#tools

Microsoft eXecution Container (MXC) is an embeddable SDK for running untrusted commands under OS-enforced policies, not a hosted sandbox service. discuss

• Defaults: Seatbelt on macOS, Bubblewrap on Linux, ProcessContainer on Windows. SDKs for Node, Rust, and .NET.
• Restricts filesystem and network access. macOS hostname allowlists need a caller-managed proxy; not every backend is a VM.
• Useful boundary: sandbox the command where it executes, not just the agent's tool-composition script. Isolation limits damage; it does not make generated output trustworthy.

Arnav Gupta's pi-subagent-manager makes context inheritance explicit. Nested threads receive their parent's snapshot; independent roots start without its history. Threads stay around for steering and resume. I want synchronous coordination by default, forks for continuity and fresh context for independent review. discuss

Armin Ronacher's subagent extension runs one observable Pi child at a time in tmux. The parent waits for the result, while I can attach to inspect or intervene. Worth preserving when adding hierarchy: synchronous coordination must not mean invisible execution. discuss

Back on Wispr Flow after six months on local speech-to-text (FluidVoice with Parakeet, plus Whisper). Local transcription is fine. The cleanup is what's missing: fixing misheard jargon ate the time dictation saved. Flow's correction pass, OS-level integration and phone keyboard win. It matters more now because models follow high-level intent well: I speak the intent plus constraints in one go and let the LLM structure it. Whisper mode works even when you speak softly. Want to try it? My referral link gets you a free month of Pro, and I get one once you've dictated 2,000 words. discuss

Pi Durable is Earendil's experimental agent harness, shipped alongside Pi 1.0. TannerMidd/pi-pocket is a mobile-first, multiplayer web app for Pi built on it. discuss

• Every model call and tool call is a task that checkpoints to storage (SQLite, JSONL, or memory) before moving on. Kill the process and a new one opens the same file and resumes.
• Recovery is per step: a cut-off model request is resent with the partial answer kept and marked aborted. A cut-off tool call reruns only if it is replay-safe; otherwise the model is told it was interrupted.
• A requestId makes a submission exactly-once, so a client retrying after a crash gets the original back.
• Forks see the parent transcript up to the fork point without copying it.
• ~15k lines total, small enough for an agent to read end to end.
• pi-pocket: restart the server mid-run and the work continues. Several people can watch, steer, or queue messages on the same session.
• npm start -- --access tailscale binds only to the tailnet address, so my phone gets it with no tunnel.
• The shift: the session lives in a SQLite file, not a terminal process, so the phone is just another client. Could replace my Moshi + tmux setup.
• Caveat: anyone who can steer runs shell commands as you.

Every coding agent (Claude Code, Codex, pi) compacts long sessions the same way: ask an LLM to prose-summarize, then summarize that summary, until load-bearing details erode (why a decision was made, which approaches got rejected). pi-blackhole swaps that for deterministic compaction: a zero-token compile() that extracts structured sections (goal, files touched, commits, preferences, brief transcript). No LLM, no drift, no cost. The compile is only lossy in the window, not on disk: blackhole also ships a recall tool (BM25 + regex over the raw session JSONL and the memory ledger) that re-fetches any dropped turn on demand, so compile + recall together is lossless where an LLM summary-of-a-summary destroys the original. It also adds observational memory: background observer/reflector workers append durable facts to per-session ledgers that survive every compaction, and /blackhole-export walks every past-session JSONL under a git-root into a ranked context file. The clever part is what export trusts. A fact's rank is driven by cross-session recurrence, damped as log(1 + distinctSessions) with a burst penalty, not raw counts, so one chatty session can't inflate it. Recurrence-as-reinforcement is basically Hebbian: facts that keep firing across sessions get stronger. Dedup is a 3-pass funnel, exact then Levenshtein then Sørensen-Dice token-set, with a Levenshtein floor so keyword overlap alone can't merge two distinct facts. Bonus: the OM workers run on their own model and billing, so I point them at openai-codex/gpt-5.6-luna while the main thread stays on Claude. discuss

gistpreview.github.io renders any GitHub Gist as a live HTML page. Pass the gist ID as a query param (?<gist_id>) and it fetches via GitHub API + document.write(). Entire thing is 2 files (index.html + main.js), no build step, trivially self-hostable. Useful for quick HTML/CSS demos without spinning up CodePen or deploying anything.

SecretSpec declares secrets once in secretspec.toml (names + descriptions, never values) and resolves them from any of 11 backends: keyring, 1Password, Vault, AWS, GCP, .env. Same command everywhere: secretspec run --profile production -- npm start. Per-secret fallback chains (providers = ["vault", "keyring", "env"]) and a ref = { item, field } form points at a secret you already have elsewhere, no renaming. Sharpest bit: agents get held to a stricter bar by default. require_reason = "agents" forces secretspec run --reason "..." before an AI agent can read a secret, appended to a local audit log; humans running interactively are unaffected. Rust core, SDKs for Python/Go/Node/Ruby/PHP/Haskell. Worth piloting on a project drowning in .env sprawl.

Recordly does video recording, screenshots, and demo editing in one open-source Electron app. Not in Homebrew core, but easy to ship via a personal tap: brew install --cask theskumar/tap/recordly. Replacing my previous screenshot/recording workflow with this as the single default (see Default Apps 2025).

Moshi is the best SSH client I've found for iPhone — connects to your laptop's tmux sessions over Mosh, making it rock-solid on mobile networks with roaming support. Perfect for an agent view on the go; I use it to monitor and interact with running pi/Claude sessions from my iPhone without losing the session on network switches.

faberic is a crowd-sourced collection of prompts bundeled with a cli to use them via piped interfaces.

colbymchenry/codegraph: Pre-indexed code knowledge graph for Claude Code — fewer tokens, fewer tool calls, 100% local

codespelunker is a CLI code search tool that understands code structure and ranks results by relevance. No indexing required with CLI, TUI, MCP and HTTP support.

mise let's you manage dependencies at OS level and project level. Thinking to manage my dev machine. The hard part is documenting what I have installed.

moor is a better replacement for less and bat as PAGER.

brew install git-trim git-trim - A dedicated binary for safely deleting merged branches. Handles edge cases better than bash one-liners, including squash-merged branches. #

slingdata-io/sling-cli is a promising tool move/sync data between databases and files, esp. helpful for local testing, ci/cd while able to do stage/sql based transformations.

Puzer published a github recommendor that uses semantic embedding from user's github stars all client side, I found some great recommendations which I plan to use:

• pamburus/hl: A fast and powerful log viewer and processor that converts JSON logs or logfmt logs into a clear human-readable format. (⭐2657)
• samwho/spacer: CLI tool to insert spacers when command output stops (⭐1663)
• darrenburns/posting: The modern API client that lives in your terminal. (⭐11134)
• plutov/oq: Terminal OpenAPI Spec viewer (⭐943)
• wey-gu/py-pglite: PGlite wrapper in Python for testing. Test your app with Postgres just as lite as SQLite. (⭐577)

Text based diagramming tools:

• yuzutech/kroki: self-hosted solution for unified interface to buch of diagramming tools, including mermaid, d2, etc.! (⭐3875)
• d2 provides a clean syntax and output as well.

npx -y npm-check-updates tells you the latest versions of your package.json, ignoring pinned versions.

New tools:

• gh-actions-lockfile to generate and verify lockfiles for gh-actions
• Proxyman is more user-friendly http debugging proxy than Charles Proxy on MacOS