feat(open-proxy): configure shared token file

Move mosh/unzip into common home packages, add orca-slicer to the thinkpad home, and remove the now-redundant system package list and kernel param.

flake.lock

@@ -28,16 +28,16 @@
         ]
       },
       "locked": {
-        "lastModified": 1772129556,
+        "lastModified": 1779036909,
-        "narHash": "sha256-Utk0zd8STPsUJPyjabhzPc5BpPodLTXrwkpXBHYnpeg=",
+        "narHash": "sha256-zXcwYQGCT6pzinK+1dBB2ekTVtfxGZAapb3Evdcu4fY=",
         "owner": "nix-darwin",
         "repo": "nix-darwin",
-        "rev": "ebec37af18215214173c98cf6356d0aca24a2585",
+        "rev": "56c666e108467d87d13508936aade6d567f2a501",
         "type": "github"
       },
       "original": {
         "owner": "nix-darwin",
-        "ref": "nix-darwin-25.11",
+        "ref": "nix-darwin-26.05",
         "repo": "nix-darwin",
         "type": "github"
       }
@@ -278,16 +278,16 @@
         ]
       },
       "locked": {
-        "lastModified": 1778401693,
+        "lastModified": 1780361225,
-        "narHash": "sha256-OVHdCqXXUF5UdGkH+FF2ZL06OLZjj2kvP2dIUmzVWoo=",
+        "narHash": "sha256-wnV9ttf4fPWNonBIQmvlrSlNpQYgx5HgWWd007mwIFA=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "389b83002efc26f1145e89a6a8e6edc5a6435948",
+        "rev": "e28654b71096e08c019d4861ca26acb646f583d8",
         "type": "github"
       },
       "original": {
         "owner": "nix-community",
-        "ref": "release-25.11",
+        "ref": "release-26.05",
         "repo": "home-manager",
         "type": "github"
       }
@@ -443,16 +443,16 @@
     },
     "nixpkgs_4": {
       "locked": {
-        "lastModified": 1778003029,
+        "lastModified": 1780203844,
-        "narHash": "sha256-q/nkKLDtHIyLjZpKhWk3cSK5IYsFqtMd6UtXF3ddjgA=",
+        "narHash": "sha256-K5sT4jTpGs15ADhviMKNBH38REpPf5Q6mM1+N6cArVE=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "0c88e1f2bdb93d5999019e99cb0e61e1fe2af4c5",
+        "rev": "b51242d7d43689db2f3be91bd05d5b24fbb469c4",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-25.11",
+        "ref": "nixos-26.05",
         "repo": "nixpkgs",
         "type": "github"
       }

flake.nix

@@ -2,7 +2,7 @@
   description = "NixOS Hosts";
 
   inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05";
     nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixos-unstable";
     disko.url = "github:nix-community/disko";
     determinate.url = "github:determinatesystems/determinate";
@@ -11,7 +11,7 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
     home-manager = {
-      url = "github:nix-community/home-manager/release-25.11";
+      url = "github:nix-community/home-manager/release-26.05";
       inputs.nixpkgs.follows = "nixpkgs";
     };
     apple-silicon = {
@@ -31,7 +31,7 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
     darwin = {
-      url = "github:nix-darwin/nix-darwin/nix-darwin-25.11";
+      url = "github:nix-darwin/nix-darwin/nix-darwin-26.05";
       inputs.nixpkgs.follows = "nixpkgs";
     };
   };

homes/aarch64-darwin/evanreichard@mac-va-mbp-personal/default.nix

@@ -7,7 +7,7 @@ let
   inherit (lib.${namespace}) enabled;
 in
 {
-  home.stateVersion = "25.11";
+  home.stateVersion = "26.05";
 
   reichard = {
     user = {

homes/aarch64-darwin/evanreichard@mac-va-mbp-work/default.nix

@@ -8,7 +8,7 @@ let
   inherit (lib.${namespace}) enabled;
 in
 {
-  home.stateVersion = "25.11";
+  home.stateVersion = "26.05";
 
   reichard = {
     user = {
@@ -41,6 +41,7 @@ in
 
     services = {
       sketchybar = enabled;
+      open-proxy.server = enabled;
     };
 
     security = {

homes/aarch64-darwin/evanreichard@mac-va-mbp-work/vm-init.sh

@@ -33,6 +33,16 @@ else
     echo "  [✓] VM SOCKS Proxy Already Running"
 fi
 
+# Reverse tunnel so the VM's `open`/`xdg-open` reach open-proxy serve on this host.
+if ! pgrep -f "ssh -N -R 7777:127.0.0.1:7777 adios-cs" > /dev/null; then
+    echo "  [*] VM Open Proxy Starting..."
+    ssh -N -R 7777:127.0.0.1:7777 adios-cs &> /dev/null &
+    disown
+    echo "  [✓] VM Open Proxy Started"
+else
+    echo "  [✓] VM Open Proxy Already Running"
+fi
+
 echo -e "  [*] Connecting..."
 
 # Connect to VM

homes/aarch64-linux/evanreichard@lin-va-mbp-personal/default.nix

@@ -9,7 +9,7 @@ let
   inherit (lib.${namespace}) enabled;
 in
 {
-  home.stateVersion = "25.11";
+  home.stateVersion = "26.05";
 
   reichard = {
     user = {
@@ -20,7 +20,7 @@ in
     services = {
       ssh-agent = enabled;
       fusuma = enabled;
-      swww = enabled;
+      awww = enabled;
     };
 
     security = {
@@ -58,6 +58,7 @@ in
 
   home.packages = with pkgs; [
     orca-slicer
+    reichard.tuxguitar
   ];
 
   dconf = {

homes/aarch64-linux/evanreichard@lin-va-mbp-work-vm/default.nix

@@ -7,7 +7,7 @@ let
   inherit (lib.${namespace}) enabled;
 in
 {
-  home.stateVersion = "25.11";
+  home.stateVersion = "26.05";
 
   reichard = {
     user = {
@@ -17,6 +17,7 @@ in
 
     services = {
       ssh-agent = enabled;
+      open-proxy.client = enabled;
     };
 
     security = {

homes/aarch64-raw-efi/evanreichard@lin-terminal-image/default.nix

@@ -7,7 +7,7 @@ let
   inherit (lib.${namespace}) enabled;
 in
 {
-  home.stateVersion = "25.11";
+  home.stateVersion = "26.05";
 
   reichard = {
     user = {

homes/x86_64-linux/evanreichard@lin-va-desktop/default.nix

@@ -7,7 +7,7 @@ let
   inherit (lib.${namespace}) enabled;
 in
 {
-  home.stateVersion = "25.11";
+  home.stateVersion = "26.05";
 
   reichard = {
     user = {

homes/x86_64-linux/evanreichard@lin-va-terminal/default.nix

@@ -8,7 +8,7 @@ let
   inherit (lib.${namespace}) enabled;
 in
 {
-  home.stateVersion = "25.11";
+  home.stateVersion = "26.05";
 
   reichard = {
     user = {

homes/x86_64-linux/evanreichard@lin-va-thinkpad/default.nix

@@ -9,7 +9,7 @@ let
   inherit (lib.${namespace}) enabled;
 in
 {
-  home.stateVersion = "25.11";
+  home.stateVersion = "26.05";
 
   reichard = {
     user = {
@@ -20,7 +20,7 @@ in
     services = {
       ssh-agent = enabled;
       fusuma = enabled;
-      swww = enabled;
+      awww = enabled;
       poweralertd = enabled;
     };
 
@@ -68,6 +68,10 @@ in
     };
   };
 
+  home.packages = with pkgs; [
+    orca-slicer
+  ];
+
   home.pointerCursor = {
     gtk.enable = true;
     name = "catppuccin-macchiato-mauve-cursors";

homes/x86_64-linux/evanreichard@lin-va-utility/default.nix

@@ -20,7 +20,7 @@ in
     services = {
       ssh-agent = enabled;
       fusuma = enabled;
-      swww = enabled;
+      awww = enabled;
     };
 
     security = {

modules/home/common/default.nix

@@ -2,11 +2,13 @@
 {
 
   home.packages = with pkgs; [
-    sqlite-interactive
     jnv
     jq
+    mosh
     ncdu
-    ripgrep
     reichard.codexis
+    ripgrep
+    sqlite-interactive
+    unzip
   ];
 }

modules/home/programs/graphical/browsers/firefox/default.nix

@@ -1,4 +1,9 @@
-{ config, lib, pkgs, namespace, ... }:
+{ config
+, lib
+, pkgs
+, namespace
+, ...
+}:
 let
   inherit (lib)
     types
@@ -62,40 +67,47 @@ in
     extensions.packages = mkOpt (with lib.types; listOf package)
       (with pkgs.firefox-addons; [
         bitwarden
+        pkgs.firefox-addons."ctrl-number-to-switch-tabs"
         darkreader
         gruvbox-dark-theme
         kagi-search
         sponsorblock
         ublock-origin
-
-        # bypass-paywalls-clean
       ]) "Extensions to install";
   };
 
   config = mkIf cfg.enable {
     programs.firefox = {
       enable = true;
+      configPath = ".mozilla/firefox";
 
       inherit (cfg) policies;
 
       profiles = {
         ${config.${namespace}.user.name} = {
-          inherit (cfg) extraConfig extensions;
+          inherit (cfg) extraConfig;
           inherit (config.${namespace}.user) name;
 
+          extensions = {
+            packages = cfg.extensions.packages;
+            force = true;
+          };
+
           id = 0;
 
           settings = mkMerge [
             cfg.settings
             {
               "browser.aboutConfig.showWarning" = false;
+              "extensions.autoDisableScopes" = 0;
+              "extensions.activeThemeID" = "{eb8c4a94-e603-49ef-8e81-73d3c4cc04ff}";
               "browser.aboutwelcome.enabled" = false;
               "browser.sessionstore.warnOnQuit" = true;
               "browser.newtabpage.activity-stream.showSponsoredTopSites" = false;
               "browser.shell.checkDefaultBrowser" = false;
               "general.smoothScroll.msdPhysics.enabled" = true;
               "intl.accept_languages" = "en-US,en";
-              "ui.key.accelKey" = "224";
+              "ui.key.accelKey" = 91;
 
