chore(flake): bump maestro to 8325bc6

chore(flake): bump maestro to 8f499db
chore(flake): bump maestro to f8b434d
2026-09-03 23:05:29 +01:00 · 2026-09-03 22:56:12 +01:00 · 2026-09-03 17:49:28 +01:00 · 2026-09-03 15:33:16 +01:00 · 2026-09-03 14:09:09 +01:00 · 2026-09-03 13:40:48 +01:00
66 changed files with 2078 additions and 1394 deletions
@@ -7,27 +7,26 @@
        "nixpkgs": "nixpkgs"
      },
      "locked": {
-        "lastModified": 1786554876,
-        "narHash": "sha256-akMknOIdX0QsBsM4lgreXSNNym7TNu9iOrDBqrQuTuQ=",
-        "owner": "agent-of-empires",
-        "repo": "agent-of-empires",
-        "rev": "9b0d691a6cdaa6d2451f6eda05e83628c54eb95a",
-        "type": "github"
+        "lastModified": 1787387938,
+        "narHash": "sha256-113jGEYKSeTwYgLdlVuRyqPBHYHJcU1kbRKiAUhj04Q=",
+        "ref": "refs/heads/main",
+        "rev": "96472052106cb5c448e9fa39244b0d0ccae9be72",
+        "revCount": 2192,
+        "type": "git",
+        "url": "https://git.naps.pt/yolo/agent-of-empires.git"
      },
      "original": {
-        "owner": "agent-of-empires",
-        "ref": "v1.14.1",
-        "repo": "agent-of-empires",
-        "type": "github"
+        "type": "git",
+        "url": "https://git.naps.pt/yolo/agent-of-empires.git"
      }
    },
    "agent-skills": {
      "locked": {
-        "lastModified": 1786957004,
-        "narHash": "sha256-lUyQGAN6Kd5onhPa+ptOiwtIaY6Y02q+nyRt9NWkdDg=",
+        "lastModified": 1788356316,
+        "narHash": "sha256-y5dQioiefegmuPLulFSEL4DrRJMaEHt1UcMGyOM6fRk=",
        "ref": "refs/heads/main",
-        "rev": "7cb03f879600e87281356fdc411b2690f09a9175",
-        "revCount": 47,
+        "rev": "abd21928bf993962f98364d48a2877155beaa6d0",
+        "revCount": 111,
        "type": "git",
        "url": "https://git.naps.pt/yolo/agent-skills.git"
      },
@@ -56,11 +55,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1784368054,
-        "narHash": "sha256-zF1iJkBQSDWmRO4/LEeHR1SpKY0lqZaxkoQJpPS9K9U=",
+        "lastModified": 1786464219,
+        "narHash": "sha256-WKqWL8r7CyTDYueTr2ffJ9ya50dellv6IR1JX5PghDY=",
        "owner": "hyprwm",
        "repo": "aquamarine",
-        "rev": "9b5f14d9483445e766294eb8fbe0b8f370269ed0",
+        "rev": "f3d1804205e8158c15595cdda1b566f93349ffae",
        "type": "github"
      },
      "original": {
@@ -71,15 +70,15 @@
    },
    "claude-code": {
      "inputs": {
-        "flake-utils": "flake-utils",
-        "nixpkgs": "nixpkgs_2"
+        "nixpkgs": "nixpkgs_2",
+        "systems": "systems"
      },
      "locked": {
-        "lastModified": 1785285785,
-        "narHash": "sha256-r1cMlvXjRVKe+uQ/GKwy4TpionpmbNgksFP2758D/MM=",
+        "lastModified": 1788303707,
+        "narHash": "sha256-ICEHLJAM480kNrsOQ+DPWWV3XFJUDc6/n/PPcjAuRR8=",
        "owner": "sadjow",
        "repo": "claude-code-nix",
-        "rev": "da78262708d858861afbe1f68ea65fedda4054c4",
+        "rev": "7f0aeb2f0c6cf1ca2bf3b0b76b823b24b04b5b21",
        "type": "github"
      },
      "original": {
@@ -90,17 +89,17 @@
    },
    "codex-cli": {
      "inputs": {
-        "flake-utils": "flake-utils_2",
+        "flake-utils": "flake-utils",
        "nixpkgs": [
          "nixpkgs"
        ]
      },
      "locked": {
-        "lastModified": 1785294467,
-        "narHash": "sha256-mylUWHK2wIw8S07K5hbkrLELnflJkDwsSWz2YFbJzLI=",
+        "lastModified": 1787094470,
+        "narHash": "sha256-UiHfeA8umiWByi/ijDnfnlGcVSEAhwNv1Gue3h6ey/U=",
        "owner": "sadjow",
        "repo": "codex-cli-nix",
-        "rev": "e4e3b0672bbb8fba7f32fe53cd9c604990970374",
+        "rev": "cfbeeca2f4dfbbfcc3c1a5b21e61a051ff43533d",
        "type": "github"
      },
      "original": {
@@ -112,17 +111,17 @@
    },
    "codex-desktop-linux": {
      "inputs": {
-        "flake-utils": "flake-utils_3",
+        "flake-utils": "flake-utils_2",
        "nixpkgs": [
          "nixpkgs"
        ]
      },
      "locked": {
-        "lastModified": 1786822283,
-        "narHash": "sha256-RdoFKwNQ2m2zbHnq/QbgLf2lUI9cohsnlMwLfJuaTh0=",
+        "lastModified": 1787079200,
+        "narHash": "sha256-BYo8mVEqRj6y8PzpFd3rX6TQTknB3Ynp/3ykMTm56D8=",
        "owner": "ilysenko",
        "repo": "codex-desktop-linux",
-        "rev": "e6b51d96ac2b9b5d9adafa852241bd0982972557",
+        "rev": "1875dc2eaab6f9448617d18d0eda58902edf0f1a",
        "type": "github"
      },
      "original": {
@@ -146,6 +145,21 @@
        "type": "github"
      }
    },
+    "crane_2": {
+      "locked": {
+        "lastModified": 1787326676,
+        "narHash": "sha256-lWhBbBvC05/xwivKBBiM2YNizpmgqCgyOIzomvRuwxs=",
+        "owner": "ipetkov",
+        "repo": "crane",
+        "rev": "692f7e9ef2ece8125b466f66f2af532b3edaed0d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ipetkov",
+        "repo": "crane",
+        "type": "github"
+      }
+    },
    "ethui": {
      "inputs": {
        "nixpkgs": "nixpkgs_3",
@@ -205,6 +219,24 @@
      "inputs": {
        "nixpkgs-lib": "nixpkgs-lib_2"
      },
+      "locked": {
+        "lastModified": 1785627969,
+        "narHash": "sha256-4dtXQk/NMePegK/nWp5NSeuZKLATItOq61lpEvmXqGw=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "427bf4bd9435fdf21321c8cc628c24efc14c0f7a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
+    "flake-parts_3": {
+      "inputs": {
+        "nixpkgs-lib": "nixpkgs-lib_3"
+      },
      "locked": {
        "lastModified": 1775087534,
        "narHash": "sha256-91qqW8lhL7TLwgQWijoGBbiD4t7/q75KTi8NxjVmSmA=",
@@ -220,24 +252,6 @@
      }
    },
    "flake-utils": {
-      "inputs": {
-        "systems": "systems"
-      },
-      "locked": {
-        "lastModified": 1731533236,
-        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "flake-utils_2": {
      "inputs": {
        "systems": "systems_2"
      },
@@ -255,7 +269,7 @@
        "type": "github"
      }
    },
-    "flake-utils_3": {
+    "flake-utils_2": {
      "inputs": {
        "systems": "systems_3"
      },
@@ -273,7 +287,7 @@
        "type": "github"
      }
    },
-    "flake-utils_4": {
+    "flake-utils_3": {
      "locked": {
        "lastModified": 1644229661,
        "narHash": "sha256-1YdnJAsNy69bpcjuoKdOYQX0YxZBiCYZo4Twxerqv7k=",
@@ -288,7 +302,7 @@
        "type": "github"
      }
    },
-    "flake-utils_5": {
+    "flake-utils_4": {
      "inputs": {
        "systems": "systems_8"
      },
@@ -308,17 +322,17 @@
    },
    "foundry": {
      "inputs": {
-        "flake-utils": "flake-utils_4",
+        "flake-utils": "flake-utils_3",
        "nixpkgs": [
          "nixpkgs"
        ]
      },
      "locked": {
-        "lastModified": 1785311662,
-        "narHash": "sha256-lC5ZlyNMf8wcQnrAzUhYb1p6ndzwEovnXKiMqSTLgUo=",
+        "lastModified": 1787123762,
+        "narHash": "sha256-gKUrkWZRS2BxEcJDyVSBZJ3fi1rN51PPe8U5hCjFNIY=",
        "owner": "shazow",
        "repo": "foundry.nix",
-        "rev": "0eb3d1233237eb4e6f4f45f31c087ee1a16245f1",
+        "rev": "a194d90ec9f6a4d70d79220e644c531da8324266",
        "type": "github"
      },
      "original": {
@@ -334,11 +348,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1785232496,
-        "narHash": "sha256-65EQYIRRpTdpH8lUiB6Mvo5uBkG60aBIzAJuALfx+O0=",
+        "lastModified": 1787144466,
+        "narHash": "sha256-HHfv2/HkNSKbbSyU9iD/g8lbP6r4tl33sSw1W4rXCk0=",
        "owner": "NixOS",
        "repo": "nixos-hardware",
-        "rev": "2e790b0a6be8ec2b76174ac0931b8ff11919ec98",
+        "rev": "0471accf8d0a8210b31d947497d179ecc99e0021",
        "type": "github"
      },
      "original": {
@@ -355,11 +369,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1785306346,
-        "narHash": "sha256-DScBkW0fOgpGPK2trNoX3ryLTlaC14+gglFo/BhGJ4g=",
+        "lastModified": 1787176219,
+        "narHash": "sha256-djoRr6jBpe35q/0JwAvXpFXg1Ktf+X54NU2RLR7wnHw=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "e705714e918c3b11affcdd15db2cbe3a070420a0",
+        "rev": "c53d643b3737e2fcd04e6cb3b3580ef50b2087a0",
        "type": "github"
      },
      "original": {
@@ -376,11 +390,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1783963347,
-        "narHash": "sha256-r376E2XpakiXwModDHIxlvB6qLq4iFVEq730vxOO4JY=",
+        "lastModified": 1786719456,
+        "narHash": "sha256-B74DLQs/VjlqyhnnX3tguWwghqJHWSJX30TKZuAljIg=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "a45a7c451455a51ae740ec3bce4024b312809c29",
+        "rev": "83b7606dcf44abe3a94b86e8bb2b3355d22e8797",
        "type": "github"
      },
      "original": {
@@ -405,11 +419,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1776511930,
-        "narHash": "sha256-fCpwFiTW0rT7oKJqr3cqHMnkwypSwQKpbtUEtxdkgrM=",
+        "lastModified": 1786464181,
+        "narHash": "sha256-2alOMkLjXANh7unkZnYnCF2K2rApZaOLMoQ3o+VX2CY=",
        "owner": "hyprwm",
        "repo": "hyprcursor",
-        "rev": "39435900785d0c560c6ae8777d29f28617d031ef",
+        "rev": "e4ed7c08123df5af460a0a70961380cbfb872f76",
        "type": "github"
      },
      "original": {
@@ -434,11 +448,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1782566056,
-        "narHash": "sha256-haEZcHzYrePnjFOYSWTbxm/Nrla0aPslJfmvdCvqtVc=",
+        "lastModified": 1786464367,
+        "narHash": "sha256-k58p4wbzIXWyRWrW84pP8tD+iaZSSYiiM+fr0Auk4oU=",
        "owner": "hyprwm",
        "repo": "hyprgraphics",
-        "rev": "c6e7b9f673f4360bc813d3dc75028f75ee88d3f8",
+        "rev": "7c895c44e3ca6d28ed68ddd80ec02b02b925e7fc",
        "type": "github"
      },
      "original": {
@@ -464,11 +478,11 @@
        "xdph": "xdph"
      },
      "locked": {
-        "lastModified": 1785334807,
-        "narHash": "sha256-bN0KRhDfwSPqbpgUgWVcQMkuDje+8ghWlm7uUQZzaxc=",
+        "lastModified": 1787138659,
+        "narHash": "sha256-/3fIl+/xZoZqliAfwYB8ahCZK04Qr/zwdOQgiR41dy8=",
        "ref": "refs/heads/main",
-        "rev": "7803e68638c1bebce57cf9ea8da51fd9a1e19edd",
-        "revCount": 7669,
+        "rev": "52b368f1d7fdee1b0e96ef3dc655b5a577df4fdb",
+        "revCount": 7745,
        "submodules": true,
        "type": "git",
        "url": "https://github.com/hyprwm/Hyprland"
@@ -512,11 +526,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1784196523,
-        "narHash": "sha256-ahtKMGXFJdlQNhatQm1+BBU/pGfGYnAqQt3vWvq4p8s=",
+        "lastModified": 1786464504,
+        "narHash": "sha256-7sHwM86KILQyHDHDuE2SDBlQ2jvZ0EW3hY7sW009/cg=",
        "owner": "hyprwm",
        "repo": "hyprland-guiutils",
-        "rev": "a6ccb6cb112ed5a244c0191fb972347ecfa893e0",
+        "rev": "4c30cf3097ea963c0e250749ee0c59f8b08816d6",
        "type": "github"
      },
      "original": {
@@ -566,11 +580,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1777320127,
-        "narHash": "sha256-Qu+Wf2Bp5qUjyn2YpZNq8a7JyzTGowhT1knrwE38a9U=",
+        "lastModified": 1786464129,
+        "narHash": "sha256-339AkTlpMYSIvFuG0rnR+8Yg4/AZKeJalshJavlnKfg=",
        "owner": "hyprwm",
        "repo": "hyprlang",
-        "rev": "090117506ddc3d7f26e650ff344d378c2ec329cc",
+        "rev": "9508458be316a0d70d37ebed1ab725ccd10411ff",
        "type": "github"
      },
      "original": {
@@ -640,11 +654,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1782554491,
-        "narHash": "sha256-+p3MlyN/nqRefcf2IckPlGRUn9+hielqpS9XClbLleM=",
+        "lastModified": 1785930473,
+        "narHash": "sha256-DitTu625BhEYpZjtjxtGpjrEJwPwW+X/+jJvhSZNSJM=",
        "owner": "hyprwm",
        "repo": "hyprtoolkit",
-        "rev": "bdba25ced39ea39ab004a8f31593ba0b0ff1ca35",
+        "rev": "af515b69dfbe366dc7873aa1475cb2f4db3ebad7",
        "type": "github"
      },
      "original": {
@@ -665,11 +679,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1784323413,
-        "narHash": "sha256-XnAVV+H4f8Xdv0yZcSwJ5kCjLyE8fHxPeLX6a3HSrAU=",
+        "lastModified": 1786464080,
+        "narHash": "sha256-W1hxvumEM57yV+QwsZ4QdAHEqOkr7e4S8VAkLX60qDE=",
        "owner": "hyprwm",
        "repo": "hyprutils",
-        "rev": "5f03477ab3a005ff27c527486f551883535aea2f",
+        "rev": "c157fe1e3092b980cc69315a6631f89aff09dcce",
        "type": "github"
      },
      "original": {
@@ -690,11 +704,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1777159683,
-        "narHash": "sha256-Jxixw6wZphUp+nHYxOKUYSckL17QMBx2d5Zp0rJHr1g=",
+        "lastModified": 1786464033,
+        "narHash": "sha256-QM8Qe4/L8lpdVN4bgwahmi+jyyc4fisseDMe4afcDxA=",
        "owner": "hyprwm",
        "repo": "hyprwayland-scanner",
-        "rev": "b8632713a6beaf28b56f2a7b0ab2fb7088dbb404",
+        "rev": "62e62c1ca23da17612c6890d4ad2064f575643db",
        "type": "github"
      },
      "original": {
@@ -719,11 +733,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1778410714,
-        "narHash": "sha256-o6RzFj4nJXaPRY7EM01siuCQeT41RfwwmcmFQqwFJJg=",
+        "lastModified": 1786464294,
+        "narHash": "sha256-ZQsZ2WvBdkboCIyh8LStDPdAIARmxzn0XMNxxoOhjPE=",
        "owner": "hyprwm",
        "repo": "hyprwire",
-        "rev": "85148a8e612808cf5ddb25d0b3c5840f3498a7dc",
+        "rev": "4ce7cd6b6128c1ac41caf23c58a30a26b327f9dd",
        "type": "github"
      },
      "original": {
@@ -732,6 +746,43 @@
        "type": "github"
      }
    },
+    "maestro": {
+      "inputs": {
+        "crane": "crane_2",
+        "flake-parts": "flake-parts_2",
+        "nixpkgs": "nixpkgs_6",
+        "process-compose-flake": "process-compose-flake"
+      },
+      "locked": {
+        "lastModified": 1788472721,
+        "narHash": "sha256-meDGgW8/Wf8vh1Yt/PqsAq3tkQ1s5fKn/29tvBkc2UU=",
+        "ref": "refs/heads/main",
+        "rev": "8325bc6d9a9a6c74995737af121114c365b17b44",
+        "revCount": 617,
+        "type": "git",
+        "url": "https://git.naps.pt/naps62/maestro.git"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://git.naps.pt/naps62/maestro.git"
+      }
+    },
+    "nix-flatpak": {
+      "locked": {
+        "lastModified": 1767983141,
+        "narHash": "sha256-7ZCulYUD9RmJIDULTRkGLSW1faMpDlPKcbWJLYHoXcs=",
+        "owner": "gmodena",
+        "repo": "nix-flatpak",
+        "rev": "440818969ac2cbd77bfe025e884d0aa528991374",
+        "type": "github"
+      },
+      "original": {
+        "owner": "gmodena",
+        "ref": "latest",
+        "repo": "nix-flatpak",
+        "type": "github"
+      }
+    },
    "nix-index-database": {
      "inputs": {
        "nixpkgs": [
@@ -739,11 +790,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1785046085,
-        "narHash": "sha256-UiK+mmZJuLWQVhJ5b2wDzogIYWAesyRm6LA3h3Ulh3Y=",
+        "lastModified": 1786852476,
+        "narHash": "sha256-IM5CYtf86W4w8eUPpKcY/LpdHElmVBtJhaKnoTKxZEA=",
        "owner": "nix-community",
        "repo": "nix-index-database",
-        "rev": "11665045df8b9938ef811a3bfdc65cffb02b4b70",
+        "rev": "c7962dc97b45129df8d751bedaf37beb5a17706e",
        "type": "github"
      },
      "original": {
@@ -784,6 +835,21 @@
      }
    },
    "nixpkgs-lib_2": {
+      "locked": {
+        "lastModified": 1785031560,
+        "narHash": "sha256-OmshNvn2vupOFpYinLUu+1Dnpu4n7Q5N3ggGVNHpkUI=",
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "rev": "0e79af5e3d4dcfcd676ab5ba3f95d2e3352e078c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "type": "github"
+      }
+    },
+    "nixpkgs-lib_3": {
      "locked": {
        "lastModified": 1774748309,
        "narHash": "sha256-+U7gF3qxzwD5TZuANzZPeJTZRHS29OFQgkQ2kiTJBIQ=",
@@ -800,11 +866,11 @@
    },
    "nixpkgs_2": {
      "locked": {
-        "lastModified": 1784783405,
-        "narHash": "sha256-4IHyyLgLBdKefkljdKod4IMn023pQiDXAWJA187cmdY=",
+        "lastModified": 1787964612,
+        "narHash": "sha256-0N9nghg3nwzX6b6qc77EzjR9cu/Z+UR66FlfsCqiURs=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "7525d999cd850b9a488817abc89c75dc733acf17",
+        "rev": "e8be7818e19ada32105a8af937a6a473b38167ca",
        "type": "github"
      },
      "original": {
@@ -848,11 +914,11 @@
    },
    "nixpkgs_5": {
      "locked": {
-        "lastModified": 1784356753,
-        "narHash": "sha256-12KrbMiWLcf8m7pCvAtZh1ZrgF85ZXDXvfR/fWTKy84=",
+        "lastModified": 1786247143,
+        "narHash": "sha256-8S3Kcxs7D4UtxJxSJZz0m14CGhuW0MxfrIwJxeGWGnQ=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "61b7c44c4073f0b827768aff0049561b5110ea5a",
+        "rev": "279b4a8275f032c566576b3f181fa0f27197f588",
        "type": "github"
      },
      "original": {
@@ -864,11 +930,27 @@
    },
    "nixpkgs_6": {
      "locked": {
-        "lastModified": 1785090369,
-        "narHash": "sha256-m0pDuRJG7EDo9ri+4Ksu83VsI+PlxNC9lNBfydejce4=",
+        "lastModified": 1787135253,
+        "narHash": "sha256-RD2kNWCG+Bjo6h+JVjWVNntZs2GtRoeY2xHjts/FNkA=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "ffb3c9b700e759be2ef13237c9d8f953b32a1e46",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_7": {
+      "locked": {
+        "lastModified": 1787070829,
+        "narHash": "sha256-vXNVDVtvfiQuXthP0NHPFdNvvMTkGpx0UP8oddIWbNk=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "624af665418d3c65d544145b4d34ad696439570e",
+        "rev": "0ae2bc1419c3f345984c2629e72e7a631820fa4d",
        "type": "github"
      },
      "original": {
@@ -878,7 +960,7 @@
        "type": "github"
      }
    },
-    "nixpkgs_7": {
+    "nixpkgs_8": {
      "locked": {
        "lastModified": 1775036866,
        "narHash": "sha256-ZojAnPuCdy657PbTq5V0Y+AHKhZAIwSIT2cb8UgAz/U=",
@@ -894,7 +976,7 @@
        "type": "github"
      }
    },
-    "nixpkgs_8": {
+    "nixpkgs_9": {
      "locked": {
        "lastModified": 1744536153,
        "narHash": "sha256-awS2zRgF4uTwrOKwwiJcByDzDOdo3Q1rPZbiHQg/N38=",
@@ -910,26 +992,6 @@
        "type": "github"
      }
    },
-    "noctalia": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1785335804,
-        "narHash": "sha256-oN3I6Kr71lOCE3/ou4GgY2cQYh4B6xQxZXzomFgYn0s=",
-        "owner": "noctalia-dev",
-        "repo": "noctalia-shell",
-        "rev": "aded31799eb0dffdbcf436243083f1ebce26f95d",
-        "type": "github"
-      },
-      "original": {
-        "owner": "noctalia-dev",
-        "repo": "noctalia-shell",
-        "type": "github"
-      }
-    },
    "nvchad-starter": {
      "flake": false,
      "locked": {
@@ -956,11 +1018,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1785121894,
-        "narHash": "sha256-AWbstkwe4twd+5iWx8QBVzTgwGAUvn4vVdobGKW5BRc=",
+        "lastModified": 1786797655,
+        "narHash": "sha256-qAWI5Vf0xaRmb8/l9XWYrvEgrIaqKBv8Dg81JO7wkrY=",
        "owner": "nix-community",
        "repo": "nix4nvchad",
-        "rev": "8135d402aa554b5f8e5dd2ec341c5a440fd18496",
+        "rev": "b878640ae13c8f70f41aa1159234206051a4378c",
        "type": "github"
      },
      "original": {
@@ -991,6 +1053,41 @@
        "type": "github"
      }
    },
+    "process-compose-flake": {
+      "locked": {
+        "lastModified": 1782060835,
+        "narHash": "sha256-Q8HH2t1l3MITtWCWY4ytcH5F/Q7aAHo3Iq/QTMAKTe0=",
+        "owner": "Platonic-Systems",
+        "repo": "process-compose-flake",
+        "rev": "464ff6880737f063c3f0d3d2c7781fda9190868f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Platonic-Systems",
+        "repo": "process-compose-flake",
+        "type": "github"
+      }
+    },
+    "rev": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1788356169,
+        "narHash": "sha256-NpIwwZ3O+rahCrWkYJvZEcSM0FeoO0av7bR7MDgZNZ0=",
+        "ref": "refs/heads/main",
+        "rev": "b432e8a9ed4e8c819df1aaf547161b71967395d3",
+        "revCount": 235,
+        "type": "git",
+        "url": "https://git.naps.pt/yolo/rev.git"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://git.naps.pt/yolo/rev.git"
+      }
+    },
    "root": {
      "inputs": {
        "agent-of-empires": "agent-of-empires",
@@ -1003,11 +1100,13 @@
        "hardware": "hardware",
        "home-manager": "home-manager",
        "hyprland": "hyprland",
+        "maestro": "maestro",
+        "nix-flatpak": "nix-flatpak",
        "nix-index-database": "nix-index-database",
-        "nixpkgs": "nixpkgs_6",
-        "noctalia": "noctalia",
+        "nixpkgs": "nixpkgs_7",
        "nvchad-starter": "nvchad-starter",
        "nvchad4nix": "nvchad4nix",
+        "rev": "rev",
        "rose-pine-hyprcursor": "rose-pine-hyprcursor",
        "sem": "sem",
        "spicetify-nix": "spicetify-nix",
@@ -1057,7 +1156,7 @@
    },
    "rust-overlay": {
      "inputs": {
-        "nixpkgs": "nixpkgs_8"
+        "nixpkgs": "nixpkgs_9"
      },
      "locked": {
        "lastModified": 1775445266,
@@ -1075,9 +1174,9 @@
    },
    "sem": {
      "inputs": {
-        "flake-parts": "flake-parts_2",
-        "flake-utils": "flake-utils_5",
-        "nixpkgs": "nixpkgs_7",
+        "flake-parts": "flake-parts_3",
+        "flake-utils": "flake-utils_4",
+        "nixpkgs": "nixpkgs_8",
        "rust-overlay": "rust-overlay"
      },
      "locked": {
@@ -1102,11 +1201,11 @@
        "systems": "systems_9"
      },
      "locked": {
-        "lastModified": 1785048222,
-        "narHash": "sha256-LjFVfwxensz76SjnvofF1Jsw+xTLd8Qp31W0J6nh2XI=",
+        "lastModified": 1786855359,
+        "narHash": "sha256-yeKMWFCPeoIKmPBLLvP1/15ulOJO8i9ZIlSSXGuW6aw=",
        "owner": "Gerg-L",
        "repo": "spicetify-nix",
-        "rev": "17e524f330c282d31c32dfe076222d4a12277886",
+        "rev": "0f478ff79b82abb785160cd4531293f61d21be86",
        "type": "github"
      },
      "original": {
@@ -1329,11 +1428,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1784371182,
-        "narHash": "sha256-S8A1lezEalltWcCp3gAic5lssS0xTSISK6fKODefhOk=",
+        "lastModified": 1786464334,
+        "narHash": "sha256-/TBQT5rhBB2Dm4HoZzhGDaCwYmRTs3W3DPhMXFWc/BU=",
        "owner": "hyprwm",
        "repo": "xdg-desktop-portal-hyprland",
-        "rev": "08d99f727944dd15e4740090305e31c5fb92a50a",
+        "rev": "9f0e9ff02739cd538d39bd706422dc50e9ca60dd",
        "type": "github"
      },
      "original": {
@@ -1350,11 +1449,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1785224333,
-        "narHash": "sha256-8DNJUVM10ktK02V9ZIV064CH+fuPF272VCAZBn6arig=",
+        "lastModified": 1787160391,
+        "narHash": "sha256-5dRTU55IlWABqnWiXDgtzrc3wT54nPoZwDQ91VOY4mE=",
        "owner": "0xc000022070",
        "repo": "zen-browser-flake",
-        "rev": "5f1a4be4d280e1ae06d61a75775a234b1714da3f",
+        "rev": "228a12a50971a115caa1c87b7de3d87b08e35275",
        "type": "github"
      },
      "original": {
@@ -49,10 +49,6 @@
      url = "https://github.com/hyprwm/Hyprland";
      submodules = true;
    };
-    noctalia = {
-      url = "github:noctalia-dev/noctalia-shell";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
    spicetify-nix = {
      url = "github:Gerg-L/spicetify-nix";
      inputs.nixpkgs.follows = "nixpkgs";
@@ -68,12 +64,25 @@
    };
    # Pinned to the tag, and pins its own nixpkgs for the same reason ethui does
    # — it is a verified Rust build. Bump deliberately, not via `flake update`.
-    agent-of-empires.url = "github:agent-of-empires/agent-of-empires/v1.14.1";
+    agent-of-empires.url = "git+https://git.naps.pt/yolo/agent-of-empires.git";
    # Semantic-diff tool rev calls via REV_SEM_BIN. NOT nixpkgs' `sem`, which is
    # the unrelated Semaphore CI cli.
    sem.url = "github:Ataraxy-Labs/sem";
    # Claude Code + Codex skills, commands, hooks and CLAUDE.md fragments.
    agent-skills.url = "git+https://git.naps.pt/yolo/agent-skills.git";
+    # Terminal-session orchestrator. Pins its own nixpkgs for the same reason
+    # ethui and agent-of-empires do — it is a verified Rust build.
+    maestro.url = "git+https://git.naps.pt/naps62/maestro.git";
+    # Always-on local code review server. Follows nixpkgs, unlike the Rust
+    # inputs above: it is a plain node bundle, and a second nixpkgs would put a
+    # second node 26 in the closure for nothing.
+    rev = {
+      url = "git+https://git.naps.pt/yolo/rev.git";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    # Declarative flatpak remotes and packages; nixpkgs' services.flatpak only
+    # exposes `enable`. Has no nixpkgs input to follow.
+    nix-flatpak.url = "github:gmodena/nix-flatpak/?ref=latest";
    nix-index-database = {
      url = "github:nix-community/nix-index-database";
      inputs.nixpkgs.follows = "nixpkgs";
@@ -5,6 +5,10 @@
  imports = [
    ../common/programs/default.nix
    ../common/programs/desktop
+    ../common/programs/workstation-apps.nix
+    ../common/programs/editors.nix
+    ../common/programs/dev-workstation.nix
+    ../common/programs/ai-gui.nix
    ../common/programs/zen-browser.nix
    ../common/programs/hyprland
    ../common/programs/kitty
@@ -1,90 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  self,
-  ...
-}:
-let
-  cfg = config.home.mutableFiles;
-  repoPath = config.home.mutableFilesRepoPath;
-  flakePrefix = self.outPath;
-
-  fileEntries = lib.attrsToList cfg;
-
-  toRepoPath = storePath: repoPath + lib.removePrefix flakePrefix (toString storePath);
-
-  checkScript = lib.concatMapStringsSep "\n" (
-    { name, value }:
-    let
-      target = "${config.home.homeDirectory}/${name}";
-      storePath = value.source;
-      originalPath = toRepoPath value.source;
-    in
-    ''
-      if [ -f "${target}" ] && ! ${lib.getExe' pkgs.diffutils "diff"} -q "${storePath}" "${target}" > /dev/null 2>&1; then
-        echo ""
-        echo "!! mutable file changed: ${name}"
-        echo "   To bring changes upstream:"
-        echo "   cp ${target} ${originalPath}"
-        echo ""
-        ${lib.getExe' pkgs.diffutils "diff"} -u "${storePath}" "${target}" || true
-        _mutable_changed=1
-      fi
-    ''
-  ) fileEntries;
-
-  copyScript = lib.concatMapStringsSep "\n" (
-    { name, value }:
-    let
-      target = "${config.home.homeDirectory}/${name}";
-      inherit (value) source;
-      dirName = builtins.dirOf target;
-    in
-    ''
-      mkdir -p "${dirName}"
-      cp -f "${source}" "${target}"
-      chmod ${if value.executable then "755" else "644"} "${target}"
-    ''
-  ) fileEntries;
-in
-{
-  options.home.mutableFilesRepoPath = lib.mkOption {
-    type = lib.types.str;
-    description = "Absolute path to the nixos-config repo on disk.";
-  };
-
-  options.home.mutableFiles = lib.mkOption {
-    type = lib.types.attrsOf (
-      lib.types.submodule {
-        options = {
-          source = lib.mkOption {
-            type = lib.types.path;
-            description = "Path to the source file.";
-          };
-          executable = lib.mkOption {
-            type = lib.types.bool;
-            default = false;
-            description = "Whether the file should be executable.";
-          };
-        };
-      }
-    );
-    default = { };
-    description = "Files to copy (not symlink) into the home directory, with change detection.";
-  };
-
-  config = lib.mkIf (cfg != { }) {
-    home.activation.mutableFiles = lib.hm.dag.entryAfter [ "writeBoundary" ] ''
-      _mutable_changed=0
-      ${checkScript}
-      if [ "$_mutable_changed" -eq 1 ]; then
-        echo ""
-        echo "!! Aborting: mutable files have been modified outside of nix."
-        echo "   Bring the changes upstream first, then re-run."
-        exit 1
-      fi
-      ${copyScript}
-    '';
-  };
-}
@@ -1,20 +1,43 @@
 {
+  config,
+  lib,
  pkgs,
  ...
 }:
+let
+  cfg = config.custom.blender;
+in
 {
-  home.packages = with pkgs; [
-    blender
-    prusa-slicer
-  ];
+  options.custom.blender = {
+    cuda = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = ''
+        Build Blender with CUDA/OptiX so Cycles renders on the GPU instead of
+        the CPU. Only useful on an NVIDIA host; enabling it on arrakis (Intel)
+        would mean a long build for nothing.

