A PHP vulnerability with a CVSS score of 9.2 that lets anyone execute code remotely without even logging in — and the official fix only covers 8.2 through 8.5. My server runs 5.6, which has no patch and no backport. This morning I only wanted to confirm how badly I was affected. But one thing led to another, and I ended up giving the site legacy — stacked up and steadily gaining entropy for over a decade — a thorough slimming down.

I use Paseo as a shell, connecting to a local opencode serve, and don't run the TUI in a terminal. After migrating OpenCode from v1 to v2 on October 1, opencode-notifier stopped making any sound: the plugin logs showed it loaded successfully, and system volume was normal. Digging through the 0.6.0 source made it clear—the V2 server hardcodes delivery to "command", forcibly turning off all sound and popup notifications and leaving only a custom command outlet, while the sounds were moved to the TUI component that I don't load at all.

My daily driver stack is Paseo + OpenCode + OpenViking. Paseo recently shipped an official plugin directory too, so now there's both the community one at paseo.cafe and the official one at paseo.sh/plugins. I'd ported the solarized theme earlier to go easier on my eyes, and it's listed in both directories.

After I fixed a small bug, TRAE went ahead and added Co-Authored-By: Claude Sonnet 4.6 to the commit message on its own. That's ridiculous as hell — even when I commit with Claude Code, it doesn't add a Claude signature. Add the credit system, token rate limiting, and project file uploads on top of that — ever since TRAE went commercial, it's getting less and less reassuring.

Right after National Day my feed was flooded with two open source projects: one rewrote Photoshop from scratch in pure Rust, the other lets an AI Agent read the binaries of any piece of software. Looked at calmly, neither is as all-powerful as the self-media make them out to be — but they do force you to rethink one thing: where does the software industry go next. My take: toward compliant SaaS, toward vertical niches, toward the long tail. And as for "anyone can build their own software" — I don't buy it. Every household has a kitchen, and restaurants still stay open.

Laurel's old water cup had a bit of a leak. I told her it was crying. I said we'd had this cup for a year — for you that's just one school year, but for it, that's a whole lifetime. She froze, clutching the cup, and later she actually wrote about it for an essay — the words didn't quite land, but what they landed on was real guilt. The AI voice I can't stand is the exact opposite: every word is right, and together they weigh nothing.

TypeSafe's Jev has been hyped across China these past few days as a "new AGI species." But it's just a classifier: you give it 【options + a natural-language description】, it gives you 【a decision】. It doesn't generate options, and it doesn't generate explanations. Fast? Genuinely fast. And its weak spots are just as real. The tech isn't new — whether it becomes a product still comes down to the people.

Mac memory mysteriously eaten up, and it turns out dozens of orphan node processes were left behind by Feishu's official lark-mcp. The root cause is that its stdio lifecycle only handles data inflow, not pipe closure, so the process doesn't kill itself after the host exits. Upstream issues and PRs were filed but have just sat there unmerged, and the repo hasn't been updated for over a year.

Several pretty stunning things happened in September: GPT6 Computer Use became more polished, embodied intelligence driven by fruit fly neural connections, and a math problem that had stumped humanity for 90 years was solved by a large model. They all point to the same question — do large AI models have a boundary? If they do, the optimal strategy is to shift toward cultivating the skills and competencies that lie beyond the AI boundary; if they don't, the optimal strategy is to find every possible way to get involved on the compute side.

While working with WorkBuddy, I noticed that deleted temp files end up in the Trash, whereas my opencode reaches for rm at the drop of a hat. Digging into that detail led me to discover that macOS 15 already ships with a built-in trash command that can replace rm.

The previous post on the goat setup missed one piece: models like deepseek-v4-flash couldn't pick a thinking depth in /models. Digging in, it turned out the GOAT plan does support it — the problem was that the hand-written models in the custom provider were missing a reasoning capability declaration, so opencode's variant generation logic stopped them at the door. In the end I added reasoning:true to every model under goat and goat-zdr, and testing showed no side effects.

I built a Solarized Light eye-friendly theme plugin for Paseo using the official addTheme plugin API. No need to touch any Paseo files, and nothing is lost on upgrade. Since Paseo 0.7.0 you can install plugins straight from GitHub, one command and you're done.

I bought CommandCode's goat plan and wanted to use it as my main plan in opencode. The whole integration takes just two steps: first /connect to save the API key, then declare the provider in opencode.json. The goat plan requires an x-cmd-zdr: 1 header on every request, and testing confirmed you can add that in the config too.

OpenCode Go's monthly allowance is spread across several tables, and the official "5-hour quota" chart doesn't list all the models. So I built a chart page that automatically scrapes the official price table and, using the same methodology as the official one, works out the number of requests available per month for each model and plots it. Hover for details.

DeepSeek Harness got a lot of people excited, but I used it once and didn't keep going; Qwen3.8 27B's capabilities have taken off, but I haven't deployed it locally either. Weighing the urge for new things against the need for stability, OpenCode + Paseo + OpenViking is already smooth enough. Anything new that doesn't offer real, controllable, reliable help is just noise.