               # "devtools.chrome.enabled" = true;
               # "xpinstall.signatures.required" = false;

modules/home/programs/graphical/wms/hyprland/config/hyprland.conf

@@ -1,154 +0,0 @@
-exec-once = uwsm app -- waybar
-exec-once = uwsm app -- $terminal
-exec-once = uwsm app -- firefox
-
-general {
-    gaps_in = 5
-    gaps_out = 12
-
-    border_size = 2
-
-    # https://wiki.hyprland.org/Configuring/Variables/#variable-types for info about colors
-    col.active_border = rgba(33ccffee) rgba(00ff99ee) 45deg
-    col.inactive_border = rgba(595959aa)
-
-    # Set to true enable resizing windows by clicking and dragging on borders and gaps
-    resize_on_border = false
-
-    # Please see https://wiki.hyprland.org/Configuring/Tearing/ before you turn this on
-    allow_tearing = false
-
-    layout = dwindle
-}
-
-# https://wiki.hyprland.org/Configuring/Variables/#decoration
-decoration {
-    rounding = 10
-
-    active_opacity = 1.0
-    inactive_opacity = 1.0
-
-    shadow {
-        enabled = true
-        range = 4
-        render_power = 3
-        color = rgba(1a1a1aee)
-    }
-
-    blur {
-        enabled = true
-        size = 3
-        passes = 1
-        vibrancy = 0.1696
-    }
-}
-
-# https://wiki.hyprland.org/Configuring/Variables/#animations
-animations {
-    enabled = yes, please :)
-
-
-    bezier = easeOutQuint,0.23,1,0.32,1
-    bezier = easeInOutCubic,0.65,0.05,0.36,1
-    bezier = linear,0,0,1,1
-    bezier = almostLinear,0.5,0.5,0.75,1.0
-    bezier = quick,0.15,0,0.1,1
-
-    animation = global, 1, 10, default
-    animation = border, 1, 5.39, easeOutQuint
-    animation = windows, 1, 4.79, easeOutQuint
-    animation = windowsIn, 1, 4.1, easeOutQuint, popin 87%
-    animation = windowsOut, 1, 1.49, linear, popin 87%
-    animation = fadeIn, 1, 1.73, almostLinear
-    animation = fadeOut, 1, 1.46, almostLinear
-    animation = fade, 1, 3.03, quick
-    animation = layers, 1, 3.81, easeOutQuint
-    animation = layersIn, 1, 4, easeOutQuint, fade
-    animation = layersOut, 1, 1.5, linear, fade
-    animation = fadeLayersIn, 1, 1.79, almostLinear
-    animation = fadeLayersOut, 1, 1.39, almostLinear
-    animation = workspaces, 1, 1.94, almostLinear, fade
-    animation = workspacesIn, 1, 1.21, almostLinear, fade
-    animation = workspacesOut, 1, 1.94, almostLinear, fade
-}
-
-# Ref https://wiki.hyprland.org/Configuring/Workspace-Rules/
-# "Smart gaps" / "No gaps when only"
-# uncomment all if you wish to use that.
-# workspace = w[tv1], gapsout:0, gapsin:0
-# workspace = f[1], gapsout:0, gapsin:0
-# windowrulev2 = bordersize 0, floating:0, onworkspace:w[tv1]
-# windowrulev2 = rounding 0, floating:0, onworkspace:w[tv1]
-# windowrulev2 = bordersize 0, floating:0, onworkspace:f[1]
-# windowrulev2 = rounding 0, floating:0, onworkspace:f[1]
-
-# See https://wiki.hyprland.org/Configuring/Dwindle-Layout/ for more
-dwindle {
-    pseudotile = true # Master switch for pseudotiling. Enabling is bound to mainMod + P in the keybinds section below
-    preserve_split = true # You probably want this
-}
-
-# See https://wiki.hyprland.org/Configuring/Master-Layout/ for more
-master {
-    new_status = master
-}
-
-# https://wiki.hyprland.org/Configuring/Variables/#misc
-misc {
-    force_default_wallpaper = -1 # Set to 0 or 1 to disable the anime mascot wallpapers
-    disable_hyprland_logo = false # If true disables the random hyprland logo / anime girl background. :(
-}
-
-
-#############
-### INPUT ###
-#############
-
-# https://wiki.hyprland.org/Configuring/Variables/#input
-input {
-    kb_layout = us
-    kb_variant =
-    kb_model =
-    kb_options =
-    kb_rules =
-
-    follow_mouse = 1
-
-    sensitivity = 0.0 # -1.0 - 1.0, 0 means no modification.
-
-    touchpad {
-        scroll_factor = 0.5
-        disable_while_typing = true
-        natural_scroll = true
-        clickfinger_behavior = true
-        tap-to-click = false
-    }
-}
-
-# https://wiki.hyprland.org/Configuring/Variables/#gestures
-gesture = 4, horizontal, workspace, invert
-
-# Thinkpad Trackpoint
-device {
-    name = tpps/2-elan-trackpoint
-    sensitivity = -0.3
-}
-
-##############################
-### WINDOWS AND WORKSPACES ###
-##############################
-
-# See https://wiki.hyprland.org/Configuring/Window-Rules/ for more
-# See https://wiki.hyprland.org/Configuring/Workspace-Rules/ for workspace rules
-
-# Example windowrule v1
-# windowrule = float, ^(kitty)$
-
-# Example windowrule v2
-# windowrulev2 = float,class:^(kitty)$,title:^(kitty)$
-
-# Ignore maximize requests from apps. You'll probably like this.
-windowrulev2 = suppressevent maximize, class:.*
-
-# Fix some dragging issues with XWayland
-windowrulev2 = nofocus,class:^$,title:^$,xwayland:1,floating:1,fullscreen:0,pinned:0

modules/home/programs/graphical/wms/hyprland/config/hyprland.lua

@@ -0,0 +1,217 @@
+-- Hyprland config (lua backend, Hyprland 0.55+).
+-- `mainMod`, `menuMod`, and the monitor(s) are injected by Nix above this file.
+-- See https://wiki.hypr.land/Configuring/Start/
+
+local terminal = "ghostty"
+local menu     = "wofi --show drun"
+
+-------------------
+---- AUTOSTART ----
+-------------------
+
+hl.on("hyprland.start", function()
+    hl.exec_cmd("uwsm app -- waybar")
+    hl.exec_cmd("uwsm app -- " .. terminal)
+    hl.exec_cmd("uwsm app -- firefox")
+end)
+
+-----------------------
+---- LOOK AND FEEL ----
+-----------------------
+
+hl.config({
+    general = {
+        gaps_in  = 5,
+        gaps_out = 12,
+
+        border_size = 2,
+
+        col = {
+            active_border   = { colors = { "rgba(33ccffee)", "rgba(00ff99ee)" }, angle = 45 },
+            inactive_border = "rgba(595959aa)",
+        },
+
+        resize_on_border = false,
+        allow_tearing    = false,
+
+        layout = "dwindle",
+    },
+
+    decoration = {
+        rounding = 10,
+
+        active_opacity   = 1.0,
+        inactive_opacity = 1.0,
+
+        shadow = {
+            enabled      = true,
+            range        = 4,
+            render_power = 3,
+            color        = 0xee1a1a1a,
+        },
+
+        blur = {
+            enabled  = true,
+            size     = 3,
+            passes   = 1,
+            vibrancy = 0.1696,
+        },
+    },
+
+    animations = {
+        enabled = true,
+    },
+
+    dwindle = {
+        preserve_split = true,
+    },
+
+    master = {
+        new_status = "master",
+    },
+
+    misc = {
+        force_default_wallpaper = -1,
+        disable_hyprland_logo   = false,
+    },
+})
+
+----------------------
+---- ANIMATIONS ------
+----------------------
+
+hl.curve("easeOutQuint",   { type = "bezier", points = { { 0.23, 1 },    { 0.32, 1 } } })
+hl.curve("easeInOutCubic", { type = "bezier", points = { { 0.65, 0.05 }, { 0.36, 1 } } })
+hl.curve("linear",         { type = "bezier", points = { { 0, 0 },       { 1, 1 } } })
+hl.curve("almostLinear",   { type = "bezier", points = { { 0.5, 0.5 },   { 0.75, 1 } } })
+hl.curve("quick",          { type = "bezier", points = { { 0.15, 0 },    { 0.1, 1 } } })
+
+hl.animation({ leaf = "global",        enabled = true, speed = 10,   bezier = "default" })
+hl.animation({ leaf = "border",        enabled = true, speed = 5.39, bezier = "easeOutQuint" })
+hl.animation({ leaf = "windows",       enabled = true, speed = 4.79, bezier = "easeOutQuint" })
+hl.animation({ leaf = "windowsIn",     enabled = true, speed = 4.1,  bezier = "easeOutQuint", style = "popin 87%" })
+hl.animation({ leaf = "windowsOut",    enabled = true, speed = 1.49, bezier = "linear",       style = "popin 87%" })
+hl.animation({ leaf = "fadeIn",        enabled = true, speed = 1.73, bezier = "almostLinear" })
+hl.animation({ leaf = "fadeOut",       enabled = true, speed = 1.46, bezier = "almostLinear" })
+hl.animation({ leaf = "fade",          enabled = true, speed = 3.03, bezier = "quick" })
+hl.animation({ leaf = "layers",        enabled = true, speed = 3.81, bezier = "easeOutQuint" })
+hl.animation({ leaf = "layersIn",      enabled = true, speed = 4,    bezier = "easeOutQuint", style = "fade" })
+hl.animation({ leaf = "layersOut",     enabled = true, speed = 1.5,  bezier = "linear",       style = "fade" })
+hl.animation({ leaf = "fadeLayersIn",  enabled = true, speed = 1.79, bezier = "almostLinear" })
+hl.animation({ leaf = "fadeLayersOut", enabled = true, speed = 1.39, bezier = "almostLinear" })
+hl.animation({ leaf = "workspaces",    enabled = true, speed = 1.94, bezier = "almostLinear", style = "fade" })
+hl.animation({ leaf = "workspacesIn",  enabled = true, speed = 1.21, bezier = "almostLinear", style = "fade" })
+hl.animation({ leaf = "workspacesOut", enabled = true, speed = 1.94, bezier = "almostLinear", style = "fade" })
+
+---------------
+---- INPUT ----
+---------------
+
+hl.config({
+    input = {
+        kb_layout  = "us",
+        kb_variant = "",
+        kb_model   = "",
+        kb_options = "",
+        kb_rules   = "",
+
+        follow_mouse = 1,
+        sensitivity  = 0.0,
+
+        touchpad = {
+            scroll_factor        = 0.5,
+            disable_while_typing = true,
+            natural_scroll       = true,
+            clickfinger_behavior = true,
+            tap_to_click         = false,
+        },
+    },
+})
+
+-- 4-finger horizontal swipe to switch workspaces. The old `invert` modifier was
+-- removed in the 0.51 gesture rework; flip the physical swipe direction if needed.
+hl.gesture({ fingers = 4, direction = "horizontal", action = "workspace" })
+
+-- Thinkpad Trackpoint
+hl.device({ name = "tpps/2-elan-trackpoint", sensitivity = -0.3 })
+
+---------------------
+---- KEYBINDINGS ----
+---------------------
+
+-- Menu Mod Bindings (macOS Transition - Spotlight & Screenshots)
+hl.bind(menuMod .. " + SPACE",     hl.dsp.exec_cmd(menu))
+hl.bind(menuMod .. " + SHIFT + 1", hl.dsp.exec_cmd("hyprshot -m output"))
+hl.bind(menuMod .. " + SHIFT + 2", hl.dsp.exec_cmd("hyprshot -m window"))
+hl.bind(menuMod .. " + SHIFT + 3", hl.dsp.exec_cmd("hyprshot -m region"))
+hl.bind(menuMod .. " + Q",         hl.dsp.window.close())
+
+-- Primary Bindings
+hl.bind(mainMod .. " + RETURN", hl.dsp.exec_cmd(terminal))
+hl.bind(mainMod .. " + M",      hl.dsp.exec_cmd("uwsm stop"))
+hl.bind(mainMod .. " + V",      hl.dsp.window.float({ action = "toggle" }))
+hl.bind(mainMod .. " + P",      hl.dsp.window.pin())
+hl.bind(mainMod .. " + J",      hl.dsp.layout("togglesplit"))
+hl.bind(mainMod .. " + S",         hl.dsp.workspace.toggle_special("magic"))
+hl.bind(mainMod .. " + SHIFT + S", hl.dsp.window.move({ workspace = "special:magic" }))
+
+-- Window Focus
+hl.bind(mainMod .. " + left",  hl.dsp.focus({ direction = "left" }))
+hl.bind(mainMod .. " + right", hl.dsp.focus({ direction = "right" }))
+hl.bind(mainMod .. " + up",    hl.dsp.focus({ direction = "up" }))
+hl.bind(mainMod .. " + down",  hl.dsp.focus({ direction = "down" }))
+
+-- Workspace switch + move active window to workspace (1-9, 0 -> 10)
+for i = 1, 10 do
+    local key = i % 10
+    hl.bind(mainMod .. " + " .. key,         hl.dsp.focus({ workspace = i }))
+    hl.bind(mainMod .. " + SHIFT + " .. key, hl.dsp.window.move({ workspace = i }))
+end
+
+hl.bind(mainMod .. " + SHIFT + right", hl.dsp.focus({ workspace = "+1" }))
+hl.bind(mainMod .. " + SHIFT + left",  hl.dsp.focus({ workspace = "-1" }))
+
+-- Window move/resize with mouse
+hl.bind(mainMod .. " + mouse:272", hl.dsp.window.drag(),   { mouse = true })
+hl.bind(mainMod .. " + mouse:273", hl.dsp.window.resize(), { mouse = true })
+
+-- Multimedia & Brightness Keys
+hl.bind("XF86AudioRaiseVolume",  hl.dsp.exec_cmd("wpctl set-volume @DEFAULT_AUDIO_SINK@ 5%+"),    { locked = true, repeating = true })
+hl.bind("XF86AudioLowerVolume",  hl.dsp.exec_cmd("wpctl set-volume @DEFAULT_AUDIO_SINK@ 5%-"),    { locked = true, repeating = true })
+hl.bind("XF86AudioMute",         hl.dsp.exec_cmd("wpctl set-mute @DEFAULT_AUDIO_SINK@ toggle"),   { locked = true, repeating = true })
+hl.bind("XF86AudioMicMute",      hl.dsp.exec_cmd("wpctl set-mute @DEFAULT_AUDIO_SOURCE@ toggle"), { locked = true, repeating = true })
+hl.bind("XF86MonBrightnessUp",   hl.dsp.exec_cmd("brightnessctl s 4%+"),                          { locked = true, repeating = true })
+hl.bind("XF86MonBrightnessDown", hl.dsp.exec_cmd("brightnessctl s 5%-"),                          { locked = true, repeating = true })
+
+-- macOS Keyboard Brightness
+hl.bind(menuMod .. " + XF86MonBrightnessUp",   hl.dsp.exec_cmd("brightnessctl -d kbd_backlight s 10%+"), { locked = true, repeating = true })
+hl.bind(menuMod .. " + XF86MonBrightnessDown", hl.dsp.exec_cmd("brightnessctl -d kbd_backlight s 10%-"), { locked = true, repeating = true })
+
+-- Player Controls
+hl.bind("XF86AudioNext",  hl.dsp.exec_cmd("playerctl next"),       { locked = true })
+hl.bind("XF86AudioPause", hl.dsp.exec_cmd("playerctl play-pause"), { locked = true })
+hl.bind("XF86AudioPlay",  hl.dsp.exec_cmd("playerctl play-pause"), { locked = true })
+hl.bind("XF86AudioPrev",  hl.dsp.exec_cmd("playerctl previous"),   { locked = true })
+
+--------------------------------
+---- WINDOWS AND WORKSPACES ----
+--------------------------------
+
+hl.window_rule({
+    name           = "suppress-maximize-events",
+    match          = { class = ".*" },
+    suppress_event = "maximize",
+})
+
+hl.window_rule({
+    name  = "fix-xwayland-drags",
+    match = {
+        class      = "^$",
+        title      = "^$",
+        xwayland   = true,
+        float      = true,
+        fullscreen = false,
+        pin        = false,
+    },
+    no_focus = true,
+})