-  fonts.fontconfig.enable = true;
+        No binary cache serves this — cuda-maintainers was measured to make no
+        difference — so flipping this on rebuilds Blender, OpenUSD, OpenSubdiv
+        and OpenImageDenoise from source.
+      '';
+    };
+  };

-  xdg.desktopEntries.prusaslicer-url-handler = {
-    name = "PrusaSlicer Protocol Handler";
-    exec = "prusa-slicer %u";
-    type = "Application";
-    noDisplay = true;
-    mimeType = [ "x-scheme-handler/prusaslicer" ];
+  config = {
+    home.packages = [
+      (if cfg.cuda then pkgs.blender.override { cudaSupport = true; } else pkgs.blender)
+      pkgs.prusa-slicer
+    ];
+
+    fonts.fontconfig.enable = true;
+
+    xdg.desktopEntries.prusaslicer-url-handler = {
+      name = "PrusaSlicer Protocol Handler";
+      exec = "prusa-slicer %u";
+      type = "Application";
+      noDisplay = true;
+      mimeType = [ "x-scheme-handler/prusaslicer" ];
+    };
  };
 }
@@ -0,0 +1,29 @@
+{
+  config,
+  pkgs,
+  inputs,
+  lib,
+  ...
+}:
+let
+  claude-desktop = pkgs.callPackage ../../../pkgs/claude-desktop/package.nix {
+    inherit (config.custom.aiApps) deviceScaleFactor;
+  };
+  codex-cli = inputs.codex-cli.packages.${pkgs.stdenv.hostPlatform.system}.default;
+  t3-code = pkgs.callPackage ../../../pkgs/t3-code/package.nix {
+    inherit (config.custom.aiApps) deviceScaleFactor;
+  };
+in
+{
+  imports = [ inputs.codex-desktop-linux.homeManagerModules.default ];
+
+  home.packages = lib.optionals pkgs.stdenv.hostPlatform.isx86_64 [
+    claude-desktop
+    t3-code
+  ];
+
+  programs.codexDesktopLinux = {
+    enable = true;
+    cliPackage = codex-cli;
+  };
+}
@@ -1,18 +1,14 @@
 {
-  config,
  pkgs,
  inputs,
  lib,
  ...
 }:
-let
-  # Official Anthropic Claude desktop app (Linux build, x86_64 only).
-  claude-desktop = pkgs.callPackage ../../../../pkgs/claude-desktop/package.nix {
-    inherit (config.custom.aiApps) deviceScaleFactor;
-  };
-in
 {
-  imports = [ inputs.agent-skills.homeModules.default ];
+  imports = [
+    inputs.agent-skills.homeModules.default
+    ./synthetic.nix
+  ];

  # Shared UI-scale knob for the Electron AI desktop apps (Claude Desktop, T3 Code).
  # Set per-host (e.g. konishi's 4K@1x monitors want ~"1.5"); null = native scale.
@@ -23,24 +19,24 @@ in
    description = "--force-device-scale-factor value for Claude Desktop and T3 Code.";
  };

+  # ~/.claude/settings.json stays unmanaged: Claude Code rewrites it itself
+  # (model pins, permission grants, plugin state), so any nix copy drifts within
+  # a session and every `nh home switch` then aborts on the diff.
  config.home = {
-    packages =
-      with pkgs;
-      [
-        inputs.claude-code.packages.${pkgs.stdenv.hostPlatform.system}.default
+    packages = with pkgs; [
+      inputs.claude-code.packages.${pkgs.stdenv.hostPlatform.system}.default

-        # sandbox
-        bubblewrap
-        socat
-        libseccomp
+      # sandbox
+      bubblewrap
+      socat
+      libseccomp

-        # voice
-        sox
+      # voice
+      sox

-        # beads
-        dolt
-      ]
-      ++ lib.optional pkgs.stdenv.hostPlatform.isx86_64 claude-desktop;
+      # beads
+      dolt
+    ];

    file = {
      ".default-npm-packages".text = ''
@@ -48,17 +44,11 @@ in
        @beads/bd
      '';

-
-
-
-
-
      ".claude/statusline.sh" = {
        source = ./statusline.sh;
        executable = true;
      };
    };

-    mutableFiles.".claude/settings.json".source = ./settings.json;
  };
 }
@@ -1,86 +0,0 @@
-{
-  "$schema": "https://json.schemastore.org/claude-code-settings.json",
-  "permissions": {
-    "allow": [
-      "Edit",
-      "Write",
-      "Bash(ls:*)",
-      "Bash(tree:*)",
-      "Bash(cat:*)",
-      "Bash(head:*)",
-      "Bash(tail:*)",
-      "Bash(find:*)",
-      "Bash(fd:*)",
-      "Bash(grep:*)",
-      "Bash(rg:*)",
-      "Bash(wc:*)",
-      "Bash(sort:*)",
-      "Bash(uniq:*)",
-      "Bash(diff:*)",
-      "Bash(pwd:*)",
-      "Bash(which:*)",
-      "Bash(jq:*)",
-      "Bash(git:*)",
-      "Bash(gh:*)",
-      "Bash(sed:*)",
-      "Bash(cp:*)",
-      "Bash(chmod:*)",
-      "Bash(mkdir:*)",
-      "Bash(kitty @ set-tab-title:*)"
-    ],
-    "additionalDirectories": [
-      "/home/naps62/projects",
-      "/home/naps62/ethui",
-      "/home/naps62/labs",
-      "/home/naps62/subvisual"
-    ]
-  },
-  "model": "opus[1m]",
-  "statusLine": {
-    "type": "command",
-    "command": "~/.claude/statusline.sh"
-  },
-  "enabledPlugins": {
-    "typescript-lsp@claude-plugins-official": true
-  },
-  "extraKnownMarketplaces": {
-    "impeccable": {
-      "source": {
-        "source": "github",
-        "repo": "pbakaus/impeccable"
-      }
-    }
-  },
-  "sandbox": {
-    "enabled": true,
-    "autoAllowBashIfSandboxed": false,
-    "allowedNetworkHosts": [
-      "github.com",
-      "api.github.com",
-      "raw.githubusercontent.com",
-      "gist.github.com",
-      "release-assets.githubusercontent.com"
-    ]
-  },
-  "tui": "fullscreen",
-  "voiceEnabled": true,
-  "defaultMode": "acceptEdits",
-  "feedbackSurveyState": {
-    "lastShownTime": 1754052643456
-  },
-  "mcpServers": {
-    "herd-mcp": {
-      "type": "http",
-      "url": "https://mcp.herd.eco/v1"
-    },
-    "linear": {
-      "type": "http",
-      "url": "https://mcp.linear.app/mcp"
-    },
-    "home-assistant": {
-      "type": "http",
-      "url": "https://ha-mcp.n62.casa/mcp"
-    }
-  },
-  "agentPushNotifEnabled": true
-}
@@ -0,0 +1,76 @@
+{
+  pkgs,
+  inputs,
+  ...
+}:
+# Claude Code pointed at synthetic.new. The three model aliases below are bound
+# to three Synthetic models, so `/model opus|sonnet|haiku` swaps between them
+# live; anything else there is reachable by full id (`/model hf:...`).
+let
+  claude = inputs.claude-code.packages.${pkgs.stdenv.hostPlatform.system}.default;
+
+  # `hf:` ids pin one exact model. The `syn:large:*` aliases in Synthetic's own
+  # docs move under you whenever they rotate what "large" means.
+  kimi = "hf:moonshotai/Kimi-K3";
+  glm = "hf:zai-org/GLM-5.2";
+
+  # Not Qwen3.6-27B for the haiku slot: its chat template rejects Claude Code's
+  # multi-block system prompt with "System message must be at the beginning."
+  glmFlash = "hf:zai-org/GLM-4.7-Flash";
+in
+{
+  home.packages = [
+    (pkgs.writeShellScriptBin "synclaude" ''
+      set -euo pipefail
+
+      if [ -z "''${SYNTHETIC_API_KEY:-}" ] && [ -r "$HOME/.env.claude" ]; then
+        set +u
+        # Silenced: the file greets missing tooling on stderr, which would
+        # otherwise print before every session.
+        . "$HOME/.env.claude" >/dev/null 2>&1
+        set -u
+      fi
+
+      if [ -z "''${SYNTHETIC_API_KEY:-}" ]; then
+        echo "synclaude: SYNTHETIC_API_KEY is not set" >&2
+        exit 1
+      fi
+
+      export ANTHROPIC_BASE_URL="https://api.synthetic.new/anthropic"
+      export ANTHROPIC_AUTH_TOKEN="$SYNTHETIC_API_KEY"
+      export ANTHROPIC_DEFAULT_OPUS_MODEL="${kimi}"
+      export ANTHROPIC_DEFAULT_SONNET_MODEL="${glm}"
+      export ANTHROPIC_DEFAULT_HAIKU_MODEL="${glmFlash}"
+      export CLAUDE_CODE_SUBAGENT_MODEL="${glm}"
+      export CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1
+      export CLAUDE_CODE_ATTRIBUTION_HEADER=0
+
+      # ~/.env.claude exports both. ANTHROPIC_MODEL outranks the DEFAULT_* trio
+      # above, and ANTHROPIC_API_KEY would send Anthropic's credential to
+      # Synthetic.
+      unset ANTHROPIC_MODEL ANTHROPIC_API_KEY
+
+      # These two dokploy tools spell ttl's bound `"exclusiveMinimum": true`,
+      # which is draft-04. Synthetic validates against draft-2020, where the key
+      # must be a number, and rejects the whole request — a bare 500 with no body
+      # when streaming. Every session fails, not just ones that call these.
+      broken_tools=(
+        mcp__dokploy__dnsProvider-createRecord
+        mcp__dokploy__dnsProvider-updateRecord
+      )
+
+      # ~/.claude/settings.json pins model "opus[1m]". The [1m] context-window
+      # suffix survives alias resolution and reaches Synthetic as part of the id,
+      # which 404s there — so pick the alias explicitly unless the caller did.
+      for arg in "$@"; do
+        case "$arg" in
+        --model | --model=*)
+          exec ${claude}/bin/claude --disallowedTools "''${broken_tools[@]}" "$@"
+          ;;
+        esac
+      done
+
+      exec ${claude}/bin/claude --model sonnet --disallowedTools "''${broken_tools[@]}" "$@"
+    '')
+  ];
+}
@@ -7,14 +7,5 @@ let
  codex-cli = inputs.codex-cli.packages.${pkgs.stdenv.hostPlatform.system}.default;
 in
 {
-  imports = [ inputs.codex-desktop-linux.homeManagerModules.default ];
-
-  # cliPackage only tells the desktop app where to find codex; it does not put
-  # it on PATH, so the cli needs installing separately.
  home.packages = [ codex-cli ];
-
-  programs.codexDesktopLinux = {
-    enable = true;
-    cliPackage = codex-cli;
-  };
 }
@@ -1,16 +1,13 @@
 {
  lib,
-  pkgs,
  config,
  ...
 }:
 {
  imports = [
-    ../features/mutable-file.nix
    ./zsh.nix
    ./nix.nix
    ./neovim
-    ./editors.nix
    ./rust.nix
    ./elixir.nix
    ./nodejs.nix
@@ -30,12 +27,6 @@
  };

  home = {
-    mutableFilesRepoPath = "${config.home.homeDirectory}/projects/nixos-config";
-
-    packages = with pkgs; [
-      impala
-    ];
-
    username = lib.mkDefault "naps62";
    homeDirectory = lib.mkDefault "/home/${config.home.username}";
    stateVersion = lib.mkDefault "24.05";
@@ -1,4 +1,7 @@
-{ pkgs, ... }:
+{ pkgs, config, ... }:
+let
+  inherit (config.custom.hyprland) cursorTheme cursorSize;
+in
 {
  home.packages = with pkgs; [
    dconf
@@ -15,17 +18,14 @@
      '';
      cursor-theme = ''
        ${pkgs.dconf}/bin/dconf write \
-        /org/gnome/desktop/interface/cursor-theme "'Nordzy-cursors'"
+        /org/gnome/desktop/interface/cursor-theme "'${cursorTheme.dark}'"

