Codex CLI's read-only, workspace-write, and danger-full-access modes are policy settings. The actual isolation is enforced by platform backends. This article connects the source-level view with the common macOS and Linux sandbox primitives.
Hermes Desktop updates from GitHub release tags, not every new commit on upstream main. When a fork needs to test newer code early, synchronize the source checkout manually.
After upgrading to Hermes v0.17.0, the Mac's idle power draw jumped from a normal 3-5W to 19W and the fans spun up. Using powermetrics to quantify, ps to localize the process, and sample to grab the call stack, I traced it all the way to Chromium's Rust font engine fontations and the Rust implementation of the Temporal API, temporal_rs, repeatedly formatting time strings and validating glyphs every frame, pinning the GPU at full load. This post records the full investigation.
This project trains a small TinyStories-style GPT model from random initialization on an Apple M4 Mac mini 16GB using MLX. It is not about calling APIs or fine-tuning an existing model, but rather walking through the entire pipeline of data preparation, tokenizer, model architecture, training loop, checkpoint, and inference generation.
This write-up leans more toward an engineering retrospective: the focus is not on training a chat-capable model, but on verifying whether a personal machine can complete an end-to-end small-scale LLM training run.
Project repository: sergioperezcheco/llm-from-scratch
The Telegram bot kept showing "typing" without ever replying, while the terminal CLI using the exact same model worked perfectly at the same time. It turned out the launchd-started gateway process doesn't inherit the system proxy environment variables, and the proxy lines in .env were commented out — so the gateway connected directly to an overseas API and timed out.
After a Hermes gateway had been online for about 48 hours, the CLI process threw an exception during its shutdown cleanup, which cascaded into the gateway being repeatedly restarted by SIGTERM, forming a vicious "restart interrupts session -> user reconnects -> interrupted again" loop that left the CLI down for about 12 minutes. This post breaks down the full crash chain and root cause.
This article has not been completed yet. If continued in the future, it is recommended to focus on risk boundaries, legality, and read-only verification methods, to avoid writing it as a tutorial for abusing public services.
SiliconFlow provides API services for models like DeepSeek-R1, which can be used with clients like Cherry Studio. This article documents the account registration, API Key acquisition, and client configuration process.
The DeepSeek official website has been extremely popular recently and often fails to respond
Local deployment offers higher security
Local deployment can bypass some official restrictions
