🏑
  • ↔
  • β†’
  1. August 13, 2026
    1. πŸ”— mahmoudimus/ida-sigmaker v1.14.3 release

      sigmaker.py - IDAPython standalone release

      Release information

      What changed

      Added

      • Windows ARM64 wheels now ship on PyPI. The cibuildwheel matrix gained a native windows-11-arm build that produces win_arm64 wheels for CPython 3.11-3.14 alongside the existing Intel matrix.

      Installation

      1. Copy sigmaker.py to your IDA Pro plugins directory.
      2. Restart IDA Pro.
      3. Use Ctrl+Alt+S to access the Signature Maker menu.

      The release source archive is also installable through Hex-Rays HCLI.

      License

      See the repository for license information.

    2. πŸ”— BLeeEZ/amperfy v2.1.1 Custom HTTP Headers, Autoplay, Instant Mix release

      Features

      • Support custom HTTP headers per account
      • Support autoplaying similar songs at the end of the play queue
      • Add "Instant Mix" via the server API to request similar songs
      • Support sharing songs
      • Display radio station metadata in player info
      • Always-on-top setting for the macOS mini player
      • Clicking a lyric line will seek to that point in the song
      • Seek directly on click (instead of click-and-drag) in the macOS player

      Bug Fixes

      • Fixed endless artwork downloads
      • Fixed playing a song directly when clicked in the Home random songs section
      • Fixed CarPlay displaying the album's song list instead of directly playing the album

      Contributors

      @jrmgx: seek directly on click (instead of click- and-drag) in the macOS mini player
      @thrandale: display radio station metadata in player info & clicking a lyric line will seek to that point in the song
      @elafargue: add "Instant Mix" via the server API to request similar songs
      @jesusjimsa: increased player artwork size
      @mikeliddle: always-on-top setting for the macOS mini player
      @jlandersen: improve player seek bar hit area
      @thisolivier: support sharing songs
      @RaulitoRS97: performance improvements
      @bmcwilliams96: fixed CarPlay displaying the album's song list instead of directly playing the album & support autoplaying similar songs at the end of the play queue
      @santiagorod92: support custom HTTP headers per account

      Thank you very much for your contributions.

    3. πŸ”— HexRaysSA/ida-codemode v0.6.0 release

      What's Changed

      Full Changelog : v0.5.2...v0.6.0

    4. πŸ”— HexRaysSA/ida-codemode v0.5.3 release

      What's Changed

      Full Changelog : v0.5.2...v0.5.3

    5. πŸ”— r/LocalLLaMA The countdown to Qwen3.8-27B starts now! rss

      The countdown to Qwen3.8-27B starts now! | submitted by /u/Ok-Shower7286
      [link] [comments]
      ---|---

    6. πŸ”— PrimeIntellect-ai/prime-agent Beta (v0.7.2-beta.484.1.7787f07) release

      Automated beta build from main (7787f07415d843b9a800f6a4720e0c739bd608e5).

    7. πŸ”— backnotprop/plannotator v0.27.1 release

      Follow @plannotator on X for updates

      Missed recent releases? Release | Highlights
      ---|---
      v0.27.0 | Call Flow analysis, --tailscale remote reviews, review panel remembers your view, Pi rebuild (breaking command rename), focus-mode shortcut
      v0.26.8 | Placed comment markers on HTML pages, shift-click multi-select, live app annotation
      v0.26.7 | Pinpoint targets any element on HTML pages, smarter hover labels, zero-scan hit testing
      v0.26.6 | Fixed empty environment variables in sandboxed sessions (Bun 1.3.14 builds)
      v0.26.5 | HTML pinpoint element annotations, durable annotate submissions, installer fallback for old git, vim HUD cursor fix
      v0.26.4 | Skill-menu hover jitter fix (same-day patch on v0.26.3)
      v0.26.3 | Skill references in comments with / or $, reachable remote session URLs, worktree switcher tooltips
      v0.26.2 | Single-file diff tabs render fully, no more silently dropped review files, light/dark theme pairs, palette-matched code blocks
      v0.26.1 | GitButler 0.22.0 compatibility via capability-probed JSON flags
      v0.26.0 | Edit Mode (suggest by editing the diff), Guided Review virtualization, colorblind theme, safe uninstall, installer opt-outs, OpenCode 2 support
      v0.25.1 | Codex no longer launches on review open, annotate-last follows the live conversation, pi-todos mirror, Claude Opus 5, abandoned-gate dismissal
      v0.25.0 | Vim keyboard controls, Approve with Notes, scriptable annotate gates, persistent Guided Reviews, memory and file-watching hardening

      What's New in v0.27.1

      Two fixes on top of v0.27.0. If you are coming from an earlier version, the full v0.27.0 notes follow below; v0.27.1 is that release plus:

      Open in editor no longer breaks after repeated sessions

      Community-reported: the open-in-editor button in code review could stop working after a few review cycles. Two defects were behind it. The launch call waited on the editor command with no time limit, so a lingering editor CLI left the button as a dead spinner. And the launched editor shared the review session's process group, so an editor cold-started from the button could be killed along with the session, which can strand the editor's own single- instance state and make every later open a silent no-op. Editor launches are now fully detached into their own process group and the wait is bounded: instant failures still show the friendly error, and a healthy launch can never hang the button or die with the session.

      File headers respect the Viewed and Git-add visibility toggles

      v0.27.0 added toggles to hide the Viewed and stage controls in the file tree, but the same controls still appeared in every file header in the diff. Toggling a control off now hides it everywhere: tree, sections, file headers, and guide file cards. Viewed state and the V/A keyboard shortcuts are unaffected.

      What's New in v0.27.0

      This is the largest release since v0.25.0: Call Flow analysis for code review, a first-class Tailscale story for reviewing from another device, a rework of the review panel around how people actually switch views, and a rebuilt Pi integration. Fourteen PRs landed. Every feature went through independent review, and the release as a whole passed two full QA sweeps (a 28-item verification workflow plus live journey, seam, and free-roam testing) before tagging.

      Important

      Breaking change for Pi users: the Pi plan-mode command is renamed /plannotator β†’ /plannotator-plan-mode. The old command no longer does anything. Update any saved workflows or muscle memory. See the Pi section below for why.

      Call Flow: see the call paths your diff changes

      Code review gets a third analysis layer alongside semantic diff: Call Flow , powered by CallDiff (AST-based, built with Tree-sitter, 22 languages supported). Enable it and the review computes, for the changeset on screen, every call path that gained or lost a call: trees rooted at your entry points, walking down to the exact functions the diff touched. A tax calculation moving from before a discount to after it shows up as a removed call and an added call in the same tree, rendered across every route that reaches it. A text diff cannot show you that.

      Enabling Call flow is consent for a small managed runtime install (about 5 MB: a pruned CallDiff core plus only the language packs your changed files need). The install runs in the background while you review; missing languages install themselves later under the same consent, and a Languages list supports installing ahead. Nothing is downloaded unless you opt in, the app works fully without it, and a failed install degrades to a clear retry, never a broken review.

      The path view organizes into collapsible entry sections with changed-path defaults and file boundaries. Every Call Flow row is commentable: click a row to start a comment, shift-click to collect multiple steps into one annotation. Comments on rows inside the visible diff anchor inline; rows outside it become file- or review-scoped feedback with the full call context preserved for your agent. A searchable raw view with a color-classified rendering is there when you want the unprocessed output, and Cmd+F inside the panel searches the analysis rather than the file tree.

      Review from your iPad: --tailscale mode, tailnet auto-detection, and a QR

      code

      Two community threads asked the same question from different directions: can I run the agent on my Mac and do the review from an iPad, and can I get a diff out of a VPS without SSH port-mapping gymnastics. @nikuscs went as far as building a proof-of- concept wrapper script. As of this release the answer is built in:

      plannotator review --tailscale

      The server stays bound to localhost. Plannotator runs tailscale serve in front of it, prints an HTTPS URL that works on every device in your tailnet, and renders a QR code in the terminal so a phone or tablet joins by pointing a camera at it. The serve mapping is cleaned up when the session ends, an existing mapping on the port is never stolen, and if Tailscale is not installed the command fails fast with an actionable message. annotate and annotate-last support the same flag.

      For classic remote mode, PLANNOTATOR_URL_HOST=auto now resolves your machine's MagicDNS name (or tailnet IP) automatically, so multi-VPS setups no longer configure a hostname per machine. Remote-ready output includes the same QR code.

      Security posture, spelled out: nothing binds beyond localhost under --tailscale, the URL is reachable only inside your own tailnet, public exposure (funnel, ngrok-style tunnels) is deliberately not supported, and the annotate agent terminal stays off for tailnet-published sessions unless you set the existing PLANNOTATOR_AGENT_TERMINAL_REMOTE=1 opt-in. The feature went through an independent security review plus an external reviewer's pass, and the follow-up hardening from both is included: startup failures exit immediately instead of hanging, serve mappings are retried on teardown and never leak silently, foreground serve configs are detected as conflicts, and nohup sessions survive terminal close exactly as they did before.

      The review panel remembers how you work

      If you review in the Tree view, every new session used to open on Git status anyway, and getting back meant one more click every single time. The panel now records the view you last used (Tree or Git status) and opens there. The toggle itself gets the full top row with Tree first, the search and collapse controls moved down next to the file tree, and the footer's copy button gave way to a copy-all control in the sidebar. An explicit choice in Settings still wins over the memo.

      The Commits rail also stops trapping you: clicking a commit used to permanently replace your working diff, with no way back short of restarting the session. Commits is now a self-contained detour. Entering it remembers what you were reviewing; returning to Tree restores that exact diff, and reloading mid-detour lands you back on your session default instead of stuck on a historical commit.

      Two smaller traps closed with the same work: the first-run setup dialog no longer re-runs its one-time reset if you closed the tab without dismissing it, and the fallback view toggle now reflects what is actually on screen.

      Pi integration rebuilt: no more prompt-cache busting

      The Pi extension no longer touches Pi's system prompt at all. Previously it injected planning instructions there, which busted Pi's prompt cache on every phase change and dropped AGENTS.md content, as @paullegranddc reported in #922. Phase framing now travels as ordinary conversation messages, so caching works the way Pi expects and your project instructions survive.

      This rebuild is why the plan-mode command is renamed: /plannotator β†’ /plannotator-plan-mode describes what the command actually does now, and there is no alias for the old name. If you type /plannotator today, nothing happens; use /plannotator-plan-mode.

      Focus mode from the keyboard

      @omardoescode asked for a keybind that clears both sidebars at once for keyboard-first annotation work, and it shipped the same day: Mod+. toggles focus mode in plan review and annotate. First press closes the Contents sidebar and the annotation panel, second press restores exactly what was open before. The binding was chosen after a full conflict audit across every surface and layout (it is also the same key code review already uses to collapse its sidebar), it never fires while you type, and the shortcuts help modal documents it in a new View section.

      Standing instructions for Guided Review

      Guided Review now accepts reviewer-supplied instructions, two ways: per-launch text appended to that guide's brief, and standing instructions stored once and applied to every guide whose launch carries none. Tell it "always lead with data-model changes" once and every future guide complies. Stored globally under your Plannotator data directory, editable from the guide launch surface.

      When a guide fails validation because it referenced files outside the changeset under review (for example, when instructions steer it toward a commit that is not on screen), the error now says exactly that, names the files, and tells you the fix: open that commit in the Commits panel first, then relaunch.

      Hardened release pipeline and security scanning

      The release and deployment pipeline was rebuilt around supply-chain hygiene: every CI action is pinned to a commit SHA, releases validate that the tag sits on main and matches all seven release-coupled version manifests before anything publishes, npm publishing moved to trusted publishing (OIDC) with no long-lived token in the workflow, package construction is separated from the privileged publish step, and deploys wait for the exact commit to pass the full test suite. Gitleaks and zizmor scanning now run on every push and PR with SARIF output into GitHub code scanning, and Dependabot keeps dependencies under watch.

      None of this changes the product, but if you consume Plannotator's binaries or npm packages, the artifacts you install are now attested end to end under a stricter pipeline.

