Flutter can finally call native APIs directly, while Claude Code settings files leak secrets on GitHub

Spend 1% of your day keeping up with tech.

Quote of the Day#

“Direct native interoperability skips platform-channel serialization to call native APIs directly through FFI and JNI.” — The Flutter team, Flutter 3.50 release post (source)

“To be honest, I don’t want to create another middleman.” — Scott Kirby, CEO of United Airlines (source)

Today’s Theme#

The first thing I opened this morning was the new Flutter release post. The part I’ve waited longest for is native interop. Calling an iOS or Android API used to mean writing a platform channel and serializing data across it. Now FFIgen and JNIgen are stable, so you call native APIs directly, synchronously, and even from a background isolate.

Another change I’ll feel right away is on iOS: the team says touch latency drops by a full frame. In apps where people scroll and tap all the time, like fitness or finance apps, users can’t name the difference, but their fingers notice it.

The same post also has work to schedule. Material and Cupertino widgets move into their own packages and the old import is deprecated. CocoaPods trunk goes read-only in December, and projects that haven’t moved to Swift Package Manager now get a warning on every command. Today I’ll run the official migration command on a small project first, and only touch production apps once that looks clean.

On the AI side, Google launched an API that answers with probabilities and never generates text. A lot of my features only need the model to say yes or no, or pick one option, and for those this cuts both latency and the bill.

The Claude Code story worried me most. Click “don’t ask again” and the full command gets written into a settings file inside the project, and if that command carries a key, one push makes it public. Today I’m adding that file to gitignore in every repo and scanning the history.

Must Read#

1. Flutter 3.50 ships: native interop goes stable and iOS touch latency drops by a full frame #

long read · Flutter · official Flutter blog

Why it matters to you: This release touches the imports you write every day, how iOS builds work and the Android defaults, so read the whole post before you upgrade.

Summary: Emma Twersky’s release post says 188 people contributed, 69 for the first time, across more than 1,200 commits. The biggest change is direct native interop: FFIgen for Objective-C and JNIgen for Java and Kotlin are now stable, support synchronous calls and work from background isolates, while Pigeon native interop is in preview. material_ui and cupertino_ui become the default for new projects and package:flutter/material.dart is deprecated; migrate with dart fix --apply --code=migrate_design_widgets. Better iOS touch scheduling cuts input latency by one frame, 16ms at 60Hz and 8ms at 120Hz. On the web, Wasm frame rates more than double in Safari 26.2+ and Firefox 147+, opt-in through wasmAllowList, and WebParagraph shrinks CanvasKit from 5.46MB to 3.75MB. New Android projects default to AGP 9.3.1, Gradle 9.5.0, compileSdk and targetSdk 36 and minSdk 24, and release builds now ignore the route, dart_entrypoint and cached_engine_id Intent extras.

Takeaway 1: CocoaPods trunk goes read-only in December 2026 and projects with Swift Package Manager disabled now get a warning on every command; Intel Macs get a warning too, and flutter config --enable-macos-arm64-only builds Apple Silicon-only macOS apps
Takeaway 2: The team now ships agent plugins and package skills you fetch with dart run skills@ get, plus skills_lint; Genkit Dart 1.0 and a MediaPipe package with 20 tasks launch alongside, and Google Play now has more than 1 million Flutter apps

Community: FlutterDev’s launch post on X had about 161 likes and 8,800 views.

Why I care: I’ll run the Material migration and the SPM switch on a small project first and make sure CI passes before upgrading production apps; anywhere Android passes a route through Intent extras has to change first.

2. Dart 3.14 adds dart migrate, and DartPad now runs the compiler in your browser #

medium read · Dart · official Dart blog

Why it matters to you: Upgrading your SDK version finally has an official tool that walks you through it step by step, and pub uses less bandwidth.

Summary: Connie Ooi’s release post introduces dart migrate, with --dry-run, --apply, --step and --target-sdk, for packages on Dart 3.0 and later. pub now uses ETag caching, which saved about 1.5MB on a test project with 144 dependencies. The DartPad beta runs the compiler and analyzer in the browser as Wasm, can pull pub.dev packages and supports multiple files. Wasm gains try_table, standalone Wasm for Wasmtime, and SIMD speedups of up to 4x from more than 60 contributions by Modestas Valauskas; the core libraries add rangeEquals, and language changes now go through an RFC process.

