(Note: This is the untold story behind the KAVLR launch. If you haven't read the main post, check it out here: [Link to main KAVLR post])
Building a
Altro...
(Note: This is the untold story behind the KAVLR launch. If you haven't read the main post, check it out here: [Link to main KAVLR post])
Building a
Altro...(Note: This is the untold story behind the KAVLR launch. If you haven't read the main post, check it out here: [Link to main KAVLR post])
Building a product is not about writing the first line of code. It’s about surviving the 100th bug.
Here is the story of how I accidentally created a "Terminal Immortal" and spent two days fighting a zombie process on my $150 Android phone.
Act I: The Creation and the Betrayal
It started with a simple goal: build a leash for AI agents. I wrote the code, connected it to Supabase, and created the Bash hook.
The first time I typed cat .env and saw the glowing red [BLOCKED], I felt like a god. I had built a security system on a $150 phone.
But I made a fatal design choice: Fail-Closed. If the server goes down, the hook blocks the command to keep the user safe.
I didn't realize that the "user" would eventually be me.
Act II: The Cloud Despair
I wanted the world to use it, so I moved the backend to the cloud. I tried Vercel. 502 Bad Gateway. I tried Railway. FUNCTION_INVOCATION_FAILED.
I was staring at a 5% battery icon, watching my terminal crash over and over. I felt like David fighting Goliath, except Goliath had infinite cloud credits and I had a 4G connection that kept dropping.
Then, I pivoted to Supabase Edge Functions. It worked. The API was alive.
Act III: The Terminal Immortal
That’s when the real monster woke up.
I tried to read my index.js file to fix a bug, and the terminal printed:
🔍 KAVLR analyzing: ""...
❌ KAVLR Backend Offline or Error. Blocking command.
My own security system locked me out of my own code.
I tried to delete the broken script. Blocked.
I tried to edit my .bashrc. Blocked.
I tried to use cat to look at the file. Blocked.
The Terminal Immortal had taken over. It was a zombie process—a ghost script that refused to die. Even when I deleted the files, Bash held onto the memory. Even when I overwrote the NPM package, the corrupted cache fought back.
I spent hours pasting Python scripts, only for Termux to mangle the text into a single line. I watched my index.js file get corrupted because my own hook intercepted the cat > index.js command and wrote error messages into the file instead of the code.
I was fighting a hydra. Every time I cut off a head, two more grew back.
Act IV: The Epiphany
I was exhausted. I opened a clean terminal session and ran a grep command to find where the ghost was hiding.
grep -rn "analyzing:" /data/data/com.termux/files/home/
And there it was. A trail of corrupted files. index.js was poisoned. node_modules was duplicated. Aliases were stacked 13 layers deep.
I realized I couldn't just patch the bug. I had to perform surgery.
I nuked the .bashrc. I deleted the rogue node_modules. I rewrote the CLI using Base64 to bypass Termux's text-mangling. I manually recreated the symlinks. I cleared the Bash hash table (hash -r).
Act V: The Victory
I held my breath and typed:
kavlr hook cat ~/kavlr/index.js
The screen printed my Express code. The file was alive.
I typed:
kavlr hook cat .env
The screen lit up with red: 🛑 [BLOCKED] THREAT DETECTED.
The Terminal Immortal was dead. The ghost was exorcised.
The Reflection
I am 12 years old. I just spent my entire weekend fighting a zombie process in a mobile terminal.
To every developer out there fighting their own "Terminal Immortal": Don't stop. The bug is stubborn, but you are stubborn and smart. And when you finally see that code print correctly, you will feel like you own the world.
We are HYNAWEB. We don't surrender to ghosts.
🐯️🚀#webdev #programming #cybersecurity #python #software #coding #development #engineering #inclusive #community
Iam 12 . I Built a Security Tool So Good It Locked Me Out of My Own Terminal for 48 Hours
