RustNet is a cross-platform, real-time network monitoring terminal UI application. It captures packets via libpcap (or platform-specific backends like PKTAP on macOS, ETW on Windows), performs deep packet inspection (DPI) for protocols including HTTP, HTTPS, DNS, SSH, QUIC, BitTorrent, and many others, and attributes each connection to the owning OS process using eBPF (Linux), lsof (macOS), IP Helper (Windows), or sockstat (FreeBSD). The architecture is a multi-crate Rust workspace: `rustnet-core` provides connection tracking, DPI analyzers, GeoIP/OUI lookup, and rate/RTT tracking; `rustnet-capture` wraps libpcap; `rustnet-host` implements process lookup via a unified `ProcessLookup` trait; `rustnet-sandbox` handles privilege dropping and sandboxing (Landlock, Seatbelt, Windows job objects). The main binary (`rustnet-monitor`) orchestrates capture, enrichment, and a ratatui-based TUI with tabs for Overview, Details, Activity, Graph, and Host. It supports PCAP/PCAPNG export with process metadata, JSONL event logging, Kubernetes pod attribution, and a rich theme system with multiple presets. The codebase is well-structured, extensively tested, and actively maintained with CI/CD for multiple platforms and packaging (DEB, RPM, DMG, MSI, Homebrew, Chocolatey).
Stern is a CLI tool for tailing logs from multiple Kubernetes pods and containers simultaneously. It watches the Kubernetes API for pod changes, streams logs via the kubectl logs API, and applies user-defined filters, templates, and color highlighting. The architecture is a single Go binary with a clean separation between CLI argument parsing (cmd/), core tailing logic (stern/), and Kubernetes client interaction. Key features include regex-based pod/container filtering, custom output templates with JSON parsing and color functions, configurable highlight colors via SGR sequences, and support for stdin log parsing. The codebase is well-structured with comprehensive unit tests and active maintenance.
consul-template is a HashiCorp-maintained daemon that renders filesystem templates using data from Consul, Vault, and Nomad. It watches template files, fetches dependency data via blocking queries or polling, then atomically writes rendered output and optionally executes a command (e.g., restart a service) on changes. The architecture is a single binary CLI with a manager that orchestrates dependency fetching (via a watcher), template execution (with a rich function library), and child process supervision. It supports multiple modes including once, de-duplication across instances, and exec. The code is well-structured with clear separation into packages: config, dependency, template, renderer, child, watch, manager, and logging. Each package implements reusable patterns (e.g., config copy/merge/finalize, dependency interface, atomic file writer, process manager). The tool is heavily tested with integration tests against real Consul/Vault/Nomad instances. It is actively maintained and widely used in production for dynamic configuration generation.
fselect is a Rust command-line tool that enables searching the filesystem using SQL-like queries. It parses a SELECT-FROM-WHERE-GROUP BY-HAVING-ORDER BY-LIMIT syntax, traverses directories, and extracts rich metadata from files including size, timestamps, permissions, media information (EXIF, audio/video dimensions, duration), cryptographic hashes, MIME types, extended attributes, ACLs, git status, and more. The tool supports aggregation functions, subqueries (both FROM-subselects and correlated IN/EXISTS), and multiple output formats (tabular, CSV, JSON, HTML). It can accelerate searches via external indexes (Everything on Windows, plocate on Linux) and includes an interactive REPL mode. The architecture is a single binary with clean separation of concerns: lexer/parser for query processing, a searcher module for filesystem traversal and expression evaluation, utilities for metadata extraction, and pluggable output formatters.
dembrandt is a production-grade design token extraction tool that analyzes live websites via headless Chromium (Playwright) and produces structured outputs including colors, typography, spacing, components, shadows, motion, and gradients. It supports multiple export formats: W3C DTCG tokens, Tailwind CSS v4 themes, DESIGN.md, self-contained HTML reports, PDF brand guides, and terminal display. Beyond extraction, it offers drift detection (comparing extractions over time with a 0–100 score), a GitHub Action for CI gates, and an MCP server for AI agent integration (Claude, Cursor). The architecture is modular with fault-isolated extractors, a pure-function drift engine, and a generic async job queue. While primarily an application, it includes an optional ONNX ML model for brand primary color prediction and advanced color science (OKLab, CIEDE2000, gamut mapping), giving it a hybrid character. The codebase demonstrates strong engineering practices: extensive test coverage, CI/CD pipelines, lazy browser loading, and graceful degradation across all output formatters.