Takeaway 1: dart migrate --dry-run shows what would change, and --step upgrades one version at a time
Takeaway 2: The new DartPad can import pub.dev packages, so teaching or reproducing a bug no longer needs a full project

Community: dart_lang’s launch post on X had about 111 likes.

Why I care: I have a few internal packages stuck on an old SDK lower bound; I’ll look at the dry-run diff and move them up one step at a time.

3. Google launches the Gemini Decisions API: probabilities instead of text, at $0.10 per million tokens #

medium read · AI APIs · Google blog

Why it matters to you: Anywhere your app asks “yes or no” or “which one”, you no longer need a big model to write text you then parse.

Summary: The new model is gemini-decision-1. One call can ask up to 1,000 questions about a single multimodal input of up to 256K tokens, using yes/no, multiple choice (2 to 255 options) or score questions, and it returns calibrated probabilities. Google says end-to-end latency is about 150 to 250 milliseconds and the price is $0.10 per million input tokens with no output charge, nearly 5x cheaper than 3.5 Flash-Lite. Google already uses it for routing in Gemini Notebook (up to 40% lower latency), Stitch, emoji selection and a safety layer for Search MCP. The AI Studio docs say output token usage is always 0, so your code can branch, sort and route on the result directly.

Takeaway 1: Simon Willison points out that the API is nearly identical to Jev’s and priced the same as GPT-6 Luna’s decision model; in his video test the question scored 0.92
Takeaway 2: Vercel AI Gateway carried gemini-decision-1 on day one (see More to Read, item 1)

Why I care: I’ll run content classification and the should-we-notify check in my app through it in the background for a week and compare with what I use now.

4. Claude Code settings files expose thousands of secrets on GitHub #

medium read · security · Ars Technica

Why it matters to you: If you ever clicked “don’t ask again” in Claude Code, your project may hold a file with a secret in it, waiting to be pushed.

Summary: Security firm Apiiro found that choosing “Yes, and don’t ask again” in Claude Code writes the full command into .claude/settings.local.json, and if that command carried a token or password, the secret lands in the file. More than 100,000 of these files are public on GitHub; about 1,100 of them, from 63 organizations, contain secrets, and 215 of those were missed by both gitleaks and TruffleHog. The issue was first reported in August 2025, and those reports were closed automatically after 60 days. Claude Code’s Boris Cherny says the team is looking into how to prevent it and recommends auto mode plus a secret scanner.

Takeaway 1: The file is .claude/settings.local.json; adding it to .gitignore is the fastest fix
Takeaway 2: Cherny says auto mode uses classifiers to handle routine permission prompts so you don’t maintain allow lists by hand, and called the gap a “good catch”

Community: sspai’s morning brief also listed it among the day’s top stories.

Why I care: Every repo of mine gets the gitignore entry today, then I scan the git history and rotate any key that shows up.

5. AWS releases AWS Emulator, an official local emulator that needs no account #

short read · cloud · GitHub/Hacker News

Why it matters to you: When your backend or agent needs AWS, it can run locally first, with no bill and no risk to production.

Summary: AWS’s open-source emulator is written in Rust under CC0-1.0, runs locally and needs no AWS account. macOS and Windows run it through Docker, and Rust tests can use an embedded mode. There’s an agent skill too, installed with aws agent-toolkit add-skill --skill-name aws-emulator, which needs AWS CLI 2.35.0 or later. Telemetry is on by default; turn it off with --telemetry off or EMULATOR_TELEMETRY=off. The HN thread had about 510 points and 178 comments, and the repo has about 1,272 stars.

Takeaway 1: Simon Willison noticed 29,684 commits in the first three weeks, written by a swarm of agents
Takeaway 2: Telemetry is on by default, so set EMULATOR_TELEMETRY=off before putting it in CI

Why I care: I mostly use Firebase and GCP, but an official emulator plus an agent skill is exactly how agents should touch the cloud safely.

6. Anthropic updates its supported regions policy: where you are, where your company is registered, and who owns it #

short read · AI policy · Anthropic/INSIDE

Why it matters to you: If your team or clients span countries, whether you can use Claude no longer depends only on where you connect from.

