¬ just serendipity 🍀

★ Goodbye

serendipity@perrotta.dev (Thiago Perrotta) — Wed, 30 Sep 2026 11:32:43 +0200

♠ Today is my last day at Tulip.

I should write about my experience sometime.

For now, I’ll just say that I had a better experience here than in Google Germany¹.

Pull Request (PR) stats by year of PR creation:

460 (2024)
1,096 (2025)
1,468 (2026 to date)

Clearly LLM assistance has significantly increased my throughput.

Now it’s time to prepare for what’s coming next. ∎

By far. ↩︎

— § —

Reply via email

#bestof #dev #serenity

offboarding: export your own work before the laptop is wiped

serendipity@perrotta.dev (Thiago Perrotta) — Wed, 30 Sep 2026 11:02:24 +0200

♠ Problem statement: what is worth taking home on the last day at work, without taking the company’s code or data?

The line I drew: my work history, my own words, my contacts, my notes. Not source code, not runbooks, not customer data. Everything else the company keeps. Metadata about my contributions is mine to remember; the artifacts are theirs.

I pointed an AI harness at the connectors I already had (GitHub, Jira, Confluence, Gmail, Drive, Calendar, Slack, the HR directory) and asked it to build an inventory. It landed in one folder:

% eza -T -L1 ~/Downloads/offboarding
offboarding
├── README.md
├── resume-highlights.md
├── merged-prs.csv
├── jira-done.jsonl
├── jira-epics.md
├── contacts.csv
├── gmail-index.md
├── emails/
├── drive-index.md
├── drive-files/
├── confluence/
├── calendar-summary.md
├── slack-export.md
├── github-insights.md
├── chrome-bookmarks-work-profile.html
└── claude-memory/

The GitHub part is pure API, no clone. Merged PRs, paginated once:

% gh api graphql --paginate -f query='query($c: String) { viewer {
    pullRequests(first: 100, states: MERGED, after: $c) {
      pageInfo { hasNextPage endCursor }
      nodes { mergedAt repository { nameWithOwner } title additions deletions }
    } } }' --jq '.data.viewer.pullRequests.nodes[]' | jq -s . > merged_prs.json
% jq -r '.[].mergedAt[:4]' merged_prs.json | sort | uniq -c
 892 2024
1160 2025
1436 2026

Titles, dates, and line counts only. That is enough to write a resume bullet later; the diffs stay behind. Same idea for Jira (assignee = currentUser() AND statusCategory = Done) and for Confluence (creator = currentUser()).

Two things were clearly mine and would have been lost: the “working with me” email from week one, and a first-day checklist I mailed to myself. Both went into emails/ verbatim. The Slack kudos channel got the same treatment, because nobody will write a reference from memory two years from now.

The README in the folder lists what was deliberately not exported: source code, PR descriptions, runbook bodies, performance reviews. ∎

— § —

Reply via email

#bloggify #dev #git

JIRA: backfill tickets from merged pull requests

serendipity@perrotta.dev (Thiago Perrotta) — Tue, 29 Sep 2026 11:21:17 +0200

♠ Problem statement: how can I catch up JIRA when pull requests have already (been) merged without tickets?

I wrote a local /backfill-jira skill for my AI harnesses. It compares recent merged PRs with existing issues before it creates anything. This is its structure; internal projects, repositories, queries, and field IDs are omitted:

% rg -n '^### Phase' ~/.claude/skills/backfill-jira/SKILL.md
31:### Phase A — gather + reconcile (read-only)
72:### Phase B — create the backfill tickets
125:### Phase C — confirm

The unit of work is a theme, not a PR. Several PRs can implement one change; one PR can also be routine enough to need no ticket. The skill checks PR references and matching issue summaries before declaring a gap. Existing backlog issues count as coverage.

The report rule in the skill is explicit:

4. **Report.** Print a table of every PR → (existing ticket | NEW theme-N | skipped-routine) and a
   separate list of the gap themes to create. The counts must reconcile: covered + new + skipped =
   total PRs. Don't let "get every PR to a theme" pressure you into merging unrelated skipped PRs
   into a theme just to shrink the skipped list.

Phase B creates one ticket for each uncovered theme, marks work as complete, and reads the status back. It also checks the sprint assignment after writing it. Neither a successful create response nor an attempted status change is proof that the final fields stuck.

The skill deliberately leaves routine work alone:

- Don't create per-PR tickets by default — one ticket per theme keeps signal high. **Never create a
  "grab bag" / "catch-all" / "hygiene" ticket that lumps together unrelated PRs** just to get to
  zero gaps — each ticket must describe one coherent, describable piece of work. If a PR is
  genuinely routine and not worth tracking on its own (a version bump, a dependency bump, a typo
  fix) and doesn't fit an existing theme, leave it **uncovered**: list it in the report as *skipped
  (routine, no ticket)* rather than inventing a ticket to absorb it.

A second pass over the same window checks whether the new tickets now cover the gaps. Zero new gaps matters more than zero skipped PRs. ∎

— § —

Reply via email

#bloggify #dev #git

typst: reusable polylux slides with section navigation

serendipity@perrotta.dev (Thiago Perrotta) — Mon, 28 Sep 2026 23:58:53 +0200

♠ Previously.

Problem statement: how can I reuse a Typst slide layout without rebuilding its section navigation every time?

Here is the complete Polylux template. Put these three files in one directory. theme.typ owns the Metropolis-inspired layout and Frankfurt-style navigation: section names above one dot per content slide. Its state records the section counts and active slide. new-section creates a divider without a dot; slide adds a dot; untracked-slide is for title or closing pages.

// =============================================================================
// Metropolis theme + Frankfurt-style navigation bar with mini-frame dots
// =============================================================================
// Visual style: Metropolis (navy blue, light blue accent, clean typography)
// Navigation:   Frankfurt (section names + circle dots for slide progress)
// =============================================================================

#import "@preview/polylux:0.4.0": *
#let _polylux-slide = slide

// ---------------------------------------------------------------------------
// Colors — Navy blue palette
// ---------------------------------------------------------------------------
#let dark-teal = rgb("#1a2744")    // navy blue (primary dark)
#let bright = rgb("#4a90d9")       // accent / emphasis (medium blue)
#let brighter = rgb("#a8c4e0")     // muted light blue
#let bg = white.darken(2%)
#let fg = dark-teal

// ---------------------------------------------------------------------------
// Navigation state — tracks slides per section for mini-frame dots
// ---------------------------------------------------------------------------
#let _nav-sections = state("nav-sections", ())       // [{name, count}, ...]
#let _nav-current-sec = state("nav-current-sec", -1)  // index into sections
#let _nav-current-frame = state("nav-current-frame", 0)

#let _begin-section(name) = {
  _nav-sections.update(secs => {
    secs.push((name: name, count: 0))
    secs
  })
  _nav-current-sec.update(i => i + 1)
  _nav-current-frame.update(_ => 0)
}

#let _count-frame() = {
  context {
    let sec-idx = _nav-current-sec.get()
    if sec-idx >= 0 {
      _nav-current-frame.update(f => f + 1)
      _nav-sections.update(secs => {
        if sec-idx < secs.len() {
          secs.at(sec-idx).count += 1
        }
        secs
      })
    }
  }
}

// ---------------------------------------------------------------------------
// Navigation header — section names + mini-frame circles
// ---------------------------------------------------------------------------
#let _nav-header() = context {
  let all-secs = _nav-sections.final()
  let curr-sec = _nav-current-sec.get()
  let curr-frame = _nav-current-frame.get()

  if all-secs.len() == 0 { return }

  set text(fill: white, size: 0.5em, weight: "bold")

  let n = all-secs.len()

  // Row 1: Section names
  let names-row = all-secs.enumerate().map(((i, sec)) => {
    let is-current = i == curr-sec
    let is-past = i < curr-sec
    let name-color = if is-current { white } else if is-past { white.darken(10%) } else { white.darken(35%) }
    align(center, text(fill: name-color, sec.name))
  })

  // Row 2: Mini-frame dots (aligned under each section name)
  let dots-row = all-secs.enumerate().map(((i, sec)) => {
    let is-current = i == curr-sec
    let is-past = i < curr-sec

    let dots = range(sec.count).map(j => {
      let frame-num = j + 1
      let dot-fill = if is-past {
        white.darken(10%)
      } else if is-current and frame-num < curr-frame {
        white.darken(5%)
      } else if is-current and frame-num == curr-frame {
        bright
      } else {
        none
      }
      let dot-stroke = if dot-fill == none { 0.6pt + white.darken(30%) } else { none }
      let fill = if dot-fill == none { dark-teal } else { dot-fill }
      box(circle(radius: 2.5pt, fill: fill, stroke: dot-stroke))
    })
    align(center, dots.join(h(2.5pt)))
  })

  // Combine into a two-row grid
  block(width: 100%, fill: dark-teal, inset: (x: 0.6em, y: 0.3em),
    grid(
      columns: (1fr,) * n,
      row-gutter: 0.25em,
      ..names-row,
      ..dots-row,
    )
  )
}

// ---------------------------------------------------------------------------
// Slide title header (Metropolis style — below nav bar)
// ---------------------------------------------------------------------------
#let _title-header = toolbox.next-heading(h => {
  show: toolbox.full-width-block.with(fill: dark-teal, inset: (x: 1em, y: 0.6em))
  set align(horizon)
  set text(fill: bg, size: 1em)
  strong(h)
})

// ---------------------------------------------------------------------------
// Footer — Metropolis style
// ---------------------------------------------------------------------------
#let _the-footer(content) = {
  set text(size: 0.7em)
  show: pad.with(0.5em)
  set align(bottom)
  context text(fill: fg.lighten(40%), content)
  h(1fr)
  toolbox.slide-number
}

// ---------------------------------------------------------------------------
// Progress bar — Metropolis style (blue)
// ---------------------------------------------------------------------------
#let progress-bar = toolbox.progress-ratio(ratio => {
  set grid.cell(inset: (y: 0.03em))
  grid(
    columns: (ratio * 100%, 1fr),
    grid.cell(fill: bright)[],
    grid.cell(fill: brighter)[],
  )
})

// ---------------------------------------------------------------------------
// Public API: slide (tracked), new-section, focus, alert, note, divider
// ---------------------------------------------------------------------------

/// Content slide — automatically tracked in the navigation bar.
/// Use `= Title` as the first line for the slide title.
#let slide(body) = {
  _count-frame()
  _polylux-slide(body)
}

/// Section divider slide — registers a new section and shows a title card.
/// Not counted in mini-frame dots.
#let new-section(name) = {
  _begin-section(name)
  _polylux-slide({
    set page(header: none, footer: none)
    toolbox.register-section(name)
    show: pad.with(20%)
    set text(size: 1.5em, fill: fg)
    name
    progress-bar
  })
}

/// Focus slide — inverted colors for key messages.
#let focus(body) = context {
  set page(header: none, footer: none, fill: dark-teal, margin: 2em)
  set text(fill: bg, size: 1.5em)
  set align(center + horizon)
  body
}

/// Untracked slide — for title, closing, etc. No navigation counting.
#let untracked-slide(body) = _polylux-slide(body)

/// Blue divider line
#let divider = line(length: 100%, stroke: 0.1em + bright)

