Crate</th>	Job</th></tr></thead>
`nixup-core</code></td>`	Config, host resolution, scaffold (render host `default.nix</code> + inventory)</td></tr>`
`nixup-ops</code></td>`	Process runners: nix apply, stow, Determinate installer</td></tr>
`nixup-smoke</code></td>`	Required / optional binary checks</td></tr>
`nixup</code></td>`	Clap CLI, console, exit codes</td></tr> </tbody></table> Shared modules under `modules/</code>: common</code> (modern CLIs), shell</code> (nushell + starship binaries only), agents</code> (fail-soft activation for rustup, headroom, claude, codex, grok, beads, radicle), plus darwin/linux splits. Ghostty and the GUI messaging apps go through zerobrew with Homebrew as fallback. Not through pkgs.ghostty</code>. I have dual-install scars.</p>` Day-to-day surface</h2> nixup bootstrap # ensure Nix → apply → smoke → remind about stow nixup apply # switch for resolved host (switch is an alias) nixup smoke # --strict exits 2 if a required tool is missing nixup doctor # flake root, config, host map, light smoke nixup hosts # list; hosts sync materializes modules nixup status # OS, hostname, flake, nix version, resolved host nixup update # nix flake update nixup stow # optional --clone of defaults.dotfiles_url </code></pre> Hostname matching picks the host when you omit --host</code>. Unknown host exits 4. Missing Nix on the apply path exits 3 after host resolution, so exit codes stay stable when you fat-finger an id on a machine without Nix.</p> The open question I'm still chewing on: how much "activation script that curl \| bash installs AI tools" I want inside a declarative setup. Fail-soft is honest. Pure is prettier. Right now honest is winning.</p> I put the Mac mini behind Cloudflare and now typing feels wet 2026-07-17T00:00:00+00:00 Last time</a> I got the fleet boring on purpose. Same flake, same CLI verbs, same shell wherever I sat down. That fixed the PATH archaeology. It did not fix the café problem.</p> The mini is the one that stays on. Claude, Codex, Grok, already parked in zellij under Ghostty at home. The laptop is the one that leaves. I wanted those sessions from somewhere else without treating my router like a public API.</p> So I drew a hard box. Skip the VPN. Route the path through Cloudflare, because the sites already live there. SSH as the door: shell, attach to zellij, move files, Screen Sharing over a local forward later if I needed a mouse.</p> The garden deploys as static Workers. Remote access had to sit next to that stack without touching wrangler.toml</code>. One hostname, one tunnel, one Access app, then SSH keys the way they always work. Friends and a custom mobile app stayed on the wishlist. Half the work lived in the Cloudflare dashboard. The other half lived in nix.</p> I already had Cloudflare for the sites. Remote access meant opening Zero Trust and treating the mini like another application.</p> Identity first, and it is a two-dashboard job. Cloudflare Access wants GitHub as a login method. GitHub wants an OAuth App (the developer settings kind: homepage URL, callback URL, client ID, client secret). You create that app under the GitHub account or org you actually use, paste Cloudflare's callback URL into it, then paste the client ID and secret back into Zero Trust under Authentication. Leave MFA on the GitHub account itself. Policy on the Cloudflare side stays narrow: my GitHub identity only, no bypass, no service token I would paste into a chat. Session length around eight hours so a workday does not re-auth every coffee, but the next morning still knocks.</p> Then a self-hosted Access application on the subdomain I chose for SSH. That app is the bouncer. It does not replace the SSH key on the mini. It only decides whether Cloudflare will hand the connection to the tunnel. The first real ssh</code> still opens a browser, hits that GitHub OAuth app, and only then continues.</p> The tunnel is a named Cloudflare Tunnel for the mini. Create it, download the credentials JSON, run cloudflared tunnel route dns</code> (or set the same CNAME in the DNS UI) so the public name points at the tunnel, not the living-room router.</p> Somewhere in that flow Cloudflare waves a finish-setup URL with a long token. It looks bookmarkable. It is a one-shot enrollment link. I almost saved it into notes. That would have been a fun secret to leak.</p> When Access is happy and the connector shows healthy edges, the dashboard work is mostly done. The rest is whether the mini runs cloudflared</code> and sshd</code> without babysitting launchd.</p> This is where nixup</a> stopped being background lore.</p> Copy the credential to /var/lib/cloudflared/</code> as root 0600</code>. We argued about the UUID. First draft almost baked it into a shared Darwin module. Final split matches nixup hosts: tracked modules/darwin/cloudflare-remote-access.nix</code> enables SSH, writes /etc/cloudflared/config.yml</code>, and runs the tunnel under launchd. The gitignored personal host module only supplies tunnelId</code>, hostname, and authorized keys.</p> Ingress stays tiny:</p> ingress: - hostname: <access-subdomain> service: ssh://127.0.0.1:22 - service: http_status:404 </code></pre> Clients get cloudflared</code>, a key per laptop, and ProxyCommand cloudflared access ssh --hostname %h</code>. First connect opens a browser, the GitHub OAuth app consent screen, then Access, then the host key prompt. id -un</code> prints my username. After two dashboards and a consent screen, success felt almost unfair.</p> Outside the house, the laptop opens a real shell on the mini. Tunnel healthy, launchd keeps it, home IP changes stop mattering. Zellij attaches over that hop. Files ride SFTP or rsync -e ssh</code>.</p> Then I typed for real. Every character does a full trip through Cloudflare and back for the echo. Sticky on a good path. Paste-and-pray on mediocre mobile. Access is mostly connect-time (the browser dance you configured in Zero Trust). Typing lag is path length and remote echo.</p> Local comedy: Nushell ate PasswordAuthentication=n</code>. Module boundaries took longer than the YAML. I almost committed private host values, walked it back. nixup hosts sync --force</code> can still erase a hand-edited host file. Screen Sharing stays off Cloudflare: forward 5901</code> to loopback 5900</code> only.</p> Test latency from a hotspot before calling it finished. Throughput lies. Typing tells the truth. Access plus tunnel is a locked door with audit logs and GitHub MFA. It is a weak daily keyboard. Keep it for break-glass on the same account as the sites.</p> WARP is Cloudflare's always-on client. We skipped it for plain OpenSSH. Tailscale (or WireGuard) is the honest fix for a keyboard that feels local when a direct path works. Cost is another identity plane.</p> Where I am leaning: dashboard Access as break-glass, mesh VPN for daily shells. nixup made the machines interchangeable. Zero Trust clicks plus a tiny nix module made the mini reachable. Next bet is a keyboard that does not swim, still near Loki.</p> I got tired of setting up the same laptop three times 2026-07-17T00:00:00+00:00 Last month I sat down at the wrong Mac and spent twenty minutes wondering why half my PATH was from 2024. Same person, same tools, slightly different story of how they arrived. The other machine had the new zellij. This one still had the brew formula I thought I uninstalled. Loki was staring at me like I owed him a walk. Fair.</p> Two Apple Silicon Macs and a Linux host. Goal was boring: open a shell anywhere and get nushell, starship, neovim, the usual CLI pile, and the agent tools I keep reinstalling by muscle memory. What I had was folklore. "On the Mini you run this. On the other Mac, that. On Linux, pray."</p> So I put the machines in a flake and wrote a CLI so I would stop improvising. That project is nixup</a>. This post is how it holds the fleet together. The next one</a> is what happened when the always-on mini had to answer from outside the house.</p> On macOS it is nix-darwin plus home-manager. On Linux it is home-manager only. Packages and env hooks live in the flake. App configs live in .dotfiles</a> and land with GNU stow. That split sounds pedantic until home-manager and stow both try to own config.nu</code>. Nix installs the binary. Stow owns the config.</p> The public tree ships example hosts so CI can nix flake show</code> without my hostname in git. Real devices stay local. That boundary bites you the first time you hang a tunnel UUID on one host and almost push it.</p> I used to edit host modules by hand. That lasted until the second machine. Now the personal file is nixup.toml</code>, gitignored, copied from an example:</p> [[hosts]] id = "my-mac" match_hostnames = ["my-mac"] os = "darwin" flake_attr = "my-mac" [[hosts]] id = "my-linux" match_hostnames = [] os = "linux" flake_attr = "you@linux" apply = "home-manager" </code></pre> nixup hosts sync</code> turns that into hosts/<id>/default.nix</code> and hosts/inventory.nix</code>. flake.nix</code> imports the inventory when it exists, otherwise the example. Day-0 is roughly:</p> cp nixup.toml.example nixup.toml # edit hosts nixup hosts sync --yes nixup bootstrap --yes nixup smoke --strict </code></pre> Bootstrap checks for Nix, applies the host, runs smoke, then reminds me about stow. Apply is day-2. Doctor is "why is this machine weird." When I later needed SSH and a tunnel only on the mini, that same host file was how the feature could opt in without Remote Login on every Darwin box.</p> Pure flakes only see tracked files. My generated inventory is gitignored, which is correct for privacy and wrong for pure eval. Without force-staging, pure builds fall back to example hosts. CI always uses the example. Local apply uses the real inventory that never leaves the laptop.</p> I spent longer than I want to admit feeling smart about "everything is in the flake" and then watching pure mode ignore the host I just generated. The fix was design: example inventory in git, personal inventory local, CLI that regenerates from TOML. Tunnel ids and authorized keys want that same pocket. Shared modules stay tracked. Machine gossip stays home.</p> Nix gets the daily CLIs: nushell, starship, stow, neovim, zellij, atuin, lazygit, rg, fd, eza, uv, bun, zola. cloudflared</code> ended up there too, long before I asked it to babysit a tunnel.</p> GUI and cask-shaped things go through zerobrew on Mac, Homebrew as fallback while that migration finishes. Ghostty is cask-only on purpose. I will not dual-install a terminal again.</p> Agent tools are the messy middle. rustup, headroom, claude-code, codex-cli, grok, beads, radicle. Activation is fail-soft so a moved installer URL never tanks the whole switch. Smoke lists required tools. smoke --strict</code> exits 2 if one is missing. That receipt is why I trust apply again, and why agents can live on one always-on box while the other machines stay clients.