Samsung Galaxy Tab A tablets sell for as little as $133, but their processors, RAM, cameras, and battery life involve trade-offs buyers should weigh first.
Source: Headtopics
Explore Tesla battery replacement pricing and longevity. Compare repair costs from independent shops against new Model 3 and Model Y prices to decide your best move.
Source: Headtopics
The Ring Peephole Cam 2K offers a renter-friendly security solution with no-drilling installation. This 2K video camera provides two-way audio and motion alerts for homes where traditional doorbells are not permitted.
Source: Headtopics
For more than two decades, the name Albert Pujols has been enough to make Houston Astros fans cringe.
Source: The Daily News
Cyberpunk: Edgerunners 2 has arrived on Netflix from CD Projekt RED and Studio Trigger, shifting to a new cast and a fresh storyline set in Night City.
Source: Headtopics
A security patch is easy to approve. Finding every PHP runtime hidden in an old container, appliance, control panel, or forgotten staging server is the harder part. That problem became urgent after PHP disclosed two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, known together as PHP2Shell. The PHP project released fixed versions on October 21, 2026. Its advisory says any PHP installation serving web requests could be at risk, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed. The project's rating of the risk is highest for mod_php, where a demonstrated request could reach the flaw before application code ran. (PHP security advisory) The discovery story needs careful attribution. Calif Research says it found the first PHP2Shell bugs during its audit. OpenAI's account says GPT-5.6 Sol helped Calif identify the critical flaw, while Wiz describes a separate, later audit that used both Gemini 4 Argon and GPT-5.6 Sol. Wiz says Argon made a significant contribution to its discovery. These accounts support a narrower claim: AI-assisted research helped expose these issues. They do not mean an AI autonomously found every flaw or built the full exploit chain. (Calif Research's account, OpenAI's account, Wiz's account) For operators, the urgent question is practical: which PHP runtimes serve real traffic, and how do you prove they were updated and restarted? Here is a cautious inventory and patch-verification workflow. It does not exploit anything. It helps you find the runtime that a package list or a single php -v command can miss. Start with the exact fixed versions The PHP project's October 21 security release lists these fixed upstream versions: PHP 8.5.12 PHP 8.4.27 PHP 8.3.36 PHP 8.2.35 Linux distributions and long-term-support vendors may backport security fixes without changing the upstream version number in the same way. PHP says to check with the vendor for updated packages. PHP 8.1 and older no longer receive updates from the PHP project, though a distribution or vendor may provide its own backport. Do not declare an old-looking version vulnerable or fixed based only on the version string. Confirm the package's vendor advisory or build provenance. (PHP advisory) The report from the Dutch National Cyber Security Centre is useful here because it tracks both PHP itself and downstream software that may bundle PHP. Its inventory listed 948 products on November 4, with 215 marked vulnerable and 185 fixed at that snapshot. Those counts change as maintainers update the list, so treat them as a dated inventory, not a current universal total. (NCSC-NL PHP2Shell tracker) Why php -v is not a complete audit A shell command named php usually reports the command-line interpreter selected by your current PATH. A website may instead use PHP-FPM behind Nginx, an Apache module, a container image, a hosting control panel, or PHP embedded inside a third-party appliance. Those may be different builds. A machine can have multiple PHP versions installed at once. Updating the CLI package does not prove that the process serving requests was updated, and replacing a package does not prove that old workers have exited. Think of this as an inventory problem with three layers: Hosts: virtual machines, physical servers, cloud instances, and staging systems. Runtimes: package installs, custom builds, containers, and bundled copies. Traffic paths: the service or appliance that actually accepts web requests. A clean result in one layer does not clear the other two. The NCSC-NL guidance explicitly recommends identifying PHP-based applications and checking third-party images, appliances, and embedded runtimes separately. (NCSC-NL operational guidance) Step 1: List every place PHP could run Start with your asset inventory, cloud console, deployment configuration, and hosting panel. Search for PHP-related service names and image tags in infrastructure code. Include production, staging, build workers that serve previews, and appliances managed by another team. On each Linux host you administer, these read-only commands provide useful clues: command -v php || true php -v 2>/dev/null || true php --ini 2>/dev/null || true ps -eo pid,comm,args | grep -E '[p]hp-fpm|[p]hp-cgi|[a]pache2|[h]ttpd|[l]itespeed' systemctl --type=service --state=running | grep -Ei 'php|apache|httpd|nginx|litespeed' They are discovery aids, not a complete scanner. Process names vary by operating