Summary: Anthropic’s supported regions page lists three tests: where the user physically is, where the company is incorporated or headquartered, and who holds majority ownership or control. Taiwan and Japan are supported; China, Hong Kong, Macau and Russia are not on the list. INSIDE’s write-up says the policy takes effect November 12 and notes that Anthropic hasn’t said how it will be enforced.

Takeaway 1: The majority ownership or control test affects Taiwan teams whose parent company is outside the supported list
Takeaway 2: Anthropic’s own page doesn’t state an effective date; November 12 comes from INSIDE

Why I care: I keep model providers switchable in my apps, so if one becomes unavailable, it’s a one-line config change.

7. 48 AI agents found a Maya site in lidar data, and it turned out to be a rediscovery #

medium read · AI agents · personal blog/Hacker News

Why it matters to you: It’s a full example of agents working through a big dataset in parallel with a human checking the result, including where they missed the literature.

Summary: While traveling in Peru, Pietro Miotti wondered what an explorer from a century ago would do with today’s tools. He had agents find public NASA lidar data, turn about 1,200 km² of jungle into images, and send 48 agents through them one by one looking for pyramids, platforms and plazas while filtering out natural hills, sinkholes and roads. It took under 72 hours from the idea to an official reply from Mexico’s National Institute of Anthropology and History (INAH), which said the site wasn’t in its register. On November 11 he updated the post: the site had already been mapped in Estrada-Belli et al. 2025, and the agents missed it in the literature, so it was a rediscovery.

Takeaway 1: He translated the report into Spanish before sending it, because Claude suggested that would improve the odds of a reply
Takeaway 2: The author says up front that he isn’t an archaeologist, and the correction sits at the top of the post

Community: The HN thread had about 889 points and 320 comments; the top comment linked an earlier record of the site, and others said they’d wait for an archaeologist to verify it.

Why I care: Agents search fast, but checking whether someone already did it still needs a human, and that’s true for my own research too.

8. EU proposes the Digital Fairness Act: easier cancellations, plus reminders before renewals and trial ends #

medium read · policy · The Verge

Why it matters to you: Apps with subscriptions, free trials or virtual currency may have to change their payment flows in the EU.

Summary: The European Commission published its Digital Fairness Act proposal on Wednesday, aiming to make online shopping fairer. It bans manipulative marketing and dark patterns such as fake “almost sold out” claims; lets users turn off addictive features like endless scrolling and autoplay, with the limits also covering AI companions and general chatbots; bans gambling-like features such as pay-to-win for minors; and requires easier cancellation of subscriptions and digital contracts, with reminders before automatic renewals and the end of free trials. The Commission expects it to save EU consumers up to €13.7 billion a year, and fines can reach 6% of worldwide annual turnover. It is still a proposal.

Takeaway 1: Renewal and trial-end reminders directly affect how paywalls and subscription flows are designed
Takeaway 2: A games industry group already called the virtual currency and loot box limits “unworkable, unjustified and disproportionate”

Why I care: My apps have subscriptions and trials, so I’ll treat reminders and one-tap cancellation as product requirements now rather than wait for the law.

9. United won’t let your AI agent book your flight #

short read · AI agents · The Verge

Why it matters to you: If the agent you’re building places orders for users, the other side’s site may simply block it.

Summary: Citing The Wall Street Journal, The Verge reports that United won’t let personal AI assistants complete bookings for customers, citing privacy and regulation. Agents can still show United flights but can’t finish the purchase. United worries agents could expose customer data or buy things people didn’t mean to, and could skirt federal rules such as having passengers personally attest that their bags hold no explosives. eBay and several banks have similar limits.

Takeaway 1: CEO Scott Kirby said, “To be honest, I don’t want to create another middleman.”
Takeaway 2: CBS also reported the decision

Why I care: If agents can look but not buy, the last step still has to send the user back to the original app or site.

10. OpenAI’s Codex workshop: a rebuilt cloud version and steering agents by voice #

long read · AI coding · Latent Space

Why it matters to you: If switching between cloud and local agents confuses you too, this has OpenAI’s own take.

Summary: Day one of AI Engineer Code Summit included OpenAI’s workshop “New Ways of Working with Codex”, hosted by Developer Experience engineers Dominik Kundel and Charlie Guo. Kundel admitted Codex’s cloud experience has long been awkward, and that Codex Cloud v2 from DevDay in September made it more usable: publish an environment once, run many tasks in isolated instances, and share environments within a company. His own habit is to start locally and then ask Codex to hand the work off to the cloud. The workshop also covered voice mode and dots, OpenAI’s personal agent.

