opkssh is a production-grade CLI tool that bridges OpenID Connect (OIDC) authentication with SSH access. It allows users to authenticate via any OIDC provider (Google, Azure, GitLab, Keycloak, etc.) and obtain short-lived SSH certificates embedding OpenPubkey PK tokens. The server-side component, invoked as sshd's AuthorizedKeysCommand, verifies these certificates against policy files and grants access based on email, subject, or group membership. The architecture is a single Go binary with client and server modes, using Cobra for CLI commands. Key entry points include `opkssh login` (interactive OIDC flow, SSH key generation, agent integration), `opkssh verify` (server-side certificate validation and policy enforcement), `opkssh add` (policy management), and `opkssh audit` (configuration validation). External dependencies include the openpubkey library for PK token operations, afero for filesystem abstraction, and testcontainers for integration tests. The tool supports Linux, macOS, and Windows, with platform-specific file permission checks and ACL handling. It also features a policy plugin system for custom access control logic via external scripts.
This is a mature, cross-platform React Native bottom sheet library (`@lodev09/react-native-true-sheet`) that provides native-feeling sheets on iOS (UISheetPresentationController), Android (BottomSheetBehavior + CoordinatorLayout), and Web (forked Vaul drawer). It is built exclusively for React Native's New Architecture (Fabric) with shared C++ shadow nodes for synchronous per-detent layout. The library offers an imperative API via refs and a global static method registry, plus optional integrations with React Navigation (custom stack router and sheet navigator), Expo Router (Sheet layout), and Reanimated (worklet-driven position tracking). Key features include automatic detent sizing, peek detents, header/footer overlays, keyboard avoidance, stacked sheets, dimming, and a portal-based overlay for toasts/dialogs. The codebase demonstrates high craftsmanship with clean native delegates, extensive event handling, and thorough test mocks. It is actively maintained with multiple example apps, CI/CD, Maestro E2E tests, and a documentation site.
Notte is a full-stack web AI agent framework and browser automation SDK. The implementation is a multi-package Python monorepo: notte-core provides shared domain models, actions, error hierarchies, telemetry, and configuration; notte-browser implements Playwright/Patchright browser control, DOM snapshotting, scraping pipelines, and form-filling heuristics; notte-agent contains the LLM-driven agent loop, deterministic fallback, and workflow execution; notte-llm wraps LiteLLM with structured completions, retries, and a file-based prompt library; notte-sdk is the client for the hosted Notte cloud API with remote sessions, agents, vaults, personas, and serverless functions; notte-integrations adds notifiers and third-party CDP session providers. Primary entry points are `NotteClient` for cloud usage, `NotteSession` for local browser automation, and `Agent`/`AgentFallback` for autonomous and hybrid scripted-agent workflows.
heapless is a Rust library crate for embedded and no_std environments, providing fixed-capacity replacements for standard collections: Vec, String, BinaryHeap, Deque, HistoryBuf, IndexMap, IndexSet, LinearMap, SortedLinkedList, lock-free SPSC/MPMC queues, and memory pools. It is not an application; it is a dependency crate compiled into downstream firmware where heap allocation is forbidden or undesirable. The API is built around const generic capacities and a LenType trait that allows lengths to be stored as u8, u16, u32, or usize to save memory. A Storage trait abstracts owned arrays and unsized views, enabling containers like Vec<T, N> to coerce to VecView<T> without duplicating implementation logic. Optional feature gates integrate with serde, defmt, ufmt, zeroize, embedded-io, and bytes, making the crate broadly useful across the Rust embedded ecosystem. Internally, the crate makes heavy use of unsafe Rust, raw pointer arithmetic, MaybeUninit, and atomic operations to achieve heap-free, often lock-free behavior. The SPSC queue is implemented as a classic split Producer/Consumer design suitable for interrupt-to-thread communication, while the memory pools are built on a Treiber lock-free stack with CAS and LLSC variants. The IndexMap uses a compact encoding that packs hash and index into a single u32, preserving insertion order while maintaining tight memory bounds. The project is actively maintained and well-integrated with the rust-embedded org, but it carries notable complexity: the MPMC queue is deprecated because it is not truly lock-free, unsoundness fixes appear regularly in the changelog, and several modules are gated behind architecture-specific atomic availability. Despite this, the abstractions are clean, the feature surface is deliberately organized, and the implementation is a strong reference for memory-constrained systems programming.
yutto is a production-grade CLI application for downloading videos, subtitles, danmaku (bullet comments), and metadata from Bilibili. In production it resolves user-supplied URLs (UGC videos, bangumi anime, paid cheese courses, favourites, collections, watch-later lists) against Bilibili's private JSON APIs, normalizes responses into typed Pydantic download requests, and runs a planner/executor pipeline: immutable DownloadPlan construction (output paths, codec/quality selection), concurrent range-based downloading, FFmpeg muxing, and writing of NFO/SRT/ASS artifacts. It also ships an experimental WebSocket JSON-RPC server mode (`yutto serve`) for remote task submission, querying, cancellation, and live event streaming with token authentication.
