A friend told me that every phone remote app he tried seemed to come with ads or payment prompts. I started making one for him, then got carried away making the controls customizable. I figured other people might want the same thing, so I opened the source.

OpenTV-Remote has native Android (Kotlin/Jetpack Compose) and iPhone (SwiftUI) apps. You can drag and resize buttons, choose presets and accent colors, save layouts for different TVs, and add app shortcuts where the TV supports them. No ads, subscriptions, paid unlocks, account requirement, or telemetry SDK. MIT licensed.

For anyone interested in the code: discovery/pairing and each TV protocol are separated from the UI, with explicit capabilities determining which controls are offered. Android TV keyboard sync uses transient IME sessions with readback/acknowledgments where available, plus a clearly labeled manual fallback.

This is a development release. Basic Android TV control has been used on a real MiTV; newer live keyboard behavior and other TV providers need broader hardware qualification. It is not universally compatible, Android TV Wi-Fi touchpad mode sends arrows rather than a mouse cursor, and casting is not included.

Android APKs are in Releases. The iPhone version currently requires a Mac and Xcode; it isn't on the App Store.

Disclosure: I'm the developer, and this was built with substantial AI assistance/vibe coding. The repository includes protocol notes, compatibility limits, and a record of what was actually tested.

Source: https://github.com/levhakobyan/OpenTV-Remote

Downloads and iPhone setup: https://levhakobyan.github.io/OpenTV-Remote/

The three screenshots show two Android layouts/colors and the iPhone app. Suggestions and bug reports are welcome.

Two weeks ago I released Prism, a free, open-source download manager for Windows, macOS and Linux (Rust + Tauri, MIT). It just passed 100 stars on GitHub, and since a good part of the feedback came from Reddit threads, I wanted to say thanks and show what it turned into.

**What changed since 1.0, mostly because someone reported it:**

- **8 languages:** Czech, German, Spanish, French, Italian, Indonesian and Arabic (the whole window mirrors right to left)

- **The browser extension is on the Chrome Web Store**, and Zen and Helium are supported

- **Linux:** the main window shows again on KDE Plasma, magnet and .torrent links open in Prism, Zen/Firefox with new profiles connect, the RPM works with RPM Fusion's ffmpeg

- **Lighter in the tray:** after a minute there, Prism closes its window to free the web view's memory

- **Sites with a robot check** are left to the browser instead of saving an error page as your file

- **.torrent links** open the *Add torrent* window instead of failing

- **Quality list for HLS/DASH streams**, from a community PR

- Compact view, playlist names and numbering, a portable version that finds the extension again, and security fixes in 1.0.8

**By the numbers:** 16 releases, 2,200+ downloads, 15 issues (11 closed), 8 pull requests from 3 contributors.

**Next (1.1.6, almost ready):** the light theme fully light on Windows, Brave Origin on Linux and macOS, VK videos, and a YouTube retry when signed-in cookies are rejected.

**Thank you, Reddit.** A lot of Prism's first two weeks happened in comment threads like this one. People installed a brand-new app from someone they'd never heard of, ran it on setups I don't have, and took the time to write down what broke. That's a big part of why there were 16 releases and not two.

Special thanks to u/CredibleWrong for finding the Brave Origin problem (fixed in 1.1.6), u/Nanobuo for asking about Helium (supported since 1.1.0) and u/StressLiving6734 for the video button ideas. And to everyone who left a bug report, an idea or just told me it works for them: thank you, all of it helped.

If you've tried it: what's still missing or annoying? Bug reports are what made most of these releases.

GitHub: https://github.com/FortoGraphy/prism-download-manager

Website: https://prismdl.site

I kept rebuilding Windows 10 install media by hand (DISM commands, hunting updates in the Update Catalog, fixing driver signatures), so I turned it into one tool.

**Win10 ISO Updater** is a single `.cmd` file with a GUI. Double-click it, pick your Windows 10 ISO, and it:

- downloads the latest updates from the Microsoft Update Catalog (cumulative update, servicing stack, Safe OS / Setup Dynamic Updates, .NET) and slipstreams them

- adds drivers exported from your PC (storage and network drivers also go into boot.wim and WinRE, so Setup sees NVMe/RAID disks)

- re-signs modded NVIDIA drivers (NVCleanstall hardware-ID mods) with your own certificate, so they install during setup with Secure Boot still on

- adds your autounattend.xml and $OEM$ folder

- runs an install check first (answer file mistakes, scripts that wait for a key press, drivers Windows will refuse), with one-click fixes

- builds a bootable BIOS + UEFI ISO

A few details:

- Nothing to install. The Microsoft tools it needs (oscdimg, Inf2Cat, signtool) are downloaded from Microsoft when a step needs them.

