Hi there, this is your daily ☕️ Devshot.
In today's Devshot:
🐳 Docker brings agent permissions to CNCF
🔍 Cursor launches a bot that tracks code to production
🛠️ Gemini CLI now confirms build edits
⚙️ Vercel open-sources TypeScript-native compiler
🧵 Benchmark tests C++ string creation speed
Plus: 🎁 8 other news you might like, 🧰 6 tools, and 📚 5 papers.
🐳 Docker brings agent permissions to CNCF LINK
- Docker has handed its Sandbox Kit Spec to the CNCF for neutral governance, creating an open standard, licensed under Apache 2.0, for packaging an AI agent alongside the exact hosts, credentials, and volumes it is permitted to reach.
- A Kit is a plain OCI image carrying three things, the agent, its tools, and a typed list of everything it requests, so existing registries, scanners, and signing tools handle it and pinning the image pins those permissions together.
- Docker built the first Kits with AWS, Datadog, Dynatrace, JFrog, Snyk, and others, letting vendors publish agent authority as diffable image lines a reviewer can refuse; Docker Sandboxes enforces the spec but under CNCF won't be the only runtime.
🔍 Cursor launches a bot that tracks code to production LINK
- Cursor has launched Rollouts, an agent that follows a code change from pull request into production and reports whether the deployment behaves as intended, flagging regressions across staging and production separately.
- Rollouts builds a monitoring plan when a PR opens, checks the resulting logs, metrics and traces after deploy, and returns one of three verdicts: verified healthy, regression detected, or inconclusive, before optionally opening a revert PR.
- Built on Cursor's new Bot Development Kit, shipped as the `@cursor/bdk` npm package, Rollouts connects to Origin or GitHub, pulls deployment events from CD systems, and can hand suspected regressions to a Cursor cloud agent to fix.
🛠️ Gemini CLI now confirms build edits LINK
- Gemini CLI 0.61.0, released Wednesday, now pauses for explicit confirmation before the agent edits build config files, runs build or test commands afterward, or executes shell commands whose arguments appear to originate from untrusted external content.
- The tool tracks which build files change during a session and holds any later npm run, make, or cargo command for approval, showing full untruncated diffs and disabling the persistent "always allow" option for these actions.
- A companion change hardens the optional sandbox: on Docker, Podman, LXC, or macOS Seatbelt, the host's ~/.gemini directory is no longer mounted, and a sanitized settings copy strips out API keys, hooks, and custom tool commands.
⚙️ Vercel open-sources TypeScript-native compiler LINK
- Vercel Labs has open-sourced scriptc, an experimental Apache 2.0 compiler that turns ordinary TypeScript into small native executables containing no Node, V8, or JavaScript engine, emitting C, LLVM IR, assembly, native binaries, or WebAssembly.
- Code lands in three tiers: compiled statically by default, run dynamically inside an embedded ~620KB quickjs-ng engine for npm packages and typed code, or rejected at compile time with a rewrite hint and error code.
- Benchmarks of scriptc 0.0.16 clocked median CLI startup at 1.78ms against Bun's 21.3ms and Node's 61.8ms, but Hono pushed 62% of the server into QuickJS, dropping throughput to 18.4k requests per second versus Bun's 70.5k.
🧵 Benchmark tests C++ string creation speed LINK
- A cross-language benchmark measured how fast each runtime converts integers to short strings in a tight loop, and C++'s std::to_string topped the chart at ~184 million strings per second on an Apple M4 Max.
- C++ hit ~5.4 ns per string by relying on small string optimization, storing the up-to-eight-digit values inside the std::string object itself and never touching the heap allocator.
- Nim, Go, Node.js, Bun, and Rust clustered around 64-86 million per second (12-16 ns each), with Rust's standard to_string() trailing both Node and Bun, while Python's str(i) lagged worst at ~23 million.
Other news you might like
- F-Droid gets its biggest update in a decade with new UI and smoother app installs LINK
- Runtime: The father of Java on the art of code LINK
- Accelerating vision-language models with LFM2.5-VL-DSpark LINK
- Query decomposition doesn’t fix context starvation — it just moves it LINK
- The Pulse: a new trend of CPU shortages LINK
- I automated my entire Linux desktop with 4 bash scripts—and reclaimed hours every week LINK
- Stop buying a new ESP32 for every sensor — your Bluetooth proxy has spare pins LINK
- IPv6 failed the internet, but it's secretly winning in your home network LINK
🧰 Trending tools
Die With Me: a Mac app that tracks Claude and Codex usage, compares it with friends, and provides a chatroom when your allowance runs out. LINK
Dograh: open-source voice agent platform with a visual flow builder, telephony, human transfer, and self-hosted QA monitoring across 30-plus model integrations LINK
tiun: an AI-native backend unifying authentication, payments, customer database, and analytics so teams ship and scale without stitching together separate services. LINK
Jev: makes fast, structured AI-driven decisions for software automation, helping developers build reliable logic into automated workflows without manual rule-writing LINK
Coldtea.ai: automates QA and monitoring with AI agents that catch post-deployment bugs, flag issues, and generate actionable fix tasks for your team LINK
AgentSky: runs managed AI coding agents with auto-recovery, letting you control remote development from WhatsApp, Telegram, Slack, web, API, or CLI LINK
📚 Trending papers & reports
AI coding assistants tend to rewrite buggy code from scratch rather than make the small targeted fix a human would, changing far more lines than needed, a mismatch that matters for AI-assisted programming tools. LINK
CodeGraph tags 145 million real code files with the algorithms, patterns, and purposes they actually embody, turning vast public repositories into a searchable map of engineering knowledge instead of raw text. LINK
Cloud misconfiguration fixes from AI pass full safety checks only 32 to 50 percent of the time on first try, but a verification loop lifts that to 68 to 92 percent at one-twelfth the cost. LINK
Independent AI training stack shows a language model can be built from scratch without the dominant software everyone relies on, matching its accuracy and running slightly faster, proving industry knowledge isn't just an artifact of one toolkit. LINK
AI compliance checks re-verify every trained model against current rules instead of trusting its build history, catching stale or wrongly-approved versions that passed standard output tests, while cutting false alarms roughly in half. LINK
See you tomorrow for a new dose of ☕️ Devshot!