HevSocks5Tunnel is a lightweight, high-performance tun2socks proxy written in C. It creates a virtual TUN interface and forwards all TCP/UDP traffic through a SOCKS5 proxy, supporting IPv4/IPv6 dual-stack, UDP-in-UDP and UDP-in-TCP relay modes, optional local ICMP echo replies, and a mapped DNS feature for transparent DNS resolution. The architecture is monolithic but modular: a YAML-based configuration parser, platform-specific tunnel backends (Linux, FreeBSD, macOS, NetBSD, Windows via Wintun), and a session management layer built on top of lwIP and the hev-task-system cooperative multitasking library. It can be used as a standalone CLI tool, a static/shared library, or embedded via JNI on Android. The codebase demonstrates strong C craftsmanship with clean abstractions, efficient I/O patterns (ring buffer with iovec, scatter/gather), and careful platform abstraction.
grug-far.nvim is a Neovim plugin providing an interactive find-and-replace workflow using ripgrep and ast-grep as search backends. It presents a dedicated buffer with editable input fields (search pattern, replacement, files filter, flags, paths) and renders results with highlighting, folding, and line-level diff markers. The plugin supports multiple search engines and replacement interpreters (Lua, Vimscript), history persistence, preview, quickfix integration, and instance-level API for programmatic control. The architecture is modular: an engine abstraction layer, async job processing with libuv, a rendering system using Neovim extmarks, and a task lifecycle manager. It includes a comprehensive screenshot-based test suite and CI workflows. The codebase demonstrates strong software craftsmanship with clean abstractions, reusable patterns, and extensive documentation.
async-openai is a comprehensive, async Rust library providing typed access to the full OpenAI REST API surface. It covers all major endpoints including Chat Completions, the modern Responses API, Audio transcription/speech, Image generation/editing, Embeddings, Fine-tuning, Assistants (deprecated), Vector Stores, Realtime WebSocket sessions, Admin & Usage, Evals, Containers, Videos, and more. The architecture centers on a `Client<C: Config>` struct that dispatches requests through a configurable HTTP stack built on `reqwest`, `tokio`, and `tower` middleware. Each API group is a separate module with strongly-typed request/response structs, builder patterns via `derive_builder`, and first-class streaming support via SSE event streams. The library emphasizes flexibility and production readiness: it supports multiple OpenAI-compatible providers (Azure, Ollama, Gemini) through the BYOT (Bring Your Own Type) pattern, allowing users to swap in custom serialization for any endpoint. A powerful middleware system integrates with the Tower ecosystem, providing retry with exponential backoff, timeouts, and concurrency limiting. The codebase is fully compatible with WASM targets, with dedicated examples and CI. Over 40 example projects demonstrate real-world usage patterns including multi-turn reasoning, function calling, web search, and realtime audio sessions. Code quality is high: type definitions are meticulously crafted with serde tagging, feature flags for minimal builds, and extensive use of macros to reduce boilerplate. The project tracks OpenAI's rapidly evolving API closely, with deprecated endpoints (Assistants) clearly marked and a migration path to Responses API. While the large surface area and many feature flags add complexity, the overall engineering is clean, well-organized, and suitable for production use. The maintainers actively respond to issues and keep dependencies up to date, making this one of the most thorough and reliable OpenAI SDKs in the Rust ecosystem.