- No telemetry. It only connects to Microsoft servers.

- Speed: boot.wim and WinRE are updated in the background at the same time as install.wim, and the PC is kept awake during long jobs.

- Driver signing only re-catalogues the INF files you edited, with several runs at once, instead of all ~40 INFs in NVIDIA's Display.Driver (that used to take up to an hour).

- Updates stop at 2025-10, the last month Microsoft allows offline. ESU updates still come from Windows Update on enrolled PCs.

- You need your own Windows ISO and license. No keys and no activation tricks are included.

Screenshots and download (open source, MIT):

https://github.com/j0p3s/Win10-ISO-Updater

It's written in PowerShell 5.1 with a WPF interface, and the test suites run on Linux with PowerShell 7. Feedback and bug reports are very welcome, especially from people who try it on other builds (LTSC 2019 / 2021, x86, ARM64).

I have built with Claude a Home Control application that can manage TV's, Sky TV, Android TV, Hive Heating, Phillips Lights, and Ring door Bell. It also have routines built in as well.

Link to GitHub below

https://github.com/foleys1972/HomeControl

Video
https://youtu.be/ov6Ox4q7hdU

Introducing Heimdall, a glassy launcher for Windows. And yes, it's faster than Everything.

Press the hotkey of your choice, and type. It finds apps, every file, open windows, calculates sums and web searches.

Native Rust, under 2 MB, ZERO telemetry. Free and open source.

EDIT: Thank you for the great reception! I just published the 1.0.3 release with some more QoL and fixes for a few annoying quirks. It's also faster than before, and now beats Everything on every search metric. It's also come to my attention that the link doesn't show up for some reason, so you can get it here:

github(.)com/Kryzern/Heimdall

Hey everyone!

I've just released ZEROAGENT X v1.0.0, an open-source developer automation platform built with Python.

The idea behind the project is simple: I wanted a more controlled way to work with developer automation tools.

ZEROAGENT X includes:

• A CLI and interactive terminal UI.
• Local-first execution workflows.
• Policy-controlled agent execution.
• Request-specific approvals.
• OpenCode integration.
• Execution history and inspectable evidence.

It's still an early public release, and there are limitations. For example, external agents aren't OS-sandboxed.

The project is licensed under Apache-2.0, and the source code is available on GitHub.

GitHub: https://github.com/harisazharir-boop/zeroagent-x

I'd really appreciate feedback on the architecture, documentation, and overall developer experience.

Thanks!

The goal: Arc-style spaces in one window, but with real isolation. Each space gets its own cookies, storage, history, passwords, form data, extensions, permissions and downloads. Firefox containers only cover cookies and storage, and profiles need separate windows, so this needed a different approach.

How it’s put together:

• app/: Swell is its own Gecko application, built inside a Firefox source checkout the same way Thunderbird’s comm/ is. It has its own window document, not a restyled Firefox UI.
• core/: a Rust core owns the app state: the sidebar tree, spaces, and per-space data.
• patches/: a small patch queue for the engine changes that can’t live outside Gecko, applied on top of a pinned Firefox revision (FIREFOX_REV).
• Extensions per space: each space gets its own copy of an extension, scoped so it only sees that space’s tabs.
• Passwords: stored per space, encrypted with a per-space key in the OS keychain.
• Tests: an isolation suite checks 17 state stores for cross-space leaks. There are also Rust unit tests, xpcshell and browser tests, and an end-to-end restart test.

It’s an alpha: Apple Silicon macOS and x86 Linux, unsigned builds, no telemetry, MPL 2.0. Build from source takes about 30 minutes and 15–20 GB.

Feedback on the architecture and the isolation model is very welcome, and so are contributors. CONTRIBUTING.md explains the setup.

Github: https://github.com/ivantacca/swell
Website: https://ivantacca.github.io/swell/

Pick a window on the PC and it shows up on the phone live, sound included. Tap, scroll, type into it. Or skip all that and say "email me the Q4 report" and the PC finds the file, attaches it in Gmail and sends it.

It also takes meeting notes without a bot joining the call.

The PC has to approve the phone, screen access is off until you turn it on, and the AI can run fully local if you don't want any cloud. Free, MIT. Windows + Android only for now.

https://github.com/ishangautam7/Talvio

Still rough in places, tell me what breaks.

I use Codex and Claude Code daily, and the most annoying moment is hitting a usage limit halfway through a task. You either wait hours or paste context into another tool by hand.