opkssh is a production-grade CLI tool that bridges OpenID Connect (OIDC) authentication with SSH access. It allows users to authenticate via any OIDC provider (Google, Azure, GitLab, Keycloak, etc.) and obtain short-lived SSH certificates embedding OpenPubkey PK tokens. The server-side component, invoked as sshd's AuthorizedKeysCommand, verifies these certificates against policy files and grants access based on email, subject, or group membership. The architecture is a single Go binary with client and server modes, using Cobra for CLI commands. Key entry points include `opkssh login` (interactive OIDC flow, SSH key generation, agent integration), `opkssh verify` (server-side certificate validation and policy enforcement), `opkssh add` (policy management), and `opkssh audit` (configuration validation). External dependencies include the openpubkey library for PK token operations, afero for filesystem abstraction, and testcontainers for integration tests. The tool supports Linux, macOS, and Windows, with platform-specific file permission checks and ACL handling. It also features a policy plugin system for custom access control logic via external scripts.
ggshield is a production-grade CLI tool for detecting hardcoded secrets in code, git history, Docker images, PyPI packages, archives, and AI coding assistant interactions. It integrates with the GitGuardian API to scan for 500+ secret types, supporting both SaaS and self-hosted instances. The tool is designed for developers and CI/CD pipelines, offering git hooks (pre-commit, pre-push, pre-receive), a plugin system for extensibility, and AI agent hooks for Claude Code, Cursor, Copilot, Codex, Vibe, and Kiro. It also includes HMSL (Has My Secret Leaked) for checking secret exposure via cryptographic queries, honeytoken management, and machine-level setup for comprehensive security coverage. The architecture is a hybrid Python/Rust CLI built with Click. The Python codebase is organized into three layers: `cmd` (CLI commands), `core` (shared infrastructure like config, scan, cache, client, UI, plugin system), and `verticals` (domain logic for secret scanning, AI, HMSL, honeytokens). A Rust native component (`ggshield-hook`) handles AI hook scanning for performance, while a Rust dispatcher delegates non-hook commands to the Python launcher. The plugin system supports dynamic command registration with sigstore signature verification. Configuration is YAML-based with versioned schemas and global/local merging. Key entry points include `ggshield/__main__.py` (CLI root), `ggshield/cmd/secret/scan/` (scan subcommands), `ggshield/cmd/auth/login.py` (authentication), `ggshield/cmd/machine/setup.py` (one-shot protection), and `rust/dispatcher/src/main.rs` (Rust binary). External dependencies include the GitGuardian API (py-gitguardian), keyring for credential storage, and platform-specific utilities for notifications and machine ID derivation. The codebase demonstrates strong engineering practices with lazy command loading, output handler strategy pattern, cache abstractions, and comprehensive test coverage (80%+).
glTF-Transform is a comprehensive SDK and CLI tool for processing, optimizing, and inspecting glTF/GLB 3D assets. It provides a rich property graph model (Document) for reading, editing, and writing glTF files, with full support for the glTF 2.0 specification and dozens of official extensions (KHR_materials_*, EXT_meshopt_compression, etc.). The library includes a broad set of transforms (compression, quantization, deduplication, welding, palette optimization, texture compression, etc.) that can be composed into custom pipelines. A command-line interface wraps all transforms for batch processing, and a viewer package provides real-time Three.js integration. Built as a monorepo with packages for core, extensions, functions, CLI, view, and docs, it demonstrates strong software engineering practices: property-graph architecture, extension system, observer patterns, and comprehensive unit/integration tests. Designed for both scripting in Node.js/Deno/Web and direct use from the command line.
NATMap is a command-line tool written in C that establishes TCP/UDP port mappings from an ISP NAT public address to a local private address. It uses STUN protocol to discover the mapped public address and maintain NAT bindings through keep-alive sessions. The architecture is built on a cooperative task-based concurrency model (hev-task-system) for efficient non-blocking I/O. It supports two modes: bind mode, where the tool keeps the port alive and notifies the user via a script, and forward mode, where it listens on the mapped port and forwards traffic to an internal target. The codebase is modular, with clear separation of concerns: configuration parsing, socket creation, STUN protocol handling, NAT session keepers (TCP/UDP), port forwarding servers, and script execution. It is highly portable, with cross-compilation support for Linux, Windows, macOS, FreeBSD, and Android across many architectures.
gh-stack is a GitHub CLI extension for managing stacked pull requests. It allows developers to create a stack of branches, each building on the previous one, and submit them as a chain of PRs. The tool handles rebasing, syncing, pushing, and merging the stack atomically, with both interactive TUI and non-interactive CLI modes. The architecture is a Go CLI built with Cobra, using Bubble Tea for interactive TUI components and lipgloss for styling. Git operations are abstracted behind an interface (internal/git/gitops.go) with mock support for testing. GitHub API integration is handled via go-gh, supporting GraphQL and REST endpoints for PR creation, stack management, and async merge. Local stack state is persisted as a JSON file in the git directory with optimistic concurrency and file locking. Key entry points include main.go calling cmd.Execute(), which registers all subcommands (init, add, submit, sync, rebase, push, merge, checkout, etc.). External dependencies include the GitHub CLI (gh), git, and the GitHub API. The codebase demonstrates strong engineering practices with extensive test coverage, interface-based mocking, and a modular internal package structure.