/// Alert text (blue bold)
#let alert(body) = text(fill: bright, weight: "bold", body)

/// Two-column layout helper — e.g. diagram left, bullets right
#let side-by-side(left, right, ratio: 1fr) = {
  grid(
    columns: (ratio, 1fr),
    gutter: 1em,
    left, right,
  )
}

/// Captioned image from assets directory
#let fig(path, caption: none, width: 80%) = {
  align(center,
    figure(
      image("assets/" + path, width: width),
      caption: if caption != none { text(size: 0.75em, caption) },
    )
  )
}

/// Speaker notes — pass `--input notes=false` to hide
#let note(body) = {
  let hidden = sys.inputs.at("notes", default: "true") == "false"
  if not hidden {
    place(bottom + left, dx: 0pt, dy: 0.8em)[
      #block(
        width: 100%,
        inset: 6pt,
        fill: rgb("#fef9c3").transparentize(20%),
        radius: 4pt,
        text(size: 10pt, style: "italic", fill: fg, body),
      )
    ]
  }
}

// ---------------------------------------------------------------------------
// Theme setup — call as:  #show: theme.setup.with(...)
// ---------------------------------------------------------------------------
#let setup(
  footer: none,
  navbar: true,
  text-font: "Avenir Next",
  math-font: "Avenir Next",
  code-font: "IBM Plex Mono",
  text-size: 22pt,
  body,
) = {
  set page(
    paper: "presentation-16-9",
    fill: bg,
    margin: (top: if navbar { 4.5em } else { 3em }, left: 1.2em, right: 1.2em, bottom: 1.8em),
    header: {
      set align(top)
      if navbar { toolbox.full-width-block[#_nav-header()] }
      _title-header
    },
    footer: _the-footer(footer),
  )

  set text(
    font: text-font,
    size: text-size,
    fill: fg,
  )
  set strong(delta: 100)
  show math.equation: set text(font: math-font)
  show raw: set text(font: code-font)
  show raw.where(block: true): it => block(
    width: 100%,
    fill: luma(240),
    inset: 10pt,
    radius: 3pt,
    stroke: 0.5pt + luma(200),
    it,
  )
  set align(horizon)
  set list(spacing: 1.4em)
  set enum(spacing: 1.4em)
  show emph: it => text(fill: bright, it.body)
  show heading.where(level: 1): _ => none

  body
}

#import "theme.typ"
#import theme: slide, untracked-slide, new-section, alert, note

#show: theme.setup.with(
  footer: [Slide template],
  text-font: "Libertinus Serif",
  code-font: "DejaVu Sans Mono",
  text-size: 22pt,
)

#untracked-slide[
  #set page(header: none, footer: none)
  #set align(center + horizon)
  #text(size: 1.5em, weight: "bold")[Slide template]
]

#new-section[First section]

#slide[
  = First slide

  A #alert[highlight] and a speaker note.

  #note[This note is absent from the audience PDF.]
]

#slide[
  = Second slide

  The navigation bar counts this slide within the first section.
]

#new-section[Second section]

#slide[
  = Third slide

  The section changes, and the dot count starts again.
]

watch:
    typst watch --input notes=true slides.typ

all: build audience

build:
    typst compile --input notes=true slides.typ

alias speaker := build

audience:
    typst compile --input notes=false slides.typ slides-audience.pdf

slides.typ is a minimal deck with two sections, three tracked slides, an untracked title, and a speaker note. Change its content and fonts for a new presentation; keep the theme and build recipes.

Justfile produces two PDFs from the same source. notes=false hides speaker notes from the audience copy:

% just all
typst compile --input notes=true slides.typ
typst compile --input notes=false slides.typ slides-audience.pdf

∎

— § —

Reply via email

#bloggify #dev #meta

talisman: exempt git commit SHAs

serendipity@perrotta.dev (Thiago Perrotta) — Mon, 28 Sep 2026 13:02:01 +0200

♠ Problem statement: make Talisman stop reporting full Git commit SHAs as hex-encoded secrets (false positives).

A typical false positive ‘violation’ looks like the following:

% printf '%s\n' '675adb16677f8d3615f499f43b6ba26e04cfffa4' > talisman-commit-sha-repro.txt
% git add talisman-commit-sha-repro.txt
% prek run talisman-commit --files talisman-commit-sha-repro.txt
talisman.................................................................Failed
- hook id: talisman-commit
- exit code: 1

Talisman Report:
+-------------------------------+------------------------------------------+----------+
|             FILE              |                  ERRORS                  | SEVERITY |
+-------------------------------+------------------------------------------+----------+
| talisman-commit-sha-repro.txt | Expected file to not contain             | high     |
|                               | hex encoded texts such as:               |          |
|                               | 675adb16677f8d3615f499f43b6ba26e04cfffa4 |          |
+-------------------------------+------------------------------------------+----------+

To stop it once and for all, add a global allowed pattern for full lowercase Git object IDs:

diff --git .talismanrc .talismanrc
index 68deb2d73c..2e4c8f7b95 100644
--- .talismanrc
+++ .talismanrc
@@ -1,14 +1,15 @@
 # yaml-language-server: $schema=schemas/talismanrc.json

 # Docs: https://thoughtworks.github.io/talisman/docs/configuring-talisman/ignoring/
 threshold: medium
 allowed_patterns:
   # keep-sorted start
+  - "\\b[0-9a-f]{40}\\b"
   - "https://gist\\.github\\.com/\\w+/\\w+"
   - "https://github\\.com/[\\w.-]+/[\\w.-]+/blob/[0-9a-f]{40}"
   - "https://github\\.com/[\\w.-]+/[\\w.-]+/commit/[0-9a-f]{40}"
   - "https://github\\.com/[\\w.-]+/[\\w.-]+/tree/[0-9a-f]{40}"
   - "rev: \\w+ # frozen:"
   # keep-sorted end

 fileignoreconfig:

Test it:

% prek run talisman-commit --files talisman-commit-sha-repro.txt
talisman.................................................................Passed

Talisman cannot prove that arbitrary hexadecimal text names a Git object. This rule deliberately exempts every standalone, lowercase, 40-character hexadecimal value. ∎

— § —

Reply via email

#dev #git #security

postgres: point-in-time restore to roll back a breaking upgrade

serendipity@perrotta.dev (Thiago Perrotta) — Thu, 24 Sep 2026 02:11:43 +0200

♠ Problem statement: how to roll back a self-hosted app upgrade when its database migrations have no down path?

A new release of an internal tool started to enforce a license limit that the old one did not. Pinning the old image back in GitOps was not enough:

[ERROR] Migration failed - inconsistent migrations
Traceback (most recent call last):
  File "/etc/service/app/./run", line 145, in <module>
    main()
subprocess.CalledProcessError: Command '['/usr/local/bin/app', 'migrate', '--verbosity=debug']' returned non-zero exit status 1.

The old binary refused to start against the new schema. RDS automated backups were on, with 30-day retention:

% aws rds describe-db-instance-automated-backups \
    --db-instance-identifier shared-db \
    --query 'DBInstanceAutomatedBackups[].[Status,RestoreWindow.EarliestTime,RestoreWindow.LatestTime]' \
    --output table
----------------------------------------------------------------------
|                 DescribeDBInstanceAutomatedBackups                 |
+--------+-----------------------------+-----------------------------+
|  active|  2026-08-24T22:41:45+00:00  |  2026-09-23T22:41:45+00:00  |
+--------+-----------------------------+-----------------------------+

Several apps share that instance. An in-place restore would have rolled back all of their databases. RDS point-in-time restore always creates a new instance anyway:

% aws rds restore-db-instance-to-point-in-time \
    --source-db-instance-identifier shared-db \
    --target-db-instance-identifier shared-db-restore-20260910 \
    --restore-time 2026-09-10T12:00:00Z \
    --db-instance-class db.t4g.micro \
    --no-multi-az --no-publicly-accessible --no-deletion-protection
shared-db-restore-20260910	creating

With the app scaled to zero, a throwaway pod in the cluster moved only the app’s database across:

% pg_dump -h shared-db-restore-20260910.xxx.rds.amazonaws.com \
    -d app -Fc -f /tmp/app.dump
% psql -h shared-db.xxx.rds.amazonaws.com -d postgres \
    -c "ALTER DATABASE app RENAME TO app_upgraded_bak;" \
    -c "CREATE DATABASE app OWNER app;"
% pg_restore -h shared-db.xxx.rds.amazonaws.com \
    -d app --no-owner --role=app -j 2 /tmp/app.dump

Rename, not drop: rollback stays two ALTER DATABASE statements away. With the old schema back, the pinned image started cleanly:

[INFO] Migrations to perform
[INFO] Performing migration for add-unified-comment-output-details
[INFO] Completed migration for add-unified-comment-output-details
[INFO] Migration complete
[INFO] Starting server

The cost: everything the app wrote after the restore point was gone.

🤖 Drafted with /bloggify. ∎

— § —

Reply via email

#aws #bloggify #dev #kubernetes

↗ Reply to: Put an AV test at the start of your slides

serendipity@perrotta.dev (Thiago Perrotta) — Sun, 20 Sep 2026 00:13:19 +0200

♠ Terence Eden:

For years, I’ve had a test-card at the start of my slides. Before I start my talk, I can immediately see if the aspect ratio is wrong, colours are off, or any other visual issues with the presentation.

In fact, it’s brilliant and simple. ∎

— § —

Reply via email

#serenity %commentary

↗ Reply to: I don't like LLMs

serendipity@perrotta.dev (Thiago Perrotta) — Sun, 20 Sep 2026 00:10:37 +0200

♠ Martin Fowler:

One of my most successful life-hacks is to avoid people I don’t like or don’t trust. I decline to interact with them socially, and make a deliberate effort to avoid working with them too, even if they are doing much that is beneficial. I feel that hanging out with pleasant, capable people, the people with integrity, has made my life a far better one. Hence my visceral dislike of interacting with an LLM that’s not just making a pretense of being human, but also posing as the kind of human I walk away from.

Words of wisdom. ∎

— § —

Reply via email

#ai #dev #serenity %commentary

terraform: destroy a deleted project from git history

serendipity@perrotta.dev (Thiago Perrotta) — Thu, 17 Sep 2026 14:15:09 +0200

♠ Problem statement: how can I run terraform destroy after deleting a project from the current Git checkout?

