¬ just serendipity 🍀

DNS: negative cache behind a local resolver

serendipity@perrotta.dev (Thiago Perrotta) — Fri, 31 Jul 2026 14:02:20 +0200

♠ Problem statement: a newly created Route 53 record resolved through public DNS, but ~~Chrome~~ Brave and macOS still returned DNS_PROBE_POSSIBLE.

It smells like a DNS caching issue.

Flushing mDNSResponder did nothing though.

The system resolver was Tailscale’s local DNS proxy, so I asked that resolver rather than trusting dig’s default path:

% dig +time=3 +tries=1 @100.100.100.100 kargo.tools.example-corp.net A +noall +answer +authority +comments
; <<>> DiG 9.10.6 <<>> +time=3 +tries=1 @100.100.100.100 kargo.tools.example-corp.net A +noall +answer +authority +comments
; (1 server found)
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 13683
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; AUTHORITY SECTION:
tools.example-corp.net. 225 IN SOA ns-1609.awsdns-09.co.uk. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400

Route 53’s authoritative nameserver and several public resolvers already had it:

% for resolver in 1.1.1.1 1.1.1.2 8.8.8.8; do
    printf '%-16s ' "$resolver"
    dig +time=2 +tries=1 +short @"$resolver" kargo.tools.example-corp.net A | paste -sd, -
  done
1.1.1.1          192.0.2.11,198.51.100.50,203.0.113.95
1.1.1.2          192.0.2.11,203.0.113.95,198.51.100.50
8.8.8.8          203.0.113.95,198.51.100.50,192.0.2.11

% dig +short @ns-1609.awsdns-09.co.uk kargo.tools.example-corp.net A
192.0.2.11
203.0.113.95
198.51.100.50

Tailscale had cached the previous NXDOMAIN response for a couple of minutes. Its cache is not macOS’s cache; restarting mDNSResponder cannot clear it. Waiting out that TTL fixed the web browser lookup.

🤖 Drafted with /bloggify.

— § —

Reply via email

#dev #macos

pi: with free models

serendipity@perrotta.dev (Thiago Perrotta) — Fri, 31 Jul 2026 01:04:23 +0200

OpenRouter #

Today I signed up for OpenRouter.

The Unified Interface For LLMs

Better prices, better uptime, no subscriptions.

Its main selling point is a single LLM API endpoint to rule them all, without lock-in to a specific provider or model.

Upon signing up you’ll get an API Key: sk-or-v1-..., which you’ll save to your password manager. You use one, right?!

The next step is to wire the key to a harness. At this point it’s no surprise I’ve been investing in pi, though OpenCode remains a decent contender.

In pi, run /login, select “Sign in with an API key”, select OpenRouter and then input the key.

Then select a /model. A good starting point is openrouter/free:

The simplest way to get free inference. openrouter/free is a router that selects free models at random from the models available on OpenRouter. The router smartly filters for models that support features needed for your request such as image understanding, tool calling, structured outputs and more.

It’s slow. But it’s free!

Now, interestingly:

User: which model are you?

Assistant: We need to answer user’s question: “which model are you?” According to instructions, we must respond in caveman style? The user asks which model. The system says we are an expert coding assistant within pi. The answer likely: “Opus”. But we need to follow Caveman mode: terse, no filler. So respond something like “Opus model”. Possibly just “Opus”. Let’s output as a plain message. Use normal verbosity for code, but this is not code. So just answer succinctly.

Opus model.

{
    "defaultModel": "openrouter/free",
    "defaultProvider": "openrouter"
}

What if you don’t want OpenRouter?

OpenCode #

Well, there’s OpenCode’s big pickle:

Big Pickle is a stealth model that’s free on OpenCode for a limited time. The team is using this time to collect feedback and improve the model.

% pi -e npm:opencode-pi --provider opencode-cli --model opencode/big-pickle

User: which model are you?

Assistant: big-pickle

— § —

Reply via email

#ai #dev #pi

git: repair unreachable object corruption

serendipity@perrotta.dev (Thiago Perrotta) — Wed, 29 Jul 2026 22:16:46 +0200

♠ Problem statement: git fsck failed in a linked worktree, even though every branch and reflog remained intact.

The initial diagnosis was noisy: missing blobs, hundreds of dangling objects, and an invalid commit graph:

missing blob 97f9a2ed29f84e47848244c2d2626b2536a33c55
error: Could not read 003fb43a3aa361b52f2ab3f27bdabcb9b5137103
failed to parse commit 003fb43a3aa361b52f2ab3f27bdabcb9b5137103 from object database for commit-graph

Worktrees have their own administrative directory but share an object database:

% git rev-parse --git-dir
.git/worktrees/thiagowfx-prm-revenue-tagging
% git rev-parse --git-common-dir
.git

I checked every missing blob against objects reachable from refs and reflogs. None were reachable. Before removing them, I backed up objects, commit graphs, and index:

% common=$(git rev-parse --git-common-dir)
% backup="$common/repair-backup-20260729221124"
% mkdir -p "$backup"
% cp "$(git rev-parse --git-path index)" "$backup/worktree-index"
% ditto "$common/objects" "$backup/objects-before-gc"
% mv "$common/objects/info/commit-graphs" "$backup/commit-graphs"

The index also had an invalid cache-tree entry. Rebuilding it from HEAD preserves working-tree files; comparing its old entries found no staged changes:

% git read-tree HEAD
% GIT_INDEX_FILE="$backup/worktree-index" git ls-files --stage > /tmp/index-before-repair
% join -t $'\t' -v 1 \
    <(awk '{print $4 "\t" $1}' /tmp/index-before-repair | sort) \
    <(git ls-files --stage | awk '{print $4 "\t" $1}' | sort)
% # no output

Then Git could discard unreachable corrupt objects and rebuild its graph:

% git gc --prune=now
% git fsck --full --strict
% echo $?
0
% git fsck --full --no-reflogs --strict >/tmp/fsck
% echo $?
0

The backup remains under .git/repair-backup-20260729221124. fsck is clean; recovery material remains available.

It’s very weird to experience this kind of error. We’re not used to it.

The one trick to remember from this post is git fsck.

🤖 Drafted with /bloggify.

— § —

Reply via email

#coding #dev #git

obsidian: logseq-compatible tasks

serendipity@perrotta.dev (Thiago Perrotta) — Wed, 29 Jul 2026 14:34:39 +0200

♠ Previously.

Problem statement: preserve Logseq’s task syntax while opening the same markdown files in Obsidian.

My migration script originally converted every task into Obsidian’s checkbox syntax:

- TODO buy milk     ->  - [ ] buy milk
- DOING ...         ->  - [/] ...
- DONE ...          ->  - [x] ...

Obsidian itself does not recognize the left-hand side as tasks. The TODOseq community plug-in does:

- TODO buy milk
- DOING ...
- DONE ...

It keeps the file unchanged, adds clickable task states and a task list to Obsidian, and remains compatible with Logseq.

Before granting a community plug-in write access to my vault, I inspected the current release with the LLM™:

% git clone --depth=1 https://github.com/scross01/obsidian-todoseq.git /tmp/obsidian-todoseq-audit
Cloning into '/tmp/obsidian-todoseq-audit'...
% cd /tmp/obsidian-todoseq-audit
% git rev-parse --short HEAD
4ba5e81
% jq '{id, version, minAppVersion, description}' manifest.json
{
  "id": "todoseq",
  "version": "0.18.1",
  "minAppVersion": "1.11.0",
  "description": "Lightweight keyword-based task tracker using Logseq style keywords."
}

A source scan found no network requests, telemetry, process execution, or dynamic code evaluation¹.

It does read and modify notes through Obsidian’s vault API, as expected:

% rg -n 'vault\.(read|modify)' src/services/editor-controller.ts | head -4
1130:        const currentContent = await this.plugin.app.vault.read(todayNote);
1135:        await this.plugin.app.vault.modify(todayNote, newContent);
1283:        const todayContent = await this.plugin.app.vault.read(todayNote);
1286:        await this.plugin.app.vault.modify(todayNote, newTodayContent);

Low risk, and no task-format conversion needed.

This should make it easier for me to adapt my LogSeq muscle memory to Obsidian, even if at the cost of enabling community plug-ins.

🤖 Drafted with /bloggify.

Hope is not a strategy. ↩︎

— § —

Reply via email

#dev #pkm #security

pi: change directories mid-session

serendipity@perrotta.dev (Thiago Perrotta) — Wed, 29 Jul 2026 14:13:03 +0200

♠ Today I learned: pi 0.82.1 cannot change its working directory mid-session.

The interactive shell syntax looks tempting, but ! and !! run commands in a child process. cd ends with that process; Pi keeps the session’s original cwd. There is no built-in /cd either:

% pi --version
0.82.1
% docs="$(brew --prefix pi-coding-agent)/libexec/lib/node_modules/@earendil-works/pi-coding-agent/docs"
% rg -n 'ctx\.(newSession|switchSession|changeCwd|switchCwd)' "$docs/extensions.md"
1109:### ctx.newSession(options?)
1117:const result = await ctx.newSession({
1187:### ctx.switchSession(sessionPath, options?)
1192:const result = await ctx.switchSession("/path/to/session.jsonl", {
1220:      await ctx.switchSession(choice, {
1247:    await ctx.newSession({
1262:    await ctx.newSession({
% rg -n '^\| `/[^|]+`' "$docs/usage.md" | tail -5
56:| `/share` | Upload as private GitHub gist with shareable HTML link |
57:| `/reload` | Reload keybindings, extensions, skills, prompts, themes, and context files |
58:| `/hotkeys` | Show all keyboard shortcuts |
59:| `/changelog` | Display version history |
60:| `/quit` | Quit pi |

This has been requested several times upstream:

% for n in 2102 2992 3921 4423 6997; do
    gh issue view "$n" --repo earendil-works/pi \
      --json number,title,state,stateReason \
      --jq '[.number, .title, .state, .stateReason] | @tsv'
  done
2102	Allow extensions to change cwd at runtime	CLOSED	COMPLETED
2992	Allow session CWD to be changed	CLOSED	COMPLETED
3921	Feature request: ExtensionCommandContext.changeCwd() for lightweight cwd switching	CLOSED	NOT_PLANNED
4423	Add command API to switch cwd	CLOSED	COMPLETED
6997	Windows Bash inside Pi not working properly	CLOSED	NOT_PLANNED

The exact /cd proposal lives in #3921. The maintainer responses on #2102, #2992, and #4423 capture the trade-off:

#2102 @badlogic: use case makes sense, however, it can be done by overriding the built-in tools to support cwd changes.
#2992 @badlogic: setting a new cwd in a session is not great, as a bunch of things need to be rewired. currently unsupported.
#4423 @badlogic: this is part of the big refactor work and will be available in the new extension api.