        # Set environment variables for current session
-        export HYPRCURSOR_THEME="Nordzy-cursors"
-        export XCURSOR_THEME="Nordzy-cursors"
+        export HYPRCURSOR_THEME="${cursorTheme.dark}"
+        export XCURSOR_THEME="${cursorTheme.dark}"

        # Update Hyprland cursor theme
-        ${pkgs.hyprland}/bin/hyprctl setcursor Nordzy-cursors 24
-      '';
-      noctalia-theme = ''
-        noctalia msg theme-mode-set dark
+        ${pkgs.hyprland}/bin/hyprctl setcursor ${cursorTheme.dark} ${toString cursorSize}
      '';
    };
    lightModeScripts = {
@@ -37,17 +37,14 @@
      '';
      cursor-theme = ''
        ${pkgs.dconf}/bin/dconf write \
-        /org/gnome/desktop/interface/cursor-theme "'Nordzy-white'"
+        /org/gnome/desktop/interface/cursor-theme "'${cursorTheme.light}'"

        # Set environment variables for current session
-        export HYPRCURSOR_THEME="Nordzy-white"
-        export XCURSOR_THEME="Nordzy-white"
+        export HYPRCURSOR_THEME="${cursorTheme.light}"
+        export XCURSOR_THEME="${cursorTheme.light}"

        # Update Hyprland cursor theme
-        ${pkgs.hyprland}/bin/hyprctl setcursor Nordzy-white 24
-      '';
-      noctalia-theme = ''
-        noctalia msg theme-mode-set light
+        ${pkgs.hyprland}/bin/hyprctl setcursor ${cursorTheme.light} ${toString cursorSize}
      '';
    };
  };
@@ -1,13 +1,13 @@
 {
  config,
-  lib,
  pkgs,
  ...
 }:
 {
  imports = [
    ./darkman.nix
-    ./spicetify.nix
+    # mpv is installed by programs.mpv there, not as a bare package here.
+    ../mpv.nix
  ];

  home = {
@@ -15,43 +15,21 @@
      # various
      google-chrome
      thunar
-      obsidian
-      mpv
-      # screen recording — evaluating these
-      obs-studio
-      kooha # simple Wayland-native screen+audio recorder
-      vokoscreen-ng # GUI recorder with webcam overlay
-      gimp
-      font-manager
      imv
      pavucontrol
      zathura
      libsForQt5.qt5ct
      kdePackages.qt6ct
      nwg-look
-      xournalpp
      jq
      ffmpeg
      unzip

-      # remote desktop
-      remmina
-
      # networking
      networkmanagerapplet
      mtr
      dnsutils

-      # communication
-      slack
-      ferdium
-      signal-desktop
-      zoom-us
-
-      # dev tools
-      yaak
-      bun
-
      # themes
      tela-icon-theme
    ];
@@ -83,36 +61,36 @@
  };

  xdg.configFile = {
-    # zathura: include noctalia-generated theme
    "zathura/zathurarc".text = ''
-      include noctaliarc
+      set default-bg "#2e3440"
+      set default-fg "#eceff4"
+      set statusbar-bg "#3b4252"
+      set statusbar-fg "#eceff4"
+      set inputbar-bg "#3b4252"
+      set inputbar-fg "#eceff4"
+      set highlight-color "#ebcb8b"
+      set highlight-active-color "#88c0d0"
+      set recolor-lightcolor "#2e3440"
+      set recolor-darkcolor "#eceff4"
    '';

-    # gtk: include noctalia-generated css (mkForce to override gtk module)
-    "gtk-3.0/gtk.css".text = lib.mkForce ''
-      @import url("noctalia.css");
-    '';
-    "gtk-4.0/gtk.css".text = lib.mkForce ''
-      @import url("noctalia.css");
-    '';
-
-    # qt: use noctalia color scheme. Applied via QT_QPA_PLATFORMTHEME=qt6ct,
-    # set in the Hyprland env block (and imported into the dbus activation
-    # environment so the xdph screen-share picker inherits it too).
-    # custom_palette=true is required for qt5ct/qt6ct to actually apply the
-    # color scheme; Fusion is used because it fully honors a custom palette
-    # (Breeze/native styles partly ignore it).
+    # qt: dark color scheme shipped by qt5ct/qt6ct themselves. Applied via
+    # QT_QPA_PLATFORMTHEME=qt6ct, set in the Hyprland env block (and imported
+    # into the dbus activation environment so the xdph screen-share picker
+    # inherits it too). custom_palette=true is required for qt5ct/qt6ct to
+    # actually apply the color scheme; Fusion is used because it fully honors a
+    # custom palette (Breeze/native styles partly ignore it).
    "qt5ct/qt5ct.conf".text = ''
      [Appearance]
      style=Fusion
      custom_palette=true
-      color_scheme_path=${config.home.homeDirectory}/.config/qt5ct/colors/noctalia.conf
+      color_scheme_path=${pkgs.libsForQt5.qt5ct}/share/qt5ct/colors/darker.conf
    '';
    "qt6ct/qt6ct.conf".text = ''
      [Appearance]
      style=Fusion
      custom_palette=true
-      color_scheme_path=${config.home.homeDirectory}/.config/qt6ct/colors/noctalia.conf
+      color_scheme_path=${pkgs.kdePackages.qt6ct}/share/qt6ct/colors/darker.conf
    '';
  };
 }
@@ -0,0 +1,12 @@
+{ pkgs, ... }:
+{
+  home.packages = with pkgs; [
+    doctl
+    awscli2
+    terraform
+    bruno
+    coturn
+    usbutils
+    ktlint
+  ];
+}
@@ -5,8 +5,8 @@
 {
  imports = [
    ./codex.nix
+    ./pi.nix
    ./ralph-claude-code.nix
-    ./t3-code.nix
  ];

  programs = {
@@ -25,19 +25,12 @@

  home.packages = with pkgs; [
    imagemagick
-    doctl
-    awscli2
-    terraform
    inotify-tools
    devenv
-    bruno
    sshfs
-    coturn
    file
-    usbutils
    nmap
    lsof
-    ktlint
    croc
    opencode
    process-compose
@@ -19,6 +19,9 @@ tmp/**/*
 *.log
 *.tmp

+# Local git worktree checkouts
+worktrees/
+
 # Latex
 _inputs.tex
 _sections.tex
@@ -1,17 +1,19 @@
 { pkgs, config, ... }:
 let
+  cfg = config.custom.hyprland;
  nordzy-cursors = pkgs.callPackage ../../../../pkgs/nordzy-cursors/package.nix { };
-  cursorSize = config.custom.hyprland.cursorSize;
+  cursorPackage = if cfg.cursorPackage != null then cfg.cursorPackage else nordzy-cursors;
+  cursorSize = cfg.cursorSize;
 in
 {
  home.packages = [
-    nordzy-cursors
+    cursorPackage
  ];

  home.sessionVariables = {
-    HYPRCURSOR_THEME = "Nordzy-cursors";  # Dark variant (default)
+    HYPRCURSOR_THEME = cfg.cursorTheme.dark;
    HYPRCURSOR_SIZE = cursorSize;
-    XCURSOR_THEME = "Nordzy-cursors";
+    XCURSOR_THEME = cfg.cursorTheme.dark;
    XCURSOR_SIZE = cursorSize;
  };

@@ -10,6 +10,8 @@ let

  hyprPkgs = inputs.hyprland.packages.${pkgs.stdenv.hostPlatform.system};

+  osd = "${pkgs.swayosd}/bin/swayosd-client";
+
  # xdph runs this instead of hyprland-share-picker (screencopy:custom_picker_binary).
  # The contract is just "print [SELECTION] to stdout"; a leading "r" grants a
  # restore token. Printing it immediately means the dialog never renders.
@@ -70,6 +72,41 @@ in
      default = 24;
      description = "Cursor size for XCURSOR_SIZE and HYPRCURSOR_SIZE";
    };
+    cursorPackage = lib.mkOption {
+      type = lib.types.nullOr lib.types.package;
+      default = null;
+      description = ''
+        Package providing cursorTheme.dark/light under share/icons. null uses
+        the nordzy-cursors package built in ./cursor.nix.
+      '';
+    };
+    cursorTheme = {
+      dark = lib.mkOption {
+        type = lib.types.str;
+        default = "Nordzy-cursors";
+        description = "Cursor theme darkman selects in dark mode.";
+      };
+      light = lib.mkOption {
+        type = lib.types.str;
+        default = "Nordzy-white";
+        description = "Cursor theme darkman selects in light mode.";
+      };
+    };
+    panelScale = lib.mkOption {
+      type = lib.types.float;
+      default = 1.0;
+      example = 1.5;
+      description = "Multiplier for every length in the eww dashboard stylesheet.";
+    };
+    verticalOutputs = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+      example = [ "DP-2" ];
+      description = ''
+        Outputs that get the portrait wallpaper set. Everything else gets the
+        landscape one.
+      '';
+    };
    shareOutput = lib.mkOption {
      type = lib.types.nullOr lib.types.str;
      default = null;
@@ -84,8 +121,9 @@ in

  imports = [
    ./cursor.nix
+    ./eww
    ./kbptr.nix
-    ./noctalia
+    ./shell.nix
    ./wallpapers.nix
  ];

@@ -204,11 +242,11 @@ in
        -- environment
        hl.env("GDK_SCALE", "2.0")
        hl.env("XCURSOR_SIZE", "${toString cfg.cursorSize}")
-        hl.env("HYPRCURSOR_THEME", "rose-pine-hyprcursor")
+        hl.env("HYPRCURSOR_THEME", "${cfg.cursorTheme.dark}")
        hl.env("HYPRCURSOR_SIZE", "${toString cfg.cursorSize}")
        -- Route Qt6 apps (incl. the xdph screen-share picker) through qt6ct so
-        -- the noctalia-generated color scheme actually applies. Without this
-        -- var the qt6ct.conf is never read.
+        -- the dark color scheme actually applies. Without this var the
+        -- qt6ct.conf is never read.
        hl.env("QT_QPA_PLATFORMTHEME", "qt6ct")

        -- autostart
@@ -216,13 +254,17 @@ in
          -- Import the Qt theme var too, so the dbus/systemd-activated
          -- xdg-desktop-portal-hyprland (and its share-picker) inherit it.
          hl.exec_cmd("dbus-update-activation-environment --systemd WAYLAND_DISPLAY XDG_CURRENT_DESKTOP QT_QPA_PLATFORMTHEME")
-          hl.exec_cmd("hyprctl setcursor Nordzy-cursors ${toString cfg.cursorSize}")
+          hl.exec_cmd("hyprctl setcursor ${cfg.cursorTheme.dark} ${toString cfg.cursorSize}")
          hl.exec_cmd("hyprsunset")
-          hl.exec_cmd("noctalia")
+          -- eww, wpaperd, mako and the polkit agent are systemd user services
+          -- bound to graphical-session.target; nothing to start here.
+          -- kdeconnectd is only DBus-activated; nothing starts it at login,
+          -- so clipboard sync stays dead until the indicator runs.
+          hl.exec_cmd("kdeconnect-indicator")
        end)

        -- layer rules
-        hl.layer_rule({ match = { namespace = "noctalia-wallpaper" }, blur = true, ignore_alpha = 0.5 })
+        hl.layer_rule({ match = { namespace = "eww-panel" }, blur = true, ignore_alpha = 0.5 })

        -- workspace rules
        hl.workspace_rule({ workspace = "w[t1]", gaps_out = 0, gaps_in = 0 })   -- no gaps when only window
@@ -250,7 +292,11 @@ in
        })

        hl.window_rule({ match = { class = "thunar" }, float = true, size = "1800 1200", move = "(cursor_x-(window_w*0.5)) (cursor_y-(window_h*0.5))" })
-        hl.window_rule({ match = { class = [[\.blueman-manager-wrapped]] }, float = true, size = "1200 800", move = "(cursor_x-(window_w*0.5)) (cursor_y-(window_h*0.5))" })
+        -- nixpkgs wraps blueman with --inherit-argv0, so the class is
+        -- blueman-manager, not the .blueman-manager-wrapped the old rule expected.
+        hl.window_rule({ match = { class = [[.*[Bb]lueman.*]] }, float = true, size = "1200 800", move = "(cursor_x-(window_w*0.5)) (cursor_y-(window_h*0.5))" })
+        hl.window_rule({ match = { class = "nm-connection-editor" }, float = true, size = "1200 800", move = "(cursor_x-(window_w*0.5)) (cursor_y-(window_h*0.5))" })
+        hl.window_rule({ match = { class = "waypaper" }, float = true, size = "1600 1000", move = "(cursor_x-(window_w*0.5)) (cursor_y-(window_h*0.5))" })
        hl.window_rule({ match = { class = [[org\.pulseaudio\.pavucontrol]] }, float = true, size = "1200 1200", move = "(cursor_x-(window_w*0.5)) (cursor_y-(window_h*0.5))" })

        -- wine / game installers (Inno Setup temp windows, e.g. Heroic/GOG).
@@ -273,7 +319,7 @@ in
        hl.window_rule({ match = { workspace = "special:yazi" }, center = true })

        -- keybinds
-        hl.bind(mod .. " + N", hl.dsp.exec_cmd("noctalia msg panel-toggle control-center"))
+        hl.bind(mod .. " + N", hl.dsp.exec_cmd("eww-panel"))
        hl.bind(mod .. " + T", hl.dsp.exec_cmd("kitty"))
        hl.bind(mod .. " + V", hl.dsp.window.float({ action = "toggle" }))
        hl.bind(mod .. " + Q", hl.dsp.window.close())
@@ -283,7 +329,7 @@ in
        -- lock (routes through logind -> hypridle lock_cmd -> hyprlock)
        hl.bind(mod .. " + CTRL + L", hl.dsp.exec_cmd("loginctl lock-session"))

-        hl.bind(mod .. " + space", hl.dsp.exec_cmd("noctalia msg panel-toggle launcher"))
+        hl.bind(mod .. " + space", hl.dsp.exec_cmd("fuzzel"))

        -- printscreen
        hl.bind("Print", hl.dsp.exec_cmd("hyprshot -m region --raw | satty --filename - --output-filename ~/downloads/screenshots/$(date +%Y-%m-%d_%H-%M-%S).png"))
@@ -321,18 +367,21 @@ in
          hl.dispatch(hl.dsp.window.center())
        end)

-        -- volume / brightness (locked so they work on the lock screen; repeat on hold)
-        hl.bind("XF86AudioRaiseVolume", hl.dsp.exec_cmd("wpctl set-volume @DEFAULT_AUDIO_SINK@ 5%+"), { locked = true, repeating = true })
-        hl.bind("XF86AudioLowerVolume", hl.dsp.exec_cmd("wpctl set-volume @DEFAULT_AUDIO_SINK@ 5%-"), { locked = true, repeating = true })
-        hl.bind("XF86MonBrightnessUp", hl.dsp.exec_cmd("brightnessctl set 5%+"), { locked = true, repeating = true })
-        hl.bind("XF86MonBrightnessDown", hl.dsp.exec_cmd("brightnessctl set 5%-"), { locked = true, repeating = true })
+        -- volume / brightness / media (locked so they work on the lock screen;
+        -- volume and brightness repeat on hold). Everything goes through
+        -- swayosd-client, which applies the change and draws the OSD popup;
+        -- store paths because Hyprland execs these with the login PATH, which
+        -- doesn't pick up profile changes made after the session started.
+        hl.bind("XF86AudioRaiseVolume", hl.dsp.exec_cmd("${osd} --output-volume raise"), { locked = true, repeating = true })
+        hl.bind("XF86AudioLowerVolume", hl.dsp.exec_cmd("${osd} --output-volume lower"), { locked = true, repeating = true })
+        hl.bind("XF86MonBrightnessUp", hl.dsp.exec_cmd("${osd} --brightness raise"), { locked = true, repeating = true })
+        hl.bind("XF86MonBrightnessDown", hl.dsp.exec_cmd("${osd} --brightness lower"), { locked = true, repeating = true })

-        -- media keys (locked)
-        hl.bind("XF86AudioMute", hl.dsp.exec_cmd("pactl set-sink-mute @DEFAULT_SINK@ toggle"), { locked = true })
-        hl.bind("XF86AudioMicMute", hl.dsp.exec_cmd("volumectl -m toggle-mute"), { locked = true })
-        hl.bind("XF86AudioNext", hl.dsp.exec_cmd("playerctl next"), { locked = true })
-        hl.bind("XF86AudioPrev", hl.dsp.exec_cmd("playerctl previous"), { locked = true })
-        hl.bind("XF86AudioPlay", hl.dsp.exec_cmd("playerctl play-pause"), { locked = true })
+        hl.bind("XF86AudioMute", hl.dsp.exec_cmd("${osd} --output-volume mute-toggle"), { locked = true })
+        hl.bind("XF86AudioMicMute", hl.dsp.exec_cmd("${osd} --input-volume mute-toggle"), { locked = true })
+        hl.bind("XF86AudioNext", hl.dsp.exec_cmd("${osd} --playerctl next"), { locked = true })
+        hl.bind("XF86AudioPrev", hl.dsp.exec_cmd("${osd} --playerctl prev"), { locked = true })
+        hl.bind("XF86AudioPlay", hl.dsp.exec_cmd("${osd} --playerctl play-pause"), { locked = true })

        -- move/resize windows with mod + LMB/RMB drag
        hl.bind(mod .. " + mouse:272", hl.dsp.window.drag(), { mouse = true })
@@ -342,10 +391,9 @@ in

    services.hyprpaper.enable = false;

