it on top of a completely different architecture inspired by miniserde. I never really finished it and it sat around for a few years. I picked it back up, and it has now reached a point where I think it's worth looking at. Even just to inspire others to see if they want to explore the space.

       The Name And Idea

       The name is Serde with its two halves swapped. Deser is Serde but the other way around. In Serde, a type drives the deserialization process: a Deserialize impl asks the deserializer for the kind of value it expects, the format calls back into a visitor. Every nested value is handled by recursion which makes Serde deserialization inherently grow the stack with each level of nesting.

       Deser on the other hand turns this around and the format tells the type of the next value and pushes events into a sink. When a sink hits the start of a nested value, it doesn't call into it but hands back a new sink to a driver, which keeps all state on the heap (in fact, in an arena). On the way out, emitters return their nested values instead of recursing into them.

       That also means that Deser cannot support formats like protobuf that are not self describing. They are in fact quite intentionally left out of the design entirely. Which is one way to say: if you want to "fix" Serde, you need to make some other compromises.

       Most of the reasons for Deser's ideas go back to Sentry Relay, which processes enormous amounts of untrusted JSON. Over the years when I was at Sentry we ran into the same set of problems again and again, and many of them are not really bugs in Serde but consequences of its design. Serde's stability guarantees mean that a lot of them cannot be fixed without breaking every format and every hand written implementation. Most of these problems come from three decisions:

       1. One set of traits for all formats. Serde serves both self describing formats (JSON, YAML, TOML, …) and formats where the reader has to know the type upfront (postcard, bincode, protobuf, …). That is incredibly useful, but it means that some features only work with some formats, and you find out at runtime. In case of Serde it also has some odd wrinkles where a derived struct quietly accepts an array in place of an object in JSON for instance.

       2. A fixed data model that loses information when buffering. Internally tagged enums, untagged enums and flatten need to buffer values before they know what to do with them. The buffer can't hold everything the format knew, errors lose their location and extensions to the ecosystem rely on in-band signalling to express things such as arbitrary precision numbers.

       3. Recursion on the call stack. Every level of nesting uses stack space. Formats protect against this with a recursion limit, but the moment you go through a code path that doesn't have one (writing, dynamic values), deeply nested data can take down your process. It also means that a deserialization cannot be paused while you wait for more input.

       Many of the corresponding Serde issues have been open for years, and I wrote about abusing Serde before. People have tried different angles on this over the years. Some went minimal and dropped most features to get fast compiles and no recursion. dtolnay's own miniserde is the best example of that, and deser's trait design was originally modelled after it. Other recent attempts went for runtime reflection, or for a new data model with a focus on binary formats.

       If you want to read up on all of the collected challenges with Serde's design, I maintain a lengthy list here.

       Dethroning Serde

       First of all I don't think it's likely that one can replace Serde. The orphan rule entrenches Serde incredibly well in the ecosystem. But some things are within the reach of a crate author's control. In case of Deser it's completeness.

       Deser today implements all important self describing formats from YAML, JSON, TOML, CBOR, JSON5 and the likes, but also XML and plist to really close the gap. XML in particular is something Serde has declined to support, and it shows (more on that below). At the very least format support should not be the reason not to use Deser.

       The second problem usually is that actually solving Serde's issues comes at a significant cost in compile time and/or runtime performance. Deser is no different. While Deser's compile times are a bit better than Serde's, the binary bloat is quite a bit worse and the runtime performance is mixed. It's roughly comparable if you look at the numbers but depending on the format structure you are losing significantly from some of the tradeoffs.

       That said, it's now in a state where it's at least in principle a drop-in replacement where the tradeoffs might work well for users.

       Deser's Design

       Deser does not try to be significantly different than Serde on the surface level. For most uses you derive Serialize and Deserialize and then start using it with your format implementing crate of choice. Most attributes are very similar, though they are taking Rust expressions instead of strings.

       use deser::{Serialize, Deserialize};
       
       #[derive(Debug, Serialize, Deserialize)]
       #[deser(rename_all = "camelCase")]
       pub struct Account {
           id: u64,
           account_holder: String,
           #[deser(default)]
           is_deactivated: bool,
       }
       
       let account: Account = deser_json::from_str(json)?;
       

       The difference in the design would become more apparent if you implement a serializer or deserializer yourself. Instead of visitors that call into each other recursively, deserializing a type creates a sink which receives events that are directly emitted by the parser, and serializing produces emitters that hand out values. Nested sinks and emitters are handed back to a driver, which keeps them on the heap. This design, which is entirely stolen from miniserde, gives some interesting consequences:

       • No stack overflows. You can arbitrarily nest structures without issues. For untrusted input you set limits with a layer, and you pick the number that you are comfortable with, which is independent of your stack space.
       • Suspendable. Because the state lives in the driver, a deserialization can be fed input as it arrives. It's also Send, so it can move between threads while you wait on IO which makes it much nicer to use with tokio. Formats like JSON, CBOR and MessagePack can be parsed as a stream if you so desire.
       • An extensible data model. The core data model is small and made of atoms, maps and sequences. For all else, there are extension values (DateTime, Uuid, etc.) that also all carry a fallback for formats that don't understand them. Unlike Serde this means it does not rely on in-band signalling of objects with magic keys to smuggle values through.
       • Lossless buffering. When a value has to be buffered (for instance because the tag of an internally tagged enum comes last), Deser records the events together with everything the format knew about them. Protocol specific extension types or error locations all survive.
       • Layers are a middleware system that sit between the format and your types and can track things like paths, enforce safety limits, rename keys or redact values without having to touch specific code paths.
       • Native flattening that doesn't buffer at all.