ProjectSend is a self-hosted secure file sharing platform built as a modular Laravel application with an Inertia.js + React frontend. The codebase is organized into domain modules — Files, Clients, Groups, Identity, Comments, Notifications, Audit, Platform, and Api — each containing controllers, services, policies, models, and event hooks. Staff members upload and share files with clients or groups, manage roles and permissions, enforce download limits, expire or version files, and monitor activity through a detailed audit log. Clients access their own portal with four switchable themes (default, compact, drive, gallery), and public share links support additional presentation themes with pagination, previews, and controlled downloads. The application is a monolith with strong modular boundaries rather than microservices. Authentication supports local accounts, LDAP, social login/SSO via OIDC, two-factor authentication, CAPTCHA, and password policies. A REST API protected by Sanctum tokens offers scoped abilities, RFC 7807 problem details, polling-based pagination, and an OpenAPI contract that is drift-tested against the live route surface. Background jobs handle zip downloads, email digests, thumbnails, file cleanup, and scheduled maintenance. The system persists settings, activity logs, notification preferences, and upload metadata in a relational database, while file payloads can be stored on local disks, S3-compatible storage, or Google Cloud Storage. The code is notably security-conscious: secrets are encrypted at rest, old input flashing excludes credentials, CSRF cookie naming is customized to avoid collisions, download paths are never exposed in API responses, and regression tests cover disclosure boundaries, permission scoping, token revocation, and account erasure. The test suite is extensive, using Pest feature tests to exercise permissions, file lifecycle edge cases, version chains, comment visibility, API contracts, and authentication flows. The architecture favors event-based extension points and registry patterns, making modules independently testable and partially reusable, though the project remains an application rather than a framework or library. Overall this is a well-crafted, actively maintained application with clean engineering practices, clear separation of concerns, and unusually thorough security regression coverage. Its main complexity is the large surface area of interchangeable themes, editions, authentication backends, and storage drivers, which creates some ongoing drift risk, but current CI, recent commits, and dependency management show the project is keeping pace with its ecosystem.
EasyNode is a full-stack server management panel that provides a unified web and native interface for remote Linux server administration. The system offers SSH terminal access, SFTP file management, Docker container control, RDP remote desktop, batch script execution, and an AI agent powered by large language models. The AI agent can execute commands, read/write files, and manage hosts with configurable safety and approval workflows, including context compression and MCP tool discovery. The backend is a Node.js (Koa) monolith with an embedded NeDB database, serving a Vue 3 single-page application and a Flutter cross-platform native app (Android, iOS, macOS, Linux, Windows, HarmonyOS). The architecture is a monorepo with three main packages: server, web, and native. The server handles REST API and WebSocket connections for real-time terminal, SFTP, Docker, server monitoring, and AI agent interactions. The web frontend uses Element Plus, xterm.js, and Monaco editor, while the native app uses Riverpod, dartssh2, and re_editor. Both clients share a common feature set including authentication (RSA-encrypted passwords, MFA), proxy/jump host support, IP access control, notification integrations, and a Plus subscription model for premium capabilities. The codebase demonstrates high engineering craftsmanship with well-separated concerns, reusable utility modules (command safety classification, shell lexer, terminal highlighter, rate limiter, database wrapper), and comprehensive test coverage for both server and client components. The AI agent subsystem is particularly notable for its pluggable safety rules, context compaction, and MCP client architecture. While the monorepo is large and some duplication exists between web and native implementations, the overall design is modular and maintainable, with active CI/CD pipelines and regular releases.
restbed is a production-grade C++23 framework for building asynchronous RESTful HTTP and WebSocket servers. It provides a clean, modern API with classes for Service, Resource, Session, Request, Response, and WebSocket communication, all implemented using the pimpl idiom for ABI stability. The framework handles HTTP/1.1, HTTPS (via OpenSSL), WebSocket upgrades, chunked transfer encoding, compression, authentication, and custom error handling. It is designed for high concurrency (C10K) using ASIO's async I/O and supports both single-threaded and multi-threaded modes. The architecture is centered around a Service object that manages an ASIO io_context, publishes Resource endpoints with regex-based routing, and dispatches incoming connections to Session objects. Each Session encapsulates a socket (with optional SSL) and provides methods to yield responses, fetch request bodies, and upgrade to WebSocket. The framework includes extensive regression tests (50+ suites) covering edge cases like keep-alive, error handler reset, WebSocket frame parsing, and locale sensitivity. Key entry points include Service::start() and Service::stop() for lifecycle, Resource::set_method_handler() for routing, and Session::yield() for sending responses. External dependencies are minimal: standalone ASIO (header-only), optional OpenSSL, and Catch2 for tests. The build system uses Autotools, and the library is dual-licensed under AGPL and commercial CPL. Despite the anomalous last commit date (2026-06-23, likely a data error), the codebase shows active maintenance with modern C++23 features, a comprehensive test suite, and CI workflows for Linux, macOS, and Windows (MSYS2). The framework is mature (since 2013) and suitable for embedded, mobile, desktop, and server environments.