      Additional Changes

      • Last-used view, Commits restore, and panel fixes are covered above; the same PRs also added a tooltip to the per-row stage button and equal-width panel toggle segments. #1273
      • Pi crash containment: a hard VCS failure during Call Flow analysis now returns a structured error instead of killing the Pi server process. #1272
      • Worktree diff-type guard: degenerate worktree: diff types with an empty path no longer fall back to the server's own directory. #1273
      • @plannotator/ui 0.30.0 for host applications: unanchored-annotation reporting via onUnanchoredChange, and readOnly mode keeps the host footer slot. #1263

      Install / Update

      macOS / Linux:

      curl -fsSL https://plannotator.ai/install.sh | bash

      Windows:

      irm https://plannotator.ai/install.ps1 | iex

      Claude Code Plugin: Run /plugin in Claude Code, find plannotator , and click "Update now".

      OpenCode: Clear cache and restart:

      rm -rf ~/.bun/install/cache/@plannotator

      What's Changed

      • feat: reviewer-supplied extra instructions for Guided Review by @backnotprop in #1267
      • feat: add optional CallDiff call-flow analysis by @backnotprop in #1268
      • fix: never touch Pi's system prompt; phase framing as conversation messages by @backnotprop in #1269
      • feat: make the CallDiff runtime a strictly opt-in, in-UI install by @backnotprop in #1270
      • feat: install Call Flow automatically in the background on opt-in by @backnotprop in #1271
      • fix: contain /api/call-flow analysis throws as JSON error responses by @backnotprop in #1272
      • fix: remember the last-used panel view; full-width toggle and cleaner panel chrome by @backnotprop in #1273
      • ci: harden releases and add security scanning by @backnotprop in #1274
      • feat: refine Call Flow navigation and annotations by @backnotprop in #1277
      • fix: restore the prior diff when leaving the Commits view by @backnotprop in #1278
      • feat: focus-mode shortcut to toggle both sidebars by @backnotprop in #1279
      • feat: tailnet auto-advertise, ready QR code, and a first-class --tailscale mode by @backnotprop in #1280
      • fix: tailscale gate exit codes and lease gating, conditional SIGHUP, informative guide validation error by @backnotprop in #1286
      • feat(ui): onUnanchoredChange report + readOnly keeps the host footer slot by @backnotprop in #1263
      • fix: hide viewed and stage controls in file headers when toggled off by @backnotprop in #1288
      • fix: detach open-in-editor launches and bound the wait by @backnotprop in #1289

      Community

      This release was shaped by the community more than any recent one:

      • @nikuscs proposed Tailscale support and built a working proof-of-concept wrapper, then described the multi-VPS workflow that guided the design. --tailscale mode is that idea, productized.
      • @freak4pc and the iPad-review thread on X articulated the "review without touching the machine" use case that the QR code and auto-advertised URLs serve.
      • @omardoescode requested the focus-mode keybind (#1276), shipped in this release, and filed the font customization request (#1275) now on the roadmap.
      • @paullegranddc reported the Pi prompt-cache busting and AGENTS.md loss (#922) that drove the Pi rebuild.
      • An external reviewer's pass on the Tailscale PR caught three correctness issues before release; the fixes shipped in #1286.

      Full Changelog : v0.26.8...v0.27.1

    8. πŸ”— Console.dev newsletter SolidStart 2 rss

      Description: JS framework for web apps.

      What we like: Framework built on Solid v1 for high performance, lightweight web applications. Built on Vite 8 with Rolldown, which brings modern tooling and deployment targets like Netlify, Cloudflare, and general Nitro web servers. Build-in support for auth & sessions, middleware, websockets, data mutation.

      What we dislike: Confusing documentation across Solid, Router, SolidStart, with varying versions v1 and v2.

    9. πŸ”— Console.dev newsletter Amp rss

      Description: Agentic coding environment.

      What we like: Every chat thread can be a cloud VM with multiple repos checked out (or work locally using the CLI). Custom coding harness involves multiple adversarial models to check work as it works. Built-in authenticated preview URLs. Terminal access. Use your existing coding LLM subscription e.g. ChatGPT.

      What we dislike: Uses tokens quite quickly. No native desktop (or mobile) apps - all PWAs.

  2. August 12, 2026
    1. πŸ”— IDA Plugin Updates IDA Plugin Updates on 2026-08-12 rss

      IDA Plugin Updates on 2026-08-12

      New Releases:

      Activity:

      • capa
        • 758c9075: Sync capa-testfiles submodule
      • dotfiles
      • ida-codemode
        • ef7c39db: readme: more installation details
      • ida-pro-mcp
        • eb25a764: feat(live): full-surface integration suites + 9.3/9.4 API-drift fixes
        • 0ae0e2a3: feat(runtime): idalib backend behind IDA_MCP_RUNTIME=idalib
        • 64bd2393: docs(wiki): GP sreg seam is dead β€” RISC-V has no segment registers
        • 8ccf4096: fix(open): memory_model no longer silently dropped; processor_options…
        • fd8d283c: fix(riscv): GP-relative xrefs resolve headless via ref re-pointing
        • f8a22c52: feat(validation): close out the 9.4 work items with live runtime matrix
        • b46dfa41: feat(compat): tinfo-based stack-frame walk replaces removed get_frame
        • 904d022a: docs: mark func_t remnant + segment-mutation batches complete
        • 482d579f: feat(compat): migrate func_t-holding remnant + segment mutation to 9.…
        • 8e358908: docs: record EA-API migration completion + remnant audit scope
        • c26b22c3: feat(compat): migrate remaining getseg sites to 9.4 EA API
        • dc863399: feat(compat): migrate flat tools batch to 9.4 EA APIs
        • 734951d7: feat(compat): migrate search subtree + error_handling to 9.4 EA APIs
        • fd42cd24: feat(compat): migrate tools batch 2 to 9.4 EA function APIs
        • 20036c08: feat(compat): function + segment-attribute wrappers for 9.4 EA APIs
      • ida_kcpp
      • IDAPluginList
        • 15f1eda1: chore: Auto update IDA plugins (Updated: 19, Cloned: 0, Failed: 0)
      • project
      • qscripts
        • fd970966: Build on libidacpp; fix monitor deactivating after a .deps index change
    2. πŸ”— cloudflare/capnweb capnweb@0.11.1 release

      Patch Changes

      • #239 667958e Thanks @Maximo-Guk! - Keep the published runtime bundles ASCII-only. A doc comment introduced in 0.11.0 carried a U+2212 into every dist bundle, which breaks consumers that inline the bundle through Latin-1-only APIs like btoa(). The comment is fixed and the build now fails if any non-ASCII byte reaches a runtime bundle in dist/.
    3. πŸ”— cloudflare/capnweb capnweb-validate@0.2.4 release

      Patch Changes

      • #240 f7f7fa8 Thanks @Maximo-Guk! - Ship typescript as a dependency (>=5.7.0 <7) instead of an uncapped peer, so the build-time transform keeps a JS-based compiler API in TypeScript 7 (tsgo) workspaces.
    4. πŸ”— backnotprop/plannotator v0.27.0 release

      Follow @plannotator on X for updates

      Missed recent releases? Release | Highlights
      ---|---
      v0.26.8 | Placed comment markers on HTML pages, shift-click multi-select, live app annotation
      v0.26.7 | Pinpoint targets any element on HTML pages, smarter hover labels, zero-scan hit testing
      v0.26.6 | Fixed empty environment variables in sandboxed sessions (Bun 1.3.14 builds)
      v0.26.5 | HTML pinpoint element annotations, durable annotate submissions, installer fallback for old git, vim HUD cursor fix
      v0.26.4 | Skill-menu hover jitter fix (same-day patch on v0.26.3)
      v0.26.3 | Skill references in comments with / or $, reachable remote session URLs, worktree switcher tooltips
      v0.26.2 | Single-file diff tabs render fully, no more silently dropped review files, light/dark theme pairs, palette-matched code blocks
      v0.26.1 | GitButler 0.22.0 compatibility via capability-probed JSON flags
      v0.26.0 | Edit Mode (suggest by editing the diff), Guided Review virtualization, colorblind theme, safe uninstall, installer opt-outs, OpenCode 2 support
      v0.25.1 | Codex no longer launches on review open, annotate-last follows the live conversation, pi-todos mirror, Claude Opus 5, abandoned-gate dismissal
      v0.25.0 | Vim keyboard controls, Approve with Notes, scriptable annotate gates, persistent Guided Reviews, memory and file-watching hardening
      v0.24.2 | Annotate YAML/JSON/TOML config files, XDG data directory support, Codex model catalog update, Cursor sandbox escape hatch

      What's New in v0.27.0

      This is the largest release since v0.25.0: Call Flow analysis for code review, a first-class Tailscale story for reviewing from another device, a rework of the review panel around how people actually switch views, and a rebuilt Pi integration. Fourteen PRs landed. Every feature went through independent review, and the release as a whole passed two full QA sweeps (a 28-item verification workflow plus live journey, seam, and free-roam testing) before tagging.

      Important

      Breaking change for Pi users: the Pi plan-mode command is renamed /plannotator β†’ /plannotator-plan-mode. The old command no longer does anything. Update any saved workflows or muscle memory. See the Pi section below for why.

      Call Flow: see the call paths your diff changes

      Code review gets a third analysis layer alongside semantic diff: Call Flow , powered by CallDiff (AST-based, built with Tree-sitter, 22 languages supported). Enable it and the review computes, for the changeset on screen, every call path that gained or lost a call: trees rooted at your entry points, walking down to the exact functions the diff touched. A tax calculation moving from before a discount to after it shows up as a removed call and an added call in the same tree, rendered across every route that reaches it. A text diff cannot show you that.

      Enabling Call flow is consent for a small managed runtime install (about 5 MB: a pruned CallDiff core plus only the language packs your changed files need). The install runs in the background while you review; missing languages install themselves later under the same consent, and a Languages list supports installing ahead. Nothing is downloaded unless you opt in, the app works fully without it, and a failed install degrades to a clear retry, never a broken review.

      The path view organizes into collapsible entry sections with changed-path defaults and file boundaries. Every Call Flow row is commentable: click a row to start a comment, shift-click to collect multiple steps into one annotation. Comments on rows inside the visible diff anchor inline; rows outside it become file- or review-scoped feedback with the full call context preserved for your agent. A searchable raw view with a color-classified rendering is there when you want the unprocessed output, and Cmd+F inside the panel searches the analysis rather than the file tree.

      Review from your iPad: --tailscale mode, tailnet auto-detection, and a QR

      code

      Two community threads asked the same question from different directions: can I run the agent on my Mac and do the review from an iPad, and can I get a diff out of a VPS without SSH port-mapping gymnastics. @nikuscs went as far as building a proof-of- concept wrapper script. As of this release the answer is built in:

      plannotator review --tailscale

      The server stays bound to localhost. Plannotator runs tailscale serve in front of it, prints an HTTPS URL that works on every device in your tailnet, and renders a QR code in the terminal so a phone or tablet joins by pointing a camera at it. The serve mapping is cleaned up when the session ends, an existing mapping on the port is never stolen, and if Tailscale is not installed the command fails fast with an actionable message. annotate and annotate-last support the same flag.

      For classic remote mode, PLANNOTATOR_URL_HOST=auto now resolves your machine's MagicDNS name (or tailnet IP) automatically, so multi-VPS setups no longer configure a hostname per machine. Remote-ready output includes the same QR code.

      Security posture, spelled out: nothing binds beyond localhost under --tailscale, the URL is reachable only inside your own tailnet, public exposure (funnel, ngrok-style tunnels) is deliberately not supported, and the annotate agent terminal stays off for tailnet-published sessions unless you set the existing PLANNOTATOR_AGENT_TERMINAL_REMOTE=1 opt-in. The feature went through an independent security review plus an external reviewer's pass, and the follow-up hardening from both is included: startup failures exit immediately instead of hanging, serve mappings are retried on teardown and never leak silently, foreground serve configs are detected as conflicts, and nohup sessions survive terminal close exactly as they did before.

      The review panel remembers how you work

      If you review in the Tree view, every new session used to open on Git status anyway, and getting back meant one more click every single time. The panel now records the view you last used (Tree or Git status) and opens there. The toggle itself gets the full top row with Tree first, the search and collapse controls moved down next to the file tree, and the footer's copy button gave way to a copy-all control in the sidebar. An explicit choice in Settings still wins over the memo.

      The Commits rail also stops trapping you: clicking a commit used to permanently replace your working diff, with no way back short of restarting the session. Commits is now a self-contained detour. Entering it remembers what you were reviewing; returning to Tree restores that exact diff, and reloading mid-detour lands you back on your session default instead of stuck on a historical commit.

