How WP Beacon got built
WP Beacon watches the WordPress plugin ecosystem for supply-chain attacks. This reads the session that gave it a backbone: a full, self-hosted git mirror of the wp.org plugin catalog, decided and stood up in a single evening.
The route, plotted
Eight waypoints in one evening, from a research question to running infrastructure. Hover any marker to read the direction that set it.
From a research question to running infrastructure
The largest session of the largest project did not open with a plan. It opened with a question, handed to the agent as research:
Can you do some research? Is someone running a WP.org plugin alt git-i-fied? Like a Github but for wp.org plugins?
With the space scouted, the next moves were about understanding the chosen tool before trusting it. The questions are the interesting part:
How does Forgejo work. Does it need to generate cached views ahead of time per each repo? If so, how much storage?
Only then did installation start, and it went straight to production posture in the same sitting:
Let's put Caddy in front and use plugin-repo.wpbeacon.io for the HTTPS. Install firewall and only allow [it].
What came next
The mirror was one evening of a seventy-four-day, sixty-one-session build. The rest turned the mirror into intelligence.
Resume the scans. Background scanning of the plugin ecosystem was already running.
Research the mirror. Is anyone git-ifying wp.org? If not, build it.
Stand up Forgejo. Self-hosted git with search, behind Caddy at plugin-repo.wpbeacon.io.
Mine the data. Acquisition analysis, Security Finder, spotting custom updaters like scroll-top.
Keep watching. A mirror plus a collector, flagging risky updates before they spread.
What to borrow
Standing up infrastructure with an agent has its own rhythm.
"Is someone already doing this?" framed the build before any code. The agent scouts, then you decide.
"How does Forgejo work, does it cache views?" A few minutes of understanding prevents an evening of surprises.
Disable the login, cut the help menu, add the logo. The agent makes a generic tool feel like yours.
From a question to a hardened, HTTPS, self-hosted mirror in hours. Scope that used to be a week.
If you built this again
Knowing this was research turned into infrastructure in an evening, here is how you would start a similar one. Copy a prompt and adapt it.
Starts with research and understanding-before-installing, the original build's actual method.
Front-loads the HTTPS, firewall, and trim-to-fit that came later.
Points at the layer the mirror exists to serve.
This recap is the output of an editor pass over the project's agent transcripts. A deterministic extract (command-center flow --editor) pulls the direction, the agent trace, and the embedded screenshots from the most representative session. A single model pass captions each image and writes the narrative.
Every quoted heading is verbatim, typos and all. Landmark captions were recovered from images embedded in the transcript, then summarized. The originals are never reproduced or shared.