Takeaway 1: Kundel’s closing tips included “turn it down”, meaning lower the effort level, and “ask your agents for help”
Takeaway 2: The piece describes dots as “a delegation sink” in the workflow

Why I care: I hand work between local and cloud agents too, and I’ll try the lower-effort tip on everyday small changes first.

11. Claude Code plus Obsidian as a family’s shared AI brain #

podcast · AI in practice · How I AI

Why it matters to you: Using a folder of Markdown files as an agent’s long-term memory is a setup almost anyone can copy.

Summary: On this episode of How I AI with Claire Vo, math educator Scott Farrar shows the household knowledge base he built in Claude Code: a folder of Markdown files viewed in Obsidian that tracks appliances, warranties, insurance documents and the family to-do list. He uses it to shop for car insurance, plan repairs and share the system with his wife, and he puts priority tasks and recent wins on a DAKboard wall display. He moved home life into Claude Code because AI chats kept drifting and forgetting.

Takeaway 1: The episode covers which things Claude told him to photograph first to seed the knowledge base
Takeaway 2: The wall display has a dedicated recent wins section

Why I care: It’s close to how I sync work and notes into my brain repo, except he shares it with his wife.

12. How a false smoke alarm almost drowned Jane Street’s only NYC datacenter #

long read · operations · personal blog/Lobsters

Why it matters to you: A very readable incident story whose final fix is surprisingly simple, worth reading against your own monitoring.

Summary: Michael Bacarella, formerly on Jane Street’s systems team, tells how dust from contractors set off a smoke alarm, the cooling shut off, and the machine room started heating up. The ceiling sprinklers were heat-triggered, so he had to pull the power on every device before the room passed 150°F and the sprinklers went off; the temperature monitor reached 143. Afterward he wrote an OCaml monitor that asks every server for its onboard sensor temperature each minute, averages them, and alerts the whole systems team if the average runs high.

Takeaway 1: The Hong Kong team only caught a similar problem because someone happened to see server after server showing a climbing temperature
Takeaway 2: His takeaway: sometimes the most reliable thing is to ask your whole fleet for its temperature and alert when the average is a little high

Community: About 35 points on Lobsters.

Why I care: My backend also has monitoring that relies on a single signal, and this reminds me to add a dumb but reliable fleet-average check.

Also Worth a Look#

Plurai wants to help AI agents work better using the same approach that helped get self-driving cars to roads - TechCrunch (borrowing a self-driving approach for AI agents)
Meta is losing its longtime head of infrastructure - TechCrunch (Meta’s longtime infrastructure chief is leaving)
Tim Peters has died - Python Discourse (Guido’s tribute to the author of the Zen of Python)
AlphaGenome 2: Deciphering how cells read DNA to better understand disease - Google DeepMind (the second-generation model for how cells read DNA)
Try Tabletop: Customizable, collaborative spaces for groups to plan, play and do more together - Google Labs (Google’s AI experiment for group planning)
Siri co-founder backs Helix for its voice ID tech - TechCrunch (a Siri co-founder backs a voice ID startup)
Hyper-Realistic Sand with WebGL2 - Hacker News (very realistic sand in WebGL2)
Faster Retrieval for Better, More Efficient RAG - Apple ML Research (Apple research on faster RAG retrieval)
CoreWeave turns to customer prepayments, shorter contracts to fund AI growth - TechCrunch (CoreWeave leans on prepayments and shorter contracts)
With $720M round, Britain’s Fractile gets a leg up in the race for AI chips - TechCrunch (a UK AI chip startup raises $720M)
I asked every TV manufacturer 17 questions about how they spy on you - The Verge (how TV makers collect your viewing data)
Hands on with Home Assistant’s new ‘smart home multi-tool’ - The Verge (hands-on with new Home Assistant hardware)
Gemini Robotics 2.5 accelerates real-world general dexterity - Google DeepMind (an update on robot dexterity)
Can a Linear Program Do Weight-Space Programming? - Hacker News (an experiment in programming model weights with a linear program)
Congress to call Jensen Huang in to answer for alleged Chinese spy affair - TechCrunch (Congress wants Jensen Huang to testify)
Why the data center you dread might never even be built - TechCrunch (why many planned data centers may never be built)
Browse tools.simonwillison.net by tag - Simon Willison (244 vibe-coded tools, now browsable by tag)

Builder Radar#

The Android Developers blog says Unity games used to rely on deprecated sample bridges for Google sign-in, which struggled with modern Gradle pipelines and AndroidX. The new Sign in with Google Mobile Plugin for Unity is open source on GitHub and built for current engine and build requirements. Google’s reasoning: Unity powers over half of all mobile games, and the first sign-in shapes day-one retention.