Authorizer is a self-hosted, production-grade authentication and authorization server written in Go. It implements OAuth 2.0 / OIDC, SAML IdP/SP, SCIM 2.0, WebAuthn/passkeys, TOTP, email/SMS OTP, and fine-grained authorization via an embedded OpenFGA engine. The architecture is transport-agnostic: a shared service layer (internal/service) is called by GraphQL resolvers, gRPC handlers, and HTTP handlers (Gin). It supports multiple storage backends (SQL, MongoDB, Cassandra, DynamoDB, Couchbase, ArangoDB) via a unified storage.Provider interface, plus Redis and in-memory stores for sessions and caching. The system includes a React admin dashboard, an end-user login SPA, and an MCP (Model Context Protocol) server for AI tool exposure. Security is a primary focus, with extensive regression tests for CVEs, SSRF protection, constant-time comparisons, and audit logging.
ggshield is a production-grade CLI tool for detecting hardcoded secrets in code, git history, Docker images, PyPI packages, archives, and AI coding assistant interactions. It integrates with the GitGuardian API to scan for 500+ secret types, supporting both SaaS and self-hosted instances. The tool is designed for developers and CI/CD pipelines, offering git hooks (pre-commit, pre-push, pre-receive), a plugin system for extensibility, and AI agent hooks for Claude Code, Cursor, Copilot, Codex, Vibe, and Kiro. It also includes HMSL (Has My Secret Leaked) for checking secret exposure via cryptographic queries, honeytoken management, and machine-level setup for comprehensive security coverage. The architecture is a hybrid Python/Rust CLI built with Click. The Python codebase is organized into three layers: `cmd` (CLI commands), `core` (shared infrastructure like config, scan, cache, client, UI, plugin system), and `verticals` (domain logic for secret scanning, AI, HMSL, honeytokens). A Rust native component (`ggshield-hook`) handles AI hook scanning for performance, while a Rust dispatcher delegates non-hook commands to the Python launcher. The plugin system supports dynamic command registration with sigstore signature verification. Configuration is YAML-based with versioned schemas and global/local merging. Key entry points include `ggshield/__main__.py` (CLI root), `ggshield/cmd/secret/scan/` (scan subcommands), `ggshield/cmd/auth/login.py` (authentication), `ggshield/cmd/machine/setup.py` (one-shot protection), and `rust/dispatcher/src/main.rs` (Rust binary). External dependencies include the GitGuardian API (py-gitguardian), keyring for credential storage, and platform-specific utilities for notifications and machine ID derivation. The codebase demonstrates strong engineering practices with lazy command loading, output handler strategy pattern, cache abstractions, and comprehensive test coverage (80%+).
This repository is a pnpm monorepo for @stylistic/eslint-plugin, a community-maintained ESLint plugin that provides formatting and stylistic rules for JavaScript, TypeScript, JSX, and related syntaxes. It ports formatting rules that were deprecated or removed from ESLint core and typescript-eslint, giving users a drop-in path to continue enforcing style conventions. The main deliverable is an npm library consumed through ESLint flat config; there is no server, database, or runtime application. The plugin exposes roughly a hundred rules, each with typed options, autofix support, parser-specific test coverage, and generated metadata and type declarations.
Sass MQ is a Sass library that provides a sophisticated mq() mixin for generating em-based media queries with named breakpoints. It converts pixel values to ems for better zoom compatibility, handles inclusive/exclusive boundary conditions properly, and supports complex media query compositions. The library includes utility functions for unit conversion and breakpoint lookup, plus a developer tool for visualizing active breakpoints. Built with modern Sass module system practices, it maintains compatibility with current Dart Sass versions while offering a clean, reusable API for responsive design.
This monorepo provides two packages for font optimization in web applications. `fontaine` is a library that automatically generates metric-adjusted CSS `@font-face` fallback rules to reduce Cumulative Layout Shift (CLS). It parses CSS, reads font metrics from files or URLs, and injects override rules with proper `size-adjust`, `ascent-override`, etc. `fontless` is a Vite plugin that builds on top of fontaine and integrates with multiple font providers (Google Fonts, Bunny, FontSource, npm, etc.) to automatically download, subset, and serve optimized fonts with zero runtime JavaScript. It scans CSS for `font-family` declarations, resolves fonts through a provider chain, downloads the actual font files, emits them as build assets, and injects both the primary `@font-face` rules and metric-override fallback families. The codebase is well-structured, has comprehensive test coverage, and follows modern JavaScript/TypeScript practices. It is a hybrid of a library (fontaine) and an application plugin (fontless) but primarily serves as a developer tool for building optimized web fonts.
