Open Source Radar — September 3: the agent's paper trail
Today's board is about the parts nobody demos: where an agent's reasoning gets stored, how a PDF becomes context, where plugins come from, and whether your dev server has a name your agent can remember. Five fresh picks, none of them repeats from this week's earlier radars.
Atlas (Rust, ~3,100 stars) — Source control built for the fact that agents now write a large share of the code and keep none of the reasoning. Every session is recorded locally, and when you commit, the commit is linked back to the session that produced it — prompts, tool calls, file changes, and the reasoning behind them, kept together and queryable months later. The links survive amend and rebase, and commits made from a terminal or another editor with Atlas closed still find their session. It also runs Claude Code, Codex, its own agent, and anything else in the ACP registry side by side against one codebase, with a shared on-device memory index so a decision one agent made shows up in the next agent's prompt. Local by default, secrets scrubbed before anything touches disk, MIT licensed, and alpha 0.3.0 shipped on August 25. Worth knowing: it's a macOS-first desktop app, and anonymous usage analytics are on by default.
pdf-inspector (Rust, ~18,700 stars) — Firecrawl's answer to a problem every RAG pipeline has: most PDF pipelines burn money running OCR on documents that were never scanned. The library sniffs a file's content streams and classifies it as text-based, scanned, image-based, or mixed in tens of milliseconds, then extracts position-aware text and converts it to markdown — headings detected from font-size ratios, code blocks from monospace detection, tables from both PDF drawing rectangles and text alignment, multi-column reading order handled. Only pages that actually need OCR get routed to it. On the opendataloader benchmark corpus of 200 documents it scored 0.875 overall, edging past liteparse and opendataloader while running the set in under half a second against markitdown's sixteen. Bindings for Python, Node, a browser WebAssembly build, and a CLI. MIT. If your ingestion step is currently "send everything to an OCR service," this is the cheaper default.
Cursor plugins (TypeScript, ~6,700 stars) — Cursor's official plugin repository, and the clearest signal yet that the coding-agent plugin market is a real category and not an Anthropic side quest. Each plugin is a standalone directory with a manifest that can ship skills, agent rules, and MCP server definitions, and the catalog splits between Cursor's own work and a long tail of third-party connectors — GitHub, Playwright, Gmail, Salesforce, Gong, HubSpot, Semrush, and a few dozen more. The interesting entries are the ones about the agent itself: continual-learning rewrites your AGENTS.md from transcripts using only high-signal bullets, orchestrate fans a large task out across parallel cloud agents with planners, workers, and verifiers, and cli-for-agent documents how to design command-line tools an agent can actually run — real flags, help text with examples, idempotency, dry runs. The README states MIT. If you write internal tooling, that last one is the most useful document in the repo.
Heretic (Python, ~30,200 stars) — The most loaded project on today's board, and worth understanding even if you never run it. It removes refusal behavior from transformer models through directional ablation — the technique known as abliteration, from Arditi and colleagues' 2024 refusal-direction work — and wraps it in an Optuna optimizer that co-minimizes two objectives at once: how often the model refuses harmful prompts, and how far its outputs drift from the original. That second objective is the point. On Gemma 3 12B, Heretic's unsupervised run cut refusals from 97 out of 100 to 3, but at a KL divergence of 0.16 against 0.45 and 1.04 for human-made abliterations — meaning far less collateral damage to the model's capabilities. It handles dense models, many multimodal ones, several MoE architectures, and hybrids like Qwen3.5. AGPL-3.0, currently at a 2.0 development version. The honest read: it's a measurement instrument that shows how thin safety alignment really is, published by someone who wants you to be able to take it off.
portless (TypeScript, ~12,000 stars) — Vercel Labs fixing a small problem that turns into a real one once agents are in the loop: port numbers move. Portless runs your dev script through a local proxy and gives it a stable named HTTPS address instead, so a project answers at something like myapp.localhost rather than whichever port happened to be free. It generates and trusts a local certificate authority on first run, assigns the underlying port through the standard environment variable, and injects the right flag for frameworks that ignore that variable — Vite, Astro, Angular, Expo, and friends — while leaving build and test commands alone. Monorepos are covered from one config file, with per-package names and optional turborepo wiring. For humans it means one bookmark that survives a reboot; for an agent it means a URL it can hold across sessions instead of re-discovering localhost every time. Apache-2.0, and still pre-1.0, so pin the version if you install it per project.
Worth watching this week: the plumbing is catching up to the demos. Provenance, ingestion, plugins, and stable addresses are unglamorous, and they're exactly what decides whether an agent you pointed at a repo still works next month.
Which gap hurts you more right now — not knowing why your agent made a change, or feeding it documents it can't read? Tell us in the comments.
Sources: Atlas (GitHub) · Atlas docs · pdf-inspector (GitHub) · opendataloader PDF parser benchmark (GitHub) · Cursor plugins (GitHub) · Heretic (GitHub) · Arditi et al., refusal direction ablation (arXiv) · portless (GitHub)