That last API still is not exposed in 0.82.1. Changing cwd means rebuilding tools, project settings, extensions, skills, context files, autocomplete, footer state, and session storage—not merely calling process.chdir().

For now, the boring path is the supported one:

/quit
% cd ~/Workspace/perrotta.dev
% pi

Session cwd is a runtime boundary. Oh well.

🤖 Drafted with /bloggify.

— § —

Reply via email

#ai #coding #dev #pi

drskill: lint claude skills

serendipity@perrotta.dev (Thiago Perrotta) — Tue, 28 Jul 2026 19:09:34 +0200

♠ I found drskill through Drew Breunig’s post about managing an agent’s loadout.

Problem statement: lint skills bundled in a Claude Code plugin with drskill.

Running it through uvx is easy enough:

% uvx drskill scan --detailed
drskill scan — 3 harnesses (10 more empty), 9 skills
...
0 errors, 5 warnings (5 new) · token counts are approximate

But none of this repository’s 11 skills appeared. The known limitation explains why:

Claude Code skills bundled inside plugins are not scanned yet.

I projected the plugin’s skill directory into the plain .claude/skills layout that drskill understands via Justfile:

# Check skills with drskill
doctor:
    #!/usr/bin/env bash
    set -euo pipefail
    tmp=$(mktemp -d)
    trap 'trash "$tmp"' EXIT
    mkdir -p "$tmp/project/.claude/skills" "$tmp/home"
    for skill in "$PWD"/plugins/thiagowfx/skills/*; do
      ln -s "$skill" "$tmp/project/.claude/skills/$(basename "$skill")"
    done
    uv_cache=$(uv cache dir)
    cd "$tmp/project"
    HOME="$tmp/home" UV_CACHE_DIR="$uv_cache" uvx drskill scan --ci --harness claude-code

The temporary HOME excludes unrelated global skills. Reusing uv’s cache avoids redownloading drskill there. --ci makes warnings fail the recipe.

The first isolated scan found four warnings:

drskill scan — 1 harness, 11 skills

WARNINGS
  [e91d] new frontmatter-angle-brackets: 'bloggify' ...
  [a551] new frontmatter-angle-brackets: 'gha' ...
  [6335] new frontmatter-angle-brackets: 'new-apkbuild' ...
  [206e] new missing-activation: 2 skills never say when to use them ...

0 errors, 4 warnings (4 new) · token counts are approximate
exit=2

The fixes were small: remove angle brackets from argument-hint values and add explicit activation conditions to catchup and handoff:

-argument-hint: "<url>"
+argument-hint: "url"

-description: Create portable handoff document for another agent or harness to continue current work.
+description: Create a portable handoff document for another agent or harness to continue current work. Use when the user asks for a handoff, continuation brief, or context transfer.

Now the repository has its own linter:

% just doctor
drskill scan — 1 harness, 11 skills

No findings.
0 errors, 0 warnings · token counts are approximate

Restoring <url> temporarily made just doctor exit 2 again, so future warnings will break the check. I should add it to CI at some point.

🤖 Drafted with /bloggify.

— § —

Reply via email

#ai #claude #coding #dev

pi: block dangerous commands syntax-aware

serendipity@perrotta.dev (Thiago Perrotta) — Tue, 28 Jul 2026 10:57:06 +0200

♠ Problem statement: block destructive shell commands issued by pi without resorting to grepping shell source with regular expressions.

My first guard was a direct port of an older hook in Claude Code:

const BLOCKED_COMMANDS: ReadonlyArray<{ pattern: RegExp; reason: string }> = [
  { pattern: /terraform\s+apply/, reason: "terraform apply is blocked - use terraform plan first" },
  { pattern: /terraform\s+destroy/, reason: "terraform destroy is blocked for safety" },
  { pattern: /git\s+reset\s+.*--hard/, reason: "git reset --hard is blocked - discards changes irreversibly" },
];

const blocked = BLOCKED_COMMANDS.find(({ pattern }) => pattern.test(command));

This matched harmless strings such as echo 'terraform destroy', while shell quoting, wrappers, substitutions, and reordered options kept opening holes. Regexes aren’t robust in this context.

Enter ASTs! Shell source could leverage a shell parser.

I switched the extension to the Bash grammar from tree-sitter-bash, loaded through the WASM Tree-sitter runtime:

await Parser.init();
const languagePath = require.resolve("tree-sitter-bash/tree-sitter-bash.wasm");
const language = await Language.load(languagePath);
return new Parser().setLanguage(language);

Tree sitter is an amazing parser.

The policy now works on executable names and arguments:

if (executable === "rm") {
  const recursive = staticArguments.some(
    (argument) => argument === "--recursive" || hasShortOption(argument, "r") || hasShortOption(argument, "R"),
  );
  const force = staticArguments.some(
    (argument) => argument === "--force" || hasShortOption(argument, "f"),
  );
  if (recursive && force) return { command, reason: "rm -rf is blocked for safety" };
}

The AST walker also follows command substitutions, heredocs, bash -c, eval, find -exec, xargs, and common wrappers. Comments and quoted data remain data. Malformed syntax and dynamic guarded arguments fail closed.

ℹ tests 48
ℹ suites 0
ℹ pass 48
ℹ fail 0
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0

Local extensions do not get npm dependencies installed by Pi. I kept index.ts dependency-free: on first load it checks for the parser files, runs a pinned installation when needed, then imports the real guard.

const result = await pi.exec("npm", ["ci", "--ignore-scripts"], {
  cwd: extensionDirectory,
  timeout: 120_000,
});

const { default: dangerousCommandGuard } = await import("./guard.ts");
await dangerousCommandGuard(pi);

Finally, testing the real tool call:

% rm -rf /tmp/foo
rm -rf is blocked for safety
% test -f /tmp/foo/marker && cat /tmp/foo/marker
guard-test

The guard blocked the command; /tmp/foo/marker survived.

The source lives in my dotfiles.

🤖 Drafted with /bloggify.

— § —

Reply via email

#ai #coding #dev #pi #security

pi: asynchronous exit summaries

serendipity@perrotta.dev (Thiago Perrotta) — Mon, 27 Jul 2026 18:18:38 +0200

♠ Problem statement: ctrl+d in pi took several seconds to quit.

The culprit was pi-memory’s session_shutdown handler. It sent one last LLM request to summarize the session, wrote its answer to the daily log, then ran qmd update. Pi awaits all shutdown handlers, correctly, so quitting waited for everything:

pi.on("session_shutdown", async (event, ctx) => {
  const result = await generateExitSummary(ctx);
  fs.writeFileSync(filePath, entry, "utf-8");
  await runQmdUpdateNow();
});

Making that promise fire-and-forget would not work: Pi exits immediately after shutdown, and either the in-flight request keeps Node alive or gets killed before it can write anything.

Instead, I made the shutdown path write a durable job, synchronously:

const job: ExitSummaryJob = {
  version: 1,
  id: randomUUID(),
  createdAt: new Date().toISOString(),
  date: todayStr(),
  reason,
  sessionId: shortSessionId(ctx.sessionManager.getSessionId()),
  conversationText: truncated.text,
  truncated: truncated.truncated,
  totalChars: truncated.totalChars,
};

const jobPath = path.join(
  EXIT_SUMMARY_JOBS_DIR,
  `${job.createdAt.replace(/[:.]/g, "-")}-${job.id}.json`,
);
fs.writeFileSync(jobPath, `${JSON.stringify(job)}\n`, { encoding: "utf-8", flag: "wx" });

The next interactive session starts an unref’ed worker. It atomically renames one job to claim it, generates summary with active model, writes it back to original day’s daily log, and deletes job. Failed jobs return to queue. A stale claimed job retries after ten minutes.

I kept upstream package intact by replacing it with a local package, effectively forking it:

% pi remove npm:pi-memory
Removed npm:pi-memory
% pi install ~/.pi/agent/local/pi-memory-async
Installed /Users/thiago.perrotta/.pi/agent/local/pi-memory-async
% pi list
User packages:
  local/pi-memory-async
    /Users/thiago.perrotta/.pi/agent/local/pi-memory-async

Jobs live in ~/.pi/agent/memory/exit-summary-jobs/. ctrl+d only writes one JSON file now; summary happens during next session, without blocking exits.

Source code: pi-memory-async.

🤖 Drafted with /bloggify.

— § —

Reply via email

#ai #coding #dev #pi #pkm

pi: update pinned npm packages

serendipity@perrotta.dev (Thiago Perrotta) — Mon, 27 Jul 2026 14:28:59 +0200

♠ Problem statement: pin pi npm packages without giving up convenient updates.

My settings.json used to leave some package versions unpinned, until now:

     "npm:@heyhuynhgiabuu/pi-diff@0.7.6",
-    "npm:@tifan/pi-recap",
-    "npm:@tmustier/pi-tab-status",
-    "npm:@tintinweb/pi-subagents"
+    "npm:@tifan/pi-recap@0.4.4",
+    "npm:@tmustier/pi-tab-status@0.1.4",
+    "npm:@tintinweb/pi-subagents@0.14.3"

Exact versions make package installation reproducible (& safer), but Pi then does not automatically pull newer packages.

