voitta-ai

by voitta-ai

Find and clean the six local surfaces where a coding agent accumulates copies of your secrets (git remote URLs, memory stores, file-history snapshots, tool config literals, permission allowlists, tool-output caches). Covers why prefix-grep gives false confidence and why keyword-adjacency redaction loses to prose.

by voitta-ai

Make a non-Claude, non-Codex agent host load skillz-format SKILL.md files:

by voitta-ai

Triage, rotate and scrub credentials that leaked into agent session transcripts: severity test, non-destructive liveness probes, rotation verification, and a kill-list scrub that cannot erase a live secret.

by voitta-ai

Run a team of agents over a repo's open issues: an architect plans the parallel set, then per-issue squads (dev + adversarial reviewer + SDET + productivity engineer), each individually watchable.

by voitta-ai

An append-only JSONL event log of agent-to-agent traffic plus a live pane over it, giving a fleet an org-wide view instead of N private conversations. No daemon and no lock: concurrent appends are safe because a single write of under PIPE_BUF bytes to an O_APPEND descriptor cannot interleave, verified at 24 concurrent writers producing 960 lines with zero torn. Ships scripts/xs with log, tail, recent, status (who is waiting on whom, derived from events rather than tracked), and prune. Includes the acceptance test that only a real team run can satisfy.

by voitta-ai

Recognize and fix the trap where supplying a custom security group to an AWS Load Balancer Controller ingress (annotation alb.ingress.kubernetes.io/security-groups) delivers NO security narrowing, because the controller's shared backend SG stays attached and security groups are additive. Use when: (1) a "narrow the ALB's security groups" change applied clean but the ALB still carries a controller-managed SG (tag elbv2.k8s.aws/resource=backend-sg) with all-protocol 0.0.0.0/0 egress, (2) you are reviewing a diff that adds a custom SG to an ingress while alb.ingress.kubernetes.io/manage-backend-security-group-rules is "true", (3) after doing the narrowing properly, new backends go "unhealthy: Target.Timeout" because the health-check port was never opened, (4) a terraform apply that flips the annotation and adds replacement node-SG rules could race and close the front door mid-apply. Core facts: effective SG posture is the UNION of attached SGs - adding a narrow SG beside a broad one changes nothing; the real fix is to stop the controller attaching/managing the backend SG and author the node-side rules yourself, with explicit depends_on ordering; measure the live SGs before and after, never trust the diff.

by voitta-ai

Determine which caller sends traffic to which ALB listener rule, and how much, before flipping or retiring that rule. Use when: (1) you need to prove a listener rule is safe to change and are looking for a CloudWatch metric per rule — there isn't one, (2) you grouped ALB access logs by `matched_rule_priority` and the numbers look wrong or a single endpoint appears under two priorities, (3) several services share one credential so the ALB cannot tell them apart, (4) you must identify an unknown HTTP client seen only as a User-Agent in access logs, (5) `SHOW PARTITIONS` on an ALB-logs Athena table returns nothing, (6) a windowed total looks low, or the "same" query returns different counts on different days — the log bucket's S3 lifecycle expiry (often 3 days) silently truncates any longer window, so a "weekly" total is really a retention-window total. Core trap: `matched_rule_priority` is a POSITION, not an identity — inserting a listener rule renumbers every rule below it, so the same priority means different rules on either side of that deploy, and a query spanning the change silently mislabels everything. Attribute by `request_url` + `user_agent` instead, quote per-day rates, and report the window the data has (min/max date), not the one the WHERE clause asked for.

by voitta-ai

Verify an Android change on a device or emulator when the project has no test suite. Covers the build-install-drive-read loop, verifying the release build rather than only debug because R8 breaks reflection-driven code, tapping by element label instead of remembered coordinates, reading app-private state back with run-as, and mocking location. Its core discipline is calibration: a check that cannot observe anything reports the same thing as a check that observed nothing, so an unplugged cable, a stale uiautomator dump, a single-quoted attribute, or a pattern that can never match all read as a passing assertion. Ships scripts/adb-ui.sh with text, has, tap, tap-nth and type.

by voitta-ai

Find and fix an Android app whose microphone use tears down Bluetooth A2DP in a car: read the profile timeline from dumpsys bluetooth_manager, name the app from appops, and pin capture to the built-in microphone with setCommunicationDevice.

by voitta-ai

Reach archive.today when automation is refused, cite it reproducibly, and send a truthful user agent.

by voitta-ai

Host an unmodified HTTP server (incl.

by voitta-ai

Fix a web app's mic failing in Chrome with a `not-allowed` error on localhost even though the OS granted Chrome mic access: Chrome auto-blocks the mic per-site, and the OS Privacy toggle / Chrome restart never clears it. Set the site to Allow.