Lobster is a local-first workflow runtime for AI agents, implemented as a TypeScript CLI and embeddable SDK. It executes deterministic pipelines defined in JSON, YAML, or .lobster files: steps are shell commands or built-in pipeline commands (where, pick, map, sort, groupBy, table, approve, ask, llm.invoke, openclaw.agent, etc.) connected through typed async-iterator data flow rather than text pipes. Pipelines support approval gates, interactive input, parallel branches, for_each loops, retry/timeout policies, on_error handlers, cost limits, and persistent state that can be suspended and resumed via base64url resume tokens. Architecturally it is a modular Node.js application: a core runtime (src/runtime.ts, src/core/tool_runtime.ts) with a command registry, a workflow file loader/executor, an atomic-file state store, an LLM cost-tracking and accounting layer, and a small SDK (src/sdk/index.ts). CLI entry points are bin/lobster.js, bin/openclaw.invoke.js, and bin/clawd.invoke.js. The package also ships GitHub and Gmail recipes that shell out to the gh and gog CLIs, and can delegate agent turns to OpenClaw. External dependencies are limited to those CLIs, the OpenClaw gateway/LLM adapters, and Node.js >= 22. Notable engineering strengths are crash-safe state persistence, idempotent LLM spend accounting, retry/backoff, abortable process-tree cancellation, and extensive tests covering resume, cancellation, concurrency, and billing edge cases. The repository is unambiguously an application; it has no data-research pipelines, notebooks, or analytics assets. It is a well-maintained, thoughtfully structured codebase with several independently reusable Node.js components.
This repository is the canonical source for **OpenClaw Agent Skills**, a collection of portable, reusable agent workflows (skills) for coding agents such as Claude Code, Codex, Pi, and OpenClaw. The primary deliverable is not a standalone application but a set of self-contained skills that provide automated code review (autoreview), redacted session publication (beam), session transcript provenance (agent-transcript), local session viewing (session-viewer), behavior validation (behavior-validator), and remote test orchestration (crabbox). Each skill lives under `skills/<name>/` with a required `SKILL.md` file and auxiliary scripts, tests, and references. The repository also includes cross-platform installer (`scripts/install-skills`) and validator (`scripts/validate-skills`) scripts that support symlink or copy installation into agent skill directories. Architecturally, the skills are independent of each other and are consumed by agents via direct symlink/copy. The most complex skill is `autoreview`, which performs a full AI-driven code review pipeline: capture git diff/commit/working-tree state, build a review prompt with evidence, invoke one of several engines (Codex, Claude, Amp, Pi) via subprocess, parse structured JSON reports, and produce a final review result with security hardening (isolation probes, credential scanning, terminal escape prevention). The `autoreview` script is monolithic (~80k tokens) but contains reusable patterns for safe subprocess environment sanitization, git diff collection, JSON extraction from noisy output, and engine isolation verification. The `session-viewer` skill provides a polished local HTML renderer for agent session JSONL files, with importers for multiple session formats. The `beam` skill focuses on redacted publication of coding sessions to a read-only catalog. The codebase demonstrates high engineering craftsmanship: extensive test coverage (Python unittest, Jest for TypeScript, shell-based harness), security-conscious patterns (symlink validation, stat-preserving writes, process group signal handling, environment sanitization), and cross-platform support (Windows, macOS, Linux via CI). The test suite is especially thorough for `autoreview`, covering edge cases like CRLF handling, binary files, merge commits, worktrees, shallow clones, and sensitive path patterns. The installer pattern (symlink for development, copy for vendored snapshots) is designed to minimize drift while allowing zero-setup downstream usage. Overall, the repository is actively maintained, uses modern tooling (Python 3.14, Node 26, TypeScript 7), and is well-suited for teams adopting agent-assisted development workflows who need reusable, vetted skill definitions.