modules/home/programs/graphical/wms/hyprland/default.nix

@@ -24,90 +24,27 @@ in
 
     wayland.windowManager.hyprland = {
       enable = true;
-      extraConfig = builtins.readFile ./config/hyprland.conf;
+      # Lua Backend - Hyprland 0.55 deprecated hyprlang and home-manager 26.05 defaults configType to "lua".
-      settings = {
+      configType = "lua";
-        "$mainMod" = cfg.mainMod;
+      extraConfig =
-        "$menuMod" = cfg.menuMod;
+        let
-        "$terminal" = "ghostty";
+          # Quote unless the value is numeric, so scale can be `2` or `"auto"`.
-        "$menu" = "wofi --show drun";
+          luaScalar = v: if builtins.match "[0-9]+(\\.[0-9]+)?" v != null then v else ''"${v}"'';
+          mkMonitor =
+            s:
+            let
+              parts = map lib.trim (lib.splitString "," s);
+              field = i: if builtins.length parts > i then builtins.elemAt parts i else "";
+            in
+            ''hl.monitor({ output = "${field 0}", mode = "${field 1}", position = "${field 2}", scale = ${luaScalar (field 3)} })'';
+        in
+        ''
+          local mainMod = "${cfg.mainMod}"
+          local menuMod = "${cfg.menuMod}"
 
-        monitor = cfg.monitors;
+          ${lib.concatMapStringsSep "\n" mkMonitor cfg.monitors}
-
+        ''
-        bind = [
+        + builtins.readFile ./config/hyprland.lua;
-          # Menu Mod Bindings (macOS Transition - Spotlight & Screenshots)
-          "$menuMod, SPACE, exec, $menu"
-          "$menuMod SHIFT, 1, exec, hyprshot -m output"
-          "$menuMod SHIFT, 2, exec, hyprshot -m window"
-          "$menuMod SHIFT, 3, exec, hyprshot -m region"
-          "$menuMod, Q, killactive"
-
-          # Primary Bindings
-          "$mainMod, RETURN, exec, $terminal"
-          "$mainMod, M, exit"
-          "$mainMod, V, togglefloating"
-          "$mainMod, P, pin"
-          "$mainMod, J, togglesplit"
-          "$mainMod, S, togglespecialworkspace, magic"
-          "$mainMod SHIFT, S, movetoworkspace, special:magic"
-
-          # Window Focus
-          "$mainMod, left, movefocus, l"
-          "$mainMod, right, movefocus, r"
-          "$mainMod, up, movefocus, u"
-          "$mainMod, down, movefocus, d"
-
-          # Workspace Switch
-          "$mainMod, 1, workspace, 1"
-          "$mainMod, 2, workspace, 2"
-          "$mainMod, 3, workspace, 3"
-          "$mainMod, 4, workspace, 4"
-          "$mainMod, 5, workspace, 5"
-          "$mainMod, 6, workspace, 6"
-          "$mainMod, 7, workspace, 7"
-          "$mainMod, 8, workspace, 8"
-          "$mainMod, 9, workspace, 9"
-          "$mainMod, 0, workspace, 10"
-
-          # Window Workspace Move
-          "$mainMod SHIFT, 1, movetoworkspace, 1"
-          "$mainMod SHIFT, 2, movetoworkspace, 2"
-          "$mainMod SHIFT, 3, movetoworkspace, 3"
-          "$mainMod SHIFT, 4, movetoworkspace, 4"
-          "$mainMod SHIFT, 5, movetoworkspace, 5"
-          "$mainMod SHIFT, 6, movetoworkspace, 6"
-          "$mainMod SHIFT, 7, movetoworkspace, 7"
-          "$mainMod SHIFT, 8, movetoworkspace, 8"
-          "$mainMod SHIFT, 9, movetoworkspace, 9"
-          "$mainMod SHIFT, 0, movetoworkspace, 10"
-          "$mainMod SHIFT, right, workspace, +1"
-          "$mainMod SHIFT, left, workspace, -1"
-        ];
-        bindm = [
-          # Window Resizing
-          "$mainMod, mouse:272, movewindow"
-          "$mainMod, mouse:273, resizewindow"
-        ];
-        bindel = [
-          # Multimedia & Brightness Keys
-          ",XF86AudioRaiseVolume, exec, wpctl set-volume @DEFAULT_AUDIO_SINK@ 5%+"
-          ",XF86AudioLowerVolume, exec, wpctl set-volume @DEFAULT_AUDIO_SINK@ 5%-"
-          ",XF86AudioMute, exec, wpctl set-mute @DEFAULT_AUDIO_SINK@ toggle"
-          ",XF86AudioMicMute, exec, wpctl set-mute @DEFAULT_AUDIO_SOURCE@ toggle"
-          ",XF86MonBrightnessUp, exec, brightnessctl s 4%+"
-          ",XF86MonBrightnessDown, exec, brightnessctl s 5%-"
-
-          # macOS Keyboard Brightness
-          "$menuMod, XF86MonBrightnessUp, exec, brightnessctl -d kbd_backlight s 10%+"
-          "$menuMod, XF86MonBrightnessDown, exec, brightnessctl -d kbd_backlight s 10%-"
-        ];
-        bindl = [
-          # Player Controls
-          ", XF86AudioNext, exec, playerctl next"
-          ", XF86AudioPause, exec, playerctl play-pause"
-          ", XF86AudioPlay, exec, playerctl play-pause"
-          ", XF86AudioPrev, exec, playerctl previous"
-        ];
-      };
     };
 
     programs.waybar = {
@@ -117,9 +54,9 @@ in
         {
           layer = "top";
           position = "top";
-          mod = "dock";
+          mode = "dock";
           exclusive = true;
-          passtrough = false;
+          passthrough = false;
           gtk-layer-shell = true;
           height = 0;
           modules-left = [

modules/home/programs/terminal/nvim/config/lua/diagnostics-config.lua

@@ -2,11 +2,7 @@
 local diagnostics_active = true
 local toggle_diagnostics = function()
 	diagnostics_active = not diagnostics_active
-	if diagnostics_active then
+	vim.diagnostic.enable(diagnostics_active)
-		vim.diagnostic.enable()
-	else
-		vim.diagnostic.disable()
-	end
 end
 
 local diagnostics_loclist_active = false

modules/home/programs/terminal/nvim/config/lua/lsp-config.lua

@@ -241,7 +241,12 @@ setup_lsp("gopls", {
 		})
 	end,
 	filetypes = { "go" },
-	cmd = { "gopls", "-remote=auto" },
+	cmd = function(dispatchers, config)
+		return vim.lsp.rpc.start({ "gopls", "-remote=auto" }, dispatchers, {
+			cwd = config.root_dir,
+			env = { GOMEMLIMIT = "6GiB" },
+		})
+	end,
 	settings = {
 		gopls = {
 			buildFlags = { "-tags=e2e" },

modules/home/programs/terminal/nvim/config/lua/lualine-config.lua

@@ -49,7 +49,7 @@ local function pr_status()
 end
 
 require("lualine").setup({
-	options = { theme = "catppuccin" },
+	options = { theme = "catppuccin-mocha" },
 	sections = {
 		lualine_c = { { pr_status } },
 		-- lualine_z = { require("opencode").statusline }

modules/home/programs/terminal/nvim/config/lua/ts-config.lua

@@ -1,4 +1,7 @@
-require("nvim-treesitter.configs").setup({
-	highlight = { enable = true, additional_vim_regex_highlighting = false },
-})
 vim.treesitter.language.register("markdown", "octo")
+
+vim.api.nvim_create_autocmd("FileType", {
+	callback = function(args)
+		pcall(vim.treesitter.start, args.buf)
+	end,
+})

modules/home/programs/terminal/nvim/default.nix

@@ -135,18 +135,18 @@ in
         golangci-lint-langserver
         lua-language-server
         nil
-        nodePackages.eslint
+        eslint
-        nodePackages.svelte-language-server
+        svelte-language-server
-        nodePackages.typescript
+        typescript
-        nodePackages.typescript-language-server
+        typescript-language-server
-        nodePackages.vscode-langservers-extracted
+        vscode-langservers-extracted
         pyright
         python312Packages.autopep8
 
         # Formatters
         luaformatter
         nixpkgs-fmt
-        nodePackages.prettier
+        prettier
         stylua
         sql-formatter
 
@@ -177,9 +177,9 @@ in
           clangd = "${pkgs.clang-tools}/bin/clangd",
           golintls = "${pkgs.golangci-lint-langserver}/bin/golangci-lint-langserver",
           luals = "${pkgs.lua-language-server}/bin/lua-language-server",
-          sveltels = "${pkgs.nodePackages.svelte-language-server}/bin/svelteserver",
+          sveltels = "${pkgs.svelte-language-server}/bin/svelteserver",
-          tsls = "${pkgs.nodePackages.typescript-language-server}/bin/typescript-language-server",
+          tsls = "${pkgs.typescript-language-server}/bin/typescript-language-server",
-          vscls = "${pkgs.nodePackages.vscode-langservers-extracted}",
+          vscls = "${pkgs.vscode-langservers-extracted}",
           sqls = "${pkgs.sqls}/bin/sqls",
         }
         return nix_vars

modules/home/programs/terminal/pi/config/AGENTS.md

@@ -46,7 +46,9 @@ Full-file reads are fine when genuinely needed, but avoid them as the default re
 
 4. **Rephrase over append**: When extending existing content (docs, comments, prose, code), prefer rephrasing to capture the new intent over tacking on more verbosity.
 
-5. **Knowledge Capture Check**: Before the final response, ask whether the task revealed a non-obvious convention, pitfall, repeatable workflow, or missing helper. If yes, briefly recommend exactly where to capture it: package/project AGENTS.md, global AGENTS.md, a skill, or a helper script. Skip this note when there is nothing meaningful.
+5. **Positive framing over prohibition**: State what _to_ do, not what _not_ to do. Default to omitting an instruction entirely rather than adding a "don't do X" rule — omission costs less context and avoids the failure mode where deleting a prohibition gets inverted into a mandate. Reserve explicit prohibitions for cases where the wrong behavior is a likely default that positive guidance alone can't redirect.
+
+6. **Knowledge Capture Check**: Before the final response, ask whether the task revealed a non-obvious convention, pitfall, repeatable workflow, or missing helper. If yes, briefly recommend exactly where to capture it: package/project AGENTS.md, global AGENTS.md, a skill, or a helper script. Skip this note when there is nothing meaningful.
 
