chore(flake): bump codex-cli to 0.153.4

chore(flake): bump maestro to 2e7c5f7
chore(flake): bump maestro to 3529947
2026-09-05 22:33:12 +01:00 · 2026-09-05 20:49:27 +01:00 · 2026-09-05 03:49:40 +01:00 · 2026-09-04 20:08:17 +01:00 · 2026-09-04 19:57:40 +01:00 · 2026-09-04 19:47:59 +01:00
10 changed files with 121 additions and 50 deletions
@@ -22,11 +22,11 @@
    },
    "agent-skills": {
      "locked": {
-        "lastModified": 1787576215,
-        "narHash": "sha256-x1ftVVEcq8p6phZEl4NC4F3RcPqpgx6wEMODMI5QHN8=",
+        "lastModified": 1788356316,
+        "narHash": "sha256-y5dQioiefegmuPLulFSEL4DrRJMaEHt1UcMGyOM6fRk=",
        "ref": "refs/heads/main",
-        "rev": "0900e5fea1245c7d5e962e48a809ff7481c87f95",
-        "revCount": 99,
+        "rev": "abd21928bf993962f98364d48a2877155beaa6d0",
+        "revCount": 111,
        "type": "git",
        "url": "https://git.naps.pt/yolo/agent-skills.git"
      },
@@ -74,11 +74,11 @@
        "systems": "systems"
      },
      "locked": {
-        "lastModified": 1787189302,
-        "narHash": "sha256-cUM75Rob89qTxJvqVRF8GUewOriqQtLiyiy5xfd1fMM=",
+        "lastModified": 1788303707,
+        "narHash": "sha256-ICEHLJAM480kNrsOQ+DPWWV3XFJUDc6/n/PPcjAuRR8=",
        "owner": "sadjow",
        "repo": "claude-code-nix",
-        "rev": "8fb8cbab6345583e0b68ca7dbbbad08a0a348145",
+        "rev": "7f0aeb2f0c6cf1ca2bf3b0b76b823b24b04b5b21",
        "type": "github"
      },
      "original": {
@@ -95,11 +95,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1787094470,
-        "narHash": "sha256-UiHfeA8umiWByi/ijDnfnlGcVSEAhwNv1Gue3h6ey/U=",
+        "lastModified": 1788568734,
+        "narHash": "sha256-SzZaOg5XWeTzPTPYpLsSIb47FjC1jXzmfJVjzl8Xd8Q=",
        "owner": "sadjow",
        "repo": "codex-cli-nix",
-        "rev": "cfbeeca2f4dfbbfcc3c1a5b21e61a051ff43533d",
+        "rev": "3a0dca3725f6d8b74cfe635a85724d2313731fb4",
        "type": "github"
      },
      "original": {
@@ -754,11 +754,11 @@
        "process-compose-flake": "process-compose-flake"
      },
      "locked": {
-        "lastModified": 1787610419,
-        "narHash": "sha256-YRDvlaiEOpzRC5JHMlm/S39EGfrGsD4kmEWwnyHz4Tg=",
+        "lastModified": 1788628221,
+        "narHash": "sha256-LIvOc7qIfzoOX0nniagUhsyjndnpZwjKyLRaiheIU5M=",
        "ref": "refs/heads/main",
-        "rev": "80a93999051d41b29544258dca272d40f3fc0c98",
-        "revCount": 443,
+        "rev": "2e7c5f7f58fe690b1545cfcfd4cd3b76b6652c51",
+        "revCount": 635,
        "type": "git",
        "url": "https://git.naps.pt/naps62/maestro.git"
      },
@@ -767,6 +767,22 @@
        "url": "https://git.naps.pt/naps62/maestro.git"
      }
    },
+    "nix-flatpak": {
+      "locked": {
+        "lastModified": 1767983141,
+        "narHash": "sha256-7ZCulYUD9RmJIDULTRkGLSW1faMpDlPKcbWJLYHoXcs=",
+        "owner": "gmodena",
+        "repo": "nix-flatpak",
+        "rev": "440818969ac2cbd77bfe025e884d0aa528991374",
+        "type": "github"
+      },
+      "original": {
+        "owner": "gmodena",
+        "ref": "latest",
+        "repo": "nix-flatpak",
+        "type": "github"
+      }
+    },
    "nix-index-database": {
      "inputs": {
        "nixpkgs": [
@@ -850,11 +866,11 @@
    },
    "nixpkgs_2": {
      "locked": {
-        "lastModified": 1787111413,
-        "narHash": "sha256-sFosWtq21eHGJRnTc/hvf4M1obRgLEUMNm/IzllkHMA=",
+        "lastModified": 1787964612,
+        "narHash": "sha256-0N9nghg3nwzX6b6qc77EzjR9cu/Z+UR66FlfsCqiURs=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "afe3d8ac4395617bdcdac9f188ac8717a062e014",
+        "rev": "e8be7818e19ada32105a8af937a6a473b38167ca",
        "type": "github"
      },
      "original": {
@@ -1059,11 +1075,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1787648458,
-        "narHash": "sha256-YO8lx85XorD2cnq5QNBvpj3JH60OrDV04GA3R2Oaih0=",
+        "lastModified": 1788517029,
+        "narHash": "sha256-WIX0qEGDAUk9DMtx8Ntw/oQ4MaMd311OdaDR9aXATiM=",
        "ref": "refs/heads/main",
-        "rev": "88bf55a737046768adcea15b2475096519341494",
-        "revCount": 234,
+        "rev": "7e78a5f04c01204ee3fcba7858c01b43f98c4c9a",
+        "revCount": 238,
        "type": "git",
        "url": "https://git.naps.pt/yolo/rev.git"
      },
@@ -1085,6 +1101,7 @@
        "home-manager": "home-manager",
        "hyprland": "hyprland",
        "maestro": "maestro",
+        "nix-flatpak": "nix-flatpak",
        "nix-index-database": "nix-index-database",
        "nixpkgs": "nixpkgs_7",
        "nvchad-starter": "nvchad-starter",
@@ -80,6 +80,9 @@
      url = "git+https://git.naps.pt/yolo/rev.git";
      inputs.nixpkgs.follows = "nixpkgs";
    };
+    # Declarative flatpak remotes and packages; nixpkgs' services.flatpak only
+    # exposes `enable`. Has no nixpkgs input to follow.
+    nix-flatpak.url = "github:gmodena/nix-flatpak/?ref=latest";
    nix-index-database = {
      url = "github:nix-community/nix-index-database";
      inputs.nixpkgs.follows = "nixpkgs";
@@ -26,20 +26,12 @@ in
  ];

