Pinky Gateway Lets AI Agents Control Phones With Owner Approval Gates

·1 views

Pinky is a public, Apache-2.0-licensed pre-alpha gateway that allows MCP-capable agents such as Claude Code, Claude Desktop, Codex and Cursor to operate supported Android and iPhone devices. The owner can watch the session, approve risky actions, or take manual control at any time. By default, payments, trades and transfers require approval, and users can extend confirmation requirements to actions like deletions, calls, installations and settings changes. The project says these rules are enforced by the gateway rather than the agent's instructions, and it hides banking, wallet and password-manager apps unless temporarily allowed. The developers label the software pre-alpha and note that its claimed button recognition across 10 languages still requires further testing.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

DNApps proposes shipping app blueprints instead of source code

The author proposes DNApps, a format in which an app is described by a single capsule file that states its purpose, which decisions are fixed versus adaptable, and the build order. A coding agent such as Claude Code, Codex, or Cursor would then generate the actual app tailored to the recipient's language, operating system, devices, preferences, and hosting. The author's example, a 15 KB capsule named Plate, yields a 75 to 95 KB app, roughly five times larger, though results on bigger apps are unknown. The approach could support multiple levels of detail, and a retired app could be kept as a compact capsule and regenerated later. The author is seeking feedback on whether the format is useful or breaks down at scale, and the v0.1 spec is open for comment until January 10, 2027.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Node.js PDF encryption for property bundles: sending passwords out of band

The article explains how a Node.js service should encrypt finished PDF bundles, store them privately, and deliver the document reference and its password through two separate channels. It warns that sending both through the same email thread undermines the security benefit, and that passwords must never appear in logs. The recommended design splits the work so a thin Express handler accepts jobs while a worker handles encryption, using explicit state transitions such as encrypted, stored_private, and password_notified. Operators are advised to alert on bundles stuck in a half-delivered state rather than on individual request failures. The piece also covers the state record fields needed, the dangers of false completion signals, and a Go example showing careful API client behavior.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

HPE ArubaOS CVE-2026-79869 Prompts Patch and Segmentation Push Across Wireless Networks

CVE-2026-79869 affects HPE Networking ArubaOS AOS-10 systems across several release branches, with a CVSS rating of 9.6 and potential for privileged command execution. Administrators are advised to build a complete device inventory, including controllers, gateways and access points, and reconcile it against management and discovery records to find unmanaged units. Fixed versions are 10.8.1.2, 10.7.2.7 and 10.4.1.14, and each device should be mapped to the correct target rather than upgraded through a blanket order. Until patching is complete, HPE recommends restricting management interfaces to a dedicated VLAN and controlling access at layer 3 and above, with documented owners and removal conditions for any temporary containment. The vendor reported no known public exploit code at initial release, though the guidance stresses local evidence of patch state over public exposure data.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why your cron job isn't running: eight common causes and how to check each

A cron job that silently does nothing usually traces back to one of eight causes, the article explains. The first step is confirming the cron daemon is actually running, since minimal container images often lack it entirely. Failures are hard to spot because cron mails output to a local user that most servers never configure, so the article recommends redirecting each job's output to its own log file. Other frequent culprits include a shorter PATH than the interactive shell uses, shell-specific syntax breaking under /bin/sh, unescaped percent signs, mismatched crontab formats, non-executable scripts or Windows line endings, and a server time zone that differs from the user's. Each cause comes with a one-line test to confirm it.

0 comments Read more at DEV Community