Sqlvet is a static analysis CLI tool for Go projects that scans raw SQL queries embedded in Go source code to detect potential runtime errors at build time. It uses Go's SSA (Static Single Assignment) representation and call graph analysis to trace SQL query strings through function calls, handling common patterns like string concatenation, functions returning query strings, and pass-through functions like sqlx.Rebind. Extracted queries are parsed with a PostgreSQL grammar (via pg_query_go) to validate syntax, table/column names against a schema, and detect unsafe dynamic SQL that could lead to injection. The tool supports custom SQL function matchers via TOML configuration, allowing users to extend analysis to their own wrapper libraries. The architecture is a single Go binary with modular packages for configuration, schema parsing, query extraction, and SQL validation, with comprehensive test coverage including integration tests using real Go packages.
pyfastx is a Python C extension library and command-line tool for efficient parsing and random access of FASTA and FASTQ files. It builds SQLite3-based indexes to enable fast sequence retrieval without excessive memory usage, supporting both plain and gzipped files. The core functionality is implemented in C using kseq.h for parsing and zran.c for gzip indexing, with a Python wrapper providing high-level classes (Fasta, Fastq, Sequence, Read) and key collections for filtering and sorting. The included CLI tool offers subcommands for indexing, statistics, splitting, format conversion, subsequence extraction, and sampling. The project includes comprehensive benchmarks comparing against tools like pysam, pyfaidx, and biopython, and is cited in peer-reviewed literature.
ascii-chat is a production-grade terminal-based video conferencing application that converts live video and audio streams into real-time ASCII art rendered in the terminal. It operates in multiple modes: server (multi-client host), client (connect to server), mirror (local preview), discovery (peer-to-peer session participant), and discovery-service (session registry and NAT traversal relay). The system uses a custom binary protocol (ACIP) over TCP/WebSocket/WebRTC, with end-to-end encryption (Ed25519 + X25519 + XSalsa20-Poly1305) and support for SSH/GPG key authentication. A companion web client compiled via WebAssembly mirrors functionality in the browser. The codebase includes a standalone reusable C library (libasciichat) with a comprehensive platform abstraction layer (POSIX/Windows/WASM), a declarative options registry that auto-generates man pages and shell completions, SIMD-accelerated ASCII rendering (AVX2, NEON, SVE, SSE2), lock-free data structures, and a sophisticated logging system with crash-safe mmap output. The architecture is modular and cross-platform, with extensive unit, integration, and E2E test coverage across Linux, macOS, Windows, and WebAssembly targets.
OpenHands/OpenHands is the frontend application for the OpenHands AI agent platform, known as Agent Canvas. It is a React single-page application (SPA) built with Vite, TypeScript, Tailwind CSS, and React Router. The application provides a comprehensive user interface for interacting with AI coding agents (OpenHands, Claude Code, Codex, Gemini, or any ACP-compatible agent) via an agent server. It supports multiple backends (local self-hosted, cloud at app.all-hands.dev) with a backend registry that routes API calls accordingly. The UI includes a chat interface with real-time WebSocket event streaming, a conversation panel for managing multiple sessions, a file explorer with Monaco editor, terminal emulator, browser snapshot view, git integration (commits, diff viewer, push/pull), settings for LLM profiles, MCP servers, secrets, skills/plugins, and an automation dashboard for scheduled or event-driven agent runs. The application is also published as an npm package (@openhands/agent-canvas) for embedding in other applications, and supports Electron desktop builds. The architecture follows a modern React pattern with Zustand for client-side state management (conversations, events, UI preferences), TanStack React Query for server-state caching and synchronization, and react-i18next for internationalization. The backend abstraction layer is a key architectural feature: every service (settings, profiles, git, secrets, automations, etc.) branches on the active backend kind (local vs cloud) and delegates to either a direct SDK client (@openhands/typescript-client) or a cloud proxy (callCloudProxy). This dual-transport pattern is enforced by guard tests that prevent ad-hoc HTTP calls outside vetted files. The application also includes a manifest system for declarative automation setup, a tool visualizer registry for rendering agent tool calls (bash, file editor, search, task), and extensive mock infrastructure (MSW) for development and testing. Key entry points include the root layout (src/routes/root-layout.tsx) which provides the main shell with sidebar, command menu, and onboarding; the conversation main view (src/components/features/conversation/conversation-main/conversation-main.tsx) with resizable panels for chat and tabs; the settings pages (src/routes/settings.tsx) with schema-driven forms; and the automation dashboard (src/routes/automations-list.tsx). External dependencies include the agent server REST API, cloud proxy endpoints, @openhands/typescript-client SDK, @openhands/extensions for automation catalogs, and various UI libraries (HeroUI, framer-motion, xterm.js, Monaco editor). The codebase is actively maintained with over 84k stars, frequent commits, and a large test suite (Vitest unit tests, Playwright E2E tests, Stryker mutation testing).