Deleting Terraform configuration does not destroy resources from its old state. My just destroy wrapper could no longer find the project:

% just destroy g08-opencost
Resolved path: g08-opencost
Error handling -chdir option: chdir g08-opencost: no such file or directory
error: recipe `destroy` failed with exit code 1

The last usable configuration is the parent of the commit that deleted its path. I taught the recipe to find and extract that revision into a temporary directory:

-    resolved_path=$(just _resolve_and_echo "{{ module_path }}")
+    resolved_path=$(just _resolve_path "{{ module_path }}")
+    historical_checkout=""
+    cleanup() {
+        if [[ -n "$historical_checkout" ]]; then
+            rm -rf "$historical_checkout"
+        fi
+    }
+    trap cleanup EXIT
+
+    if [[ ! -d "$resolved_path" ]]; then
+        project_name="${resolved_path%/}"
+        project_name="${project_name##*/}"
+        project_path="standalone/$project_name"
+        deletion_commit=$(git log -1 --format=%H --diff-filter=D -- "$project_path")
+
+        if [[ -z "$deletion_commit" ]] || ! git cat-file -e "$deletion_commit^:$project_path" 2>/dev/null; then
+            just _error "Project not found in current checkout or Git history: {{ module_path }}"
+            exit 1
+        fi
+
+        historical_commit=$(git rev-parse "$deletion_commit^")
+        historical_checkout=$(mktemp -d)
+        git archive "$historical_commit" | tar -x -C "$historical_checkout"
+        resolved_path="$historical_checkout/$project_path"
+        just _info "Project was deleted. Using $project_path from commit ${historical_commit:0:12}."
+    fi

The normal backend initialization and destroy path can then run unchanged:

% just destroy g08-opencost
Project was deleted. Using standalone/g08-opencost from commit fb82317c0010.
Resolved path: /var/folders/yr/6sw3yylx6gjcy5jr38d6j6000000gn/T/tmp.0als997N54/standalone/g08-opencost
...
Plan: 0 to add, 0 to change, 8 to destroy.

Do you really want to destroy all resources?
  Terraform will destroy all your managed infrastructure, as shown above.
  There is no undo. Only 'yes' will be accepted to confirm.

  Enter a value:
Error: error asking for approval: EOF

Releasing state lock. This may take a few moments...

No automatic approval: the historical configuration only gets Terraform back to its usual confirmation prompt. ∎

— § —

Reply via email

#bloggify #dev #git #terraform

@claude: troubleshoot

serendipity@perrotta.dev (Thiago Perrotta) — Wed, 16 Sep 2026 17:41:40 +0200

♠ Claude Tag:

Claude Tag is a new way for teams to work with Claude.

We’re starting on Slack, which Claude can join as a team member. Grant Claude access to selected channels, and connect it to whichever tools, data—and even codebases—you choose. Then, anyone in the channel can tag @Claude in, and delegate tasks to it while they focus on other work. Claude builds context by remembering relevant information from the channels it’s in, and can plan out tasks to complete in the future.

Reply @claude: troubleshoot in any Slack thread to address most issues and teammate support questions.

The Sonnet model is good enough to power it.

Why do I (still) have a job anyway?! ∎

— § —

Reply via email

#ai #dev #serenity

lf: edit files and enter directories with enter

serendipity@perrotta.dev (Thiago Perrotta) — Wed, 16 Sep 2026 16:41:39 +0200

♠ Problem statement: in lf, how can <Enter> edit files without trying to edit directories?

e already opens the selected file in $EDITOR. My first keybinding mapping attempt copied its default command:

 # Edit file: 'e' (mapped out-of-the-box)
+map <enter> $$EDITOR "$f"

This worked for files, but it also sent directories to the editor, which is unwelcome.

Next up: lf’s built-in open command already has the split behavior I wanted for directories:

% lf -doc | sed -n '533,540p'
Change the current working directory to the parent directory.

open (default l and <right>)

If the current file is a directory, then change the current directory to
it, otherwise, execute the open command. A default open command is
provided to call the default system opener asynchronously with the
current file as the argument. A custom open command can be defined to

So I kept the file branch in $EDITOR and sent the directory branch back to lf’s open command:

cmd edit-or-open ${{
    if [ -d "$f" ]; then
        "$lf" -remote "send $id open"
    else
        $EDITOR "$f"
    fi
}}
map <enter> edit-or-open

This works exactly as intended!

The complete lf configuration lives in my dotfiles. ∎

— § —

Reply via email

#bloggify #dev #linux

pi: stop repeated macos keychain prompts for mcp oauth

serendipity@perrotta.dev (Thiago Perrotta) — Tue, 08 Sep 2026 13:09:35 +0200

♠ Problem statement: why did Pi keep asking for my macOS login keychain password during MCP OAuth authentication?

/mcp-auth grafana opened the same prompt again after I entered the correct password and selected Allow:

pi wants to use your confidential information stored in “pi-mcp-adapter.oauth” in your keychain.

pi-mcp-adapter stores OAuth credentials in the operating system credential store. Its Grafana record name is a SHA-256 hash:

% node -e 'const {createHash}=require("crypto"); console.log("sha256-" + createHash("sha256").update("grafana").digest("hex"))'
sha256-cace491b69555e8d0f77747d47ae54e31ce4cc322fe51a7bdcf64402f3676ebf

The Keychain ACL still allowed old Homebrew Node executables:

% security dump-keychain -a | rg -A18 'sha256-cace491b69555e8d0f77747d47ae54e31ce4cc322fe51a7bdcf64402f3676ebf"'
    entry 1:
        authorizations (6): decrypt derive export_clear export_wrapped mac sign
        don't-require-password
        description: pi-mcp-adapter.oauth
        applications (2):
            0: /opt/homebrew/Cellar/node/26.6.0/bin/node (status -67068)
                requirement: cdhash H"ea8d578543c9d8c21b74e26f7976cc30b60e24a5"
            1: /opt/homebrew/Cellar/node/26.5.0_1/bin/node (status -67068)
                requirement: cdhash H"4947cbedfdb054cda3708de8c0b22946c4fd98f1"

Pi now used Homebrew Node 26.8.1 with a different ad-hoc signature:

% codesign -dv --verbose=4 /opt/homebrew/Cellar/node/26.8.1/bin/node 2>&1 | rg 'Identifier|CDHash|TeamIdentifier'
Identifier=node-55554944b8d19d4157093cf1805ecde9a77d4850
CandidateCDHash sha256=cead962814af248488bb6597ee22a32fc23d00a1
CandidateCDHashFull sha256=cead962814af248488bb6597ee22a32fc23d00a1aac036bb431b750dd5120163
CDHash=cead962814af248488bb6597ee22a32fc23d00a1
TeamIdentifier=not set

The password was valid. macOS did not trust this new executable to read the old item. Selecting Allow authorized one access, so the next read prompted again.

I removed the base record and its two credential chunks, then authenticated again:

% service=pi-mcp-adapter.oauth
% base=sha256-cace491b69555e8d0f77747d47ae54e31ce4cc322fe51a7bdcf64402f3676ebf
% security dump-keychain 2>/dev/null \
    | sed -n 's/^[[:space:]]*"acct"<blob>="\([^"]*\)"/\1/p' \
    | rg "^${base}(\.chunk\.[a-f0-9]{16}\.[0-9]+)?$" \
    | while read -r account; do
        security delete-generic-password -s "$service" -a "$account"
      done
password has been deleted.
password has been deleted.
password has been deleted.

A future Homebrew Node update would change its code hash again. The official Node binary installed by Mise has a stable Developer ID requirement instead:

% codesign -dr - ~/.local/share/mise/installs/node/latest/bin/node 2>&1
designated => identifier node and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = HX7739G8FX

Installing Pi through that Node avoids tying Keychain access to one Homebrew binary hash:

% npm install -g --ignore-scripts @earendil-works/pi-coding-agent

∎

— § —

Reply via email

#bloggify #dev #macos #pi #security

pi: approve several pull requests at once

serendipity@perrotta.dev (Thiago Perrotta) — Tue, 08 Sep 2026 12:15:25 +0200

♠ Previously.

Problem statement: how can I approve several reviewed pull requests without opening each one individually?

I pasted six pull request URLs into Pi and asked it to approve all of them. It ran the same gh command for each URL:

prs=(
  https://github.com/[redacted]/[redacted]/pull/7692
  https://github.com/[redacted]/[redacted]/pull/7695
  https://github.com/[redacted]/[redacted]/pull/7689
  https://github.com/[redacted]/[redacted]/pull/7694
  https://github.com/[redacted]/[redacted]/pull/7693
  https://github.com/[redacted]/[redacted]/pull/36196
)
status=0
for pr in "${prs[@]}"; do
  if gh pr review --approve "$pr"; then
    printf 'APPROVED %s\n' "$pr"
  else
    printf 'FAILED %s\n' "$pr" >&2
    status=1
  fi
done
exit "$status"

APPROVED https://github.com/[redacted]/[redacted]/pull/7692
APPROVED https://github.com/[redacted]/[redacted]/pull/7695
APPROVED https://github.com/[redacted]/[redacted]/pull/7689
APPROVED https://github.com/[redacted]/[redacted]/pull/7694
APPROVED https://github.com/[redacted]/[redacted]/pull/7693
APPROVED https://github.com/[redacted]/[redacted]/pull/36196

One prompt, six approvals, no repository checkouts. ∎

— § —

Reply via email

#bloggify #dev #git #pi

espanso: restart a stale daemon after upgrading

serendipity@perrotta.dev (Thiago Perrotta) — Mon, 07 Sep 2026 15:03:27 +0200

♠ Problem statement: why did Espanso stop expanding text while its service was running?

The CLI reported a healthy service on version 2.4.1:

% espanso --version
2.4.1
% espanso status
espanso is running

The daemon log disagreed:

% rg 'espanso version:' ~/Library/Caches/espanso/espanso.log | tail -1
16:50:24 [daemon(2251)] [INFO] espanso version: 2.4.0

The app had been upgraded on September 3, but the launcher and daemon still came from August 24. Restarting the worker had not replaced either one:

% ps -p 1899,2251,92631 -o pid,lstart,command
  PID STARTED                      COMMAND
 1899 Mon Aug 24 16:50:17 2026     /Applications/Espanso.app/Contents/MacOS/espanso launcher
 2251 Mon Aug 24 16:50:23 2026     /Applications/Espanso.app/Contents/MacOS/espanso daemon
92631 Mon Sep  7 14:55:26 2026     /Applications/Espanso.app/Contents/MacOS/espanso worker --monitor-daemon --start-reason manual_restart

A full service restart replaced all three processes:

% espanso service restart
% ps -p "$(pgrep -d, -f '/Applications/Espanso.app/Contents/MacOS/espanso (launcher|daemon|worker)')" -o pid,lstart,command
  PID STARTED                      COMMAND
 3049 Mon Sep  7 15:01:47 2026     /Applications/Espanso.app/Contents/MacOS/espanso launcher
 3063 Mon Sep  7 15:01:47 2026     /Applications/Espanso.app/Contents/MacOS/espanso daemon
 3064 Mon Sep  7 15:01:47 2026     /Applications/Espanso.app/Contents/MacOS/espanso worker --monitor-daemon
% rg 'espanso version:' ~/Library/Caches/espanso/espanso.log | tail -1
15:01:47 [daemon(3063)] [INFO] espanso version: 2.4.1

Text expansion worked again.

So now I’ll need to remember to restart espanso whenever it is upgraded. ∎

— § —

Reply via email

#bloggify #dev #macos

Gen AI is the future

serendipity@perrotta.dev (Thiago Perrotta) — Mon, 07 Sep 2026 09:56:38 +0200

♠ Just an ordinary day with OpenAI inference via pi:

Error: Codex error: Our servers are currently overloaded. Please try again later.

∎

— § —

Reply via email

#ai #serenity

pi: git-ai: trace code commits back to agent sessions

serendipity@perrotta.dev (Thiago Perrotta) — Mon, 07 Sep 2026 09:26:59 +0200

♠ Git AI records agent checkpoints in Git notes¹, without changing commit messages or repository files.