      Two smaller traps closed with the same work: the first-run setup dialog no longer re-runs its one-time reset if you closed the tab without dismissing it, and the fallback view toggle now reflects what is actually on screen.

      Pi integration rebuilt: no more prompt-cache busting

      The Pi extension no longer touches Pi's system prompt at all. Previously it injected planning instructions there, which busted Pi's prompt cache on every phase change and dropped AGENTS.md content, as @paullegranddc reported in #922. Phase framing now travels as ordinary conversation messages, so caching works the way Pi expects and your project instructions survive.

      This rebuild is why the plan-mode command is renamed: /plannotator β†’ /plannotator-plan-mode describes what the command actually does now, and there is no alias for the old name. If you type /plannotator today, nothing happens; use /plannotator-plan-mode.

      Focus mode from the keyboard

      @omardoescode asked for a keybind that clears both sidebars at once for keyboard-first annotation work, and it shipped the same day: Mod+. toggles focus mode in plan review and annotate. First press closes the Contents sidebar and the annotation panel, second press restores exactly what was open before. The binding was chosen after a full conflict audit across every surface and layout (it is also the same key code review already uses to collapse its sidebar), it never fires while you type, and the shortcuts help modal documents it in a new View section.

      Standing instructions for Guided Review

      Guided Review now accepts reviewer-supplied instructions, two ways: per-launch text appended to that guide's brief, and standing instructions stored once and applied to every guide whose launch carries none. Tell it "always lead with data-model changes" once and every future guide complies. Stored globally under your Plannotator data directory, editable from the guide launch surface.

      When a guide fails validation because it referenced files outside the changeset under review (for example, when instructions steer it toward a commit that is not on screen), the error now says exactly that, names the files, and tells you the fix: open that commit in the Commits panel first, then relaunch.

      Hardened release pipeline and security scanning

      The release and deployment pipeline was rebuilt around supply-chain hygiene: every CI action is pinned to a commit SHA, releases validate that the tag sits on main and matches all seven release-coupled version manifests before anything publishes, npm publishing moved to trusted publishing (OIDC) with no long-lived token in the workflow, package construction is separated from the privileged publish step, and deploys wait for the exact commit to pass the full test suite. Gitleaks and zizmor scanning now run on every push and PR with SARIF output into GitHub code scanning, and Dependabot keeps dependencies under watch.

      None of this changes the product, but if you consume Plannotator's binaries or npm packages, the artifacts you install are now attested end to end under a stricter pipeline.

      Additional Changes

      • Last-used view, Commits restore, and panel fixes are covered above; the same PRs also added a tooltip to the per-row stage button and equal-width panel toggle segments. #1273
      • Pi crash containment: a hard VCS failure during Call Flow analysis now returns a structured error instead of killing the Pi server process. #1272
      • Worktree diff-type guard: degenerate worktree: diff types with an empty path no longer fall back to the server's own directory. #1273
      • @plannotator/ui 0.30.0 for host applications: unanchored-annotation reporting via onUnanchoredChange, and readOnly mode keeps the host footer slot. #1263

      Install / Update

      macOS / Linux:

      curl -fsSL https://plannotator.ai/install.sh | bash

      Windows:

      irm https://plannotator.ai/install.ps1 | iex

      Claude Code Plugin: Run /plugin in Claude Code, find plannotator , and click "Update now".

      OpenCode: Clear cache and restart:

      rm -rf ~/.bun/install/cache/@plannotator

      What's Changed

      • feat: reviewer-supplied extra instructions for Guided Review by @backnotprop in #1267
      • feat: add optional CallDiff call-flow analysis by @backnotprop in #1268
      • fix: never touch Pi's system prompt; phase framing as conversation messages by @backnotprop in #1269
      • feat: make the CallDiff runtime a strictly opt-in, in-UI install by @backnotprop in #1270
      • feat: install Call Flow automatically in the background on opt-in by @backnotprop in #1271
      • fix: contain /api/call-flow analysis throws as JSON error responses by @backnotprop in #1272
      • fix: remember the last-used panel view; full-width toggle and cleaner panel chrome by @backnotprop in #1273
      • ci: harden releases and add security scanning by @backnotprop in #1274
      • feat: refine Call Flow navigation and annotations by @backnotprop in #1277
      • fix: restore the prior diff when leaving the Commits view by @backnotprop in #1278
      • feat: focus-mode shortcut to toggle both sidebars by @backnotprop in #1279
      • feat: tailnet auto-advertise, ready QR code, and a first-class --tailscale mode by @backnotprop in #1280
      • fix: tailscale gate exit codes and lease gating, conditional SIGHUP, informative guide validation error by @backnotprop in #1286
      • feat(ui): onUnanchoredChange report + readOnly keeps the host footer slot by @backnotprop in #1263

      Community

      This release was shaped by the community more than any recent one:

      • @nikuscs proposed Tailscale support and built a working proof-of-concept wrapper, then described the multi-VPS workflow that guided the design. --tailscale mode is that idea, productized.
      • @freak4pc and the iPad-review thread on X articulated the "review without touching the machine" use case that the QR code and auto-advertised URLs serve.
      • @omardoescode requested the focus-mode keybind (#1276), shipped in this release, and filed the font customization request (#1275) now on the roadmap.
      • @paullegranddc reported the Pi prompt-cache busting and AGENTS.md loss (#922) that drove the Pi rebuild.
      • An external reviewer's pass on the Tailscale PR caught three correctness issues before release; the fixes shipped in #1286.

      Full Changelog : v0.26.8...v0.27.0

    5. πŸ”— r/LocalLLaMA Today is Models Day rss

      Today is Models Day | submitted by /u/Fz1zz
      [link] [comments]
      ---|---

    6. πŸ”— cloudflare/capnweb capnweb-validate@0.2.3 release

      Patch Changes

      • #227 2b292e4 Thanks @teamchong! - Ignore extra arguments past a method's declared parameters instead of refusing the call, and drop them before invoking the implementation.
    7. πŸ”— cloudflare/capnweb capnweb@0.11.0 release

      Minor Changes

      • #212 1cca1a2 Thanks @codehz! - Support RpcTargets (and other RPC stubs) as ReadableStream/WritableStream chunks without disposing their capabilities when write() returns. Stream chunk payloads now keep lifecycle tied to the chunk (via Symbol.dispose when needed) so methods on streamed stubs remain usable after the write resolves.

      • #201 7325f9d Thanks @ttmx! - Support exact ArrayBuffer, DataView, and typed array serialization over RPC.

      • #224 064b0f3 Thanks @dimitropoulos! - Support serializing URL objects over RPC.

      Patch Changes

      • #220 43aa384 Thanks @ndisidore! - Remove the ~1ms per-batch latency floor in the HTTP batch client on Node and Bun by flushing via setImmediate instead of the clamped setTimeout(0).

      • #214 2a02db9 Thanks @ndisidore! - The RPC ReadableStream type accepts any RPC-compatible chunk type, matching WritableStream.

      • #238 1a1f0d4 Thanks @Maximo-Guk! - Share one RpcPromise alias between Result and the public export. Deeply-nested RPC interfaces no longer blow the checker's depth budget: this fixes all "excessively deep" / "excessive stack depth" (TS2589/TS2321) errors under TypeScript 7 (tsgo) and reduces TypeScript 5.9 type instantiations by ~13%. RpcPromise<T> for primitive T now also carries the pipelining Provider<T> surface, matching what stub calls already returned.

    8. πŸ”— r/LocalLLaMA Qwen3.8-2.4T-A95B Released rss

      Qwen3.8-2.4T-A95B Released | submitted by /u/de4dee
      [link] [comments]
      ---|---

    9. πŸ”— @binaryninja@infosec.exchange Sidekick 26.1 is out now! Sidekick finally has a proper home as a Binary Ninja mastodon

      Sidekick 26.1 is out now! Sidekick finally has a proper home as a Binary Ninja view, with each binary or project built around one continuing conversation with a lead agent. Also new: consolidated Resources, terminal access, transaction Revert, faster sidebars, lower first-response latency, and plenty more. Check out everything new in 26.1: https://sidekick.binary.ninja/blog/sidekick-26-1-a-proper-home-for- sidekick/

    10. πŸ”— r/LocalLLaMA Exact Qwen 3.8 27b release date and time rss

      Exact Qwen 3.8 27b release date and time | Since it seems like there is some confusion in other threads... Source: - https://modelscope.cn/models/Qwen/Qwen3.8-27B - https://huggingface.co/Qwen/Qwen3.8-27B EDIT: They took the page down, idk why they did that. I'm slammed at work so haven't had time to look into it more, def a bummer though. EDIT 2: The Modelscope link is working again. Also added the hugging face link. submitted by /u/yuicebox
      [link] [comments]
      ---|---

    11. πŸ”— Barre/ZeroFS v2.2.3 release

      What's Changed

      Full Changelog : v2.2.2...v2.2.3

    12. πŸ”— HexRaysSA/plugin-repository commits sync repo: +5 releases rss 
      sync repo: +5 releases

## New releases
- [IDA-MCP](https://github.com/captain-ai-hub/ida-mcp): 0.6.3, 0.6.2, 0.6.1
- [ida-codemode](https://github.com/hexrayssa/ida-codemode): 0.5.2, 0.5.1
    13. πŸ”— r/LocalLLaMA It's the final countdown, baby! Qwen is out in just over 7 hours! rss

      It's the final countdown, baby! Qwen is out in just over 7 hours! | Historic event! We're ready! Google Translate, on the other hand, is not ready! submitted by /u/LegacyRemaster
      [link] [comments]
      ---|---

    14. πŸ”— r/LocalLLaMA RTX 6000 PRO price raised to $16,000 USD on the Nvidia website rss

      RTX 6000 PRO price raised to $16,000 USD on the Nvidia website | submitted by /u/Norwood_Reaper_
      [link] [comments]
      ---|---

    15. πŸ”— seanmonstar Micro: A trait for fluent Durations rss

      I dislike the pattern in some languages to create durations by multiplying constants. It feels like a concession when it cannot be expressed more nicely. There’s a tracking issue to add such constants in libstd.

      How about a trait instead? (I suggested it in the tracking issue a long time ago, but it’s lost in the noise). Rust traits are awesome. They can be implemented on any other type, even primitives, without them needing to cooperate.

      A trait could allow us to write 5.seconds(), or 200.milliseconds(), etc. I think this is much better. I would rather this exist instead. Maybe std::time::TimeUnits, or pick a better name, doesn’t matter which, just that it’s easy to import.

