Styx lets coding agents reach SSH servers without ever receiving your private key

·2 views

Styx is a free, open-source desktop app that runs coding agents and requires them to ask permission before accessing production systems. Its SSH targets store host, user, port, optional jump host and environment, and agents run standard ssh, scp, sftp or rsync commands with those settings applied. Key files and passwords are kept in the OS keychain, and agents receive only a forwarded SSH agent socket or a signed-in connection rather than the secret itself. Every grant is scoped, time-limited and recorded in an append-only audit log, with extra prompts for production targets. The author notes that Styx is a guardrail rather than a sandbox, since an agent calling the ssh binary by its full path can bypass the check.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Working checkout doesn't prove a product is priced right, critic argues

A GitHub discussion exposed a gap in a five-question diagnostic tool for product failures, which classifies problems as traffic, activation, billing, or positioning. Reviewer chenhz01 argued that symptom-based classifiers can confuse adjacent failure modes, though the maintainer countered that the tool's direct yes/no gates prevent billing failures from being mistaken for activation failures. The reviewer's real point, the maintainer conceded, is that a product can pass the billing gate yet still be mispriced for its buyer, so the fix is a price change rather than new copy. The article notes that owners often reach for cheap messaging fixes instead of repricing, and that testing only with one's own purchases verifies the payment system but not willingness to pay. As a result, the diagnostic now explicitly flags mispricing rather than assigning it to positioning.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

WooCommerce Cart Cookies Can Silently Disable Page Caching for Shoppers

An experienced WooCommerce auditor reports that sites often benchmark quickly yet feel slow to real shoppers. The cause is cart session handling, which sets cookies once an item is added and leads caching layers to skip the cache for those visitors. Because the cart icon appears in the header, this bypass can extend to nearly every page the shopper views. Cart fragment AJAX requests add further uncached load, even for empty carts. Standard performance tools test anonymous visitors with empty carts, so they miss this slowdown entirely.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Pre-Trade Risk Gate in Python: Hysteresis, EWMA Spikes and Taker-Sweep Detection

The author presents a pre-trade risk gate that checks market microstructure before each order and returns an allow or block decision with reasons. The gate closes on four triggers: recent large taker sweeps, a VPIN reading in its top decile, an unusually lopsided order book relative to the pair's own history, and a sudden shift in the book's imbalance against its moving average. It uses hysteresis, reopening only after a cooldown and a lower VPIN re-arm level, and fails closed whenever a fresh snapshot cannot be obtained. Measurements show that reusing an HTTPS session cut median check latency from about 160 ms to 59 ms, and a one-second cache avoids redundant requests. The article also notes that REST-based gating cannot react fast enough to beat the first fill after a sweep, which would require a streaming feed.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

HubSpot Tracking Lacks Consent Mode v2 Equivalent, Skewing Attribution Reports

Google's Consent Mode v2 lets Google tags keep firing in a limited, cookieless form when consent is denied, but HubSpot offers no comparable mechanism and its tracking either runs fully or not at all. This mismatch causes HubSpot to record fewer conversions than GA4, with the gap roughly matching a site's consent denial rate. Because HubSpot's tracking identifies individuals and should therefore sit behind consent gates like ad storage, it must be blocked entirely when consent is denied. Blocking it can permanently erase original source data, since HubSpot sets that attribute only on first visit and does not backfill it. Denied contacts also accumulate fewer page views, lowering their lead scores, and higher denial rates in the EU and UK can make European campaigns appear weaker in HubSpot reports.

0 comments Read more at DEV Community