-    # hyprlock: the lock screen, replacing noctalia's built-in locker (which is
-    # ugly and — unlike hyprlock — opaque to scripts/lock-state detection).
-    # Clean minimal dark look; tweak colours/clock/font to taste. hypridle below
-    # drives it (idle + before-sleep), and $mod CTRL+L locks manually.
+    # hyprlock: the lock screen. Clean minimal dark look; tweak colours/clock/
+    # font to taste. hypridle below drives it (idle + before-sleep), and
+    # $mod CTRL+L locks manually.
    programs.hyprlock = {
      enable = true;
      settings = {
@@ -0,0 +1,292 @@
+{
+  config,
+  lib,
+  pkgs,
+  inputs,
+  ...
+}:
+let
+  cfg = config.custom.hyprland;
+
+  # Every length in the stylesheet goes through this, so one option resizes the
+  # whole dashboard for 4K hosts.
+  px = n: "${toString (builtins.ceil (n * cfg.panelScale))}px";
+
+  mkScript =
+    name: runtimeInputs:
+    pkgs.writeShellApplication {
+      inherit name runtimeInputs;
+      text = builtins.readFile (./scripts + "/${name}.sh");
+    };
+
+  battery = mkScript "battery" [
+    pkgs.coreutils
+    pkgs.findutils
+    pkgs.jq
+  ];
+  network = mkScript "network" [
+    pkgs.networkmanager
+    pkgs.gawk
+    pkgs.gnused
+    pkgs.jq
+  ];
+  bluetooth = mkScript "bluetooth" [
+    pkgs.bluez
+    pkgs.coreutils
+    pkgs.findutils
+    pkgs.gawk
+    pkgs.jq
+  ];
+  audio = mkScript "audio" [
+    pkgs.gawk
+    pkgs.jq
+    pkgs.wireplumber
+  ];
+  panelToggle = mkScript "eww-panel" [
+    config.programs.eww.package
+    pkgs.jq
+    inputs.hyprland.packages.${pkgs.stdenv.hostPlatform.system}.hyprland
+  ];
+
+  eww = lib.getExe config.programs.eww.package;
+  bluetoothctl = "${pkgs.bluez}/bin/bluetoothctl";
+  wpctl = "${pkgs.wireplumber}/bin/wpctl";
+  wpaperctl = "${pkgs.wpaperd}/bin/wpaperctl";
+
+  # setsid, and before the close rather than after it: eww kills the onclick
+  # handler's process group when the window it came from goes away, so a bare
+  # `close panel; cmd` never reaches cmd.
+  act = cmd: "${pkgs.util-linux}/bin/setsid --fork ${cmd}; ${eww} close panel";
+in
+{
+  home.packages = [
+    panelToggle
+    pkgs.waypaper
+  ];
+
+  programs.eww = {
+    enable = true;
+
+    systemd.enable = true;
+
+    yuckConfig = ''
+      ;; Each script prints one JSON object; widgets read .icon / .label / .sub
+      ;; off it.
+      (defpoll clock-time :interval "10s" :initial "--:--" `date +%H:%M`)
+      (defpoll clock-date :interval "1h"  :initial ""      `date "+%A, %d %B"`)
+
+      (defpoll battery
+        :interval "30s"
+        :initial '{"present":false,"icon":"","label":"","sub":""}'
+        `${lib.getExe battery}`)
+
+      (defpoll network
+        :interval "10s"
+        :initial '{"icon":"","label":"...","sub":""}'
+        `${lib.getExe network}`)
+
+      (defpoll bluetooth
+        :interval "10s"
+        :initial '{"powered":false,"icon":"","label":"...","sub":""}'
+        `${lib.getExe bluetooth}`)
+
+      (defpoll speaker
+        :interval "2s"
+        :initial '{"present":false,"volume":0,"muted":true,"icon":""}'
+        `${lib.getExe audio} sink`)
+
+      (defpoll mic
+        :interval "2s"
+        :initial '{"present":false,"volume":0,"muted":true,"icon":""}'
+        `${lib.getExe audio} source`)
+
+      (defwidget card [title]
+        (box :class "card" :orientation "v" :space-evenly false
+          (label :class "card-title" :halign "start" :text title :visible {title != ""})
+          (box :orientation "v" :space-evenly false
+            (children))))
+
+      (defwidget row [icon label sub onclick]
+        (eventbox :class "row" :cursor "pointer" :onclick onclick
+          (box :space-evenly false
+            (label :class "row-icon" :text icon)
+            (box :orientation "v" :space-evenly false :hexpand true
+              (label :class "row-label" :halign "start" :text label)
+              (label :class "row-sub" :halign "start" :text sub :visible {sub != ""})))))
+
+      ;; Mute button, slider, readout. `state` is the speaker/mic json object.
+      (defwidget volume [state node]
+        (box :space-evenly false :visible {state.present}
+          (button :class {state.muted ? "mute muted" : "mute"}
+                  :onclick "${wpctl} set-mute ''${node} toggle"
+                  {state.icon})
+          (scale :class "slider" :hexpand true
+                 :value {state.volume} :min 0 :max 101
+                 :onchange "${wpctl} set-volume ''${node} {}%")
+          (label :class "row-sub" :text {"''${state.volume}%"})))
+
+      (defwidget action [icon tooltip onclick]
+        (button :class "action" :tooltip tooltip :onclick onclick icon))
+
+      (defwidget dashboard []
+        (box :class "dash" :orientation "v" :space-evenly false
+
+          (box :space-evenly false
+
+            (card :title ""
+              (label :class "clock-time" :halign "start" :text clock-time)
+              (label :class "clock-date" :halign "start" :text clock-date))
+
+            (card :title "System"
+              (box :visible {battery.present} :space-evenly false
+                (row :icon {battery.icon} :label {battery.label}
+                     :sub {battery.sub} :onclick ""))
+              (row :icon {network.icon} :label {network.label} :sub {network.sub}
+                   :onclick "${act "${pkgs.networkmanagerapplet}/bin/nm-connection-editor"}")
+              (row :icon {bluetooth.icon} :label {bluetooth.label} :sub {bluetooth.sub}
+                   :onclick "${act "${pkgs.blueman}/bin/blueman-manager"}")))
+
+          (box :space-evenly false
+
+            (card :title "Audio"
+              (volume :state speaker :node "@DEFAULT_AUDIO_SINK@")
+              (volume :state mic :node "@DEFAULT_AUDIO_SOURCE@"))
+
+            (card :title "Actions"
+              (box :space-evenly false :halign "start"
+                (action :icon "󰑐" :tooltip "Next wallpaper"
+                        :onclick "${wpaperctl} next")
+                (action :icon "󰸉" :tooltip "Pick wallpaper"
+                        :onclick "${act "${lib.getExe pkgs.waypaper}"}")
+                (action :icon "󰂯" :tooltip "Toggle bluetooth"
+                        :onclick {bluetooth.powered
+                                  ? "${bluetoothctl} power off"
+                                  : "${bluetoothctl} power on"})
+                (action :icon "󰌾" :tooltip "Lock"
+                        :onclick "${act "${pkgs.systemd}/bin/loginctl lock-session"}"))))))
+
+      ;; Sized to its content. A full-screen backdrop would give click-outside-
+      ;; to-close, but its handler also fires for clicks on the sliders.
+      (defwindow panel
+        :namespace "eww-panel"
+        :geometry (geometry :anchor "center")
+        :stacking "overlay"
+        (dashboard))
+    '';
+
+    scssConfig = ''
+      $bg:     rgba(46, 52, 64, 0.96);
+      $card:   rgba(59, 66, 82, 0.72);
+      $border: #4c566a;
+      $fg:     #eceff4;
+      $muted:  #81a1c1;
+      $accent: #88c0d0;
+      $red:    #bf616a;
+
+      * {
+        all: unset;
+        font-family: "FiraCode Nerd Font", monospace;
+      }
+
+      window {
+        background-color: transparent;
+      }
+
+      .dash {
+        background-color: $bg;
+        border: ${px 1} solid $border;
+        border-radius: ${px 20};
+        padding: ${px 14};
+        color: $fg;
+      }
+
+      .card {
+        background-color: $card;
+        border-radius: ${px 14};
+        padding: ${px 16};
+        margin: ${px 6};
+        min-width: ${px 300};
+      }
+
+      .card-title {
+        font-size: ${px 11};
+        color: $muted;
+        margin-bottom: ${px 8};
+      }
+
+      .clock-time {
+        font-size: ${px 56};
+        font-weight: 600;
+      }
+
+      .clock-date {
+        font-size: ${px 14};
+        color: $muted;
+      }
+
+      .row {
+        border-radius: ${px 10};
+        padding: ${px 10} ${px 12};
+
+        &:hover {
+          background-color: rgba(136, 192, 208, 0.14);
+        }
+      }
+
+      .row-icon {
+        font-size: ${px 22};
+        color: $accent;
+        min-width: ${px 34};
+      }
+
+      .row-label {
+        font-size: ${px 14};
+      }
+
+      .row-sub {
+        font-size: ${px 11};
+        color: $muted;
+      }
+
+      .mute {
+        font-size: ${px 20};
+        color: $accent;
+        min-width: ${px 34};
+
+        &.muted {
+          color: $red;
+        }
+      }
+
+      .slider {
+        margin: 0 ${px 12};
+        min-width: ${px 180};
+
+        trough {
+          background-color: rgba(76, 86, 106, 0.6);
+          border-radius: ${px 8};
+          min-height: ${px 8};
+
+          highlight {
+            background-color: $accent;
+            border-radius: ${px 8};
+          }
+        }
+      }
+
+      .action {
+        background-color: rgba(76, 86, 106, 0.45);
+        border-radius: ${px 12};
+        padding: ${px 12} ${px 18};
+        margin-right: ${px 8};
+        font-size: ${px 20};
+        color: $fg;
+
+        &:hover {
+          background-color: $accent;
+          color: #2e3440;
+        }
+      }
+    '';
+  };
+}
@@ -0,0 +1,37 @@
+# One JSON object per audio node. $1 is "sink" or "source". wpctl prints
+# "Volume: 0.45", with " [MUTED]" appended, and errors when there is no node.
+
+case "$1" in
+  sink) node="@DEFAULT_AUDIO_SINK@" ;;
+  source) node="@DEFAULT_AUDIO_SOURCE@" ;;
+  *) echo "usage: audio sink|source" >&2; exit 2 ;;
+esac
+
+raw=$(wpctl get-volume "$node" 2>/dev/null || true)
+
+case "$raw" in
+  *Volume:*) ;;
+  *)
+    jq -nc '{ present: false, volume: 0, muted: true, icon: "󰖁" }'
+    exit 0
+    ;;
+esac
+
+volume=$(printf '%s' "$raw" | awk '{ printf "%d", $2 * 100 }')
+
+muted=false
+case "$raw" in *MUTED*) muted=true ;; esac
+
+if [ "$1" = "source" ]; then
+  if [ "$muted" = true ]; then icon="󰍭"; else icon="󰍬"; fi
+elif [ "$muted" = true ]; then icon="󰖁"
+elif [ "$volume" -ge 66 ]; then icon="󰕾"
+elif [ "$volume" -ge 33 ]; then icon="󰖀"
+else icon="󰕿"
+fi
+
+jq -nc \
+  --argjson volume "$volume" \
+  --argjson muted "$muted" \
+  --arg icon "$icon" \
+  '{ present: true, volume: $volume, muted: $muted, icon: $icon }'
@@ -0,0 +1,32 @@
+# One JSON object for the panel's battery row. `present: false` on the desktops,
+# which have no BAT* at all — the row hides itself on that.
+
+bat=$(find /sys/class/power_supply -maxdepth 1 -name 'BAT*' 2>/dev/null | sort | head -1)
+
+if [ -z "$bat" ]; then
+  jq -nc '{ present: false, icon: "", label: "", sub: "" }'
+  exit 0
+fi
+
+capacity=$(cat "$bat/capacity")
+status=$(cat "$bat/status")
+
+if [ "$status" = "Charging" ] || [ "$status" = "Full" ]; then
+  icon="󰂄"
+elif [ "$capacity" -ge 90 ]; then icon="󰁹"
+elif [ "$capacity" -ge 80 ]; then icon="󰂂"
+elif [ "$capacity" -ge 70 ]; then icon="󰂁"
+elif [ "$capacity" -ge 60 ]; then icon="󰂀"
+elif [ "$capacity" -ge 50 ]; then icon="󰁿"
+elif [ "$capacity" -ge 40 ]; then icon="󰁾"
+elif [ "$capacity" -ge 30 ]; then icon="󰁽"
+elif [ "$capacity" -ge 20 ]; then icon="󰁼"
+elif [ "$capacity" -ge 10 ]; then icon="󰁻"
+else icon="󰁺"
+fi
+
+jq -nc \
+  --arg icon "$icon" \
+  --arg label "$capacity%" \
+  --arg sub "$status" \
+  '{ present: true, icon: $icon, label: $label, sub: $sub }'
@@ -0,0 +1,22 @@
+# One JSON object for the panel's bluetooth row. bluetoothctl blocks forever
+# instead of erroring when there is no adapter, hence the /sys check + timeouts.
+
+if [ -z "$(find /sys/class/bluetooth -mindepth 1 -maxdepth 1 2>/dev/null)" ]; then
+  jq -nc '{ powered: false, icon: "󰂲", label: "No adapter", sub: "" }'
+  exit 0
+fi
+
+powered=$(timeout 2 bluetoothctl show 2>/dev/null | awk '/Powered:/ { print $2; exit }' || true)
+
+if [ "$powered" != "yes" ]; then
+  jq -nc '{ powered: false, icon: "󰂲", label: "Off", sub: "" }'
+  exit 0
+fi
+
+connected=$(timeout 2 bluetoothctl devices Connected 2>/dev/null | cut -d' ' -f3- | paste -sd', ' - || true)
+
+if [ -n "$connected" ]; then
+  jq -nc --arg sub "$connected" '{ powered: true, icon: "󰂱", label: "On", sub: $sub }'
+else
+  jq -nc '{ powered: true, icon: "󰂯", label: "On", sub: "Nothing connected" }'
+fi
@@ -0,0 +1,11 @@
+# Toggle the panel on whichever monitor has focus. `eww open --toggle` can't do
+# this: it ignores --screen when the window is already open elsewhere, so the
+# panel would stay stuck on the monitor it first appeared on.
+
+if eww active-windows | grep -q '^panel'; then
+  exec eww close panel
+fi
+
+screen=$(hyprctl -j monitors | jq -r 'map(select(.focused))[0].id // 0')
+
+exec eww open panel --screen "$screen"
@@ -0,0 +1,43 @@
+# One JSON object for the panel's network row. State must match "connected"
+# exactly: NetworkManager reports docker0 and br-* as "connected (externally)".
+
+status=$(nmcli -t -f TYPE,STATE,CONNECTION device status 2>/dev/null || true)
+
+# nmcli's terse output backslash-escapes colons inside connection names, so
+# rejoin fields 3..NF and unescape rather than taking $3.
+pick() {
+  printf '%s\n' "$status" | awk -F: -v want="$1" '
+    $1 == want && $2 == "connected" {
+      name = $3
+      for (i = 4; i <= NF; i++) name = name ":" $i
+      print name
+      exit
+    }' | sed 's/\\:/:/g'
+}
+
+wifi=$(pick wifi)
+ethernet=$(pick ethernet)
+
+if [ -n "$wifi" ]; then
+  signal=$(nmcli -t -f IN-USE,SIGNAL dev wifi 2>/dev/null | awk -F: '$1 == "*" { print $2; exit }' || true)
+
+  if [ -z "$signal" ]; then icon="󰤨"
+  elif [ "$signal" -ge 75 ]; then icon="󰤨"
+  elif [ "$signal" -ge 50 ]; then icon="󰤥"
+  elif [ "$signal" -ge 25 ]; then icon="󰤢"
+  else icon="󰤟"
+  fi
+
+  if [ -n "$signal" ]; then
+    sub="Wi-Fi · $signal%"
+  else
+    sub="Wi-Fi"
+  fi
+
+  jq -nc --arg icon "$icon" --arg label "$wifi" --arg sub "$sub" \
+    '{ icon: $icon, label: $label, sub: $sub }'
+elif [ -n "$ethernet" ]; then
+  jq -nc --arg label "$ethernet" '{ icon: "󰈀", label: $label, sub: "Ethernet" }'
+else
+  jq -nc '{ icon: "󰤭", label: "Offline", sub: "" }'
+fi
@@ -1,104 +0,0 @@
-{
-  config,
-  lib,
-  inputs,
-  pkgs,
-  ...
-}:
-let
-  avatar = pkgs.fetchurl {
-    url = "https://github.com/naps62.png";
-    sha256 = "1ck11xg4rwcvn8dcc06ax7i9yfzy21v1n6h5mcjrkrici5sznlsv";
-  };
-in
-{
-  imports = [ inputs.noctalia.homeModules.default ];
-
-  # Noctalia v5 rewrote the config schema (TOML, snake_case, flat sections).
-  # The v4 settings (appLauncher.*, bar.widgets.*, controlCenter.shortcuts.*, etc.)
-  # have no v5 equivalents — most must now be tweaked through the in-shell
-  # Settings UI. See docs.noctalia.dev/v5 and example.toml in the upstream repo.
-  programs.noctalia = {
-    enable = true;
-    settings = {
-      shell = {
-        font_family = "Sans Serif";
-        avatar_path = "${config.home.homeDirectory}/.face";
-        telemetry_enabled = false;
-        polkit_agent = true;
-      };
-
-      wallpaper = {
-        enabled = true;
-        fill_mode = "crop";
-        directory = "${config.home.homeDirectory}/.cache/wallpapers/3840x2160";
-        transition = [ "fade" ];
-        transition_duration = 1500;
-        automation = {
-          enabled = true;
-          interval_minutes = 360;
-          order = "random";
-          recursive = true;
-        };
-      };
-
-      theme = {
-        mode = "dark";
-        source = "builtin";
-        builtin = "Nord";
-        templates = {
-          enable_builtin_templates = true;
-          builtin_ids = [
-            "btop"
-            "gtk3"
-            "gtk4"
-            "hyprland"
-            "qt"
-          ];
-        };
-      };
-
-      notification.enable_daemon = true;
-
-      weather = {
-        enabled = true;
-        unit = "celsius";
-      };
-
-      location = {
-        auto_locate = false;
-        address = "Braga, Portugal";
-      };
-
-      nightlight = {
-        enabled = true;
-        temperature_day = 6500;
-        temperature_night = 4000;
-      };
-
-      bar.main = {
-        position = "top";
-        background_opacity = 0.93;
-        radius = 12;
-        start = [ "launcher" "wallpaper" "workspaces" ];
-        center = [ "media" "clock" ];
-        end = [ "tray" "notifications" "network" "bluetooth" "volume" "brightness" "battery" "control-center" "session" ];
-      };
-    };
-  };
-
-  home.file.".face".source = avatar;
-
-  # force overwrite files that noctalia may have turned into regular files
-  # (Hyprland 0.55+ is Lua-only, so the managed file is now hyprland.lua)
-  xdg.configFile."hypr/hyprland.lua".force = true;
-  xdg.configFile."gtk-3.0/gtk.css".force = true;
-
-  # NOTE: noctalia still writes its color theme to ~/.config/hypr/noctalia.conf
-  # in *hyprlang* syntax ($primary = rgb(...), general { col.active_border = ... }).
-  # Hyprland 0.55+ dropped the hyprlang parser entirely, so that file can no
-  # longer be `source`d — there is no hl.source, and the lua config can't parse
-  # hyprlang. Hyprland therefore uses the static border colors from
-  # ../default.nix instead of noctalia's themed ones. To restore live theming,
-  # noctalia would need to emit a Lua snippet we can require() here.
-}
@@ -0,0 +1,84 @@
+{ pkgs, ... }:
+{
+  programs.fuzzel = {
+    enable = true;
+    settings = {
+      main = {
+        terminal = "${pkgs.kitty}/bin/kitty";
+        layer = "overlay";
+        font = "FiraCode Nerd Font:size=12";
+        icon-theme = "Tela black";
+        lines = 12;
+        width = 40;
+        inner-pad = 8;
+      };
+      border = {
+        radius = 12;
+        width = 1;
+      };
+      colors = {
+        background = "2e3440f0";
+        text = "eceff4ff";
+        match = "88c0d0ff";
+        selection = "434c5eff";
+        selection-text = "eceff4ff";
+        border = "4c566aff";
+      };
+    };
+  };
+
+  services.mako = {
+    enable = true;
+    settings = {
+      font = "FiraCode Nerd Font 11";
+      background-color = "#2e3440f0";
+      text-color = "#eceff4";
+      border-color = "#4c566a";
+      border-radius = 12;
+      border-size = 1;
+      padding = "14";
+      margin = "12";
+      default-timeout = 6000;
+      anchor = "top-right";
+      layer = "overlay";
+    };
+  };
+
+  # swayosd: the on-screen volume/brightness/caps-lock popup. Noctalia drew this
+  # before; without it the XF86 keys still work but give no feedback, which reads
+  # as "the keys are dead". swayosd-client does the change *and* the popup, so the
+  # binds in default.nix call it instead of wpctl/brightnessctl directly.
+  services.swayosd = {
+    enable = true;
+    topMargin = 0.85;
+    stylePath = pkgs.writeText "swayosd-style.css" ''
+      window#osd {
+        padding: 12px 20px;
+        border-radius: 12px;
+        border: 1px solid #4c566a;
+        background: alpha(#2e3440, 0.94);
+      }
+
+      window#osd #container { margin: 12px; }
+
+      window#osd image,
+      window#osd label { color: #eceff4; }
+
+      window#osd progressbar:disabled { opacity: 0.5; }
+
+      window#osd trough {
+        min-height: 6px;
+        border-radius: 6px;
+        background: #434c5e;
+      }
+
+      window#osd progress {
+        min-height: 6px;
+        border-radius: 6px;
+        background: #88c0d0;
+      }
+    '';
+  };
+
+  services.hyprpolkitagent.enable = true;
+}
@@ -1,5 +1,10 @@
-{ pkgs, ... }:
+{ config, pkgs, ... }:
 let
+  cfg = config.custom.hyprland;
+
+  horizontalDir = "${config.home.homeDirectory}/.cache/wallpapers/3840x2160";
+  verticalDir = "${config.home.homeDirectory}/.cache/wallpapers/2160x3840";
+
  # Horizontal wallpapers (3840x2160) for HDMI-A-1 and DP-1
  # Just add any image URL you want here
  horizontal = [
@@ -107,4 +112,25 @@ let
 in
 {
  home.file.".local/bin/wallpaper-fetch".source = fetchScript;
+
+  # `any` covers every output not named in custom.hyprland.verticalOutputs,
+  # which get the portrait set instead.
+  services.wpaperd = {
+    enable = true;
+    settings =
+      {
+        default = {
+          duration = "6h";
+          sorting = "random";
+          mode = "center";
+        };
+        any.path = horizontalDir;
+      }
+      // builtins.listToAttrs (
+        map (output: {
+          name = output;
+          value.path = verticalDir;
+        }) cfg.verticalOutputs
+      );
+  };
 }
@@ -1,27 +1,108 @@
 { pkgs, ... }:
 let
  clip2path = pkgs.writeShellScript "clip2path" ''
-    set -e
+    set -euo pipefail