  3. August 11, 2026
    1. πŸ”— IDA Plugin Updates IDA Plugin Updates on 2026-08-11 rss

      IDA Plugin Updates on 2026-08-11

      New Releases:

      Activity:

      • CaeriusIDA
      • capa
        • b5864729: Sync capa-testfiles submodule
        • cd2621d8: Sync capa-testfiles submodule
      • disrobe
        • c11220a1: evidence: bound measured tool execution
        • 44ae17ba: workspace: centralize internal dependency versions
        • 12e0bde5: codec: centralize validated custom base64 decoding
        • df07ddf5: bytes: preserve migrated decoder edge contracts
        • 8d1b6f44: bytes: centralize bounded leb128 decoding
        • d477f752: recon: pin planted corpus finding counts
        • bc931932: chain: enforce typed metadata access
        • 64052f77: native: recover aarch64 binary16 scalar operations
        • a3813104: process: normalize short Windows tool paths
        • 1b2a6dc7: mobile: gate chain analysis helpers
        • c0f94e53: native: bound emitter traversal and ordered membership
        • 0f9d1e87: lua: bind opcode coverage to its table row
        • d74b930d: lua: record prometheus vmify corpus members
        • cc6de0ea: ruby: recover loop jumps and block attachments
      • grokathon
        • 84d5187b: Merge pull request #146 from theodorechapman/engine-demos
        • 268a4d4c: demos: restore the metrics evidence bench as a live hub page
        • 044ae685: demos: 3D engine bay, demo hub, MAME wiring, frozen classic demo
        • 259d93a9: Merge pull request #145 from theodorechapman/mute-game-audio
        • c13753b9: arcade: mute all game audio (breaks screen recordings)
      • ida-codemode
        • 5ba472f0: Merge pull request #21 from HexRaysSA/omp-support
        • d853a1d1: Add oh-my-pi support
        • e92f30f8: 0.5.2
        • 4dd6a603: Remove automated hcli plugin install magic
        • 976503bc: Bump ida-domain in ida-plugin.json
        • d54aa05d: Add hcli ida python explain-environment output to trace log
        • 96a2e441: 0.5.1
        • bce2569d: Bump hcli to 0.19.1
      • ida-pro-mcp
        • 18144409: Merge pull request #62 from GrecAndrei/swarm/paper-addressal
    2. πŸ”— r/LocalLLaMA All the more reason not to use Closed Models ... Claude now officially "marks" AI-generated content ... steganographically, apparently ... and there are false positives already rss

      submitted by /u/johnnyApplePRNG
      [link] [comments]

    3. πŸ”— PrimeIntellect-ai/prime-agent v0.7.2 release
      • Fixed Down Arrow focusing the Agents View entry before moving a nonempty prompt cursor to the end (ENG-5147).
      • Added app.messages.expand (ctrl+p) to collapse or expand agent-to-agent messages separately from ctrl+o tool output.
      • Added a ctrl+t expand hint to collapsed thinking blocks, matching the tool output hint.
      • Changed expand/collapse hints to a consistent bracketed (Ctrl+O to expand) style across tool, message, summary, and error rows.
      • Added a configurable copy action to login dialogs so raw sign-in URLs can be copied without selecting wrapped text (#643).
      • Added privacy-safe pseudonymous product analytics for onboarding, command use, execution modes, run outcomes, TTFT, latency, usage, tools, retries, and compactions, with disclosure and opt-out controls (ENG-4682).
      • Changed sent agent messages in the IPython cell UI to show only the message text with a ╰─ gutter when expanded, matching received messages, and hid the raw agent_message.send receipt dictionary.
      • Fixed Homebrew installs attempting to self-update their versioned Cellar keg instead of directing users to brew upgrade prime-agent (#844)
      • Fixed the agents view collapsing expanded subagent lists when returning from an opened agent (ENG-5105).
      • Kept the subagent summary row visible and selectable while its list is expanded in the agents view, so pressing enter on it collapses the list again (ENG-5105).
      • Added in-place editing of queued steering and follow-up messages: Alt+Up/Alt+Down browse the queue from the draft, Enter applies the edit as steering, Alt+Enter as a follow-up, and submitting an empty editor deletes the item; interrupts now preserve the queue (#838).
      • Fixed workers with no live connection reporting as ready; stopping workers now report a stopping state, are hidden from live sessions, and no longer receive daemon-wide commands (#850).
      • Fixed timed-out worker stops stranding dead-but-registered workers ("Session worker is not connected"); stops now finalize in the background once the process exits, and zombie processes are no longer counted as alive (#851).
      • Fixed sessions becoming permanently unopenable after a stale worker registration was left behind; open/resume now self-heals by finishing the old cleanup and starting a fresh worker (#852).
    4. πŸ”— modem-dev/hunk v0.18.1 release

      What's Changed

      Full Changelog : v0.18.0...v0.18.1

    5. πŸ”— HexRaysSA/ida-codemode v0.5.2 release

      Full Changelog : v0.5.1...v0.5.2

    6. πŸ”— r/LocalLLaMA Introducing Unsloth Desktop app rss

      Introducing Unsloth Desktop app | Hi LocalLlama, we're super excited to release Unsloth Desktop today! πŸ¦₯
      It's the first desktop app that enables you to run and train models locally. Open-source. Available on Mac, Windows, and Linux

      • Supports MLX, diffusion image/video models, audio models, and GGUF
      • You can run MiniMax-H3, Muse Glimmer, soon Qwen 3.8 etc
      • Connect Claude Code and Codex to local LLMs
      • 50% more accurate with self-healing tool calls and sandboxed code execution
      • Supports CPU and multi-GPU setups across NVIDIA, AMD, Intel, and Mac
      • Train models 2Γ— faster while using 70% less VRAM
      • Includes private web search, deep research, RAG, MCP, and exports (NVFP4, GGUF)
      • Use Unsloth’s OpenAI-compatible API with OpenAI and Anthropic cloud models
      • Securely deploy LLMs remotely and access them anywhere via Cloudflare HTTPS

      We do not collect any telemetry or data. Unsloth Desktop is now available on unsloth.ai and GitHub.

      Thanks for the support as always and we're here to answer any questions! πŸ’— submitted by /u/danielhanchen
      [link] [comments]
      ---|---

    7. πŸ”— r/LocalLLaMA nvidia/NVIDIA-Nemotron-3.5-Lightning-30B-A3B-BF16 Β· Hugging Face rss

      nvidia/NVIDIA-Nemotron-3.5-Lightning-30B-A3B-BF16 Β· Hugging Face | submitted by /u/coder543
      [link] [comments]
      ---|---

    8. πŸ”— exe.dev OAuth for Agents rss

      Agents are unusually capable credential-handling tools. They read logs, execute commands, inspect files, call external services, and frequently operate on inputs that weren’t written by the person who deployed them.

      Giving an agent a long-lived secret means trusting not only the agent itself, but every tool it invokes, every file it reads, and every instruction it encounters, magnified by autonomous decision making.

      At exe, we believe agents should be able to access everything they need. That said, we do our best to avoid giving them persistent credentials that could leak.

      The safer model is to give the agent an identity and let it obtain narrowly scoped, short-lived access when it needs it. We’ve already built quite a few things around this idea, including our HTTPS proxy integration and our LLM integration, and recently we added support for Workload Identity Federation, or WIF.

      So what is WIF, and why is it a big deal?

      Years ago, back when I was working on Kubernetes, one of the most popular workflows users had was giving workloads running in k8s access to some cloud resource, say BigQuery.

      The typical solution up until that point was to create a service account, download its secret JSON fileβ€”which let you act as that service accountβ€”put it in a Secret in the k8s API, mount it into your pod, and then configure the cloud APIs to use it.

      It was a fairly suboptimal user experience. The secret had to be long-lived, could be leaked, needed to be rotated periodically, and there was really no way to know who or what was using it.

      Sounds familiar!

      Then the great security engineers working on Kubernetes realized that, by adding a few features to GCP and Kubernetes, they could use the Kubernetes API server as a trust boundary by having it act as an identity provider.

      In some ways, it already was one: the secrets were stored there, it already had a concept of service accounts, and it knew which workload was running as which identity.

      It worked by letting pods ask the k8s API server for a signed token (or JWT), which could then be presented to GCP to impersonate a service account. GCP would confirm that the k8s API server had signed it and that the cluster was within the configured trust boundary.

      If everything was configured correctly, your Kubernetes pods could now magically act as a GCP service account without ever being given a long-lived GCP credential. As a bonus, you could know exactly which pod was accessing which resources.

      Under the hood, this uses a lesser-known OAuth 2.0 flow called token exchange. One system issues a cryptographically signed token asserting who you are, and another system decides whether it trusts that issuer and is willing to exchange that token for one of its own.

      The method quickly spread, and all the major clouds shipped some version of it. Things like GitHub Actions adopted it too, letting you use GitHub’s identity to access cloud resources instead of storing long-lived cloud credentials.

      The new exe WIF integration follows suite and allows an agent (or workload) running on exe to use its identity to access resources on any cloud, or really anywhere, without needing a long-lived credential sitting around inside the VM.

      It is the same basic idea Kubernetes arrived at years ago: give the workload an identity, establish trust between systems, and mint short-lived access when it is actually needed instead of copying secrets everywhere.

      To use it in exe, go to the integrations page and create a new Identity Federation integration. You can then attach it to tags or individual VMs.

      You’ll need to configure the resource provider (GCP, AWS, etc) to consume the credentials. We have some guides for AWS and GCP already and more are coming soon.

      We would love to hear which services you would use this with and how we could improve the experience.

      Bonus - sequence diagram

      sequenceDiagram
    autonumber

    box Inside the exe VM
        actor Agent as Agent or workload
        participant Auth as Google auth library
    end

    box exe.dev
        participant Integration as Attached WIF integration
        participant Issuer as exe.dev OIDC issuer
    end

    box Google Cloud
        participant STS as Google STS
        participant IAM as IAM Credentials API
        participant BigQuery as BigQuery
    end

    Note over Integration,BigQuery: One-time setup<br/>The integration is attached to this VM<br/>Google trusts the exe.dev OIDC issuer<br/>The exe identity may impersonate the service account

    Agent->>Auth: Make a BigQuery request

    Note over Auth: Google auth loads the external account configuration<br/>and discovers the exe token endpoint

    Auth->>Integration: Request an exe identity token

    Note over Integration,Issuer: Request crosses from the VM<br/>into exe.dev

    Integration->>Integration: Verify the VM is allowed<br/>to use this integration
    Integration-->>Auth: Short-lived exe.dev OIDC token

    Note over Auth,STS: The VM sends the exe identity token<br/>directly to Google Cloud

    Auth->>STS: Exchange exe.dev OIDC token<br/>for a Google federated token

    opt Google does not have the signing keys cached
        STS->>Issuer: Fetch OIDC metadata and signing keys
        Issuer-->>STS: Issuer metadata and signing keys
    end

    STS->>STS: Verify signature, issuer,<br/>audience, expiry, and subject
    STS-->>Auth: Short-lived federated token

    Auth->>IAM: Request an access token for<br/>the configured service account
    IAM->>IAM: Verify the exe identity may<br/>impersonate the service account
    IAM-->>Auth: Short-lived service account access token

    Auth->>BigQuery: Call BigQuery with<br/>the service account access token
    BigQuery-->>Auth: Query response

    Auth-->>Agent: Return result
    9. πŸ”— MetaBrainz Picard 3 beta 9 released rss

      Today, we have released MusicBrainz Picard 3 beta 9. This new versions brings several fixes over the last beta 7 (yes, we have skipped a beta number again), but also improvements and some new features.

      Since we are near a final release, we tried to focus on quality of life and UI/UX improvements, some changes in the UI are quite important (release preferences UI is a complete overhaul, and the new About dialog also got a nice refresh). Among the highlights are:

      • MetaBrainz OAuth2 support and various OAuth improvements and bug fixes
      • ISRC reading (from files or CD) and optional submission

      • Word diff for tags in the Metadata Box

      • UI/UX improvements: Redesign of some option pages, along re-organization and performance improvements

      • Plugin API improvements

      Download links and a detailed list of changes since Picard 3 beta 7 are available below. For a more detailed overview of what is new in Picard 3 please see the previous blog post Picard 3 Alpha Release.

      While we have all the major features implemented and with the latest bug fixes we are confident in the current code, this is still a pre-release and there might be bugs. If you use this, do so with care, backup your files and please report any issues you encounter.

      Some of the changes are also backward incompatible, hence we recommend you make a backup of your Picard.ini config file before trying the beta version. You can do so in Picard’s Options under Advanced > Maintenance.

      What’s new?

      Bugs

      • [PICARD-3349] - Copying the "new" column of a deleted tag in the metadata box copies the old value instead of empty
      • [PICARD-3351] - Options dialog is sometimes too big in height, impossible to access Make It So button
      • [PICARD-3352] - "Embed only a single front image" option can prevent images to be loaded
      • [PICARD-3357] - Some Cyanrip log files fail to be parsed
      • [PICARD-3365] - Debug options tooltips not shown
      • [PICARD-3368] - Removing multiple tags from multiple tracks is slow
      • [PICARD-3372] - Infinite OAuth retry loop when refresh token is revoked

      New Features

      • [PICARD-163] - ISRC support for lookup and submission
      • [PICARD-2482] - Submit ISRCs from CD
      • [PICARD-3355] - Allow plugins to unregister script variables and allow double registering
      • [PICARD-3356] - Expose plugin_persist storage in plugin v3 API
      • [PICARD-3358] - Add metadata tag context menu extension point and script variable title for plugins
      • [PICARD-3363] - Add option to allow complete albums to be auto removed after save
      • [PICARD-3367] - Add shell completion generation for picard-cli
      • [PICARD-3369] - Add a test playground for checking file names in local cover art options

      Improvements

      Download

      We appreciate your interest in trying this new version. Use with care, backup your files and please use theMetaBrainz community forums and the ticket system to give feedback and report bugs.

      For Windows and macOS you can download the beta version from the Picard download page. Linux users can run from source or try the beta channel of the Picard snap package.

      Picard is free software and the source code is available on GitHub.

