# Daniel Farina — full agent dump

I build the layer around the model — sandbox, tools, evals, control plane — and publish what actually breaks.

Canonical: https://danielfarina.com
Developers: https://danielfarina.com/developers
CLI: npx github:daniel-farina/danielfarina
Contact: elchileno@gmail.com

# Work

## Sub8

Computer-use agent on its own Linux VM.

Private Linux desktop per bot. Host files off-limits. View-only by default, human takeover, vault for secrets. Swap Grok / Claude / Codex / Ollama on the same task — isolation as an eval harness, not a demo mouse.

Live: https://sub8.grok.me
Page: https://danielfarina.com/work/sub8/

## Xplor

Chromium fork with an agent gateway.

Fork Chromium so the agent owns default search, per-page ask, and an always-on local gateway. Extensions are guests; guests lose. The gateway is the product.

Live: https://xplor.sh
Page: https://danielfarina.com/work/xplor/

## GrokTerm

PTY host for coding agents with voice.

Terminal host for coding agents: multi-tab PTY, two-way voice, CLI + notarized Mac app. The control surface for agents that live in shells.

Live: https://grokterm.com
Page: https://danielfarina.com/work/grokterm/

## grok-remote

ACP control plane over a tailnet.

Agent runs where the repo is. You run wherever you are. Live web UI speaking Agent Client Protocol over a tailnet. Disconnect/resume without orphaning the worker.

Live: https://github.com/daniel-farina/grok-remote
Page: https://danielfarina.com/work/grok-remote/

## grok-bench

Prompt diffs, compaction, proxy observability.

Prompt diffs, compaction, and proxy observability for Grok API workflows. The measurement layer for harness failure modes — not a leaderboard toy.

Live: https://github.com/daniel-farina/grok-bench
Page: https://danielfarina.com/work/grok-bench/

## ThinkVoice

Speak without moving your mouth — Grokathon.

HCI at the model boundary: Grok Voice plus sensing hardware so people can converse without moving their mouths. Context-aware reply chips; blink/nod/shake select. SpaceXAI Grokathon: 3rd place and Most Users.

Live: https://thinkvoice.grok.me
Page: https://danielfarina.com/work/thinkvoice/


# Essays

# Talk, don't block: splitting the coding-agent composer from the worker

The thing you talk to should not be the thing holding the write lock.

You are watching a coding agent work. You see it go the wrong way at step 6 of 40. You type.

The product has three bad options: queue the message until the turn ends (too late), inject it into the same turn (prefix-cache roulette), or cancel the turn (you just threw away the useful half).

I kept hitting this in Grok Build, Claude Code, and Codex. Different UIs. Same bug: the composer is owned by the worker.

## Before

One agent is both conversational partner and writer. Tools run in the main checkout. Subagents exist but nesting is effectively off. The task pane is a flat list.

```
You ──every message──► Agent
                          │
                          ├── edits / shell ──► MainTree
                          └── optional depth-1 child ──► MainTree
```

Enter means "talk to the thing that holds the write lock." Esc means "abort the useful half." That is not a conversation. It is a hostage negotiation with a process.

## After

You always talk to a supervisor. Mutating work is a tree of background jobs. Writers get worktrees. The supervisor reads, steers, kills. It does not hold the write lock.

```
You ──every message──► Supervisor
                          │
                          ├── read / search ──► MainTree
                          ├── spawn / steer / kill ──► JobA (worktree)
                          └── JobB (shared if read-only)
```

The supervisor is the free conversational partner. Jobs own context. Parallel. May nest within a depth cap. Writers stay isolated by default.

## What Enter does

| Action | Stops a job? | Prefix cache |
| --- | --- | --- |
| Type to supervisor | No | Jobs untouched |
| Supervisor steers a job | No | Child: append-only |
| Supervisor kills a job | That node/subtree | Child aborted; committed history kept |
| Esc / send-now | Supervisor turn only | Jobs keep running |

Steer is append-only interjection at the child's next safe gap. Kill is explicit. Cancel never means "throw away the worker that was almost done."

## Landing

When a writer finishes: try to apply the worktree onto main.

- Clean: land, wake supervisor.
- Conflict: spawn a merge worker with "resolve, do not invent features." Two retries. Then tell the supervisor it is blocked.

Default is not "please click Approve on this diff." That is a setting (`auto_merge` / `propose` / `branch`). Humans are not the merge tool by default.

## Isolation rules that matter

- Mutating jobs: worktree default.
- Explore / plan: shared tree default.
- Depth while supervisor is on: parent → child → grandchild (cap 3).
- Concurrency: capped. Unlimited nesting is a non-goal.

## What this is not

Not a second IDE. Not a mission-control dashboard product. Not unlimited nesting. Headless one-shots stay single-agent (Solo) unless opted in. The supervisor does not do long-running shell or file edits itself — that is the whole point.

## Why labs should care

Post-training improves tool-call validity. It does not fix a product that destroys prefix cache or cancels useful work when a human wants to talk. The harness shape is the control plane around the model. If talking kills the job, you are measuring the wrong failure.