 ## Style
 

modules/home/programs/terminal/pi/config/skills/create-skill/SKILL.md

@@ -48,6 +48,7 @@ description: "<One-liner: what it does and when to trigger. Keep under ~200 char
 - **Needs configurable values (paths, identifiers, etc.; not secrets — values are stored as plaintext files)?** Copy `assets/variable.sh` into the new skill's `scripts/` dir as-is. Callers use `variable.sh --get NAME [--require-exec RELPATH]`; the helper prints self-explaining `--set` instructions on "unset" or "set-but-invalid" and exits non-zero, so callers just propagate. The helper self-ignores its `.vars/` store on first `--set`, so no `.gitignore` setup is needed.
 - **Frontmatter is required.** `name` and `description` fields. The description is what the agent uses to decide whether to load the skill, so make it specific about trigger conditions.
 - **Don't over-specify.** Trust the agent to fill gaps. Document the _what_ and _when_, not every micro-step.
+- **Frame positively; omit rather than prohibit.** Write what the agent _should_ do. Prefer leaving a rule out over adding "don't do X" (see AGENTS.md principle: _Positive framing over prohibition_).
 - **Split workflow from reference when the reference surface grows.** If a skill accumulates lookup tables, mapping rules, or capability references that the workflow consults, move them into a sibling `<skill>/<category>/` directory (e.g. `mappings/`, `references/`) with one sub-doc per category and an index `README.md`. Keep `SKILL.md` focused on the hot path — workflow, hard rules, and a short table pointing at the sub-docs. Include a brief style guide in the index README covering (a) defer to authoritative sources (stubs, schemas, generated docs) whenever possible, (b) row/entry formatting conventions, (c) when to create a new sub-doc vs. extend an existing one.
 
 ### 3. Present for Review

modules/home/programs/terminal/pi/config/skills/git-commit/SKILL.md

@@ -126,6 +126,8 @@ EOF
 - Imperative mood: "fix bug" not "fixes bug"
 - Reference issues: `Closes #123`, `Refs #456`
 - Keep description under 72 characters
+- Keep commit bodies short: 4 sentences max.
+- If you are unsure whether a body is useful, omit it entirely.
 
 ## Git Safety Protocol
 

modules/home/services/awww/default.nix

@@ -5,23 +5,23 @@
 , ...
 }:
 let
-  cfg = config.${namespace}.services.swww;
+  cfg = config.${namespace}.services.awww;
 in
 {
-  options.${namespace}.services.swww = {
+  options.${namespace}.services.awww = {
-    enable = lib.mkEnableOption "swww wallpaper service";
+    enable = lib.mkEnableOption "awww wallpaper service";
   };
 
   config = lib.mkIf cfg.enable {
     home.packages = with pkgs; [
-      swww
+      awww
     ];
 
     systemd.user = {
       services = {
-        swww-daemon = {
+        awww-daemon = {
           Unit = {
-            Description = "SWWW Wallpaper Daemon";
+            Description = "AWWW Wallpaper Daemon";
             After = [ "graphical-session.target" ];
           };
 
@@ -31,7 +31,7 @@ in
 
           Service = {
             Type = "simple";
-            ExecStart = "${pkgs.swww}/bin/swww-daemon";
+            ExecStart = "${pkgs.awww}/bin/awww-daemon";
             Restart = "on-failure";
             RestartSec = 5;
           };
@@ -39,28 +39,28 @@ in
 
         change-wallpaper = {
           Unit = {
-            Description = "SWWW Wallpaper Changer";
+            Description = "AWWW Wallpaper Changer";
-            After = [ "swww-daemon.service" ];
+            After = [ "awww-daemon.service" ];
-            Requires = [ "swww-daemon.service" ];
+            Requires = [ "awww-daemon.service" ];
           };
 
           Install = {
-            WantedBy = [ "swww-daemon.service" ];
+            WantedBy = [ "awww-daemon.service" ];
           };
 
           Service = {
             Type = "oneshot";
             ExecStart = "${pkgs.writeShellScript "change-wallpaper-script" ''
               WALLPAPER=$(${pkgs.findutils}/bin/find $HOME/Wallpapers -type f | ${pkgs.coreutils}/bin/shuf -n 1)
-              ${pkgs.swww}/bin/swww img "$WALLPAPER" --transition-type random
+              ${pkgs.awww}/bin/awww img "$WALLPAPER" --transition-type random
             ''}";
           };
         };
       };
 
-      timers.swww-schedule = {
+      timers.awww-schedule = {
         Unit = {
-          Description = "SWWW Wallpaper Schedule";
+          Description = "AWWW Wallpaper Schedule";
         };
 
         Install = {

modules/home/services/open-proxy/default.nix

@@ -0,0 +1,76 @@
+{ config
+, lib
+, pkgs
+, namespace
+, ...
+}:
+let
+  inherit (lib) mkIf mkEnableOption;
+  cfg = config.${namespace}.services.open-proxy;
+  package = pkgs.reichard.open-proxy;
+  secretName = "open_proxy_token";
+  tokenPath = config.sops.secrets.${secretName}.path;
+in
+{
+  options.${namespace}.services.open-proxy = {
+    server.enable = mkEnableOption "open-proxy host server (opens forwarded URLs/files on this machine)";
+    client.enable = mkEnableOption "open-proxy client (shadows open/xdg-open to forward to the host)";
+  };
+
+  config = lib.mkMerge [
+    (mkIf (cfg.server.enable || cfg.client.enable) {
+      sops.secrets.${secretName} = {
+        sopsFile = lib.snowfall.fs.get-file "secrets/common/evanreichard.yaml";
+      };
+    })
+
+    (mkIf cfg.server.enable {
+      assertions = [
+        {
+          assertion = pkgs.stdenv.isDarwin;
+          message = "reichard.services.open-proxy.server is only supported on macOS (Darwin).";
+        }
+      ];
+
+      launchd.agents.open-proxy = {
+        enable = true;
+        config = {
+          Label = "io.reichard.open-proxy";
+          ProgramArguments = [ "${package}/bin/open-proxy" "serve" ];
+          RunAtLoad = true;
+          KeepAlive = true;
+          EnvironmentVariables = {
+            OPEN_PROXY_TOKEN_FILE = tokenPath;
+            # open(1) lives in /usr/bin; launchd agents don't inherit a login PATH.
+            PATH = "/usr/bin:/bin:/usr/sbin:/sbin";
+          };
+          StandardOutPath = "${config.home.homeDirectory}/Library/Logs/open-proxy/open-proxy.out.log";
+          StandardErrorPath = "${config.home.homeDirectory}/Library/Logs/open-proxy/open-proxy.err.log";
+        };
+      };
+    })
+
+    (mkIf cfg.client.enable {
+      assertions = [
+        {
+          assertion = pkgs.stdenv.isLinux;
+          message = "reichard.services.open-proxy.client is only supported on Linux.";
+        }
+      ];
+
+      # Shadow the openers via ~/.local/bin (prepended to PATH below). open-proxy
+      # keys off argv[0], so these symlinks run in client mode and fall back to
+      # any real opener further down PATH when the host is unreachable.
+      home.file = {
+        ".local/bin/open".source = "${package}/bin/open-proxy";
+        ".local/bin/xdg-open".source = "${package}/bin/open-proxy";
+      };
+
+      home.sessionPath = [ "$HOME/.local/bin" ];
+      home.sessionVariables = {
+        BROWSER = "open";
+        OPEN_PROXY_TOKEN_FILE = tokenPath;
+      };
+    })
+  ];
+}

modules/nixos/hardware/opengl/default.nix

@@ -16,6 +16,12 @@ in
     enable32Bit = mkBoolOpt false "enable 32-bit";
     enableIntel = mkBoolOpt false "support for intel";
     enableNvidia = mkBoolOpt false "support for nvidia";
+    nvidiaPackage = lib.mkOption {
+      type = lib.types.package;
+      default = config.boot.kernelPackages.nvidiaPackages.stable;
+      defaultText = "config.boot.kernelPackages.nvidiaPackages.stable";
+      description = "nvidia driver package; pin to legacy_580 for Pascal (GTX 10xx) and older";
+    };
   };
 
   config = mkIf cfg.enable {
@@ -32,7 +38,7 @@ in
 
     # Enable Nvidia Hardware
     hardware.nvidia = mkIf cfg.enableNvidia {
-      package = config.boot.kernelPackages.nvidiaPackages.stable;
+      package = cfg.nvidiaPackage;
       modesetting.enable = true;
       powerManagement.enable = true;
       open = false;

modules/nixos/nix/default.nix

@@ -38,6 +38,7 @@ in
           sshUser = "evanreichard";
           protocol = "ssh";
           sshKey = config.sops.secrets.builder_ssh_key.path;
+          publicHostKey = "c3NoLWVkMjU1MTkgQUFBQUMzTnphQzFsWkRJMU5URTVBQUFBSUdscEMwcm9yQVRLeks4bUxNS2dDWXFNNU4yTi9HZ1MydDRNMTNjd25BT1M=";
           supportedFeatures = [
             "benchmark"
             "big-parallel"

modules/nixos/services/llama-swap/config.nix

@@ -682,7 +682,10 @@ in
     # https://huggingface.co/unsloth/Qwen3.6-35B-A3B-MTP-GGUF/tree/main
     "qwen3.6-35b-dual" = {
       name = "Qwen3.6 35B (Dual GPU, UD-Q6)";
-      macros.ctx = "215000";
+      # macros.ctx = "215000";
+      # -ctk q8_0 \
+      # -ctv q8_0 \
+      macros.ctx = "131072";
       cmd = ''
         ${llama-cpp}/bin/llama-server \
           --port ''${PORT} \
@@ -694,8 +697,6 @@ in
           --top-k 20 \
           --min-p 0.00 \
           --presence-penalty 0.0 \
-          -ctk q8_0 \
-          -ctv q8_0 \
           --spec-type draft-mtp \
           --spec-draft-n-max 3 \
           -dev CUDA0,CUDA1 \

overlays/firefox-addons/default.nix

@@ -1,4 +1,4 @@
 { inputs, ... }:
 final: _prev: {
-  firefox-addons = inputs.firefox-addons.packages.${final.system};
+  firefox-addons = inputs.firefox-addons.packages.${final.stdenv.hostPlatform.system};
 }

packages/llama-cpp/default.nix

@@ -3,63 +3,19 @@ let
   # Version MUST be an integer string.
   # For tagged releases use the tag number (e.g. "9222").
   # For HEAD builds use YYYYMMDD (e.g. "20260519").
-  version = "9412";
+  version = "9496";
 
   src = pkgs.fetchFromGitHub {
     owner = "ggml-org";
     repo = "llama.cpp";
-    rev = "cb47092b007fcd5122eee2e8bb32ce972cdb23c2";
+    rev = "94a220cd6745e6e3f8de62870b66fd5b9bc92700";
-    hash = "sha256-x/2LOlEoaghgHEZp6m5ItXyNHGsvYmUrHYxKEtSeVSM=";
+    hash = "sha256-1jAowfGVzrrHDwWWzKESY7aV82whnuIg1N37fmtcgyw=";
     leaveDotGit = true;
     postFetch = ''
       git -C "$out" rev-parse --short HEAD > $out/COMMIT
       find "$out" -name .git -print0 | xargs -0 rm -rf
     '';
   };
-
-  # Pre-Built WebUI Assets
-  # As of b9151 llama.cpp removed the prebuilt WebUI from the repo and tries to
-  # curl them from a HuggingFace bucket at build time. That fails in the Nix
-  # sandbox. We build the UI from source in a separate derivation and drop the
-  # 4 output files into build/tools/ui/dist/ so cmake's "Priority 1: local
-  # assets present" branch short-circuits the network fetch.
-  #
-  # As of b9180 the source dir was renamed tools/server/webui -> tools/ui, and
-  # the vite plugin now writes to ../../build/tools/ui/dist relative to tools/ui.
-  webuiNpmDeps = pkgs.fetchNpmDeps {
-    name = "llama-webui-${version}-npm-deps";
-    inherit src;
-    sourceRoot = "${src.name}/tools/ui";
-    hash = "sha256-Iyg8FpcTKf2UYHuK7mA3cTAqVaLcQPcS0YCa5Qf01Gc=";
-  };
-
-  webui = pkgs.buildNpmPackage {
-    pname = "llama-webui";
-    inherit version src;
-
-    # Custom unpack: the vite plugin writes back into the source tree (tools/ui/dist),
-    # so it must be writable. Plain sourceRoot leaves the parent dirs in the read-only
-    # Nix store.
-    unpackPhase = ''
-      runHook preUnpack
-      cp -r ${src} llama-src
-      chmod -R u+w llama-src
-      cd llama-src/tools/ui
-      runHook postUnpack
-    '';
-
-    npmDeps = webuiNpmDeps;
-
-    installPhase = ''
-      runHook preInstall
-      mkdir -p $out
-      install -Dm644 dist/index.html   $out/index.html
-      install -Dm644 dist/bundle.js    $out/bundle.js
-      install -Dm644 dist/bundle.css   $out/bundle.css
-      install -Dm644 dist/loading.html $out/loading.html
-      runHook postInstall
-    '';
-  };
 in
 (pkgs.llama-cpp.override {
   cudaSupport = true;
@@ -71,6 +27,11 @@ in
   (oldAttrs: {
     inherit version src;
 