       On top of that are a lot of things that I just wanted to have:

       • Allow enum tags to be of any type, not just strings
       • Adapters that compose (as = Option<Vec<DisplayFromStr>>)
       • Enabling validation as an adapter
       • derive attributes that are real Rust expressions instead of strings
       • bytes as a core functionality in the data model
       • duplicate keys rejected by default and errors that point at the problem

       Here is a small configuration type that shows a few of these together:

       use deser::adapters::DisplayFromStr;
       use deser::de::Recording;
       use deser::{Deserialize, Serialize};
       use deser_encoding::Hex;
       use deser_validate::{Check, NonEmpty, Range};
       use ipnet::IpNet;
       
       #[derive(Debug, Serialize, Deserialize)]
       pub struct Config {
           // at least one 256-bit key, each written as hex
           #[deser(as = Check<NonEmpty, Vec<Hex>>)]
           secret_keys: Vec<[u8; 32]>,
           // `IpNet` knows nothing about deser, but has `FromStr` and `Display`
           #[deser(as = Option<Vec<DisplayFromStr>>)]
           allowed_networks: Option<Vec<IpNet>>,
           listeners: Vec<Listener>,
       }
       
       #[derive(Debug, Serialize, Deserialize)]
       #[deser(tag = "type", rename_all = "snake_case")]
       pub enum Listener {
           Unix { path: PathBuf },
           Tcp {
               host: IpAddr,
               #[deser(as = Check<Range<1, 65535>>)]
               port: u16,
           },
           // types this version does not know are kept and written back
           #[deser(other)]
           Other(#[deser(tag)] String, Recording),
       }
       

       Adapters are types, so Hex can go inside a Vec, and DisplayFromStr inside a Vec inside an Option. Validators are adapters too, so Check<NonEmpty, Vec<Hex>> decodes the keys and then checks that there is at least one. The catch-all variant keeps the tag and a recording of everything else in case someone wants to process it later.

       Errors are something I care a lot about, so here is what happens when a value is wrong:

       secret_keys = ["9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08"]
       allowed_networks = ["10.0.0.0/8", "fd00::/8"]
       
       [[listeners]]
       type = "unix"
       path = "/run/app.sock"
       
       [[listeners]]
       host = "127.0.0.1"
       port = 0
       type = "tcp"
       
       [[listeners]]
       type = "quic"
       host = "::1"
       alpn = ["h3"]
       
       
       
       let config: Config = deser_toml::Deserializer::from_str(input)
           .deserialize_with(|driver| driver.push_layer(PathLayer::new()))?;
       

       Note that here the tag of the internally tagged enum comes last which means that the values have to be buffered until the tag is known. In Serde this is tricky and we would lose the location if we used some tricks to add it. With Deser however, with the path layer enabled Deser you where in the structure the problem is:

       Unexpected: invalid value: must be between 1 and 65535 at line 10 column 8 (path: listeners[1].port)
       

       Deser Meta Data

       Deser really wants to be extensible, and XML is a more extreme example of the differences between Deser and Serde. Here is an Atom entry that mixes in Dublin Core for the authors:

       use chrono::{DateTime, Utc};
       use deser::Deserialize;
       use deser_value::Value;
       use deser_xml::DeserializerConfig;
       
       deser_xml::namespace!(
           atom = "http://www.w3.org/2005/Atom",
           dc = "http://purl.org/dc/elements/1.1/",
       );
       
       #[derive(Debug, Deserialize)]
       struct Entry {
           #[deser(rename = atom!("title"))]
           title: String,
           #[deser(rename = dc!("creator"))]
           creators: Vec<String>,
           #[deser(rename = atom!("updated"))]
           updated: DateTime<Utc>,
       }
       
       // entries we understand, and everything else is kept as it is
       #[derive(Debug, Deserialize)]
       #[deser(untagged)]
       enum Item {
           Entry(Entry),
           Other(Value),
       }
       
       let item: Item = DeserializerConfig::new()
           .resolve_namespaces(true)
           .from_str(r#"
               <entry xmlns="http://www.w3.org/2005/Atom"
                      xmlns:d="http://purl.org/dc/elements/1.1/">
                 &lt;title&gt;Deser&lt;/title&gt;
                 <d:creator>John</d:creator>
                 <updated>2026-09-29T21:00:00Z</updated>
                 <d:creator>Jane</d:creator>
               </entry>
           "#)?;
       