Moonfold is an open-source desktop and web workspace that runs the agent CLIs you already have (Codex and Claude Code today, with adapters for Cursor, OpenCode and others in beta) with your own logins. When one hits its limit, it stops the turn, writes a brief of where the task stands (plan, changed files, git status, the failing command), redacts secrets, shows you the brief, and hands the same thread to the next agent. The GIF in the README is a real run: Codex starts a bug fix, Claude finishes it.

It is a fork of T3 Code (MIT), which gave me the multi-provider base, worktrees and diff review. What I added: the handoff, usage tracking per provider, scheduled tasks, in built browser pane and computer access, plugins and memories, and a security pass (Supervised is the default permission mode).

Honest limits: it is a beta, builds are unsigned, Gemini CLI is not verified end to end yet, and the brief is only as good as what the first agent left behind. Nothing is proxied: each agent is your own local CLI, and there is no telemetry unless you turn it on.

I'd love feedback on the handoff brief what would you want carried over that isn't?

Windows, macOS, Linux. Beta, feedback welcome: github.com/Mr-Dark-debug/Moonfold

I'm building Emend. It adds AI writing to a Tiptap editor: rewrite selected text, write new text, or ask questions about the document.

What you get:

• Three AI components (bubble menu, composer, document chat), or a full editor starter
• Already have a Tiptap editor? Just add the components to it
• Bring your own AI key and start using it
• The AI never changes text until the user accepts it

It's still early, so I'd love your feedback.

GitHub: https://github.com/amittam104/emend

• WhatsApp, Telegram and Instagram DMs in one place, unread first
• No stories, reels or feeds. Photos and videos show as text until you open them
• Nobody sees "seen" (read receipts off by default)
• Optional delivery times and a daily time limit
• Keyboard only: / to search, emoji by name, sent/seen ticks, notifications

Setup: WhatsApp = scan a QR code. Telegram = a free API key from my.telegram.org (2 min). Instagram = cookies from your browser.

Heads up: WhatsApp and Instagram access is unofficial, so Meta could restrict an account. Try it with one you're okay risking. Telegram uses the official API.

I'd really appreciate a review: what works, what's confusing, what's missing? Honest feedback helps me more than anything.

GitHub: https://github.com/mitanshpatelll/ttyl

If you find it useful, a ⭐ on the repo helps others find it.

I've been working with my college backend and I wanted to get a proper architecture diagram using excalidraw mcp but all were messed up either text issues or messy arrow or overlapping boxes...

So I started working on my own MCP server that lets AI agents generate and manipulate Excalidraw diagrams directly without all those bugs.

One of the main challenges has been making diagrams readable rather than merely generating shapes: fitting text inside boxes, keeping components separated, routing arrows around obstacles, and exporting the complete scene at a useful resolution.

The project now supports Mermaid and architecture diagram generation, scene editing, font aware text containment, connector routing, geometry diagnostics, and PNG export.

Here's an example of a backend architecture diagram for a college project generated using the MCP:

You can run it using:

uvx exca-mcp

GitHub: https://github.com/Dharshan2208/excalidraw-mcp

PyPI: https://pypi.org/project/exca-mcp/

It's open source under the MIT license. I'd like feedback from people who've built diagramming tools or used AI agents for architecture diagrams. What would you improve first?

Hey everyone!

I've just released ZEROAGENT X v1.0.0, an open-source developer automation platform built with Python.

The idea behind the project is simple: I wanted a more controlled way to work with developer automation tools.

ZEROAGENT X includes:

• A CLI and interactive terminal UI.
• Local-first execution workflows.
• Policy-controlled agent execution.
• Request-specific approvals.
• OpenCode integration.
• Execution history and inspectable evidence.

It's still an early public release, and there are limitations. For example, external agents aren't OS-sandboxed.

The project is licensed under Apache-2.0, and the source code is available on GitHub.

GitHub: https://github.com/harisazharir-boop/zeroagent-x

I'd really appreciate feedback on the architecture, documentation, and overall developer experience.

Thanks!