</p> Nu scripts for bootstrap and smoke worked until they became the product. I wanted typed config, CI-friendly exit codes, and tests that do not need a full machine switch. Four crates: nixup-core</code>, nixup-ops</code>, nixup-smoke</code>, nixup</code>. Virtual workspace, resolver 3. Tests pin a temp nixup.toml</code> and assert unknown hosts exit 4 and strict smoke exits 2. Same verbs on every box: hosts sync</code>, apply</code>, smoke</code>, doctor</code>.</p> I still don't love all of it. Fail-soft curl installers inside a declarative system are honest and ugly. Secrets stay outside the flake. Stow still needs a dotfiles clone. Pure flakes stay rude about gitignored hosts, so I regenerate from TOML.</p> And once every machine finally felt like the same desk, a new itch showed up. The mini stays awake with zellij full of agents. The laptop leaves the house. Same shell, same flake, still no honest way to attach from a café without punching a hole in the router.</p> That part is next: Cloudflare to the mini, paid for in keystroke lag</a>.</p> Tools</h2> nixup</a></li> nix-darwin</a> and home-manager</a></li> Determinate Nix</a> when I need an installer that does not fight the daemon</li> GNU stow and a separate dotfiles</a> repo for configs</li> </ul> I turned my job hunt into a pipeline, then got rejected by my own tech stack 2026-07-12T00:00:00+00:00 Two rejection emails landed the same week this spring. One from Deepgram, one from ElevenLabs. Both polite, both no.</p> Here's the funny part. My side project runs on both of them. Voluble does real-time speech-to-speech translation: Deepgram turns speech into text, ElevenLabs turns it back, and I've been paying both at 2am for a year. Then both passed. If you want a quick lesson in humility, get rejected by the APIs you build on.</p> That was the mood in April. I needed a senior engineering role, I had EU work rights and a comp floor I wasn't pretending didn't exist, and my browser looked like a hostage situation. 40-something tabs of postings I'd half-read, and a spreadsheet whose "status" column stopped being true by week 1. I'd apply on a Tuesday, forget by Thursday, and rediscover the rejection three weeks later like a small archaeological find.</p> So I did the thing engineers do when they're avoiding their feelings. I built a pipeline.</p> The engine is career-ops</a>, an open-source job-search system by santifer. I use it, and over 3 months I've bent it pretty hard around how I actually work. The apply button stayed mine. Everything before it, I handed to the machine.</p> What I was hunting</h2> Wide, on purpose. Backend, AI and ML product engineering, plain senior software engineer, app and product roles, and senior or staff mobile. I've shipped iOS and Android, Go backends, and a Rust core behind a translation app. People keep filing me under "mobile dev," and that throws away half my range.</p> It all runs off two files.</p> config/profile.yml</code> is the me half: target roles, which archetypes are a real fit versus a stretch, where I can legally work, my comp floor, and a narrative block with the stories I want to tell (Voluble's Rust core, dragging an OTT app's ANR rate to 0.09%, the open-source work).</p> portals.yml</code> is the market half: a location filter, a title filter, a stack of Google dorks aimed at specific ATS platforms (one is literally site:jobs.ashbyhq.com "Backend Engineer" Netherlands OR remote</code>), and a list of tracked companies, each with a note on why it's worth an evening.</p> How it hunts</h2> Scanning is the cheap part, so I keep it cheap. It hits the Greenhouse, Ashby, and Lever APIs directly, no language model near it, and dedups every URL.</p> The job boards are the annoying part. LinkedIn, Glassdoor, and Indeed have no friendly APIs, and they hate scrapers. So I drive my own logged-in Chrome with Playwright, WebWright, and Claude for Chrome, reading the accessibility tree the way a screen reader would instead of brittle CSS. Because it's my own session, I'm not fighting bot checks, and keeping it local saved me more grief than anything else.</p> How it scores</h2> Every posting that survives gets scored into a report under reports/</code>: fit, seniority, red flags, and a legitimacy check. That last one earns its keep. A depressing number of "senior remote" listings are ghost jobs, and I'd rather learn that before I burn an evening on a cover letter.</p> Tailoring each application</h2> Each score comes with a report, and that report is where tailoring starts. It pulls out what this specific role wants: the archetype, the must-have skills, the words an ATS will grep for. That drives the CV.</p> Everything builds from one cv.md</code> plus the proof points in profile.yml</code>, and the generator assembles a per-company version from them. It reads the role's archetype and must-haves off the report, then decides which of my stories to lead with, which to keep, and which to cut. A backend role at Qonto pulls my Go and axum work and Voluble's Rust core to the front. A mobile role at Zalando leads with SwiftUI, Compose, and that 0.09% ANR number. It also makes sure the words the ATS is grepping for actually show up, when they're true. It never invents anything. It just decides which true thing goes first.</p> It renders two ways: a LaTeX path through xelatex (tectonic when the fonts sulk) and an HTML path through headless Chromium with the Unicode normalized, because half the ATS parsers choke on a smart quote.</p> The cover letter takes its angle from the company note I wrote in portals.yml</code>. For the AI companies that angle was obvious: I build Voluble on Deepgram and ElevenLabs, so I said so. (They passed anyway. We'll get to that.) The prose runs through voice-dna.md</code>, my anti-slop style guide. If a draft sounds like a language model in a tie, it fails.</p> Where I take over</h2> One step is never automated: applying. The machine gets me to a ranked, tailored shortlist and stops there. I sent every application by hand.</p> Three months of receipts</h2> Early April to mid-July, the plain version. I scored 440 postings. I passed on 110 of them (66 skipped on sight, 44 binned after a closer look) and left 234 sitting in the maybe pile. And I applied to 91 companies by hand, 96 applications once you count the few I went back for.</p> Where those landed so far: 34 no's, 4 interviews, 1 warm maybe (Beatgrid), no offers yet, and a healthy pile still pending or gone quiet. That's a job hunt.</p> The applications went wide, which was the point. Mistral AI and Speechify on the AI side. Sentry, Supabase, and Reddit for dev tools. Qonto, Airwallex, Rabobank, and ING in fintech. Figma, TomTom, Coolblue, Fairphone, Tibber, Wikimedia, Lely, and NOWATCH across product. For once my applications said out loud what I am: a senior engineer who ships across mobile, backend, and AI.</p> The rejections went wide too, and most were fine. Booking.com, ABN AMRO, Mollie, Picnic, bol, eBay, Mozilla, PostHog, Philips, Just Eat Takeaway, Xebia, Speakap. That's the job. And then Deepgram and ElevenLabs, which I keep framed in my head.</p> The 4 that turned into conversations are the ones I'm quietly proud of: bunq, Zalando (their Lounge team), Ditto (for Ditto Care), and Wypoon Technologies. A couple are still live as I write this.</p> What it's good and bad at</h2> It's good at volume without panic: it reads more postings in a morning than I'd manage in a week, and it catches ghost jobs I'd have fallen for. It's useless at the part that actually gets you hired, being a person a hiring manager remembers, or telling whether "senior" at a 12-person startup means staff-level scope or founder-does-everything chaos. That's still me, at my desk, with coffee.</p> 3 months in, the search is still open, but I can see all of it now. I know my conversion at every stage, I know which archetypes waste my night, and when a good role lands the boring work is already done.</p> And if bunq or Zalando works out, I owe Deepgram and ElevenLabs a thank-you note for the motivation.</p> Tools</h2> career-ops</a>, the open-source engine behind all of this</li> Playwright</a>, WebWright</a>, and Claude for Chrome</a> for driving my own logged-in browser</li> Tectonic</a> and xelatex for rendering the per-company CVs</li> Voluble</a>, the side project that keeps showing up here</li> </ul> My job hunt runs itself twice a day now 2026-07-12T00:00:00+00:00 Most mornings I find out how my job hunt is going before I'm properly awake. I shuffle to the kitchen, start the coffee, open the laptop, and there's a ranked shortlist in my inbox, each role with a one-page fit report. I didn't lift a finger for it. My Mac did the work at 6am while I was face-down in a pillow.</p> Last time</a> I walked through the pipeline. This is the bit I promised at the end: how it runs itself twice a day without me hovering over it.</p> Two runs, weekdays only</h2> I schedule the whole thing as local Claude Desktop tasks. One run early, before I'm functional, and one around 4pm, before I shut the laptop. The morning run scans and scores the overnight postings, so I wake up to coffee and a shortlist instead of 40 open tabs. The afternoon run sweeps up whatever went live during the day and tidies the tracker. Weekdays only. Senior roles don't really get posted on a Sunday, and I'm not reading ghost jobs on my weekend.</p> I'm hunting senior engineering roles across mobile, AI, backend, and product, so the net is wide: Reddit, Supabase, Qonto, NOWATCH, Lely. The scheduler doesn't care that those are five different archetypes. It reads, scores, and files.</p> Why it stays on my Mac</h2> The good listings live behind LinkedIn, Glassdoor, and Indeed, and all three want a real, logged-in session. My scanner drives my own Chrome over the remote debugging port, 9222, with the cookies I already have. A cloud runner has none of that. It'd trip every bot check on the first request and get my account rate-limited or worse. So the machine that does the scanning is the one on my desk. The scheduler just wakes it up on a timer.</p> The guardrails</h2> Running a job hunt unattended is a great way to embarrass yourself, so there are rules. It never applies: the agent gets me to an evaluated shortlist and stops, and a human sends every application. It respects rate limits instead of hammering a careers page, because a flagged LinkedIn would undo the whole point. And I audit what it writes: I skim the generated CVs and cover letters before anything goes out. A tailored letter with one wrong company name is worse than no automation at all.</p> The shortlist it hands me is real, though. Ditto Care and Zalando both turned into actual interviews. My favorite result is still a rejection: I built Voluble on Deepgram and ElevenLabs, name-dropped both as a warm angle in the cover letters, and both said no. Fair enough.</p> So that's the split. The computer does the grunt work, and I do the judging. Twice a day it hands me the 10 roles worth my attention and quietly bins the 300 that aren't.</p> Tools</h2> career-ops</a>, the engine</li> Claude Desktop scheduled tasks, the timer that runs it twice a day</li> Playwright</a>, WebWright</a>, and Claude for Chrome</a> for the scanning</li> </ul>