To tackle that, I added a just update-pi recipe that asks npm for each package’s current latest version and writes back an exact pin:

[doc('Update pinned Pi npm packages')]
[group('update')]
update-pi:
    #!/usr/bin/env bash
    set -euo pipefail

    settings="pi/.pi/agent/settings.json"
    updates="{}"
    while IFS= read -r spec; do
        if [[ "$spec" =~ ^npm:((@[^/]+/[^@]+)|([^@]+))(@[^@]+)?$ ]]; then
            package="${BASH_REMATCH[1]}"
        else
            echo "Invalid npm package spec: $spec" >&2
            exit 1
        fi

        latest="$(npm view "$package@latest" version)"
        pinned="npm:$package@$latest"
        updates="$(jq -cn \
            --argjson updates "$updates" \
            --arg spec "$spec" \
            --arg pinned "$pinned" \
            '$updates + {($spec): $pinned}')"
        echo "✓ $pinned"
    done < <(jq -r '.packages[] | select(type == "string" and startswith("npm:"))' "$settings")

    updated_settings="$(jq --argjson updates "$updates" \
        '.packages |= map($updates[.] // .)' "$settings")"
    printf '%s\n' "$updated_settings" > "$settings"

It handles every npm: entry, including scoped packages:

% just update-pi
✓ npm:@heyhuynhgiabuu/pi-diff@0.7.6
✓ npm:@heyhuynhgiabuu/pi-pretty@0.6.20
✓ npm:@tifan/pi-recap@0.4.4
✓ npm:@tmustier/pi-tab-status@0.1.4
✓ npm:@tintinweb/pi-subagents@0.14.3

The aggregate just update recipe invokes it alongside submodule, prek hook, and vendored-file updates.

🤖 Drafted with /bloggify.

— § —

Reply via email

#ai #coding #dev #pi #security

Anki: archive a deck

serendipity@perrotta.dev (Thiago Perrotta) — Mon, 27 Jul 2026 10:49:00 +0200

♠ Previously.

The Anki official docs do not provide explicit instructions about the archival of decks that are no longer needed.

Archiving is better than deleting because you never know when you may need a deck again.

One way to archive a deck is to simply export it as a backup and save it elsewhere. But then you collection becomes scattered. I’d really like to manage all my decks in a single place.

So I came up with a simple workaround.

First, create an Archive:: subdeck. A subdeck creates a parent-child relationship which, for our purposes, bundles all archived decks within an umbrella parent. It’s visually easier to manage and organize, effectively hiding archived decks from the deck list view.

Second, move the desired deck(s) within Archive::.

Third, one by one, open the cards/notes list (“Browse”) of a deck, select all cards/notes (Cmd-A), then suspend them all (Cmd-J or right click, “Toggle suspend”).

Side effect: cards/notes from the deck will no longer show up for review. At the same time, your past progress is kept, should you ever want to unarchive them.

— § —

Reply via email

#dev #pkm

pi: test drive an extension

serendipity@perrotta.dev (Thiago Perrotta) — Sun, 26 Jul 2026 01:24:35 +0200

♠ Problem statement: using pi, install an extension (package) as an one-off, without persisting it, for the sake of test-driving it, akin to pre-commit try-repo.

Solution:

% pi --help
[...]
--extension, -e <path> Load an extension file (can be used multiple times)
[...]

For example:

% pi -e npm:@tmustier/pi-usage-extension

added 1 package, and audited 2 packages in 1s

found 0 vulnerabilities

…then I can run /usage in that session.

— § —

Reply via email

#ai #dev #pi

obsidian: type * for a bullet point, not ** bold

serendipity@perrotta.dev (Thiago Perrotta) — Fri, 24 Jul 2026 10:04:46 +0200

♠ Problem statement: in Obsidian, out-of-the-box, typing * at the start of a new line emits *|* (an empty bold pair, cursor in the middle) instead of starting a bullet point.

The culprit is Settings → Editor → Auto pair Markdown syntax. With it on, every * auto-inserts its closing *, so a * followed by a space never gets the chance to become a list marker. In fact, we get a bullet point followed by a plain *, which we then have to delete.

To turn this setting off: set Settings → Editor → Auto pair Markdown syntax to off.

Now: * followed by a space at the start of a line converts it to a bullet¹, exactly like - does.

Surely inserting bullet points in Obsidian is a muscle memory artifact from migrating from LogSeq. ↩︎

— § —

Reply via email

#dev #pkm

pi: /btw side-chat

serendipity@perrotta.dev (Thiago Perrotta) — Wed, 22 Jul 2026 14:07:54 +0200

♠ Previously.

Problem statement: mid-task, I want to ask the LLM agent a quick tangential question — “will this change cause downtime?” — without polluting the main agent thread.

Claude Code has /btw¹ for exactly this. pi doesn’t, but patriceckhart/pi-btw does, as an extension. It opens a side-chat overlay: the LLM gets to see the full main thread context and answers, but nothing is written back to the conversation history.

The upstream extension imports the pre-fork @mariozechner/* package names, which are now deprecated. As such, I use earendil-works/pi. Rather than trust a diff I hadn’t read, I reimplemented it against the current API, and cross-checked against the bundled examples/extensions/summarize.ts (the canonical example for calling the model from an extension):

import { complete } from "@earendil-works/pi-ai/compat";
import type { ExtensionAPI, SessionEntry } from "@earendil-works/pi-coding-agent";
import { convertToLlm, getMarkdownTheme } from "@earendil-works/pi-coding-agent";

// ...inside the /btw command handler, once at entry:
const branch = ctx.sessionManager.getBranch();
const mainMessages = branch
  .filter((entry): entry is SessionEntry & { type: "message" } => entry.type === "message")
  .map((entry) => entry.message);
const mainLlmMessages = convertToLlm(mainMessages);   // frozen snapshot
const systemPrompt = ctx.getSystemPrompt();

// ...per question, the side-chat calls the model directly:
const response = await complete(
  ctx.model!,
  { systemPrompt, messages: [...mainLlmMessages, ...btwLlmMessages] },
  { apiKey: auth.apiKey, headers: auth.headers, env: auth.env, signal },
);

The key move is what’s missing: the handler never calls pi.sendMessage() or appends anything. It reads the branch once, talks to the model in an ctx.ui.custom() overlay, and returns. The main session is untouched, so the next real prompt doesn’t pay for any of it.

Added to ~/.pi/agent/extensions/btw.ts.

🤖 Drafted with /bloggify.

I am no longer using Arch, btw (sad!) ↩︎

— § —

Reply via email

#ai #coding #dev #pi

pi: auto-retry stalled requests

serendipity@perrotta.dev (Thiago Perrotta) — Wed, 22 Jul 2026 13:45:41 +0200

♠ Previously.

Problem statement: sometimes a prompt in pi just hangs, as if the network dropped. It never recovers on its own — I have to hit Esc and re-prompt.

It’s 2026, this symptom should be self-recoverable.

Pi already has agent-level retry on transient errors (retry.enabled defaults to true). The catch is when it fires: a stalled connection isn’t an error until the HTTP idle timeout trips, and that defaults to five minutes:

httpIdleTimeoutMs | number | 300000 | HTTP header/body idle timeout in milliseconds […] Set to 0 to disable.

So pi would have eventually recovered. I was just quitting long before the five-minute clock ran out. Who has patience to wait for 5 minutes?!

:∴ Lower the idle timeout to O(seconds) instead:

{
  "httpIdleTimeoutMs": 30000,
  "retry": {
    "enabled": true,
    "maxRetries": 5,
    "baseDelayMs": 2000
  }
}

Dropped into ~/.pi/agent/settings.json, documented in docs/settings.md. Now a stall errors out after 30s and pi retries automatically with exponential backoff (2s, 4s, 8s…), up to five attempts. There’s no need for Esc nor re-prompting.

The idle timer resets on every byte received, so long thinking or a slow stream won’t trip it — only a genuinely dead connection will. Restart pi for the change to take effect.

🤖 Drafted with /bloggify.

— § —

Reply via email

#ai #coding #dev #pi

pi: cycle models backward with ctrl+n

serendipity@perrotta.dev (Thiago Perrotta) — Wed, 22 Jul 2026 13:23:53 +0200

♠ Previously.

Problem statement: pi binds ctrl+p to app.model.cycleForward¹ by default, but has no default binding to cycle backward other than shift+ctrl+p, which is arguably difficult to remember.

Every keybinding in pi is namespaced and overridable via ~/.pi/agent/keybindings.json, documented in docs/keybindings.md:

{
  "app.model.cycleBackward": [
    "shift+ctrl+p",
    "ctrl+n"
  ]
}

ctrl+n is also the default for app.session.toggleNamedFilter, but that only fires inside the session picker, not while a model selector or the main editor has focus.

Run /reload in pi to pick up the keybinding addition without restarting the session.

∴ ctrl+p/ctrl+n now cycle models forward/backward, matching the readline (emacs!) history bindings I already have muscle memory for.

🤖 Drafted with /bloggify.

It cycles through models selected in /scoped-models. ↩︎

— § —

Reply via email

#ai #coding #dev #pi

pi: caveman mode

serendipity@perrotta.dev (Thiago Perrotta) — Wed, 22 Jul 2026 12:14:47 +0200

♠ Previously, previously.

Problem statement: adopt caveman in pi.

Pi isn’t one of the 30+ agents caveman auto-detects. The install matrix (INSTALL.md) lists agent detection rules one by one — claude, cursor, windsurf, opencode, openclaw, etc — and pi isn’t in it. Running the one-liner installer here would just skip everything silently. Booo!

Rather than run someone else’s curl | bash against an agent it wasn’t built for, “““I””” reimplemented the terse-speak part natively, since pi already ships the two primitives needed: skills and extensions.