What it means for your app: Flutter developers won’t use this plugin, but it shows Google replacing old sign-in bridges with maintained ones, so check whether the sign-in package in your app is still maintained.

2. Firebase AI Logic now offers Gemini 4 Carbon through client-side SDKs #

Firebase said on X that developers on the paid tier of the Gemini Developer and Gemini Enterprise APIs can use Gemini 4 Carbon through Firebase AI Logic as of the day before, integrating it into mobile and web apps with client-side SDKs. The post had about 11 likes.

What it means for your app: If your Flutter app already uses Firebase AI Logic, switching models is just a model name change; Carbon costs more, so save it for the few features that need deep reasoning.

3. GitHub Actions now supports workflow lockfiles #

Hugo van Kemenade walks through locking GitHub Actions with a lockfile. The old advice was to pin actions to a full commit SHA because tags can be repointed at malicious code; now you install the extension with gh extension install github/gh-actions-lock and generate a lockfile.

What it means for your app: Flutter CI usually pulls in several third-party actions, and the ones that sign builds and upload to the stores are the first to lock.

4. Cursor Projects goes multiplayer, so your agents can coordinate with your teammates’ agents #

Cursor announced on X that Projects has been rebuilt for multiplayer: every teammate and their agents work together in one workspace, and your agents can coordinate with your teammates’ agents. The post had about 3,864 likes and 520,000 views.

What it means for your app: When a small team has several agents changing the same app, assigning work and avoiding conflicts becomes its own job, so try it on one small feature first.

5. The EU draft wants easier cancellations and reminders before renewals and trial ends #

In the Digital Fairness Act draft from must-read 8, the part closest to app developers is the subscription rules: digital contracts must be easier to cancel, users must be reminded before automatic renewals and free trial ends, and pay-to-win features are off limits for minors. Fines can reach 6% of worldwide annual turnover; it’s still a draft.

What it means for your app: Subscription apps with EU users can build trial-end reminders and an in-app cancel path now, which also cuts refunds and bad reviews.

6. Atuin Threads turns agent sessions on every machine into searchable, synced history #

Atuin started as a tool for syncing shell history. Its author says more than half the commands on his machines are now run by agents, but agent sessions are scattered across tools and machines and hard to find again. Threads makes them searchable history synced across machines: start a task in Claude Code on one machine, pick it up in Codex on another, and atuin resume brings the full context along.

What it means for your app: If you use Cursor, Claude Code and Codex at once, the usual problem is forgetting which task is half done where, and this saves digging through logs; check what it syncs before installing.

What the Community Is Arguing About#

1. How many of the vulnerabilities Anthropic found actually got fixed?#

VulnCheck has tracked Anthropic’s Project Glasswing for seven months and counts 442 CVEs attributable to Anthropic, about 0.5% of all CVEs this year, with only two confirmed exploited. Of Anthropic’s 37,966 reported findings, only 19.4% are public and 217 are marked fixed; curl rejected 19 of 34 published reports. The HN thread had about 445 points and 216 comments. The top comment, from the author of Fil-C, says all nine reports he got were real bugs; an engineer at a big company says he has patched serious issues every day since Mythos launched, all in private codebases that public data never shows. The argument is whether public CVE counts reflect what AI vulnerability hunting really finds.

2. What does constant location tracking do to kids and parents?#

An Atlantic piece on parents tracking kids with location apps drew about 267 points and 303 comments on HN. Some parents describe deliberately keeping kids off social media and tracking watches; others warn that once kids notice the tracking, the easy answer is to leave the phone behind, so they can’t call for help when it matters. Others say these products market on parental guilt. The argument is whether tracking makes kids safer or takes away their chance to learn to handle problems alone.