legolas.dev

I wanted agent state in Zellij, not another tab I forget about

2026-07-26T00:00:00+00:00

I run coding agents inside Zellij under Ghostty. Claude, Codex, Grok, Pi, whatever is useful that week. Several tabs. A few floating panes. The agent that needs a permission prompt never feels urgent until I happen to look at the right surface.</p>

You know the loop. Switch tab. Read the bottom of a scrollback. Switch again. Miss the one that finished twenty minutes ago. Desktop is quiet because nothing ever told it the state changed. The multiplexer is great at panes. It is not great at "which agent is stuck on allow?"</p>

I did not want another orchestration layer. I did not want a fork of Zellij just for a status rail. Stock 0.44.3+ was the bar. Two WASM plugins and a pure Rust core felt like the right size.</p>

The product itch came from Herdr</a> and its agent panes: real terminals, agent state rolled up so you can jump to blocked work instead of polling every surface by hand. Herdr is an agent multiplexer. I live in Zellij already. The design question was how much of that agent-pane idea can sit on</em> stock Zellij as plugins, without replacing the multiplexer.</p>

So I shipped zj-agents</a>.</p>

What it is for</h2>
zj-agents is semantic state for coding-agent panes on unmodified Zellij. A background engine</strong> discovers panes that look like known agents, classifies what the viewport is saying, and pushes a small snapshot. A sidebar</strong> renders that list, focuses a pane when you hit Enter, and stays hideable so it is not another permanent column.</p>
States matter more than pretty glyphs. Unknown. Idle. Working. Blocked. Done. Blocked means a real rule matched something like a permission prompt, not a random fallback. Done is derived: two successful Idle observations after Working while the pane is unfocused. Focus clears sticky Done without a notification spam loop. That table lives in pure code so tests can hammer it without a host.</p>
Desktop notifications exist, but only on new Blocked and Done transitions when the pane is not focused. Labels go through a sanitizer first. Hostile titles and markup do not get to train your notification daemon.</p>
What problem that actually closes</h2>
The desk problem is attention, not another chat UI. I already have agents. I already have panes. I needed a shared, boring truth:</p>

which pane is an agent</li>
what state it is in</li>
whether I should look now</li>
without pasting full screen contents into a second process that logs everything</li> </ul>
The engine is the only thing allowed to read viewports. The sidebar only sees sanitized metadata and derived state over a versioned pipe (`hello</code>, snapshot</code>, reload</code>). No bye, no ack theater. Privacy was a product requirement, not a footnote.</p>`
`Install is the usual Zellij story. No package manager. Release WASM, named aliases in config, load_plugins</code> for the engine. v0.1.0 is up with both artifacts and checksums. From the repo: nu scripts/install.nu --from-release</code>, or curl the assets into ~/.config/zellij/plugins/</code>.</p>`
`Where it came from</h2> Primary inspiration: Herdr's agent pane model</strong>. Semantic state on real PTYs (blocked, working, done, idle), see the herd at a glance, jump to what needs you. Herdr owns that stack as a multiplexer. I wanted the awareness layer without leaving Zellij.</p>`On the Zellij shelf I also checked awesome-zellij</a>. zj-radar</a> is the closest cousin (sidebar of agent states; more push/pipe). zellaude</a> goes deep on Claude in the status bar. zellij-attention</a> puts icons on tab names from hooks. Different shapes.</p> So the pitch is not "nobody did agent awareness." It is Herdr-shaped state on stock Zellij: fixture-backed manifests, engine plus hideable sidebar, no fork, no required hooks. Listing PR on awesome-zellij for that reason.</p> How it got built</h2> This one did not start as a blank weekend doodle. There was a design pass and a long implementation plan (semantic state, inventory bootstrap, atomic manifest reload, notification coalescing). Codex work handed off into a Grok-driven session under subagent-driven development: task, implement, review, fix until the bar held.</p> The same desk rules as other recent ships. No green CI that still ships stubs. No production warning suppressions as a lifestyle. Fixtures for Claude, Codex, Grok, Pi, and OMP before claiming detection. Patterns come from redacted captures, not README poetry. That slowed the agent list. It also kept OpenCode and friends out until someone brings real viewports.</p> Upstream style hygiene followed the same pattern as Keylore and tessera: dual license, Dependabot, verify on Ubuntu and macOS, release on v*</code> tags with git-cliff notes, branch rules that force linear history. Actions burned private minutes until the repo went public. Then the release job actually produced the WASM files the README pretends exist.</p> What is done, what is not</h2> Done: core state machine and protocol, five bundled agents with fixture gates, engine session model, sidebar, install from release, public repo, v0.1.0 assets.</p> Not done: I am not claiming a full interactive smoke matrix on every host. Zellij still needs permission grants once. Classification is only as good as the fixtures and rules. If your agent UI changes, manifests change. That is the product.</p> If you live in multi-agent Zellij sessions and keep missing the pane that is waiting on you, that is the itch. Clone or curl. Grant the batches. Open the sidebar. See if the desk gets quieter.</p> Tools</h2> kaankoken/zj-agents</a></li> Release v0.1.0</a></li> Herdr</a> (agent pane / agent multiplexer inspiration)</li> awesome-zellij listing PR</a></li> zj-radar</a></li> zellaude</a></li> zellij-attention</a></li> </ul>