system and package. A reverse proxy such as Nginx may pass requests to PHP-FPM, so seeing Nginx alone tells you little about the PHP version. Likewise, a process list can show a service without identifying the image or package that supplied its binary. For Debian- or Ubuntu-based hosts, inspect installed packages as a second view: dpkg-query -W -f='${Package} ${Version}\n' 'php*' 2>/dev/null For RPM-based hosts, check the package database with the package tool used by that system. Do not assume the package name is identical across distributions or third-party repositories. If the system uses a hosting panel, consult its supported runtime list too. Panel-managed PHP builds can live outside the operating system's standard package paths. The point is to gather evidence from multiple places, not to trust one command. Record the hostname, application, runtime source, serving mode, reported version, owner, and next action. If you cannot identify the runtime owner, mark the asset as unresolved rather than treating it as safe. Step 2: Check containers and bundled products A host can be patched while a container continues to run an older PHP image. List the containers that are actually running, then trace each one to its image and deployment definition: docker ps --format 'table {{.Names}}\t{{.Image}}\t{{.Status}}' This only reports containers visible to the Docker daemon you queried. Repeat for each cluster, account, and environment, and use your orchestrator's deployment inventory for Kubernetes or other platforms. For every PHP image, identify its base image and rebuild from an image containing a vendor-fixed runtime. A tag such as latest is not proof that the deployed image changed; compare immutable image digests or your registry's build metadata. Also check products that embed PHP rather than exposing a PHP package directly. The NCSC-NL tracker names downstream software and points to supplier advisories. A product may require a vendor firmware or appliance update even when you cannot run php -v on it. For hosted services, ask the provider whether the relevant fleet or service component has been patched, and request the affected product version or rollout status. (NCSC-NL product inventory) This is where a version-only policy often fails. “The server is on PHP 8.4” leaves unanswered which build, which host, and which process. A more useful record says: “The public web tier runs the vendor package with the security fix; the FPM service was restarted; the running process now reports the expected build.” Step 3: Patch through the owner of the runtime For a standard distribution package, use that distribution's security update process and verify its advisory. For a container, rebuild and redeploy the image. For a managed platform, apply the provider's update process. For a custom build, use the relevant PHP release and deployment process, then verify the binary and all service workers. Do not copy a package command from a different operating system or panel. A command that appears to succeed may update the wrong PHP stream or leave the serving service untouched. The official PHP page says Linux distributions and LTS vendors received patches in advance, which is why the vendor's package status matters. (PHP security advisory) After deployment, restart or reload the relevant PHP and web-server processes using the service manager and procedure for your platform. Then check that the old workers are gone. The NCSC-NL guidance also calls out restarting workers when mitigation steps are used. A replaced executable on disk is not enough if a long-running process still has the old code mapped in memory. (NCSC-NL operational guidance) Step 4: Verify the serving process, not just the package Use a platform-specific health check that identifies the PHP version from the web-serving path. For example, an application can expose a temporary, access-controlled diagnostic endpoint that returns only the runtime version and SAPI. Remove it immediately after checking. Do not publish a public phpinfo() page: it can disclose configuration and environment details unrelated to this patch. For PHP-FPM, verify the package or image used by the pool, confirm the service restarted, and inspect the running process list. For Apache mod_php, check the Apache module and the PHP build loaded by Apache. For a containerized service, verify the deployed image digest as well as the runtime inside the running container. For appliances and managed services, use the vendor's version report or written confirmation. Keep a small evidence record for each asset: The package, image digest, appliance build, or vendor update that contains the fix. The service or deployment that was restarted or rolled out. A post-update check showing the serving runtime is the expected build. Any exception, owner, and deadline if an asset could not be updated. The goal is not paperwork for its own sake. This record helps prevent an old canary, preview environment, or secondary node from being forgotten after the main application passes its health check. If patching is delayed PHP's project has described temporary mitigations, including disabling session upload progress and reviewing settings such as memory_limit, post_max_size, and PHP 8.5's fatal_error_backtraces. The NCSC-NL guidance