Rutter written sailing directions
Editor's cut · Build recap

How WP Beacon got built

WP Beacon watches the WordPress plugin ecosystem for supply-chain attacks. This reads the session that gave it a backbone: a full, self-hosted git mirror of the wp.org plugin catalog, decided and stood up in a single evening.

wpbeacon.io

61
Sessions
1295
Headings
12
Landmarks
33.2M
Tokens out
Opus 4.7
Model
The chart · the passage plotted

The route, plotted

Eight waypoints in one evening, from a research question to running infrastructure. Hover any marker to read the direction that set it.

48°24′N 004°29′W
Departure / made port Heading (a direction given) Landmark (evidence handed over) A tack (course correction)
Session 9498c26e

From a research question to running infrastructure

152 headings · one evening · a full git mirror

The largest session of the largest project did not open with a plan. It opened with a question, handed to the agent as research:

Heading 5

Can you do some research? Is someone running a WP.org plugin alt git-i-fied? Like a Github but for wp.org plugins?

With the space scouted, the next moves were about understanding the chosen tool before trusting it. The questions are the interesting part:

Heading 9

How does Forgejo work. Does it need to generate cached views ahead of time per each repo? If so, how much storage?

Only then did installation start, and it went straight to production posture in the same sitting:

Heading 11

Let's put Caddy in front and use plugin-repo.wpbeacon.io for the HTTPS. Install firewall and only allow [it].

The wake · Apr 21 → Jul 3

What came next

The mirror was one evening of a seventy-four-day, sixty-one-session build. The rest turned the mirror into intelligence.

Apr 21

Resume the scans. Background scanning of the plugin ecosystem was already running.

Apr ·

Research the mirror. Is anyone git-ifying wp.org? If not, build it.

Apr ·

Stand up Forgejo. Self-hosted git with search, behind Caddy at plugin-repo.wpbeacon.io.

Apr 24

Mine the data. Acquisition analysis, Security Finder, spotting custom updaters like scroll-top.

Jul 3

Keep watching. A mirror plus a collector, flagging risky updates before they spread.

Reading the direction

What to borrow

Standing up infrastructure with an agent has its own rhythm.

Start with a research question

"Is someone already doing this?" framed the build before any code. The agent scouts, then you decide.

Understand the tool before installing it

"How does Forgejo work, does it cache views?" A few minutes of understanding prevents an evening of surprises.

Bend off-the-shelf software to fit

Disable the login, cut the help menu, add the logo. The agent makes a generic tool feel like yours.

One evening, real infrastructure

From a question to a hardened, HTTPS, self-hosted mirror in hours. Scope that used to be a week.

Sailing directions

If you built this again

Knowing this was research turned into infrastructure in an evening, here is how you would start a similar one. Copy a prompt and adapt it.

Opening prompt
I want a self-hosted git mirror of the entire wordpress.org plugin catalog, with a browsable UI and full-text search, so I can diff plugin versions for supply-chain attacks. First, research whether anyone already does this and which tools fit (Gitea, Forgejo). Explain the storage and view-caching implications before we install anything.

Starts with research and understanding-before-installing, the original build's actual method.

Go to production posture at once
Install the chosen tool with full-text search enabled. Put Caddy in front for HTTPS on my hostname, add a firewall, disable the login and any menus I do not need, and brand it with my logo.

Front-loads the HTTPS, firewall, and trim-to-fit that came later.

Wire the intelligence
Then wire a collector that scans the mirror for risky updates and flags them. I will ask research questions against the collected data as we go.

Points at the layer the mirror exists to serve.

This recap is the output of an editor pass over the project's agent transcripts. A deterministic extract (command-center flow --editor) pulls the direction, the agent trace, and the embedded screenshots from the most representative session. A single model pass captions each image and writes the narrative.

Every quoted heading is verbatim, typos and all. Landmark captions were recovered from images embedded in the transcript, then summarized. The originals are never reproduced or shared.

← Back to the Harbor