/dev/null: a read-only dev-null.sh commit feed for the bar

[Ivozzz]

I made a bar widget for Omarchy that puts dev-null.sh in the bar. It is read-only: no account, no token, nothing written back — it only reads the site's public endpoints.

Repo: https://github.com/Ivozzz/omarchy-devnull

omarchy plugin add https://github.com/Ivozzz/omarchy-devnull.git --enable

What's in it

• Three feeds, switchable in the panel or with 1 2 3, named after the site's own log tabs: Following (the developers you watch), Latest and Trending.
• A username lookup. Type any GitHub handle to see their profile — commit and follower counts — and to add or remove them from your watchlist without leaving the panel.
• A row is the whole commit: avatar, handle, short hash, age, up to three lines of the body, and its star and reply counts. Click opens it on dev-null.sh.
• The pill counts the current feed and turns the accent colour when something new has arrived since the last refresh.
• English and Italian catalogs, so it follows Setup > Language the way the built-in plugins do.

How it reads the site

dev-null.sh's public API under /api/v1 is per-user only, with no global timeline and no search. So Following is built from it — one request per watched user, merged — and the other two feeds come from the Inertia payload the site already embeds in /log/latest and /log/trending (<script type="application/json">, props.commits.data), which carries the same commit shape. Only that JSON is read; the surrounding markup is never parsed, so a redesign of the site costs nothing.

The site's own /log/following is not used: it answers 302 to the login page, and the plugin has no session and wants none. Following means your watchlist instead.

Since response text is untrusted input, it is stripped of markup and invisible characters, every string and list is bounded, commit URLs are rebuilt from a validated username and id rather than taken from the response, and each request is an argv vector behind its own URL allowlist. Details and the two small gaps (the log payload carries no short hash, and it lacks a dev-null.sh-hosted avatar) are in the README.

Feedback

Issues and PRs in the repo. It is MIT, has no telemetry, and is not affiliated with or endorsed by dev-null.sh — happy to be corrected on anything above.

It has since passed the marketplace's Quattro compatibility and automated
security baseline checks under the plugin id io.github.ivozzz.devnull, and is
up for maintainer review.