explicitly says these steps are not complete fixes. PHP's October 23 informational advisory also recommends session.upload_progress.enabled=0 until the next regular bug-fix release for an unlikely additional RCE vector, CVE-2026-115560. It notes that the risk depends on an unusual combination of session-handler configuration and application behavior. (PHP advisory and update, NCSC-NL guidance) Treat these as temporary risk reduction, not a substitute for the vendor-fixed runtime. Do not blindly change memory or request-size limits on a busy service without checking application requirements. Test configuration changes, document them, and schedule the actual patch. A separate operational point matters: Singapore's Cyber Security Agency published an alert on November 3, 2026, describing active exploitation against selected network and security products, including reports of attackers chaining PHP2Shell with a separate Linux kernel flaw. That is not evidence that every PHP installation has been compromised. It is a reason to check product-specific vendor guidance and review logs for systems that could have been exposed. (Singapore CSA alert) What AI changes, and what it does not The public accounts describe more than one audit, with different researchers and different models involved. Calif says its audit found the first PHP2Shell bugs. OpenAI says GPT-5.6 Sol helped identify the critical flaw. Wiz later reports a separate investigation that used Gemini 4 Argon and GPT-5.6 Sol, with Argon making a significant contribution. These are the organizations' own accounts of their research, not independent measurements of how much work a model did. (Calif Research, OpenAI, Wiz) The useful lesson is not “AI automatically hacks old software.” The evidence here is narrower: capable models contributed to researchers' audits of a mature codebase, and those audits found serious flaws. Years of deployed versions and rarely audited products still need human owners who can inventory, update, restart, and verify them. The defenders' work is less glamorous: know what is running, know who owns it, update the right artifact, restart the right process, and verify the result. That is exactly the kind of work that becomes more important when vulnerability discovery speeds up. A short checklist to keep Inventory: include hosts, containers, staging, control-panel runtimes, and appliances. Identify the serving mode: CLI version alone does not identify PHP-FPM, mod_php, or a bundled runtime. Use vendor evidence: confirm upstream fixed versions or vendor backports. Deploy and restart: update the artifact that serves requests, then ensure old workers exit. Verify: check the live runtime or vendor build, not only the package manager's success message. Track exceptions: assign an owner and deadline to anything still unknown or unpatched. Review exposure: follow product-specific advisories and investigate suspicious activity where appropriate. The hard part of this incident is not typing an update command. It is finding the copy of PHP nobody remembers deploying. A reliable inventory turns that into a finite list instead of a guess. I write about software engineering, security, and AI. Subscribe if you want the next practical breakdown. Have you found a PHP runtime in a place your normal inventory missed? What check exposed it? Save this checklist for your next runtime patch cycle. Sources: PHP security advisory and releases NCSC-NL PHP2Shell operational information and software inventory Calif Research: PHP2Shell, a tale of two PHP remote vulnerabilities OpenAI: GPT-5.6 Sol and PHP2Shell research Wiz: AI-assisted vulnerability discovery Singapore Cyber Security Agency alert on active exploitation Docker security update for PHP2Shell
Source: Dev Community
After Kolek suggested Swift may attend Knicks games to be seen rather than out of genuine fandom, the team made clear it appreciates the pop star’s longtime support
Source: Yahoo! News
SPEEDWAY, Ind. — The lights are up along Main Street, and the holiday mood is set. The shops say all they need now are the customers. Friday night’s Speedway Stroll kicked off the season of holiday spending. Both brick and mortar and pop-up shops said it was a much-needed jolt. ”People don't spend money the [...]
Source: Fox 59
Russia launches ballistic missile attack on Kyiv ahead of Abu Dhabi peace talks
Source: Investing Us
The X-Men confront a terrifying new experimental Sentinel in Uncanny X-Men 38, marking a shift toward bio-organic horrors that pose a grave risk to mutantkind.
Source: Headtopics
A beloved singer responded directly to a fan’s comment criticizing her daring outfit, explaining the reason behind her choice of attire. Recently, a video was posted on a social media…
Source: Koreaboo
Momentum, a leading innovator in commercial textiles and wallcoverings, has introduced QuickShip | Assured Textiles, a new upholstery program designed for high-volume contract projects with tight turnarounds, delivers elevated design alongside exceptional durability and value. This program is the first of its kind within the contract interiors industry because it delivers high-volume orders that bypass… The post Momentum Introduces QuickShip | Assured Textiles for High-Volume Contract Projects first appeared on officeinsight.