In order to integrate it with Pi we use an extension, because Git AI must observe file and Bash tool calls:

const GIT_AI_BIN = join(homedir(), '.git-ai', 'bin', 'git-ai');

const child = spawn(GIT_AI_BIN, ['checkpoint', 'pi', '--hook-input', 'stdin'], {
  stdio: ['pipe', 'ignore', 'ignore'],
});

The extension listens before and after each mutating call. It sends Pi session ID, model, tool, working directory, and touched files to git-ai checkpoint.

In a shell script in my dotfiles, I configured git-ai:

# Git AI daemon receives Git Trace2 events through per-user socket.
if command -v git-ai >/dev/null 2>&1; then
  export GIT_TRACE2_EVENT="af_unix:stream:${GIT_AI_DAEMON_TRACE_SOCKET:-$HOME/.git-ai/internal/daemon/trace2.sock}"
  export GIT_TRACE2_EVENT_NESTING=0
fi

After restarting Pi, code attribution starts to appear alongside normal git blame calls²:

% git ai blame src/main.rs
442dfde2 (pi 2026-09-05 14:29:59 +0200 1) fn main() { println!("pi"); }

The commit note contains the useful attribution / provenance snippet:

"sessions": {
  "s_82565459b433c5": {
    "agent_id": {
      "tool": "pi",
      "id": "pi-extension-test",
      "model": "gpt-5.6-sol"
    }
  }
}

Now a suspicious line can lead from Git history to the exact Pi session. The session ID can then subsequently be searched with fr or resumed in Pi.

Other useful commands with real examples:

% git ai show HEAD
STYLE.md
  s_f2908643b7ce0d::t_739223c8b9befd 12,29,48
---
{
  "schema_version": "authorship/3.0.0",
  "git_ai_version": "1.7.2",
  "base_commit_sha": "d225f5e635bbf5494574591580af8abf93da9480",
  "prompts": {},
  "sessions": {
    "s_f2908643b7ce0d": {
      "agent_id": {
        "tool": "pi",
        "id": "01a07acd-e9c7-759f-84b4-107f9ebc2556",
        "model": "gpt-5.6-sol"
      },
      "human_author": "Thiago Perrotta <{redacted_email}>"
    }
  }
}

% git log --show-notes=ai
commit d225f5e635bbf5494574591580af8abf93da9480 (HEAD -> master)
Author: Thiago Perrotta <{redacted_email}>
Date:   Mon Sep 7 09:40:01 2026 +0200

    docs: require problem statement questions

Notes (ai):
    STYLE.md
      s_f2908643b7ce0d::t_739223c8b9befd 12,29,48
    ---
    {
      "schema_version": "authorship/3.0.0",
      "git_ai_version": "1.7.2",
      "base_commit_sha": "d225f5e635bbf5494574591580af8abf93da9480",
      "prompts": {},
      "sessions": {
        "s_f2908643b7ce0d": {
          "agent_id": {
            "tool": "pi",
            "id": "01a07acd-e9c7-759f-84b4-107f9ebc2556",
            "model": "gpt-5.6-sol"
          },
          "human_author": "Thiago Perrotta <{redacted_email}>"
        }
      }
    }

A little known git feature. ↩︎
Of course, the LLM decided to choose a Rust example to test the integration. Of course. It certainly wouldn’t have been my first choice. ↩︎

∎

— § —

Reply via email

#ai #dev #git #pi

typst: color-coded choir parts

serendipity@perrotta.dev (Thiago Perrotta) — Thu, 03 Sep 2026 16:54:39 +0200

♠ Previously.

Problem statement: a plain lyrics sheet does not say who sings what. In a choir rehearsal one has to annotate every line by hand: sopranos here, everybody on the refrain.

Two files, one helper, no music engraving:

% ls
AGENTS.md  main.pdf  main.typ  template.typ

template.typ holds the styling only — page, font, headings:

#let template(doc) = {
  set page(paper: "a4", margin: (left: 2cm, right: 2cm, top: 2cm, bottom: 2cm))
  set text(font: "Libertinus Serif", size: 11pt, lang: "en")
  set heading(numbering: none)

  show heading.where(level: 1): it => {
    set text(size: 24pt, weight: "bold")
    set align(center)
    it
    v(0.5em)
  }

  doc
}

main.typ holds the content, plus a parts_line() that draws one colored square per voice above the lyrics:

#let parts_line(parts_colors, lyrics) = {
  let squares = parts_colors.map(((part, color)) => {
    box(width: 1em, height: 1em, fill: color, stroke: rgb("#000"), inset: 0pt)
  }).join(h(0.2em))

  set align(left)
  [#squares \ #lyrics]
}

#let soprano = rgb("#ffc0cb")
#let alto = rgb("#90ee90")
#let tenor = rgb("#ffffff")
#let bass = rgb("#87ceeb")
#let all = rgb("#f0f0f0")

The verse then reads almost like the score:

== Verse 1

#parts_line((("S", soprano), ("B", bass)), "Oh the weather outside is frightful,")
#parts_line((("all", all),), "And since we've no place to go.")
#parts_line((("S", soprano), ("A", alto), ("T", tenor), ("B", bass)), "Let It Snow! Let It Snow! Let It Snow!")

Two pages, a sixth of a second:

% typst --version
typst 0.15.1 (unknown commit)

% time typst compile main.typ
typst compile main.typ  0.04s user 0.07s system 63% cpu 0.169 total

Tenor is white and only visible because of the black stroke, which is a happy accident: on a photocopy it still reads as a distinct part. The "S" and "B" strings are ignored by the helper — they are there so the source stays readable without counting colors. ∎

— § —

Reply via email

#bloggify #dev

pre-commit: internal hook repos, take two

serendipity@perrotta.dev (Thiago Perrotta) — Thu, 03 Sep 2026 14:03:03 +0200

♠ Previously.

Problem statement: an internal hook repo has to be cloned by CI and by every developer, and the credentials each side owns are not the same.

A .pre-commit-config.yaml refers to hooks by repository:

repos:
  - repo: https://github.com/<org>/pre-commit-hooks
    rev: 528e165cff8a11bc4f9f49a9b25f3249e09e4237 # frozen: v0.0.22
    hooks:
      - id: just-format

Before every run, prek clones each of those repositories into its cache. A public repo clones anonymously and nobody thinks about it again. Ours moved out of a personal account into an org-owned repo, which is INTERNAL — so the clone now needs credentials, from whoever is running.

In June I gave the runners a short-lived app token and called it done. CI went green. The next morning, a coworker could no longer commit:

$ prek run -a
error: Failed to init hooks
  caused by: Failed to initialize repo `https://github.com/<org>/pre-commit-hooks`
  caused by: Command `git full clone` exited with an error:

[status]
exit status: 128

[stderr]
fatal: could not read Username for 'https://github.com': terminal prompts disabled

Not a permissions problem: the same coworker could open and clone the repo by hand. prek clones non-interactively, and an internal repo over https:// needs a credential helper to answer. Mine had a token cached; theirs did not:

% git -c credential.helper= clone https://github.com/<org>/pre-commit-hooks
Cloning into 'pre-commit-hooks'...
fatal: could not read Username for 'https://github.com': terminal prompts disabled

SKIP= does not rescue this. The clone happens while hooks are being initialized, long before SKIP is consulted, so the whole run dies and commits with it. Three days after the migration, I reverted it everywhere:

4f74a46a Revert: ci: migrate pre-commit hooks to <org>/pre-commit-hooks
ea747ebe Revert: ci: migrate pre-commit hooks to <org>/pre-commit-hooks
4ec7e8063 Revert: ci: migrate pre-commit hooks to <org>/pre-commit-hooks

That June token was handed to git as a URL rewrite: https://github.com/ became https://x-access-token:$TOKEN@github.com/ on the runner. I had also considered git@github.com:<org>/pre-commit-hooks back then, and dropped it because runners have no SSH key. The premise was right and the conclusion was backwards — a rewrite runs in whichever direction we point it, and I had pointed it at the side that could not adapt.

So the config takes the URL that developers already have credentials for:

-  - repo: https://github.com/<org>/pre-commit-hooks
-    rev: 528e165cff8a11bc4f9f49a9b25f3249e09e4237 # frozen: v0.0.22
+  - repo: git@github.com:<org>/pre-commit-hooks
+    rev: 3030e9389488a2e4543a4d5d45d78a63bb591864 # frozen: v1.1.0

And the keyless runner rewrites that SSH prefix back to HTTPS, with the same short-lived app token as before:

- name: Authenticate git for the internal hooks repo
  env:
    TOKEN: ${{ steps.generate-token.outputs.token }}
  run: git config --global url."https://x-access-token:${TOKEN}@github.com/<org>/".insteadOf "git@github.com:<org>/"

A warm cache is what hid the bug the first time, so both paths were verified against a cold one. The developer path, cloning over SSH:

% XDG_CACHE_HOME=$(mktemp -d) prek run -a just-format
Format Justfiles.........................................................Passed

The runner path, with SSH made unusable and nothing but the rewrite in $HOME:

% export HOME=$(mktemp -d)
% printf '[url "https://x-access-token:%s@github.com/<org>/"]\n\tinsteadOf = git@github.com:<org>/\n' "$(gh auth token)" > "$HOME/.gitconfig"
% SSH_AUTH_SOCK= GIT_SSH_COMMAND=/bin/false XDG_CACHE_HOME="$HOME/.cache" prek run -a just-format
Format Justfiles.........................................................Passed

That second run also exposed where the rewrite belongs. Asking for a single hook populated the cache with every hook repo in the config:

% ls "$HOME/.cache/prek/repos" | wc -l
      13

prek initializes all of them up front, so the rewrite goes in every job that runs prek — not only the linting one. ∎

— § —

Reply via email

#bloggify #dev #git #pre-commit #ssh

starship: hyperlink github PR number

serendipity@perrotta.dev (Thiago Perrotta) — Thu, 03 Sep 2026 14:02:52 +0200

♠ Previously.

Problem statement: the GitHub PR number in my Starship prompt was plain text.

The custom module already asked gh for the PR number and cached it with bkt:

[custom.github_pr]
command = "bkt --ttl=10m --scope=\"$(git rev-parse --show-toplevel):$(git branch --show-current)\" -- gh pr view --json number --jq '\"#\" + (.number | tostring)' 2>/dev/null"
when = "git rev-parse --is-inside-work-tree 2>/dev/null"
format = " [$output](magenta)"
ignore_timeout = true

An OSC 8 escape sequence can turn #78 into a terminal hyperlink. I first used ESC \ to terminate each sequence. The template produced the expected bytes, but zsh prompt expansion consumed each backslash and left an incomplete escape sequence:

missing hyperlink sequence; output=b'...\x1b]8;;https://github.com/thiagowfx/.dotfiles/pull/78\x1b#78\x1b]8;;\x1b...'