  # maestro's and rev's units come from their flake modules, not from the
-  # hand-written set below. 8081, not 8080: aoe-web already has that port on
-  # this host. There is no auth layer, so 0.0.0.0 is only safe behind the LAN
-  # perimeter.
-  services.maestro = {
-    enable = true;
-    web.enable = true;
-    settings = {
-      daemon.bind_addr = "127.0.0.1:7070";
-      web = {
-        bind_addr = "0.0.0.0:8081";
-        daemon_url = "http://127.0.0.1:7070";
-      };
-    };
-  };
+  # hand-written set below.
+  #
+  # settings stays empty on purpose: ~/.config/maestro/config.toml is a
+  # hand-edited plain file, not nix-generated (module skips it iff `{}`).
+  # There is no `web.enable`: the daemon serves the UI on `daemon.bind_addr`.
+  services.maestro.enable = true;

  # Everything under ~, three levels deep — the worktrees live at
  # ~/<area>/<repo>/worktrees/<name>. sem gives entity-level diffs; without it
@@ -51,9 +43,9 @@ in
    semBin = "${sem}/bin/sem";
  };

-  # One endpoint for every repo this config pins. rev and agent-skills apply
-  # straight away; maestro only bumps the lock and notifies, because switching
-  # restarts the daemon that owns every interactive shell on this box.
+  # One endpoint for every repo this config pins. All three apply straight
+  # away: a maestro restart drops the daemon but not the sessions it manages,
+  # so the interactive shells on this box survive it.
  services.nixAutodeploy = {
    enable = true;
    flake = "/home/naps62/tea/nixos-config";
@@ -61,10 +53,7 @@ in
    repos = {
      "yolo/rev".input = "rev";
      "yolo/agent-skills".input = "agent-skills";
-      "naps62/maestro" = {
-        input = "maestro";
-        apply = false;
-      };
+      "naps62/maestro".input = "maestro";
    };
  };

@@ -22,6 +22,7 @@
    ../common/features/bluetooth.nix
    ../common/features/ledger.nix
    ../common/features/smb-mounts.nix
+    ../common/features/transmission.nix
    ../common/features/home
  ];

@@ -39,7 +40,7 @@
      # yolo VM's /home/naps62 (share defined in hosts/yolo/default.nix).
      server = "10.7.10.2";
      share = "home";
-      mountPoint = "/home/naps62/yolo";
+      mountPoint = "/mnt/yolo";
    }
  ];