How Keylore got planned on a twenty dollar day and shipped with Grok 2026-07-23T00:00:00+00:00 Planning Keylore ate almost a full day of a $20 package. Implementation with Grok 4.5 moved so much faster that I felt slightly scammed by the planning bill and grateful for the implement pass in the same hour. This post is that day, stretched into something I can still stand to read.</p> If you want the short why, the entry post</a> is enough. Here we stay on how the work ran.</p> The loop, without the costume</h2> I did not open a chat and say "build me a config manager" once. That path has bitten me before. Thin demos. Half-wired features. A README that lies about status.</p> The loop looked like this:</p> </p> Brainstorm and spec first. Write a plan second. When the plan wobbled, go back. Reiterate until the goal held. Only then subagent-driven development with parallel agents on the chunks, all under the same goal. Ship open source when the desk could use the app.</p> That is the whole ritual. No secret second process.</p> Who did which half</h2> Spec and planning ran on GPT 5.6 under a sol ultra setup. Long briefs. Boring acceptance notes. What local-first meant. What a kit was allowed to be. What v1 apps were in scope. What "consent" had to mean when a template wanted onto disk.</p> That half was slow on purpose. I kept pushing on holes: execution in kits, silent overwrites, fake multi-app support, release claims I could not keep. The meter on a $20 package does not care about your pride. It still runs down while you argue with a model about whether a template may ship a binary.</p> Implementation ran on Grok 4.5. Shoutout to the xAI team. Once the plan stopped falling over, the implement pass was the fun part. Milestone after milestone. Forms. Discovery. Kit consent paths. Shortcut views. Tests that fail when a dirty form would clobber a deploy. Template engine pieces and app pieces got separate attention so one agent was not inventing both a kit format and a window layout in the same breath.</p> I stayed in the loop for taste and for the dumb breaks. Green CI is a liar if you never open the window. Screenshots. Click the wrong mode. Edit AeroSpace, flip to Ghostty, come back, see if the buffer still makes sense. Save with dirty state. Cancel a load mid-flight. Agents propose. I try to break it. Fail again. Repeat.</p> Some days that meant three rounds on the same form adapter because the happy path looked fine and the second open of the same file did not. That is still cheaper than finding it after a tag.</p> What "done" meant on a chunk</h2> I kept a short quality list in ordinary language, the same spirit as the global bar on the diagram.</p> No red tests. No warning piles I planned to "clean later." No production stubs left as the real work. No TODO that was actually the feature. Use the skills that match the job. Prefer current tooling when I touch deps. Do not trust a stale local cache that says the world is fine.</p> That is not a manifesto. It is how you keep a multi-day agent run from turning into a junk drawer. When a chunk failed review, it went back. When the plan was wrong, the plan reopened. Spec was allowed to change when reality punched it. The diagram's reiterate arrow is not decoration.</p> Parallel agents helped on independent pieces. Shared state still needed a human with opinions. Two agents inventing two different "source of truth" stories for the same config is a special kind of headache. The goal text stayed shared so they were not solving different products by accident.</p> Where the money went</h2> I will say the quiet part. Planning was expensive relative to typing. A day of back-and-forth on a $20 package feels silly until you remember the alternative: a week of coding the wrong architecture with full confidence.</p> The package did not care which half was "creative." It billed the long arguments about consent and adapters the same as a short "rename this type" pass. I watched the budget go mostly into the former. That is fine. That is where the product got opinionated.</p> Implement was cheap by comparison. Grok 4.5 chewed through milestones that would have been me copy-pasting for evenings. I still had to read the diffs. I still threw some away. Speed without reading is how you open-source a haunted house.</p> If you run a similar loop, budget the boring half. Spec is where you decide kits cannot execute. Spec is where you admit v1 is four apps on Apple Silicon. Spec is where you stop promising a DMG you cannot build this week. Writing those sentences once saved me from "just ship a zip of scripts" at 2am.</p> Release reality, said out loud</h2> The repo is public: kaankoken/keylore</a>.</p> I burned through GitHub Actions minutes on other projects like a responsible adult with a hobby and a timer. So the CI-built, signed DMG story is incomplete. The code is there. The Actions dashboard is crickets. Give me about ten days and I will put a proper build up. Until then, clone it and build on an Apple Silicon Mac if you are impatient.</p> I am also half looking for a good reason to stop treating GitHub as the only place builds can happen. Hosting the machines myself is on the list. Homelab energy. Not this week. The minutes first have to regenerate like a sad little meter.</p> That is not a brand story. It is ops. Open source without a pretty installer is still open source. Lying about the installer is just lying.</p> When the minutes come back I will wire the verify path and the signed release story the README already describes. Homebrew cask, notarized tags, the usual adult packaging. Until then the honest install docs are: clone, open the workspace, build Release, run it.</p> What I would repeat</h2> Same loop on the next tool-shaped itch. Spec until it hurts. Plan until review stops finding new holes. Implement under a hard bar. Keep the human for the desk test.</p> I would also keep the split that worked here: a strong planner for the long argument, a fast implementer for the milestones, and me for "does this still feel like the app I wanted at 1am." Different models for different halves is allowed. Pretending one chat session is a full engineering org is how you get a demo and a hangover.</p> Keylore exists because I was tired of blind config edits. The agents did not invent that pain. They helped close it under a loop I could audit. If the product post is the desk, this post is the workshop floor: sawdust, rework, and a meter that hit zero at an inconvenient time.</p> Series</h2> I got bored of editing configs blind, so I shipped a macOS app</a></li> This post</li> </ul> Tools</h2> kaankoken/keylore</a></li> </ul> What Keylore actually does to your configs 2026-07-22T00:00:00+00:00 Last time</a> I said I got bored of editing configs blind and shipped a macOS app for it. This post is the product tour. What Keylore does when you point it at a desk full of tool configs, and why the boring safety choices are the point.</p> I still open LazyGit, Ghostty, AeroSpace, and Zellij every week. Each one keeps its own file shape. TOML over here. YAML over there. KDL if you are in Zellij land. Ghostty still likes its own line format. None of that is wrong. It just means I spent years grepping docs for keys I had already half-remembered.</p> Keylore is the app I wanted on that desk. Local-first. No account. No "sync your dots to our cloud" pitch. Point it at a workspace or a repo layout, and it tries to find the configuration files that already live there.</p> Finding the mess</h2> Discovery is the first job. You pick a root. Keylore walks the layout it understands and surfaces the apps it can talk to. In v1 that means the four I actually live in: LazyGit, Ghostty, AeroSpace, Zellij.</p> On my machine that root is usually a dotfiles-style tree, the same place I keep everything else under version control. Keylore is not hunting your entire home directory for fun. It is looking for known layouts and known files. When it finds one, you pick the app in the sidebar and go to work.</p> If a tool is not there, it is not there. I did not invent a universal plugin marketplace on day one. The list is short on purpose. I would rather ship four honest adapters than a fake "supports everything" page. Starship and Atuin have kit sketches in the repo tree for later; they are not the v1 promise on the README. Weekly tools first.</p> Apple Silicon only. macOS 14+. Same limits as the README. That is the machine I build on. If you are on Intel, this is not your app yet, and I am not going to soft-pedal that.</p> Editing without pretending</h2> Once an app is selected you can open its config. The files stay in their native formats. Keylore is not rewriting your Ghostty config into some private JSON of the week and hoping you never open the file again.</p> There is a text path with previews so a save is less of a coin flip. Syntax highlighting is enough to stop me from merging two KDL blocks with my face. There is also a structured path for options the kits and catalogs know about. Toggles, fields, rows for keybinds when the catalog has them. The goal is simple: see the option space on screen instead of hunting the same man page for the third time this month.</p> Some apps are happier in the form. Some still want the raw file. Both paths exist because I use both on the same afternoon.