+    # WebUI npm deps hash for our pinned src. Upstream nixpkgs builds the WebUI
+    # from tools/ui via `npm run build` in preConfigure (offline, using these
+    # deps), so no custom webui derivation / HF-bucket workaround is needed.
+    npmDepsHash = "sha256-1iM0LGeI9e+gZEHk46lkBe51DxIhiimfAm9o3Z3m9Ik=";
+
     # Add SPIR-V Headers for Vulkan Backend
     # Newer llama.cpp requires spirv/unified1/spirv.hpp which isn't
     # pulled in by vulkan-headers alone.
@@ -87,18 +48,4 @@ in
       export NIX_ENFORCE_NO_NATIVE=0
       ${oldAttrs.preConfigure or ""}
     '';
-
-    # Drop pre-built UI assets into tools/ui/dist/ so cmake's Priority 1 path
-    # (SRC_DIST_DIR in scripts/ui-assets.cmake) picks them up and skips the HF
-    # Bucket fetch. As of b9404 the lookup moved from build/tools/ui/dist to
-    # tools/ui/dist.
-    postPatch = ''
-      ${oldAttrs.postPatch or ""}
-      mkdir -p tools/ui/dist
-      cp ${webui}/* tools/ui/dist/
-    '';
-
-    # Expose the WebUI sub-derivation so it can be built/tested in isolation:
-    #   nix build .#llama-cpp.webui --builders ''
-    passthru = (oldAttrs.passthru or { }) // { inherit webui; };
   })

packages/open-proxy/default.nix

@@ -0,0 +1,25 @@
+{ lib
+, buildGoModule
+, fetchgit
+}:
+
+buildGoModule rec {
+  pname = "open-proxy";
+  version = "unstable-2026-06-16";
+
+  src = fetchgit {
+    url = "https://gitea.va.reichard.io/evan/open-proxy.git";
+    rev = "a589341214a1e035b6ce2b2d79870e591a25ccca";
+    hash = "sha256-onfvxOl4TdeRrVLD1oJWcnhEDzKFYU/V0qxV1+NpQrg=";
+  };
+
+  vendorHash = null;
+
+  meta = {
+    description = "Forward `open`/`xdg-open` from a remote VM to the host machine";
+    homepage = "https://gitea.va.reichard.io/evan/open-proxy";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ evanreichard ];
+    mainProgram = "open-proxy";
+  };
+}

packages/pi-coding-agent/default.nix

@@ -3,6 +3,8 @@
 , fetchFromGitHub
 , nodejs
 , nodejs_22
+, firefox
+, geckodriver
 , makeWrapper
 , pkg-config
 , pixman
@@ -16,16 +18,16 @@
 
 buildNpmPackage rec {
   pname = "pi-coding-agent";
-  version = "0.77.0";
+  version = "0.78.1";
 
   src = fetchFromGitHub {
     owner = "earendil-works";
     repo = "pi-mono";
     rev = "v${version}";
-    hash = "sha256-PJyhLWfqoPjHoYl4pKJVD3uMD5YjQB5YIk5mBZvGi8E=";
+    hash = "sha256-K5+reVdi9LPwUHxFgM1iFWojuj6M/m25ymhkDOQdBE4=";
   };
 
-  npmDepsHash = "sha256-StMh+5zyJ0nln5rMx5rrGm40A9EcvOIOnGKo/HO4+7g=";
+  npmDepsHash = "sha256-PknwCOAr61Fq2Mhl6jd79Rdsje1OXFts2MDLM/gIEYE=";
 
   nativeBuildInputs = [ pkg-config makeWrapper ];
 
@@ -78,7 +80,12 @@ buildNpmPackage rec {
       chmod +x $out/bin/pi
 
       wrapProgram $out/bin/pi \
-        --prefix PATH : ${lib.makeBinPath [ nodejs_22 ]}
+        --prefix PATH : ${lib.makeBinPath [
+          nodejs_22
+          # evan/pi-web - Browser automation tools are needed for web-fetch support.
+          firefox
+          geckodriver
+        ]}
 
       runHook postInstall
   '';