Source: Officeinsight - Giving Voice To Those Who Create W
I run a small fan site for a Fortnite event, and one page is a chest counter: you tap +1 every time you open a chest, and it turns the count into odds. Analytics showed something I hadn't designed for. On phones, people tap it about 50 times per visit. They prop the phone next to the console and keep tapping between fights. Which means the phone goes to sleep between matches, and every time they come back they have to unlock it first. So I added the Screen Wake Lock API. The happy path is one line: The rest of this post is the stuff that one line doesn't tell you. 1. The browser takes the lock away, a lot A wake lock is released automatically whenever the page is hidden: switching apps, locking the phone, changing tabs. When the user comes back, you don't get it back for free. You have to request it again on visibilitychange: If you only request once on load, it silently stops working the first time someone checks a message. 2. Don't grab it on page load Plenty of visitors read the page and leave. Holding the screen on for them just drains their battery. I only ask for the lock after the first tap on a counter button, and only re-acquire on visibilitychange if counting has started: 3. Requests can fail, and that's fine request() rejects in battery-saver mode, in some embedded browsers, and under certain permission policies. The counter must keep working anyway, so the failure is swallowed: catch { sentinel = null; // counting still works, the screen just sleeps } Also guard against double requests: a fast double-tap can fire two request() calls before the first resolves. I keep a pending promise and skip if one is in flight. 4. Give people an off switch, and remember it Some people don't want their screen pinned on. A checkbox, "Keep my screen on while counting", is on by default, and the choice goes into localStorage (wrapped in try/catch, since private mode can throw). Turning it off releases the current lock right away. 5. Hide the option where it can't work Older iOS Safari (before 16.4) has no navigator.wakeLock. Showing a checkbox that does nothing is worse than no checkbox, so the row starts hidden and is only revealed when the API exists. The whole thing Here is the module as it runs on the site, small enough to paste: export Passing wakeLock and doc in, instead of reading navigator and document inside, is what makes it testable: in Node I hand it a fake wakeLock that records calls and a fake document I can "show" again, then assert things like "the first tap requests once, later taps reuse it" and "after the browser releases it, showing the page takes it back". Eight small tests, no browser needed. You can try it on the Pirate Token chest tracker: tap +1 once, then leave your phone alone and watch it not go dark. If you've hit other Wake Lock edge cases (I'd love to hear how Samsung Internet behaves), tell me in the comments.
Source: Dev Community
Canceled games are nothing new, but 10 exciting games were taken out of action before they could deliver on their promise.
Source: Polygon
The floor of the EICMA motorcycle show in Milan is always a global battlefield of sexy new two-wheelers. This year however a weird and wonderful radical newcomer has stolen the show – and it has three wheels not two. Continue Reading Category: Automotive, Transport Tags: EICMA 2026, Three-Wheeler, Retro, Sports Cars, Trike
Source: New Atlas
From literary lamps to library-card charms, purchasing these presents for the bibliophile in your life is long overdue
Source: Rolling Stone
Book: Prompt Engineering Pocket Guide The series: Pocket Guides for Developers — 8 short books on agents, RAG, prompts, observability, events, databases and system design — the whole series My project: Hermes IDE | GitHub — an IDE for developers who ship with Claude Code and other AI coding tools Me: xgabriel.com | GitHub Your AGENTS.md says "Never import @acme/db from src/domain/." Read that line again. It's a lint rule, written in English, handed to the one reader in your pipeline that is allowed to ignore it. You don't have to take my word for it. Anthropic's Claude Code memory docs put it in one sentence: Claude treats CLAUDE.md files "as context, not enforced configuration." The same goes for an AGENTS.md, which Claude Code reads in place of CLAUDE.md when a repo has none, and which the AGENTS.md site says is "used by over 60k open-source projects." So here's the take. Every rule in your instruction file that a linter, a git hook or a permission rule could check is a bug waiting in prose. Move it to the tool. Keep the file for the calls no tool can make. Your rule file is a request, and the docs say so Claude Code's best practices page splits every instruction into two kinds. Your prompt, CLAUDE.md and skills are non-deterministic: the model reads them and decides, and "there's no guarantee that it'll follow your instructions." Hooks, deny rules and managed settings are deterministic: Claude Code "applies this every time, no matter what the model decided to do." The page goes further than you'd expect from the company that sells the model: "If something has to happen every time, make it a hook, a deny rule, or a managed setting. CLAUDE.md is for guidelines, and Claude is allowed to decide a guideline doesn't apply." And the tell it gives you: "If you keep adding emphasis to a CLAUDE.md line and Claude still misses it, that's a sign the line belongs in a hook." An IMPORTANT: you've added three times is a rule asking to be moved. Most of an instruction file is rules that want to be gates. Where prose rules go missing The model choosing not to follow a line is one way a rule fails. The line not being in front of the model is another, and that one is mechanical. Compaction is the first. When a long Claude Code session compacts, the context window docs say the project-root CLAUDE.md is re-injected from disk. Path-scoped rules and nested CLAUDE.md files are different: they load when Claude touches a matching file, "so compaction summarizes them away with everything else" until a matching file is touched again. A rule you only typed into the chat can be lost with the rest of the history. The best practices page says the same of "don't push until I've reviewed": "the sentence can get lost when the conversation compacts, so anything that matters belongs in a deny rule." Size is the second. Codex stops adding AGENTS.md files once their combined size reaches project_doc_max_bytes, 32 KiB by default. Claude Code's docs ask you to keep each CLAUDE.md under 200 lines, because "longer files consume more context and reduce adherence." Subagents are the third. The memory docs note that subagents which start without project instructions start without your AGENTS.md too. None of these touch ESLint. Nobody summarizes eslint.config.js, and nobody stops reading it at 32 KiB. The 40-rule AGENTS.md Here's an AGENTS.md for a TypeScript service in a pnpm monorepo. I made it up for this post, but each line is the kind of rule these files collect. Count how many a tool could check. # AGENTS.md ## Setup 1. Use pnpm. Never npm or yarn. 2. Never run `npm install`, not even to try something. 3. Ask before adding a dependency. 4. Never run `pnpm update`. 5. Never edit pnpm-lock.yaml by hand. 6. Never read or print .env files. ## Architecture 7. Never import @acme/db from src/domain/. 8. Never import express in src/domain/. 9. src/domain/ must not import @acme/http. 10. No deep imports like @acme/db/src/client. 11. Business rules live in src/domain/, free of I/O. 12. Ask before changing exports of packages/api-client. ## TypeScript 13. Never use `any`. 14. Keep `strict: true` in tsconfig.json. 15. Use `===`, never `==`. 16. Await or handle every promise. 17. No `@ts-ignore`. 18. No console.log. Use the logger. ## Formatting 19. Two-space indent. 20. Single quotes. 21. Trailing commas everywhere. 22. Max line length 100. 23. Always use semicolons. 24. LF line endings. ## Files 25. Never edit src/gen/. Run `pnpm codegen`. 26. Never edit a migration that is already committed. 27. Every migration gets a down step, or a reason why not. ## Git 28. Never push to main. 29. Never force-push. 30. Never use --no-verify. 31. Conventional Commits for every message. 32. Run lint before every commit. ## Done means 33. Run `pnpm typecheck` before you say you're done. 34. Run `pnpm lint` before you say you're done. 35. Run the tests before you say you're done. ## Style 36. Prefer named exports. 37. If a test fails, fix the code, not the test. 38. Match the error handling of the module you're in. 39. One concern per PR. Say so when a change grows. 40. Money is integer cents. Never floats. My count: 32 of those 40 lines are checks. Eight are judgment. Where the 32 rules went Rules Moved to 1, 2 preinstall: npx only-allow pnpm, a Claude Code deny rule, a Codex rule 3 Claude Code ask rule Bash(pnpm add *) 4 Claude Code deny rules for pnpm update and pnpm up 5 CI: pnpm install --frozen-lockfile 6 Claude Code deny rules Read(./.env), Read(./.env.