</p> I care about dirty state more than I should. If you changed a form and something else wants to overwrite the disk, the app should make you deal with that. Silent clobber is how people lose a half-hour of tweaks. The tests in the repo are full of that class of boring check. Form save writes. Dirty form blocks a reckless deploy. Stale edit sessions get rejected. Unsexy. Correct.</p> External edits still happen. You will open the file in another editor. The world is messy. Keylore has to live with that instead of pretending it owns the only process on the machine.</p> Template kits, with a hard stop</h2> Kits are optional. That sentence does a lot of work.</p> A kit is data. Catalogs of options. Default config fragments. Declarative payloads you can inspect. You opt in before anything lands. Kits do not ship executables. They do not run code on your machine. If a kit wants to "help" by running a script, it does not belong in this design.</p> I have installed enough "helpful" packages that quietly grew hands. Dotfile managers that shell out mid-install. Theme packs that assume your PATH. I wanted consent that means something. You see what is offered. You say yes. Then the data moves. If you never say yes, nothing installs.</p> Signed and declarative is the bar for the kit path. Local-first still holds. The kit is not a remote code delivery channel with a friendly name. If that sounds strict, good. Config managers that get clever with execution are how you wake up with a shell you do not recognize.</p> Shortcuts you can actually see</h2> Most of these tools have defaults. Then you override three of them and forget the rest exist.</p> Keylore has a shortcuts and defaults view for that. Effective keybindings from the official defaults plus your overrides, in one place. If a tool has a key you never set, you can still see what it does out of the box. That is half the reason I built the app. I was tired of "is this bound or am I imagining it" at 1am.</p> It is not a remapper for every app on macOS. It is the keybind story for the tools Keylore already understands. Scope stays small. The list stays honest.</p> What v1 is not</h2> v1 is not a full Nix-shaped declaration of your whole life. It is not a cross-platform GUI. It is not "bring any random TOML and we magic a form." Adapters matter. Catalogs matter. Ghostty's line format is not LazyGit's YAML, and the code knows that.</p> It is also not a finished release machine story. The code is public. Clone it. Build the Keylore scheme on an Apple Silicon Mac with a current Xcode. I already wrote about the Actions minutes I burned elsewhere. A pretty DMG from CI is still on the list. Source is the truth today.</p> If you want brew or a signed download later, that is the README path once the pipeline is awake again. Until then I would rather you have the repo than a broken "download now" button.</p> The shape I keep coming back to</h2> Discover what is on disk. Edit it in the format the tool already uses. Offer structure when the catalog knows the option. Install kit data only with consent. Show defaults and overrides for shortcuts. Stop before the app starts executing strangers' code.</p> That is the whole product pitch without the marketing coat of paint. If you only read this post and never the entry one, you should still know what you are installing: a native Mac app for a small set of developer configs, local-first, kit-shy on purpose.</p> More tools can land later. More adapters. More catalog depth. I will ship those when I use them weekly, not when a feature matrix looks lonely.</p> Series and where to go</h2> Day 1 was the why: I got bored of editing configs blind, so I shipped a macOS app</a>.</p> Day 3 is the how: planning with GPT, implementing with Grok 4.5, the reiterate loop, and the release mess. If you care more about the agent day than the option inspector, skip ahead when that post is up.</p> Repo lives here either way: kaankoken/keylore</a>. Open the workspace. Build Release. Point it at a real config root and try to break the boring paths. That is more useful feedback than a star on a README I wrote at 11pm.</p> Tools</h2> kaankoken/keylore</a></li> entry post</a></li> </ul> I got bored of editing configs blind, so I shipped a macOS app 2026-07-21T00:00:00+00:00 I got tired of opening the same config files and still not knowing what options I had. LazyGit keybinds. Ghostty settings. AeroSpace window rules. Zellij layouts. Half the time I was grepping the docs or someone else's dotfiles just to flip one thing I should have been able to see on the desk.</p> You know the loop. Open the file. Guess which key is real. Search the upstream README. Find three examples that disagree. Change one line. Restart the app. Wonder if you hit a default, an override, or nothing at all. I live in those tools all day. Blind edits got old.</p> The editor is fine for the text. Bad at the "what can this app even do" part of the job. I wanted a real macOS app on the desk: find the files, edit them in the formats they already use, show me the option space, and only install a template when I say yes.</p> So I shipped Keylore.</p> </p> Keylore is a native macOS app for developer app configs. Local-first. Point it at a workspace or a repo layout and it finds the configuration files sitting there. You edit in the formats those tools already speak: TOML, YAML, KDL, and the line formats some of them still use. Previews are there so a save is less of a guess.</p> Template kits are optional. You opt in. They are data only: signed, declarative payloads. Kits do not ship executables, and they do not run code on your machine. That consent line mattered. I have installed enough "helpful" packages that quietly grew hands.</p> There is also a shortcuts and defaults view. Effective keybindings from the official defaults plus your overrides, in one place, instead of bouncing between man pages and three config layers. If a tool has a key you never set, you can still see what it does out of the box.</p> v1 supports LazyGit, Ghostty, AeroSpace, and Zellij. Apple Silicon only. macOS 14+. That is the desk I live on, so that is what shipped first. Those four are the ones I open every week.</p> How it got built is a short story for this post. I planned the whole thing with GPT 5.6 on a sol ultra setup. Spec and plan ate almost a full day of a $20 package, with a reiterate loop until the goal held. Implementation ran on Grok 4.5 and moved a lot faster than the planning did. Spec first, plan next, push back until it stopped falling over, then subagent-driven development with parallel agents on the chunks. Shoutout to xAI for Grok 4.5; the implement pass was the fun part. Day 3 of this series goes into that loop for real. This one stays on why the app exists.</p> </p> There is a product post next: discover, edit, kits, shortcuts, and how the safety model actually works. After that, the process post: who planned, who implemented, how the loop felt day to day, and the release mess I am still cleaning up. Three days, same thread.</p> And yes, about that release mess. I burned through my GitHub Actions minutes on other projects like a responsible adult with a hobby and a timer. So today there is no CI-built DMG for you to click. The code is open. The signed binary pipeline is me looking at the Actions dashboard and hearing crickets. Give me about ten days and I will put a proper build up. Until then, clone it and build on an Apple Silicon Mac if you are impatient, or wait with the rest of us.</p> I am also half looking for a good reason to stop treating GitHub as the only place builds can happen. Hosting the machines myself is on the list. Homelab energy. Not this week. The minutes first have to regenerate like a sad little meter.</p> Tools</h2> kaankoken/keylore</a></li> </ul> I forked Zellij so my terminal could show images again 2026-07-18T00:00:00+00:00 I live in Zellij under Ghostty. Yazi, Codex, Grok... half the tools I use every day want to put an image in the pane. On a normal terminal that works. Inside Zellij it was just empty space.</p> Outside the multiplexer those apps draw fine. Inside it they speak the Kitty Graphics Protocol over APC, and the vte</code> path Zellij uses throws APC away before the grid ever sees it. Zellij already had Sixel. It did not have this path. Agents sit in my panes for hours. I was done opening a raw window every time something needed a picture.</p> So I forked it.</p> I could have pasted a thin passthrough and hoped. I have paid for that class of fix before. This time I wanted something that still worked after resize, multi-client attach, and the dumb edge cases those tools actually hit. That meant treating it like real Rust work, and running the agents under a loop I could trust.</p> How I ran the agents</h2> Ultracode on. Superpowers brainstorm with a long, boring brief: what KGP does on the wire, how Sixel already works in this codebase, Ghostty as the host, and the acceptance desk (Yazi previews, Codex pets, Grok images). Then Fable-5 at max effort on the design. If the review found holes, back into brainstorming. When the design held, write-plan. Same Fable gate on the plan. Issues reopen the plan. Only after that did subagent-driven development start, and every milestone got the same review until it passed.