Developer Creates Personal Task Manager Allowing Claude Code and OpenCode Agents to Autonomously Execute Marked Tasks
A developer has turned a personal to-do list into an autonomous queue that Claude Code, Codex CLI, and OpenCode agents can read from and write to without constant human prompting. The system, hosted at shar8.app, uses an MCP server over HTTPS so any compatible client can connect using a single endpoint.
Users simply add a task through the web or mobile interface and toggle the 'Agent' flag. When the computer is on, a scheduled agent run detects the task within a minute, claims it exclusively, performs the work locally, and appends the result to the task notes. The task then receives one of three statuses: 'Under review', 'Needs clarification', or 'Agent failed'. Only the human user can close the task.
Supported agent capabilities
The MCP server exposes fifteen tools divided into categories:
- Reading: tasks_list, task_get, inbox_list
- Creation: task_add, inbox_add, subtask_add, task_comment
- Editing: task_edit, task_snooze, task_done, subtask_toggle, task_delete
- Delegation: agent_queue, agent_claim, agent_finish
The first twelve tools are available during interactive sessions; the final three are reserved for scheduled autonomous runs.
Authentication supports two flows. Browser-based OAuth works for interactive clients such as Claude Code and Codex, while long-lived bearer tokens enable headless operation in cron jobs or OpenCode configurations. Revocation takes effect immediately on the next request.
Security controls
Task text is explicitly treated as untrusted data, not instructions. No tools are enabled by default; any external capability such as web search must be added through a separate configuration file. Outbound actions like sending email are disabled unless an explicit allow-list of recipients is provided. All agent output is placed under human review before any further action.
The author notes that an agent connected interactively has full rights including deletion, so users running unattended agents are advised to restrict tools on the client side. Prompt injection remains a theoretical risk mitigated by the data-versus-command distinction and mandatory human oversight.
The solution has been tested on macOS with real Claude subscriptions and scheduled runs; Linux support is implemented and unit-tested while Windows remains in beta.
Related articles
T-Bank Warns Customers of Payment and Transfer Outages
On November 3, T-Bank notified users that payments and transfers may fail due to ongoing technical issues. The bank placed an in-app message stating that the problems are being fixed. Clients confirmed the disruption through reports to Interfax, noting that the online banking interface displays the warning upon login. The outage affects only payments and transfers, while other banking services remain available. No details were provided regarding the root cause, the number of impacted users, or an estimated time for full recovery. Monitoring service DETECTOR404 also recorded the incident, aligning with user complaints and the bank's official notice.
Rostelecom Refactors InfoSec Careers: Matching Employee Skills to Evolving Business Priorities
Rostelecom's information security block developed a systematic approach to reassess employee expertise and redirect talent to new roles when business structures change rapidly. In one case, an architect hired for a specific team was reassigned after the unit was disbanded, initially moving to a similar position that did not fully align with his broader competencies. HR-business partner Olga Lapshina examined the specialist's full background, including prior work in audits, methodology development, regulatory documentation, university teaching, and scientific research, plus strong mentoring abilities with younger staff. These skills matched the needs of the methodology department, leading to a transfer supported by an individual development plan and a mentor via the internal Tochka Rosta platform. Within two months the employee contributed improvements that accelerated preliminary InfoSec audits by 30 percent and risk assessments by 20 percent while expanding threat scenario coverage by 10 percent. The initiative demonstrates Rostelecom's emphasis on horizontal career movement and retention of experienced professionals through structured career tracks.
How to Avoid Becoming the Hero of 'My Program Deleted 800 GB': Safe Recursive Deletion in Bash and Python
A recent Habr article examines dangerous patterns in recursive file deletion scripts that have caused massive data loss incidents, including an 800 GB wipe triggered by Telegram Desktop on Windows. The piece analyzes classic mistakes such as empty variables in rm commands and extra spaces that turned single paths into multiple destructive arguments, referencing the 2015 Steam Linux bug and the 2011 Bumblebee installer error. It provides hardened Bash templates using set -euo pipefail, ${VAR:?} checks, realpath validation, and --one-file-system flags to prevent deletion of forbidden directories or symlinked targets. The Python section introduces a safe_rmtree wrapper that enforces root boundaries, rejects symlinks, uses resolve(strict=True), and checks shutil.rmtree.avoids_symlink_attacks before proceeding. Additional recommendations include dry-run modes, marker files, temporary directory usage, and logging to make deletion operations auditable and reversible where possible.
Hackers tamper with refrigeration units in European supermarkets, setting temperatures to +50 °C
Attackers gained unauthorized access to refrigeration and freezer control systems in supermarkets across several European countries, including Sweden, Belgium, Luxembourg, and Estonia. In multiple locations they altered temperature settings to +50 °C, risking widespread spoilage of perishable goods. The incidents primarily affected older, unpatched Danfoss controllers that had been connected to networks for remote maintenance. Estonian manufacturer Kitman Coldtech reported that one attack on a legacy Danfoss system was detected and stopped within approximately ten minutes, preventing any damage. Similar intrusions were confirmed by Swedish chains ICA and Coop, following earlier incidents in French supermarkets in October that resulted in product losses. Experts note that legacy industrial controllers remain attractive targets because they are often left exposed once placed online for convenience.