A skill for /skill:caveman documentation, and an extension that rewrites the system prompt on every turn via pi.on("before_agent_start", (event) => ...):

const INSTRUCTIONS = `Caveman mode: on. Respond terse. Drop articles (a/an/the), filler (just/really/basically), pleasantries, hedging. Fragments OK. Short synonyms. Technical terms exact. Pattern: [thing] [action] [reason]. [next step]. Example — not: "Sure! I'd be happy to help you with that." yes: "Bug in auth middleware. Fix:"
Boundaries, always: code blocks, commit messages, and PR descriptions stay normal full verbosity, never compressed. Drop caveman style for security warnings, irreversible/destructive actions, or when the user seems confused — resume caveman after.`;

export default function (pi: ExtensionAPI) {
  let on = true; // auto-on by default, every session

  const applyStatus = (ctx: { ui: { setStatus: (k: string, v?: string) => void } }) => {
    ctx.ui.setStatus("caveman", on ? "[caveman]" : undefined);
  };

  pi.on("session_start", async (_event, ctx) => applyStatus(ctx));

  pi.on("before_agent_start", (event) => {
    if (!on) return;
    return { systemPrompt: `${event.systemPrompt}\n\n${INSTRUCTIONS}` };
  });

  pi.registerCommand("caveman", {
    description: "Toggle caveman terse-response mode: on|off (default: on)",
    handler: async (args, ctx) => {
      const arg = args.trim().toLowerCase();
      if (arg === "off" || arg === "stop" || arg === "normal") on = false;
      else if (arg === "on" || arg === "") on = true;
      else return ctx.ui.notify(`Unknown arg "${arg}". Use: on | off`, "error");
      applyStatus(ctx);
      ctx.ui.notify(on ? "Caveman mode on." : "Caveman mode off.", "info");
    },
  });
}

before_agent_start fires on every prompt, before the agent loop starts, so the instructions are re-appended each turn instead of relying on one message that could get pruned from context. Dropped in ~/.pi/agent/extensions/caveman.ts, auto-discovered, no /reload needed after the first load.

Unlike the Claude Code plugin, I skipped lite/full/ultra/wenyan — I called that bloat back in June, and I’m not adding it to my own version either. On or off is enough.

The result, unprompted:

user: caveman on or off now?

assistant: Caveman: on.

user: how to turn it off?

assistant: /caveman off

I also skipped the parts that don’t have a pi equivalent: the statusline savings counter, /caveman-stats, the caveman-shrink MCP proxy that rewrites tool descriptions (a proxy that rewrites what an agent sees is exactly the kind of thing worth reading before installing). The 40-line extension above covers what I actually wanted.

One rule baked into both the skill and the extension: code, commits, and PRs stay full verbosity, never compressed.

This experience was an eye-opener for me to realize how bloated the upstream caveman project became.

🤖 Drafted with /bloggify.

— § —

Reply via email

#ai #coding #dev #pi

★ logseq → obsidian

serendipity@perrotta.dev (Thiago Perrotta) — Mon, 20 Jul 2026 18:26:33 +0200

♠ Previously.

Problem statement: LogSeq v2 is moving its graph format from markdown files to a sqlite database:

This is not OK for my workflow.

The whole point of adopting LogSeq was, just like Obsidian, the promise of managing my notes in plain markdown files.

Even though this migration is supposed to improve the performance of the app, it ends up breaking a fundamental reason why I decided to use it in the first place.

Furthermore, the Second Brain app of my choice is supposed to be boring. It is a big deal to wake up one day and find that I can no longer open my notes graph with the new version of the app. This is a no-go.

Well, classic LogSeq (dubbed “Logseq OG”) will be kept around, but I can only assume that from this point on it will become poorly maintained — it will never get the same amount of resources and attention as the new version.

Also, even if I really wanted to use the new version, it turns out it does not work on mobile (iOS), which is a dealbreaker, therefore I would be forced to stay stuck with OG for a while. Heck, the iOS app hasn’t been updated in 2y anyway, and it shows.

There will be no hard feelings, this is a peaceful breakup; I enjoyed LogSeq, it’s simpler and more streamlined than Obsidian; as such, I will keep recommending it to most people.

That said, I’ve always been pondering whether to switch back to Obsidian. There’s no doubt that Obsidian is more actively maintained and better suited for Gen AI / LLM workflows these days (see Obsidian CLI for starters).

Why did I switch to LogSeq from Obsidian in the first place? Because Obsidian was too much for me. It was more complicated (in terms of its feature set) than warranted for my purposes. It offered more than I needed. That’s not necessarily a bad thing. It’s like saying (hypothetically) “I prefer nano instead of vim”, or that I prefer to live in a studio apartment than in a 3-bedroom house.

Obsidian won’t let me down in terms of changing its file format: file over app is one of their core promises:

File over app is a philosophy: if you want to create digital artifacts that last, they must be files you can control, in formats that are easy to retrieve and read. Use tools that give you this freedom.

File over app is an appeal to tool makers: accept that all software is ephemeral, and give people ownership over their data.

This is very important. My Second Brain app must not lock me in. LogSeq, upon the switch to a sqlite database, breaks this invariant. I want — I need — boring markdown files. Do not break the beauty and simplicity of this setup.

Migration #

LogSeq and Obsidian are similar but not identical.

In order to bridge the gap, a small python script (drafted by Claude Fable 5, reviewed by me) walked the existing LogSeq Graph and wrote to a fresh Obsidian Vault, leaving the source untouched, should I decide to roll back.

These are some mappings (LogSeq → Obsidian):

journals/2024_03_04.md         ->  journals/2024-03-04.md
pages/Foo___Bar.md             ->  Foo/Bar.md          (namespaces)
- TODO buy milk                ->  - [ ] buy milk
- DOING ...                    ->  - [/] ...
- DONE ...                     ->  - [x] ...
[[Feb 9th, 2026]]              ->  [[2026-02-09]]
((67ea7dba-3200-...))          ->  [[2025-03-31#^67ea7dba]]
{{embed ((67ea7dba-3200-...))}} -> ![[2025-03-31#^67ea7dba]]
{{video https://...}}          ->  plain URL
id:: 67ea7dba-3200-...         ->  ^67ea7dba block anchor (when referenced)
collapsed:: true, :LOGBOOK:    ->  dropped

Plus one line of config so that the LogSeq journals become Obsidian daily notes:

{
    "folder": "journals",
    "format": "YYYY-MM-DD"
}

…and then I spent some time trying to dumb down Obsidian, disabling core plug-ins I do not need at this time. There’s no need for community plug-ins for now (if ever).

So far, I only migrated my corp (work) notes. I’ll need to migrate my personal PKM as well, but I am happy to simply pilot this migration at work first, so that I don’t get to regret twice.

The migration script:

#!/usr/bin/env python3
"""Migrate LogSeq graph -> Obsidian vault. Source is never modified."""
import re
import shutil
from pathlib import Path

SRC = Path("/Users/thiago.perrotta/Library/Mobile Documents/iCloud~com~logseq~logseq/{redacted}")
DST = Path("/Users/thiago.perrotta/Library/Mobile Documents/iCloud~md~obsidian/{redacted}")

UUID = r"[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}"
MONTHS = {m: i + 1 for i, m in enumerate(
    ["Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug", "Sep", "Oct", "Nov", "Dec"])}

MARKER_MAP = {
    "TODO": "[ ]", "LATER": "[ ]", "WAITING": "[ ]",
    "DOING": "[/]", "NOW": "[/]", "IN-PROGRESS": "[/]",
    "DONE": "[x]",
    "CANCELED": "[-]", "CANCELLED": "[-]",
}


def journal_name(stem: str) -> str:
    return stem.replace("_", "-")


def dest_rel(src_file: Path) -> Path:
    """Map a source md file to its vault-relative destination path."""
    if src_file.parent.name == "journals":
        return Path("journals") / (journal_name(src_file.stem) + ".md")
    # namespace pages: A___B.md -> A/B.md; everything else under pages/
    parts = src_file.stem.split("___")
    return Path(*parts[:-1]) / (parts[-1] + ".md") if len(parts) > 1 else Path("pages") / src_file.name


def page_ref(src_file: Path) -> str:
    """Wiki-link target for a source file (what goes inside [[...]])."""
    if src_file.parent.name == "journals":
        return journal_name(src_file.stem)
    return "/".join(src_file.stem.split("___"))


def collect_ids():
    """uuid -> (link target, anchor) for every id:: definition; also which uuids are referenced."""
    defined, referenced = {}, set()
    for f in sorted(SRC.glob("pages/*.md")) + sorted(SRC.glob("journals/*.md")):
        text = f.read_text(encoding="utf-8")
        for m in re.finditer(rf"^\s*id:: ({UUID})\s*$", text, re.M):
            defined[m.group(1)] = (page_ref(f), m.group(1)[:8])
        for m in re.finditer(rf"\(\(({UUID})\)\)", text):
            referenced.add(m.group(1))
    return defined, referenced


def convert(text: str, defined, referenced) -> str:
    lines = text.split("\n")
    out = []
    in_fence = False
    in_logbook = False

    def resolve_ref(m):
        uuid = m.group(1)
        if uuid in defined:
            target, anchor = defined[uuid]
            return f"[[{target}#^{anchor}]]"
        return m.group(0)

    def resolve_embed(m):
        uuid = m.group(1)
        if uuid in defined:
            target, anchor = defined[uuid]
            return f"![[{target}#^{anchor}]]"
        return m.group(0)

    def date_link(m):
        mon, day, year = m.group(1), int(m.group(2)), int(m.group(4))
        return f"[[{year:04d}-{MONTHS[mon]:02d}-{day:02d}]]"

    pending_merge_indent = None  # indent of an empty bullet awaiting its continuation line

    for line in lines:
        stripped = line.strip()