</p> </p> While that loop ran I kept the same rules in the brief every time: no errors, no warnings, no red tests. No warning suppressions in production code (test-only allow</code> with a reason is fine). No stubs, no TODO left as the real work. Use the skills that match the job. Latest deps when I touch crates and workflows. Do not trust a stale local tool-version cache.</p> That is the agent story. It only mattered because the desk needed a real multiplexer change, not a demo.</p> What had to be true in the code</h2> Ghostty still draws the pixels. Zellij is a bad place to become a graphics engine. The job is capture, bookkeeping, and re-emit.</p> Catch ESC _ G … ST</code> in front of vte</code> so the stream is not dropped. Store image bytes and placement metadata under ids Zellij owns (apps use their own ids; rewrite once on the way in). Put Unicode placeholder cells in the grid (U+10EEEE plus the diacritics the protocol uses) so scroll, resize, and occlusion stay honest. Re-emit the right sequences per attached client. If a client cannot do placeholders, stay dormant. Quiet beats a pane full of broken characters.</p> Early review passes killed the cute shortcuts. Id schemes that fall over on quiet transmits. Probes that lie about capability. Inventing a reverse channel when host_query</code> already exists. Direct placements still get turned into placeholders under the hood so the grid stays the source of truth.</p> Then the milestones ran under that plan. Same bar. Same review. CI was green while a pet still sat on the wrong cells, so the human half stayed in the loop: screenshots, a kgp-log</code> trail, resize, detach a second client, scroll, try again. Pets fighting the grid. Backgrounds wrong after a grid tweak. Capability checks that made an app decide KGP was dead forever. Yazi zero-extent placements that looked fine until you noticed the preview never painted. Agent proposes the next fix. I attach and try to break it. Fail again. Repeat until the daily tools stop lying.</p> What works now</h2> Public fork on main: kaankoken/zellij</a>. On Ghostty, Yazi previews, Codex pets, and Grok images show up inside the session I already live in. I am not jumping to a second terminal for pictures anymore.</p> Upstream already said something useful</h2> PR 4851</a> was a Kitty-only passthrough. Maintainer imsnif closed the conversation on 2026-03-14 with a clear long-term preference: generic, protocol-agnostic passthrough</strong>, so Zellij does not grow a special case for every graphics dialect that shows up next year. Fair call for the project.</p> My fork is deeper KGP bookkeeping on purpose: placeholders, zellij-owned ids, local answers for app queries from a host capability probe. It keeps the desk honest today. It is also a protocol-specific shape, which is the maintenance cost he wants to keep out of tree. Both of those stand.</p> Next step for me is to honor that decision and aim a contribution at the generic direction he described. The fork stays the daily-drive bridge while that work exists.</p> Tools</h2> kaankoken/zellij</a></li> zellij-org/zellij#4851</a></li> Ghostty</a></li> Yazi</a></li> </ul> nixup: one CLI for every machine I touch 2026-07-17T00:00:00+00:00 I got tired of applying a different mental model every time I sat down at a machine. Mac Mini, another Mac, a Linux box. Same tools, three slightly different stories of how they got there.</p> So I built nixup</a>: a small Rust CLI that owns day-0 and day-2 for a multi-host Nix flake. The flake is nix-darwin + home-manager on Apple Silicon, home-manager only on Linux. App configs stay in .dotfiles</a> and land via GNU stow. This repo owns packages, shell hooks, and agent installers.</p> What I was trying to learn</h2> How far you can push "config is the source of truth" when Nix wants files on disk, pure flakes ignore gitignored paths, and half your tools still come from curl installers and casks.</p> Also: can a thin Rust CLI make that feel boring in a good way?</p> The model</h2> nixup.toml</code> is personal and gitignored. You copy from nixup.toml.example</code>, list hosts, smoke checks, and defaults.</p> [[hosts]] id = "my-mac" match_hostnames = ["my-mac"] os = "darwin" flake_attr = "my-mac" [[hosts]] id = "my-linux" match_hostnames = [] os = "linux" flake_attr = "you@linux" apply = "home-manager" </code></pre> Then:</p> nixup hosts sync --yes # writes hosts/<id>/ + hosts/inventory.nix nixup bootstrap --yes # Nix if needed, apply, smoke nixup apply --yes nixup smoke --strict nixup doctor </code></pre> Host modules and the inventory are generated. I do not hand-edit them as the long-term source of truth. Edit the TOML, re-sync, apply.</p> That collides with pure evaluation. Flakes only see tracked files. Personal hosts/inventory.nix</code> and hosts/<id>/</code> stay local and gitignored, so pure eval falls back to committed example hosts (my-mac</code>, my-linux</code>) unless you force-stage your private inventory. CI always uses the example. My real machines never need to be in the public tree.</p> Layout</h2> Four crates, virtual workspace, resolver 3:</p> Crate</th> Job</th></tr></thead> nixup-core</code></td> Config, host resolution, scaffold (render host default.nix</code> + inventory)</td></tr> nixup-ops</code></td> Process runners: nix apply, stow, Determinate installer</td></tr> nixup-smoke</code></td> Required / optional binary checks</td></tr> nixup</code></td> Clap CLI, console, exit codes</td></tr> </tbody></table> Shared modules under modules/</code>: common</code> (modern CLIs), shell</code> (nushell + starship binaries only), agents</code> (fail-soft activation for rustup, headroom, claude, codex, grok, beads, radicle), plus darwin/linux splits. Ghostty and the GUI messaging apps go through zerobrew with Homebrew as fallback. Not through pkgs.ghostty</code>. I have dual-install scars.</p> Day-to-day surface</h2> nixup bootstrap # ensure Nix → apply → smoke → remind about stow nixup apply # switch for resolved host (switch is an alias) nixup smoke # --strict exits 2 if a required tool is missing nixup doctor # flake root, config, host map, light smoke nixup hosts # list; hosts sync materializes modules nixup status # OS, hostname, flake, nix version, resolved host nixup update # nix flake update nixup stow # optional --clone of defaults.dotfiles_url </code></pre> Hostname matching picks the host when you omit --host</code>. Unknown host exits 4. Missing Nix on the apply path exits 3 after host resolution, so exit codes stay stable when you fat-finger an id on a machine without Nix.</p> The open question I'm still chewing on: how much "activation script that curl | bash installs AI tools" I want inside a declarative setup. Fail-soft is honest. Pure is prettier. Right now honest is winning.</p> I put the Mac mini behind Cloudflare and now typing feels wet 2026-07-17T00:00:00+00:00 Last time</a> I got the fleet boring on purpose. Same flake, same CLI verbs, same shell wherever I sat down. That fixed the PATH archaeology. It did not fix the café problem.</p> The mini is the one that stays on. Claude, Codex, Grok, already parked in zellij under Ghostty at home. The laptop is the one that leaves. I wanted those sessions from somewhere else without treating my router like a public API.</p> So I drew a hard box. Skip the VPN. Route the path through Cloudflare, because the sites already live there. SSH as the door: shell, attach to zellij, move files, Screen Sharing over a local forward later if I needed a mouse.</p> The garden deploys as static Workers. Remote access had to sit next to that stack without touching wrangler.toml</code>. One hostname, one tunnel, one Access app, then SSH keys the way they always work. Friends and a custom mobile app stayed on the wishlist. Half the work lived in the Cloudflare dashboard. The other half lived in nix.</p> I already had Cloudflare for the sites. Remote access meant opening Zero Trust and treating the mini like another application.</p> Identity first, and it is a two-dashboard job. Cloudflare Access wants GitHub as a login method. GitHub wants an OAuth App (the developer settings kind: homepage URL, callback URL, client ID, client secret). You create that app under the GitHub account or org you actually use, paste Cloudflare's callback URL into it, then paste the client ID and secret back into Zero Trust under Authentication. Leave MFA on the GitHub account itself. Policy on the Cloudflare side stays narrow: my GitHub identity only, no bypass, no service token I would paste into a chat. Session length around eight hours so a workday does not re-auth every coffee, but the next morning still knocks.</p> Then a self-hosted Access application on the subdomain I chose for SSH. That app is the bouncer. It does not replace the SSH key on the mini. It only decides whether Cloudflare will hand the connection to the tunnel. The first real ssh</code> still opens a browser, hits that GitHub OAuth app, and only then continues.</p> The tunnel is a named Cloudflare Tunnel for the mini. Create it, download the credentials JSON, run cloudflared tunnel route dns</code> (or set the same CNAME in the DNS UI) so the public name points at the tunnel, not the living-room router.</p> Somewhere in that flow Cloudflare waves a finish-setup URL with a long token. It looks bookmarkable. It is a one-shot enrollment link. I almost saved it into notes. That would have been a fun secret to leak.