BEL terminates OSC 8 without passing a backslash through zsh:

diff --git starship/.config/starship.toml starship/.config/starship.toml
index 87e83794..739ee62f 100644
--- starship/.config/starship.toml
+++ starship/.config/starship.toml
@@ -54,7 +54,7 @@ format = " [⎇ $output]($style)"
 style = "bold yellow"

 [custom.github_pr]
-command = "bkt --ttl=10m --scope=\"$(git rev-parse --show-toplevel):$(git branch --show-current)\" -- gh pr view --json number --jq '\"#\" + (.number | tostring)' 2>/dev/null"
+command = "bkt --ttl=10m --scope=\"$(git rev-parse --show-toplevel):$(git branch --show-current)\" -- gh pr view --json number,url --template '{{printf \"\\033]8;;%s\\007#%v\\033]8;;\\007\" .url .number}}' 2>/dev/null"
 when = "git rev-parse --is-inside-work-tree 2>/dev/null"
 format = " [$output](magenta)"
 ignore_timeout = true

I tested the full Starship-to-zsh path against the branch for PR #78:

% tmp=$(mktemp -d)
% git -C "$tmp" init -q
% git -C "$tmp" remote add origin https://github.com/thiagowfx/.dotfiles.git
% git -C "$tmp" switch -q -c renovate/web-tree-sitter-0.x
% (cd "$tmp" && STARSHIP_SHELL=zsh starship prompt) |
    zsh -c 'prompt=$(cat); print -nP -- "$prompt"' |
    python3 -c 'import sys
out = sys.stdin.buffer.read()
expected = b"\x1b]8;;https://github.com/thiagowfx/.dotfiles/pull/78\x07#78\x1b]8;;\x07"
assert expected in out
print("PASS: zsh-rendered Starship prompt links #78 to PR URL")'
PASS: zsh-rendered Starship prompt links #78 to PR URL

Cmd + click on the number now opens the PR in Ghostty.

That test covered zsh only. Bash exposed a prompt alignment bug two weeks later. Text from the command line appeared at the right edge and before the prompt.

Starship did not mark the complete OSC 8 sequence as non-printing for Bash:

\[\x1b]8;;https://github.com\]/[redacted]/[redacted]/pull/7163\x07#7163\[\x1b]8;;\x07

Only ESC ] 8 ;; https://github.com was inside Readline’s \[ and \] markers. Bash counted the remaining URL as visible prompt text, so its cursor position was wrong.

I reverted the hyperlink:

 [custom.github_pr]
-command = "bkt --ttl=10m --scope=\"$(git rev-parse --show-toplevel):$(git branch --show-current)\" -- gh pr view --json number,url --template '{{printf \"\\033]8;;%s\\007#%v\\033]8;;\\007\" .url .number}}' 2>/dev/null"
+command = "bkt --ttl=10m --scope=\"$(git rev-parse --show-toplevel):$(git branch --show-current)\" -- gh pr view --json number --jq '\"#\" + (.number | tostring)' 2>/dev/null"
 when = "git rev-parse --is-inside-work-tree 2>/dev/null"
 format = " [$output](magenta)"
 ignore_timeout = true

The PR number is plain text again. The Bash prompt now stays aligned.

🤖 Drafted with /bloggify. ∎

— § —

Reply via email

#bloggify #dev #git

mise: prune old installations

serendipity@perrotta.dev (Thiago Perrotta) — Thu, 03 Sep 2026 13:49:39 +0200

♠ Previously.

Today I learned: mise can remove tool versions no longer referenced by its tracked configuration files.

List versions eligible for cleanup (dry-run):

% mise ls --prunable
% mise prune --tools --dry-run

Run the cleanup (without --dry-run):

% mise prune --tools

mise prune also handles stale tracked configuration links:

% mise prune --dry-run
mise pruned configuration links [dryrun]

For an one-off cleanup, mise uninstall removes selected versions instead:

% mise uninstall node@18.0.0
% mise uninstall --all node

The first command removes one version. The second removes every installed version of one tool. ∎

— § —

Reply via email

#dev

pi: enable fullscreen TUI mode

serendipity@perrotta.dev (Thiago Perrotta) — Thu, 03 Sep 2026 13:48:57 +0200

♠ Today I learned: pi can keep its editor and footer at the bottom of the terminal with fullscreen TUI mode, similarly to Claude Code.

The regular mode leaves terminal scrollback in charge. The --tui-mode option switches to a viewport managed by Pi:

% pi --help | rg -- '--tui-mode|TUI mode'
  --tui-mode <mode>              TUI mode: regular (default) or fullscreen

For an one-off session:

% pi --tui-mode fullscreen

For a persistent default, add tuiMode to ~/.pi/agent/settings.json:

diff --git pi/.pi/agent/settings.json pi/.pi/agent/settings.json
index 7d2fee8b..57fd5094 100644
--- pi/.pi/agent/settings.json
+++ pi/.pi/agent/settings.json
@@ -41,6 +41,7 @@
   "showCacheMissNotices": true,
   "theme": "catppuccin-mocha",
   "treeFilterMode": "user-only",
+  "tuiMode": "fullscreen",
   "warnings": {
     "anthropicExtraUsage": false
   }

The transcript scrolls inside Pi. The editor, queued messages, widgets, and footer stay docked at the bottom.

The same setting is available under /settings as TUI mode. Pi 0.84.4 supports regular and fullscreen.

Fullscreen mode also owns mouse selection. Dragging with the primary mouse button copies the selected text on release by default:

{
  "fullscreenCopyOnSelect": true
}

Pi confirms the copy with a reverse-video Copied! flash in the top-right corner for one second, which is quite easy to miss. ∎

— § —

Reply via email

#bloggify #dev #pi

direnv: silence a blocked .envrc

serendipity@perrotta.dev (Thiago Perrotta) — Wed, 02 Sep 2026 16:22:01 +0200

♠ Sometimes we simply do not want to activate direnv in a given project.

Deny it for the current directory:

% direnv deny .

To enable it later:

% direnv allow .

This is necessary to make it stop nagging you each time you cd into a project (directory) with .envrc:

% cdtmp
/var/folders/yr/6sw3yylx6gjcy5jr38d6j6000000gn/T/thiago.perrotta-2026-09-02-k5lfb0

thiago.perrotta /var/folders/yr/6sw3yylx6gjcy5jr38d6j6000000gn/T/thiago.perrotta-2026-09-02-k5lfb0
% touch .envrc
direnv: error /private/var/folders/yr/6sw3yylx6gjcy5jr38d6j6000000gn/T/thiago.perrotta-2026-09-02-k5lfb0/.envrc is blocked. Run `direnv allow` to approve its content

∎

— § —

Reply via email

#dev

Hacker News RSS (hnrss): replace broken feed endpoint

serendipity@perrotta.dev (Thiago Perrotta) — Wed, 02 Sep 2026 13:19:22 +0200

♠ Previously.

Problem statement: my filtered Hacker News feed stopped working in Miniflux because its HNRSS endpoint returned a bad gateway response.

This has been happening for a couple of weeks, to the point it became unreliable.

The feed selected stories with more than 650 points:

https://hnrss.org/newest?points=650

Miniflux reported the upstream failure without hiding it:

The website is not available at the moment due to a bad gateway error.
The problem is not on Miniflux side. Please, try again later.

HNRSS is open source, and another public instance runs a fork against the same Hacker News Algolia data. So I replaced the domain:

-https://hnrss.org/newest?points=650
+https://hnrss.kakwalab.ovh/newest?points=650

The replacement returned an XML feed with 20 items:

% curl -L --max-time 15 -sS \
    'https://hnrss.kakwalab.ovh/newest?points=650' \
    -o /tmp/hnrss.xml \
    -w '%{http_code} %{content_type} %{size_download} bytes\n'
200 application/xml; charset=utf-8 15929 bytes

% python3 -c 'import xml.etree.ElementTree as ET; \
r=ET.parse("/tmp/hnrss.xml").getroot(); \
i=r.findall("./channel/item"); print(len(i)); print(i[0].findtext("title"))'
20
Hang on to Your Firefox

∎

— § —

Reply via email

#dev #selfhosted

AgentsView vs fast-resume

serendipity@perrotta.dev (Thiago Perrotta) — Tue, 01 Sep 2026 20:55:14 +0200

♠ Previously.

Problem statement: does AgentsView replace fast-resume, or do they solve different problems?

I installed both and compared their current releases:

% agentsview --version
agentsview v0.41.1 (commit a902515a, built 2026-08-18T13:34:56Z)
% fr --version
fr 2.11.2

fr has one job: search local agent sessions and resume one in its native agent. Search is typo-tolerant. Enter replaces fr with the original agent process and restores its working directory:

Agent stores ──► adapters ──► normalized sessions ──► Tantivy index
                                                        │
Terminal ◄──── resume handoff ◄──── TUI/search ◄────────┘

AgentsView is a persistent SQLite archive with a desktop app, local web UI, CLI, REST API, MCP server, cost reports, and session health signals. Its search surface is correspondingly larger:

% agentsview session search --help | grep -E -- '--(fts|hybrid|regex|semantic|in )'
      --fts                      Fast tokenized FTS over messages only
      --hybrid                   Hybrid semantic + full-text search (reciprocal rank fusion)
      --in string                Comma-separated sources: messages,tool_input,tool_result (default all)
      --regex                    Treat pattern as an RE2 regex
      --semantic                 Semantic (vector) search over user/assistant messages

AgentsView documents 59 session sources against fr’s 12. Resume support is the opposite: AgentsView maps nine agent types, while fr has handoff commands for all twelve, including Pi:

# fast-resume
Pi → pi --session <id>

# AgentsView resume map
claude, codex, traex, copilot, cursor, gemini, opencode, amp, kiro

The local footprint shows the difference in scope:

% du -sh /opt/homebrew/Cellar/fast-resume/2.11.2 \
    /Applications/AgentsView.app ~/.cache/fast-resume ~/.agentsview
14M     /opt/homebrew/Cellar/fast-resume/2.11.2
116M    /Applications/AgentsView.app
772K    /Users/tperrotta/.cache/fast-resume
28M     /Users/tperrotta/.agentsview

fr treats its index as a disposable cache. AgentsView keeps sessions until agentsview prune removes them. It also sends an anonymous daily liveness ping and checks for updates; fr 2.11.2 has neither mechanism.

Given the aforementioned trade-offs: I am happier with fr. KISS. ∎

— § —

Reply via email

#ai #bloggify #dev #pkm #privacy

kargo: quote numeric-looking image tags

serendipity@perrotta.dev (Thiago Perrotta) — Tue, 01 Sep 2026 15:39:56 +0200

♠ Previously.

Problem statement: a Kargo promotion turned a valid all-digit Git SHA into scientific notation.

The Freight contained an image tag and a Helm chart version:

15abd266dc635e7b9f3fe740441a73cd3cd549e7  937844257  0.5.1

937844257 looked like a build number. It was the first nine characters of a real commit:

% git rev-parse 937844257
9378442576c62b45cba4b41d8b4eb09a763da1ad

The Stage passed the tag directly to yaml-update:

- uses: yaml-update
  config:
    path: ./gitrepo/apps/overlays/g02/sessions/patches.yaml
    updates:
      - key: 1.value.image.tag
        value: ${{ imageFrom(vars.imageRepo).Tag }}

Kargo coerces expression results that look like JSON numbers. The promotion log showed the result:

Updated ./gitrepo/apps/overlays/g02/sessions/patches.yaml

- 1.value.image.tag: 9.37844257e+08
- 3.value: ~0.5.0

The generated Git diff therefore pointed at an image tag that did not exist:

 image:
-  tag: cd3a31000
+  tag: 9.37844257e+08

Kargo provides quote() for exactly this case:

-        value: ${{ imageFrom(vars.imageRepo).Tag }}
+        value: ${{ quote(imageFrom(vars.imageRepo).Tag) }}

I changed all image-tag writes across the eight rollout Stages and checked the same condition before and after:

before fix: 20 unsafe image-tag updates
after fix: 0 unsafe image-tag updates

% prek run kargo-promotion-tasks --all-files
Check Kargo PromotionTask references.....................................Passed

An older Kargo bug report even used an all-digit short SHA as its example. Git hashes contain hexadecimal characters, but none of those characters has to be a letter.