*) 7–10 ESLint no-restricted-imports 13, 16, 17 typescript-eslint no-explicit-any, no-floating-promises, ban-ts-comment 14 Claude Code ask rule on tsconfig*.json 15, 18 ESLint eqeqeq, no-console 19–24 Prettier config, prettier --check 25 Claude Code deny rule Edit(/src/gen/**) 26 CI: fail if git diff shows a modified migration 28, 29 GitHub branch protection, ask rule on git push 30 Claude Code deny rule on --no-verify 31 commit-msg hook: commitlint --edit $1 32 pre-commit hook running pnpm lint 33–35 Claude Code Stop hook, required CI check The architecture rules become one object in your flat config. ESLint's no-restricted-imports takes gitignore-style group patterns and a message, and the message is what the agent reads when the rule fires: { files: ["src/domain/**/*.ts"], rules: { "no-restricted-imports": ["error", { patterns: [ group: ["@acme/db", "@acme/db/*", "express", "@acme/http", "@acme/http/*"], message: "src/domain/ stays free of I/O. " + "Add a port here, an adapter in src/infra/.", }, group: ["@acme/*/src/**"], message: "Import the package entry point.", ], }], no-explicit-any is in typescript-eslint's recommended config. no-floating-promises needs typed linting and comes with recommended-type-checked. In Go, depguard in golangci-lint does the import job. The package-manager rule gets three locks. The pnpm docs give the preinstall script, which makes npm install and yarn fail for humans. For agents, a deny rule in .claude/settings.json, plus the rest of the agent-side rules: pnpm check is a script that runs pnpm lint && pnpm typecheck, and pnpm lint runs ESLint and Prettier with --check. The Stop hook follows the docs' own typecheck example: exit code 2 blocks the stop, and stderr goes back to Claude as the reason it can't finish yet, up to a block limit. The hook leaves the test suite out to stay fast. CI runs the tests. In the permissions docs, a /path pattern in project settings is relative to the working directory, and a trailing * also matches the bare command, so Bash(npm *) catches npm alone too. git commit -n needs its own rules; my lefthook post has them. Codex gets its own copy, in a .rules file under /.codex/rules/. The Codex rules docs mark rules as experimental and load project rules only when the project's .codex/ layer is trusted: # .codex/rules/repo.rules prefix_rule( pattern = ["npm"], decision = "forbidden", justification = "This repo uses pnpm. Run pnpm install.", ) Test it with codex execpolicy check --pretty --rules .codex/rules/repo.rules -- npm install before you rely on it. The rest belongs to CI, where it binds everyone. pnpm's --frozen-lockfile fails the install when the lockfile is out of sync, and it's on by default in CI. GitHub blocks force pushes on protected branches by default. The migration rule is a few lines, with origin/main fetched: pnpm install --frozen-lockfile pnpm check pnpm test changed=$(git diff --name-only --diff-filter=M \ origin/main...HEAD -- db/migrations/) if [ -n "$changed" ]; then echo "Committed migrations were edited: $changed" >&2 exit 1 fi Commit messages get commitlint in a commit-msg hook, with commitlint --edit $1 as the command. Read the edges before you trust the agent-side half. The best practices page says rules "match tool calls, not intent": a Read deny catches cat .env, but "it won't catch a script that opens the file." That's why the rules that matter most also have a copy in a linter, a git hook or CI. The 9 lines that stay 1. Check your work with `pnpm check` and `pnpm test`. If a check or hook blocks you, fix the cause. Never disable the rule; if it looks wrong, say so. 2. Business rules live in src/domain/, free of I/O. 3. Ask before changing exports of packages/api-client. 4. Every migration gets a down step, or a reason why not. 5. Prefer named exports, unless a framework needs a default. 6. If a test fails, fix the code, not the test. If the test is wrong, change it and say why. 7. Match the error handling of the module you're in. 8. One concern per PR. Say so when a change grows. 9. Money is integer cents. Never floats. Line 1 replaces rules 33 to 35, and it's the line the docs value most: when your repo has a check, "the single most useful line in your CLAUDE.md is the command that runs it." It also covers the gap a linter leaves open, an agent adding an eslint-disable comment to get past a red line. Line 5 is where this take bends. A linter can ban default exports. The best practices page still keeps Prefer named exports in the file, because it "has plenty" of exceptions and a hook is for a rule with zero of them. So the test has two parts: can a tool check it, and is a failure always a bug. Lines 2 to 9 are context and judgment, where a tool would be wrong some of the time. The docs also warn about the opposite mistake: "If you ever find yourself at forty of them, most are probably preferences that Claude could have weighed on its own." That's about hooks and deny rules. Look at the table again. Most of the 32 went to ESLint, Prettier and CI, tools your repo runs for humans anyway, so the agent-only set stays at one hook and eleven permission rules. Several agents, one set of gates I build Hermes IDE, so weigh this section with that in mind. The split matters more once you run more than one agent. Hermes runs Claude Code, Codex, Antigravity CLI, GitHub Copilot CLI, OpenCode and others side by side, each in its own real terminal and its own hermes/ worktree (per-repo