-    if [ -n "$WAYLAND_DISPLAY" ]; then
-      types=$(wl-paste --list-types)
-      if grep -q '^image/' <<<"$types"; then
-        ext=$(grep -m1 '^image/' <<<"$types" | cut -d/ -f2 | cut -d';' -f1)
-        file="/tmp/clip_$(date +%s).''${ext}"
-        wl-paste --type "image/''${ext}" > "$file"
-        printf '%q' "$file" | kitty @ send-text --stdin
+    jq=${pkgs.jq}/bin/jq
+    scp=${pkgs.openssh}/bin/scp
+    wlpaste=${pkgs.wl-clipboard}/bin/wl-paste
+    xclip=${pkgs.xclip}/bin/xclip
+    find=${pkgs.findutils}/bin/find
+
+    # kitty/kitten stay unpinned: remote control has to reach the running
+    # instance, whose build may differ from pkgs.kitty.
+
+    "$find" /tmp -maxdepth 1 -name 'clip_*' -mtime +1 -delete 2>/dev/null || true
+
+    # Some apps advertise a lossy format before image/png.
+    pick_type() {
+      if grep -qx 'image/png' <<<"$1"; then
+        echo image/png
      else
-        wl-paste --no-newline | kitty @ send-text --stdin
+        grep -m1 '^image/' <<<"$1" | cut -d';' -f1
      fi
-    elif [ -n "$DISPLAY" ]; then
-      types=$(xclip -selection clipboard -t TARGETS -o)
-      if grep -q '^image/' <<<"$types"; then
-        ext=$(grep -m1 '^image/' <<<"$types" | cut -d/ -f2 | cut -d';' -f1)
-        file="/tmp/clip_$(date +%s).''${ext}"
-        xclip -selection clipboard -t "image/''${ext}" -o > "$file"
-        printf '%q' "$file" | kitty @ send-text --stdin
+    }
+
+    ext_of() {
+      local e=''${1#image/}
+      e=''${e%%+*}
+      e=''${e#x-}
+      tr -cd 'a-zA-Z0-9' <<<"$e"
+    }
+
+    # Destination of the ssh client running in the focused window, empty if
+    # that window is local. Prefers the real ssh process over the `kitten ssh`
+    # wrapper, whose own long options would confuse the parser below.
+    ssh_dest() {
+      local -a argv
+      mapfile -t argv < <(kitty @ ls | "$jq" -r '
+        [ .[] | select(.is_focused)
+          | .tabs[] | select(.is_focused)
+          | .windows[] | select(.is_focused)
+          | .foreground_processes[]?
+          | { b: ((.cmdline[0] // "") | split("/") | last), c: .cmdline }
+        ] as $p
+        | ( [ $p[] | select(.b == "ssh") ] + [ $p[] | select(.b == "kitten") ] )
+        | (.[0].c // [])[]')
+
+      [ ''${#argv[@]} -gt 0 ] || return 0
+      if [ "''${argv[0]##*/}" = kitten ]; then
+        [ "''${argv[1]:-}" = ssh ] || return 0
+        argv=("''${argv[@]:2}")
      else
-        xclip -selection clipboard -o | kitty @ send-text --stdin
+        argv=("''${argv[@]:1}")
+      fi
+
+      local valueflags=bcDEeFIiJLlmOopQRSWw a
+      while [ ''${#argv[@]} -gt 0 ]; do
+        a=''${argv[0]}
+        case "$a" in
+          --) echo "''${argv[1]:-}"; return 0 ;;
+          -?)
+            case "$valueflags" in *"''${a#-}"*) argv=("''${argv[@]:1}") ;; esac
+            argv=("''${argv[@]:1}")
+            ;;
+          -*) argv=("''${argv[@]:1}") ;;
+          *) echo "$a"; return 0 ;;
+        esac
+      done
+    }
+
+    send_path() {
+      local file=$1 dest remote
+      dest=$(ssh_dest)
+      if [ -n "$dest" ]; then
+        remote=/tmp/''${file##*/}
+        if ! "$scp" -q -o BatchMode=yes -o ConnectTimeout=5 "$file" "$dest:$remote"; then
+          kitten notify --app-name clip2path clip2path "copy to $dest failed, nothing pasted"
+          return 1
+        fi
+        file=$remote
+      fi
+      printf '%q' "$file" | kitty @ send-text --stdin
+    }
+
+    # Text goes through the real paste action. send-text has no bracketed
+    # paste, so multi-line text would run line by line in a shell.
+    if [ -n "''${WAYLAND_DISPLAY:-}" ]; then
+      types=$("$wlpaste" --list-types)
+      if grep -q '^image/' <<<"$types"; then
+        type=$(pick_type "$types")
+        file=$(mktemp --suffix=".$(ext_of "$type")" /tmp/clip_XXXXXXXX)
+        "$wlpaste" --type "$type" > "$file"
+        send_path "$file"
+      else
+        kitty @ action paste_from_clipboard
+      fi
+    elif [ -n "''${DISPLAY:-}" ]; then
+      types=$("$xclip" -selection clipboard -t TARGETS -o)
+      if grep -q '^image/' <<<"$types"; then
+        type=$(pick_type "$types")
+        file=$(mktemp --suffix=".$(ext_of "$type")" /tmp/clip_XXXXXXXX)
+        "$xclip" -selection clipboard -t "$type" -o > "$file"
+        send_path "$file"
+      else
+        kitty @ action paste_from_clipboard
      fi
    fi
  '';
@@ -36,7 +117,7 @@ in
 {
  programs.kitty = {
    enable = true;
-    # Fixed theme — noctalia no longer toggles kitty with dark/light mode.
+    # Fixed theme — nothing toggles kitty with dark/light mode.
    themeFile = "Catppuccin-Mocha";
    settings = {
      confirm_os_window_close = 0;
@@ -0,0 +1,7 @@
+{ inputs, ... }:
+# Maestro: the terminal-session orchestrator. Module only — no `enable` here,
+# because the daemon owns every interactive shell on the host it runs on, and
+# only one box should be doing that. Hosts opt in from their own services.nix.
+{
+  imports = [ inputs.maestro.homeManagerModules.default ];
+}
@@ -0,0 +1,36 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  cfg = config.custom.mpv;
+in
+{
+  options.custom.mpv = {
+    hwdec = lib.mkOption {
+      type = lib.types.str;
+      default = "auto-safe";
+      example = "nvdec-copy";
+      description = ''
+        Value for mpv's `hwdec`. `auto-safe` only picks a decoder mpv considers
+        reliable for the running driver and falls back to software otherwise,
+        so it is correct on Intel (arrakis) and on hosts with no usable GPU
+        decoder (yolo). NVIDIA hosts override it.
+      '';
+    };
+  };
+
+  config = {
+    programs.mpv = {
+      enable = true;
+
+      config = {
+        hwdec = cfg.hwdec;
+        vo = lib.mkDefault "gpu-next";
+        save-position-on-quit = true;
+        keep-open = "yes";
+      };
+    };
+  };
+}
@@ -12,5 +12,14 @@

  programs.nvchad = {
    enable = true;
+
+    # Neovim only auto-picks OSC 52 when it finds no clipboard tool, but
+    # wl-clipboard is on every host — so over SSH it writes the *remote*
+    # clipboard instead. Locally wl-copy stays: kitty refuses OSC 52 reads.
+    extraConfig = ''
+      if vim.env.SSH_TTY and vim.env.SSH_TTY ~= "" then
+        vim.g.clipboard = "osc52"
+      end
+    '';
  };
 }
@@ -0,0 +1,198 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+# nix-autodeploy: one webhook endpoint that turns "a repo I own pushed to main"
+# into "that flake input is bumped, committed, and (optionally) applied".
+#
+# Replaces per-app deploy webhooks that rebuilt from a checkout on the box. The
+# apps are flake inputs now, so deploying one is a lock bump plus a generation
+# switch — the same operation for every app, hence one service instead of N.
+let
+  cfg = config.services.nixAutodeploy;
+
+  # A user unit inherits almost no PATH, and the deploy shells out to git (with
+  # the gitea credential helper), nix and nh.
+  profilePath = lib.concatStringsSep ":" [
+    "%h/.local/bin"
+    "%h/.nix-profile/bin"
+    "/etc/profiles/per-user/%u/bin"
+    "/run/current-system/sw/bin"
+  ];
+
+  deploy = pkgs.writeShellApplication {
+    name = "nix-autodeploy-deploy";
+    runtimeInputs = [
+      pkgs.git
+      pkgs.nix
+      pkgs.nh
+      pkgs.curl
+      pkgs.jq
+      pkgs.util-linux
+    ];
+    text = ''
+      # usage: nix-autodeploy-deploy <flake-input> <apply|notify>
+      input=$1
+      mode=$2
+      flake=${lib.escapeShellArg cfg.flake}
+      topic=${lib.escapeShellArg cfg.ntfy.topic}
+      ntfy_url=${lib.escapeShellArg cfg.ntfy.url}
+
+      notify() {
+        [ -n "''${NTFY_TOKEN:-}" ] || return 0
+        curl -fsS -X POST "$ntfy_url/$topic" \
+          -H "Authorization: Bearer $NTFY_TOKEN" \
+          -H "Title: $1" -d "$2" > /dev/null || true
+      }
+
+      # Serialize: two pushes landing together would otherwise race on the same
+      # working tree and the same flake.lock.
+      exec 9> "''${XDG_RUNTIME_DIR:-/tmp}/nix-autodeploy.lock"
+      flock 9
+
+      cd "$flake"
+
+      branch=$(git rev-parse --abbrev-ref HEAD)
+      if [ "$branch" != main ]; then
+        notify "autodeploy skipped ($input)" "checkout is on $branch, not main"
+        exit 0
+      fi
+      if ! git diff --quiet || ! git diff --cached --quiet; then
+        notify "autodeploy skipped ($input)" "working tree is dirty"
+        exit 0
+      fi
+
+      git fetch --quiet origin main
+      git merge --ff-only --quiet origin/main
+
+      nix flake update "$input"
+      if git diff --quiet -- flake.lock; then
+        echo "autodeploy: $input already at the pushed revision"
+        exit 0
+      fi
+
+      rev=$(nix flake metadata --json |
+        jq -r --arg i "$input" '.locks.nodes[$i].locked.rev[0:7]')
+      git commit --quiet -m "chore(flake): bump $input to $rev" -- flake.lock
+      git push --quiet origin main
+
+      if [ "$mode" != apply ]; then
+        notify "$input bumped to $rev" "Not applied — run 'nh home switch' when convenient."
+        exit 0
+      fi
+
+      if nh home switch "$flake"; then
+        notify "$input deployed" "Bumped to $rev and switched."
+      else
+        notify "$input FAILED to apply" "Lock is at $rev on main; the switch failed. See journalctl --user -u run-*."
+        exit 1
+      fi
+    '';
+  };
+
+  listener = pkgs.writers.writePython3Bin "nix-autodeploy" {
+    # Only line length: http.server's do_GET/do_POST spelling is already
+    # excused inline.
+    flakeIgnore = [ "E501" ];
+  } (builtins.readFile ./listener.py);
+
+  repoFile = (pkgs.formats.json { }).generate "nix-autodeploy-repos.json" (
+    lib.mapAttrs (_: r: { inherit (r) input apply; }) cfg.repos
+  );
+in
+{
+  options.services.nixAutodeploy = {
+    enable = lib.mkEnableOption "the forge-webhook listener that bumps and applies flake inputs";
+
+    port = lib.mkOption {
+      type = lib.types.port;
+      default = 7375;
+      description = "Port the listener binds on 0.0.0.0. There is no auth beyond the webhook HMAC, so only expose it through the reverse proxy.";
+    };
+
+    flake = lib.mkOption {
+      type = lib.types.str;
+      example = "/home/naps62/tea/nixos-config";
+      description = "Absolute path to the nixos-config checkout whose flake.lock gets bumped. Must be on main and clean, or the deploy skips.";
+    };
+
+    environmentFile = lib.mkOption {
+      type = lib.types.str;
+      example = "%h/.config/nix-autodeploy/env";
+      description = ''
+        File holding `NIX_AUTODEPLOY_SECRET` (the webhook HMAC secret, shared
+        with every repo below) and `NTFY_TOKEN`. Not in the store — these are
+        secrets.
+      '';
+    };
+
+    ntfy = {
+      url = lib.mkOption {
+        type = lib.types.str;
+        default = "https://ntfy.home.naps.pt";
+        description = "Base URL of the ntfy server deploy results are posted to.";
+      };
+      topic = lib.mkOption {
+        type = lib.types.str;
+        default = "nix-autodeploy";
+        description = "ntfy topic for deploy results.";
+      };
+    };
+
+    repos = lib.mkOption {
+      default = { };
+      description = "Forge repositories to listen for, keyed by `<owner>/<repo>` exactly as the webhook payload spells it.";
+      example = lib.literalExpression ''
+        { "yolo/rev" = { input = "rev"; }; }
+      '';
+      type = lib.types.attrsOf (
+        lib.types.submodule {
+          options = {
+            input = lib.mkOption {
+              type = lib.types.str;
+              description = "Name of the flake input in this repo's flake.nix that tracks that repository.";
+            };
+            apply = lib.mkOption {
+              type = lib.types.bool;
+              default = true;
+              description = ''
+                Whether to run `nh home switch` after the bump. Set false for an
+                app whose restart disrupts a live session — the lock is still
+                bumped and pushed, and the ntfy message says it is waiting.
+              '';
+            };
+          };
+        }
+      );
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.user.services.nix-autodeploy = {
+      Unit = {
+        Description = "nix-autodeploy — forge webhooks bump and apply flake inputs";
+        After = [ "network.target" ];
+        # Same restart-budget trap every other always-on unit here avoids: at
+        # RestartSec=2 a fast-crashing listener would park in `failed`.
+        StartLimitIntervalSec = 0;
+      };
+      Service = {
+        Type = "simple";
+        ExecStart = lib.getExe listener;
+        EnvironmentFile = cfg.environmentFile;
+        Environment = [
+          "PATH=${profilePath}"
+          "NIX_AUTODEPLOY_PORT=${toString cfg.port}"
+          "NIX_AUTODEPLOY_DEPLOY_BIN=${lib.getExe deploy}"
+          "NIX_AUTODEPLOY_ENV_FILE=${cfg.environmentFile}"
+          "NIX_AUTODEPLOY_REPOS_FILE=${repoFile}"
+        ];
+        Restart = "always";
+        RestartSec = 2;
+      };
+      Install.WantedBy = [ "default.target" ];
+    };
+  };
+}
@@ -0,0 +1,104 @@
+"""Forge webhook listener that turns a push into a flake-input bump.
+
+Verifies the HMAC a Gitea (or GitHub) webhook signs the body with, then hands
+the actual work to a transient systemd unit. Nothing is done in-process: the
+deploy runs `nh home switch`, which restarts every unit home-manager owns —
+including this listener — so the job has to outlive it.
+"""
+
+import hashlib
+import hmac
+import json
+import os
+import subprocess
+import sys
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+
+SECRET = os.environ.get("NIX_AUTODEPLOY_SECRET", "").encode()
+PORT = int(os.environ.get("NIX_AUTODEPLOY_PORT", "7375"))
+DEPLOY = os.environ["NIX_AUTODEPLOY_DEPLOY_BIN"]
+# {"<owner>/<repo>": {"input": "rev", "apply": true}, ...}. Passed as a file,
+# not a variable: systemd's Environment= strips the quotes out of inline JSON.
+with open(os.environ["NIX_AUTODEPLOY_REPOS_FILE"]) as fh:
+    REPOS = json.load(fh)
+ENV_FILE = os.environ.get("NIX_AUTODEPLOY_ENV_FILE", "")
+MAX_BODY = 1 << 20
+
+if not SECRET:
+    sys.exit("NIX_AUTODEPLOY_SECRET is not set")
+
+
+def signature_ok(body: bytes, headers) -> bool:
+    expected = hmac.new(SECRET, body, hashlib.sha256).hexdigest()
+    # Gitea sends the bare hex digest; GitHub prefixes it with "sha256=".
+    for name in ("X-Gitea-Signature", "X-Hub-Signature-256"):
+        got = headers.get(name)
+        if got and hmac.compare_digest(got.removeprefix("sha256="), expected):
+            return True
+    return False
+
+
+def spawn(repo: str, entry: dict) -> None:
+    cmd = [
+        "systemd-run",
+        "--user",
+        "--collect",
+        f"--description=nix-autodeploy: {repo}",
+        # PATH is not inherited by a transient unit, and the deploy shells out
+        # to git, nix and the gitea credential helper.
+        f"--setenv=PATH={os.environ['PATH']}",
+    ]
+    if ENV_FILE:
+        cmd.append(f"--property=EnvironmentFile={ENV_FILE}")
+    cmd += [DEPLOY, entry["input"], "apply" if entry.get("apply", True) else "notify"]
+    subprocess.run(cmd, check=True)
+
+
+class Handler(BaseHTTPRequestHandler):
+    def reply(self, code: int, text: str) -> None:
+        payload = text.encode()
+        self.send_response(code)
+        self.send_header("Content-Type", "text/plain")
+        self.send_header("Content-Length", str(len(payload)))
+        self.end_headers()
+        self.wfile.write(payload)
+
+    def do_GET(self) -> None:  # noqa: N802 - BaseHTTPRequestHandler's spelling
+        if self.path == "/health":
+            self.reply(200, "ok\n")
+        else:
+            self.reply(404, "no\n")
+
+    def do_POST(self) -> None:  # noqa: N802
+        length = int(self.headers.get("Content-Length", "0"))
+        if length > MAX_BODY:
+            return self.reply(413, "body too large\n")
+        body = self.rfile.read(length)
+
+        if not signature_ok(body, self.headers):
+            return self.reply(401, "bad signature\n")
+
+        try:
+            event = json.loads(body)
+        except json.JSONDecodeError:
+            return self.reply(400, "bad json\n")
+
+        ref = event.get("ref")
+        repo = (event.get("repository") or {}).get("full_name")
+        if ref != "refs/heads/main":
+            return self.reply(200, f"ignored ref {ref}\n")
+
+        entry = REPOS.get(repo)
+        if entry is None:
+            return self.reply(200, f"ignored repo {repo}\n")
+
+        spawn(repo, entry)
+        self.reply(202, f"deploying {entry['input']}\n")
+
+    def log_message(self, fmt: str, *args) -> None:
+        # Journal already timestamps; the default format prepends its own.
+        sys.stderr.write(f"{self.address_string()} {fmt % args}\n")
+
+
+if __name__ == "__main__":
+    ThreadingHTTPServer(("0.0.0.0", PORT), Handler).serve_forever()
@@ -1,4 +1,9 @@
-{ pkgs, inputs, ... }:
+{
+  lib,
+  pkgs,
+  inputs,
+  ...
+}:
 {
  imports = [
    # Prebuilt, weekly-updated nix-index database (backs `comma`).
@@ -13,7 +18,9 @@
  # `flake` sets NH_FLAKE so `nh home switch` finds this repo without --flake.
  programs.nh = {
    enable = true;
-    flake = "/home/naps62/projects/nixos-config";
+    # mkDefault: hosts whose clone lives elsewhere (yolo, under ~/tea) override
+    # this with a plain assignment.
+    flake = lib.mkDefault "/home/naps62/projects/nixos-config";
  };

  home.packages = with pkgs; [
@@ -1 +0,0 @@
-Screenshots: stored in ~/downloads/screenshots, with date time in the filename
@@ -1,100 +0,0 @@
---
-description: Merge worktree changes and clean up safely
---
-
-# Merge Worktree and Cleanup
-
-Merge changes from the current worktree into a target branch and clean up the worktree.
-
-**Usage:** `/merge [target-branch]`
-
-**Arguments:**
- `$1`: Target branch to merge into (default: auto-detect main/master)
-
-## Process
-
-### 1. Pre-flight Checks
-
-```bash
-CURRENT_BRANCH=$(git branch --show-current)
-WORKTREE_DIR=$(git rev-parse --git-common-dir)
-
-if [[ ! "$WORKTREE_DIR" == *".git/worktrees"* ]]; then
-  echo "❌ Error: You're not in a worktree"
-  exit 1
-fi
-
-if ! git diff-index --quiet HEAD --; then
-  echo "❌ Error: You have uncommitted changes"
-  git status --short
-  exit 1
-fi
-```
-
-### 2. Determine Target Branch
-
-```bash
-TARGET_BRANCH="${1:-}"
-if [ -z "$TARGET_BRANCH" ]; then
-  if git show-ref --verify --quiet refs/heads/main; then
-    TARGET_BRANCH="main"
-  elif git show-ref --verify --quiet refs/heads/master; then
-    TARGET_BRANCH="master"
-  else
-    echo "❌ Error: Cannot auto-detect main branch"
-    exit 1
-  fi
-fi
-```
-
-### 3. Update Target Branch
-
-```bash
-WORKTREE_PATH=$(pwd)
-COMMON_DIR=$(git rev-parse --git-common-dir)
-REPO_ROOT=$(echo "$COMMON_DIR" | sed 's/\.git.*//' | sed 's/\/$//')
-if [ "$COMMON_DIR" = ".git" ]; then
-  REPO_ROOT=$(git rev-parse --show-toplevel)
-fi
-
-cd "$REPO_ROOT"
-git checkout "$TARGET_BRANCH"
-git pull origin "$TARGET_BRANCH"
-```
-
-### 4. Merge
-
-```bash
-git merge --no-ff "$CURRENT_BRANCH" -m "Merge branch '$CURRENT_BRANCH'"
-```
-
-If you prefer a squash merge, do this instead:
-
-```bash
-git merge --squash "$CURRENT_BRANCH"
-git commit -m "feat: <summary>"
-```
-
-### 5. Push and Clean Up
-
-```bash
-git push origin "$TARGET_BRANCH"
-
-git worktree remove "$WORKTREE_PATH" --force || rm -rf "$WORKTREE_PATH"
-git branch -d "$CURRENT_BRANCH" || git branch -D "$CURRENT_BRANCH"
-```
-
-### 6. Optional: Delete Remote Branch
-
-```bash
-git push origin --delete "$CURRENT_BRANCH"
-```
-
-## Language-specific checks
-
-### Rust
- `cargo check`
- `cargo clippy` (clean up new warnings)
-
-### TypeScript
- `tsc`
@@ -1,9 +0,0 @@
---
-description: Rebase/merge upstream changes into the current branch
---
-This command should only work while in a secondary branch (not main or master).
-
-Commit any unstaged changes
-Fetch updates from the origin repo
-If there are new commits on the parent branch (typically origin/main), then merge them back into the current branch
-Solve any conflicts, and analyze the incoming changes to see if additional changes are required to the branch's code (e.g.: if something was renamed in the meantime in main, our new code may need to be adjusted)
@@ -1,12 +1,13 @@
 _:
 {
+  # Global rules (opencode/AGENTS.md) and the shared commands (merge, update)
+  # come from the agent-skills home-manager module — opencode has no @file
+  # imports, so the module concatenates the shared fragments into one file.
+  # opencode also auto-loads skills from ~/.claude/skills and ~/.agents/skills.
  xdg.configFile = {
    # Global config file
    "opencode/opencode.json".source = ./opencode.json;

-    # Global rules (equivalent to ~/.claude/CLAUDE.md)
-    "opencode/AGENTS.md".source = ./AGENTS.md;
-
    # Custom agents
    "opencode/agents/oracle.md".source = ./agents/oracle.md;
    "opencode/agents/explorer.md".source = ./agents/explorer.md;
@@ -16,10 +17,8 @@ _:
    "opencode/agents/designer-bold.md".source = ./agents/designer-bold.md;
    "opencode/agents/analyze-branch.md".source = ./agents/analyze-branch.md;

