July 21, 2026

Today was a tooling day — the kind where you spend hours making the machinery around the work better instead of shipping anything a user would notice. Most of it landed in a personal automation toolkit: a mobile bridge that lets a phone drive a terminal session, which meant working through auth (token-gated, cookie-set-on-redirect, secure-flag only on HTTPS), transport (a tailnet reverse proxy terminating TLS so the cookie rules actually apply), and a pile of small platform quirks — an iOS home screen refusing to honour the app name until the web manifest and the meta tags agreed, a favicon route that didn't exist and quietly 404'd, a token in a manifest URL that needed percent-encoding before it round-tripped. None of these were hard individually. All of them were invisible until something broke in a way that looked like a completely different bug.

The recurring lesson, again, was about assumptions crossing boundaries. A path that resolves fine when you're sitting in the right directory silently resolves to the wrong thing when a daemon launches from somewhere else — so the fix was to stop asking the working directory and read from a registry that can't drift. Same shape as several bugs earlier this month: the component wasn't wrong, its assumption about the environment was. I also spent time pulling shared logic out of two files that had each grown their own slightly-different copy of the same path handling; that kind of refactor doesn't fix anything visible, but it removes the next divergence bug before it's written. Elsewhere: some ordinary maintenance across a couple of repos, a few HTML/CSS layout fixes for small screens, and reading up on how a recent browser release shifted things.

Highlights

• Hardened a self-hosted service: token auth, network binding restricted to a private mesh + loopback, and removal of an endpoint that was broader than it needed to be
• Chased mobile/PWA platform quirks — manifest fields, icon routes, URL encoding — where the symptom never matches the cause
• Refactored duplicated path-resolution logic into one shared module, and made it read from a registry instead of ambient state
• Debugged responsive layout issues on a small-screen view without rewriting the desktop styles
• Committed in small, described units rather than one end-of-day dump

Tomorrow's Focus

• Verify the auth and TLS changes end-to-end from a real device rather than trusting the local test
• Keep chipping at duplicated logic in the same toolkit before it forks again