This repository is the `react-native-update` SDK (branded as Pushy for China and Cresc globally), a production-grade over-the-air (OTA) update library for React Native applications. It enables incremental patching of JavaScript bundles (including Hermes bytecode) and native resources across iOS, Android, and HarmonyOS platforms. The system comprises a JavaScript layer (React context, hooks, client classes) that orchestrates check, download, patch, and switch operations, and native modules on each platform that handle binary patching (via HDiffPatch/LZMA), secure zip extraction, resumable downloads, and a native cold-start check that can recover from crashes without JS involvement. The core patching and decision logic is implemented in C++ and shared across all platforms, enforced by golden-vector test suites. The SDK supports staged rollouts, telemetry, error reporting, crash rescue, and multiple update strategies (silent, alert, etc.). It is not a standalone application but a library integrated into React Native apps, with extensive CI/CD, unit tests, and e2e tests.
Rats Search is a decentralized BitTorrent search engine implemented as a Qt6/C++ desktop application with a headless server mode. It crawls the BitTorrent DHT network to discover torrent metadata, indexes it using Manticore Search (a Sphinx-compatible full-text database), and provides a full-featured GUI for searching, downloading, and managing torrents. The application also includes a P2P replication layer for synchronizing databases between peers, a REST/WebSocket API for remote control, and support for torrent creation, seeding, and metadata export. The codebase is well-layered (domain, data, services, net, ui, rest) with clear separation of concerns, extensive unit and integration tests (15+ test files), and a professional CMake build system with CI for Windows, macOS, and Linux. A legacy Electron/Node.js version (v1.x) is preserved in the `legacy/` directory but is not actively developed. The project demonstrates high craftsmanship in its data layer (hash-based row IDs, safe SphinxQL query builders, resumable database dumps) and service architecture (cancel tokens, progress reporting, event-driven updates via Qt signals). However, the main window (`mainwindow.cpp`) exceeds 2400 lines, and the presence of the legacy codebase adds maintenance overhead.
Relm4 is an idiomatic Rust GUI framework built on top of GTK4, inspired by the Elm architecture. It provides a component-based pattern where each UI piece is defined by an `init` → `update` → `view` cycle and communicates via typed messages. The framework includes a declarative macro system (`view!`, `#[component]`, `menu!`) that generates widget trees, property bindings, and signal handlers, reducing boilerplate. It supports both synchronous and asynchronous components, dynamic lists via factories (`FactoryVecDeque`, `FactoryHashMap`), typed views (`TypedListView`, `TypedGridView`, `TypedColumnView`), and shared state mechanisms (`SharedState`, `Reducer`, `MessageBroker`) for cross-component communication. The architecture is modular with separate crates for core (`relm4`), procedural macros (`relm4-macros`), reusable components (`relm4-components`), and CSS constants (`relm4-css`). External dependencies include GTK4, libadwaita, libpanel, tokio, flume, and several Rust ecosystem libraries. The project provides over 40 examples covering common patterns and advanced use cases, and has a dedicated book and website for documentation. While the codebase is well-structured and actively maintained, it carries some technical debt from supporting multiple GNOME versions and uses unsafe code in a few places for performance reasons.
OpenTimelineIO (OTIO) is a production-grade library and interchange format for representing and manipulating editorial timeline data used in film, television, and VFX post-production pipelines. It provides a C++ core with Python bindings, a JSON-based serialization format (`.otio`), a plugin system for adapters (AAF, EDL, FCP XML, etc.), media linkers, hook scripts, and custom schemas. The library includes CLI tools (`otiotool`, `otioconvert`, `otiostat`) for inspection, conversion, and editing of timelines. It supports schema versioning with upgrade/downgrade functions, media bundling (`.otioz`/`.otiod`), and editing algorithms (trim, slice, overwrite, etc.). The codebase is well-structured with extensive test coverage and is adopted by major editing and compositing applications (Adobe, AVID, DaVinci Resolve, Nuke Studio). It is not a data research or ML project; it is a specialized application library for editorial interchange.