zentex · Writing

Real Chromium pixels in your terminal

Sun, 02 Aug 2026 00:00:00 GMT

Terminal browsers usually cheat. They parse HTML, throw away the layout, and print what survives. That works for reading a man page online and falls apart the moment a page depends on its real rendering, which in 2026 is nearly every page.

terminal-fenster takes the other road. A headless Chromium renders the page for real, and the frames are painted straight into the terminal through the Kitty graphics protocol. Ghostty treats them like any other cell content. Your scrollback, your splits, and your keybindings keep working, and the page looks like the page.

Input goes the other way. Keys and clicks in the terminal are mapped back into Chromium events, so you can log in, scroll, and fill forms without leaving the shell. The whole thing exists because my work lives in a terminal, and switching to a browser window a hundred times a day was the single most annoying part of it.

Zero prompt logging is the product

Sun, 05 Jul 2026 00:00:00 GMT

An LLM router sits in the most sensitive spot of the whole stack. Every prompt, every system message, and every tool result passes through it. Most providers treat that stream as an asset to mine. I think the mining is the bug.

routing.run is OpenAI compatible on the outside and deliberately forgetful on the inside. Requests are routed, billed, and dropped. There is no prompt store to breach, subpoena, or train on, because the store does not exist.

The models themselves are a commodity now. They get cheaper and better every quarter no matter what I do. The thing that is not a commodity is your context, and a router that remembers nothing is the only honest way to hold it.

Authorized means written down

Wed, 10 Jun 2026 00:00:00 GMT

Every security engagement I take starts the same way. A written scope that names the systems, the techniques, and the window. Not a verbal ok on a call. A document both sides can point at later.

The Publive work ran like that. Scope first, then recon, then findings written up as they landed, each with reproduction steps and impact stated plainly. Critical bugs got reported the day they were confirmed, not saved for a dramatic final report.

I do not test systems I was not asked to test. Curiosity is not authorization, and a bug found outside scope is not a favor, it is a liability for everyone involved. If you want your systems poked, the invitation has to exist in writing. Then I am happy to break things carefully.