packages/pi-coding-agent/package-lock.json

@@ -12,7 +12,8 @@
         "packages/coding-agent/examples/extensions/with-deps",
         "packages/coding-agent/examples/extensions/custom-provider-anthropic",
         "packages/coding-agent/examples/extensions/custom-provider-gitlab-duo",
-        "packages/coding-agent/examples/extensions/sandbox"
+        "packages/coding-agent/examples/extensions/sandbox",
+        "packages/coding-agent/examples/extensions/gondolin"
       ],
       "devDependencies": {
         "@anthropic-ai/sandbox-runtime": "0.0.26",
@@ -722,6 +723,78 @@
         "node": ">=14.21.3"
       }
     },
+    "node_modules/@cto.af/wtf8": {
+      "version": "0.0.5",
+      "resolved": "https://registry.npmjs.org/@cto.af/wtf8/-/wtf8-0.0.5.tgz",
+      "integrity": "sha512-LfUFi+Vv4eDzj+XAtR89e3wwjXA/NZjUSwU5NhwbBrLecxPaBYFy3exCuc1j+D4UZeOVdqlsl8G7LmOt18V0tg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=20"
+      }
+    },
+    "node_modules/@earendil-works/gondolin": {
+      "version": "0.12.0",
+      "resolved": "https://registry.npmjs.org/@earendil-works/gondolin/-/gondolin-0.12.0.tgz",
+      "integrity": "sha512-BXbvzQKb5QmxY5NtthRDONJTu7+IDKbzqWGrJyyNXMP7N681Tx0Q9TK8pK1ba8nUvYQTipNJyGZOsJfYiZll1A==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "cbor2": "^2.3.0",
+        "node-forge": "^1.3.3",
+        "ssh2": "^1.17.0",
+        "undici": "^6.21.0"
+      },
+      "bin": {
+        "gondolin": "dist/bin/gondolin.js"
+      },
+      "engines": {
+        "node": ">=23.6.0"
+      },
+      "optionalDependencies": {
+        "@earendil-works/gondolin-krun-runner-darwin-arm64": "0.12.0",
+        "@earendil-works/gondolin-krun-runner-linux-x64": "0.12.0"
+      }
+    },
+    "node_modules/@earendil-works/gondolin-krun-runner-darwin-arm64": {
+      "version": "0.12.0",
+      "resolved": "https://registry.npmjs.org/@earendil-works/gondolin-krun-runner-darwin-arm64/-/gondolin-krun-runner-darwin-arm64-0.12.0.tgz",
+      "integrity": "sha512-ftDlusht4PcT7Y3TuPrZIKrCXy3isiBTVMvlXYK0pcud2uXY6uwFTGeunYgP+8ND/60ddb+MImqbfmkcK8B84A==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "bin": {
+        "gondolin-krun-runner": "bin/gondolin-krun-runner"
+      }
+    },
+    "node_modules/@earendil-works/gondolin-krun-runner-linux-x64": {
+      "version": "0.12.0",
+      "resolved": "https://registry.npmjs.org/@earendil-works/gondolin-krun-runner-linux-x64/-/gondolin-krun-runner-linux-x64-0.12.0.tgz",
+      "integrity": "sha512-RRYsgwe2r5ApKmFNy469QgwnyjAHpAs9XANdWpTd9ol4iUYOY3sX7e0xIooAKxd+ktxGI4N/xRWicwGen3D/Ow==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "bin": {
+        "gondolin-krun-runner": "bin/gondolin-krun-runner"
+      }
+    },
+    "node_modules/@earendil-works/gondolin/node_modules/undici": {
+      "version": "6.26.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-6.26.0.tgz",
+      "integrity": "sha512-4yqz8a3n5HmGTlsbADNtr/dJlhkh/55Rq798G6ibiULcXbDtaLpTl1pvdqcbFfeoj3iSi52lePFM7h9H21cw/A==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18.17"
+      }
+    },
     "node_modules/@earendil-works/pi-agent-core": {
       "resolved": "packages/agent",
       "link": true
@@ -2572,6 +2645,15 @@
         "url": "https://github.com/chalk/ansi-styles?sponsor=1"
       }
     },
+    "node_modules/asn1": {
+      "version": "0.2.6",
+      "resolved": "https://registry.npmjs.org/asn1/-/asn1-0.2.6.tgz",
+      "integrity": "sha512-ix/FxPn0MDjeyJ7i/yoHGFt/EX6LyNbxSEhPPXODPL+KB0VPk86UYfL0lMdy+KCnv+fmvIzySwaK5COwqVbWTQ==",
+      "license": "MIT",
+      "dependencies": {
+        "safer-buffer": "~2.1.0"
+      }
+    },
     "node_modules/assertion-error": {
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/assertion-error/-/assertion-error-2.0.1.tgz",
@@ -2623,6 +2705,15 @@
       ],
       "license": "MIT"
     },
+    "node_modules/bcrypt-pbkdf": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/bcrypt-pbkdf/-/bcrypt-pbkdf-1.0.2.tgz",
+      "integrity": "sha512-qeFIXtP4MSoi6NLqO12WfqARWWuCKi2Rn/9hJLEmtB5yTNr9DqFWkJRCf2qShWzPeAMRnOgCrq0sg/KLv5ES9w==",
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "tweetnacl": "^0.14.3"
+      }
+    },
     "node_modules/bignumber.js": {
       "version": "9.3.1",
       "resolved": "https://registry.npmjs.org/bignumber.js/-/bignumber.js-9.3.1.tgz",
@@ -2706,6 +2797,15 @@
       "integrity": "sha512-zRpUiDwd/xk6ADqPMATG8vc9VPrkck7T07OIx0gnjmJAnHnTVXNQG3vfvWNuiZIkwu9KrKdA1iJKfsfTVxE6NA==",
       "license": "BSD-3-Clause"
     },
+    "node_modules/buildcheck": {
+      "version": "0.0.7",
+      "resolved": "https://registry.npmjs.org/buildcheck/-/buildcheck-0.0.7.tgz",
+      "integrity": "sha512-lHblz4ahamxpTmnsk+MNTRWsjYKv965MwOrSJyeD588rR3Jcu7swE+0wN5F+PbL5cjgu/9ObkhfzEPuofEMwLA==",
+      "optional": true,
+      "engines": {
+        "node": ">=10.0.0"
+      }
+    },
     "node_modules/cac": {
       "version": "6.7.14",
       "resolved": "https://registry.npmjs.org/cac/-/cac-6.7.14.tgz",
@@ -2731,6 +2831,18 @@
         "node": "^18.12.0 || >= 20.9.0"
       }
     },
+    "node_modules/cbor2": {
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/cbor2/-/cbor2-2.3.0.tgz",
+      "integrity": "sha512-76WB3hq8BoaGkMkBVJ27fW5LJU+qqDLEpgRNCG/SYKhODWXpVPOTD4UcUto3IEzYLA52nsvbhb0wabhHDn3qXg==",
+      "license": "MIT",
+      "dependencies": {
+        "@cto.af/wtf8": "0.0.5"
+      },
+      "engines": {
+        "node": ">=20"
+      }
+    },
     "node_modules/chai": {
       "version": "5.3.3",
       "resolved": "https://registry.npmjs.org/chai/-/chai-5.3.3.tgz",
@@ -2806,6 +2918,20 @@
         "node": ">=18"
       }
     },
+    "node_modules/cpu-features": {
+      "version": "0.0.10",
+      "resolved": "https://registry.npmjs.org/cpu-features/-/cpu-features-0.0.10.tgz",
+      "integrity": "sha512-9IkYqtX3YHPCzoVg1Py+o9057a3i0fp7S530UWokCSaFVTc7CwXPRiOjRjBQQ18ZCNafx78YfnG+HALxtVmOGA==",
+      "hasInstallScript": true,
+      "optional": true,
+      "dependencies": {
+        "buildcheck": "~0.0.6",
+        "nan": "^2.19.0"
+      },
+      "engines": {
+        "node": ">=10.0.0"
+      }
+    },
     "node_modules/cross-spawn": {
       "version": "7.0.6",
       "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
@@ -3943,6 +4069,13 @@
       "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
       "license": "MIT"
     },
+    "node_modules/nan": {
+      "version": "2.27.0",
+      "resolved": "https://registry.npmjs.org/nan/-/nan-2.27.0.tgz",
+      "integrity": "sha512-hC+0LidcL3XE4rp1C4H54KujgXKzbfyTngZTwBByQxsOxCEKZT0MPQ4hOKUH2jU1OYstqdDH4onyHPDzcV0XdQ==",
+      "license": "MIT",
+      "optional": true
+    },
     "node_modules/nanoid": {
       "version": "3.3.12",
       "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.12.tgz",
@@ -4034,6 +4167,15 @@
         "url": "https://opencollective.com/node-fetch"
       }
     },
+    "node_modules/node-forge": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/node-forge/-/node-forge-1.4.0.tgz",
+      "integrity": "sha512-LarFH0+6VfriEhqMMcLX2F7SwSXeWwnEAJEsYm5QKWchiVYVvJyV9v7UDvUv+w5HO23ZpQTXDv/GxdDdMyOuoQ==",
+      "license": "(BSD-3-Clause OR GPL-2.0)",
+      "engines": {
+        "node": ">= 6.13.0"
+      }
+    },
     "node_modules/npm-run-path": {
       "version": "2.0.2",
       "resolved": "https://registry.npmjs.org/npm-run-path/-/npm-run-path-2.0.2.tgz",
@@ -4202,6 +4344,10 @@
       "resolved": "packages/coding-agent/examples/extensions/custom-provider-gitlab-duo",
       "link": true
     },
+    "node_modules/pi-extension-gondolin": {
+      "resolved": "packages/coding-agent/examples/extensions/gondolin",
+      "link": true
+    },
     "node_modules/pi-extension-sandbox": {
       "resolved": "packages/coding-agent/examples/extensions/sandbox",
       "link": true
@@ -4544,6 +4690,12 @@
       ],
       "license": "MIT"
     },
+    "node_modules/safer-buffer": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz",
+      "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==",
+      "license": "MIT"
+    },
     "node_modules/semver": {
       "version": "7.8.0",
       "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.0.tgz",
@@ -4696,6 +4848,23 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/ssh2": {
+      "version": "1.17.0",
+      "resolved": "https://registry.npmjs.org/ssh2/-/ssh2-1.17.0.tgz",
+      "integrity": "sha512-wPldCk3asibAjQ/kziWQQt1Wh3PgDFpC0XpwclzKcdT1vql6KeYxf5LIt4nlFkUeR8WuphYMKqUA56X4rjbfgQ==",
+      "hasInstallScript": true,
+      "dependencies": {
+        "asn1": "^0.2.6",
+        "bcrypt-pbkdf": "^1.0.2"
+      },
+      "engines": {
+        "node": ">=10.16.0"
+      },
+      "optionalDependencies": {
+        "cpu-features": "~0.0.10",
+        "nan": "^2.23.0"
+      }
+    },
     "node_modules/stackback": {
       "version": "0.0.2",
       "resolved": "https://registry.npmjs.org/stackback/-/stackback-0.0.2.tgz",
@@ -5116,6 +5285,12 @@
         "node": "*"
       }
     },
+    "node_modules/tweetnacl": {
+      "version": "0.14.5",
+      "resolved": "https://registry.npmjs.org/tweetnacl/-/tweetnacl-0.14.5.tgz",
+      "integrity": "sha512-KXXFFdAbFXY4geFIwoyNK+f5Z1b7swfXABfL7HXCmoIWMKU3dmS26672A4EeQtDzLKy7SXmfBu51JolvEKwtGA==",
+      "license": "Unlicense"
+    },
     "node_modules/typebox": {
       "version": "1.1.38",
       "resolved": "https://registry.npmjs.org/typebox/-/typebox-1.1.38.tgz",
@@ -5995,10 +6170,10 @@
     },
     "packages/agent": {
       "name": "@earendil-works/pi-agent-core",
-      "version": "0.77.0",
+      "version": "0.78.1",
       "license": "MIT",
       "dependencies": {
-        "@earendil-works/pi-ai": "^0.77.0",
+        "@earendil-works/pi-ai": "^0.78.1",
         "ignore": "7.0.5",
         "typebox": "1.1.38",
         "yaml": "2.9.0"
@@ -6032,7 +6207,7 @@
     },
     "packages/ai": {
       "name": "@earendil-works/pi-ai",
-      "version": "0.77.0",
+      "version": "0.78.1",
       "license": "MIT",
       "dependencies": {
         "@anthropic-ai/sdk": "0.91.1",
@@ -6077,12 +6252,12 @@
     },
     "packages/coding-agent": {
       "name": "@earendil-works/pi-coding-agent",
-      "version": "0.77.0",
+      "version": "0.78.1",
       "license": "MIT",
       "dependencies": {
-        "@earendil-works/pi-agent-core": "^0.77.0",
+        "@earendil-works/pi-agent-core": "^0.78.1",
-        "@earendil-works/pi-ai": "^0.77.0",
+        "@earendil-works/pi-ai": "^0.78.1",
-        "@earendil-works/pi-tui": "^0.77.0",
+        "@earendil-works/pi-tui": "^0.78.1",
         "@silvia-odwyer/photon-node": "0.3.4",
         "chalk": "5.6.2",
         "cross-spawn": "7.0.6",
@@ -6121,25 +6296,32 @@
     },
     "packages/coding-agent/examples/extensions/custom-provider-anthropic": {
       "name": "pi-extension-custom-provider-anthropic",
-      "version": "0.77.0",
+      "version": "0.78.1",
       "dependencies": {
         "@anthropic-ai/sdk": "0.52.0"
       }
     },
     "packages/coding-agent/examples/extensions/custom-provider-gitlab-duo": {
       "name": "pi-extension-custom-provider-gitlab-duo",
-      "version": "0.77.0"
+      "version": "0.78.1"
+    },
+    "packages/coding-agent/examples/extensions/gondolin": {
+      "name": "pi-extension-gondolin",
+      "version": "0.78.1",
+      "dependencies": {
+        "@earendil-works/gondolin": "0.12.0"
+      }
     },
     "packages/coding-agent/examples/extensions/sandbox": {
       "name": "pi-extension-sandbox",
-      "version": "1.7.0",
+      "version": "1.8.1",
       "dependencies": {
         "@anthropic-ai/sandbox-runtime": "0.0.26"
       }
     },
     "packages/coding-agent/examples/extensions/with-deps": {
       "name": "pi-extension-with-deps",
-      "version": "0.77.0",
+      "version": "0.78.1",
       "dependencies": {
         "ms": "2.1.3"
       },
@@ -6175,7 +6357,7 @@
     },
     "packages/tui": {
       "name": "@earendil-works/pi-tui",
-      "version": "0.77.0",
+      "version": "0.78.1",
       "license": "MIT",
       "dependencies": {
         "get-east-asian-width": "1.6.0",

packages/tuxguitar/default.nix

@@ -0,0 +1,114 @@
+{ lib
+, stdenv
+, maven
+, fetchFromGitHub
+, jdk17
+, jre
+, swt
+, makeWrapper
+, wrapGAppsHook3
+, pkg-config
+, alsa-lib
+, jack2
+, fluidsynth
+, libpulseaudio
+, lilv
+, suil
+, qt5
+, which
+}:
+
+maven.buildMavenPackage rec {
+  pname = "tuxguitar";
+  version = "2.0.1";
+
+  src = fetchFromGitHub {
+    owner = "helge17";
+    repo = "tuxguitar";
+    rev = version;
+    hash = "sha256-USdYj8ebosXkiZpDqyN5J+g1kjyWm225iQlx/szXmLA=";
+  };
+
+  mvnHash = "sha256-XTODH8SG7iwhACJT4AbIokORUe00r6theV18TEXbrIs=";
+
+  doCheck = false;
+
+  mvnJdk = jdk17;
+
+  nativeBuildInputs = [
+    makeWrapper
+    pkg-config
+    wrapGAppsHook3
+  ];
+
+  buildInputs = [
+    alsa-lib
+    fluidsynth
+    jack2
+    lilv
+    qt5.qtbase
+    suil
+  ];
+
+  mvnFetchExtraArgs = {
+    inherit buildInputs;
+    dontWrapQtApps = true;
+  };
+
+  postPatch = ''
+    substituteInPlace desktop/build-scripts/native-modules/tuxguitar-synth-lv2-linux/pom.xml \
+      --replace-fail /usr/include/lilv-0/lilv ${lib.getDev lilv}/include/lilv-0/lilv \
+      --replace-fail /usr/include/suil-0/suil ${lib.getDev suil}/include/suil-0/suil
+
+    if [[ "$name" == maven-deps-* ]]; then
+      mvn install:install-file \
+        -Dfile=${swt}/jars/swt.jar \
+        -DgroupId=org.eclipse.swt \
+        -DartifactId=org.eclipse.swt.gtk.linux \
+        -Dpackaging=jar \
+        -Dversion=4.36 \
+        -Dmaven.repo.local=$out/.m2
+    fi
+  '';
+
+  mvnParameters = "-f desktop/build-scripts/tuxguitar-linux-swt/pom.xml verify -P native-modules";
+
+  dontWrapGApps = true;
+  dontWrapQtApps = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    cp -r desktop/build-scripts/tuxguitar-linux-swt/target/tuxguitar-*-linux-swt/{dist,lib,share,tuxguitar.sh} $out/
+    ln -sf ${swt}/jars/swt.jar $out/lib/swt.jar
+    ln -s ../tuxguitar.sh $out/bin/tuxguitar
+
+    runHook postInstall
+  '';
+
+  postFixup = ''
+    wrapProgram $out/tuxguitar.sh \
+      "''${gappsWrapperArgs[@]}" \
+      --prefix PATH : ${lib.makeBinPath [ jre which ]} \
+      --prefix LD_LIBRARY_PATH : "$out/lib:${lib.makeLibraryPath [
+        swt
+        alsa-lib
+        fluidsynth
+        jack2
+        libpulseaudio
+        lilv
+        qt5.qtbase
+        suil
+      ]}"
+  '';
+
+  meta = {
+    description = "Multitrack guitar tablature editor";
+    homepage = "https://github.com/helge17/tuxguitar";
+    license = lib.licenses.lgpl2;
+    maintainers = with lib.maintainers; [ evanreichard ];
+    mainProgram = "tuxguitar";
+    platforms = lib.platforms.linux;
+  };
+}