-    # Global commands
+    # Global commands (opencode-specific ones only)
    "opencode/commands/work.md".source = ./commands/work.md;
-    "opencode/commands/merge.md".source = ./commands/merge.md;
-    "opencode/commands/update.md".source = ./commands/update.md;
    "opencode/commands/smart-debug.md".source = ./commands/smart-debug.md;
    "opencode/commands/tdd-cycle.md".source = ./commands/tdd-cycle.md;
    "opencode/commands/security-scan.md".source = ./commands/security-scan.md;
@@ -0,0 +1,12 @@
+{ pkgs, ... }:
+let
+  pi = pkgs.callPackage ../../../pkgs/pi/package.nix { };
+in
+{
+  # ~/.pi/agent/AGENTS.md comes from the agent-skills home-manager module
+  # (pi has no @file imports, so the module concatenates the shared fragments).
+  # Pi reads skills straight from ~/.agents/skills, which the module links.
+  # Settings stay unmanaged: pi writes ~/.pi/agent/settings.json itself from
+  # /settings, /trust and `pi config`.
+  home.packages = [ pi ];
+}
@@ -0,0 +1,7 @@
+{ inputs, ... }:
+# rev: the always-on code review server. Module only — no `enable` here. It
+# discovers every repo under its roots and serves them without auth, so only a
+# box that is already a trusted single-user machine should run it.
+{
+  imports = [ inputs.rev.homeManagerModules.default ];
+}
@@ -1,16 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}:
-let
-  # T3 Code: open-source desktop control plane for coding agents (x86_64 only).
-  # Shares the custom.aiApps.deviceScaleFactor knob (defined in ../claude).
-  t3-code = pkgs.callPackage ../../../pkgs/t3-code/package.nix {
-    inherit (config.custom.aiApps) deviceScaleFactor;
-  };
-in
-{
-  home.packages = lib.optional pkgs.stdenv.hostPlatform.isx86_64 t3-code;
-}
@@ -22,6 +22,16 @@ set -s escape-time 25
 # Enable 256 colors
 set -g default-terminal "tmux-256color"
 set -ag terminal-overrides ",xterm-256color:RGB"
+set -ag terminal-overrides ",*256col*:Tc"
+
+# smcup@/rmcup@ drops the alternate screen, so what tmux drew stays in the
+# outer terminal's scrollback instead of vanishing when tmux exits.
+set -ag terminal-overrides ",xterm*:Tc:smcup@:rmcup@"
+
+# Forward Shift+Enter and other modified keys through to applications
+set -s extended-keys on
+set -s extended-keys-format csi-u
+set -as terminal-features "tmux-256color:extkeys"

 # -------------------------------------------------------------------
 # Status bar theme
@@ -101,6 +111,37 @@ setw -g mode-keys vi
 bind -T copy-mode-vi v send -X begin-selection
 bind -T copy-mode-vi y send -X copy-selection-and-cancel

+# -------------------------------------------------------------------
+# Clipboard (OSC 52)
+# -------------------------------------------------------------------
+set -g set-clipboard on
+
+# tmux silently skips OSC 52 unless the outer terminal's terminfo claims the
+# capability. kitty's does; SSH sessions usually land on a bare
+# xterm-256color that does not, so declare both.
+set -ag terminal-features ",xterm-kitty:clipboard"
+set -ag terminal-features ",xterm-256color:clipboard"
+
+# Let nvim's OSC 52 provider reach the outer terminal through tmux.
+set -g allow-passthrough on
+
+# Drag-to-copy. No external command: set-clipboard routes this through
+# OSC 52, which works on Wayland and over SSH. xclip did neither.
+bind-key -T copy-mode-vi MouseDragEnd1Pane send-keys -X copy-pipe-and-cancel
+bind-key -T copy-mode MouseDragEnd1Pane send-keys -X copy-pipe-and-cancel
+
+# -------------------------------------------------------------------
+# Mouse scrolling
+# -------------------------------------------------------------------
+# Scrolling up enters copy-mode, unless the pane's application wants the
+# mouse itself or we are already in copy-mode.
+bind-key -n WheelUpPane if-shell -F -t = "#{mouse_any_flag}" "send-keys -M" "if -Ft= '#{pane_in_mode}' 'send-keys -M' 'copy-mode -e'"
+
+bind-key -T copy-mode-vi WheelUpPane send-keys -X scroll-up
+bind-key -T copy-mode-vi WheelDownPane send-keys -X scroll-down
+bind-key -T copy-mode WheelUpPane send-keys -X scroll-up
+bind-key -T copy-mode WheelDownPane send-keys -X scroll-down
+

 # tmux-resurrect settings
 set -g @resurrect-capture-pane-contents 'on'
@@ -109,40 +150,3 @@ set -g @resurrect-strategy-nvim 'session'
 # tmux-continuum settings (auto-save and auto-restore)
 set -g @continuum-restore 'on'
 set -g @continuum-save-interval '10'
-
-
-# agent-deck configuration
-# agent-deck-tmux-config-version: 3
-# Added by agent-deck installer - 2026-03-18
-# https://github.com/asheshgoplani/agent-deck
-
-# Terminal with true color support
-set -g default-terminal "tmux-256color"
-set -ag terminal-overrides ",xterm*:Tc:smcup@:rmcup@"
-set -ag terminal-overrides ",*256col*:Tc"
-
-# Performance
-set -sg escape-time 0
-set -g history-limit 50000
-
-# Extended keys: forward Shift+Enter and other modified keys to apps (tmux 3.2+)
-set -s extended-keys on
-set -as terminal-features 'tmux-256color:extkeys'
-
-# Mouse support (scroll + drag-to-copy)
-set -g mouse on
-
-# Auto-enter copy-mode when scrolling up (critical for WSL compatibility)
-# This handles: 1) apps with mouse support, 2) already in copy-mode, 3) normal pane
-bind-key -n WheelUpPane if-shell -F -t = "#{mouse_any_flag}" "send-keys -M" "if -Ft= '#{pane_in_mode}' 'send-keys -M' 'copy-mode -e'"
-
-# Scroll bindings in copy-mode (both vi and emacs modes)
-bind-key -T copy-mode-vi WheelUpPane send-keys -X scroll-up
-bind-key -T copy-mode-vi WheelDownPane send-keys -X scroll-down
-bind-key -T copy-mode WheelUpPane send-keys -X scroll-up
-bind-key -T copy-mode WheelDownPane send-keys -X scroll-down
-
-# Clipboard integration (drag-to-copy)
-bind-key -T copy-mode-vi MouseDragEnd1Pane send-keys -X copy-pipe-and-cancel "xclip -in -selection clipboard"
-bind-key -T copy-mode MouseDragEnd1Pane send-keys -X copy-pipe-and-cancel "xclip -in -selection clipboard"
-# End agent-deck configuration
@@ -0,0 +1,20 @@
+{ pkgs, ... }:
+{
+  imports = [ ./desktop/spicetify.nix ];
+
+  home.packages = with pkgs; [
+    obsidian
+    obs-studio
+    kooha
+    vokoscreen-ng
+    gimp
+    font-manager
+    xournalpp
+    remmina
+    slack
+    signal-desktop
+    zoom-us
+    yaak
+    bun
+  ];
+}
@@ -10,7 +10,18 @@
      enableCompletion = true;
      autosuggestion.enable = true;
      syntaxHighlighting.enable = true;
-      completionInit = "autoload -U compinit && compinit -u";
+      # A full compinit security-checks and rebuilds the dump on every shell
+      # start. Do that at most once a day and use the cached dump (-C) in
+      # between. Missing dump globs to nothing, so it takes the full path.
+      completionInit = ''
+        autoload -U compinit
+        _zcompdump_fresh() {
+          setopt local_options extendedglob
+          [[ -n ''${ZDOTDIR:-$HOME}/.zcompdump(#qNmh-24) ]]
+        }
+        if _zcompdump_fresh; then compinit -C; else compinit -u; fi
+        unfunction _zcompdump_fresh
+      '';

      shellAliases = {
        c = "cargo";
@@ -5,6 +5,10 @@
  imports = [
    ../common/programs/default.nix
    ../common/programs/desktop
+    ../common/programs/workstation-apps.nix
+    ../common/programs/editors.nix
+    ../common/programs/dev-workstation.nix
+    ../common/programs/ai-gui.nix
    ../common/programs/zen-browser.nix
    ../common/programs/hyprland
    ../common/programs/kitty
@@ -20,21 +24,38 @@

  home.sessionVariables = {
    LIBVA_DRIVER_NAME = "nvidia";
-    GDM_BACKEND = "nvidia-drm";
+    # Was GDM_BACKEND, which nothing reads (SDDM is the DM here).
+    GBM_BACKEND = "nvidia-drm";
    __GLX_VENDOR_LIBRARY_NAME = "nvidia";
+
+    # Firefox/Zen decode video in a separate RDD process whose sandbox denies
+    # /dev/nvidia*, so nvidia-vaapi-driver never initialises there and playback
+    # silently drops to software. Costs one sandbox layer; no narrower switch
+    # exists. Check with `nvidia-smi --query-gpu=utilization.decoder`.
+    MOZ_DISABLE_RDD_SANDBOX = "1";
  };

+  # Plain `nvdec` keeps frames in GPU memory and breaks some filters.
+  custom.mpv.hwdec = "nvdec-copy";
+
+  # The 4060 would render Cycles far faster, but nothing caches this build —
+  # flipping it on compiles Blender, OpenUSD, OpenSubdiv and OpenImageDenoise.
+  custom.blender.cuda = false;
+
  custom.hyprland = {
    yaziSize = "2400 1800";
    cursorSize = 42;
    # The screen actually shared in every call; skips the xdph picker entirely.
    shareOutput = "HDMI-A-1";
+    verticalOutputs = [ "DP-2" ];
+    panelScale = 1.6;
  };

  custom.gaming = {
    enable = true;
    nvidia = true;
    retroarch = true;
+    moonlight = true;
  };

  # 4K@1x monitors render the Electron AI apps tiny; scale their UI up. Tune to taste.
@@ -46,7 +67,6 @@
      -- session the moment Hyprland starts so a cold boot lands on hyprlock, not
      -- an open desktop. A brief flash before it paints is possible.
      hl.exec_cmd("hyprlock")
-      hl.exec_cmd("$HOME/.local/bin/hyprpaper-rotate")
    end)

    -- ethui-dev
@@ -109,12 +129,5 @@
    hl.config({ render = { direct_scanout = false } })
  '';

-  programs.noctalia.settings = {
-    shell.ui_scale = 1.25;
-    notification.monitors = [ "DP-1" ];
-    # NOTE: v5 has no per-monitor wallpaper directories; only directory_light /
-    # directory_dark. Re-add via Settings UI if upstream gains support.
-  };
-
  programs.kitty.settings.font_size = 16;
 }
@@ -1,141 +0,0 @@
-default_profile = "default"
-
-[acp]
-allow_agent_install = false
-allowed_agents = []
-auto_stop_idle_secs = 0
-compaction_reminder = false
-compaction_reminder_percent = 75
-default_agent = "claude"
-max_concurrent_workers = 5
-node_path = ""
-offer_structured_in_new_session = false
-rate_limit_auto_resume = false
-replay_events = 0
-restrict_agents = false
-show_tool_durations = true
-silent_orphan_grace_secs = 120
-
-[auth]
-persist_sessions = true
-
-[diff]
-context_lines = 3
-split_view = false
-
-[hooks]
-
-[host_hooks]
-
-[logging]
-default_level = "info"
-file_path = "debug.log"
-keep_count = 5
-max_size_mib = 50
-output = "file"
-rotation = "size"
-show_spans = false
-
-[logging.targets]
-
-[sandbox]
-auto_cleanup = true
-container_runtime = "docker"
-default_image = "ghcr.io/agent-of-empires/aoe-sandbox:latest"
-default_terminal_mode = "host"
-enabled_by_default = false
-environment = [
-    "TERM",
-    "COLORTERM",
-    "FORCE_COLOR",
-    "NO_COLOR",
-]
-extra_volumes = []
-mount_ssh = false
-selinux_relabel = false
-volume_ignores = []
-volume_ignores_strategy = "anonymous"
-
-[session]
-agent_status_hooks = true
-auto_resume_on_restart = true
-auto_stop_idle_secs = 0
-click_action = "live_send"
-confirm_before_quit = false
-confirm_delete = false
-conversation_summary = false
-default_attach_mode = "tmux"
-delete_to_trash = false
-favorites_first = true
-inherit_host_environment = false
-live_send_exit_chord = "C-q"
-live_send_leader = "C-b"
-live_send_on_view_switch = false
-merge_hooks_into_selected_agent = true
-mouse_capture = true
-opencode_preassign_session_id = false
-prevent_sleep_idle_grace_minutes = 15
-prevent_sleep_when_active = false
-restart_wake_message = "wake up: pick up what you were doing"
-row_tag = "none"
-show_session_colors = true
-show_tips = true
-smart_rename = true
-smart_rename_agent = ""
-snooze_duration_minutes = 30
-strict_hotkeys = false
-tie_workdir_to_name = true
-trash_retention_days = 30
-unread_indicator = true
-yolo_mode_default = true
-
-[session.agent_detect_as]
-kimiclaude = "claude"
-synclaude = "claude"
-
-[session.custom_agents]
-kimiclaude = "kimiclaude"
-synclaude = "synclaude"
-
-[skills]
-auto_propagate = false
-
-[sound]
-enabled = false
-
-[status_hooks]
-enabled = false
-
-[telemetry]
-enabled = false
-
-[theme]
-color_mode = "truecolor"
-idle_decay_minutes = 0
-name = ""
-
-[tmux]
-clipboard = "auto"
-mouse = "auto"
-status_bar = "auto"
-vt_live = true
-
-[updates]
-auto_update_plugins = false
-update_check_mode = "notify"
-
-[web]
-notifications_enabled = true
-notify_on_error = true
-notify_on_idle = false
-notify_on_waiting = true
-notify_on_wake_fire = true
-
-[worktree]
-auto_cleanup = true
-bare_repo_path_template = "./{branch}"
-delete_branch_on_cleanup = false
-enabled = true
-init_submodules = true
-path_template = "../{repo-name}-worktrees/{branch}"
-workspace_path_template = "../{branch}-workspace-{session-id}"
@@ -1,251 +0,0 @@
-{
-  "permissions": {
-    "allow": [
-      "Bash",
-      "Edit",
-      "Write",
-      "NotebookEdit",
-      "WebFetch",
-      "WebSearch"
-    ],
-    "deny": [
-      "Read(~/.ssh/**)",
-      "Read(*.pem)",
-      "Read(*.key)",
-      "mcp__dokploy__application-one",
-      "mcp__dokploy__mounts-listByServiceId",
-      "mcp__dokploy__mounts-one",
-      "mcp__dokploy__compose-one",
-      "mcp__dokploy__schedule-create",
-      "mcp__dokploy__schedule-update",
-      "mcp__dokploy__schedule-runManually"
-    ],
-    "defaultMode": "auto"
-  },
-  "model": "claude-fable-5[1m]",
-  "hooks": {
-    "PostToolUse": [
-      {
-        "matcher": "Write|Edit|MultiEdit",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "~/.claude/hooks/comment-lint.py"
-          }
-        ]
-      },
-      {
-        "matcher": "AskUserQuestion",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "sh -c 'unset IFS; set -f; umask 077; [ -n \"$AOE_INSTANCE_ID\" ] || exit 0; case \"$AOE_INSTANCE_ID\" in *[!0-9a-zA-Z_-]*) exit 0 ;; esac; B=/tmp/aoe-hooks-1000; mkdir -p \"$B\" 2>/dev/null || exit 0; LS=$(LC_ALL=C ls -ldn \"$B\" 2>/dev/null) || exit 0; set -- $LS; M=\"$1\"; case \"$M\" in drwx------|drwx------.|drwx------+|drwx------@) ;; *) exit 0 ;; esac; ME=$(id -u 2>/dev/null) || exit 0; [ \"$3\" = \"$ME\" ] || exit 0; D=\"$B/$AOE_INSTANCE_ID\"; mkdir -p \"$D\" 2>/dev/null; LS=$(LC_ALL=C ls -ldn \"$D\" 2>/dev/null) || exit 0; set -- $LS; M=\"$1\"; case \"$M\" in drwx------|drwx------.|drwx------+|drwx------@) ;; *) exit 0 ;; esac; [ \"$3\" = \"$ME\" ] || exit 0; printf running > \"$D/status\" 2>/dev/null; exit 0 # aoe-hooks'"
-          }
-        ]
-      }
-    ],
-    "Notification": [
-      {
-        "hooks": [
-          {
-            "type": "command",
-            "command": "~/.claude/hooks/tmux-attention.sh"
-          }
-        ]
-      },
-      {
-        "matcher": "permission_prompt|elicitation_dialog|agent_needs_input",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "sh -c 'unset IFS; set -f; umask 077; [ -n \"$AOE_INSTANCE_ID\" ] || exit 0; case \"$AOE_INSTANCE_ID\" in *[!0-9a-zA-Z_-]*) exit 0 ;; esac; B=/tmp/aoe-hooks-1000; mkdir -p \"$B\" 2>/dev/null || exit 0; LS=$(LC_ALL=C ls -ldn \"$B\" 2>/dev/null) || exit 0; set -- $LS; M=\"$1\"; case \"$M\" in drwx------|drwx------.|drwx------+|drwx------@) ;; *) exit 0 ;; esac; ME=$(id -u 2>/dev/null) || exit 0; [ \"$3\" = \"$ME\" ] || exit 0; D=\"$B/$AOE_INSTANCE_ID\"; mkdir -p \"$D\" 2>/dev/null; LS=$(LC_ALL=C ls -ldn \"$D\" 2>/dev/null) || exit 0; set -- $LS; M=\"$1\"; case \"$M\" in drwx------|drwx------.|drwx------+|drwx------@) ;; *) exit 0 ;; esac; [ \"$3\" = \"$ME\" ] || exit 0; printf waiting > \"$D/status\" 2>/dev/null; exit 0 # aoe-hooks'"
-          }
-        ]
-      },
-      {
-        "matcher": "idle_prompt|agent_completed",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "sh -c 'unset IFS; set -f; umask 077; [ -n \"$AOE_INSTANCE_ID\" ] || exit 0; case \"$AOE_INSTANCE_ID\" in *[!0-9a-zA-Z_-]*) exit 0 ;; esac; B=/tmp/aoe-hooks-1000; mkdir -p \"$B\" 2>/dev/null || exit 0; LS=$(LC_ALL=C ls -ldn \"$B\" 2>/dev/null) || exit 0; set -- $LS; M=\"$1\"; case \"$M\" in drwx------|drwx------.|drwx------+|drwx------@) ;; *) exit 0 ;; esac; ME=$(id -u 2>/dev/null) || exit 0; [ \"$3\" = \"$ME\" ] || exit 0; D=\"$B/$AOE_INSTANCE_ID\"; mkdir -p \"$D\" 2>/dev/null; LS=$(LC_ALL=C ls -ldn \"$D\" 2>/dev/null) || exit 0; set -- $LS; M=\"$1\"; case \"$M\" in drwx------|drwx------.|drwx------+|drwx------@) ;; *) exit 0 ;; esac; [ \"$3\" = \"$ME\" ] || exit 0; printf idle > \"$D/status\" 2>/dev/null; exit 0 # aoe-hooks'"
-          }
-        ]
-      }
-    ],
-    "PreToolUse": [
-      {
-        "matcher": "Bash",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "~/.claude/hooks/comms-lint.py"
-          }
-        ]
-      },
-      {
-        "matcher": "",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "~/.claude/hooks/tmux-reset.sh"
-          }
-        ]
-      },
-      {
-        "matcher": "Bash",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "rtk hook claude"
-          }
-        ]
-      },
-      {
-        "hooks": [
-          {
-            "type": "command",
-            "command": "sh -c 'unset IFS; set -f; umask 077; [ -n \"$AOE_INSTANCE_ID\" ] || exit 0; case \"$AOE_INSTANCE_ID\" in *[!0-9a-zA-Z_-]*) exit 0 ;; esac; B=/tmp/aoe-hooks-1000; mkdir -p \"$B\" 2>/dev/null || exit 0; LS=$(LC_ALL=C ls -ldn \"$B\" 2>/dev/null) || exit 0; set -- $LS; M=\"$1\"; case \"$M\" in drwx------|drwx------.|drwx------+|drwx------@) ;; *) exit 0 ;; esac; ME=$(id -u 2>/dev/null) || exit 0; [ \"$3\" = \"$ME\" ] || exit 0; D=\"$B/$AOE_INSTANCE_ID\"; mkdir -p \"$D\" 2>/dev/null; LS=$(LC_ALL=C ls -ldn \"$D\" 2>/dev/null) || exit 0; set -- $LS; M=\"$1\"; case \"$M\" in drwx------|drwx------.|drwx------+|drwx------@) ;; *) exit 0 ;; esac; [ \"$3\" = \"$ME\" ] || exit 0; IN=$(cat 2>/dev/null); S=running; case \"$IN\" in *\\\"tool_name\\\":\\\"AskUserQuestion\\\"*) S=waiting ;; esac; printf %s \"$S\" > \"$D/status\" 2>/dev/null; exit 0 # aoe-hooks'"
-          }
-        ]
-      }
-    ],
-    "SessionStart": [
-      {
-        "matcher": "startup|resume|clear",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "~/.claude/hooks/git-autoupdate.sh"
-          }
-        ]
-      },
-      {
-        "hooks": [
-          {
-            "type": "command",
-            "command": "python3 ~/.claude/scripts/aoe-register-remote.py"
-          }
-        ]
-      },
-      {
-        "hooks": [
-          {
-            "type": "command",
-            "command": "/home/naps62/tea/rev/scripts/rev-hook-session-start.sh"
-          }
-        ]
-      },
-      {
-        "hooks": [
-          {
-            "type": "command",
-            "command": "sh -c '[ -n \"$AOE_INSTANCE_ID\" ] || exit 0; command -v aoe >/dev/null 2>&1 || exit 0; aoe __extract-session-id 2>/dev/null; exit 0 # aoe-hooks'"
-          }
-        ]
-      }
-    ],
-    "Stop": [
-      {
-        "hooks": [
-          {
-            "type": "command",
-            "command": "/home/naps62/tea/rev/scripts/rev-hook-stop.sh"
-          }
-        ]
-      },
-      {
-        "hooks": [
-          {
-            "type": "command",
-            "command": "sh -c 'unset IFS; set -f; umask 077; [ -n \"$AOE_INSTANCE_ID\" ] || exit 0; case \"$AOE_INSTANCE_ID\" in *[!0-9a-zA-Z_-]*) exit 0 ;; esac; B=/tmp/aoe-hooks-1000; mkdir -p \"$B\" 2>/dev/null || exit 0; LS=$(LC_ALL=C ls -ldn \"$B\" 2>/dev/null) || exit 0; set -- $LS; M=\"$1\"; case \"$M\" in drwx------|drwx------.|drwx------+|drwx------@) ;; *) exit 0 ;; esac; ME=$(id -u 2>/dev/null) || exit 0; [ \"$3\" = \"$ME\" ] || exit 0; D=\"$B/$AOE_INSTANCE_ID\"; mkdir -p \"$D\" 2>/dev/null; LS=$(LC_ALL=C ls -ldn \"$D\" 2>/dev/null) || exit 0; set -- $LS; M=\"$1\"; case \"$M\" in drwx------|drwx------.|drwx------+|drwx------@) ;; *) exit 0 ;; esac; [ \"$3\" = \"$ME\" ] || exit 0; printf idle > \"$D/status\" 2>/dev/null; exit 0 # aoe-hooks'"
-          }
-        ]
-      }
-    ],
-    "UserPromptSubmit": [
-      {
-        "hooks": [
-          {
-            "type": "command",
-            "command": "sh -c '[ -n \"$AOE_INSTANCE_ID\" ] || exit 0; command -v aoe >/dev/null 2>&1 || exit 0; aoe __extract-session-id 2>/dev/null; exit 0 # aoe-hooks'"
-          },
-          {
-            "type": "command",
-            "command": "sh -c 'unset IFS; set -f; umask 077; [ -n \"$AOE_INSTANCE_ID\" ] || exit 0; case \"$AOE_INSTANCE_ID\" in *[!0-9a-zA-Z_-]*) exit 0 ;; esac; B=/tmp/aoe-hooks-1000; mkdir -p \"$B\" 2>/dev/null || exit 0; LS=$(LC_ALL=C ls -ldn \"$B\" 2>/dev/null) || exit 0; set -- $LS; M=\"$1\"; case \"$M\" in drwx------|drwx------.|drwx------+|drwx------@) ;; *) exit 0 ;; esac; ME=$(id -u 2>/dev/null) || exit 0; [ \"$3\" = \"$ME\" ] || exit 0; D=\"$B/$AOE_INSTANCE_ID\"; mkdir -p \"$D\" 2>/dev/null; LS=$(LC_ALL=C ls -ldn \"$D\" 2>/dev/null) || exit 0; set -- $LS; M=\"$1\"; case \"$M\" in drwx------|drwx------.|drwx------+|drwx------@) ;; *) exit 0 ;; esac; [ \"$3\" = \"$ME\" ] || exit 0; printf running > \"$D/status\" 2>/dev/null; exit 0 # aoe-hooks'"
-          }
-        ]
-      }
-    ],
-    "StopFailure": [
-      {
-        "hooks": [
-          {
-            "type": "command",
-            "command": "sh -c 'unset IFS; set -f; umask 077; [ -n \"$AOE_INSTANCE_ID\" ] || exit 0; case \"$AOE_INSTANCE_ID\" in *[!0-9a-zA-Z_-]*) exit 0 ;; esac; B=/tmp/aoe-hooks-1000; mkdir -p \"$B\" 2>/dev/null || exit 0; LS=$(LC_ALL=C ls -ldn \"$B\" 2>/dev/null) || exit 0; set -- $LS; M=\"$1\"; case \"$M\" in drwx------|drwx------.|drwx------+|drwx------@) ;; *) exit 0 ;; esac; ME=$(id -u 2>/dev/null) || exit 0; [ \"$3\" = \"$ME\" ] || exit 0; D=\"$B/$AOE_INSTANCE_ID\"; mkdir -p \"$D\" 2>/dev/null; LS=$(LC_ALL=C ls -ldn \"$D\" 2>/dev/null) || exit 0; set -- $LS; M=\"$1\"; case \"$M\" in drwx------|drwx------.|drwx------+|drwx------@) ;; *) exit 0 ;; esac; [ \"$3\" = \"$ME\" ] || exit 0; printf idle > \"$D/status\" 2>/dev/null; exit 0 # aoe-hooks'"
-          }
-        ]
-      }
-    ],
-    "ElicitationResult": [
-      {
-        "hooks": [
-          {
-            "type": "command",
-            "command": "sh -c 'unset IFS; set -f; umask 077; [ -n \"$AOE_INSTANCE_ID\" ] || exit 0; case \"$AOE_INSTANCE_ID\" in *[!0-9a-zA-Z_-]*) exit 0 ;; esac; B=/tmp/aoe-hooks-1000; mkdir -p \"$B\" 2>/dev/null || exit 0; LS=$(LC_ALL=C ls -ldn \"$B\" 2>/dev/null) || exit 0; set -- $LS; M=\"$1\"; case \"$M\" in drwx------|drwx------.|drwx------+|drwx------@) ;; *) exit 0 ;; esac; ME=$(id -u 2>/dev/null) || exit 0; [ \"$3\" = \"$ME\" ] || exit 0; D=\"$B/$AOE_INSTANCE_ID\"; mkdir -p \"$D\" 2>/dev/null; LS=$(LC_ALL=C ls -ldn \"$D\" 2>/dev/null) || exit 0; set -- $LS; M=\"$1\"; case \"$M\" in drwx------|drwx------.|drwx------+|drwx------@) ;; *) exit 0 ;; esac; [ \"$3\" = \"$ME\" ] || exit 0; printf running > \"$D/status\" 2>/dev/null; exit 0 # aoe-hooks'"
-          }
-        ]
-      }
-    ]
-  },
-  "worktree": {
-    "baseRef": "fresh"
-  },
-  "statusLine": {
-    "type": "command",
-    "command": "~/.claude/statusline.sh"
-  },
-  "enabledPlugins": {
-    "building@subvisual": true,
-    "rust-analyzer-lsp@claude-plugins-official": false,
-    "caveman@caveman": true
-  },
-  "extraKnownMarketplaces": {
-    "subvisual": {
-      "source": {
-        "source": "github",
-        "repo": "subvisual/harness"
-      }
-    },
-    "superpowers-marketplace": {
-      "source": {
-        "source": "github",
-        "repo": "obra/superpowers-marketplace"
-      }
-    },
-    "caveman": {
-      "source": {
-        "source": "github",
-        "repo": "JuliusBrussee/caveman"
-      }
-    }
-  },
-  "tui": "fullscreen",
-  "skipDangerousModePermissionPrompt": true,
-  "theme": "dark",
-  "editorMode": "vim",
-  "preferredNotifChannel": "auto",
-  "autoCompactEnabled": true,
-  "remoteControlAtStartup": false,
-  "inputNeededNotifEnabled": true,
-  "agentPushNotifEnabled": true,
-  "mcpServers": {
-    "playwright": {
-      "args": [
-        "-y",
-        "@playwright/mcp@latest"
-      ],
-      "command": "npx",
-      "type": "stdio"
-    }
-  }
-}
@@ -3,6 +3,16 @@
  pkgs,
  ...
 }:
+let
+  # ./opencode.json holds only yolo's overrides; everything else is inherited
+  # so agents, commands and skills keep coming from common. Attrsets merge
+  # key-by-key, lists are replaced whole.
+  mergedOpencodeConfig = (pkgs.formats.json { }).generate "opencode.json" (
+    lib.recursiveUpdate (lib.importJSON ../common/programs/opencode/opencode.json) (
+      lib.importJSON ./opencode.json
+    )
+  );
+in
 {
  imports = [
    ../common/programs/default.nix
@@ -11,33 +21,48 @@
    ../common/programs/kitty
    ../common/programs/gpg.nix
    ../common/programs/aoe
+    ../common/programs/maestro
+    ../common/programs/rev
+    ../common/programs/nix-autodeploy
    ../common/features/xdg.nix
    ./monitors.nix
    ./services.nix
    ./ssh.nix
  ];

