Skip to content

Open Source

Software I maintain in the open, with its trust model and quality gates in view.

ZDX — Zsh Developer Experience Suite

ZDX is a set of interactive, fzf-powered developer workflows and a plugin loader for Zsh, built as a drop-in for Oh My Zsh. Release 0.1.0 brings 251 public commands across 15 suites into one terminal-first interface: open zdx to explore, or call a suite directly when you already know the workflow. Each suite loads only when it is first used.

zdx              # browse every suite, filter and preview commands
dev-menu         # open one suite directly: checks, audits, cleanups
zdx doctor       # report missing dependencies before you need them

What it covers

  • Projects. Git repositories and identities, isolated workspace profiles, polyglot quality gates and security audits, project tasks discovered from Justfile, package.json, Makefile or Compose descriptors, and GitHub Actions runs and dispatches.
  • Files and environments. Staged archives, bounded bulk file operations, .env profiles parsed without source or eval, and Python virtual environments with uv-managed runtimes.
  • System and network. Diagnostics, Docker resources, network checks and WireGuard tunnels.
  • AI and hardware. Local AI assistants and MCP declarations, the Hugging Face Hub and NVIDIA GPU telemetry.
  • ZDX tools. zdx doctor for dependency diagnostics, and a plugin manager for custom menus under ~/.config/zdx.

How it keeps trust visible

  • Actions that change state, such as cleanups, migrations, restores or workflow dispatches, list their exact targets and offer a dry run and a confirmation first.
  • Every suite documents its dependencies, supported platforms, mutation plans and authorization model.
  • The installer links a checkout you have reviewed. It does not download code, install dependencies or edit your shell startup file.
  • Custom plugins are executable Zsh sourced into your shell, not sandboxed data; review a plugin's source and update origin before loading it.

Quality and supply chain

OpenSSF Best Practices (Silver) and an OpenSSF Scorecard, a BATS test suite and shellcheck, gitleaks, actionlint, zizmor and zsh -n checks in pre-commit and CI, DCO sign-off on every commit, and release archives with a SHA-256 checksum and Sigstore-backed build provenance. Linux is the primary platform and WSL2 is supported; macOS runs the core workflows without the Linux-specific system and VPN actions. MIT licensed.

View ZDX on GitHub Release notes 0.1.0

This Site — landerox.github.io

The repository behind this site is public because the pipeline is part of the portfolio: a bilingual Zensical build, SHA-pinned GitHub Actions audited by zizmor and CodeQL, OpenSSF Scorecard, DCO sign-off, Lighthouse CI across both locales and Playwright interaction tests. Every tool choice records the alternatives it rejected in docs/decisions.md.