</p> When Access is happy and the connector shows healthy edges, the dashboard work is mostly done. The rest is whether the mini runs cloudflared</code> and sshd</code> without babysitting launchd.</p> This is where nixup</a> stopped being background lore.</p> Copy the credential to /var/lib/cloudflared/</code> as root 0600</code>. We argued about the UUID. First draft almost baked it into a shared Darwin module. Final split matches nixup hosts: tracked modules/darwin/cloudflare-remote-access.nix</code> enables SSH, writes /etc/cloudflared/config.yml</code>, and runs the tunnel under launchd. The gitignored personal host module only supplies tunnelId</code>, hostname, and authorized keys.</p> Ingress stays tiny:</p> ingress: - hostname: <access-subdomain> service: ssh://127.0.0.1:22 - service: http_status:404 </code></pre> Clients get cloudflared</code>, a key per laptop, and ProxyCommand cloudflared access ssh --hostname %h</code>. First connect opens a browser, the GitHub OAuth app consent screen, then Access, then the host key prompt. id -un</code> prints my username. After two dashboards and a consent screen, success felt almost unfair.</p> Outside the house, the laptop opens a real shell on the mini. Tunnel healthy, launchd keeps it, home IP changes stop mattering. Zellij attaches over that hop. Files ride SFTP or rsync -e ssh</code>.</p> Then I typed for real. Every character does a full trip through Cloudflare and back for the echo. Sticky on a good path. Paste-and-pray on mediocre mobile. Access is mostly connect-time (the browser dance you configured in Zero Trust). Typing lag is path length and remote echo.</p> Local comedy: Nushell ate PasswordAuthentication=n</code>. Module boundaries took longer than the YAML. I almost committed private host values, walked it back. nixup hosts sync --force</code> can still erase a hand-edited host file. Screen Sharing stays off Cloudflare: forward 5901</code> to loopback 5900</code> only.</p> Test latency from a hotspot before calling it finished. Throughput lies. Typing tells the truth. Access plus tunnel is a locked door with audit logs and GitHub MFA. It is a weak daily keyboard. Keep it for break-glass on the same account as the sites.</p> WARP is Cloudflare's always-on client. We skipped it for plain OpenSSH. Tailscale (or WireGuard) is the honest fix for a keyboard that feels local when a direct path works. Cost is another identity plane.</p> Where I am leaning: dashboard Access as break-glass, mesh VPN for daily shells. nixup made the machines interchangeable. Zero Trust clicks plus a tiny nix module made the mini reachable. Next bet is a keyboard that does not swim, still near Loki.</p> I got tired of setting up the same laptop three times 2026-07-17T00:00:00+00:00 Last month I sat down at the wrong Mac and spent twenty minutes wondering why half my PATH was from 2024. Same person, same tools, slightly different story of how they arrived. The other machine had the new zellij. This one still had the brew formula I thought I uninstalled. Loki was staring at me like I owed him a walk. Fair.</p> Two Apple Silicon Macs and a Linux host. Goal was boring: open a shell anywhere and get nushell, starship, neovim, the usual CLI pile, and the agent tools I keep reinstalling by muscle memory. What I had was folklore. "On the Mini you run this. On the other Mac, that. On Linux, pray."</p> So I put the machines in a flake and wrote a CLI so I would stop improvising. That project is nixup</a>. This post is how it holds the fleet together. The next one</a> is what happened when the always-on mini had to answer from outside the house.</p> On macOS it is nix-darwin plus home-manager. On Linux it is home-manager only. Packages and env hooks live in the flake. App configs live in .dotfiles</a> and land with GNU stow. That split sounds pedantic until home-manager and stow both try to own config.nu</code>. Nix installs the binary. Stow owns the config.</p> The public tree ships example hosts so CI can nix flake show</code> without my hostname in git. Real devices stay local. That boundary bites you the first time you hang a tunnel UUID on one host and almost push it.</p> I used to edit host modules by hand. That lasted until the second machine. Now the personal file is nixup.toml</code>, gitignored, copied from an example:</p> [[hosts]] id = "my-mac" match_hostnames = ["my-mac"] os = "darwin" flake_attr = "my-mac" [[hosts]] id = "my-linux" match_hostnames = [] os = "linux" flake_attr = "you@linux" apply = "home-manager" </code></pre> nixup hosts sync</code> turns that into hosts/<id>/default.nix</code> and hosts/inventory.nix</code>. flake.nix</code> imports the inventory when it exists, otherwise the example. Day-0 is roughly:</p> cp nixup.toml.example nixup.toml # edit hosts nixup hosts sync --yes nixup bootstrap --yes nixup smoke --strict </code></pre> Bootstrap checks for Nix, applies the host, runs smoke, then reminds me about stow. Apply is day-2. Doctor is "why is this machine weird." When I later needed SSH and a tunnel only on the mini, that same host file was how the feature could opt in without Remote Login on every Darwin box.</p> Pure flakes only see tracked files. My generated inventory is gitignored, which is correct for privacy and wrong for pure eval. Without force-staging, pure builds fall back to example hosts. CI always uses the example. Local apply uses the real inventory that never leaves the laptop.</p> I spent longer than I want to admit feeling smart about "everything is in the flake" and then watching pure mode ignore the host I just generated. The fix was design: example inventory in git, personal inventory local, CLI that regenerates from TOML. Tunnel ids and authorized keys want that same pocket. Shared modules stay tracked. Machine gossip stays home.</p> Nix gets the daily CLIs: nushell, starship, stow, neovim, zellij, atuin, lazygit, rg, fd, eza, uv, bun, zola. cloudflared</code> ended up there too, long before I asked it to babysit a tunnel.</p> GUI and cask-shaped things go through zerobrew on Mac, Homebrew as fallback while that migration finishes. Ghostty is cask-only on purpose. I will not dual-install a terminal again.</p> Agent tools are the messy middle. rustup, headroom, claude-code, codex-cli, grok, beads, radicle. Activation is fail-soft so a moved installer URL never tanks the whole switch. Smoke lists required tools. smoke --strict</code> exits 2 if one is missing. That receipt is why I trust apply again, and why agents can live on one always-on box while the other machines stay clients.</p> Nu scripts for bootstrap and smoke worked until they became the product. I wanted typed config, CI-friendly exit codes, and tests that do not need a full machine switch. Four crates: nixup-core</code>, nixup-ops</code>, nixup-smoke</code>, nixup</code>. Virtual workspace, resolver 3. Tests pin a temp nixup.toml</code> and assert unknown hosts exit 4 and strict smoke exits 2. Same verbs on every box: hosts sync</code>, apply</code>, smoke</code>, doctor</code>.</p> I still don't love all of it. Fail-soft curl installers inside a declarative system are honest and ugly. Secrets stay outside the flake. Stow still needs a dotfiles clone. Pure flakes stay rude about gitignored hosts, so I regenerate from TOML.</p> And once every machine finally felt like the same desk, a new itch showed up. The mini stays awake with zellij full of agents. The laptop leaves the house. Same shell, same flake, still no honest way to attach from a café without punching a hole in the router.</p> That part is next: Cloudflare to the mini, paid for in keystroke lag</a>.</p> Tools</h2> nixup</a></li> nix-darwin</a> and home-manager</a></li> Determinate Nix</a> when I need an installer that does not fight the daemon</li> GNU stow and a separate dotfiles</a> repo for configs</li> </ul> I turned my job hunt into a pipeline, then got rejected by my own tech stack 2026-07-12T00:00:00+00:00 Two rejection emails landed the same week this spring. One from Deepgram, one from ElevenLabs. Both polite, both no.</p> Here's the funny part. My side project runs on both of them. Voluble does real-time speech-to-speech translation: Deepgram turns speech into text, ElevenLabs turns it back, and I've been paying both at 2am for a year. Then both passed. If you want a quick lesson in humility, get rejected by the APIs you build on.</p> That was the mood in April. I needed a senior engineering role, I had EU work rights and a comp floor I wasn't pretending didn't exist, and my browser looked like a hostage situation. 40-something tabs of postings I'd half-read, and a spreadsheet whose "status" column stopped being true by week 1. I'd apply on a Tuesday, forget by Thursday, and rediscover the rejection three weeks later like a small archaeological find.</p> So I did the thing engineers do when they're avoiding their feelings. I built a pipeline.</p> The engine is career-ops</a>, an open-source job-search system by santifer. I use it, and over 3 months I've bent it pretty hard around how I actually work. The apply button stayed mine. Everything before it, I handed to the machine.</p> What I was hunting</h2> Wide, on purpose. Backend, AI and ML product engineering, plain senior software engineer, app and product roles, and senior or staff mobile. I've shipped iOS and Android, Go backends, and a Rust core behind a translation app. People keep filing me under "mobile dev," and that throws away half my range.