diff --git a/config/macos/bin/con b/config/macos/bin/con
new file mode 100755
index 0000000..d8657d6
--- /dev/null
+++ b/config/macos/bin/con
@@ -0,0 +1,135 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ATTACH_TMUX=1
+DRY_RUN=0
+TMUX_SESSION_DEFAULT="default"
+
+df_platform=""
+df_namespace=""
+df_user=""
+
+ssh_identity=""
+ssh_host=""
+ssh_args=()
+
+usage() {
+    local prog
+    prog=$(basename "$0")
+    echo "Usage: $prog <platform> [user@]namespace [--no-tmux|-t] [--dry-run|-n] [-- <ssh args...>]" >&2
+    echo
+    echo "Examples:"
+    echo "  $prog orb namespace"
+    echo "  $prog utm user@namespace --no-tmux"
+    echo "  $prog core user@namespace --dry-run -- -v -p 2222"
+    exit 1
+}
+
+parse_args() {
+    if [[ $# -lt 2 ]]; then
+        usage
+    fi
+
+    df_platform="$1"
+    local user_namespace_arg="$2"
+    shift 2
+
+    # Extract df_user and df_namespace
+    if [[ "$user_namespace_arg" == *@* ]]; then
+        df_user="${user_namespace_arg%@*}"
+        df_namespace="${user_namespace_arg#*@}"
+    else
+        df_user="$USER"
+        df_namespace="$user_namespace_arg"
+    fi
+
+    # Parse remaining flags and ssh args
+    while [[ $# -gt 0 ]]; do
+        case "$1" in
+            -t|--no-tmux)
+                ATTACH_TMUX=0
+                shift
+                ;;
+            -n|--dry-run)
+                DRY_RUN=1
+                shift
+                ;;
+            --)
+                shift
+                ssh_args+=("$@")
+                break
+                ;;
+            *)
+                echo "Unknown option: $1" >&2
+                usage
+                ;;
+        esac
+    done
+}
+
+resolve_host() {
+    case "$df_platform" in
+        orb)
+            # orb-stack handles user@namespace internally
+            ssh_host="${df_namespace}@orb"
+            ;;
+        utm)
+            ssh_host="${df_namespace}.utm.local"
+            ssh_identity="$HOME/.ssh/id_ed25519_internal"
+            ;;
+        core)
+            ssh_host="${df_namespace}.core.lan"
+            ssh_identity="$HOME/.ssh/id_ed25519_internal"
+            ;;
+        ec2)
+            ssh_host="${df_namespace}.ec2.internal"
+            ;;
+        hetzner)
+            ssh_host="${df_namespace}.hetzner.test"
+            ;;
+        *)
+            echo "Error: unknown platform '$df_platform'" >&2
+            exit 1
+            ;;
+    esac
+}
+
+build_ssh_cmd() {
+    local cmd=(ssh -tt)
+
+    if [[ -n "$ssh_identity" ]]; then
+        cmd+=(-i "$ssh_identity" -o IdentitiesOnly=yes)
+    fi
+
+    if [[ ${#ssh_args[@]} -gt 0 ]]; then
+        cmd+=("${ssh_args[@]}")
+    fi
+
+    cmd+=("${df_user}@${ssh_host}")
+
+    if [[ $ATTACH_TMUX -eq 1 ]]; then
+        cmd+=("tmux" "new-session" "-As" "$TMUX_SESSION_DEFAULT"
+              "-e" "DF_NAMESPACE=$df_namespace"
+              "-e" "DF_PLATFORM=$df_platform")
+    fi
+
+    echo "${cmd[@]}"
+}
+
+main() {
+    parse_args "$@"
+    resolve_host
+    ssh_cmd=($(build_ssh_cmd))
+
+    if [[ $DRY_RUN -eq 1 ]]; then
+        echo "Dry run command:"
+        printf '%q ' "${ssh_cmd[@]}"
+        echo
+        exit 0
+    fi
+
+    exec "${ssh_cmd[@]}"
+}
+
+main "$@"
+
diff --git a/config/macos/bin/vm b/config/macos/bin/vm
deleted file mode 100755
index 7b59cf6..0000000
--- a/config/macos/bin/vm
+++ /dev/null
@@ -1,81 +0,0 @@
-#!/usr/bin/env bash
-# ~/bin/vm
-#
-# SSH helper script for connecting to VMs or workstations.
-# Usage:
-#   vm [--no-tmux] <host>
-#
-# Host patterns:
-#   personal-orb           -> ssh $USER@personal@orb
-#   personal-utm           -> ssh $USER@personal.utm.local
-#   personal-workstation   -> ssh $USER@personal.workstation.lan
-#
-# Optional:
-#   --no-tmux             -> skips attaching to tmux session
-
-# TMP: Tmux will be disabled (switch to 0 to enable it again)
-skip_tmux=0
-
-# Check for --no-tmux flag
-if [[ "$1" == "--no-tmux" ]]; then
-    skip_tmux=1
-    shift
-fi
-
-full="$1"
-shift # remove host from args
-
-user="$USER"
-host="$full"
-
-# Split user@host if explicitly specified
-if [[ "$full" == *@* ]]; then
-    user="${full%@*}"
-    host="${full#*@}"
-fi
-
-# Map host patterns to SSH target and machine type
-case "$host" in
-    *-orb)
-        ssh_host="${host%-orb}@orb"
-        TARGET_MACHINE="orb"
-        ;;
-    *-utm)
-        ssh_host="${host%-utm}.utm.local"
-        TARGET_MACHINE="utm"
-        ssh_identity="$HOME/.ssh/id_ed25519_internal"
-        ;;
-    *-workstation)
-        ssh_host="${host%-workstation}.workstation.lan"
-        TARGET_MACHINE="workstation"
-        ssh_identity="$HOME/.ssh/id_ed25519_internal"
-        ;;
-    *)
-        echo "Error: unknown host pattern '$host'" >&2
-        exit 1
-        ;;
-esac
-
-# Always use "default" tmux session
-tmux_session="default"
-
-# Build SSH command safely using an array
-ssh_cmd=(ssh -tt)
-
-# Include identity file if needed
-[[ -n "$ssh_identity" ]] && ssh_cmd+=(-i "$ssh_identity" -o IdentitiesOnly=yes)
-
-# Add target user and host
-ssh_cmd+=("$user@$ssh_host")
-
-# Add tmux session unless skipped
-if [[ $skip_tmux -eq 0 ]]; then
-    ssh_cmd+=("tmux" "new-session" "-As" "$tmux_session" "-e" "TARGET_MACHINE=$TARGET_MACHINE")
-else
-    # Pass through any extra args user supplied
-    ssh_cmd+=("$@")
-fi
-
-# echo "Executing: ${ssh_cmd[*]}" >&2
-exec "${ssh_cmd[@]}"
-