The eval that matters is boring: did talking kill the job? That is the first slice of what I am calling steer-bench.

## Offer

This pattern is being implemented in the open as **steer** — a clean-room control plane. Original code. Not a fork of any vendor CLI. Public names: Supervisor, Job, Isolation, LandingPolicy, `spawn_job`, `steer_job`, `kill_job`.

I build the layer around the model. This is the architecture I want to push until the boring eval turns green.

Canonical: https://danielfarina.com/posts/talk-dont-block/

---

# Sub8: give the agent a computer it cannot escape

Computer-use is easy. Isolation is the product.

Screenshot-click-type is not the hard part. Any demos that stop at "the model can use a mouse" are selling the wrong layer.

The hard part is a private Linux desktop per bot, view-only by default, human takeover when needed, a vault that never puts secrets in the transcript, and a harness that can swap Grok / Claude / Codex / Ollama on the same task.

That is Sub8.

## Topology

- Host app on your machine — orchestration, UI, policy.
- Docker / Colima VM — the agent's desktop. Host files are off-limits by construction.
- Two tunnels: computer-use (pixels + input) and docker exec (shell when you allow it).

If the agent can see your home directory, you do not have computer-use. You have remote code execution with a cute cursor.

## Why host files are off-limits

Coding agents fail in interesting ways: `rm -rf`, credential scrapes, "helpfully" rewriting configs outside the repo. Isolation is not paranoia. It is the product boundary that lets you run long tool-call loops overnight without babysitting.

View-only by default. Human takeover when the agent is stuck. Secrets in a vault — never pasted into the chat transcript the model can echo later.

## Model-agnostic as an eval feature

Being able to swap models on the same isolation harness is not a marketing checkbox. It is how you measure post-training effects on tool use: same desktop, same task, different model. If your sandbox is glued to one vendor's computer-use API, you cannot run that comparison.

## What broke in alpha

Permissions and display plumbing ate more time than the model. Credential injection paths that looked safe until the transcript leaked them. The interesting failures were harness failures — not "the LLM clicked the wrong button."

Live: https://sub8.grok.me

Isolation first. Then the mouse.

Canonical: https://danielfarina.com/posts/sub8-isolation-is-the-product/

---

# Fork the browser. Don't bolt on an extension.

If the agent is a guest in Chrome, you already lost.

Extensions are guests. Guests do not own navigation, default search, or the process lifetime of the tab. If you want an agent that builds and browses inside the browser, fork Chromium.

Xplor is that fork: Grok (and agent tooling) at source level — default search, per-page ask, toolbar, always-on local gateway.

## Extension vs fork

| Capability | Extension | Fork |
| --- | --- | --- |
| Default search / new tab | Fighting Chrome | Native |
| Always-on local gateway | Fragile background page | Process you own |
| CDP + higher-level API | Partial / brittle | First-class |
| "Grok it" on every page | Content script games | Built-in |
| Not affiliated with xAI | Say it anyway | Say it anyway |

The gateway is the actual product. CDP plus a higher-level API so any external agent can drive the browser — not a chat overlay bolted onto someone else's Chrome.

## What I care about measuring

Can an agent open a page, extract structure, write code in a side panel, and keep session state without the extension getting killed? That is a harness question. Chromium internals matter because the agent control plane has to sit under the UI chrome, not on top of it.

Live: https://xplor.sh · source: https://github.com/daniel-farina/xplorer

Not affiliated with xAI. Power user of coding agents and browsers — shipping the fork.

Canonical: https://danielfarina.com/posts/xplor-fork-the-browser/

---

# Drive a coding agent from the other machine

ACP over a tailnet. Session survives disconnect.

The agent should run where the repo is. You should run wherever you are.

SSH plus tmux is not the same product. You get a terminal. You do not get a live web UI speaking Agent Client Protocol to agent stdio, disconnect/resume, or a control plane shaped like supervisor/worker instead of one chat pane.

## What ACP buys

ACP (Agent Client Protocol) is the wire between UI and agent process. The UI is not "a website that shells out." It is a client of the agent's protocol — tools, turns, cancellation — over a tailnet so the laptop on the desk and the phone on the train are the same session.

Disconnect should not orphan the worker. Resume should not invent a new context window.

## Why not just SSH

- SSH gives you bytes. ACP gives you structured agent state.
- Tmux survives disconnect for a human staring at logs. It does not give a product surface for steer/kill of background jobs.
- A control plane UI is where you put the supervisor — the thing you talk to while workers hold the write lock elsewhere.

## Shape

Remote agent sessions with a real UI. Supervisor/worker shaped. Not a single chat pane pretending to be a product.

Source: https://github.com/daniel-farina/grok-remote

This is the same thesis as Talk, don't block — applied to where the UI lives relative to the machine that has the checkout.

Canonical: https://danielfarina.com/posts/grok-remote-acp-over-tailnet/