Coding agents write everything down: every .env they read, every key you pasted “just to test one call”, every printenv they ran while debugging. Claude Code, Codex, Gemini CLI, Cursor, Cline and others keep those conversations on your disk as plain JSON or SQLite. The Claude Code docs say so themselves: transcripts aren’t encrypted at rest, and file permissions are the only protection.

spillage does three things:

• Find: reads the logs and settings of 14 agents and reports each key with the session, the project and how it got there (you pasted it, a tool printed it, or the model repeated it), plus a link to where you rotate it.
• Scrub: redacts keys in place without breaking the JSON, so claude --resume still works. Untouched bytes stay identical, every changed line is re-parsed before writing, writes are atomic, and mtime is kept.
• Guard: installs hooks into Claude Code, Codex CLI and Gemini CLI. They block a prompt that contains a key, and they block tool calls like cat .env, printenv or echo $STRIPE_SECRET_KEY before they run.

bash

pipx install spillage   # or: uvx spillage
spillage                # find what already leaked
spillage guard install  # block the next one

It has 100 rules with low false-positive rates. GitHub tokens are checked against their built-in CRC32, JWTs have to decode, and placeholders like sk-...your-key-here are skipped. It also takes the values from your projects’ .env files and searches for those exact strings, which catches random DB passwords no regex would. It scans about 240 MB of real agent history in under 4 seconds.

Some Python details that may interest people here:

• Standard library only. That seemed fair for a tool you point at your secrets.
• Almost every rule starts with a literal prefix (ghp_, sk-ant-, AKIA), which lets re skip straight to candidates. That’s 0.2 s instead of 6 s per rule. Rules without a prefix look up an anchor with str.find first.
• Large scans fan out over up to 8 processes, and huge session files are split at line breaks so one 100 MB file doesn’t pin a single core.
• Only the JSON line that holds a match is parsed.
• There is no network code at all. It never sends anything and never tests whether a key is live. Releases carry signed build attestations.

Python 3.9–3.14, macOS/Linux/Windows, MIT.

Target Audience

Anyone using a coding agent on a machine with real keys on it. That’s mostly devs with Claude Code, Codex, Cursor or Aider, plus teams that want a CI check, since there’s a GitHub Action and a pre-commit hook for agent transcripts committed to a repo.

Two honest caveats:

• Rotate first. Every key in those logs already went to the model provider when the conversation happened. scrub only cleans your disk.
• The hooks are a guard rail, not a sandbox. They stop the common ways a key ends up in a conversation. An agent determined to read a file will find a path the hooks don’t know.

Comparison

• gitleaks and TruffleHog are built for git repos. They have far more detectors, and TruffleHog can verify whether a key is live. On agent logs, though, they don’t know that a private key in JSONL is written with \n escapes, that a match inside a base64 screenshot is noise, or which session a line came from. They also don’t scrub.
• ggshield has hooks for more agents than spillage, but it scans live sessions through GitGuardian’s API. It doesn’t cover what’s already on disk, and it needs an account.

Run them too. spillage covers what your agent already kept.

https://github.com/maximilianfeix/spillage

Feedback I’d really like: agents whose logs I’m not reading yet, and key formats it misses. Describe the shape, don’t paste the key.

When you ship an Electron update, the question in a release review is usually simple: did this release add a preload member, a new IPC channel, a more permissive window or a new server the app talks to? A diff of two minified app.asar bundles doesn’t answer that, and running the app to find out isn’t always an option.

What it does

hexvero reads two builds statically and lists what changed:

• IPC and bridge map: window → contextBridge member → IPC channel → ipcMain handler
• Window settings: webPreferences per window, and whether nodeIntegration and sandbox are actually in effect
• Runtime and fuses: Electron, Chromium and Node versions, fuses and ASAR integrity, read from the packaged binaries
• Network hosts and localStorage/sessionStorage keys, each marked as literal or inferred

Every change comes with the file and line it was read from, in both builds. If hexvero can’t resolve something, it reports it as ? (unknown), not as removed.

ipcChannels (2)
  + update:check  @ b: receiver main.js:30, sender preload.js:9
  ? shell:open    @ a: receiver main.js:30, sender preload.js:9
windows (1)
  ~ main.js::win  @ b: main.js:8
      nodeIntegration: true → false, sandbox: false → true

hexvero check old new --policy policy.json turns this into a CI gate. Exit 0 means pass, 3 means the policy was violated (for example a new bridge member or a new external host), and 4 means it couldn’t decide. It also outputs SARIF. Since 0.12 there is also hexvero audit for a single build (CSP, shell.openExternal, permission handlers). And there’s an MCP server with 16 tools if you want a coding agent to run the review.

Try it with no setup: npx hexvero demo (Node 22.12+). It never executes the target, and there’s no telemetry and no network calls.

How accurate is it?

On blind test apps written by someone who had no access to hexvero:

• 52 of 64 IPC channels found, none false
• window settings and endpoints still had misses and some false rows

All numbers, including every miss, are in docs/accuracy.md. It’s a static reader, not a vulnerability scanner, so a passing check is not a security verdict.