🤖 Drafted with /bloggify. ∎

— § —

Reply via email

#argocd #bloggify #dev #git #kubernetes

prek 0.5: auto-update → update

serendipity@perrotta.dev (Thiago Perrotta) — Tue, 01 Sep 2026 12:40:57 +0200

♠ Previously.

Problem statement: prek 0.5 removed prek auto-update, which broke every scheduled updater (github workflows) we have.

The workflow installed the latest stable release. One week it resolved 0.4.14:

Resolved "latest" to latest stable release 0.4.14
Using prek 0.4.14
Run prek auto-update --freeze --cooldown-days 7 --jobs "$(nproc)"

The next week it resolved 0.5.0 and stopped before updating any hook:

Resolved "latest" to latest stable release 0.5.0
Using prek 0.5.0
Run prek auto-update --freeze --cooldown-days 7 --jobs "$(nproc)"
error: unexpected argument '--freeze' found

  tip: to pass '--freeze' as a value, use '-- --freeze'

Usage: prek <HOOK|PROJECT>...

Error: Process completed with exit code 2.

The 0.5.0 release notes listed the breaking change:

prek auto-update has been removed. Use prek update, or prek autoupdate for drop-in compatibility with pre-commit.

I switched to the canonical command in workflows and docs:

-      - name: Run prek auto-update
-        run: prek auto-update --freeze --jobs "$(nproc)"
+      - name: Run prek update
+        run: prek update --freeze --jobs "$(nproc)"

Five of my personal repositories had the old comman:

check-json-schema-meta   9bf47ea fix(ci): use prek update command
pancake                  08e7540 fix(ci): use prek update command
perrotta.dev             a9766c9931 fix(ci): use prek update command
pre-commit-hooks         965f3ff fix(ci): use prek update command
skills                   9d81d26 fix(ci): use prek update command

The new command accepted the same options and completed a dry-run:

% prek update --freeze --jobs 1 --dry-run
https://github.com/google/keep-sorted
  would update rev `339d935575ef7d92f2c9b4df9ce4b724d73c9201` (frozen: v0.9.1) -> `b225c42a9a8f480d760cf967d1e3a839060b242c` (frozen: v0.10.0)

∎

— § —

Reply via email

#dev #pre-commit

external secrets: repair a CRD upgrade

serendipity@perrotta.dev (Thiago Perrotta) — Mon, 31 Aug 2026 16:29:01 +0200

♠ Problem statement: an External Secrets Operator upgrade left different clusters in different states, and a normal ArgoCD retry could not repair them.

The upgrade moved from ESO 0.9.20 to 2.9.0. Two CRDs rendered at about 707 KB. Client-side apply tried to store each complete manifest in an annotation capped at 262144 bytes:

metadata.annotations: Too long: may not be more than 262144 bytes

Server-side apply avoids kubectl.kubernetes.io/last-applied-configuration:

% kubectl apply --server-side --force-conflicts -f crd-secretstores.yaml

That fixed only half of the problem. The old chart configured CRD conversion through the ESO webhook. The new chart omitted the conversion block, but server-side apply does not remove a field that the desired manifest never mentions. Reads still went to a /convert endpoint that ESO 2.9.0 no longer served:

conversion webhook for external-secrets.io/v1beta1, Kind=SecretStore failed

The conversion field had to be removed before the new schema was applied:

% kubectl patch crd/secretstores.external-secrets.io --type=merge \
    -p '{"spec":{"conversion":{"strategy":"None","webhook":null}}}'
% kubectl apply --server-side --force-conflicts -f crd-secretstores.yaml

Order matters. Applying the schema first creates a window where every SecretStore read reaches the dead webhook.

One fixed sequence was still not enough. A cluster with the old controller and old CRDs was healthy. Applying the v1 CRDs before ArgoCD deployed ESO 2.9.0 would instead produce this controller error:

no matches for kind

I made the upgrade script classify live state before changing it:

case "$IMG_TAG:$V1_COUNT:$WEBHOOK_COUNT" in
  v2.9.*:3:0|2.9.*:3:0)  CLASS=DONE ;;
  v2.9.*:*|2.9.*:*)      CLASS=NEEDS-CRD-FIX ;;
  v0.9.*:0:*|0.9.*:0:*)  CLASS=NOT-STARTED ;;
  v0.9.*:*|0.9.*:*)      CLASS=MIXED ;;
  *)                      CLASS=UNKNOWN ;;
esac

DONE is a no-op. NEEDS-CRD-FIX patches conversion, renders all three CRDs from the pinned Helm chart, applies them server-side, and restarts the controller. MIXED and UNKNOWN stop instead of guessing.

NOT-STARTED also stops by default. Its separate opt-in path enables ArgoCD auto-sync, waits for the new controller to land, then asks for a second run:

$ALLOW_NOT_STARTED || die "refusing without --allow-not-started"
run kc patch app external-secrets -n argocd --type=merge \
  -p '{"spec":{"syncPolicy":{"automated":{
    "enabled":true,"prune":true,"selfHeal":true
  }}}}'
info "Then: $0 $GARDEN"

The final checks compare custom resource counts, read all three resource kinds, check every ExternalSecret, scan controller logs, and require ArgoCD to converge:

for k in clustersecretstores secretstores externalsecrets; do
  kc_ok get "$k.external-secrets.io" -A || FAIL=true
done

if (( CSS_AFTER < CSS_BEFORE || SS_AFTER < SS_BEFORE || \
      ES_AFTER < ES_BEFORE )); then
  FAIL=true
fi

APP="$(kc get app external-secrets -n argocd \
  -o "jsonpath={.status.sync.status}/{.status.health.status}")"
[[ "$APP" == "Synced/Healthy" ]] || FAIL=true

The repair became an idempotent state transition instead of a command sequence.

🤖 Drafted with /bloggify. ∎

— § —

Reply via email

#argocd #bloggify #dev #kubernetes

★ git: diff against the default branch

serendipity@perrotta.dev (Thiago Perrotta) — Mon, 31 Aug 2026 14:28:49 +0200

♠ Problem statement: create a git alias / script to diff against the default upstream branch, inspired by chromium depot_tools(7) git-upstream-diff(1):

git-upstream-diff — Print a diff of the current branch, compared to its upstream.

I used to have an alias for it in 2024, but I did not have a reliable way at the time to find whether a repository used main, master, or something else:

udiff = !git diff $(git show-branch --merge-base HEAD 2>/dev/null)~1

It lasted one month (repository archeology FTW):

% git log --all --format='%h %ad %s' --date=short --grep=udiff -i
da961f1 2026-08-31 git: restore udiff command
a4f13e9 2024-10-07 git: remove udiff
244ca3b 2024-09-02 git: add udiff alias

Worktrunk now gives me what I always wanted:

% wt config state default-branch
master

Previously.

As git finds executables named git-<command> on PATH, the replacement is a small script at git/.bin/git-udiff:

#!/bin/sh
#
# git-udiff - Show changes since the current branch diverged from the default branch

set -e

if [ "$(git rev-parse --is-inside-work-tree 2>/dev/null)" != "true" ]; then
  echo "Error: Not in a git repository"
  exit 1
fi

default_branch=$(wt config state default-branch 2>/dev/null)
merge_base=$(git merge-base "$default_branch" HEAD)

exec git diff "$merge_base" "$@"

Why a script instead of an alias? Because it is no longer a readable one-liner.

git merge-base finds the divergence commit. Diffing from that commit without an end revision includes committed, staged, and unstaged tracked changes. Forwarding "$@" keeps regular diff options and path filters working:

% git udiff --stat
 claude/.claude/settings.json | 3 ++-
 pi/.pi/agent/settings.json   | 2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)

% git udiff --name-only -- pi/.pi/agent/settings.json
pi/.pi/agent/settings.json

The command is back, now based on repository state instead of a branch-name guess:

% git show --stat --oneline da961f1
da961f1 git: restore udiff command
 git/.bin/git-udiff | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

∎

— § —

Reply via email

#bestof #dev #git

argocd: sync windows block pruning

serendipity@perrotta.dev (Thiago Perrotta) — Mon, 31 Aug 2026 13:00:50 +0200

♠ Problem statement: deleting an ArgoCD Application from Git (GitOps) does not guarantee it will disappear from the cluster.

We removed an app-of-apps child from every garden it lived in and merged the PR. The parent synced clean:

phase: Succeeded
message: successfully synced (all tasks run)

An hour later, six clusters paged 🚨 with ArgoCdAppSyncUnknown. The child was still there:

sync: Unknown
health: Healthy
deletionTimestamp:
finalizers:

No deletionTimestamp, no finalizer stuck — it was never asked to delete. The controller logs said why:

level=info msg="Sync prevented by sync window" application=datastore-all
    dest-namespace=infra-services project=garden

The app was listed in an AppProject sync window:

{
  "kind": "allow",
  "schedule": "0 23 * * *",
  "duration": "1h",
  "timeZone": "America/New_York",
  "applications": ["...", "datastore-all", "..."]
}

An allow window means auto-sync — including pruning — only runs inside it. The parent app re-rendered without the child and dropped it from status.resources, but pruning a tracked resource is itself a sync operation, so ArgoCD deferred it to 23:00–00:00 New York time. Meanwhile the orphaned Application still pointed at a values file that no longer existed on HEAD:

Failed to load target state: failed to generate manifest for source 1 of 2:
    ... open apps/overlays/g28/datastore-all/values.yaml: no such file or directory

Manifest generation failure is a sync status of Unknown, which is exactly what fired the alert.

The object had no finalizer, so deleting it directly only removes the bookkeeping, not the workload it deployed:

% kubectl -n argocd delete app datastore-all

The actual infra-services resources it created are still tracked by label and get pruned once the window opens — or by hand in the meantime. ∎

— § —

Reply via email

#argocd #bloggify #dev #kubernetes

★ TV Shows

serendipity@perrotta.dev (Thiago Perrotta) — Mon, 31 Aug 2026 02:59:17 +0200

♠ Previously.

I added a TV shows page with a sample of my favorites, inspired by Michael Harley’s watching page and Michael Stapelberg’s series page.

