| Age | Commit message (Collapse) | Author |
|---|
|
The per-target files in /tmp/alacritty were deleted by the session's
cleanup trap, so a second window to the same host (or a relaunch racing
a previous exit) lost its config mid-flight and Alacritty logged
"Unable to load config ... File not found" on live reload. Suffix the
paths with the launcher PID so each instance owns its own files.
|
|
`theme --set <mode> <name>` needs a tmux conf and a ghostty colour file that
alacritty-format themes do not provide, so such a name fell back to the
generic dark/light tmux colours and left ghostty unchanged, exiting 0.
bin/theme-gen reads a theme in alacritty .toml format (by alacritty-theme
checkout name or path) or Ghostty's bundled `palette = N=#hex` format, and
writes config/tmux/colors/<name>.conf and config/ghostty/colors/<name>, plus
config/alacritty/colors/<name>.toml for a ghostty-format source.
Generated with it: sonokai, solarized_osaka_night, kanagawabones and
dracula_plus_high_contrast, with nvim stand-ins for the three that have no
nvim port installed.
Parsed keys go through eval, so only plain section.key names and hex values
are accepted: a theme file could otherwise run commands.
From dot request 20261017-110255-work-laptop-48c22c.
|
|
--inbox files into another inbox than dot: the path it posts to and the
namespace it signs in both follow it, so the key signs for that inbox only.
DOT_REQUEST_URL still overrides the whole URL for testing.
A signed request over 400 KB -- the inbox's limit on the wire -- now goes
xz -9e compressed with Content-Encoding: xz, which the inbox undoes before
checking anything; a smaller one goes as it is. --compress and --no-compress
override that either way. Compressing needs xz, so it joins the Brewfile;
without it a request that must be compressed is refused, never sent plain.
Checked against a local inbox: 148 KB sent plain, 740 KB compressed to 37 KB
and accepted, --no-compress over the limit refused with 413, --compress on a
small request accepted, a bad --inbox name refused before signing.
|
|
Push to talk on F20, Command Mode on Ctrl+F20, written into Flow's config.json
because its settings screen refuses F20 without a modifier while its key
listener accepts it. The key codes and action names come from reading Flow
1.6.1021's app.asar: shortcuts are keyed by macOS key codes string-sorted and
joined with "+", f20 is 90, ctrl is 59, ptt is Push to talk and lens is Command
Mode. splitKeybinds is kept in step so Flow cannot read back a disagreeing pair.
A bin/ tool rather than a link/ part, though it was proposed as one. It has to
quit and restart Flow for an edit to stick, and link.sh runs unattended after
every sync: a part that can kill a dictation mid-sentence is a poor trade for a
binding that can wait until someone asks for it. On demand it is also free to
fail loudly, since nothing else's run depends on it.
Flow ignores an AppleScript quit, so it gets a TERM; and it is launched by
bundle id, because the bundle contains a second app also called "Wispr Flow"
-- its Swift helper -- that `open -a` can start instead, which exits at once.
The file as first found is kept as config.json.pre-wispr-keys.
|
|
Every agent here except Claude Code reads AGENTS.md -- pi, codex, and aider now
that its read: says so. The vendor-neutral name was the symlink and the
Claude-specific one the real file, with a header saying the file was guidance
"to Claude Code". Swapped, keeping history on the real file through git mv.
Claude Code has read AGENTS.md directly since v2.1.277 and the machine this was
done on is newer, so the obvious move was to delete CLAUDE.md. Checking the
other machines first was worth it: four were on versions between 2.1.158 and
2.1.263, and a session on any of them would have found no instructions at all.
So CLAUDE.md stays as one line, `@AGENTS.md`, which the documentation endorses
for exactly this case and which -- unlike the symlink it replaces -- works on
Windows and does not trip Claude Code's refusal to write through a symlink. The
header says to delete it once every machine is current.
|
|
Three settings this account has always set by hand on every new Mac, now in the
script that exists for exactly that: the bottom-right hot corner sleeping the
display, tap to click, and three-finger drag on an external trackpad -- the
last a gap, since the script set it only for the built-in one.
Each of those is written in more than one place because macOS keeps them in
more than one place: an external Magic Trackpad has its own domain, and the
login window reads com.apple.mouse.tapBehavior rather than either of them,
per-host for this machine and globally for any other. Setting one and not the
others is why tap to click sometimes survives a reboot and sometimes does not.
bin/macos-defaults-diff is the general answer: snapshot, change one setting,
and it prints what moved, including the -currentHost domains a plain
`defaults read` never shows. It flushes cfprefsd first, since a change made
seconds earlier can otherwise be missing from the read meant to reveal it, and
it says plainly when nothing changed -- anything behind Privacy & Security
lives in the SIP-protected TCC database and cannot be scripted at all.
|
|
A clone made over https cannot publish anything, so a fix found on such a
machine is lost at the next pull. The instructions already said to hand back a
change request instead of editing; this is the command that does it. The
request is markdown on stdin, signed with a key that machine holds, and posted
to the inbox, which stores it only if the signature is from a key authorised
there. Where the key is not authorised, nothing is stored and the submission
says so.
The endpoint is named here, which the leak rule would otherwise forbid, and the
rule now carries the exception: a public endpoint this repo's own tooling must
reach, already published by a DNS record and a certificate in the transparency
logs, is not a leak. Concealing it would protect nothing and cost every machine
a hand-written config file; what protects it is the signature. The private
layer's check has the same exception, so it is enforced rather than remembered,
and it does not extend to hosts, addresses or internal-only names.
The other side is documented too: where `sz-requests` exists, what arrived can
be read and judged. A signature says which machine produced the text, never
that the text is right -- the machines filing these are the ones this account
does not fully control.
|
|
Shell, editor and terminal configuration, the tools that go with them, and
szecret, an age-based secret manager whose store lives elsewhere.
History restarts here. What came before was not written to be read by
anyone else, and carried machine names, addresses and an encrypted secret
store; it is kept privately instead. What is left is meant to be safe on
any machine, including one whose owner is not me: see CLAUDE.md for the
rule it is written to.
|