      Acknowledgements

      Code contributions by Bob Swift, Bryan Roessler, Laurent Monin and Philipp Wolfer.
      Translations were updated by "ApeKattQuest, MonkeyPython" (Norwegian BokmΓ₯l), blueday (Swedish), Gsam3 (German), Marc Riera (Catalan), silentbird (Chinese (Traditional Han script)) and Vaclovas Intas (Lithuanian).
      Documentation updates by Bob Swift, Laurent Monin and Philipp Wolfer.

    10. πŸ”— HexRaysSA/ida-codemode v0.5.1 release

      Full Changelog : v0.5.0...v0.5.1

    11. πŸ”— HexRaysSA/plugin-repository commits sync repo: +1 release rss 
      sync repo: +1 release

## New releases
- [ida-codemode](https://github.com/hexrayssa/ida-codemode): 0.5.0
    12. πŸ”— r/LocalLLaMA Qwen 3.8-27b coming this week rss

      Qwen 3.8-27b coming this week | Confirmed by the official Qwen account. submitted by /u/Bestlife73
      [link] [comments]
      ---|---

    13. πŸ”— hacker news ida pro references New comment by mettamage in "Squeak 6.1" rss

      It does though. It teaches you that closed source is still open source in many many ways. Especially when you have something like Ghidra or IDA Pro. Nowadays this is even more true because LLMs can speed up retrieval of missing knowledge way more quickly. Back in the day I had to search for stuff but I bet now that LLMs give a decent guess at decompilation of something. Also it's the systems programming language and requires you to dive into the computer architecture of things. Try that with Python or JavaScript.

    14. πŸ”— backnotprop/plannotator v0.26.8 release

      Follow @plannotator on X for updates

      Missed recent releases? Release | Highlights
      ---|---
      v0.26.7 | Pinpoint targets any element on HTML pages, smarter hover labels, zero-scan hit testing
      v0.26.6 | Fixed empty environment variables in sandboxed sessions (Bun 1.3.14 builds)
      v0.26.5 | HTML pinpoint element annotations, durable annotate submissions, installer fallback for old git, vim HUD cursor fix
      v0.26.4 | Skill-menu hover jitter fix (same-day patch on v0.26.3)
      v0.26.3 | Skill references in comments with / or $, reachable remote session URLs, worktree switcher tooltips
      v0.26.2 | Single-file diff tabs render fully, no more silently dropped review files, light/dark theme pairs, palette-matched code blocks
      v0.26.1 | GitButler 0.22.0 compatibility via capability-probed JSON flags
      v0.26.0 | Edit Mode (suggest by editing the diff), Guided Review virtualization, colorblind theme, safe uninstall, installer opt-outs, OpenCode 2 support
      v0.25.1 | Codex no longer launches on review open, annotate-last follows the live conversation, pi-todos mirror, Claude Opus 5, abandoned-gate dismissal
      v0.25.0 | Vim keyboard controls, Approve with Notes, scriptable annotate gates, persistent Guided Reviews, memory and file-watching hardening
      v0.24.2 | Annotate YAML/JSON/TOML config files, XDG data directory support, Codex model catalog update, Cursor sandbox escape hatch
      v0.24.0 | PR/MR artifact gallery, GitButler review support, port ranges, expanded comment editor, OpenCode + Pi fixes

      What's New in v0.26.8

      This release rebuilds how annotations look and behave on HTML pages, and it is the largest change to the annotate surface since pinpoint mode shipped. Nine PRs landed, three of them from first-time contributors @Snaylaker, @atomicflag, and @monkhai.

      Placed comment markers replace inline highlights on HTML pages

      Annotating a raw HTML page used to write highlight markup directly into the page's own DOM. That caused two visible bugs: multi-paragraph selections often turned only their first paragraph blue, and on some pages the injected markup broke the page's layout. Both had the same root cause, so both are gone the same way: nothing writes into the page anymore.

      Annotations now appear as numbered comment bubbles projected onto a fixed overlay above the page. A bubble sits at the exact point you clicked, not a corner of the element, and it stays glued through scrolling, page re-renders, responsive reflows, and zoom. If the annotated element disappears or scrolls out of a clipped container, its bubble hides instead of floating over unrelated content, and it returns when the target does. Selections highlight through the same overlay, so highlights now always cover the full selection and can never disturb the page beneath.

      The bubbles are real buttons: click one, or click the highlighted text itself, to jump to that annotation in the panel. Highlights brighten on hover so you can tell they are clickable. Bubble numbers match the numbering in the feedback your agent receives, so "see comment 3" means the same thing on screen and in the session. Committed highlights still print; annotating with Cmd+P in mind works the way it did before.

      The implementation went through three adversarial review rounds, a 25-item QA gate with independent verification of every serious finding, and a follow-up hardening pass covering clipping, visibility, print, and per-frame performance on mutation-heavy pages.

      Shift-click selects multiple elements for one comment

      One comment can now cover several places on an HTML page. Make a pinpoint selection, hold Shift, and click more elements: each gains an outline and a chip in the composer, Shift-clicking a selected element removes it, and removing the first selection promotes the next one rather than cancelling the draft. Up to 16 additional targets ride on one comment, and after saving, every target shows a bubble carrying the same comment number. Feedback to the agent lists every selected element, so "these three buttons need the same fix" is one comment, not three.

      HTML sessions open minimal, and stale preferences reset

      Opening an HTML page to annotate now shows just the page: pinpoint input ready, tools hidden, sidebar and annotations drawer closed. Anything you change persists for your next HTML session, but only while you keep using HTML annotate. A preference untouched for a week expires back to these defaults, so a mode you tried once months ago never becomes a permanent surprise. Active users keep their setup; annotating refreshes the clock.

      Pages with their own Content-Security-Policy are now annotatable

      An HTML file carrying its own strict CSP meta tag (common in saved pages and generated reports) silently blocked the annotation script, leaving a page you could see but not annotate. The annotate viewer now removes the document's CSP meta tags before rendering. The iframe sandbox remains the security boundary, and the file on disk is untouched.

      OpenCode: Qwen3.6 no longer corrupts the planning prompt

      OpenCode sessions using Qwen3.6 hit a Jinja template conflict: Plannotator injected its planning instructions as multiple system-prompt parts, and Qwen's template mangled them. @atomicflag rewrote the injection to compose one consolidated system part. The review process surfaced a subtle evaluation-order bug and an escaping edge case, both fixed and regression-tested, and the QA gate then caught that the OpenCode 2 adapter still used the old multi-part path, so the fix now covers both OpenCode 1 and OpenCode 2 entry points.

      Plan position survives window refocus in vim mode

      Switching away from a plan review window and back again reset the vim cursor to the top of the document. @Snaylaker fixed the refocus path to preserve your position, so alt-tabbing to check something no longer costs you your place in a long plan.

      Additional Changes

      • File headers show a hover state in code review. Diff file headers now tint on hover with a short transition, signaling that the header is clickable (it collapses the file). Contributed by @monkhai in #1256.
      • The legacy self-hosting docs route redirects to the canonical docs site. #1255

      Install / Update

      macOS / Linux:

      curl -fsSL https://plannotator.ai/install.sh | bash

      Windows:

      irm https://plannotator.ai/install.ps1 | iex

      Claude Code Plugin: Run /plugin in Claude Code, find plannotator , and click "Update now".

      OpenCode: Clear cache and restart:

      rm -rf ~/.bun/install/cache/@plannotator

      Then in opencode.json:

      {
  "plugin": ["@plannotator/opencode@latest"]
}

      What's Changed

      • fix(vim): preserve plan position on refocus by @Snaylaker in #1252
      • Fix OpenCode plugin Jinja template corruption with Qwen3.6 by @atomicflag in #1114
      • feat(annotate): shift-click multi-element selection for raw-HTML pinpoint by @backnotprop in #1254
      • fix(marketing): redirect self-hosting guide to canonical docs by @backnotprop in #1255
      • feat(review): add file header hover state by @monkhai in #1256
      • feat(annotate): placed comment markers for raw-HTML annotation by @backnotprop in #1257
      • fix: QA-gate hardening for the v0.26.8 feature set by @backnotprop in #1258
      • fix(annotate): strip document-authored CSP meta tags that block the annotation bridge by @backnotprop in #1259
      • feat(annotate): minimal-by-default HTML sessions with stale-preference decay by @backnotprop in #1260

      New Contributors

      Contributors

      Three first-time contributors landed changes in this release. @atomicflag took on a genuinely tricky compatibility problem between Plannotator's system-prompt injection and Qwen3.6's Jinja template, and stuck with it through three review rounds until the fix was airtight. @Snaylaker fixed the vim-mode position reset on window refocus, a small paper cut that anyone reviewing long plans felt daily. @monkhai polished the code review diff headers with a hover state that makes the collapse affordance discoverable.

      Welcome to all three, and thank you.

      Full Changelog : v0.26.7...v0.26.8

    15. πŸ”— Ampcode News Global Plugins and Skills rss

      With so much work happening in orbs there needed to be a new place to store Amp plugins and skills. So we added global plugins and skills. They're Amp-hosted, built for agents, and work everywhere Amp runs.

      You can now tell Amp to:

      • "Create a personal plugin that runs our formatter on every file the agent edits."
      • "Import the browser-testing skill from this repo into my personal skills so I can use it on all my projects."
      • "Does anyone on my team share a skill for writing release notes?"
      • "Check if any of my imported plugins are out of date."
      • If you're a workspace admin: "Copy Thorsten's plain-writing plugin into our workspace plugins."

      You can find them in your User Settings and Workspace Settings:

      Personal plugins settings showing plugins with their source

      Workspace skills settings showing shared skills

      Personal vs Workspace

      Personal plugins and skills are good place to experiment and try things out. You can have your agent build something and reload the plugins live within the same thread.

      Workspace plugins and skills are pushable by workspace admins, and are loaded by default for everyone, so we recommend only publishing there once you've tested out something yourself. And if you want to make big changes to an existing workspace plugin, import it into your personal one, give it a test, and then publish it back up.

      Remix and Share

      Personal plugin and skills are much more than a replacement for ~/.configβ€”they can be shared with your workspace too, letting people discover, import and remix them.

      Share dialog with Private and Workspace visibility

      A shared plugin's page showing its source files and where it was imported from

      If there's upstream updates you'd like to pull into your version, or just update your version, you can run amp skill update <name>, amp plugins update <name>, or just ask Amp:

      • "Update the browser-testing skill to the latest version."
      • "Check if any of my imported skills are out of date."
  4. August 10, 2026
    1. πŸ”— IDA Plugin Updates IDA Plugin Updates on 2026-08-10 rss

      IDA Plugin Updates on 2026-08-10

      New Releases:

      Activity:

      • CaeriusIDA
        • b3c50800: Ajoutez des fichiers projet.
        • b296a084: Ajoutez .gitattributes, .gitignore, README.mdet LICENSE.txt.
      • capa
        • ce846fe4: Sync capa-testfiles submodule
        • 79c0d8d0: Merge pull request #3140 from mandiant/dependabot/npm_and_yarn/web/ex…
        • aaf5c643: build(deps-dev): bump js-yaml from 4.3.0 to 4.3.1 in /web/explorer
        • 3563c217: build(deps): bump pip from 26.1.2 to 26.2 (#3136)
        • 1caf26ed: Sync capa rules submodule
      • disrobe
        • c3d4217e: codec: unify seeded adler32 checksums
        • 24cd219d: codec: type and bound lenient percent decoding
        • f6b88958: pyarmor: own hotpatch scratch directories
        • a751dd6e: action: pair output flags with cli commands
        • 65e972e5: native: reject wrapped section file offsets
        • 52827e0a: contain trusted tool process trees
        • 89f05c94: dotnet: refuse unlowered compiler constructs
        • 87a2dc29: core: gate Windows-only anti-analysis imports
        • 61a5a0c4: tighten PHP differentials and static precision checks
        • 49772719: keep full coverage off routine main pushes
        • 52db8fa1: release: prepare v0.10.5
        • 11f4cb3d: go: require parsed containers for recovery
      • DynamicVarCheck_IDA
      • fifam
      • grokathon
        • fd70bd2b: arcade: add desktop start prompt
      • hrtng
        • eb6b9c20: fix enum importing; fix auto-comments;
      • ida-codemode
        • c888608d: Improve timeline view of the dashboard
        • eb4553bc: 0.5.0
        • 80eb7945: Add new trace events to dashboard
        • 3417d0eb: Reformat
        • 4598de45: Do not try hcli from PATH
        • 9155aad9: Switch to regular ida-domain release
        • 7567c320: Add ida-codemode-logs tool to collect logs in a self-contained package
      • ida-domain
      • ida-hcli
        • 56ee5e23: fix: require rich>=14.1 so nested spinners don't abort commands (#296)
        • ef2eba2e: fix: pass all arguments through to the program in ida python commands
        • fd20bd39: docs: document how hcli finds the IDA installation, version, and Python
        • db1e25e6: refactor: consolidate Python-environment inspection in hcli.lib.venv
        • 4dfc729a: refactor: resolvers report their source; explain-environment consumes…
        • 908a5969: refactor: express no-build-isolation only through PipOptions
        • 200c3ce4: refactor: probe interpreter versions in exactly one place
        • 26928279: perf: probe IDA's Python via idat once per process
        • 2a5d02cd: refactor: delete dead hcli.lib.util.python module
      • IDAPluginList
        • e6aa4a2f: chore: Auto update IDA plugins (Updated: 19, Cloned: 0, Failed: 0)
      • Luc-Nhan
        • b1140450: fix(tools): coerce hex-string int args and guard future.cancel()
        • 29ed93c4: fix(tools): reject unknown tool args with actionable message
      • twdll
        • ce21343c: feat: add political parties methods
    2. πŸ”— r/LocalLLaMA I trained a 1B-parameter LLM from scratch on 20B tokens for about $200 rss

