Developer releases open-source bash-write-targets tool to statically detect bash command file writes

·1 views

A developer built a standalone, stdlib-only Python tool called bash-write-targets after their agent-guard project's README said such a tool did not yet exist. The tool statically parses a bash command string to list the files it would write, such as redirection targets and sed -i or mv destinations, and can output the results as JSON. It handles cases like heredocs and unresolvable variables, and it does not execute commands or use eval. The developer notes its limits: it cannot detect writes made inside interpreter code like python3 -c, nor network actions such as POSTing data. The project is MIT-licensed and available on GitHub and PyPI, with 19 smoke tests reported as passing.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Lessons from running a 200-game browser arcade on instant-play design

A contributor who helps run PlayPokiGame, a free site of casual HTML5 games playable in-browser without downloads or signups, shares lessons from observing real player behavior. Time-to-interactive proved the strongest predictor of play sessions, with games showing a playable frame within about three seconds drawing far more engagement. The author also found that browser players skip tutorials, so controls should be shown in-game, and that short 10–20 minute play bursts favor games with natural 3–5 minute loops. Instant respawns, auto-pausing on tab blur, and periodic localStorage saves are highlighted as key to keeping players from abandoning games. The author argues these principles apply broadly to web products, given the browser runs on everything from cheap Chromebooks to high-end workstations.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Browser-based HEIC to JPG conversion for iPhone photos using JavaScript

iPhones save photos in HEIC format by default, which is smaller than JPG but often rejected by websites, forms, and Windows apps. Because only Safari can natively decode HEIC, the author recommends the heic2any library, which uses WebAssembly to convert files directly in the browser. The library is about 1.3 MB, so it is loaded only after a user selects a HEIC file to keep page loads fast. Developers are advised to handle multi-image HEIC outputs as arrays, check file extensions since MIME types can be empty, convert files sequentially to limit memory use, and use a quality setting of 0.9. Since the file never leaves the user's device, the approach also suits private photos.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Five On-Premises Project Management Tools Compared on Data Control and Workflow Fit

Organizations that must keep project records on infrastructure they manage need to weigh deployment options alongside approval steps, status reporting, and daily usability. A new practitioner's guide compares five tools on deployment and data control, workflow coverage, and operational fit. It recommends first confirming hosting requirements, then testing each candidate against a representative project from planning through reporting. The guide profiles ONES.com, Jira Data Center, Microsoft Project Server, Wrike, and OpenProject Enterprise, noting each one's strengths and caveats such as Jira Data Center's announced end-of-life timeline. Its suggested evaluation method is to trace a requirement through planned work and execution updates to see whether it surfaces in project reporting.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Treat LLM Agents Like New Bank Tellers: Five Controls That Transfer

A developer with a background in financial systems argues that LLM agents with tool access resemble new bank employees who are fast but cannot reliably distinguish genuine customers from fraudsters. The author suggests that long-established banking controls can be applied to these agents. Key recommendations include enforcing policy in code rather than in prompts, using a gate that checks each proposed tool call before execution, and treating retrieved document content as untrusted data to limit prompt injection. The piece also recommends detailed logging of every proposed tool call, including rejections, and using velocity checks to detect fraud patterns.

0 comments Read more at DEV Community