by voitta-ai

Diagnose Chrome's "Your connection to this site is not secure" on a major site (gmail.com, google.com, github.com) on a machine behind a corporate TLS-inspecting proxy (Zscaler, Netskope, Palo Alto, Blue Coat). Use when: (1) Chrome's site-info bubble shows the red triangle and "You should not enter any sensitive information on this site", (2) a CLI `openssl`/`curl` check of the same host looks perfectly clean and you cannot reproduce the browser's complaint, (3) you are about to tell someone their proxy is MITM-ing them. Covers the PAC-proxy blind spot in CLI checks, how to read the intercepted chain, and — critically — why a forged proxy certificate with zero SCTs is the NORMAL steady state and usually NOT the cause.

by voitta-ai

Search your own past claude.ai conversations for something you said or were told. Use when: (1) you need to find or disprove a claim about what was said in an earlier Claude chat, (2) you want to grep your whole Claude history, (3) someone references "that chat we had" and you need the receipts, (4) you tried grepping ~/Library/Application Support/Claude and found nothing, (5) a claude.ai export arrived as a manifest JSON instead of a data zip, or (6) curl on an export URL returns HTTP 403 with a Cloudflare "Just a moment..." page. Covers the export request flow, the multi-file manifest with one-time URLs, and searching conversations.json.

by voitta-ai

Port a Claude Code plugin to the Codex CLI (or back); where the two plugin systems match vs diverge, and the shared hooks.json caveats.

by voitta-ai

Talk to a Claude Code session that is already running via the native ListAgents + SendMessage pair instead of a headless claude -p call or a terminal-scraping bridge: addressing rules (the name is the address; refs do not survive the listing that produced them), the one-shot notify_when_idle subscription that replaces every polling loop, the no-TTY law that makes headless and in-process transports wedge silently instead of failing, multi-hop transport dependency failures, and the per-session permission boundary that forbids delegating around your own denials.

by voitta-ai

Convert an existing repo that ships Claude Code slash commands and/or hooks (typically as a dotclaude/ or .claude/ directory the user copies into their project) into a Claude Code plugin so users can install with `/plugin marketplace add OWNER/REPO` + `/plugin install NAME@MARKETPLACE`. Use when: (1) repo currently has a commands/ + hooks/ layout meant for manual copy-into-project install, (2) you want to add plugin install without breaking the manual install path, (3) confused about where marketplace.json vs plugin.json live, (4) confused about which env var the plugin's hooks should reference, (5) the installed plugin shows "failed to load" with `Duplicate hooks file detected` after you declared a `hooks` pointer in plugin.json. Covers coexistence of manual and plugin install via a shared source directory.

by voitta-ai

Publish a Claude Code plugin to Anthropic's plugin marketplace, including the pre-submission validation pass.

by voitta-ai

Bootstrap Python deps from a Claude Code plugin hook so /plugin install is one-click on systems lacking them (PEP 668-safe).

by voitta-ai

Make a Claude Code / Codex plugin repo tag itself and publish release notes from its manifest version, and make the version bump non-optional. Use when: (1) the repo has merges piling up with no tags, no GitHub releases, or tags that exist but have no release attached, (2) a CONTRIBUTING/CLAUDE.md rule says "bump the version on every shipping merge" and nothing enforces it, (3) you are hand-running `git tag -a vX.Y.Z <squash-sha> && git push origin vX.Y.Z` after every merge, (4) you are about to add a CHANGELOG.md to a repo whose PR titles already say what changed, (5) users report `claude plugin update` says "up to date" while master has moved, and you want CI to catch the missing bump instead of users catching it months later, (6) you need the tag to land on the squash commit in a squash-merge repo, (7) two PRs merged minutes apart and the second one's release never appeared even though every check is green. Covers the two-job workflow (PR-side bump gate + push-side tag-and-release), `paths-ignore` as the docs-only exemption, why the gate must NOT be a required status check, idempotence for re-runs and the same-version concurrent-merge gap it leaves (the second tag-and-release run reports success while creating nothing - verify the tag's tree, then ship a bump-only PR), queueing several bumping PRs against the gate (rebase + re-bump; a green gate goes stale because base-branch movement does not re-trigger PR CI), and the multi-plugin case where per-plugin versions are separate cache keys the gate cannot see. Pairs with claude-code-plugin-update-flow, which explains why the version is load-bearing in the first place.

by voitta-ai

Update an installed Claude Code plugin via /plugin marketplace update + /reload-plugins, not the discovery-picker /plugin update.

by voitta-ai

Read an undocumented Claude Code settings block out of the bun-compiled CLI binary with strings: prompt text for the slots, validator bodies for the limits

by voitta-ai

Identify the exact ~/.claude.json slice that carries MCP config for cross-machine migration vs session bookkeeping.

by voitta-ai

One name for a Claude Code session everywhere: cc/cx launch wrappers, cc-names who/pick/sync, and a Stop hook that keeps the cmux tab title equal to the session's peer name.