      I trained a 1B-parameter LLM from scratch on 20B tokens for about $200 | A few months ago, I had the idea of making a LLM from scratch as a personal project (for learning and partly for improving my resume). Since I learned a lot from other posts on here over the past year, I wanted to share the results. TLDR: I trained a 1.1B param model on 20B tokens from fineweb-edu, then finetuned it on openhermes with LoRA to get a chat model. Total cost was about $200 (in February/March though, so it would probably be more expensive now).

      The architecture is based on Gemma3 since it was my most used model when I started. There are a few differences: - I have a smaller context length (4096) and because of that I didn't use sliding window attention. - I have a smaller vocabulary (32k, trained the tokenizer with sentencepiece) - I also tweaked some hyperparameters to reach my target parameter count. For the data, I used fineweb-edu for training the tokenizer and pretraining the model. Then LoRA finetuned the model on openhermes. I purposely tried to find data from 2023 and earlier because I saw this post back then and thought it would be cool to test the model by asking it questions about the "future" (like I did in the gallery images). As far as the training goes:

      Pretraining

      For pretraining, I first did training runs on 2B tokens to test the architecture at 3 sizes: 185M, 500M and 1.1B. Then I did a final run of the 1.1B model on 20B training tokens. I did it on vast.ai and here's the summary: | | 185M | 500M | 1B (on 2B tokens) | 1B (on 20B tokens)
      ---|---|---|---|---
      Total params | 185M | 527M | 1.1B | 1.1B
      GPU | 3090 | 5090 | H100 | H100
      Duration | 19h | 17h | 13h | 130h
      Final val perplexity | 19.2 | 16.0 | 15.1 | 10.93

      Also I logged in wandb generations from a few fixed prompts every 30M training tokens or so (was probably the most fun part of the project to check the new samples every couple hours to see the improvements) Here are a few examples for the final 1B model.

      Input prompt: "Let me tell you a story:"

      At 30M tokens seen text Let me tell you a story: a person, you should your child, and the other person who can take the time and the person with its own. If you do not want to give them a bit, you can learn from a student

      At 20B tokens seen text Let me tell you a story: I lived in a large city and we were having a little get-together. We all knew each other for years – so much so that I was surprised to learn that we met. It was around this time that one of us decided to become a vegetarian.

      Input prompt: "The capital of France is"

      At 30M tokens seen text The capital of France is by the other of the Western Europe. The U.S. and the church are the first of Christ in 1937, the other three times of the world.

      At 20B tokens seen text The capital of France is Paris and its currency is the Euro. A French person is called a Francais. After the Second World War, the French government decided to introduce a new currency that was pegged to the dollar.

      Lora finetuning

      To get a chat model, I ran some Lora finetuning on the best 1B model, using Openhermes as a dataset. I also did it on vast.ai, but on a 3060 and over 52 hours. Reached a final validation perplexity of 2.71 (not that it means anything since it is not on the same dataset as the previous values)

      Again I did have some regular logging of sample prompts.

      Input prompt: "What is gravity"

      At 3M tokens seen

      text The answer is: Gravity is the force that causes objects on Earth to stay together. At 250M tokens seen

      text Gravity is the force that causes objects to fall toward each other.

      Input prompt: "Write a short poem about a frog."

      At 3M tokens seen

      text Write a short poem about a frog. eleph. At 250M tokens seen

      ```text A frog's heart beating In the dark and damp wood A frog's voice, so soft No one can hear.

      It's a call, a croak, a chorus Of frogs in the night's air

      The land, the air, the water A place where frogs thrive. ```

      Input prompt: "What is the chemical formula for water?"

      At 3M tokens seen text heatwaves and water. mangan What is the chemical formula of oxygen? mangan At 250M tokens seen text H2O.

      Overall, over training that the model became more and more concise, especially compared to the base that was very yappy. Still, the quality is not very good for the total price. (when comparing to nanochat for example). When I have some more time, I will probably experiment with some full sft instead of LoRA, and maybe some extended datasets.

      Side-quests

      The post is already pretty long so I will just list quickly some of the other things I tried out: - Because my version had some differences with the original Gemma3 and also because I wanted to understand a bit better how it works, I added the architecture in a fork of llama.cpp. - To test it out, I vibecoded a WearOS app I used to run a Q2_K GGUF version of the 1B model (runs at about 2tok/s on my watch) - I ran a few benchmarks with lm-eval, nothing really interesting to note, it is weaker than Gemma3 1B across the board. - I deployed a demo website on GCP (deploying the model on CPU with the GGUFs) to analyze logprobs of the base model (and compare it with a few other small models) and chat with the instruction-tuned model. I don't know much about frontend so the React was completely vibecoded.

      Conclusion

      Even if the model is not that good, I learned a lot while doing it and I can only recommend to anyone who wants to better understand LLMs. It has also helped me in my job search process over the past 4 months (whether for getting more interviews or for doing better in ML technical interviews)

      Let me know if you have any feedback testing the model or any question!

      submitted by /u/SevereTilt
      [link] [comments]

    3. πŸ”— r/LocalLLaMA Muse glimmer benchmark rss

      Muse glimmer benchmark | Little less smart than Qwen, but way fewer tokens per task. submitted by /u/NoFaithlessness951
      [link] [comments]
      ---|---

    4. πŸ”— tintinweb/pi-subagents v0.15.0 release

      No content.

    5. πŸ”— HexRaysSA/ida-codemode v0.5.0 release

      Full Changelog : v0.4.1...v0.5.0

    6. πŸ”— @binaryninja@infosec.exchange Capable of lifting more than ever, with more performance improvements and mastodon

      Capable of lifting more than ever, with more performance improvements and features crammed into one of our biggest releases ever: Binary Ninja 6.0! Join us today @4pm ET to see a preview of our latest improvements: https://youtube.com/live/PojKznVNE_o

    7. πŸ”— r/LocalLLaMA Muse Glimmer ACTUALLY fits on a single RTX 3090 rss

      I did some testing this morning, and I was surprised to find that Muse Glimmer actually comfortably fits on a single RTX 3090 with full context + DFlash + mmproj at Q4_K_XL, unlike Qwen3.6-27B and Gemma-4-31B.

      Muse Glimmer supports up to 256k context according to Unsloth. Here is my command:

      llama-server \ --model Muse-Glimmer-30B-UD-Q4_K_XL.gguf \ --mmproj Muse-Glimmer-30B-mmproj-kquant.gguf \ --spec-draft-model Muse-Glimmer-30B-DFlash-kquant.gguf \ --spec-draft-ngl 999 \ --spec-draft-n-max 15 \ --spec-type draft-dflash \ -c 262144 \ --override-kv muse-glimmer.context_length=int:262144,dflash.context_length=int:262144 \ -ngl 999 \ -fit off \ --parallel 1 \ --flash-attn on \ --no-warmup \ --cache-type-k f16 \ --cache-type-v f16 \ --temp 1.0 \ --top-p 0.95 \ --top-k 64 \ --reasoning-preserve \ --jinja \ --host 127.0.0.1 \ --port 8080

      This fits in about 22GB to 23GB of VRAM, actually leaving a reasonable amount of unused memory.

      On this RTX 3090, for Qwen3.6-27B and Gemma-4-31B, this is what I've been able to achieve using their Q4_K_XL models with MTP + mmproj, right at the limits of the RTX 3090's VRAM:

      Model | F16 KV cache | Q8 KV cache
      ---|---|---
      Qwen3.6-27B | 70,000 tokens | 125,000 tokens
      Gemma-4-31B | 52,000 tokens | 81,000 tokens

      Those small contexts have been borderline unusable on f16, and I don't enjoy using Q8 KV unless absolutely necessary, so I mostly use my slower DGX Spark to run these models at the full context.

      On Muse Glimmer, there seems to be little reason to use my DGX Spark since it fits so nicely on the RTX 3090. Maybe I could run a bunch of parallel agents with full KV on the Spark.

      Muse Glimmer also runs at between 64 tok/s and 124 tok/s in my testing under DFlash, depending on whether it is outputting prose or code. Either way, a pretty solid speed. I've seen about 1400 tok/s of prompt processing.

      I also ran a two needle haystack test at about 150k tokens with one needle at the beginning and the other at the end, and the model retrieved them perfectly on the first try, so this is definitely not soft-capped to 128k context.

      submitted by /u/coder543
      [link] [comments]

    8. πŸ”— r/LocalLLaMA Mark Zuckerberg on releases rss

      Mark Zuckerberg on releases | https://x.com/i/status/2086755195535413696 submitted by /u/jacek2023
      [link] [comments]
      ---|---

    9. πŸ”— r/LocalLLaMA unsloth/Muse-Glimmer-30B-GGUF Β· Hugging Face rss

      unsloth/Muse-Glimmer-30B-GGUF Β· Hugging Face | Guide: https://unsloth.ai/docs/models/muse-glimmer submitted by /u/Nunki08
      [link] [comments]
      ---|---

    10. πŸ”— r/LocalLLaMA Introducing Muse Glimmer: an open-weight model optimized for always-on local agent workflows rss

      Introducing Muse Glimmer: an open-weight model optimized for always-on local agent workflows | Hi r/LocalLLaMA πŸ‘‹ Today we’re excited to release Muse Glimmer, a 30B open-weight model built specifically for local agent workflows. We’re releasing the weights to the community under a permissive Apache 2.0 license. A few specs

      • 30B params, dense
      • Multimodal: interleaved text + images via a dedicated perception encoder
      • Trained on 100+ languages
      • Controllable reasoning effort (quality/speed tradeoff)

      Memory footprint
      At full precision, 30B needs 55+ GB, which is out of reach for consumer hardware. We quantize weights to ~4-bit, bringing the LM under 20 GB. That leaves headroom in a 24 GB or 32 GB envelope for the KV cache, the perception encoder, and the speculative decoding drafter running simultaneously. We validated minimal to no degradation on agentic tasks under compression. Speculative decoding
      Ships with a lightweight DFlash-based drafter that proposes blocks of tokens which the main model verifies in parallel. Significantly faster than token-by- token generation with identical output quality. We're also shipping quantized drafter versions so the memory overhead stays small. A few capabilities
      We trained Muse Glimmer for agentic loop tasks, including:

      • End-to-end task completion (strong performance on DeepSearch QA, MCP-Atlas, 𝛕3-Bench, SWE-Bench, and more)
      • Function calling with precise schemas across long workflows
      • Multi-step reasoning over long horizons
      • Failure recovery β€” when a tool call fails or returns something unexpected, it's trained to diagnose and retry instead of halting. This was a deliberate training target.
      • Works with OpenClaw and other agentic scaffolds
      • Multimodal understanding and reasoning

      Running it
      Weights are up on Hugging Face. Coming soon: Ollama, LM Studio, Unsloth and torchtitan, plus optimized integrations for llama.cpp, MLX, and ExecuTorch. vLLM and SGLang for serving. Get started quickly with Together AI, Fireworks AI, and OpenRouter. We're also working with AMD, Arm, Dell, Intel, and NVIDIA on per-device optimization. We look forward to your feedback and seeing what the community builds with Muse Glimmer. πŸ”— Weights: https://huggingface.co/meta-models
      πŸ”— Research Blog: https://go.meta.me/museglimmer
      πŸ”— Resources: https://developer.meta.com/ai/models/muse-glimmer/ submitted by /u/AIatMeta
      [link] [comments]
      ---|---

    11. πŸ”— backnotprop/plannotator v0.26.7 release

      Follow @plannotator on X for updates

      What's New in v0.26.7

      One change, and it transforms how annotating HTML pages feels: pinpoint mode now targets any element on the page.