setup). Codex reads AGENTS.md natively and Claude Code reads it when there's no CLAUDE.md, so it's the instruction file you can share. The agent-side gates are not shared: .claude/settings.json binds Claude Code, and .codex/rules/ binds Codex. Hermes 2.3.4: Codex and Claude Code in split panes, each in its own hermes/ worktree, with status, context use, cost and branch in the sidebar. The gates that hold for every agent are the ones in the repo: ESLint, Prettier, the git hooks and CI. Each agent runs in a real terminal, so its git commit meets the same hooks yours does. Hermes adds two things around that. Your own checks can decide when a task is done before you land it. And since 2.3.4 a context meter shows how full each conversation is and offers Compact when it gets close, so you can see compaction coming. Hermes 2.3.4: a Claude Code session after pressing the Context chip, with Claude Code's /context breakdown (44.4k of 1M tokens, 4%), the per-session context gauges in the sidebar, and the token total and estimated cost. Hermes is free to download, source-available under BSL 1.1, and runs on macOS, Windows and Linux. It isn't affiliated with Nous Research, Anthropic, OpenAI or any agent vendor. Open your own AGENTS.md and count. How many of your lines would a tool check better than the model? Tell me your ratio in the comments. If this was useful The 9 lines that stay are a prompt, so write them like one: specific, short, with the reason attached. The Prompt Engineering Pocket Guide is my short book on that, from instruction placement to the structure that keeps a model on task. It's one of 8 short books in Pocket Guides for Developers, covering agents, RAG, prompts, observability, events, databases and system design: the whole series is here. If you run several agents on one repo, Hermes IDE puts them side by side, each on its own branch. It's built in the open on GitHub.
Source: Dev Community
Shares of QTREX Quantum Ltd. (NASDAQ:QTEX – Get Free Report) dropped 9.8% during trading on Wednesday. The company traded as low as $1.01 and last traded at $1.01. Approximately 3,134,224 shares changed hands during mid-day trading, a decline of 62% from the average daily volume of 8,220,546 shares. The stock had previously closed at $1.12. […]
Source: Markets Daily
Shares of iShares MSCI EAFE ETF (NYSEARCA:EFA – Get Free Report) crossed above its 200-day moving average during trading on Wednesday. The stock has a 200-day moving average of $103.29 and traded as high as $105.80. iShares MSCI EAFE ETF shares last traded at $105.72, with a volume of 15,320,965 shares. iShares MSCI EAFE ETF […]
Source: Watch List News
Ryerson Holding evp Andrew Greiff sells $96,300 in common stock
Source: Investing Us
Futurewave Acquisition Corporation (NASDAQ:FWAC – Get Free Report)’s share price traded up 0.2% during trading on Wednesday. The company traded as high as $9.98 and last traded at $9.98. 26,238 shares changed hands during mid-day trading, a decline of 72% from the average session volume of 94,518 shares. The stock had previously closed at $9.96. […]
Source: Ticker Report
Shares of JPMorgan Fundamental Data Science Large Core ETF (NASDAQ:LCDS – Get Free Report) were up 1.7% during mid-day trading on Wednesday. The company traded as high as $74.01 and last traded at $74.1890. 11 shares traded hands during mid-day trading, a decline of 97% from the average session volume of 390 shares. The stock […]
Source: Markets Daily
Godzilla Minus One introduces an all-new iteration of the titular titan, and here is how big Godzilla is compared to other Godzilla movies.
Source: Screenrant
Marvel unveils its new Sentinel design, and it's the stuff of nightmares for the next generation of X-Men, who may not be prepared to fight them.
Source: Screenrant
Chang Chen, chair of the Taipei Golden Horse Film Festival Executive Committee and last year’s Golden Horse best leading actor winner for “Lucky Lu,” advised six of Taiwan’s rising performers on working across different film sets at a Taiwan Creative Content Fest (TCCF) showcase in Taipei. The “TCCF x The Golden Horse Awards: Taiwan Emerging […]
Source: Variety
Passage by Passport On Tuesday, as Americans voted in the midterms, an Iranian lawmaker announced that ships from India, China, Iraq and Qatar would be exempt from Hormuz transit restrictions. Indian and Chinese ships would pay a fee, and everyone else would stay at risk. That same week, a tanker of Russian diesel was sailing […] The post The Empty Buffer: Why the World’s Oil Safety Net Was Built for the Wrong War appeared first on Modern Diplomacy.
Source: Modern Diplomacy
BLUE BELL, PA — Unisys Corp. (NYSE: UIS) has helped Cushman & Wakefield achieve more than $35 million in savings over five years through a cloud migration and artificial intelligence-powered …
Source: Mychesco