@@ -0,0 +1,28 @@
+{ inputs, lib, ... }:
+{
+  imports = [ inputs.nix-flatpak.nixosModules.nix-flatpak ];
+
+  services.flatpak = {
+    enable = true;
+
+    # mkOptionDefault so the module's default `flathub` remote is kept rather
+    # than replaced.
+    remotes = lib.mkOptionDefault [
+      {
+        name = "flathub-beta";
+        location = "https://flathub.org/beta-repo/flathub-beta.flatpakrepo";
+      }
+    ];
+
+    packages = [
+      # PrusaSlicer 3.x. As of 3.0 Prusa ships no Linux binary at all — Flathub
+      # is the only channel, and the alphas live in flathub-beta. Runs alongside
+      # pkgs.prusa-slicer (2.9.x, in home/common/programs/3d.nix): 3.x keeps its
+      # profiles in a separate PrusaSlicer3-dev config dir.
+      {
+        appId = "com.prusa3d.PrusaSlicer";
+        origin = "flathub-beta";
+      }
+    ];
+  };
+}
@@ -40,7 +40,10 @@ in
          };
          mountPoint = lib.mkOption {
            type = lib.types.str;
-            description = "Local mount point, e.g. \"/mnt/retroarch\".";
+            # MUST NOT live under $HOME: starship and eww stat every entry of the
+            # home dir, so a mount point there triggers the automount on every
+            # prompt and blocks for mount-timeout while the VPN is down.
+            description = "Local mount point outside $HOME, e.g. \"/mnt/retroarch\".";
          };
          user = lib.mkOption {
            type = lib.types.str;
@@ -0,0 +1,15 @@
+{ pkgs, ... }:
+{
+  services.transmission = {
+    enable = true;
+    package = pkgs.transmission_4;
+    openRPCPort = true;
+    settings = {
+      rpc-bind-address = "0.0.0.0";
+      rpc-whitelist-enabled = false;
+      rpc-host-whitelist-enabled = false;
+      rpc-authentication-required = false;
+      download-dir = "/var/lib/transmission/Downloads";
+    };
+  };
+}
@@ -20,7 +20,9 @@
    ../common/features/wine.nix
    ../common/features/gaming
    ../common/features/appimage.nix
+    ../common/features/flatpak.nix
    ../common/features/smb-mounts.nix
+    ../common/features/transmission.nix
    ../common/features/home
  ];

@@ -42,7 +44,7 @@
      # yolo VM's /home/naps62 (share defined in hosts/yolo/default.nix).
      server = "10.7.10.2";
      share = "home";
-      mountPoint = "/home/naps62/yolo";
+      mountPoint = "/mnt/yolo";
    }
  ];

@@ -17,6 +17,7 @@
    ../common/features/kdeconnect.nix
    ../common/features/nix-ld.nix
    ../common/features/appimage.nix
+    ../common/features/transmission.nix
    ../common/features/home
  ];

@@ -30,11 +31,20 @@
  # this VM has a real 8G swap partition, and the host manages its own memory.
  zramSwap.enable = lib.mkForce false;

-  # The only out-of-band way in. `vga: virtio-gl` renders through a GL context
-  # with no QEMU console surface, so noVNC and screendump both go dark; this
-  # pairs with the VM's serial0 socket to keep `qm terminal` working. Listed
-  # last so it wins /dev/console and gets the getty.
  boot.kernelParams = [
+    # When the host pages this VM's memory out, KVM's async page fault parks
+    # the faulting task in an uninterruptible wait instead of stalling the
+    # whole vCPU. If the "page ready" wakeup is ever dropped, that task is
+    # wedged forever and SIGKILL cannot touch it — it took out maestro-web,
+    # nix activation generators and a dozen agent sessions, a few per day,
+    # until a reboot. Disabling async PF makes host page-ins stall the vCPU
+    # synchronously: slower under host memory pressure, but nothing hangs.
+    "no-kvmapf"
+
+    # The only out-of-band way in. `vga: virtio-gl` renders through a GL
+    # context with no QEMU console surface, so noVNC and screendump both go
+    # dark; this pairs with the VM's serial0 socket to keep `qm terminal`
+    # working. Listed last so it wins /dev/console and gets the getty.
    "console=tty1"
    "console=ttyS0,115200"
  ];
@@ -137,9 +137,12 @@ stdenv.mkDerivation (finalAttrs: {
    # The bundled Chromium/ANGLE dlopen()s the system libEGL.so.1 for GL; give it
    # libglvnd + NixOS's GPU driver path so it hardware-accelerates instead of
    # falling back to software rendering.
+    # Chromium maps XDG_CURRENT_DESKTOP=Hyprland to "other" and silently picks the
+    # plaintext `basic` keystore, so safeStorage reports unavailable and auth tokens
+    # never persist across restarts. Pin the libsecret backend explicitly.
    makeWrapper $out/lib/claude-desktop/claude-desktop $out/bin/claude-desktop \
      "''${gappsWrapperArgs[@]}" \
-      --add-flags "--no-sandbox${lib.optionalString (deviceScaleFactor != null) " --force-device-scale-factor=${deviceScaleFactor}"}" \
+      --add-flags "--no-sandbox --password-store=gnome-libsecret${lib.optionalString (deviceScaleFactor != null) " --force-device-scale-factor=${deviceScaleFactor}"}" \
      --prefix PATH : ${lib.makeBinPath [ xdg-utils ]} \
      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ libGL mesa ]}:/run/opengl-driver/lib"