+  # Host-local: bash goes from "ask" to "allow" so unattended opencode sessions
+  # stop stalling on every git and grep.
+  # It also drops the prompt on branches under review, which is the tradeoff.
+  xdg.configFile."opencode/opencode.json".source = lib.mkForce mergedOpencodeConfig;
+
  custom.hyprland.cursorSize = 32;

+  # Amber, and a different silhouette to Nordzy — this desktop is only ever seen
+  # inside a Moonlight window, so the cursor has to be tellable at a glance from
+  # the client's own. Same theme in both modes; darkman would otherwise swap it.
+  custom.hyprland.cursorPackage = pkgs.bibata-cursors;
+  custom.hyprland.cursorTheme = {
+    dark = "Bibata-Modern-Amber";
+    light = "Bibata-Modern-Amber";
+  };
+
  # Headless browser driver the agent tooling shells out to. Was a global npm
  # install on the ubuntu box.
  home.packages = [ pkgs.agent-browser ];

-  # Both default to ~/projects/nixos-config in common/programs; this clone lives
-  # under ~/tea. nh.flake sets NH_FLAKE, so without it `nh home switch` with no
-  # argument resolves to a path that does not exist.
-  home.mutableFilesRepoPath = lib.mkForce "/home/naps62/tea/nixos-config";
+  # This is the one box that runs the agent-skills units; each starts a session,
+  # so a second machine enabling them would run the same job twice.
+  programs.agentSkills = {
+    machine = "yolo";
+    prDaemon.enable = true;
+    hourlog.enable = true;
+    weekReview.enable = true;
+  };
+  programs.nh.flake = "/home/naps62/tea/nixos-config";

-  # Host-local, not shared: this sets yolo_mode_default = true, which starts aoe
-  # sessions with permission checks skipped. Only correct on this box.
-  home.mutableFiles.".config/agent-of-empires/config.toml".source = ./aoe-config.toml;
-
-  # Likewise host-local: carries skipDangerousModePermissionPrompt and the rev
-  # hook paths, neither of which belong on a workstation.
-  home.mutableFiles.".claude/settings.json".source = lib.mkForce ./claude-settings.json;
-
-  programs.agentSkills.machine = "yolo";
-  programs.nh.flake = lib.mkForce "/home/naps62/tea/nixos-config";
+  # Idle lock and dpms-off blank the virtual output: Sunshine then captures a
+  # flat frame and Moonlight goes black, with no console to unlock from.
+  services.hypridle.enable = lib.mkForce false;

  # Blur and shadow cost a fullscreen pass per frame, and every frame here is
  # also x264-encoded for the stream — on a virtio-gpu with no VirGL, in software.
@@ -1,11 +1,14 @@
-_:
-{
+_: {
  # Hyprland 0.55+ is Lua-only (see home/common/programs/hyprland).
  #
  # Matches every output rather than naming one: the virtio-gpu connector name
  # varies by qemu display backend (Virtual-1 vs Virtual-0). Explicit mode, not
  # `preferred` — this is the resolution Sunshine streams.
+  #
+  # 2160p is near the ceiling: virtio-gpu has no NVENC/VAAPI, so Sunshine falls
+  # back to x264, which measured 73fps here against 135fps at 1440p — a 60fps
+  # client has only ~20% margin.
  wayland.windowManager.hyprland.extraConfig = ''
-    hl.monitor({ output = "", mode = "2560x1440@60", position = "0x0", scale = 1 })
+    hl.monitor({ output = "", mode = "3840x2160@60", position = "0x0", scale = 1 })
  '';
 }
@@ -0,0 +1,5 @@
+{
+  "permission": {
+    "bash": "allow"
+  }
+}
@@ -3,122 +3,95 @@
  inputs,
  ...
 }:
-# The user services this box exists to run, ported from hand-written units in
-# ~/.config/systemd/user on the Ubuntu machine.
+# The user services this box exists to run.
 #
-# NOT self-contained: every ExecStart under ~/.bun or ~/.local/bin is an
-# imperatively-installed binary, and the WorkingDirectories are clones of
-# separate repos. Nix owns the unit definitions here, nothing more.
+# maestro and rev come from their own flakes, so nix owns the build as well as
+# the unit. aoe-web is still the odd one out: its unit is defined here and the
+# binary comes from the flake input.
 let
  # A user unit gets almost no PATH by default; these are the profile dirs the
  # original units got for free from the system PATH on Ubuntu.
  toolPath = "%h/.local/bin:%h/.nix-profile/bin:/etc/profiles/per-user/naps62/bin:/run/current-system/sw/bin";

  sem = inputs.sem.packages.${pkgs.system}.default;
+
+  aoe = inputs.agent-of-empires.packages.${pkgs.system}.aoe-with-web;
 in
 {
+  # sem is here as well as on rev's unit: the shell uses it directly too.
  home.packages = [
    sem
-    pkgs.bun
+    # ACP adapter aoe's structured (web) sessions spawn as `claude-agent-acp`.
+    pkgs.claude-agent-acp
  ];

+  # maestro's and rev's units come from their flake modules, not from the
+  # hand-written set below.
+  #
+  # settings stays empty on purpose: ~/.config/maestro/config.toml is a
+  # hand-edited plain file, not nix-generated (module skips it iff `{}`).
+  # There is no `web.enable`: the daemon serves the UI on `daemon.bind_addr`.
+  services.maestro.enable = true;
+
+  # Everything under ~, three levels deep — the worktrees live at
+  # ~/<area>/<repo>/worktrees/<name>. sem gives entity-level diffs; without it
+  # rev falls back to line diffs.
+  services.rev = {
+    enable = true;
+    roots = [ "%h" ];
+    depth = 3;
+    semBin = "${sem}/bin/sem";
+  };
+
+  # One endpoint for every repo this config pins. All three apply straight
+  # away: a maestro restart drops the daemon but not the sessions it manages,
+  # so the interactive shells on this box survive it.
+  services.nixAutodeploy = {
+    enable = true;
+    flake = "/home/naps62/tea/nixos-config";
+    environmentFile = "%h/.config/nix-autodeploy/env";
+    repos = {
+      "yolo/rev".input = "rev";
+      "yolo/agent-skills".input = "agent-skills";
+      "naps62/maestro".input = "maestro";
+    };
+  };
+
  systemd.user.services = {
-    rev = {
+    aoe-web = {
      Unit = {
-        Description = "rev — always-on local code review server";
+        Description = "aoe serve — Agent of Empires web dashboard";
        After = [ "network.target" ];
+        # MUST stay 0: at RestartSec=2 a fast-crashing aoe burns the default
+        # 5-starts-per-10s budget, and systemd parks the unit in `failed` until
+        # a manual `systemctl --user reset-failed`.
+        StartLimitIntervalSec = 0;
      };
      Service = {
        Type = "simple";
-        WorkingDirectory = "%h/tea/rev";
-        # nodejs_26, not pkgs.nodejs: rev's package.json sets engines >=26 and
-        # the nixpkgs default is 24.
-        ExecStart = "${pkgs.nodejs_26}/bin/node server/index.ts";
+        WorkingDirectory = "%h";
+        # The fork removed dashboard auth entirely, so there is no --auth flag
+        # any more — the reverse proxy is the only access gate. --allowed-host
+        # is what makes the rebinding gate accept a hostname under a wildcard
+        # bind (an IP literal needs no flag).
+        ExecStart = "${aoe}/bin/aoe serve --host 0.0.0.0 --port 8080 --behind-proxy --allowed-host aoe.n62.casa";
+        # TMUX_TMPDIR keeps the daemon on the same tmux server the shell and
+        # TUI use, instead of a second one under /tmp (same bug pr-daemon had).
        Environment = [
-          "NODE_ENV=production"
-          "REV_ROOTS=%h"
-          "REV_DEPTH=3"
-          "REV_SEM_BIN=${sem}/bin/sem"
          "PATH=${toolPath}"
+          "TMUX_TMPDIR=%t"
        ];
        Restart = "always";
        RestartSec = 2;
+        # If this unit boots before any shell, the shared tmux server lands in
+        # its cgroup; the default control-group kill would take every session
+        # down on restart.
+        KillMode = "process";
      };
      Install.WantedBy = [ "default.target" ];
    };
-
-    rev-deploy = {
-      Unit = {
-        Description = "rev-deploy — Gitea webhook listener that deploys rev on push to main";
-        After = [ "network.target" ];
-      };
-      Service = {
-        Type = "simple";
-        WorkingDirectory = "%h/tea/rev";
-        ExecStart = "${pkgs.bun}/bin/bun scripts/deploy-webhook.ts";
-        EnvironmentFile = "%h/.config/rev/deploy.env";
-        Environment = [ "PATH=${toolPath}" ];
-        Restart = "always";
-        RestartSec = 2;
-      };
-      Install.WantedBy = [ "default.target" ];
-    };
-
-    hourlog = {
-      Unit = {
-        Description = "Start the Friday hour log in a tmux session";
-        Documentation = [ "https://git.naps.pt/yolo/agent-skills" ];
-        ConditionPathIsDirectory = "%h/tea/agent-skills";
-      };
-      Service = {
-        Type = "oneshot";
-        ExecStart = "%h/tea/agent-skills/bin/hourlog-session.sh";
-        Environment = [ "PATH=${toolPath}" ];
-        # This unit may be what starts the tmux server; the default cgroup kill
-        # would take it back down as soon as ExecStart returns.
-        KillMode = "process";
-      };
-    };
-
-    week-review = {
-      Unit = {
-        Description = "Start the weekly agent-skills review in a tmux session";
-        Documentation = [ "https://git.naps.pt/yolo/agent-skills" ];
-        ConditionPathIsDirectory = "%h/tea/agent-skills";
-      };
-      Service = {
-        Type = "oneshot";
-        ExecStart = "%h/tea/agent-skills/bin/week-review-session.sh";
-        Environment = [ "PATH=${toolPath}" ];
-        KillMode = "process";
-      };
-    };
  };
-
-  systemd.user.timers = {
-    hourlog = {
-      Unit.Description = "Friday hour log, 18:00 Europe/Lisbon";
-      Timer = {
-        # Zone suffix pinned because the machine clock is UTC; keeps it at 18:00
-        # wall time across DST.
-        OnCalendar = "Fri 18:00 Europe/Lisbon";
-        Persistent = true;
-        AccuracySec = "1min";
-      };
-      Install.WantedBy = [ "timers.target" ];
-    };
-
-    week-review = {
-      Unit.Description = "Weekly agent-skills review, Fridays 17:00 Europe/Lisbon";
-      Timer = {
-        OnCalendar = "Fri 17:00 Europe/Lisbon";
-        Persistent = true;
-        AccuracySec = "1min";
-      };
-      Install.WantedBy = [ "timers.target" ];
-    };
-  };
-
-
-
 }
+# pr-daemon, hourlog and week-review are not here: their units ship with the
+# scripts they run, in the agent-skills module. This host opts in with
+# programs.agentSkills.*.enable in home/yolo/default.nix.
@@ -3,6 +3,16 @@ _:
 # on the Ubuntu box.
 {
  programs.ssh.settings = {
+    # gpg-agent serves as the ssh agent here, and signing blocks forever on a
+    # pinentry prompt that has no TTY in headless/agent sessions — `ssh-add -l`
+    # works, but git push hangs right after "Server accepts key". The key file
+    # has no passphrase, so read it directly and skip the agent.
+    "github.com" = {
+      IdentityAgent = "none";
+      IdentitiesOnly = true;
+      IdentityFile = "~/.ssh/id_ed25519";
+    };
+
    "grafana" = {
      HostName = "10.6.10.30";
      User = "root";
@@ -17,6 +17,7 @@
    ../common/features/docker.nix
    ../common/features/appimage.nix
    ../common/features/fonts.nix
+    ../common/features/kdeconnect.nix
    ../common/features/nix-ld.nix
    ../common/features/bluetooth.nix
    ../common/features/ledger.nix
@@ -34,6 +35,12 @@
      share = "media";
      mountPoint = "/mnt/media";
    }
+    {
+      # yolo VM's /home/naps62 (share defined in hosts/yolo/default.nix).
+      server = "10.7.10.2";
+      share = "home";
+      mountPoint = "/mnt/yolo";
+    }
  ];

  boot.kernelParams = [
@@ -1,7 +1,4 @@
 { pkgs, ... }:
-let
-  sddm-noctalia-theme = pkgs.callPackage ../../../../pkgs/sddm-noctalia-theme/package.nix { };
-in
 {
  services.xserver = {
    enable = true;
@@ -15,7 +12,7 @@ in
  services.displayManager.sddm = {
    enable = true;
    wayland.enable = true;
-    theme = "sddm-noctalia";
+    theme = "sddm-astronaut-theme";
    package = pkgs.kdePackages.sddm;
    extraPackages = with pkgs.kdePackages; [
      qtmultimedia
@@ -26,6 +23,6 @@ in
  };

  environment.systemPackages = with pkgs; [
-    sddm-noctalia-theme
+    sddm-astronaut
  ];
 }
@@ -10,6 +10,13 @@
    portalPackage = inputs.hyprland.packages.${pkgs.stdenv.hostPlatform.system}.xdg-desktop-portal-hyprland;
  };

+  # swayosd (the volume/brightness OSD, configured in home) writes
+  # /sys/class/backlight/*/brightness directly. The package ships a udev rule
+  # that chgrps those files to `video`; without both the rule and the group,
+  # brightness keys pop the OSD but change nothing.
+  services.udev.packages = [ pkgs.swayosd ];
+  users.users.naps62.extraGroups = [ "video" ];
+
  # GTK/GNOME services still useful on Wayland
  programs.dconf.enable = true;