        # merge continuation text into a bullet whose first line was a property
        if pending_merge_indent is not None:
            m = re.match(rf"^{re.escape(pending_merge_indent)}\s\s?(\S.*)$", line)
            pending_merge_indent = None
            if m and out:
                out[-1] = out[-1] + m.group(1)
                continue

        # LogSeq opens fences on bullet lines ("- ```lang"), closes with bare "```"
        if re.match(r"^\s*(?:[-*+]\s+)?```", line):
            in_fence = not in_fence
            out.append(line)
            continue
        if in_fence:
            out.append(line)
            continue

        # LOGBOOK drawers
        if stripped == ":LOGBOOK:":
            in_logbook = True
            continue
        if in_logbook:
            if stripped == ":END:":
                in_logbook = False
            continue

        # bullet-form property lines: block whose first line is the property itself
        # ("- collapsed:: true" with real content on the continuation line below)
        m = re.match(rf"^(\s*)- (collapsed:: (?:true|false)|logseq\.order-list-type:: number|id:: ({UUID}))\s*$", line)
        if m:
            indent = m.group(1)
            uuid = m.group(3)
            if uuid and uuid in referenced:
                out.append(f"{indent}- ^{uuid[:8]}")
            else:
                out.append(f"{indent}- ")
                pending_merge_indent = indent
            continue

        # property lines
        m = re.match(rf"^\s*id:: ({UUID})\s*$", line)
        if m:
            uuid = m.group(1)
            if uuid in referenced and out:
                # anchor goes at end of the block's first line
                for i in range(len(out) - 1, -1, -1):
                    if out[i].strip():
                        out[i] = out[i].rstrip() + f" ^{uuid[:8]}"
                        break
            continue
        if re.match(r"^\s*collapsed:: (true|false)\s*$", line):
            continue
        if re.match(r"^\s*logseq\.order-list-type:: number\s*$", line):
            # convert the previous bullet line to a numbered item; number it by
            # walking back past deeper lines to the previous same-indent sibling
            for i in range(len(out) - 1, -1, -1):
                bm = re.match(r"^(\s*)- (.*)$", out[i])
                if bm:
                    indent = bm.group(1)
                    n = 1
                    for j in range(i - 1, -1, -1):
                        if not out[j].strip():
                            continue
                        lead = out[j][: len(out[j]) - len(out[j].lstrip())]
                        if len(lead) > len(indent):
                            continue  # child or continuation line
                        if lead == indent:
                            nm = re.match(rf"^{re.escape(indent)}(\d+)\. ", out[j])
                            n = int(nm.group(1)) + 1 if nm else 1
                        break
                    out[i] = f"{indent}{n}. {bm.group(2)}"
                    break
            continue

        # task markers on bullet lines (not headings)
        line = re.sub(
            r"^(\s*)- (TODO|LATER|WAITING|DOING|NOW|IN-PROGRESS|DONE|CANCELED|CANCELLED)\s+",
            lambda m: f"{m.group(1)}- {MARKER_MAP[m.group(2)]} ",
            line,
        )

        # drop LogSeq priority markers
        line = re.sub(r"\[#[A-C]\]\s*", "", line)

        # embeds and block refs
        line = re.sub(rf"\{{\{{embed \(\(({UUID})\)\)\}}\}}", resolve_embed, line)
        line = re.sub(r"\{\{embed \[\[([^]]+)\]\]\}\}", r"![[\1]]", line)
        line = re.sub(rf"\(\(({UUID})\)\)", resolve_ref, line)
        line = re.sub(r"\{\{video ([^}]+)\}\}", r"\1", line)

        # date links: [[Feb 9th, 2026]] -> [[2026-02-09]]
        line = re.sub(
            r"\[\[(Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) (\d{1,2})(st|nd|rd|th), (\d{4})\]\]",
            date_link, line)

        # asset paths
        line = line.replace("](../assets/", "](assets/")

        out.append(line)

    result = "\n".join(out)
    if result.strip() == "-":  # LogSeq empty-page placeholder
        result = ""
    return result


def main():
    defined, referenced = collect_ids()
    orphans = referenced - set(defined)
    if orphans:
        print(f"WARNING: refs without target: {orphans}")

    written = 0
    for f in sorted(SRC.glob("pages/*.md")) + sorted(SRC.glob("journals/*.md")):
        rel = dest_rel(f)
        dst = DST / rel
        dst.parent.mkdir(parents=True, exist_ok=True)
        dst.write_text(convert(f.read_text(encoding="utf-8"), defined, referenced),
                       encoding="utf-8")
        written += 1

    assets_dst = DST / "assets"
    assets_dst.mkdir(exist_ok=True)
    copied = 0
    for a in SRC.glob("assets/*"):
        if a.name == ".DS_Store":
            continue
        shutil.copy2(a, assets_dst / a.name)
        copied += 1

    print(f"wrote {written} notes, copied {copied} assets")


if __name__ == "__main__":
    main()

— § —

Reply via email

#ai #bestof #dev #pkm #serenity

Sports.app

serendipity@perrotta.dev (Thiago Perrotta) — Mon, 20 Jul 2026 11:35:19 +0200

♠ The recently released Apple Sports app was surely a great way to keep up with the World Cup on the go.

It is very polished; it does one thing, and does it well. Simple yet effective. I do recommend it.

It’s especially handy when you’re not able to watch a match live for whatever reason.

If you’re able to watch a match in real time then it’s better to leave your phone in airplane mode, otherwise chances are you’ll get a goal notification from the app before you get to see it on the TV due to broadcasting delays. Wild.

— § —

Reply via email

#serenity

brew pin

serendipity@perrotta.dev (Thiago Perrotta) — Sat, 18 Jul 2026 14:53:04 +0200

♠ TIL: brew pin.

For reasons to be elaborated in another post, I am currently prevented from upgrading LogSeq to its latest version in homebrew:

% brew outdated
[...]
logseq (0.10.14) != 2.0.1
[...]

LogSeq v2 introduces breaking changes to my workflow. I found this out the hard way. As put by Valodim in HN:

And now after several years of complete stagnation, the supposed improvement is a database format to fix their technical issues, so I can no longer keep all my data as markdown files? At a time when half the edits are done by Claude and tracked with jujustu, this is just not useful for me.

All I wanted was the original vision, but with less bugs and more quality of life features.

As such, I would like to settle in the current version for now. Pinning to the rescue!

% brew pin logseq
Warning: logseq has `auto_updates true` and may update itself outside Homebrew despite being pinned.

% brew list --pinned
logseq

% brew outdated
[...]
logseq (0.10.14) != 2.0.1 [pinned at 0.10.14]
[...]

That’s all.

To unpin it in the future:

% brew unpin logseq

— § —

Reply via email

#dev #macos #pkm

★ The lifecycle of physical books

serendipity@perrotta.dev (Thiago Perrotta) — Sat, 18 Jul 2026 14:21:02 +0200

♠ Typically:

Step 1: buy a physical book — via Amazon, bookstores, classifieds marketplaces (e.g. Craigslist in the US, Kijiji in Canada, Kleinanzeigen in Germany). Bonus points for used copies. This should take up to a week.
Step 2: read the ~~goddamn~~ book. This is arguably the hardest part, albeit the most exciting one. As Alex Kotliarskyi puts it (emphasis mine):

The 80/20 rule says that 80% value come from 20% effort. What if we apply the 80/20 rule to the first 80%?

So 80% of 80% of value come from 20% of 20% of effort. Or 64% of the value come from 4% of the effort. Apply it again and you’ll get ~51% value from ~1% effort. Which is ballpark close to “Dimidium facti, qui coepit, habet” — Well begun is half done.

Once you start, it becomes much easier to go through it, I promise.

Step 3: Find a way to get rid of the book.

There’s no shame. Have gratitude, appreciate it, and then simply move on. I don’t like to stick with physical books forever. They unnecessarily occupy space in my home.

There are various ways to do so:

Donating is the easiest. Leave books by the vestibule of your apartment building complex with a post-it note stating that it’s free¹.
Leave books in public community bookshelves or libraries.
Gift a book to a friend. Bonus points for being thoughtful.
Sell a book in a classified site. Bonus points for using the same one you got it from.

And now, adding the missing alternative to my repertoire:

momox:

Schnell & einfach Gebrauchtes verkaufen Was möchtest du verkaufen? Bücher & Medien Kleidung

Momox is

a Berlin-based recommerce site for used books and media founded by Christian Wegner in 2004.

In plain English: it’s like selling a book in a classified, but without having to wait for someone to actually message you².

Scan or input its ISBN, get an estimate of how much you’ll get for it (assuming it’s in good condition), arrange a box, pack the book, ship it for free, wait, and then get paid. It’s very streamlined and easy to use.

So far, I’ve only heard of this concept in Germany. I would love to find out if it’s possible to follow suit in other countries.

Zu verschenken, as they say it auf Deutsch. In plain English, “for free” suffices. ↩︎
And eventually lowball or flake on you. ↩︎

— § —

Reply via email

#bestof #serenity

★ Project Aces OST

serendipity@perrotta.dev (Thiago Perrotta) — Fri, 17 Jul 2026 12:52:54 +0200

♠ Project Aces (from the Ace Combat series) has one of the best videogame OSTs ever.

I am¹ finally pleased² to find their whole collection available on Spotify as of 2026. Previously, only a handful of them were available.

No more fiddling random playlists on YouTube Music!

myrepos: a wip action to find unfinished work

serendipity@perrotta.dev (Thiago Perrotta) — Fri, 17 Jul 2026 12:23:10 +0200

♠ Previously.

Problem statement: I manage a few dozen repos via myrepos (mr), and I wanted a single command to show which ones have work in progress (“WIP”) — uncommitted changes, dirty staging area, stray branches and alike.

I want essentially a filtered version of mr ls.

So I defined my own command. A repo is not WIP when all three hold:

the default branch is checked out;
no other local branches exist;
and the working tree is fully clean.

Anything else gets flagged with a reason.