      Pinpoint targets what your cursor is on

      Since v0.26.5, raw-HTML annotate sessions default to pinpoint input. But pinpoint could only target a fixed list of "semantic" HTML tags: headings, paragraphs, tables, sections. Real prototype and report pages are built from styled divs and spans, so hovering a small chip or an icon button selected the whole enclosing section, and some elements could not be selected at all.

      Pinpoint now resolves the element actually painted under your cursor, whatever its tag. Chips, icon buttons, badges, custom cards: all individually annotatable. Elements smaller than 16px promote to their parent so you are not pixel-hunting, and containers are selected the natural way, by pointing at their padding or any spot not covered by a child. The whole interaction stays mouse-only and matches how pinpoint already feels on markdown documents. Hover labels got smarter too: a div with a rowchip class now labels as "rowchip", using its aria-label, role, or class names instead of a bare tag name.

      Under the hood the hover path no longer rebuilds a document-wide element graph every frame; it is a per-event hit-test with zero document scans, which also retires the performance debt noted in the v0.26.5 pinpoint release. Anchor restoration keeps every fail-closed guarantee, and data-testid-style attributes (data-test-id, data-cy, data-qa) now count as trusted element identity for restoring annotations onto regenerated pages. One honest limit: an element with no text and no identifying attribute can be annotated in- session, but its pin does not restore on a later reopen; a pin that cannot verify its target refuses to guess.

      The change went through two adversarial review rounds; the first round removed an anchoring mechanism that could have restored a pin onto the wrong sibling, in favor of failing closed.

      Install / Update

      macOS / Linux:

      curl -fsSL https://plannotator.ai/install.sh | bash

      Windows:

      irm https://plannotator.ai/install.ps1 | iex

      Claude Code Plugin: Run /plugin in Claude Code, find plannotator , and click "Update now".

      OpenCode: Clear cache and restart:

      rm -rf ~/.bun/install/cache/@plannotator

      Then in opencode.json:

      {
  "plugin": ["@plannotator/opencode@latest"]
}

      Pi: Install or update the extension:

      pi install npm:@plannotator/pi-extension

      What's Changed

      • feat(annotate): hit-test pinpoint targeting for raw-HTML sessions by @backnotprop in #1251

      Full Changelog : v0.26.6...v0.26.7

    12. πŸ”— HexRaysSA/plugin-repository commits sync repo: +3 releases rss 
      sync repo: +3 releases

## New releases
- [ida-codemode](https://github.com/hexrayssa/ida-codemode): 0.4.1, 0.4.0, 0.3.2
    13. πŸ”— backnotprop/plannotator v0.26.6 release

      Follow @plannotator on X for updates

      What's New in v0.26.6

      v0.26.6 is a rebuild-only patch: no Plannotator code changed, but every binary is now compiled with Bun 1.3.14 instead of 1.3.11.

      Env vars now work inside OS sandboxes

      Binaries built with Bun 1.3.11 loaded an empty environment whenever a parent of the working directory was unreadable, which is the normal state inside OS- level sandboxes (Seatbelt on macOS, Landlock on Linux, tools like nono). Every PLANNOTATOR_* variable was silently ignored there: remote mode never activated, fixed ports were dropped, and no warning explained why. This was oven-sh/bun#27802, fixed upstream in Bun 1.3.13.

      We had pinned Bun to 1.3.11 in April because 1.3.12 broke macOS binary signing outright. Before unpinning we verified both directions: a 1.3.14 build reads env vars correctly under an unreadable ancestor, and cross-compiled macOS binaries carry the same valid linker signature as the known-good releases and launch cleanly.

      The release pipeline also gained two permanent guardrails: macOS binaries are now smoke-launched after every build (the April signing breakage shipped because only Linux and Windows were), and a new check runs the freshly built binary from a directory with an unreadable ancestor and asserts env vars still load.

      Install / Update

      macOS / Linux:

      curl -fsSL https://plannotator.ai/install.sh | bash

      Windows:

      irm https://plannotator.ai/install.ps1 | iex

      Claude Code Plugin: Run /plugin in Claude Code, find plannotator , and click "Update now".

      OpenCode: Clear cache and restart:

      rm -rf ~/.bun/install/cache/@plannotator

      Then in opencode.json:

      {
  "plugin": ["@plannotator/opencode@latest"]
}

      Pi: Install or update the extension:

      pi install npm:@plannotator/pi-extension

      What's Changed

      • fix(ci): bump Bun build pin to 1.3.14 for sandbox env loading by @backnotprop in #1250

      Community

      @SierraJC filed #1249 with a complete diagnosis: the exact upstream Bun issue, the fix version, and a one- line repro that distinguishes "binary cannot see the variable" from "binary mishandles the variable". Reports like this make patches fast.

      Full Changelog : v0.26.5...v0.26.6

    14. πŸ”— backnotprop/plannotator v0.26.5 release

      Follow @plannotator on X for updates

      Missed recent releases? Release | Highlights
      ---|---
      v0.26.4 | Skill-menu hover jitter fix (same-day patch on v0.26.3)
      v0.26.3 | Skill references in comments with / or $, reachable remote session URLs, worktree switcher tooltips
      v0.26.2 | Single-file diff tabs render fully, no more silently dropped review files, light/dark theme pairs, palette-matched code blocks
      v0.26.1 | GitButler 0.22.0 compatibility via capability-probed JSON flags
      v0.26.0 | Edit Mode (suggest by editing the diff), Guided Review virtualization, colorblind theme, safe uninstall, installer opt-outs, OpenCode 2 support
      v0.25.1 | Codex no longer launches on review open, annotate-last follows the live conversation, pi-todos mirror, Claude Opus 5, abandoned-gate dismissal
      v0.25.0 | Vim keyboard controls, Approve with Notes, scriptable annotate gates, persistent Guided Reviews, memory and file-watching hardening
      v0.24.2 | Annotate YAML/JSON/TOML config files, XDG data directory support, Codex model catalog update, Cursor sandbox escape hatch
      v0.24.1 | Annotate accepts parent-relative ../ file paths
      v0.24.0 | PR/MR artifact gallery, GitButler review support, port ranges, expanded comment editor, OpenCode + Pi fixes
      v0.23.1 | Startup no longer hangs on large or slow directory trees, Ask AI input stays visible after long responses
      v0.23.0 | Plan approval fix for Claude Code 2.1.199+, annotate mode version diff, binary-only --minimal install, reviews post without attribution

      What's New in v0.26.5

      This release makes annotate feedback durable, rebuilds how you annotate raw HTML pages, and fixes real bugs reported from the field: lost Pi feedback after a reload, a vim cursor hiding behind the HUD, and an installer failure on older git. Seven PRs, two from external contributors, including a first contribution from @Whamp.

      Your annotate feedback can no longer be lost

      When you submitted annotate feedback after the invoking agent had already timed out, the server settled the decision with nobody listening and deleted your draft. The feedback then existed nowhere. Reported by @0okay after exactly this happened on Windows.

      Now the server writes your submitted feedback to a durable record under your data directory before it deletes the draft, so a vanished consumer can no longer take your work with it. If the record cannot be written, the draft is kept as the recovery copy instead. This applies to single local file sessions; URL, folder, and last-message sessions stay fully stateless, and disabling annotate history keeps everything stateless as before.

      Annotating HTML pages: pinpoint-first

      Raw-HTML annotate sessions got a rework. Pinpoint is now the default input: hover highlights the element under your cursor, a click pins it and opens the comment composer directly, and each element annotation gets a numbered badge. Drag selection is still one toggle away, and your choice is remembered separately from markdown sessions.

      Pages also open minimal: the first session hides the toolstrip, tab flags, and sidebar so you see just the page, and every session after that opens with exactly the chrome you last left visible.

      Under the hood, element annotations now carry a verified CSS anchor so they restore to the same element when you re-open a page, even after the page was regenerated. Restoration is deliberately fail-closed: when the anchor cannot be trusted, the annotation falls back to text search, and text that moved elsewhere in the page is followed rather than mis-pinned. The feature shipped through two adversarial review rounds plus a 25-item QA sweep, which hardened anchor verification, capped selection sizes, kept pin badges out of printed pages, and bounded anchor building so a click on deeply nested markup can never freeze the tab.

      Pi: feedback delivers after a reload

      A Plannotator browser tab can outlive a Pi /reload. When feedback arrived from such a tab, the extension rejected the freshly reloaded runtime as the same stale session (reload preserves Pi's session id) and the feedback was dropped with an error. @Whamp diagnosed the root cause and fixed it: the extension now tracks an in-process runtime token, so a reload counts as a new active runtime and both feedback and notifications route to it. Comes with a regression test simulating the exact reload scenario.

      Vim: the cursor stays out from under the HUD

      Document vim navigation used to pin the cursor target flush against the viewport edge, exactly where the sticky action bar and the key HUD float, so j/k motion at the top or bottom of a document hid the caret behind an overlay. @rNoz reported it and fixed it: cursor movement now reveals its target with a scrolloff-style margin sized to the viewport, so keyboard motion keeps the caret visible the way mouse scrolling always did.

      The installer works on older git

      install.sh failed its skills step with a misleading "network or git error" on systems whose git predates 2.25 (for example a stale Xcode Command Line Tools git), because git clone --sparse does not exist there. Reported by @dubbl-a. All three installers now probe for the capability and fall back to a plain shallow clone, surfacing the real git error when something else goes wrong. A follow-up in this release also pins the probe to a stable locale, so localized git builds take the fallback correctly too.

      Additional Changes

      • Windows Codex wording corrected. The README claimed Codex hooks are disabled on native Windows while the installer called them experimental and printed setup steps. The docs now agree: experimental, with manual steps (#1241 reported by @dustintran333)
      • Print stays clean. Printing an annotated HTML page no longer bakes pin badges or pinpoint overlays into the output; inline annotation marks remain printable on purpose (#1245)
      • CI now runs every DOM suite. Eight DOM-gated test files were silently skipping in CI, including the vim and HTML-annotate suites; they are wired in and enforced on every run

      Install / Update

      macOS / Linux:

      curl -fsSL https://plannotator.ai/install.sh | bash

      Windows:

      irm https://plannotator.ai/install.ps1 | iex

      Claude Code Plugin: Run /plugin in Claude Code, find plannotator , and click "Update now".

      OpenCode: Clear cache and restart:

      rm -rf ~/.bun/install/cache/@plannotator

      Then in opencode.json:

      {
  "plugin": ["@plannotator/opencode@latest"]
}

      Pi: Install or update the extension:

      pi install npm:@plannotator/pi-extension

      What's Changed

      • Fix feedback delivery after Pi reload by @Whamp in #1240
      • fix(install): fall back to a plain shallow clone when git lacks --sparse by @backnotprop in #1239
      • fix(annotate): persist submitted feedback before deleting the draft by @backnotprop in #1237
      • fix(vim): keep the j/k cursor clear of the HUD bands when scrolling by @rNoz in #1154
      • feat(annotate): pinpoint-first raw-HTML sessions with element anchors and a minimal-first render by @backnotprop in #1243
      • chore: fold in pre-release QA findings by @backnotprop in #1245
      • fix: address the three pre-release sweep findings by @backnotprop in #1246

      New Contributors

      Community

      @Whamp hit the Pi reload bug in daily use, traced it to session identity surviving the reload, and shipped the fix with a regression test. First contribution, and a precise one.

      @rNoz continues to make vim mode better than we left it: he filed the HUD occlusion report (#1153) with a demo video and fixed it himself, including a pure scroll-math helper with its own test suite.