</p> It all runs off two files.</p> config/profile.yml</code> is the me half: target roles, which archetypes are a real fit versus a stretch, where I can legally work, my comp floor, and a narrative block with the stories I want to tell (Voluble's Rust core, dragging an OTT app's ANR rate to 0.09%, the open-source work).</p> portals.yml</code> is the market half: a location filter, a title filter, a stack of Google dorks aimed at specific ATS platforms (one is literally site:jobs.ashbyhq.com "Backend Engineer" Netherlands OR remote</code>), and a list of tracked companies, each with a note on why it's worth an evening.</p> How it hunts</h2> Scanning is the cheap part, so I keep it cheap. It hits the Greenhouse, Ashby, and Lever APIs directly, no language model near it, and dedups every URL.</p> The job boards are the annoying part. LinkedIn, Glassdoor, and Indeed have no friendly APIs, and they hate scrapers. So I drive my own logged-in Chrome with Playwright, WebWright, and Claude for Chrome, reading the accessibility tree the way a screen reader would instead of brittle CSS. Because it's my own session, I'm not fighting bot checks, and keeping it local saved me more grief than anything else.</p> How it scores</h2> Every posting that survives gets scored into a report under reports/</code>: fit, seniority, red flags, and a legitimacy check. That last one earns its keep. A depressing number of "senior remote" listings are ghost jobs, and I'd rather learn that before I burn an evening on a cover letter.</p> Tailoring each application</h2> Each score comes with a report, and that report is where tailoring starts. It pulls out what this specific role wants: the archetype, the must-have skills, the words an ATS will grep for. That drives the CV.</p> Everything builds from one cv.md</code> plus the proof points in profile.yml</code>, and the generator assembles a per-company version from them. It reads the role's archetype and must-haves off the report, then decides which of my stories to lead with, which to keep, and which to cut. A backend role at Qonto pulls my Go and axum work and Voluble's Rust core to the front. A mobile role at Zalando leads with SwiftUI, Compose, and that 0.09% ANR number. It also makes sure the words the ATS is grepping for actually show up, when they're true. It never invents anything. It just decides which true thing goes first.</p> It renders two ways: a LaTeX path through xelatex (tectonic when the fonts sulk) and an HTML path through headless Chromium with the Unicode normalized, because half the ATS parsers choke on a smart quote.</p> The cover letter takes its angle from the company note I wrote in portals.yml</code>. For the AI companies that angle was obvious: I build Voluble on Deepgram and ElevenLabs, so I said so. (They passed anyway. We'll get to that.) The prose runs through voice-dna.md</code>, my anti-slop style guide. If a draft sounds like a language model in a tie, it fails.</p> Where I take over</h2> One step is never automated: applying. The machine gets me to a ranked, tailored shortlist and stops there. I sent every application by hand.</p> Three months of receipts</h2> Early April to mid-July, the plain version. I scored 440 postings. I passed on 110 of them (66 skipped on sight, 44 binned after a closer look) and left 234 sitting in the maybe pile. And I applied to 91 companies by hand, 96 applications once you count the few I went back for.</p> Where those landed so far: 34 no's, 4 interviews, 1 warm maybe (Beatgrid), no offers yet, and a healthy pile still pending or gone quiet. That's a job hunt.</p> The applications went wide, which was the point. Mistral AI and Speechify on the AI side. Sentry, Supabase, and Reddit for dev tools. Qonto, Airwallex, Rabobank, and ING in fintech. Figma, TomTom, Coolblue, Fairphone, Tibber, Wikimedia, Lely, and NOWATCH across product. For once my applications said out loud what I am: a senior engineer who ships across mobile, backend, and AI.</p> The rejections went wide too, and most were fine. Booking.com, ABN AMRO, Mollie, Picnic, bol, eBay, Mozilla, PostHog, Philips, Just Eat Takeaway, Xebia, Speakap. That's the job. And then Deepgram and ElevenLabs, which I keep framed in my head.</p> The 4 that turned into conversations are the ones I'm quietly proud of: bunq, Zalando (their Lounge team), Ditto (for Ditto Care), and Wypoon Technologies. A couple are still live as I write this.</p> What it's good and bad at</h2> It's good at volume without panic: it reads more postings in a morning than I'd manage in a week, and it catches ghost jobs I'd have fallen for. It's useless at the part that actually gets you hired, being a person a hiring manager remembers, or telling whether "senior" at a 12-person startup means staff-level scope or founder-does-everything chaos. That's still me, at my desk, with coffee.</p> 3 months in, the search is still open, but I can see all of it now. I know my conversion at every stage, I know which archetypes waste my night, and when a good role lands the boring work is already done.</p> And if bunq or Zalando works out, I owe Deepgram and ElevenLabs a thank-you note for the motivation.</p> Tools</h2> career-ops</a>, the open-source engine behind all of this</li> Playwright</a>, WebWright</a>, and Claude for Chrome</a> for driving my own logged-in browser</li> Tectonic</a> and xelatex for rendering the per-company CVs</li> Voluble</a>, the side project that keeps showing up here</li> </ul> My job hunt runs itself twice a day now 2026-07-12T00:00:00+00:00 Most mornings I find out how my job hunt is going before I'm properly awake. I shuffle to the kitchen, start the coffee, open the laptop, and there's a ranked shortlist in my inbox, each role with a one-page fit report. I didn't lift a finger for it. My Mac did the work at 6am while I was face-down in a pillow.</p> Last time</a> I walked through the pipeline. This is the bit I promised at the end: how it runs itself twice a day without me hovering over it.</p> Two runs, weekdays only</h2> I schedule the whole thing as local Claude Desktop tasks. One run early, before I'm functional, and one around 4pm, before I shut the laptop. The morning run scans and scores the overnight postings, so I wake up to coffee and a shortlist instead of 40 open tabs. The afternoon run sweeps up whatever went live during the day and tidies the tracker. Weekdays only. Senior roles don't really get posted on a Sunday, and I'm not reading ghost jobs on my weekend.</p> I'm hunting senior engineering roles across mobile, AI, backend, and product, so the net is wide: Reddit, Supabase, Qonto, NOWATCH, Lely. The scheduler doesn't care that those are five different archetypes. It reads, scores, and files.</p> Why it stays on my Mac</h2> The good listings live behind LinkedIn, Glassdoor, and Indeed, and all three want a real, logged-in session. My scanner drives my own Chrome over the remote debugging port, 9222, with the cookies I already have. A cloud runner has none of that. It'd trip every bot check on the first request and get my account rate-limited or worse. So the machine that does the scanning is the one on my desk. The scheduler just wakes it up on a timer.</p> The guardrails</h2> Running a job hunt unattended is a great way to embarrass yourself, so there are rules. It never applies: the agent gets me to an evaluated shortlist and stops, and a human sends every application. It respects rate limits instead of hammering a careers page, because a flagged LinkedIn would undo the whole point. And I audit what it writes: I skim the generated CVs and cover letters before anything goes out. A tailored letter with one wrong company name is worse than no automation at all.</p> The shortlist it hands me is real, though. Ditto Care and Zalando both turned into actual interviews. My favorite result is still a rejection: I built Voluble on Deepgram and ElevenLabs, name-dropped both as a warm angle in the cover letters, and both said no. Fair enough.</p> So that's the split. The computer does the grunt work, and I do the judging. Twice a day it hands me the 10 roles worth my attention and quietly bins the 300 that aren't.</p> Tools</h2> career-ops</a>, the engine</li> Claude Desktop scheduled tasks, the timer that runs it twice a day</li> Playwright</a>, WebWright</a>, and Claude for Chrome</a> for the scanning</li> </ul>

legolas.dev

I wanted agent state in Zellij, not another tab I forget about

What problem that actually closes</h2> The desk problem is attention, not another chat UI. I already have agents. I already have panes. I needed a shared, boring truth:</p> which pane is an agent</li> what state it is in</li> whether I should look now</li>

How Keylore got planned on a twenty dollar day and shipped with Grok

What Keylore actually does to your configs

I got bored of editing configs blind, so I shipped a macOS app

I forked Zellij so my terminal could show images again

nixup: one CLI for every machine I touch

I put the Mac mini behind Cloudflare and now typing feels wet

I got tired of setting up the same laptop three times

I turned my job hunt into a pipeline, then got rejected by my own tech stack

My job hunt runs itself twice a day now