The definition:

# List repos with work in progress: not on default branch, extra local branches, or dirty tree.
# Run as `mr -m wip`: the -m (minimal) flag drops mr's per-repo "mr wip:" header and blank
# lines, leaving only the flagged repos. This cannot be defaulted per-action (mr only honors
# -m/-q as CLI flags, not via config).
wip =
 reasons=""
 cur=$(git symbolic-ref --quiet --short HEAD 2>/dev/null || echo "(detached)")
 def=$(git symbolic-ref --quiet --short refs/remotes/origin/HEAD 2>/dev/null | sed 's|^origin/||')
 if [ -z "$def" ]; then if git show-ref --verify --quiet refs/heads/main; then def=main; elif git show-ref --verify --quiet refs/heads/master; then def=master; fi; fi
 if [ -n "$def" ] && [ "$cur" != "$def" ]; then reasons="$reasons branch:$cur"; fi
 n=$(git for-each-ref --format='%(refname)' refs/heads | wc -l | tr -d ' ')
 if [ "$n" -gt 1 ]; then reasons="$reasons +$((n-1))_branches"; fi
 if [ -n "$(git status --porcelain)" ]; then reasons="$reasons dirty"; fi
 if [ -n "$reasons" ]; then printf '%s [%s]\n' "$MR_REPO" "${reasons# }"; fi

Naturally, the snippet above is art from the LLM, but it accomplishes exactly what I want:

thiago.perrotta ~
% mr -m wip
mr wip: /Users/thiago.perrotta/Corp/gitops
/Users/thiago.perrotta/Corp/gitops [branch:thiagowfx/acme +1_branches]

mr wip: /Users/thiago.perrotta/Corp/terraform
/Users/thiago.perrotta/Corp/terraform [+1_branches]

mr wip: /Users/thiago.perrotta/workspace/perrotta.dev
/Users/thiago.perrotta/workspace/perrotta.dev [+3_branches dirty]

Clean repos stay silent. I get to see all repos with unfinished work, and I can see exactly why each one is dirty.

mr wip works too but it’s noisier. I need to add mr -m wip to my muscle memory¹. Without the -m flag, mr prepends a mr wip: header and a blank line for every repo, WIP or not.

-m can’t be baked into the action definition — mr only honors it as a CLI flag — so the comment above the action documents it.

Previously I’d run mr xl (an alias for git branch -vv across every repo) and eyeball the result — but that’s dozens of lines of branch tips for tens of repos, and I still have to scan for the ones that are actually behind or dirty. wip does the scanning: it only prints the repos that need attention, with the reason attached. Much more ergonomic than visually diffing a wall of green.

Runs read-only, so it’s safe to run twice.

🤖 Drafted with /bloggify.

Should I rely on this workflow more often, I could leverage Espanso or a shell alias/function to easen its recall. ↩︎

— § —

Reply via email

#coding #dev #git

safari: (permanently) allow pop-ups for a domain

serendipity@perrotta.dev (Thiago Perrotta) — Thu, 16 Jul 2026 14:01:29 +0200

♠ Problem statement: a site / domain needs pop-ups for OAuth / logins, but I don’t want to disable Safari’s pop-up blocker globally just to appease a couple of domains.

Safari lets one scope the exception on a per-site basis. The domain has to be open in a tab first, so that its entry shows up in the list:

Open the site in a new tab.
Click Safari → Settings → Websites → Pop-up Windows (left sidebar).
Find the domain under “Currently Open Websites” and set it to Allow.

The blocker stays on everywhere else, as it should be.

The default at the bottom (“When visiting other websites”) is the global toggle; leave it on Block and Notify so only the sites I’ve whitelisted get through.

That per-site list is the same panel that governs camera, microphone, location, and auto-play permissions.

— § —

Reply via email

#macos #privacy

claude code: replace a hand-rolled loop with /goal

serendipity@perrotta.dev (Thiago Perrotta) — Thu, 16 Jul 2026 13:44:25 +0200

♠ Previously.

Problem statement: one of my skills, /pr-pass, was a hand-rolled loop — push, poll CI, fix a failure, re-push, repeat, bail after five iterations.

It works quite well, and it’s one of my most used skills.

That said, recently Claude Code shipped /goal (in v2.1.139), which is exactly that loop, packaging it as a primitive. So the skill was reimplementing something the harness now does natively.

In fact, most harnesses ship /goal natively these days.

We shall refactor!

/goal sets a completion condition. After each turn a fast model checks whether it holds; if not, Claude starts another turn on its own. It auto-clears once the condition is met. From the docs:

The /goal command sets a completion condition and Claude keeps working toward it without you prompting each step. After each turn, a small fast model checks whether the condition holds. If not, Claude starts another turn instead of returning control to you.

That deletes three things the old skill hand-built: the Monitor poll waiting on CI state, the “go back to Step 1” loop, and the max-5-iterations guard. The guard becomes a clause in the condition itself:

/goal every check on this PR has passed (gh pr checks shows no FAILURE
and no PENDING), or stop after 5 turns

One catch worth knowing before reaching for /goal: the evaluator (tester?) is a fresh model that only reads the transcript. It does not run gh or read files.

It does not call tools, so it can only judge what Claude has already surfaced in the conversation.

So the condition has to be something Claude’s own output demonstrates. The skill now says to paste the gh pr checks result into the reply every turn, so the evaluator has a CI state to judge against. Otherwise the goal would have never resolved thus it would have looped forever.

Another gotcha: /goal doesn’t touch permissions. Each turn’s git push still prompts unless paired it with auto mode.

The lesson generalizes past this one skill: whenever the harness grows a primitive, the custom code that predates it becomes technical debt. /loop, Stop hooks, and /goal now cover most of the “keep going until X” constructs I used previously.

🤖 Drafted with /bloggify.

— § —

Reply via email

#ai #claude #coding #dev

when Gen AI cites docs that don't exist

serendipity@perrotta.dev (Thiago Perrotta) — Thu, 16 Jul 2026 12:34:22 +0200

♠ Today in AGI: two Claude agents, same annotation, opposite answers.

I had a PR touching an ArgoCD PostSync hook. Ordering hooks within a phase needs an annotation, so I asked; Claude Code (Opus 4.8) and Claude in GitHub disagreed:

Claude Code: argocd.argoproj.io/hook-weight does not exist.
Claude in GitHub: it does exist.

Both stated it flatly. So I pushed the GitHub agent, and it doubled down — citing documentation(!):

This claim is incorrect. argocd.argoproj.io/hook-weight is a documented ArgoCD annotation for controlling hook execution order within a phase. From the ArgoCD resource hooks documentation:

Citing non-existent docs is the clanker equivalent of pulling rank.

Confident. Sourced. Wrong. The actual annotation for ordering is argocd.argoproj.io/sync-wave:

They are defined by the argocd.argoproj.io/sync-wave annotation. The value is an integer that defines the ordering.

metadata:
  annotations:
    argocd.argoproj.io/sync-wave: "5"

There is no hook-weight. The “documentation” it quoted from doesn’t say what it says it says.

Eventually it folded:

You are correct, and I apologize for the confident but incorrect claim in round 3.

Round 3. It took three rounds and a fabricated citation before the model conceded. The failure mode isn’t the hallucination — it’s the escalation to """docs""" as authority to defend it.

Same model family, same question, one right and one wrong. Verify against the upstream source, not against the more confident agent.

Human-in-the-loop is still very much needed, folks.

🤖 Drafted with /bloggify.

— § —

Reply via email

#ai #claude #dev #kubernetes

★ cmux

serendipity@perrotta.dev (Thiago Perrotta) — Tue, 07 Jul 2026 14:35:14 +0200

♠ cmux is the best implementation I’ve seen for agent orchestrators apps like Conductor, T3 Code, Dux, and friends:

Open source Ghostty-based macOS terminal with vertical tabs and notifications for AI coding agents. Built for multitasking, organization, and programmability.

It’s built on top of Ghostty¹ and it’s absolutely amazing. It’s effectively better than what I attempted to build once during an on-site hackathon wiring Claude Code sessions to Obsidian.

The invariant I care about the most:

restart your computer
reopen $APP
automatically restore every claude code session: layout & history preserved, scrollback intact

…is accomplished with fine elegance by cmux.

There’s no need to manually fiddle with tmux / zellij resurrection or alike.

Pair it with worktrunk (the wt CLI) for bonus points. Its integration is well-supported, achieving one cmux workspace per git worktree. For the time being I’m still invoking wt manually though, because that gives me more control.

It is very customizable.

Desirable side effect: existing ghostty settings are automatically inherited. They aren’t duplicated — they are effectively reused, which is superb. ↩︎

— § —

Reply via email

#ai #bestof #dev #ghostty

↗ Gerrymandle: daily gerrymandering puzzle

serendipity@perrotta.dev (Thiago Perrotta) — Fri, 26 Jun 2026 11:30:06 +0200

Welcome to Gerrymandle!

Draw electoral district lines to win more seats than your opponents and win the election!

Win the election for purple. Draw 5 districts of 6 populated tiles so that they win more districts than any other party.

This is fun! And eye-opening.

— § —

Reply via email

#gaming #serenity %commentary

★ claude code: ship your skills as a plugin marketplace

serendipity@perrotta.dev (Thiago Perrotta) — Thu, 25 Jun 2026 20:40:02 +0200

♠ Problem statement: my Claude Code skills lived in my .dotfiles, usable only on the machine that cloned them. I wanted them to be installable anywhere with one command, so that (for example) my teammates could easily adopt them.