Mole is a macOS system maintenance CLI tool that provides a unified interface for cleaning caches, uninstalling applications, analyzing disk usage, monitoring system health, and optimizing performance. It combines two Go binaries (cmd/analyze for disk exploration with a Bubble Tea TUI, cmd/status for real-time system metrics) with an extensive shell script library for orchestration and system-level operations. The `mo` command dispatches to subcommands like `clean`, `uninstall`, `analyze`, `status`, `optimize`, `purge`, and `installer`. The architecture is hybrid: Go handles performance-critical tasks (concurrent directory scanning with semaphore-based concurrency, hardlink deduplication, gob-based caching, and interactive TUI rendering) while Bash scripts manage cleanup logic, safety guards (path identity snapshots, whitelists, process guards), Homebrew integration, and sudo session management. Key data flows include disk scanning with progress events and cache invalidation, system metrics collection via gopsutil and macOS commands (system_profiler, ioreg, pmset), and cleanup operations with dry-run previews and bounded timeouts. External dependencies include Homebrew (for cask detection and uninstall), macOS system commands (tmutil, plutil, diskutil, osascript), and Go modules (charmbracelet/bubbletea, lipgloss, gopsutil). The codebase emphasizes safety with fail-closed policies, identity re-verification before deletion, and extensive timeout handling. It supports both interactive TUI and non-interactive JSON output for scripting.
Rustlings is an interactive CLI application designed to teach Rust through a series of small, hands-on exercises. It provides a terminal-based learning environment where users edit, compile, test, and run Rust code snippets, progressing through topics from basic variables to async programming. The system is built as a single binary that embeds all exercise files and solutions at compile time using a custom proc macro, eliminating external file dependencies. The CLI offers multiple modes: a watch mode that automatically re-checks exercises on file changes, a list mode for browsing and selecting exercises, and commands for running, hinting, resetting, and checking all exercises. State persistence tracks user progress in a local file. The architecture is modular, with clear separation between exercise execution logic, terminal UI, state management, and developer tooling. External dependencies include clap for argument parsing, crossterm for terminal control, notify for file watching, and serde for serialization. The project is actively maintained by the Rust community and serves as the official companion to 'The Rust Programming Language' book.
This is Prisma 8, a next-generation ORM framework written in TypeScript. It provides a contract-driven schema definition system where a 'contract' (JSON + TypeScript types) defines the data model, codecs, extensions, and capabilities. From this contract, the framework generates migrations, a type-safe query builder, and runtime execution for multiple database targets (PostgreSQL, SQLite, MongoDB). The architecture follows a multi-plane design with clear separation between the control plane (schema definition, migration planning, CLI) and the runtime plane (query execution, codec encoding/decoding). The monorepo is organized into layers: foundation (contract IR, canonicalization), core (config, framework components), authoring (PSL parser, contract builder), tooling (CLI, emitter, migration tools), family-specific packages (SQL family, Mongo family), target adapters (Postgres, SQLite, Mongo), and extensions (pgvector, postgis, supabase, etc.). Key entry points include the CLI (packages/1-framework/3-tooling/cli/src/bin.ts), contract definition via defineContract, migration base class, runtime creation (createPostgresRuntime, createMongoRuntime), and the ORM client (Collection). Data flows from contract source (PSL or TypeScript) to contract IR, emission (contract.json + contract.d.ts), migration planning, DDL execution, runtime query building, codec encoding/decoding, and database execution. External dependencies include PostgreSQL (via pg driver), SQLite (via better-sqlite3 or WASM), MongoDB (via mongodb driver), various extensions (pgvector, postgis, etc.), and Node.js/Bun runtimes.
Glances is a cross-platform, real-time system monitoring tool written in Python. It collects system metrics (CPU, memory, disk, network, processes, sensors, containers, GPU, NPU, etc.) via the `psutil` library and optional hardware-specific backends, and renders them through multiple interfaces: a curses-based terminal UI, a web UI (Vue.js + FastAPI REST API), a pure JSON/CSV stdout mode, a Model Context Protocol (MCP) server for AI assistant integration, and exports to 20+ time-series databases and message brokers (InfluxDB, Prometheus, Kafka, Elasticsearch, etc.). The architecture is modular and plugin-based: each metric domain is a self-contained plugin inheriting from a common base class, and each export target is a separate module. Glances can run standalone (local monitoring), in client/server mode (XML-RPC or REST), or as a central browser that discovers and displays multiple Glances instances via Zeroconf. The project is production-grade, with extensive test coverage, CI/CD across multiple OSes, Docker images, and active security maintenance. Its primary use case is real-time monitoring of single or distributed systems, with optional historical data export for long-term analysis.