3. How do you actually self-host securely?#

A newcomer with a fresh Raspberry Pi asked on Lobsters, saying search results were either SEO slop or sales pitches; the thread reached about 86 points and 49 comments. Top replies suggest starting with services that aren’t public, installing Tailscale on your phone, laptop and Pi; others say regular updates, no SSH password logins and a non-default port stop most automated attacks. Tailscale came up so often that someone started counting. The argument is whether to expose services publicly at all or keep everything behind a private network.

4. What are some “No AI” apps and companies?#

Someone on Lobsters asked for lists of apps, companies and resources that avoid AI; the thread reached about 62 points and 25 comments. The most upvoted reply links Codeberg’s AI-free FOSS Alternatives list, though others note its top section is “Tainted Software”, making it read more like a blocklist; an employee of the Spritely Institute says it’s a nonprofit with a firm no-gen-AI policy. The argument is whether such lists should recommend good alternatives or catalog what to avoid.

Chinese Tech Scene#

1. Google launches Gemini for healthcare, connecting to Epic and Oracle health records with agents for visits and insurance review #

(iThome): Google launched Gemini for healthcare, which connects to Epic and Oracle health record systems and uses agents to help with visits and insurance review.

2. Security daily, Nov 11: attackers used stolen Qubole credentials to break into dozens of companies’ AWS environments #

(iThome): Attackers used stolen credentials from the Qubole big data platform to get into dozens of companies’ AWS environments, another case of leaked third-party platform credentials.

3. Hi-Lai Foods’ outsourced online store has a security incident exposing some order data #

(iThome): Hi-Lai Foods’ outsourced online store had a security incident in which some customers’ order data was accessed; the same day, HeySong’s online store reported its vendor’s database was accessed too.

4. Are agents ending the pull request? Even GitHub is rethinking the traditional workflow #

(InfoQ 中文): InfoQ looks at whether the pull request still works as a review process once agents generate most of the code, with GitHub rethinking it too.

5. Engineering hiring falls to half its peak as Manus drops traditional coding interviews and PMs start writing code #

(InfoQ 中文): Engineering hiring is at half its peak, Manus has dropped traditional coding interviews, and product managers are starting to write code themselves.

6. Cloudflare launches a Web Search API for AI applications #

(InfoQ 中文): Cloudflare launched a Web Search API for AI applications, one more option for agents that need to search the web.

7. Claude Fable 5.2 is 20% cheaper per token, but reasoning settings swing per-task cost by nearly 6x #

(TechOrange 科技報橘): Fable 5.2 is 20% cheaper per token, but depending on reasoning settings the same coding task can cost nearly 6x more, which lines up with item 5 in More to Read.

8. n8n Labs launches Nod, an open-source personal agent that runs a browser on your computer #

(INSIDE): n8n Labs released Nod as a research preview on November 10. It runs a browser in a sandbox on Mac or Windows to handle tasks, is Apache 2.0 licensed, needs no n8n account, keeps data and memory on your machine, and you pay the model provider directly.

9. NCHC expands model fine-tuning in TAIWAN AI RAP as part of its sovereign AI push #

(iThome): Taiwan’s National Center for High-performance Computing is adding model fine-tuning to its TAIWAN AI RAP platform as part of its sovereign AI plans, aiming to get AI applications deployed faster.

10. Context is a cost too: new ideas for making agents more efficient #

(InfoQ 中文): InfoQ treats the context an agent consumes as a cost and discusses how to make agents more efficient from there.

11. Datadog launches a dedicated AI model for SRE troubleshooting #

(InfoQ 中文): Datadog launched an AI model built specifically for SRE troubleshooting.

12. Gemini Robotics 2.5 on a Mercedes line: humanoid robots pick parts with a 96% proof-of-concept success rate #

(TechOrange 科技報橘): Gemini Robotics 2.5 went onto a Mercedes production line, with humanoid robots picking parts on their own at a 96% success rate in the proof of concept.

13. AI budgets keep growing while ROI stays unclear, and 38% of respondents have delayed, cut or canceled projects over overruns #

(TechOrange 科技報橘): Companies keep raising AI budgets without clear returns, and 38% of respondents have delayed, scaled back or canceled projects because of overruns.

14. OpenMausBot, an open-source Grok Bot alternative that runs on your own Claude and Codex subscriptions #

(INSIDE): OpenMausBot is an open-source AI bot that lets you plug in your own Claude and Codex subscriptions.