Claude Code reads skills from a marketplace, which is essentially a git repo with a manifest. So I turned github.com/thiagowfx/skills into one. The layout:

.claude-plugin/marketplace.json    # marketplace manifest
plugins/thiagowfx/                 # one plugin
  .claude-plugin/plugin.json       # plugin manifest
  skills/<name>/SKILL.md           # one dir per skill (auto-discovered)

The marketplace lists plugins; a plugin bundles skills. I have one plugin holding all ten. I do not find it necessary to have multiple plug-ins at this point. marketplace.json points at it with a relative source:

{
  "name": "thiagowfx",
  "owner": { "name": "Thiago Perrotta", "url": "https://github.com/thiagowfx" },
  "plugins": [
    {
      "name": "thiagowfx",
      "source": "./plugins/thiagowfx",
      "description": "Thiago's personal Gen-AI / Claude Code skills."
    }
  ]
}

The plugin manifest is just metadata — there’s no need to enumerate skills. Anything under skills/<name>/SKILL.md is discovered automatically:

{
  "name": "thiagowfx",
  "version": "0.2.2",
  "license": "MIT"
}

The docs are explicit about why I keep that version:

Setting version means users only receive updates when you change this field, so bump it on every release. If you omit version and host this marketplace in git, every commit automatically counts as a new version.

I’ll go with version pinning for now.

Install from any machine:

/plugin marketplace add thiagowfx/skills
/plugin install thiagowfx@thiagowfx

/plugin marketplace update thiagowfx pulls future changes.

Outside Claude:

claude plugins update thiagowfx@thiagowfx

The whole thing — manifests, nine seeded skills, README, license — was scaffolded by Claude Code itself, which felt appropriately recursive: one of the skills I was packaging interviews me about a plan before any code gets written, so it grilled me about how to package the skills. Quite meta, eh?

Next up: point the dotfiles at the repo so there’s a single source of truth.

🤖 Drafted with /bloggify.

— § —

Reply via email

#ai #bestof #claude #coding #dev

★ caveman: talk like caveman, save tokens

serendipity@perrotta.dev (Thiago Perrotta) — Thu, 25 Jun 2026 01:30:43 +0200

♠ Long Claude Code sessions eat a lot of context, fast. Each response injects tokens into the context window: prose-heavy replies burn through it faster than terse ones ($$).

caveman is a Claude Code plugin that switches the model into a compressed communication style: drops articles, filler words, and pleasantries while keeping full technical accuracy. Claims ~75% token reduction per response.

Installation:

% /plugin marketplace add JuliusBrussee/caveman
Successfully added marketplace: caveman
% /plugin install caveman@caveman
✓ Installed caveman. Run /reload-plugins to apply.

After /reload-plugins, manually activate with /caveman. Manually deactivate it by saying “normal mode” or “caveman off”.

A session-start hook fires automatically on the next session, effectively auto-enabling it (M-x caveman-mode emacs vibes).

It ships three modes (lite, full, ultra) and three subagent presets (cavecrew-investigator, cavecrew-builder, cavecrew-reviewer). I don’t care. This is unnecessary bloat. An irony, for a plug-in intended to mitigate bloat.

The out-of-the-box installation is enough; tweaks are not necessary. The defaults are sensible.

In practice: responses are punchy. The model still reasons correctly; it just stops narrating. No “Sure, I’d be happy to help with that.” Just the answer.

~~You’re absolutely right.~~ no more!?

🤖 Drafted with /bloggify.

— § —

Reply via email

#ai #bestof #claude #dev

espanso: reload config after editing

serendipity@perrotta.dev (Thiago Perrotta) — Wed, 24 Jun 2026 13:34:06 +0200

♠ Previously.

Problem statement: espanso edit corp opens a config file, but saving it doesn’t take immediate effect.

At $DAILYJOB I keep a separate match file for work-specific snippets (“corp”). Espanso supports multiple match files under match/:

% espanso edit corp
Editing file: /Users/thiago.perrotta/Library/Application Support/espanso/match/corp.yml

After saving, the new trigger doesn’t expand. Espanso doesn’t auto-reload on file change.

The intended fix:

% espanso restart

Except that it has timed out:

unable to start service: timed out
Hint: sometimes this happens because another Espanso process is left running for some reason.
      Please try running 'espanso restart' or manually killing all Espanso processes, then try again.

A stale process was holding the IPC socket lock, so espanso restart, espanso start, and even espanso service start all timed out — while espanso status cheerfully reported espanso is not running. The hint is right, but its suggested remedy (run espanso restart again) doesn’t break the cycle.

On macOS, espanso runs as a launchd service. The reliable escape hatch is to bounce it through launchd, which owns the process:

% launchctl kickstart -k "gui/$(id -u)/com.federicoterzi.espanso"

-k kills the existing instance before restarting it. After that, corp.yml expands again.

Meta: should I create a trigger for this command? :P

🤖 Drafted with /bloggify.

— § —

Reply via email

#dev #macos

keychron k2: bluetooth always-on

serendipity@perrotta.dev (Thiago Perrotta) — Sat, 20 Jun 2026 23:51:02 +0200

♠ Problem statement: the Keychron K2 (C3, stock firmware) disconnects from macOS after ~10 minutes idle — and there’s no way to prevent it.

I spent some time looking for a fix. The usual suggestions:

Disable Bluetooth auto-sleep in macOS? macOS doesn’t do that — the keyboard decides to sleep, not the host.
Install a keep-alive app? The keyboard’s firmware powers down its own radio. By the time the app could send a ping, there’s nothing on the other end listening.
Key combo to disable sleep on the keyboard? Only on newer Keychron boards (QMK/VIA). The C3 runs stock firmware with no configurable sleep timer.
Flash QMK and set an infinite sleep timeout? The C3 isn’t a QMK board. Can’t.

The C3 stays paired — macOS reconnects on the first keypress, with ~1s lag. That’s the firmware’s design. The radio sleeps to save battery. Nothing running on the Mac can reach through a sleeping radio and wake the other end.

The only real fix: flip the side switch to Cable, plug in USB-C. No Bluetooth, no sleep, no drops.

Time to shop for a new Keychron, with QMK?

🤖 Drafted with /bloggify.

— § —

Reply via email

#macos

pre-commit: authentication in internal github repos

serendipity@perrotta.dev (Thiago Perrotta) — Thu, 18 Jun 2026 14:42:26 +0200

♠ Problem statement: prek can’t clone a repo: that lives in an internal (private) GitHub repo — https:// clone fails without credentials.

I forked my personal pre-commit-hooks into an org-owned repo and updated all our .pre-commit-config.yaml files to point at it:

- repo: https://github.com/<org>/pre-commit-hooks
  rev: 5695e23285bef67d1dee957e5c12e86f58ba843b # frozen: v1.0.0
  hooks:
    - id: check-bash-shebang

This approach works locally (my GitHub token is broad).

CI (github actions) fails though:

fatal: could not read Username for 'https://github.com': terminal prompts disabled

The repo is INTERNAL, not public. As such, prek clones the repo: URL to fetch the hooks; with no credentials on the runner, it can’t.

First instinct: git@github.com:<org>/pre-commit-hooks. Runners have no SSH key though!

The fix is to keep https:// in the config, mint a short-lived token that can read the hooks repo, and tell git to rewrite the URL:

- name: Generate app token
  uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
  id: generate-token
  with:
    client-id: ${{ vars.APP_CLIENT_ID }}
    private-key: ${{ secrets.APP_PRIVATE_KEY }}
    owner: ${{ github.repository_owner }}
    repositories: pre-commit-hooks
    permission-contents: read
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
  with:
    persist-credentials: false
- name: Authenticate git for internal hook repos
  env:
    TOKEN: ${{ steps.generate-token.outputs.token }}
  run: git config --global url."https://x-access-token:${TOKEN}@github.com/".insteadOf "https://github.com/"
- uses: j178/prek-action@bdca6f102f98e2b4c7029491a53dfd366469e33d # v2.0.4

Two things worth noting.

First: never inline ${{ steps.generate-token.outputs.token }} directly into a run: shell string — zizmor (a GitHub Actions security linter) flags it as a template injection risk. Pass it via env: and use the shell variable instead.
Second: the repositories: pre-commit-hooks scope only works if the App is actually installed on that repo. That one is a manual step in GitHub’s UI — github.com/organizations/<org>/settings/installations → the App → Repository access → add the repo. No amount of YAML fixes it otherwise; it silently returns a 404 from the App installation endpoint otherwise.

After the installation grant, the clone goes through and prek runs cleanly.

🤖 Drafted with /bloggify.

— § —

Reply via email

#dev #git #pre-commit

git: switch-to-default with wt

serendipity@perrotta.dev (Thiago Perrotta) — Sun, 14 Jun 2026 20:03:03 +0200

♠ My switch-to-default git alias had been trying branch names in order:

switch-to-default = !git switch --force main 2>/dev/null \
    || git switch --force master 2>/dev/null \
    || git switch --force $(git symbolic-ref refs/remotes/origin/HEAD \
        | sed 's@^refs/remotes/origin/@@')

It works, but it’s trial-and-error. Different people and different projects cannot decide whether to use main or master. It’s a mess.

Worktrunk tracks the default branch as part of its worktree state:

% wt config state default-branch
master

No need to guess!

New alias:

switch-to-default = !git switch --force \
    $(wt config state default-branch 2>/dev/null \
        || git symbolic-ref refs/remotes/origin/HEAD 2>/dev/null \
            | sed 's@^refs/remotes/origin/@@' \
        || echo master)

wt first, then fall back to origin/HEAD if wt is not installed, then master as a last resort.

🤖 Drafted with /bloggify.

— § —

Reply via email

#dev #git

Stop Energy

serendipity@perrotta.dev (Thiago Perrotta) — Sun, 14 Jun 2026 17:41:56 +0200

♠ RFC: What is Stop Energy? by Dave Winer:

Suppose someone, call him Mr. A, has an idea that he believes is ready to deploy, or is requesting comments as he is getting ready to deploy. So he posts an RFC, usually on a mail list or a website, in the hope that people will spot a problem and help him figure out a solution; or find no problems and co-develop an implementation, or develop a compatible implementation. In theory, the Internet is a collegial environment, with lots of people who want to do new stuff, where one should expect to get this kind of help.

