Tag
gohawk 是一款面向 Go 语言的工业级静态分析工具，专注于资源管理和并发问题检测，已用于发现并修复 Docker、Kubernetes 和 Caddy 中的真实 bug。
noalloc 是一个用 AI 编写的 Go 工具链，可通过 `//noalloc:root` 等指令检查函数调用树中的堆分配，并提供固定容量的零分配数据结构（含 JSON 编解码器）以帮助编写无堆分配代码。
该预印本提出 BIEvolve，通过契约引导的静态依赖分析与跨批次数值一致性动态验证，为 LLM 内核生成代理加入批不变性(BI)保障，将 BI 通过率从 67.6% 提升至 91.9%，同时保留 91.8% 的基线加速收益。
一篇 PyPy 博文介绍了一个玩具级的 bit provenance 抽象域，通过追踪 SSA 变量中每一位的来源来识别位操作序列中的等价关系，从而实现诸如 `result = a & c` 简化为 `result = a` 的优化，并在 Pydrofoil 和 PyPy 中进行了评估。
Tweede golf, in collaboration with Microsoft under the Open Device Partnership, released the Call Graph Analyzer (CGA), a Rust tool that extracts a call graph from monomorphized MIR to track down functions in compiled binaries that can panic, runnable via `cargo cga check`.
作者分享了在一周内用 AI 辅助但不盲信 AI 的方法，安全删除约 19000 行编译器死代码的经验：先用静态分析界定范围，再让 LLM 标记 RED/BLUE 函数，并用独立的调用图工具交叉验证标记完整性，最终实现零回滚、零修复提交的清理。
A practical guide on how to trust AI coding agents more, emphasizing an 'inverse pyramid' of effort: codebase improvements, static analysis, prose guidance, then human review. It links to Cursor's official plugins repo for installing agent-friendly tooling and workflows.
A deep technical blog post introducing a novel reverse-walking borrow checker for the Valen programming language, which traverses functions backward through time to verify memory safety while optionally relaxing shared-xor-mutable rules.
@poteto (Lauren) from the Grok Bot team proposes a four-layer "inverted pyramid" framework for trusting AI Agent outputs: prioritize investing in codebase improvements and static analysis over rule files and manual review, and engineer the environment so Agents do the right thing by default.
开源了 PuedoBot，一个基于确定性扫描加双 pass LLM 流水线的 CLI 安全审计工具，第二个 pass 专门反驳第一个 pass 的发现以减少 SAST 误报。
Deslop 是一套面向 Oxlint 的开源插件规则集，用于拦截 AI 生成的 TypeScript 代码中常见的类型断言滥用、低信号测试等'slop'模式。
Meta/Facebook open-sources Lifeguard, a fast static analyzer (in beta) that detects Python code patterns incompatible with PEP 810 Lazy Imports, helping large codebases safely adopt deferred module loading to cut startup time and memory overhead.
exhale 0.2.0 为 Ruby gem 新增 exhale complexity 功能，基于认知复杂度算法在 PR 中检测代理式 AI 逐步引入的代码复杂化，并给出可修复提示，而非仅对遗留代码设固定阈值。
An exploration of how compilers and build systems can communicate more effectively, examining interfaces and coordination mechanisms between them and beyond.
This paper introduces a theory of bidirectional type slicing, where selecting a term and querying its type information yields a minimal program slice sufficient to explain that type. The metatheory is mechanised in Agda and a linear-time approximation is implemented for the Hazel programming environment.
exhale-ruby is a contraction toolkit for Rails that detects duplicated code in pull requests, guiding coding agents to fold copies back into existing code using a DRY check built on Prism and Herb.
An indie dev released repopedia, an MIT-licensed, fully local code knowledge-graph tool that builds a SQLite graph from Python/TypeScript repos using tree-sitter, plus an MCP server so coding agents like Claude Code can query call graphs and blast-radius impact directly instead of relying on grep.
tools4imps released exhale-ruby, a contraction toolkit for Rails that combines dryer and flay on top of Prism/Herb to catch duplicated code introduced by AI agents, with `exhale dry` as its first PR gate. It normalizes code units, scores similarity with rare-fingerprint Jaccard weighting, and labels findings as introduced, shifted, or already there.
Benzi is a compiler-backed AI coding agent that uses deterministic static analysis and code indexing instead of reading raw source code, reporting 78.2% on SWE-bench Verified for under 10 cents per fix while reading far fewer tokens than Claude Code, DeepSeek's harness, and OpenCode.
The author built jev-test-impact, a tool that uses Git diffs and static dependency analysis with Jev to score and run only relevant tests, aiming to improve regression recall in testing workflows.