secrets/common/evanreichard.yaml

@@ -1,3 +1,4 @@
+open_proxy_token: ENC[AES256_GCM,data:LxC0dR2EQ8XPmw4fwKnKJD3usqImMKH+81I9RSTNsjg=,iv:LQmf+kxtwgAMxcHvIe6y3Qw/oxXvdWGbyV/kdwPpKw4=,tag:TUQbM8sIK6KB7eOsYfHuqw==,type:str]
 conduit_apikey: ENC[AES256_GCM,data:4mjvEI00V7nAhPkDa97eOfLCqItxoRALFe8OdxzUiUc=,iv:2mtSu1LDUvaneTnqs3Z4GVAj+HuAY2+VXrpIITSg/64=,tag:trkgxyX0ssCjyKMB42bFGg==,type:str]
 context7_apikey: ENC[AES256_GCM,data:K8/OoJMWBhN3ufmTa/tAiD3iMergDZQ1OBucUtLsrg+L26DXDPAko9D41w==,iv:/IVpaaPivUTn2rbIAPIwyN5nb7TmtDh05YlMdOlBkhE=,tag:0XJfoNlDelBwMXMAAqKjtQ==,type:str]
 zai_apikey: ENC[AES256_GCM,data:eNgIfEqs8JGM7Qo6D5KMMqRF8fd1qLakYQ9F5oEDUvLqPJ+TAktz8GMVuSndwW5BxA==,iv:eR8IR/MDmhk2JUoT2chCwRYOJGfxEBFGARf1CI7EG8Q=,tag:3fmRWA5eof304WSWKntDFg==,type:str]
@@ -5,8 +6,7 @@ kagi_token: ENC[AES256_GCM,data:6pxxMMQ3RCy6sdUFiuAy8rUzsIMMiBgPzphpgTVMfiHC98ej
 rke2_kubeconfig: ENC[AES256_GCM,data:DmmaV5bSnSSbLfenT7/xsv9qq5V1s2b9mzdeOe5JbhXLcvC9RRX3z1TkAwdC9IEAtr0cIiPigJS2fUCo0/baYSZ+lKTZ6pUmuPwX0x1g2O8Vdfe7jTTnTDnZ/A8+CIrS79uhsNxlmQNpEOCCSAOQ4+XAnFbPbLh/0QhV2M3a19ocJBQnFyNpYCxverRvNIfgHOoMskvwn3MEsmp6foOGnwPsbeQ1RRiIyCmf7c6jJQH7O5qDLcTIFNYNKiorr8veRhI5av0eX+5/rM8wWgBVNo/lf4TJnX+ufIUZQYCIz4vpfaw8N1jcpiAJiUFGdlKX+AR9b3ti8owa5+JmQkLNp4GBEI+I0tdMp15K6RjKqkKrkPujtUFntxXC07r+eQ37oUUvS9qilIMrkX0TxWoooShgOgQfVUEAEdtb2o830TL1FFZHTiy5RBkeRQxol4yAW/M0B0S4iIj/W07UHNdp5tBaPotsdyj9QQrumYS67GwWolVW007pG8nvD/lvP55nAndsLZpHAYSFI6z1N5ayx0N4I8OP+dT5ElaQv/tt/KO69EQYEwJetgRLnMQ34WKfAr3akLYja6QxkrhEnhfa60mXP9QLynEWGsfYdMUjPioIiImvdRi+5FkyvQ7aZyVzCRsMNGL3I5f1dXWz2wS+B1oB9yimOpfz4wr2794w64EKO1gF5dso17ebVEBuT8myeOenZREVUJCEunYcFPsMDD8bI+VD/VJDwQI/aWmukBWW9dztySiAJA0RWOb69LeApgx2SUwcPnx1yLerb5FWjA8hzY6GKGKyO8cNMRbH/l6QjAL/oMg3cgi7dH/7o1dGSphvGpTAOmcb82ZiT4gMSHhKIrxdLKyZclGu4Rf/mSjadGzLrEA6qj5r07wJOxZHu2bcMafWnoUZBuo7yE/ogVkruW1vI9c4lNBsOIUescE4sE5qjRncJkPEh9pcwWWLFnRQVCxVSpp72VyeJTxvo9gEBHuZGFF3J7R3YsTq1YhcXAR5+PIseIY46rdxqIh2WmVfG4W/iteuQh+JEcspvHNMB7a7j3yTEOHQ7ILaslLYDDnma4qo6SPuTzhx3Tbkx1WN5FelVkw1INV6qSjL83ghfk5nOVumbYurrTXviqqWg5ikCJ/Ewy2nrpNMbeVMs0x9Wcdpe7xi405IdJm6ry5Ipo9ZMKNJxRDP+ebUBgfiB3WzVI68AvvTpePz3KxGDwzh2aWu3Ei7CJoBrCrkEk2DPxoGvBinOvslZYuGhvUqL5XuNoDjLuxNCY1Dt67dvLi3ydiekZU8mNQ1qraMSFBg4KXH9e718X1zjuAGv86TVUfllxiXeoo6L/Sgn2iO1YW5w6igO5qkuIYEIi1rpx0jFOrbgvZeU6qjBHQmFwEw7h03IVw54s62E2dCy1wSq1BcUu1jUR5iJ0mPJ8ajGhb4D7MRO2wanAQxrzKJhSJ1OAdCzrebprLJRoo1v4YySiQkZ5cD57YnABST+i3/u0aWcS3xDi8Z/NKr0TMyvf2rWpvlOYUfIDgZLQiHBiph0UZNk/XNpvH23e6lEHG/ztmIu8CbcAuAbAy7Qwf664UGq9cK82gklvebO6lo5vCUGpx8mLOQYLIOefdoDJEei3DoTeZvtOpLkNXnRlwSlCY4geCNOioU3H6mtF4JdlLSFM7QMt/4CpMGEEzXDVCu7GI2Gem7VmBuLOBhGYxiF1zG+D6ZKUxOx1rmo7f2flgdfEtlkpQrIbeZfVEnqgb5z9Vw8bziW+Kc5CJyo9iV09BK0aeZWstnR6SKIWwuImWrGM0zSQBHd8QdrgicuR416PnFuElT3dkrF3TedLTKWKasWhlGOYeILMzCz/dnwy85ihp5zc10AbIpLISAvHSaMtEgdiwIc2n2Ti94ntnwfIB3AG20X3/yljDZKezn95+SZV8jOhMk/OcrpGH3UTB7ezHyf6gVD0qLXM6xUgi5vehhsO8ihFFTSNHf0881fimokRHQPjMJ9NC3J26JLhqJEs0Zfwvx2+7NrGq0pnRQ0W0FExy14dWWx270/EF8L91YRFohCJidJYgD5oTEab3eG1itM+OAAIA5xG+g5N6Re+34yO3JDMVUfuxGYpxKxfF8eVvAXB46+CH/lXQH6cPO8plWmlrzT8TS3rPj8MtvXrNaCVHuoWQ3oNu0cSGtsgcX/kJ8P8rOV8wNEdj2EpA8Fq8o741OapgFxpc5fMN3gKc6n7uwnKBHMMaQsZ2ymWeEn+qa6f/Me0DlyOkVLQFTYqAKibOoeyCtNILMf/NPMFMLe7Oktl6f9dvsMtu1zwCSYAV83/Ti8sZdnPFLET4OttQB+Bk8IX7BeTndAc3uMrVuOBwJC4sh2uGvRIJPEYbfw6p2amcn8mylN1o+l6sntpMrudEFo+oAz6M4UCEoNpotRIIMBB+uZo8T876TxSbENz31IDrOJ8ka4hCE0dK/gxZQsnoa16VvouTSc92se52n3RdELu+q9Oeeubd4htUJHhqxpbSmEQGVTWH2kJT7c76NZu7B634aUtoYI5eYmcLB3zsqVwZeG9fpzNeHMS2C6qzT4uKjxmbTW8eicDYSZSyJg4rpEjxf9GZn8f4898JtGvKF+esthhOlaxCEFcVoPQLC4pOAzY/TN+XTPk55bEPQ5LP3cByTfIv1UnZvSjXpAz2m+DlbkGfEqiICHr4HkISJS297CKI05tjpQNfO1Ylp89uL1hqwcddRee6+34kb+1XjSYwKMooZvSf/pasjj5xlpbCtxkiEIHp996H4MNXaySjZ7QU49Yy3EAKjulbc7xQXpkSUZb5Rh8yge/KpCK/5gK/fwlYIJ3tR4mIMN/b7HmfulBmktekK0G2fxagoKFot3DOwY1OnwIJhNzo0fCS3qFe9r2Ixs76C78gXo+DChKxYcYS7N5wmQy1PxKOsBpxeiWyaHCIC8Ey5dPSEoYi0zr+1A6wbkPaCrKI/C9Bwu8f04ySCBdbQQa52uCdWM2ctIsPHZNzkWNcXCfz9XLQZYZG/bQJtj+lDXgKKd8AiF0+WKzinGWHkKQbZPVYJI0s0jLXfH3G+kg5QztkfXedHNY6y0F5hh15jRYWsLAn6Ls2NJVP9SmCvl+pj6wHRKqDV7SbHz2bqCwLzzD68Wvv7b44OLFZEAH8F1TW8D205Dw7YFDiLMnWjeWv8ZX5CNUi7tkiCeORdQGiiv6n3CItvqWQ00tKnO5h+4/E97PtsSgfqG+Pgyjjscz4z02stB1XuaGbfPKe604CeYcmhjf9mV8gjfewOYTs+E2j6aoSKJbOtdiWfIHNngn92D/tOLB2UsuErYd3ZGLoH2yBOVL1rLnkY1QG4JxzXCwpnauQTzHRmg/WpJXurETbVyzFkzkF9YnX9iuJFt1mZglZuaO0JtC93xhdjMqjJyau4Oba7ZwwzyvM4TkgvffbPZit5nNAAZO0HO4r3t5nMIJeS1uBin66pjUWEuZ8ptjA5iYuAJwAg2VOPUuDKc9HBYmQjJ+Yx+KhO0aDmJd2pV/R6TOKua6jAnmny2FFqbyC3znPTfJZHOnVPZZ0V1D0NJ8dP62EDBebTnoFScE+93xyB9ETE3ubrBACAPTMuCQlqAY5ix2F1MpCCT7c0ovMyRlDaUJyFXS93UfJf4MmQg1+yCHuGX9E/bqUXsXC6SdJU9PdJ/3QdhN7iIcy8rPxOfYjJSwFrdUZn9sJcrVsbbPuObOM9HPOtp/E2xTOlYkfIeValLFxBb2lEBZghYXT05X82fSoe9ZBZdJfIMmLnuh/bP++bBVU7/y/aCYFcRCOafDdLQrTOpJ62SIDP0zN0YkmRy41qNlSaMp0ZZpxiK45ihqGP4aqWBmGC822dTsY4og1V07rRnfdG2wQcW+VHLldg72vRoc2brhfRZAOvwHQQCy0NxMD5pCgoSXJD4qsJrOFBcsmbs8YZ2omHzkVf+9ybnUD4WNCjVIvM,iv:CMrKYb+2QZVKEJMjW51rbiYW/cN6ATDzgwfBdSi9B10=,tag:qVqO5byXdj7DZdaHNx7S9A==,type:str]
 sops:
     age:
-        - recipient: age1sac93wpnjcv62s7583jv6a4yspndh6k0r25g3qx3k7gq748uvafst6nz4w
+        - enc: |
-          enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrY0pseTB5R290aXAzdnB3
             aTVMS2tBdnEvSjR5K241dElEa1Z1Tmt2a0ZJCnRSbVBsZ3lNVlNzdnFlY3VvaWpB
@@ -14,8 +14,8 @@ sops:
             S3hOa3p1MHVLek5zaUxhWXFiV2Z3R0UKxSrnYSoN6KcuFdg5K6qwcwh9/j9lI0HB
             HqujumuIfWkcctNk38AMn4beeesmXsbJQcUPHUVOZQw6Ov4jXaGz/Q==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age17ayje4uv2mhwehhp9jr3u9l0ds07396kt7ef40sufx89vm7cgfjq6d5d4y
+          recipient: age1sac93wpnjcv62s7583jv6a4yspndh6k0r25g3qx3k7gq748uvafst6nz4w
-          enc: |
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMazJ5VmNXQ2FRYzFuejBU
             bWNPWnI2a2R3NVBpY0Y2N0lXd1RXbUdmTkc0ClZDTSs4bklpeVEyMDNrVXJXRHRF
@@ -23,8 +23,8 @@ sops:
             a3dPbEZtL0tsOWpWSEtPblZSYk9NVTgKM6TfK7VX6v059FXpRjpAlgX+ab4f6vq2
             jH8jyO33YxQYI1kSgXJ5AR8evCoV3FzbZ5rzIy2PRmCOwFV8Im2bRg==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age1mar507c9mxmwalg486chs5kfh0mya38rv5w64ypfwnwlawewrpnswerpg8
+          recipient: age17ayje4uv2mhwehhp9jr3u9l0ds07396kt7ef40sufx89vm7cgfjq6d5d4y
-          enc: |
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4S0NrbGF4WXN5KzY4S0lt
             ZW1PMWE5NUF6NEIyWmp6RWY4MzNYbE0wQnpFCkdOaGtIWmtJT08zNmZNNzcvQldp
@@ -32,8 +32,8 @@ sops:
             VFJrQWNnNTJ4azVpMElHbmsrZnJPM2MKx/7XxkZfd1tPMck9FmoM6g28dp5JeXQ5
             OdiOLlKc2If1f6dLKkjDmmscMui6aLMQ8RJ8dLK7FKlYy+95VsHVrw==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age1w6avj7gd4f5frk90lsyh4e2k5am6z92hzlr0vpgrm767muyj59qsnuah62
+          recipient: age1mar507c9mxmwalg486chs5kfh0mya38rv5w64ypfwnwlawewrpnswerpg8
-          enc: |
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnZFpKSVpWMCt6Z3M5UGUz
             YVI4TG85UVh1eXYwVStQWk5xdEhhSjdNTzFJCk1mNnBtSVV0VFB0TnFIeVdocWFP
@@ -41,8 +41,8 @@ sops:
             MzNuSHlWWnNMYkJMMHZkcnh0cXZaREkKE+j0yWV/zK8lz8vRa0cywpLL2DiAFsgi
             fgCdeysSacrQLxB8iBWbusJ31ktyJMYLrsWFAdPkl0WN6HjaR3k3CQ==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age1avlhszrryt4gf4ya536jhzm7qwt9xfttm8x4sns6h9w2tahzqp8sspz9y5
+          recipient: age1w6avj7gd4f5frk90lsyh4e2k5am6z92hzlr0vpgrm767muyj59qsnuah62
-          enc: |
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDUFYyTzdpQlJ4VVJJbDF5
             cEhIQ1NSRVcwRUFBUzdaeXdkOWhPVjFIdGtBCk5qVmx1L09kVGhiNnlaQ0xoeTVz
@@ -50,8 +50,8 @@ sops:
             VmFINkwvZEFuWnkyb2JpTCtmRUVBbUkKKzbifH6Ue84MkpaLHrwDvJu8uvjY7yOY
             +qYg0rOqFuZAx9YiOjDR7JVeGpfHM+7pO9ZjSNTPH0f1NC3XwsNp1A==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age1dccte7xtwswgef089nd80dutp96xnezx5lrqnneh9cusegsnda8sj3dj6c
+          recipient: age1avlhszrryt4gf4ya536jhzm7qwt9xfttm8x4sns6h9w2tahzqp8sspz9y5
-          enc: |
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBSS9CQlE0azMwbFo4V0Ez
             V3pKL2QvY0NNdmoxZXhQRUU1cG9Temk5M3pZCjBZUHJFRmZ1bTZzQ2RGU2F3WXF5
@@ -59,8 +59,8 @@ sops:
             Zm1ReDlMWW8wak5Jb0VncFV2bFJROWsKWi9DTgveMgGG8eK4qNeAGGG/gfiJS96G
             232Tgf94Pb8eAU2zbF77pLWMaqTBbYPz1tggcMTfrAeDohq+/0sU8g==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age1ped3hpugq06908ex8kgama33qckqe03rmac5pa6th87vks5d249qhshvqu
+          recipient: age1dccte7xtwswgef089nd80dutp96xnezx5lrqnneh9cusegsnda8sj3dj6c
-          enc: |
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqS0p2TVhWd2VMQTNNR0or
             amhNdTh5bmY3WWh1QkgveWZEMEtxSCt3Tng4CnVEKzhDMFVzRktndmI5OFhSei94
@@ -68,7 +68,8 @@ sops:
             TC91cmtZWm03dzYwS2E3dkorNkdFY2sKj5OZHOtKx1NGPSGKsWjC/8+seUAhvmxb
             wQ0iuPAq6yDLhYV69n7Jx4G9fKoidLIQxq+Ia+tLcYt58UDX7aixJQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-05-04T03:17:35Z"
+          recipient: age1ped3hpugq06908ex8kgama33qckqe03rmac5pa6th87vks5d249qhshvqu
-    mac: ENC[AES256_GCM,data:hFnRRENIaWa+Yidk7JqY+XMZ4xyekQLY9MMSgo5j4w7UI+Fb82RpNjmFrOS13ck7kKS+CVLWrFSEDxWJYcjHyLE5btoi06SFiZYfDF0JlOfq6e+loTj+TqhyWyJoQ3ZYaj9weak+qCroN4q88EWrle3Rlw0b/67lnkkzYJYYOlk=,iv:i9DVooO/9Gjr+yWaEkdXEWABAyrp8qNPt48EzqoEfiA=,tag:8hYmoJ9p3fse9eckhYqkvg==,type:str]
+    lastmodified: "2026-06-16T18:49:15Z"
+    mac: ENC[AES256_GCM,data:Q51p1A317BYzKvXSpkx2HBduGLGvxdQFi/BCfUtKWV9uAJGlQDp//eGJ7kJEG6DIO6sWUddf75fBLYAQcqm3iogIetTLUuQl3OhHSpAPvGpUDC6Hh87sAZy/ebaN2cy7BhJy5cjPJ9JAkfHqLCFRP+cVIwS/eb87GzwvWdSGZbc=,iv:yTTwhHCB09Qb6a437VENFiWQPp8CHwd0TelFj4ugO3U=,tag:JXN58pSy2I04O44Hg4pQcw==,type:str]
     unencrypted_suffix: _unencrypted
-    version: 3.12.1
+    version: 3.13.1

