Drag and drop now works both ways. macget turns a Mac path into a file
readable here: translated for free if it is in a Syncthing-shared folder,
fetched over ssh otherwise, into appdata rather than the RAM rootfs. It takes
every form a drag produces - plain path, escaped spaces, file:// URL, ~/...
Cmd+Shift+F and Cmd+Ctrl+F push the current Finder selection to a chosen or
the last-used terminal, sharing that target with the screenshot hotkeys. They
need Automation permission for Finder; without it the AppleEvent hangs and
fails -1712 while the hotkey appears to do nothing.
Two fixes recorded: the shared-folder table is no longer duplicated between
omac and macget, and the scp remote path must not be quoted in SFTP mode,
which is the opposite of what omac's ssh calls need.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
ssh mac works from this box. The key had been offered and refused for a day
because it had never reached the Mac — an earlier paste ran only part of its
command. Fixed by pulling the key over the Mac -> Unraid link that already
worked, so it never passed through the clipboard.
Two new commands in shell/bin, installed to /root/.local/bin at boot:
- omac translates an Unraid path to its Mac counterpart through the shared
Syncthing folders, then opens it, prints it, emits a file:// URL or an OSC 8
hyperlink, or verifies it has synced. It refuses rather than guesses outside
a shared folder. Literal paths are tried before symlink-resolved ones, after
readlink -m was found to resolve skills/memory out of the shared tree.
- clip puts text into the Mac's pasteboard over OSC 52, walking up the process
tree to find a pty and wrapping for tmux passthrough.
Also records the Hammerspoon screenshot hotkey on the Mac side, how hc ls from
the Mac addresses terminals on both machines, and that screencapture cannot
work over ssh because macOS withholds Screen Recording from a non-GUI session.
Verified end to end: a PNG made here, copied to the Mac, pushed back with
hc put unraid/t13, named by shot and read in-session byte-intact.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The self-heal script written on 2026-11-05 was never scheduled — it had run
once, by hand. The hc binary had disappeared with no reboot at 25 days uptime,
so the boot-time restore in the go file is not sufficient on its own. Now runs
every 10 minutes, from the go file's crontab line because that line replaces
the whole crontab at boot.
Also documents hc put as the transport for Mac screenshots into a session here
(verified end to end), the RAM-backed drop location, $HC_TERMINAL_ID, the new
shot helper, and what reaching the Mac from this box still needs.
Separately: the crontab comment's claimed hourly git-ref update of the AMPECO
backend checkout corresponds to no actual job and has not been running.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Root's login shell is now /bin/zsh (5.9, staged in /boot/extra so rc.local
reinstalls it at boot). bash stays the fallback; both shells source one shared
env and alias file. Shell config consolidated on the flash drive at
/boot/config/shell/, installed by install.sh from both boot paths, which were
previously fighting over /root/.bashrc.
Four things that were silently broken are fixed:
- /boot/config/passwd cannot set root's shell at all — rc.S.cont reads it but
hardcodes /bin/bash. The change is made from the go file instead, guarded so
a missing zsh falls back to bash rather than locking root out.
- git refused to work in every project share (dubious ownership: owned by
jazzymc, not root), which silently emptied every branch lookup. safe.directory
entries added.
- /root/.gitconfig was in RAM, so the credential helper and store died at every
reboot.
- Login shells lost the custom PATH, because /etc/zprofile hardcodes it after
~/.zshenv. Also fixed the literal backslash in the go file's shebang.
Documents the Shell Environment section and corrects the Boot Sequence, which
the go file change made out of date.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Fixed Transport endpoint not connected error — Plex volume mount
needed :rslave propagation to see rclone FUSE mount from zurg.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Document Kasm DinD architecture, Traefik integration, and the
proxy_port/frameDeny fixes that resolved session connection failures.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Created 11-NETWORK-ASSET-INVENTORY.md with full device inventory
- Documented 30+ devices from DHCP/ARP tables
- Categorized devices: Infrastructure, Secure, IoT, Kids
- Added MAC vendor reference table
- Recommended NetBox as primary IPAM/DCIM tool
- Listed alternative tools: phpIPAM, Snipe-IT, GLPI, etc.
- Added action items for unknown device identification
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Created 10-VLAN-NETWORK-SEGMENTATION.md with full VLAN plan
- Added CSS326-24G-2S+ SwOS switch to 00-CURRENT-STATE.md
- Documented switch credentials and web UI access
- Proposed 4 VLANs: Secure (10), IoT (20), Kids (30), Guest (40)
- Included cross-VLAN solution for S25 accessing IoT devices
- Added SwOS configuration steps for port VLAN assignments
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Created 09-MIKROTIK-WIFI-CAPSMAN.md with full configuration details
- Added cAP ac device info and WiFi networks to 00-CURRENT-STATE.md
- Updated changelog with WiFi/CAPsMAN setup and legacy device fix
- Documented SSH access for both MikroTik devices
- Added WiFi network credentials and security settings
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