Open Source Picks#

Today’s trending list has two tools about working with agents: a meeting notes app that needs no bot in the call, and a drawing app you share with an agent. The other three are deep-tech projects on quantization, assembly and game recompilation. Star counts are checked against the GitHub API today.

1. FrigadeHQ/yogurt #

TypeScript | 331 stars

Free, open-source AI meeting notes that record calls without adding a bot to the meeting, on Mac, Windows and Linux, MIT licensed; it records your calls, so check your company’s rules before using it for work meetings.

2. klad-app/klad #

Rust | 113 stars

A 2D painting and animation app you share with a coding agent: you draw with a pen, the agent paints through the klad CLI with the same brushes on the same canvas, there’s no image model, and every stroke stays editable. The license shows as NOASSERTION, so check it before commercial use.

3. huawei-csl/MACaQ #

C++ | 68 stars

A model quantization tool from a Huawei team that outputs GGUF and covers text, image, video and audio models, working with llama.cpp, vLLM, Diffusers and PyTorch, Apache-2.0.

4. 0xdeadf1sh/AssemblyForNeovim #

Lua | 172 stars

A small Lua script that shows inline x64 or aarch64 assembly for C, C++ and Rust inside Neovim, under the Unlicense.

5. adrbn/bo2-mac #

C++ | 187 stars

Call of Duty: Black Ops II statically recompiled from 32-bit x86 Windows to native ARM64 macOS, using Remill to LLVM IR and Metal to draw Direct3D 11, with no Wine and no game files in the repo, GPL-3.0.

Watch & Listen#

1. Greg Isenberg: Use Grok Bot better than 99% of people #

Channel: Greg Isenberg

Greg Isenberg

Why it matters to you: Ras Mic shows how he has one bot orchestrate and hands the coding to Claude Code, a good companion to OpenAI’s local-to-cloud handoff in must-read 10.

Takeaway 1: Give each serious project its own bot and keep one general engineering bot for random ideas
Takeaway 2: Hand the code to Claude Code while the bot handles planning, review and the business side
Takeaway 3: Lock the design system in Paper before writing code so the agent has something to reference

2. Greg Isenberg live: new ChatGPT, Claude whiteboards and Google Carbon #

Channel: Greg Isenberg

Greg Isenberg

Why it matters to you: There was too much news this week, and this stream walks through several launches and talks about which ones could become startup ideas.

Takeaway 1: After a data analysis agent demo, he says it replaces much of the data analyst function
Takeaway 2: He suggests setting up AI tools for local businesses could become a service, like managing Google Business profiles
Takeaway 3: On stream they made a video thumbnail with the new tools in about six minutes

3. 20VC: Mercor’s CEO on spending more on AI than on salaries #

Channel: 20VC

20VC

Why it matters to you: Mercor just closed a new round, and CEO Brendan Foody talks here about the company’s token spend, which you can read alongside item 4 in More to Read.

Takeaway 1: The description says their token spend is now higher than their salary spend
Takeaway 2: Latent Space’s write-up puts inference at 3x salaries
Takeaway 3: Worth asking where the ratio of AI spend to payroll is heading on your own team

Today’s Take#

Flutter 3.50 comes first today. I’ll pick a small project, run the Material migration and switch to Swift Package Manager, make sure CI and store builds pass, and then schedule upgrades for the production apps.

CocoaPods going read-only in December can’t wait. I’ll list every pod my projects use, check which have no SPM version yet, and find replacements for those first.

The Claude Code settings file gets handled today: gitignore in every repo, a scan of git history, and every key that shows up gets rotated.

I’ll use dart migrate from Dart 3.14 on a few internal packages stuck on an old SDK lower bound, starting with a dry run. The new DartPad can import pub.dev packages, so next time I report a bug or teach someone Flutter, I’ll send a DartPad link instead of asking them to clone a whole project.

I’ll run the classification and notification checks in my app through the Decisions API in the background first, and only switch if latency and cost beat what I have.

The EU draft hasn’t passed, but I plan to treat trial-end reminders and in-app cancellation as product requirements now.

Anthropic changed how it decides supported regions, and United won’t let agents book for people, so what an agent can do depends more and more on whether the other side allows it. Model providers stay switchable in config, and the final step of a purchase stays a tap the user makes.