systems/aarch64-linux/lin-o1-headscale/default.nix

@@ -15,7 +15,7 @@ in
     (modulesPath + "/profiles/qemu-guest.nix")
   ];
 
-  system.stateVersion = "25.11";
+  system.stateVersion = "26.05";
   time.timeZone = "UTC";
 
   boot.loader.grub = {

systems/aarch64-linux/lin-o1-node/default.nix

@@ -12,7 +12,7 @@ in
     (modulesPath + "/profiles/qemu-guest.nix")
   ];
 
-  system.stateVersion = "25.11";
+  system.stateVersion = "26.05";
   time.timeZone = "UTC";
 
   boot.loader.grub = {

systems/aarch64-linux/lin-va-mbp-personal/default.nix

@@ -11,12 +11,20 @@ in
     ./hardware-configuration.nix
   ];
 
-  system.stateVersion = "25.11";
+  system.stateVersion = "26.05";
   time.timeZone = "America/New_York";
 
   programs.firejail.enable = true;
   programs.nix-ld.enable = true;
 
+  # Asahi Wi-Fi Resume Bug - The Broadcom driver can fail to reconnect after suspend on this MacBook.
+  powerManagement.resumeCommands = ''
+    ${pkgs.kmod}/bin/modprobe -r brcmfmac_wcc 2>/dev/null || true
+    ${pkgs.kmod}/bin/modprobe -r brcmfmac 2>/dev/null || true
+    ${pkgs.kmod}/bin/modprobe brcmfmac
+    ${pkgs.systemd}/bin/systemctl restart NetworkManager.service
+  '';
+
   # System Config
   reichard = {
     nix = enabled;

systems/aarch64-linux/lin-va-mbp-work-vm/default.nix

@@ -11,7 +11,7 @@ in
     (modulesPath + "/profiles/qemu-guest.nix")
   ];
 
-  system.stateVersion = "25.11";
+  system.stateVersion = "26.05";
   time.timeZone = "America/New_York";
 
   programs.nix-ld.enable = true;

systems/aarch64-raw-efi/lin-terminal-image/default.nix

@@ -3,7 +3,7 @@ let
   inherit (lib.${namespace}) enabled;
 in
 {
-  system.stateVersion = "25.11";
+  system.stateVersion = "26.05";
   time.timeZone = "America/New_York";
 
   # Config Boot

systems/x86_64-linux/lin-o1-x86-node/default.nix

@@ -15,7 +15,7 @@ in
     (modulesPath + "/profiles/qemu-guest.nix")
   ];
 
-  system.stateVersion = "25.11";
+  system.stateVersion = "26.05";
   time.timeZone = "UTC";
 
   boot.loader.grub = {

systems/x86_64-linux/lin-ovh-kube1/default.nix

@@ -15,7 +15,7 @@ in
     (modulesPath + "/profiles/qemu-guest.nix")
   ];
 
-  system.stateVersion = "25.11";
+  system.stateVersion = "26.05";
   time.timeZone = "UTC";
 
   networking.firewall.allowedTCPPorts = [ 443 ];

systems/x86_64-linux/lin-ssd-kube1/default.nix

@@ -12,7 +12,7 @@ in
     (modulesPath + "/profiles/qemu-guest.nix")
   ];
 
-  system.stateVersion = "25.11";
+  system.stateVersion = "26.05";
   time.timeZone = "UTC";
 
   networking.firewall.allowedTCPPorts = [ 443 ];

systems/x86_64-linux/lin-va-desktop/default.nix

@@ -15,7 +15,7 @@ let
   };
 in
 {
-  system.stateVersion = "25.11";
+  system.stateVersion = "26.05";
   time.timeZone = "America/New_York";
   nixpkgs.config.allowUnfree = true;
   hardware.nvidia-container-toolkit.enable = true;
@@ -100,6 +100,8 @@ in
       opengl = {
         enable = true;
         enableNvidia = true;
+        # GTX 1080 Ti is Pascal; NVIDIA 590+ (nixpkgs stable = 595) dropped Pascal support.
+        nvidiaPackage = config.boot.kernelPackages.nvidiaPackages.legacy_580;
       };
     };
 

systems/x86_64-linux/lin-va-nix-builder/default.nix

@@ -3,7 +3,7 @@
 }:
 {
   time.timeZone = "America/New_York";
-  system.stateVersion = "25.11";
+  system.stateVersion = "26.05";
 
   reichard = {
     system = {

systems/x86_64-linux/lin-va-office/default.nix

@@ -9,7 +9,7 @@ let
   cfg = config.${namespace}.user;
 in
 {
-  system.stateVersion = "25.11";
+  system.stateVersion = "26.05";
   time.timeZone = "America/New_York";
 
   nixpkgs.config.allowUnfree = true;

systems/x86_64-linux/lin-va-terminal/default.nix

@@ -3,7 +3,7 @@ let
   inherit (lib.${namespace}) enabled;
 in
 {
-  system.stateVersion = "25.11";
+  system.stateVersion = "26.05";
   time.timeZone = "America/New_York";
 
   programs.nix-ld.enable = true;

systems/x86_64-linux/lin-va-thinkpad/default.nix

@@ -7,16 +7,9 @@ let
   inherit (lib.${namespace}) enabled;
 in
 {
-  system.stateVersion = "25.11";
+  system.stateVersion = "26.05";
   time.timeZone = "America/New_York";
 
-  boot = {
-    kernelParams = [
-      # Mask GPE03 (EC wakeup events) to allow hibernation without spurious CPU wakeups
-      "acpi_mask_gpe=0x03"
-    ];
-  };
-
   programs.nix-ld.enable = true;
 
   hardware = {
@@ -85,14 +78,4 @@ in
       sops = enabled;
     };
   };
-
-  # Additional System Packages
-  environment.systemPackages = with pkgs; [
-    dool
-    jq
-    mosh
-    rclone
-    sqlite-interactive
-    unzip
-  ];
 }

systems/x86_64-vmware/lin-va-rke2/default.nix

@@ -13,7 +13,7 @@ in
 
   config = {
     # Basic System
-    system.stateVersion = "25.11";
+    system.stateVersion = "26.05";
     time.timeZone = "UTC";
 
     reichard = {