Comparison

• Electronegativity checks one build against known risky patterns. Its README says it’s no longer actively maintained.
• REA is much broader (dynamic analysis, decompilers, devices) and can also compare versions. On the same blind set, hexvero linked 65 of 78 bridge members to their IPC channels, REA 6.5.0 linked 6 of 66. If you need dynamic analysis, use REA.

Repo: https://github.com/maximilianfeix/hexvero (MIT)

I’d especially like to hear about IPC patterns from real apps that it misses. Wrapper classes and routers already work, but there are certainly more.

I’ve been building DepScope, an open-source dependency security scanner for npm and PyPI.

The thing that bothered me about dependency scanning is that a clean result can be misleading. Sometimes checks fail, data is unavailable, or a scanner only covers part of the problem.

DepScope tries to make those gaps explicit.

• Checks package versions against OSV vulnerability advisories
• Separates confirmed vulnerabilities from heuristic warnings
• Flags suspicious package-name similarities and npm lifecycle scripts
• Shows which checks succeeded, failed, or were skipped
• Scans without installing or executing the packages

It also supports project scans, a terminal UI, and an MCP server for AI coding workflows.

Built in Go, open source under Apache 2.0.

GitHub: https://github.com/janghotan/depscope

I’m interested in feedback, especially on whether the reporting is useful enough to fit into a real development workflow. What would you change?

I created Awesome Easy-to-Join Orgs repo, a curated list of GitHub organizations that welcome people who want to get involved without necessarily writing code.

The goal is to make open-source communities more accessible to beginners, students, and non-coders who want to participate, learn, or contribute in other ways.

I'm sharing the project here in case it's useful to anyone looking for communities to join. Suggestions for additional organizations and feedback on the list are welcome!

Hi all, we just open-sourced OpenMuse, a personal AI assistant app.

Instead of just chatting, it works on a cloud desktop (or your own computer):

• Browses the web, looks things up and fills in forms
• Uses desktop apps
• Writes and runs code in a workspace
• Runs scheduled tasks

The main thing we cared about was keeping the human in control:

• You can watch the agent’s screen live from your phone. If it hits a login or a captcha, you take over, then hand it back.
• It asks before submitting forms or running commands.
• You decide which desktop apps it’s allowed to use.

OpenMuse is built on WorkAgentSDK, an AI agent framework for Python that we wrote and open-sourced along with it. To be clear, it’s not a coding assistant like Cursor or Antigravity. It’s a framework for building agent products. For example, each session can run on a different node, so one backend can serve many users, each with their own cloud desktop.

Stack:

• Backend: Python (FastAPI + WorkAgentSDK)
• App: Flutter
• Nodes: Docker containers with a virtual desktop, Chromium and a shell sandbox, or run directly on Linux or macOS
• Models: OpenAI, Claude, Qwen, and OpenAI-compatible APIs

It’s v0.1, so still early. We’d love to hear what you think:

• Does “agent on a remote desktop, human supervising from a phone” seem useful to you?
• If you’re building agent products, what’s been the hardest part?

GitHub: https://github.com/nativefunc/WorkAgentSDK
(The app is under examples/showcase/openmuse)

Mainly to replace Paprika which isn't very good on Android. And I didn't want to pay another subscription for alternatives!

It is local-first, so all the data is stored on your device and works offline.

You can try it here: https://cheffect.app

GitHub: https://github.com/tim-smart/cheffect

Collection of small zero-dependency Node tools packaged as agent skills (SKILL.md format - works with Claude Code, Codex, Cursor and other agents).

Each skill does one audit-type job offline and prints JSON: SEO audit, repo due diligence, npm health, secret scanning, JWT decode, Dockerfile lint, contract triage + more.

Install: npx skills add NenadZivotic/lite-agent-skills --skill <name> Node 18+, tests included. Lite editions are fully usable; README links to paid full versions.

What other audit/check would be worth packaging this way?

While developing Varelyo, a desktop tool for designing products directly in code, I kept running into the same issue. AI agents were rebuilding basic components for every new project, often with inconsistent styles, variants and token structures.

So I created Varelyo UI, a React/TypeScript component library with ready-to-use components, typed APIs, states, variants and three token layers: Core → Semantic → Component.

You get the actual component source code, which you can use, customize and extend in your own projects. The token architecture lets you adapt the design system to your brand without rebuilding everything.

For AI agents, this means working with an existing component system instead of generating basic UI from scratch. They can adapt styles, extend components or create new ones when needed.

The video shows the components inside Varelyo and how their visual style changes when applying a brand.

I originally made this for my own workflow, but decided to open-source it in case others find it useful.

Free, MIT-licensed and works independently of Varelyo Desktop.

GitHub: https://github.com/varelyo/ui