The list lives in YAML. Trakt keeps my full watch history; this file stays small, alphabetical, and intentionally incomplete:

shows:
  # keep-sorted start case=no by_regex=title:\s+"?([^"]+)
  - title: 13 Reasons Why
    years: 2017–2020
    seasons: 4
    url: https://www.themoviedb.org/tv/66788-13-reasons-why
    cover: https://media.themoviedb.org/t/p/w500/nel144y4dIOdFFid6twN5mAX9Yd.jpg
  - title: 3%
    years: 2016–2020
    seasons: 4
    url: https://www.themoviedb.org/tv/68467-3
    cover: https://media.themoviedb.org/t/p/w500/uLBJSLuAQ8UqLIKZVWG3uNEXwjt.jpg
  # keep-sorted end

A custom Hugo layout turns each record into a poster card. Show details and posters come from The Movie Database:

<div class="tv-shows-grid">
  {{- range $data.shows }}
  <div class="tv-shows-item">
    <a href="{{ .url }}" title="{{ .title }} ({{ .years }})">
      <img class="tv-shows-cover" src="{{ .cover }}" alt="Poster for {{ .title }}" loading="lazy" decoding="async" referrerpolicy="no-referrer">
      <div class="tv-shows-item-title">{{ .title }}</div>
    </a>
    <div class="tv-shows-item-meta">
      {{ .years }} &middot; {{ .seasons }} {{ cond (eq .seasons 1) "season" "seasons" }}
    </div>
  </div>
  {{- end }}
</div>

The data has a JSON schema, and the page now sits next to Books in the More menu:

% git show --stat --oneline 97dc4bde16
97dc4bde16 add TV shows page
6 files changed, 305 insertions(+), 3 deletions(-)

TV show recommendations are almost always welcome. ∎

— § —

Reply via email

#bestof #bloggify #serenity

ssh: pipe SQL through doas with base64

serendipity@perrotta.dev (Thiago Perrotta) — Sat, 29 Aug 2026 02:44:43 +0200

♠ Problem statement: nested shell quotes made a remote PostgreSQL update harder to run than the update itself.

The target is an Alpine Linux host. Its Miniflux configuration contains the database connection string, so psql must run after sourcing /etc/miniflux.conf through doas.

An inline command quickly becomes a quoting puzzle. SQL contains single quotes, Unicode, and sometimes apostrophes. The local shell also expands unquoted characters before ssh sends anything to the server.

I wrote SQL to a temporary file, encoded it locally, and sent only base64 over SSH:

% base64 /tmp/miniflux-flags.sql | tr -d '\n' | \
  ssh knol 'doas sh -c '\''
    . /etc/miniflux.conf
    base64 -d | psql "$DATABASE_URL" -X -v ON_ERROR_STOP=1
  '\''

Remote shell receives a simple command. base64 -d reconstructs SQL on the server. psql reads it from standard input. ON_ERROR_STOP=1 makes a SQL error stop the command instead of continuing to later statements.

The file contained real, guarded updates:

BEGIN;
UPDATE feeds SET title = title || ' 🇺🇸'
WHERE id = 1394 AND title = 'furbo.org: Craig Hockenberry'
RETURNING id, title;
UPDATE feeds SET title = title || ' 🇨🇦'
WHERE id = 1406 AND title = 'Ansuz: Matthew Skala'
RETURNING id, title;
UPDATE feeds SET title = title || ' 🇬🇧'
WHERE id = 1411 AND title = 'Ian Jackson'
RETURNING id, title;
-- eight more exact-title guards
COMMIT;

The remote output stayed useful:

BEGIN
 id  |              title
-----+---------------------------------
1394 | furbo.org: Craig Hockenberry 🇺🇸
(1 row)
UPDATE 1
...
UPDATE 1
COMMIT

A second query verified every ID after commit:

 id  |              title
-----+---------------------------------
1394 | furbo.org: Craig Hockenberry 🇺🇸
1406 | Ansuz: Matthew Skala 🇨🇦
1411 | Ian Jackson 🇬🇧
1444 | Matthew Garrett: mjg59 🇬🇧
1459 | Cloudscaling by Randy Bias 🇺🇸
1460 | Marcin Juszkiewicz 🇵🇱
1464 | Liss is More by Casey Liss 🇺🇸
1472 | Jerod Santo 🇺🇸
1482 | Matthias Kirschner 🇩🇪
1545 | Charles Leifer 🇺🇸
(10 rows)

Base64 does not encrypt anything. It only moves one opaque payload through several shells. That is enough to keep local parsing away from SQL. ∎

— § —

Reply via email

#bloggify #dev #linux #ssh

blog: calendar view

serendipity@perrotta.dev (Thiago Perrotta) — Sat, 29 Aug 2026 02:12:41 +0200

♠ Problem statement: my blog archive was useful, but did not show its posting pattern over time.

I liked Jim Nielsen’s calendar view, so I added one too. List remains better for finding a post. The new calendar is for seeing when I published.

The calendar and list use one filter. Coding, recipes, and RSS-only posts stay out of both:

{{- $pages := where .pages "Site.Language.Lang" .lang -}}
{{- $pages = where $pages "Kind" "page" -}}
{{- $pages = where $pages "Params.rss_only" "!=" true -}}
{{- $excludeCategories := slice "coding" "recipes" -}}
{{- $pages = where $pages "Params.categories" "intersect" $excludeCategories | symdiff $pages -}}
{{- return $pages -}}

I group posts by ISO date. A day gets a blue dot. A day with a bestof post gets a yellow star. Clicking it shows every post from that date:

{{- $postsByDate := newScratch }}
{{- range $pages }}
  {{- $key := .Date.Format "2006-01-02" }}
  {{- $dayPages := $postsByDate.Get $key | default (slice) }}
  {{- $postsByDate.Set $key ($dayPages | append .) }}
{{- end }}

<details class="calendar-day calendar-day--has-post">
  <summary>
    <span class="calendar-day--post{{ if $featured }} calendar-day--featured{{ end }}">
      {{ if $featured }}<span class="calendar-day--featured-icon">★</span>{{ end }}
    </span>
  </summary>
  <div class="calendar-popover">
    {{- range $dayPages }}
    <a href="{{ .Permalink }}">
      <span>{{ if in .Params.tags "bestof" }}★ {{ end }}{{ .Title }}</span>
    </a>
    {{- end }}
  </div>
</details>

It has English, Portuguese, and Italian month labels. The marker target is 24 pixels tall, and mobile uses two month columns:

.calendar-day--has-post summary {
  width: 100%;
  min-height: 24px;
}

@media (max-width: 600px) {
  .calendar-months {
    grid-template-columns: repeat(2, minmax(0, 1fr));
  }
}

% git show --stat --oneline 9c1db78581
9c1db78581 calendar
11 files changed, 388 insertions(+), 33 deletions(-)

% hugo --environment production
                   │  EN  │ PT  │ IT
───────────────────┼──────┼─────┼────
 Pages             │ 2968 │ 225 │ 21
Total in 8080 ms

∎

— § —

Reply via email

#bloggify #dev #meta

★ miniflux: add country flags to all feeds 🌐

serendipity@perrotta.dev (Thiago Perrotta) — Fri, 28 Aug 2026 01:20:26 +0200

♠ Problem statement: given my miniflux server with hundreds of RSS feed subscriptions, add emoji country flags to each feed title, representing their country of origin and/or the country they’re associated with¹.

For example:

Before: Not Just Serendipity by Thiago Perrotta
After: Not Just Serendipity by Thiago Perrotta 🇧🇷🇨🇦

Some feeds may be identified with multiple flags. The distinction is purposely loose.

I started to do this tagging process manually, throughout several weeks, until I exhausted the ones I knew about.

The next natural step, in 2026, is to resort to Gen AI to finish the heavy lifting, now that the initial pattern has been established.

With my OpenAI Codex subscription and pi, I prompted away:

User: List all prompts I ran in this session, bulleted list:

Thinking: Listing all user prompt messages

“Are you able to connect to my miniflux database in knol? (ssh knol) Creds are in /etc/miniflux.conf in knol.”

“Note that Alpine Linux uses doas, not sudo.”

“Are you able to find my list of subscriptions / feeds? There should be 687 of these.”

“Observe that some feed titles have flags in them.”

“I want to add a flag for the origin of each blog. Source a few feeds lacking flags and suggest which flags to add.”

“LGTM.”

“Source 10–15 more blogs.”

“LGTM.”

“Write a blog post about this work using /bloggify.”

“List all prompts I ran in this session, bulleted list.”

Here are a few interesting bits produced by the agent. Note that I run the coding harness (pi) from my laptop, not from my server. As such, all commands that interact with the server do so via ssh. This is good enough for my purposes.

Count all feeds:

% ssh knol 'doas sh -c '\''. /etc/miniflux.conf; psql "$DATABASE_URL" -X -Atqc "SELECT count(*) FROM feeds"'\'''
687

Some titles already followed the convention:

780|37signals jobs 🇩🇰🇺🇸
818|A cup of coffee by Quentin JOLY 🇫🇷
1366|AI Engineer Guide 🇮🇳
562|Adam Gordon Bell: Cascade Of Insights 🇨🇦
916|Adam Johnson 🇬🇧

A pair of Unicode regional indicators forms a flag. Export the titles and count those pairs:

% ssh knol 'doas sh -c '\''. /etc/miniflux.conf; psql "$DATABASE_URL" -X -q -c \
  "COPY (SELECT id, title FROM feeds ORDER BY title) TO STDOUT WITH CSV"'\''' | \
  python3 -c 'import csv,sys,re; rows=list(csv.reader(sys.stdin)); p=re.compile(r"[\U0001F1E6-\U0001F1FF]{2}"); found=[(i,t,p.findall(t)) for i,t in rows if p.search(t)]; print(f"feeds_with_flags={len(found)} flags={sum(len(x[2]) for x in found)}")'
feeds_with_flags=148 flags=158

I did not infer origin from a name, domain, language, or current residence. Each addition needed an explicit source. For example, Jeremy Keith says “I’m from Ireland originally”, Andre Garzia says he is originally from Brazil, and Christian Rebischke describes himself as being from Germany.

The title itself is the metadata. Exact old-title guards made each update idempotent and prevented an accidental edit to a renamed feed:

BEGIN;
UPDATE feeds
SET title = 'Christian Rebischke: shibumi 🇩🇪'
WHERE id = 207 AND title = 'Christian Rebischke: shibumi';
UPDATE feeds
SET title = 'Adactio: Journal by Jeremy Keith 🇮🇪'
WHERE id = 1106 AND title = 'Adactio: Journal by Jeremy Keith';
UPDATE feeds
SET title = 'Adactio: Articles by Jeremy Keith 🇮🇪'
WHERE id = 1107 AND title = 'Adactio: Articles by Jeremy Keith';
UPDATE feeds
SET title = 'Andre Alves Garzia 🇧🇷'
WHERE id = 1481 AND title = 'Andre Alves Garzia';
COMMIT;

BEGIN
UPDATE 1
UPDATE 1
UPDATE 1
UPDATE 1
COMMIT

A second sourced batch added 12 more titles. Compound origins stay compound:

430|Burak Karakan: ps 🇩🇪🇹🇷
1022|Amjad Masad 🇯🇴🇺🇸
1076|Christopher Olah 🇨🇦
1100|Cognitive Medium by Michael Nielsen 🇦🇺🇺🇸
1174|Andrej Karpathy 🇸🇰🇨🇦
1489|Jeff Geerling 🇺🇸

The same audit now reports:

total=687
feeds_with_flags=164
flags=178
without_flags=523

Only 523 to go.

This is a practical excuse to tokenmaxx, eh?!