      Issue reporters this release:

      • @0okay reported the lost-feedback failure (#678) that drove the durable-submission work
      • @dubbl-a reported the old-git installer failure (#1238) with the exact git version and error output that made the fix straightforward
      • @dustintran333 caught the README contradicting the installer on Windows Codex hooks (#1241)

      Full Changelog : v0.26.4...v0.26.5

    15. πŸ”— Filip Filmar rules_vivado: FPGA Synthesis and Place-and-Route in Bazel rss

      rules_vivado drives the AMD/Xilinx Vivado FPGA toolchain from Bazel: VHDL and Verilog compile, elaborate, simulate, synthesize, place-and-route, generate a bitstream, and program the device, all as hermetic Bazel build actions rather than clicks in a GUI or a pile of ad-hoc TCL. This is the module that turns the Cocoapuffs board flow into bazel build. This post kicks off a short series. Over the Cocoapuffs project and its parent repo a200t_examples I ended up writing a fair number of Bazel modules to make an FPGA-based RISC-V system reproducible from source.

    16. πŸ”— Ampcode News A Dial for You rss

      We changed the Dial. Link a ChatGPT subscription and low, medium, and high only use OpenAI models: as the main agent, as the oracle, as the thread reader, as code review. Every model behind those modes is an OpenAI model, billed to your subscription.

      Before this change, you'd still pay for tokens with a subscription linked, because parts of the work ran on other models: low and the thread reader on GLM-5.2, the high oracle on Claude Fable, code review on Haiku β€” all billed to Amp credits. That confused people, and we get why.

      With a subscription connected:

      • low runs GPT-5.6 Terra instead of GLM-5.2.
      • medium runs GPT-5.6 Sol, as before.
      • high runs GPT-5.6 Sol as both agent and oracle. The oracle used to be Fable.
      • The thread reader and code review move to GPT-5.6 Terra.

      The mode picker with the dial on medium, showing GPT-5.6 Sol as agent and oracle and a green ChatGPT subscription LED

      Doesn't this make the modes worse? Barely, and less every month. The frontier models have converged: any of them gets you to a good result with a good harness. We swapped the default model for most users overnight and nobody complained. So the modes stay at the frontier, and the tokens come out of a subscription you already pay for.

      high also drops its credit minimum when your subscription is active. There's no Fable call left to pay for.

      ultra doesn't change. It runs Claude Fable on credits, because ultra is for the tasks where you want the strongest model, whatever it costs.

      If you don't have a subscription, nothing changes. The modes run as before, on Amp credits.

      Link your subscription and turn the dial.

    17. πŸ”— Baby Steps Cylic trait implementations: motivation rss

      Lately I've been thinking about cyclic trait implementations. This is a problem that I've been trying to understand for years and years and I finally feel like I'm geting somewhere. I'm going to try to write out a series of blog posts documenting those explorations and, hopefully, culminating in a design that could be RFC'd. In this first post, I want to talk about one of the interesting questions, what I am going to call "internal" vs "external" proofs. I know that this material can seem abstract, so I'm going to try and connect it to "real Rust" as much as possible! This particular blog post is an introduction, explaining the general problem and giving some motivation for why we care.

      What are cyclic trait implementations?

      Right now in Rust we require most traits to have non-cyclic , or inductive , implementations. To explain what I mean, let's consider this trait:

      trait Dump {
    fn dump(&self);
}

      Now imagine that we have an impl of this for i32:

      // Impl I
impl Dump for i32 {
    fn dump(&self) {
        println!("{self}");
    }
}

      A simple impl for Rc<T> and `Option:

      // Impl RC
impl<T> Dump for Rc<T>
where
    T: Dump,
{
    fn dump(&self) {
        T::dump(self)
    }
}

// Impl Opt
impl<T> Dump for Option<T>
where
    T: Dump,
{
    fn dump(&self) {
        if let Some(v) = self {
            T::dump(v)
        }
    }
}

      and finally a recursive List type that has an impl as well:

      struct List<T> {
    value: Rc<T>,
    next: Option<Rc<List<T>>>,
}

// Impl L
impl<T> Dump for List<T>
where
    T: Dump,
{
    fn dump(&self) {
        Dump::dump(&self.value);
       if let Some(n) = &self.next {
            Dump::dump(n);
        }
    }
}

      If I try to show that List<i32>: Dump, I do that by

      • Applying "impl L" to show that List<i32>: Dump if i32: Dump
        • Then applying "impl I" to show that i32: Dump

      There's no cycle here - that is, I didn't have to use impl L to show that impl L is valid.

      Cyclic logic sounds bad, but it can be exactly what you want

      Now, when I said that "the impl L didn't have to use the impl L to show that it is valid" that might not have sounded suspicious to you. In fact, it's a pretty natural idea. After all, generally when you try to establish a logical argument, you aren't allowed to use cyclic reasoning. That is, you can't say: I know that Niko likes Rust because Niko likes Rust. So, in the same sense, it seems natural that I should not be able to say "I know that List<i32> implements Dump because List<i32> implements Dump".

      But actually, it would sometimes be really useful to say exactly that. One example is so-called "perfect derive". In our Dump impl above, we had one where-clause, T: Dump. And if you were to create a custom derive for Dump and write #[derive(Dump)], the impl I showed is typically exactly what you would get. But it's not necessarily what you want. Consider what you get with #[derive(Clone)]:

      // Impl LC1
impl<T> Clone for List<T>
where
    T: Clone, // <-- generated but not really required!
{
    fn dump(&self) {
        List {
            value: Clone::clone(&self.value),
            next: Clone::clone(&self.next),
        }
    }
}

      Here, the derive is going to create an impl that requires T: Clone. But if you look closely, you'll see that all the fields only use Rc<T>, so in fact, we should be able to clone a List even without T: Clone! But how is the compiler to know this?

      You might think that the compiler could do some super smarty-pants analysis on the fields to figure it out. And, in a way, it can: that is what cyclic trait solving is all about. The thing is, while the compiler can do that, the derive cannot - the derive doesn't have access to the definitions of other types and so forth, and clearly we would need to know things about Option and Rc to figure out whether T: Clone is required here.

      But what we could do is to generate a different impl. Instead of adding T: Clone for each type parameter, we could add a where-clause for each field type. This makes sense: after all, we are just going to be calling Clone on every field, so it's quite logical to say that the impl is valid if every field is cloneable:

      // Impl LC2
impl<T> Clone for List<T>
where
    Rc<T>: Clone,
    Option<Rc<List<T>>>: Clone,
{
    // .. as above ..
}

      Under this formulation, we can see that all we have to be able to do is to clone an Rc<_> and clone an Option<Rc<_>>, neither of which require that T: Clone.

      This idea is called perfect derive

      We call this idea [perfect derive][] and it's been a goal for a while. The thing is, cyclic reasoning is tricky to get right. The Clone example is actually an easy one: that one doesn't really require cyclic reasoning:

      • To show that List<i32>: Clone we have to show that…
        • Rc<i32>: Clone, which is easy because impl<T> Clone for Rc<T> doesn't have any where-clauses1
        • Option<Rc<List<i32>>>: Clone uses the impl<T> Clone for Option<T> where T: Clone impl which requires…
        • Rc<List<i32>>: Clone, which is again easy

      But it's not so easy for Dump

      But if we use that same "cyclic derive pattern" to generate our Dump impl, things don't work out so well. Instead of just a T: Dump bound, our Dump impl now has two bounds:

      // impl L1
impl<T> Dump for List<T>
where
    Rc<T>: Dump, // <-- Used to be `T: Dump`
    Option<Rc<List<T>>>, // <-- This one is new!
{
    fn dump(&self) {...}
}

      Now imagine we try to show List<i32>: Dump. We begin by applying impl L1, which requires us to show that its where clauses hold:

      • To show List<i32>: Dump we use impl L1, which has two where-clauses:
        • Rc<i32>: Dump, this one is easy because the Rc impl requires that i32: Dump which is true.
        • But Option<Rc<List<i32>>>: Dump is tricky. The Option impl requires that…
        • We need to prove Rc<List<i32>>: Dump, and then the Rc impl requires that…
          • We need to prove List<i32>: Dump, but that is what we started with! That's cyclic logic!

      Ugh. Something's tricky here!

      We can't just accept any old cycle because of supertraits

      Now, maybe you think we can just accept any cycles. And for these examples, it would be fine: but it's not correct if you consider supertraits. Consider this trait and impl pair:

      trait Magic: Copy { }

// Impl M
impl<T> Magic for T
where
    T: Magic,
{}

      If you are naive, this weird trait-impl pair can be used to prove that any type is Copy, regardless of whether it has a Copy impl. For example:

      • Say we want to prove that String: Copy. We observe that if a type implements Magic, it must implement Copy, so…
        • We begin by proving String: Magic. We use the impl M, which requires
        • that we show String: Magic, which is a cycle, so we accept it.

      Uh oh, now we did something wrong. We proved that String: Copy even though there is no Copy impl. Something is fishy.

      Now clearly we can all see the problem here - the implementation of Magic didn't really add any information. It was just a tautology, saying that T: Magic if T: Magic. It's not wrong , but implementing Magic was supposed to tell us more than just the fact that there is an impl of Magic, it was supposed to tell us also that the supertrait Copy is implemented. And that's not true here.

      But if you think about it, it's hard to decide why we should reject impl M but accept the impl L1 of Dump for List<T>. They both wind up with a cyclic proof. So what's the difference? This is the question we'll be exploring over the next few blog posts.

      Soundness for traits

      This gets at an interesting question: what does it mean for the trait system to be sound. This seems obvious but actually it was a question I found kind of non-obvious for a long time.

      We've found two satisfactory answers to that question. One of them involves converting to dictionary-passing style. Nadri explained that in a blog post. I think that's a great post to read. I'm going to give another definition here that doesn't require converting to a dependently typed program2

      My rough definition is this3: the trait system is sound if, whenever it accepts some program P, that program cannot have a function that believes some Trait holds for the T, but there is no impl of Trait that can be used. So in the case of Magic and Copy, it's easy to write a program that shows simple cyclic trait solving is unsound:

      trait Magic: Copy {}

impl<T: Magic> Magic for T {}

fn is_copy<T: Copy>() {
    // this function believes `T: Copy`
}

fn main() {
    // this can be called because we believe that
    // * `String: Magic` because
    //     * `String: Magic`, and we accept cycles.
    // And then `String: Magic` implies `String: Copy`.
    is_copy::<String>();
}

      By my definition, any sound type/trait system must reject this program because, if it were to execute, then execution would reach is_copy::<String> and yet there is noCopy impl that is judged to ber applicable to String. Uh oh!

      Coming next

      As I promised, this post was mostly focused on "setting the scene". My goal was to explain what the problem is that we are trying to solve - permitting "good cyclic impls" but forbidding bad ones. I didn't spend a lot of time on the bad ones, but it turns out that there's a wide variety of unsound things one can do, some of which the compiler currently gets wrong, others of which it would only get wrong if we started permitting cycles.

      My motivation for getting into this work is a bit complicated. I want perfect derive. But it's also a loose end in our trait semantics that I really want to see nailed down before we move onto other tasks. Having auto traits (e.g., Send) work differently from other traits is clearly a "smell", and without a strong understanding of the logical underpinnings of our trait system it's easy to get things wrong when we build extensions.

      In the next few posts I'll go a bit deeper into the exploration I and others have been doing. I'll talk about some of the "false starts" we took along the way and why they don't work, and then about some of the solutions that are under consideration. Working through this stuff has really helped me to broaden my understanding of various areas of logic. By the time we're done, we'll cover4 coinduction and productivity, modal logic and the later modality, and we'll see how our techniques might even help us with resolving specialization5.

      I cited it earlier, but if you want to read other tasks on the same subject, I definitely recommend Nadri's post on dictionary-passing style.

      1. Apart from the default Sized bound, I'm ignoring that here β†©οΈŽ

      2. I have found that both the dictionary-passing interpretation and the logic approach I'm using are valuable. In the end, they're more or less equivalent, which I guess shouldn't be surprising if you've heard of the Curry Howard Correspondence, but I'll talk about that later perhaps. β†©οΈŽ

      3. I would like to, but haven't, define a simplified version of Rust that includes trait solving and simple type checkoing and show that it cannot "go wrong". β†©οΈŽ

      4. In a shallow way, I'm no expert! β†©οΈŽ

      5. Plot twist, bet you didn't see that coming! I sure didn't. β†©οΈŽ

generated: August 13, 2026 at 15:47:07