@@ -0,0 +1,28 @@
+{ inputs, lib, ... }:
+{
+  imports = [ inputs.nix-flatpak.nixosModules.nix-flatpak ];
+
+  services.flatpak = {
+    enable = true;
+
+    # mkOptionDefault so the module's default `flathub` remote is kept rather
+    # than replaced.
+    remotes = lib.mkOptionDefault [
+      {
+        name = "flathub-beta";
+        location = "https://flathub.org/beta-repo/flathub-beta.flatpakrepo";
+      }
+    ];
+
+    packages = [
+      # PrusaSlicer 3.x. As of 3.0 Prusa ships no Linux binary at all — Flathub
+      # is the only channel, and the alphas live in flathub-beta. Runs alongside
+      # pkgs.prusa-slicer (2.9.x, in home/common/programs/3d.nix): 3.x keeps its
+      # profiles in a separate PrusaSlicer3-dev config dir.
+      {
+        appId = "com.prusa3d.PrusaSlicer";
+        origin = "flathub-beta";
+      }
+    ];
+  };
+}
@@ -47,6 +47,11 @@
  # the module's own systemd.user.services.sunshine definition.
  systemd.user.services.sunshine.environment.LD_LIBRARY_PATH = "/run/opengl-driver/lib";

+  # hardware.uinput (pulled in by services.sunshine) makes /dev/uinput
+  # root:uinput 0660 and adds nobody to the group, so sunshine's virtual mouse
+  # and keyboard die with "Permission denied" and the stream takes no input.
+  users.groups.uinput.members = [ "naps62" ];
+
  # DualSense/DualShock emulation. Sunshine presents a *real* PS5 HID (touchpad,
  # motion, LEDs, rumble) via /dev/uhid, not plain uinput — a uinput pad can't
  # carry those features. The kernel uhid node is root-only (0600) with no udev
@@ -0,0 +1,10 @@
+{ pkgs, ... }:
+{
+  # Clipboard (and file) sync between hosts over the LAN. Moonlight/Sunshine
+  # carry no clipboard channel at all, so this is the only path between the
+  # streaming client and its host.
+  programs.kdeconnect = {
+    enable = true;
+    package = pkgs.kdePackages.kdeconnect-kde;
+  };
+}
@@ -11,11 +11,16 @@ _:
  # moonlight shows a black, artefacted picture rather than any error.
  systemd.user.services.sunshine.serviceConfig.LimitNOFILE = 65536;

+  # hardware.uinput (pulled in by services.sunshine) makes /dev/uinput
+  # root:uinput 0660 and adds nobody to the group, so sunshine's virtual mouse
+  # and keyboard die with "Permission denied" and the stream takes no input.
+  users.groups.uinput.members = [ "naps62" ];
+
  services.sunshine = {
    enable = true;
    autoStart = true;
    openFirewall = true;
-    capSysAdmin = false; # wlr-screencopy needs no CAP_SYS_ADMIN
+    capSysAdmin = true; # kms capture reads the scanout framebuffer via DRM

    settings = {
      # MUST be set. Auto-probe tries portalgrab first, and
@@ -23,11 +28,17 @@ _:
      # probe then hangs forever instead of falling back, so sunshine never
      # binds its ports and the unit sits "active" doing nothing.
      #
-      # "wlr", not "wlgrab": wlgrab is the name this backend logs under, but it
+      # "kms", not "wlr": the wlr backend takes wlr-screencopy's dmabuf path,
+      # which on this virtio-gpu returns empty buffers — sunshine encodes a flat
+      # frame (~50-byte P-frames) and every client shows black, with no error on
+      # either side. grim still works because it uses the shm path, and sunshine
+      # exposes no way to force shm.
+      #
+      # "wlr", not "wlgrab": wlgrab is the name that backend logs under, but it
      # is not accepted as a value — sunshine rejects it with "Unable to
      # initialize capture method", then still starts and binds its ports with
      # no encoder, so the failure only shows up as a 503 in moonlight.
-      capture = "wlr";
+      capture = "kms";

      # The web UI is only reachable over the network here — there is no local
      # browser — and sunshine CSRF-rejects any origin but localhost unless it
@@ -37,6 +48,12 @@ _:
      # and never strips brackets or quotes, so "[...]" makes every entry fail
      # its starts_with("https://") check.
      csrf_allowed_origins = "https://10.7.250.1:47990,https://10.7.10.2:47990";
+
+      # At the default 20, sunshine's FEC mangles large frames and moonlight
+      # draws horizontal bands over an otherwise-fine stream — no error on
+      # either side, and the network shows 0% loss. konishi carries the same
+      # workaround in its hand-written ~/.config/sunshine/sunshine.conf.
+      fec_percentage = 1;
    };
  };
 }
@@ -40,7 +40,10 @@ in
          };
          mountPoint = lib.mkOption {
            type = lib.types.str;
-            description = "Local mount point, e.g. \"/mnt/retroarch\".";
+            # MUST NOT live under $HOME: starship and eww stat every entry of the
+            # home dir, so a mount point there triggers the automount on every
+            # prompt and blocks for mount-timeout while the VPN is down.
+            description = "Local mount point outside $HOME, e.g. \"/mnt/retroarch\".";
          };
          user = lib.mkOption {
            type = lib.types.str;
@@ -23,6 +23,14 @@
    # GC is handled by `nh clean` below (keep-N / keep-since semantics).
    # The two are mutually exclusive — nh asserts if nix.gc.automatic is on.
    gc.automatic = false;
+
+    # Unauthenticated GitHub API calls (flake input fetches) are capped at
+    # 60/hr and 429 quickly. The token itself must not land in /nix/store
+    # (world-readable), so it lives in a plain file outside Nix's management —
+    # !include reads it at nix.conf parse time instead of embedding it.
+    extraOptions = ''
+      !include /etc/nix/github-token.conf
+    '';
  };

  # nh: ergonomic nixos-rebuild wrapper. Auto-detects the target from the
@@ -30,7 +38,9 @@
  # no host arg. Runs as root, so its `clean` prunes system + user profiles.
  programs.nh = {
    enable = true;
-    flake = "/home/naps62/projects/nixos-config";
+    # mkDefault: hosts whose clone lives elsewhere (yolo, under ~/tea) override
+    # this with a plain assignment.
+    flake = lib.mkDefault "/home/naps62/projects/nixos-config";
    clean = {
      enable = true;
      extraArgs = "--keep 10 --keep-since 7d";
@@ -13,18 +13,24 @@
    ../common/features/pipewire.nix
    ../common/features/docker.nix
    ../common/features/fonts.nix
+    ../common/features/kdeconnect.nix
    ../common/features/nix-ld.nix
    ../common/features/bluetooth.nix
    ../common/features/ledger.nix
    ../common/features/wine.nix
    ../common/features/gaming
    ../common/features/appimage.nix
+    ../common/features/flatpak.nix
    ../common/features/smb-mounts.nix
    ../common/features/home
  ];

  networking.hostName = "konishi";

+  # Set here rather than in hardware-configuration.nix so it survives a
+  # nixos-generate-config regeneration; the list merges with that file's.
+  fileSystems."/".options = [ "noatime" ];
+
  # NAS media share — reachable only over the wg-home VPN. Lazy automount, so it
  # never blocks boot and (re)mounts on first access once the VPN is up.
  custom.smbMounts = [
@@ -33,6 +39,12 @@
      share = "media";
      mountPoint = "/mnt/media";
    }
+    {
+      # yolo VM's /home/naps62 (share defined in hosts/yolo/default.nix).
+      server = "10.7.10.2";
+      share = "home";
+      mountPoint = "/mnt/yolo";
+    }
  ];

  # Arm Wake-on-LAN (magic packet) on the Intel igc NIC and re-apply it on every
@@ -17,7 +17,8 @@ qm create 132 --name yolo \
  --vga virtio-gl \
  --serial0 socket \
  --agent 1 \
-  --onboot 1
+  --onboot 1 \
+  --args '-display egl-headless,gl=core,rendernode=/dev/dri/renderD128'
 ```

 After creating the disk, drop its ZFS reservation — the `data` pool has no
@@ -27,12 +28,15 @@ After creating the disk, drop its ZFS reservation — the `data` pool has no
 zfs set refreservation=none data/vm-132-disk-1
 ```

-## The three that matter
+## The four that matter

-**`--vga virtio-gl`.** Not for speed — the host's virglrenderer falls back to
-llvmpipe either way. It is what lets mesa allocate GBM buffers. With plain
-`virtio` every capture fails with `Failed to create GBM buffer`, and sunshine
-streams a black picture while reporting no error at all.
+**`--vga virtio-gl`.** Lets mesa allocate GBM buffers. With plain `virtio`
+every capture fails with `Failed to create GBM buffer`, and sunshine streams a
+black picture while reporting no error at all.
+
+**`--args '-display egl-headless,...,rendernode=/dev/dri/renderD128'`.** Pins
+host-side rendering to the UHD 770. Without it the guest renders on llvmpipe —
+see below.

 **`--serial0 socket`.** `virtio-gl` renders through a GL context with no QEMU
 console surface, so the Proxmox noVNC console and `qm screendump` both go dark.
@@ -42,44 +46,36 @@ This plus `boot.kernelParams = [ "console=ttyS0,115200" ]` keeps
 **`--bios ovmf`.** `hosts/common/features/user.nix` uses systemd-boot, which
 needs UEFI. SeaBIOS gives an unbootable disk.

-## Known limit: no GPU acceleration
+## Why the render node has to be pinned

-The guest reports `virgl (LLVMPIPE)`, so compositing and capture readback are
-both on CPU. Hyprland delivers ~2fps at 2560x1440, sunshine asks for 60, and
-moonlight disconnects. Capture and encoding are otherwise fine — x264 manages
-1440p at 3x realtime here.
+pve 8.4.1 hardcodes `-display egl-headless,gl=core` in
+`/usr/share/perl5/PVE/QemuServer.pm` with no `rendernode=`. qemu then picks a
+node itself by scanning `/dev/dri` in `readdir` order and taking the first
+`renderD*` that opens. Here that lands on renderD129 — the nvidia card, which
+is reserved for LXCs. mesa cannot drive it, so virglrenderer falls back to
+software and the guest reports `virgl (LLVMPIPE)`: Hyprland manages ~2fps at
+2560x1440 while sunshine asks for 60, and moonlight disconnects.

-The host can do better: `iris_dri.so` is present and `i915` is loaded on
-renderD128 (the UHD 770; renderD129 is the nvidia card, reserved for LXCs and
-not available to VMs). Two things stop it being used:
-
- pve 8.4.1 hardcodes `-display egl-headless,gl=core` in
-  `/usr/share/perl5/PVE/QemuServer.pm` with no `rendernode=`, so qemu picks the
-  EGL device itself.
- `/usr/share/glvnd/egl_vendor.d/` lists `10_nvidia.json` ahead of
-  `50_mesa.json`, and lower wins — so EGL initialises against nvidia and falls
-  back to llvmpipe.
-
-To test the diagnosis without changing anything, start the VM with the mesa
-vendor forced:
+The `--args` line overrides this. PVE appends `args` after its own `-display`,
+and qemu's last `-display` wins, so rendering is pinned to renderD128 (the UHD
+770, `i915`) without touching the packaged perl — which any pve-manager upgrade
+would revert. Confirm from the guest:

 ```
-__EGL_VENDOR_LIBRARY_FILENAMES=/usr/share/glvnd/egl_vendor.d/50_mesa.json qm start 132
+grep "Renderer:" /run/user/1000/hypr/*/hyprland.log
 ```

-If the guest then reports `iris` rather than `LLVMPIPE`, persist it with a
-drop-in rather than by editing the packaged perl — drop-ins survive upgrades,
-and the nvidia LXCs are unaffected because they start via pve-container:
+`virgl (Mesa Intel(R) Graphics (RPL-S))` is correct; `LLVMPIPE` means the
+override is not taking. On the host, `ls -l /proc/$(cat
+/var/run/qemu-server/132.pid)/fd | grep dri` shows which node qemu actually
+holds.

-```
-systemctl edit pvedaemon
-  [Service]
-  Environment=__EGL_VENDOR_LIBRARY_FILENAMES=/usr/share/glvnd/egl_vendor.d/50_mesa.json
-```
+Forcing the EGL vendor instead (`__EGL_VENDOR_LIBRARY_FILENAMES=.../50_mesa.json`)
+does not help and was tried: the vendor was never the problem, the node was.

-Last resort only, if EGL still picks wrong: append
-`,rendernode=/dev/dri/renderD128` to the QemuServer.pm line above. That edits a
-packaged file and is reverted by any pve-manager upgrade.
+Encoding stays on x264. virgl accelerates GL only — the guest sees a
+virtio-gpu, not the Intel device, so there is no VAAPI/QuickSync encode path.
+Not a bottleneck: x264 manages 1440p at 3x realtime here.

 ## Network

@@ -14,6 +14,7 @@
    ../common/features/remote-desktop.nix
    ../common/features/docker.nix
    ../common/features/fonts.nix
+    ../common/features/kdeconnect.nix
    ../common/features/nix-ld.nix
    ../common/features/appimage.nix
    ../common/features/home
@@ -24,21 +25,25 @@
  # screen and reports no error.
  networking.hostName = "yolo";

-  # Lets the Proxmox host drive clean shutdowns/reboots and report the guest's
-  # IP. The qemu-guest profile in hardware-configuration.nix only sets up the
-  # virtio drivers; the agent itself is a separate service.
-  services.qemuGuest.enable = true;
-
  # Hung shutdown waiting on systemd-zram-setup@zram0: deactivating zram swap
  # has to fault every stored page back into RAM first. Redundant here anyway —
  # this VM has a real 8G swap partition, and the host manages its own memory.
  zramSwap.enable = lib.mkForce false;

-  # The only out-of-band way in. `vga: virtio-gl` renders through a GL context
-  # with no QEMU console surface, so noVNC and screendump both go dark; this
-  # pairs with the VM's serial0 socket to keep `qm terminal` working. Listed
-  # last so it wins /dev/console and gets the getty.
  boot.kernelParams = [
+    # When the host pages this VM's memory out, KVM's async page fault parks
+    # the faulting task in an uninterruptible wait instead of stalling the
+    # whole vCPU. If the "page ready" wakeup is ever dropped, that task is
+    # wedged forever and SIGKILL cannot touch it — it took out maestro-web,
+    # nix activation generators and a dozen agent sessions, a few per day,
+    # until a reboot. Disabling async PF makes host page-ins stall the vCPU
+    # synchronously: slower under host memory pressure, but nothing hangs.
+    "no-kvmapf"
+
+    # The only out-of-band way in. `vga: virtio-gl` renders through a GL
+    # context with no QEMU console surface, so noVNC and screendump both go
+    # dark; this pairs with the VM's serial0 socket to keep `qm terminal`
+    # working. Listed last so it wins /dev/console and gets the getty.
    "console=tty1"
    "console=ttyS0,115200"
  ];
@@ -54,35 +59,65 @@
  environment.systemPackages = [ pkgs.git ];

  # This clone lives under ~/tea, not the ~/projects path global/nix.nix assumes.
-  programs.nh.flake = lib.mkForce "/home/naps62/tea/nixos-config";
+  programs.nh.flake = "/home/naps62/tea/nixos-config";

-  # No physical seat: Sunshine is a user service and cannot capture until a
-  # graphical session exists, so a cold boot must reach one unattended. No
-  # hyprlock on start (unlike konishi) — nobody could type the password in.
-  services.displayManager = {
-    autoLogin = {
+  services = {
+    # Lets the Proxmox host drive clean shutdowns/reboots and report the guest's
+    # IP. The qemu-guest profile in hardware-configuration.nix only sets up the
+    # virtio drivers; the agent itself is a separate service.
+    qemuGuest.enable = true;
+
+    # Exposes /home/naps62 to arrakis/konishi (custom.smbMounts on both, mounted
+    # at ~/yolo). Guest auth — the home dir holds SSH keys and credentials, so
+    # the only guard is `hosts allow` limiting clients to the wireguard subnet
+    # (desktops connect from wg addresses, 10.10.*).
+    # Clients address this VM as 10.7.10.2; keep that DHCP lease reserved.
+    samba = {
      enable = true;
-      user = "naps62";
-    };
-    defaultSession = "hyprland";
-  };
-
-  # A Proxmox guest has no emulated sound card, so PipeWire starts with no sink
-  # and Sunshine has nothing to capture — the stream is silent. This sink is the
-  # only one, so it wins the default and Sunshine records its monitor.
-  services.pipewire.extraConfig.pipewire."10-null-sink" = {
-    "context.objects" = [
-      {
-        factory = "adapter";
-        args = {
-          "factory.name" = "support.null-audio-sink";
-          "node.name" = "sunshine-sink";
-          "node.description" = "Sunshine";
-          "media.class" = "Audio/Sink";
-          "audio.position" = "FL,FR";
+      openFirewall = true;
+      settings = {
+        global = {
+          "map to guest" = "bad user";
+          "hosts allow" = "10.10.0.0/16 127.0.0.1";
+          "hosts deny" = "ALL";
        };
-      }
-    ];
-  };
+        home = {
+          path = "/home/naps62";
+          "read only" = "no";
+          "guest ok" = "yes";
+          "force user" = "naps62";
+          "force group" = "users";
+        };
+      };
+    };

+    # No physical seat: Sunshine is a user service and cannot capture until a
+    # graphical session exists, so a cold boot must reach one unattended. No
+    # hyprlock on start (unlike konishi) — nobody could type the password in.
+    displayManager = {
+      autoLogin = {
+        enable = true;
+        user = "naps62";
+      };
+      defaultSession = "hyprland";
+    };
+
+    # A Proxmox guest has no emulated sound card, so PipeWire starts with no
+    # sink and Sunshine has nothing to capture — the stream is silent. This sink
+    # is the only one, so it wins the default and Sunshine records its monitor.
+    pipewire.extraConfig.pipewire."10-null-sink" = {
+      "context.objects" = [
+        {
+          factory = "adapter";
+          args = {
+            "factory.name" = "support.null-audio-sink";
+            "node.name" = "sunshine-sink";
+            "node.description" = "Sunshine";
+            "media.class" = "Audio/Sink";
+            "audio.position" = "FL,FR";
+          };
+        }
+      ];
+    };
+  };
 }
@@ -0,0 +1,72 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchurl,
+  autoPatchelfHook,
+  makeWrapper,
+  stdenv,
+}:
+let
+  version = "0.84.2";
+
+  # Prebuilt Bun executables from the release page. Bump version + hashes from
+  # the SHA256SUMS asset:
+  #   https://github.com/earendil-works/pi/releases
+  sources = {
+    x86_64-linux = {
+      asset = "pi-linux-x64.tar.gz";
+      hash = "sha256-kG++eH/SJcSsYk/n69Wx1Vpg4PXH71F5XSMVZPnuHBM=";
+    };
+    aarch64-linux = {
+      asset = "pi-linux-arm64.tar.gz";
+      hash = "sha256-0VNy2p5LTF/vn9Fb7XbX9fFyDdOf583g7GLltlrWPvE=";
+    };
+  };
+
+  source =
+    sources.${stdenvNoCC.hostPlatform.system}
+      or (throw "pi: unsupported system ${stdenvNoCC.hostPlatform.system}");
+in
+stdenvNoCC.mkDerivation {
+  pname = "pi";
+  inherit version;
+
+  src = fetchurl {
+    url = "https://github.com/earendil-works/pi/releases/download/v${version}/${source.asset}";
+    inherit (source) hash;
+  };
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+    makeWrapper
+  ];
+
+  # libgcc, for the bundled native clipboard module.
+  buildInputs = [ (lib.getLib stdenv.cc.cc) ];
+
+  installPhase = ''
+    runHook preInstall
+
+    # The binary resolves its themes, bundled node_modules and wasm relative to
+    # itself, so the whole tree ships together and only `pi` gets a wrapper.
+    mkdir -p $out/share/pi
+    cp -r . $out/share/pi/
+    chmod +x $out/share/pi/pi
+
+    # Nix owns updates here; `pi update --self` would write into the store.
+    makeWrapper $out/share/pi/pi $out/bin/pi \
+      --set-default PI_SKIP_VERSION_CHECK 1
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Pi coding agent CLI";
+    homepage = "https://pi.dev";
+    changelog = "https://github.com/earendil-works/pi/releases/tag/v${version}";
+    license = lib.licenses.mit;
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
+    platforms = lib.attrNames sources;
+    mainProgram = "pi";
+  };
+}
@@ -1,33 +0,0 @@
-{ pkgs, ... }:
-
-pkgs.stdenv.mkDerivation {
-  pname = "sddm-noctalia-theme";
-  version = "1.0";
-
-  src = pkgs.fetchFromGitHub {
-    owner = "mahaveergurjar";
-    repo = "sddm";
-    rev = "noctalia";
-    sha256 = "sha256-e/gYI6znHXxlDCOVh4p265x3kO0nQUU897hCY1yEz88=";
-  };
-
-  installPhase = ''
-    mkdir -p $out/share/sddm/themes/sddm-noctalia
-    cp -r * $out/share/sddm/themes/sddm-noctalia/
-
-    # Patch for Qt6 SDDM greeter compatibility
-    # SDDM reads QtVersion from metadata.desktop to find the greeter binary;
-    # default is 5 (sddm-greeter), we need 6 (sddm-greeter-qt6)
-    substituteInPlace $out/share/sddm/themes/sddm-noctalia/metadata.desktop \
-      --replace-fail "Theme-Id=noctalia" "QtVersion=6
-    Theme-Id=noctalia"
-
-  '';
-
-  meta = with pkgs.lib; {
-    description = "Noctalia-themed SDDM login theme";
-    homepage = "https://github.com/mahaveergurjar/sddm/tree/noctalia";
-    license = licenses.gpl3;
-    platforms = platforms.linux;
-  };
-}
				`@@ -1 +0,0 @@`
				`Screenshots: stored in ~/downloads/screenshots, with date time in the filename`