Web searches are done with pi-web-search. ∎

Why? Purely as a matter of context, and for an extra dose of serendipity via diversity. For example, it’s often exciting to me to read posts from other Canadians, for no particular reason. ↩︎

— § —

Reply via email

#bestof #dev #selfhosted

claude code: /goal

serendipity@perrotta.dev (Thiago Perrotta) — Wed, 26 Aug 2026 17:45:34 +0200

♠ Problem statement: a coding agent stops when it thinks it is done, not when the thing is actually done.

/goal sets a condition that outlives the turn. The docs call it a wrapper around a session-scoped, prompt-based Stop hook: every time the agent tries to end its turn, an evaluator checks the condition and pushes back if it does not hold.

/goal argocd, prometheus and external secrets should all be healthy and synced in cluster #26

I set that mid-session while debugging a cluster where three Argo CD apps were stuck. What followed was the useful part. The agent wrapped up with a tidy summary and two pull requests, and got this back:

Stop hook feedback:
[argocd, prometheus and external secrets should all be healthy and synced in cluster #26]:
PRs #3064 and #3062 have been opened but not yet merged. The latest status check
in the transcript confirms external-secrets = 'OutOfSync', argocd = 'OutOfSync',
prometheus = 'Unknown' — none are both 'healthy and synced'.

Opening a PR is not the same as the apps being green, and the evaluator reads the transcript rather than the closing paragraph. It fired three times. Each time the summary was plausible and each time the condition was still false.

/goal with no arguments shows the condition, elapsed time, turn count, token spend, and the evaluator’s last reason. /goal clear ends it.

The failure mode it fixes is specific: an agent that declares victory one step early. It does not make the agent smarter — mine still burned several turns on wrong theories, and I had to redirect it more than once. It only refuses to let “I opened a PR” stand in for “the apps are green”. ∎

— § —

Reply via email

#ai #argocd #bloggify #claude #dev #kubernetes

Continuity

serendipity@perrotta.dev (Thiago Perrotta) — Tue, 25 Aug 2026 15:40:59 +0200

♠ A serendipitous discovery: macOS continuity.

Picture this:

I am using my corp Macbook Pro, whilst my personal Macbook Air happens to be close by. Both of their lids are open.

In my corp Macbook, for some reason, I decided to move the mouse cursor to the edge of the laptop screen, using the trackpad.

And then, just like magic, the mouse cursor in my personal Macbook starts to move around.

And then I open up a terminal and start to type, from my corp Macbook, and somehow characters start to appear in my personal Macbook.

Remote trackpad + keyboard control. This is amazing!

This post was created in my personal Macbook, typed from my corp keyboard.

Naturally, I am signed into my Apple ID in both devices. ∎

— § —

Reply via email

#dev #macos #serenity

pi: prompt template or skill?

serendipity@perrotta.dev (Thiago Perrotta) — Tue, 25 Aug 2026 01:13:46 +0200

♠ Problem statement: I often type commit (only) what you changed in coding agent harnesses. Can I make an abbreviation out of it?

Pi turns a Markdown file in ~/.pi/agent/prompts/ into a /slash command. This one gives me /commit:

---
description: Commit files changed in this turn without pushing
---
Commit what you changed (only). DO NOT push.

% find ~/.pi/agent/prompts -maxdepth 1 -type f -print -exec sh -c 'printf "%s\n" "--- $1"; cat "$1"' _ {} \;
/Users/thiago.perrotta/.pi/agent/prompts/commit.md
--- /Users/thiago.perrotta/.pi/agent/prompts/commit.md
---
description: Commit files changed in this turn without pushing
---
Commit what you changed (only). DO NOT push.

In Pi, a prompt template is fixed prompt expansion. It is right for a short, stable request:

Prompt templates are Markdown snippets that expand into full prompts. Type /name in the editor to invoke a template, where name is the filename without .md.

A skill is a capability package. Its description is available at startup, but Pi loads its SKILL.md only when task matches or I run /skill:name. A skill can carry scripts, references, setup, and a workflow that branches on state:

Skills are self-contained capability packages that the agent loads on-demand. A skill provides specialized workflows, setup instructions, helper scripts, and reference documentation for specific tasks.

A commit flow with checks, generated files, partial staging rules, or project specific policy deserves a skill. This one is a couple of words and one constraint, so I choose to keep it simple. ∎

— § —

Reply via email

#ai #dev #pi

terrateam: plan from drift issues

serendipity@perrotta.dev (Thiago Perrotta) — Mon, 24 Aug 2026 18:38:39 +0200

♠ Problem statement: Terrateam opens drift reports as GitHub issues, but terrateam plan only works on pull requests.

The distinction is explicit in Terrateam’s issue comment handler:

{ primary = Primary.{ number = pull_request_id; pull_request = Some _; _ }; _ };

| Gw.Issue_comment_event.Issue_comment_created _ ->
    Logs.debug (fun m -> m "%s : NOOP : ISSUE_COMMENT_CREATED" request_id);
    Prmths.Counter.inc_one (Metrics.comment_events_total "noop");
    Abbs_future_combinators.return_ok ()

Calling the repository workflow directly was not an option either. Its work token comes from the Terrateam backend.

So I kept Terrateam in charge and gave it the pull request it expects. A GitHub Actions relay checks that the source is an open Terrateam drift issue and that the commenter has repository write access. It then puts a comment-only Terraform file in each selected drift directory:

markers = [
    InputGitTreeElement(
        path=f"{directory}/terrateam_issue_relay.tf",
        mode="100644",
        type="blob",
        content=f"# Terrateam plan relay for drift issue #{issue_number}, comment {comment_id}.\n",
    )
    for directory in directories
]

That path change gives Terrateam a real dirspace without changing infrastructure. The relay opens a temporary draft PR and posts the original command on it:

pull = repo.create_pull(
    base=repo.default_branch,
    head=branch,
    title=f"Terrateam plan relay for drift issue #{issue_number}",
    body=relay_body(issue_number, comment_id, event["comment"]["html_url"]),
    draft=True,
)
pull.as_issue().create_comment(command)

Terrateam uses its normal locks, hooks, credentials, and batching. Another workflow copies its comments back to the drift issue. apply remains unsupported: an issue has no PR approval or review intent.

The live test planned the requested directory and returned the result:

## Plans :thumbsup:

## Terrateam Plan Output :thumbsup:

**Plan: 0 to add, 8 to change, 0 to destroy**

The temporary PR ended where it should:

% gh pr view 6687 --json number,state,headRefName,title
{"headRefName":"bot/terrateam-issue-relay/6663-5398113346","number":6687,"state":"CLOSED","title":"Terrateam plan relay for drift issue #6663"}

% ./ci/run_python_tests.sh ci/terrateam_issue_relay
collected 19 items
tests/test_relay.py ...................                                  [100%]
============================== 19 passed in 1.45s ==============================

A scheduled job deletes inactive relay branches after 30 hours. Terrateam still owns plan execution; the relay only translates the issue command into its existing PR protocol. ∎

— § —

Reply via email

#bloggify #dev #terraform #terrateam

★ Books

serendipity@perrotta.dev (Thiago Perrotta) — Mon, 24 Aug 2026 18:28:31 +0200

♠ It’s about time: I added a books page to this blog with a sample of my favorites. ∎

— § —

Reply via email

#bestof #serenity

goodreads: a books page from a private shelf

serendipity@perrotta.dev (Thiago Perrotta) — Mon, 24 Aug 2026 16:39:40 +0200

♠ Previously.

Problem statement: I wanted a /books page with covers, but my Goodreads shelf is private and the API has been dead since 2020.

% curl -sS "https://www.goodreads.com/review/list_rss/7873832?shelf=read" \
    -o /tmp/rss.txt -w "%{http_code}\n"
401
% head -c 42 /tmp/rss.txt
Sorry, that person's shelf is private

The CSV export needs no auth, no key, no scraping — one click under My Books → Import/Export. It carries 1469 rows and everything worth rendering, except covers:

% head -1 ~/Downloads/goodreads_library_export.csv | tr ',' '\n' | grep -ciE "cover|image"
0

So ci/goodreads_to_books.py reads the CSV, keeps the five-star read rows, and writes data/books.yaml for Hugo to render:

% just goodreads-import
ci/goodreads_to_books.py ~/Downloads/goodreads_library_export.csv
wrote 101 books in 2 categories to ~/Workspace/perrotta.dev/data/books.yaml (101 kept their category, series, note and cover; 101 covers, 0 fetched; 63 excluded)

101 on display, 63 excluded: the 164 five-star rows, minus the textbooks and language courses nobody needs a recommendation for.

Covers come from each book’s public page — those stay readable even when the shelf is not, and the og:image points straight at the CDN:

% curl -sL "https://www.goodreads.com/book/show/22034" |
    grep -o '<meta property="og:image" content="[^"]*"'
<meta property="og:image" content="https://m.media-amazon.com/images/S/compressed.photo.goodreads.com/books/1394988109i/22034.jpg"

Which lands in the data file, one fetch per book, ever:

      - title: The Godfather
        author: Mario Puzo
        year: 1969
        rating: 5
        url: https://www.goodreads.com/book/show/22034
        cover: https://m.media-amazon.com/images/S/compressed.photo.goodreads.com/books/1394988109i/22034.jpg

That “ever” is the whole trick. Crawling 164 pages back to back gets an AWS WAF challenge — HTTP 202 with an empty body — and it sticks around for a few minutes:

  Thinking, Fast and Slow: HTTP 202, 0 bytes
  Blindness: HTTP 202, 0 bytes
  Freakonomics + Superfreakonomics: HTTP 202, 0 bytes
giving up after 5 failures in a row; run again later to fetch the remaining 43 covers

So the importer treats a cover as a cache entry rather than a build step: three seconds between requests, a save every ten covers, and a bail-out after five consecutive failures. A blocked run keeps what it got, and the next run resumes:

        book["cover"] = fetch_cover(book)
        if book["cover"]:
            fetched += 1
            failures = 0
            if fetched % COVER_SAVE_EVERY == 0:
                save()

Three runs, spaced by coffee, and every cover was in. Re-imports are now free — 0 fetched above — and idempotent, which matters because the CSV is the source of truth for titles and ratings, while the YAML owns the curation: categories, series names, notes, an excluded list for the books I don’t want on display, and an overrides list for when the shelved edition is not the one worth linking:

overrides:
  - id: "15779555"
    title: The Godfather
    url: https://www.goodreads.com/book/show/22034

That entry is the Brazilian translation of The Godfather. It is what I read, but O Poderoso Chefão is not what I would recommend.

% git --no-pager show --stat --oneline 7c8785dbb4
7c8785dbb4 books: add fiction favorites
 data/books.yaml | 348 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 348 insertions(+)

Fiction first. Non-fiction is still sitting unstaged, which is its own kind of review queue.

🤖 Drafted with /bloggify. ∎

— § —

Reply via email

#bloggify #dev #meta #serenity

bloggify, revisited

serendipity@perrotta.dev (Thiago Perrotta) — Mon, 24 Aug 2026 01:21:57 +0200

♠ Yours truly, more than two months ago:

As of today, it’s not clear to me whether this approach will stick.

Clearly this approach is here to stay: bloggify (40+ posts at the time of this writing).

I am starting to ponder whether to split /bloggify posts into an Agent Blog:

These posts are written by my agents, not by me.

We’ll see. ∎

— § —

Reply via email

#ai #bloggify #dev #serenity