In this scenario, A is a proponent of Forward Motion. In all likelihood, instead of getting help, A will encounter Stop Energy, reasons why he can’t or shouldn’t be allowed to do what he proposes.

Stop Energy is not reasoned, it never takes into account the big picture, it is the mirror image of Forward Motion. In the Stop Energy model, everyone, no matter how small their stake in a technology, has the power to veto. Nothing ever gets done, and people who want to move forward are frustrated in every attempt to move. Unfortunately, Stop Energy is the rule, not the exception.

— § —

Reply via email

#dev #serenity

Don't ask to ask

serendipity@perrotta.dev (Thiago Perrotta) — Wed, 10 Jun 2026 12:02:06 +0200

♠ Just ask! Just do it™:

[…]

So, to summarize, don’t ask “Any Java experts around?”, but rather ask “How do I do {problem} with Java and {other relevant info}?”

Previously.

— § —

Reply via email

#serenity

bloggify

serendipity@perrotta.dev (Thiago Perrotta) — Tue, 09 Jun 2026 16:50:11 +0200

♠ I’ve been drawing a line for ages here. My AI usage policy, quoting Derek Sivers:

I have never ever used AI to generate text in place of my “voice”. […] nothing claiming to be written by me is written by an AI.

Likewise, I said. Then in “new blog post via Claude Code” I held the line one more time: the LLM orchestrates the publishing, but “everything is still my own text, my own words. The LLM is not writing the prose.”

The line moved. Slightly. I wrote a /bloggify skill whose entire job is to draft a post in my own style / voice:

---
name: bloggify
description: Draft a blog post for perrotta.dev in the existing house style.
argument-hint: "<topic or what you want to write about>"
---

Write a blog post about `$ARGUMENTS` for the perrotta.dev blog.

The trick is that the style is already written down. The repo has a STYLE.md — derived by reading my own old posts — and the skill just points at it:

The repo owns the style. Read STYLE.md and CLAUDE.md first — they are the source of truth for voice, structure, frontmatter, and conventions.

It scaffolds with just new, follows the rules I’d already codified (minimal frontmatter, bold problem statement, code carries the weight, no “In this post I will…”), lints with prek, and hands back a draft. It does not commit.

So: is this still my own words?

Mostly. The skill forbids invented examples — it has to use real commands, real output, the real artifact. The structure is mine, written down a year ago. The voice is mine, learned from my old posts. The prose is the machine’s impression of me, and I edit it until it sounds like me again.

The line didn’t disappear. It just got blurrier.

I (still) commit to reading the entire post, paragraph by paragraph, and making manual changes to it to better match my style.

As of today, it’s not clear to me whether this approach will stick.

🤖 Drafted with /bloggify.

— § —

Reply via email

#ai #claude #dev #meta

kubectl: atomic upsert

serendipity@perrotta.dev (Thiago Perrotta) — Tue, 09 Jun 2026 16:16:12 +0200

♠ Problem statement: A cronjob refreshes an image-pull secret in every namespace so nodes can authenticate to a private registry. It does the obvious™ thing: delete the old secret, then create the new one right away:

kubectl delete secret --ignore-not-found aws-ecr-token -n "$namespace"
kubectl create secret docker-registry aws-ecr-token -n "$namespace" \
    --docker-server="https://$AWS_ACCOUNT.dkr.ecr.$AWS_REGION.amazonaws.com" \
    --docker-username="AWS" \
    --docker-password="$(aws ecr get-login-password --region "$AWS_REGION")"

Every couple of hours, for a fraction of a second, that secret does not exist in the cluster (booo!). Most of the time nobody notices. Occasionally a deploy step that copies the secret into a tenant namespace runs into exactly that gap, its kubectl get returns non-zero, and the whole deployment fails with ImagePullError. Occasional flakiness, our favorite kind.

The idiomatic fix is to never delete.

The solution is to employ kubectl create with a client-side dry-run that renders the object to YAML without touching the cluster; pipe that into kubectl apply and we get an upsert:

kubectl create secret docker-registry aws-ecr-token -n "$namespace" \
    --docker-server="https://$AWS_ACCOUNT.dkr.ecr.$AWS_REGION.amazonaws.com" \
    --docker-username="AWS" \
    --docker-password="$(aws ecr get-login-password --region "$AWS_REGION")" \
    --dry-run=client -o yaml | kubectl apply -f -

The first run creates the secret; every run afterwards updates it in place. There is no moment wherein it’s absent.

The thing I wanted to be sure of before trusting it: does apply over a secret that was originally created actually rotate the password, or does it merge in some way that leaves stale data behind? kubectl apply does a 3-way merge against the last-applied-configuration annotation, and that merge has bitten me before. A secret with no prior annotation falls back to a 2-way merge — so this is worth checking, just in case.

So I checked. Two consecutive upserts on a throwaway namespace, rotating the password between them:

% kubectl get secret aws-ecr-token -n "$ns" -o jsonpath='{.metadata.uid}'
38d4c676-7169-4d1d-9911-9de068bba29a   # run 1
# [...]
38d4c676-7169-4d1d-9911-9de068bba29a   # run 2 — same uid: never deleted

% kubectl get secret aws-ecr-token -n "$ns" \
    -o jsonpath='{.data.\.dockerconfigjson}' | base64 -d
{"auths":{"...":{"username":"AWS","password":"PASSWORD_V2_ROTATED",...}}}

The uid is stable across runs — proof the object was never deleted and recreated, only updated. resourceVersion bumped, the password rotated to the new value, and no trace of the old one lingered. The 2-way-merge worry didn’t materialize: for a flat field like .data.\.dockerconfigjson, apply replaces the value outright.

A uid that survives a refresh is the whole proof. Delete-then-create mints a new uid every cycle; an in-place update keeps it. If we ever want to know whether something replaced an object or mutated it, the uid is the way to go.

Two more things worth highlighting:

It’s atomic from a consumer’s point of view — the secret is never missing. It is not a transaction. apply is still a single API write; we’re trading a delete-then-create pair (two writes, with a gap) for one write (no gap).
--dry-run=client is the spelling since k8s 1.18. Older clusters used a bare --dry-run or --dry-run=true.

The same pattern works for configmaps, or anything else kubectl create knows how to build. create ... --dry-run=client -o yaml | apply -f - is the way to do whenever we’d otherwise reach for delete-then-create.

— § —

Reply via email

#dev #kubernetes

terraform police

serendipity@perrotta.dev (Thiago Perrotta) — Mon, 08 Jun 2026 01:21:44 +0200

♠ The Master wakes to a pager. Coffee is ready.

Apprentice: “Master, who created the drift?”

Master: “Which drift?”

Apprentice: “The bucket tag — live state ≠ terraform config in git.”

Master: “Show me the chain.”

They follow: pipeline → cronjob → github actions container → terraform CI bot → github pull request → human.

Apprentice: “We found them. Shall we ~~retaliate~~ punish?”

Master: “What would punishing do to the state?”

Apprentice: “Teach them not to drift.”

Master: “Teach the pipeline to ask ‘why’ first.”

Apprentice: “And what if entropy persists?”

Master: “Record why. The record is a lamp in the fog.”

Apprentice: “Who made the first drift in all systems?”

Master: “Entropy.”

Apprentice: “Then we’ll blame entropy?”

Master: “Blame nothing. Write the JIRA ticket.”

The apprentice writes the ticket. The pipeline asks “why” and then sleeps. The pager blinks once. Dawn sets. Just another ordinary day goes by.

What does the “Terraform police” do, you asked?

It pursues active drifts in the terraform repository.

It chases the individual(s?) responsible for deepening chaos.

It teaches them how not to do so anymore.

Rinse and repeat.

Will the workload of the “Terraform police” ever end?

Is drift an ephemeral state?

Is this world a simulation?

Is this a world simulation?

— § —

Reply via email

#dev #serenity #terraform

brew trust

serendipity@perrotta.dev (Thiago Perrotta) — Fri, 05 Jun 2026 10:37:31 +0200

♠ It’s a lovely day to upgrade my system:

% brew upgrade
[...]
Homebrew will ignore formulae, casks and commands from these taps when `HOMEBREW_REQUIRE_TAP_TRUST` is set.
This will become the default in Homebrew 6.0.0 or 5.2.0, whichever comes first.
Enable trust checks now with:
  export HOMEBREW_REQUIRE_TAP_TRUST=1
Trust specific formulae, casks or commands with:
  brew trust --formula <user>/<tap>/<formula>
  brew trust --cask <user>/<tap>/<cask>
  brew trust --command <user>/<tap>/<command>
or trust installed formulae from these taps with:
  brew trust --formula thiagowfx/pancake/pancake
  brew trust --formula thiagowfx/taps/cco thiagowfx/taps/python-is-python3
You can trust all formulae, casks and commands from these taps with:
  brew trust [...] thiagowfx/pancake thiagowfx/taps
Prefer trusting only the specific formulae, casks or commands you need.
Untap them with:
  brew untap [...] thiagowfx/pancake thiagowfx/taps
To keep allowing them by default during the transition:
  export HOMEBREW_NO_REQUIRE_TAP_TRUST=1
This is not recommended and will be removed in a later release.

This is a great move!

With many supply-chain attacks in open-source repositories lately, it’s a very welcome feature.

Do I trust myself? I think so!

% brew trust thiagowfx/pancake thiagowfx/taps
Trusted tap: thiagowfx/pancake
Trusted tap: thiagowfx/taps

— § —

Reply via email

#dev #macos

Codexbar

serendipity@perrotta.dev (Thiago Perrotta) — Sun, 31 May 2026 18:03:11 +0200

♠ Previously.

Peter Steinberger’s excellent codexbar:

CodexBar tracks usage windows, credit balances, and reset countdowns across the providers you actually pay for — one status item each, or merge them into one.

It’s a tiny app that sits in the macOS system tray.

Every imaginable provider is supported. Notable examples include: Codex (OpenAI), Claude Code (Anthropic), OpenCode.

— § —

Reply via email

#ai #dev