       XML uses namespaces which means that names need to be matched by their namespace, not by the prefix the document happens to use. Here the document says d: and the type says dc!. atom!("title") is just the string {http://www.w3.org/2005/Atom}title, which works because attributes are expressions. The two creators are collected into one Vec even though there is another element between them, and the text of updated goes straight into a chrono datetime. Because the enum is untagged, the entry has to be buffered before a variant is picked, and deser's buffer keeps both creators. So the result is an Entry with John and Jane.

       quick-xml, the most popular XML crate for Serde, drops the prefixes and ignores namespaces entirely, so a <x:title> from some other namespace is happily accepted as the title of the entry. The split list part though is considerably worse. A plain Entry fails with a duplicate field error for creator, unless you turn on the overlapped-lists feature (which, remember, is a global additive flag that any crate could set). That feature makes quick- xml read ahead to the end of the element and buffer everything in between, without a limit unless you set one.

       But the feature only helps when quick-xml is hooked up to the struct directly and no buffering is taking place. Wrap the struct in the untagged enum and Serde buffers the entry itself. Read from that buffer, Entry sees creator twice and fails again. The fallback is a map, which keeps only the last creator, and there is no error. With or without the feature you get this:

       Other({"creator": {"$text": "Jane"}, "title": {"$text": "Deser"}, ...})
       

       Notice how John is gone.

       Format specific extension types such as TOML datetimes are another case. TOML has them natively, Serde's data model does not, so the toml crate passes them on as a map with a magic key. In Deser a datetime is an extension value, which formats that know it keep and all others write as a string:

       let value: Value = deser_toml::from_str("released = 2026-09-29T21:00:00+02:00")?;
       
       deser_json::to_string(&value)?;
       // {"released":"2026-09-29T21:00:00+02:00"}
       deser_toml::to_string(&value)?;
       // released = 2026-09-29T21:00:00+02:00
       

       The same with serde_json::Value gives you {"released":{"$__toml_private_datetime":"2026-09-29T21:00:00+02:00"}}, and reading the value into a chrono::DateTime fails outright with invalid type: map, expected an RFC 3339 formatted date and time string.

       The Cost

       So now that you know Deser is at least in theory cool, at what cost?

       It is not free. The design relies on dynamic dispatch and on sinks and emitters that live on the heap, and that has considerable runtime overhead. In my own measurements for JSON, Deser reads somewhere between 33% faster and 60% slower than serde_json depending on the data. On average it's about 10% slower for reading. Writes are between three times as fast and 70% slower and a wash on average. For YAML and TOML it's noticeably faster than the Serde based crates, but that is more about the format implementations than the architecture.

       Compile times slightly are better, but not dramatically so. Because it doesn't monomorphize everything, release builds of derived code are about 2.3 times as fast as with Serde and that get a tiny bit better in practice for your own code as less recompilation is necessary.

       To make Deser's design work at all, it also uses unsafe internally. Most of this is to keep the chain of borrowed sinks on the heap. I feel like this is fine in the days of Miri and agents, but I know it makes some folks uneasy.

       And well, the biggest cost is that it's just not Serde.

       How Much Is There?

       Quite a lot actually which might be surprising. In addition to the core there is support for derive.

       It supports all flavorts of JSON you can think of: JSON, JSONC, JSON5 and HJSON. (Fun fact here: they are all generated out of one shared parser template) For binary handling it supports CBOR and MessagePack. Additionally it does YAML 1.1 and 1.2, TOML, XML and all three flavors of Apple's plist as well as CSV/TSV, urlencoded data and environment variables. For more crazy contraptions you can attach path info or capture location data as well as support for debug printing. You can perform validation as you parse, opt into different binary encodings in addition to base64, you can bridge to serde or capture dynamic values, transcode between formats or hook it up with tokio.

       For documentation see docs.rs/deser and the code itself is on GitHub alongside many examples.

   16. 🔗 New Music Releases A Perfect Circle - To Whom It May Concern rss

       A Perfect Circle - a new release is available:

       • 2026-09-29: To Whom It May Concern (Single)

       Amazon: Canada | Deutschland | France | United Kingdom | United States

       Visit muspy for more information.

   17. 🔗 New Music Releases Atreyu - Her Portrait in Black rss

       Atreyu - a new release is available:

       • 2026-09-29: Her Portrait in Black (Single)

       Amazon: Canada | Deutschland | France | United Kingdom | United States

       Visit muspy for more information.

   18. 🔗 Ampcode News Plaid Speed rss

       Amp now supports Plaid speed for modes that use GPT-6 Astra. Plaid uses OpenAI's ultrafast speed tier, which enables inference requests to run up to 6× faster, with 6× cost per token.

       Open the mode picker in the new thread dialog, choose a mode that uses GPT-6 Astra (e.g., the default High mode), and move the speed switch past Fast to Plaid.

       

       Plaid currently works with Amp-provided inference only, as OpenAI does not yet support ultrafast for linked ChatGPT subscriptions. When Plaid is activated, subagents and non-Plaid-enabled model inference will fall back to fast or standard speed. Like fast mode, Plaid can be toggled on or off for an existing thread.

generated: October 02, 2026 at 21:30:35