update opencode config, secrets, tailscale, and agents input

- opencode: remove deprecated google_auth, add git_master config,
  experimental truncation, use glm-4.6v for multimodal-looker,
  upgrade categories to glm-5, remove opencode-memory plugin
- m3-atlas: add ref/exa/outline/basecamp secret declarations
- m3-kratos: enable tailscale with ssh and reset flags
- agents: switch back to remote git input

flake.lock

@@ -24,11 +24,11 @@
     "agents": {
       "flake": false,
       "locked": {
-        "lastModified": 1770836286,
-        "narHash": "sha256-8vdozOXwlpOjSRFu6H+HnGByGCnBV+ggX4uIRHUfiaY=",
+        "lastModified": 1771054446,
+        "narHash": "sha256-0IispDJYxOtWn1usZh6AR4nF3ouCscXDxBzgwAVjhx0=",
         "ref": "refs/heads/master",
-        "rev": "94b89da5335da059c75bccc686be91a923726075",
-        "revCount": 48,
+        "rev": "923e2f1eaad96f440bbb76d07bb66ac4f5b4460a",
+        "revCount": 55,
         "type": "git",
         "url": "https://code.m3ta.dev/m3tam3re/AGENTS"
       },

home/features/coding/opencode.nix

@@ -22,7 +22,7 @@
     enable = true;
     settings = {
       theme = "opencode";
-      plugin = ["oh-my-opencode" "opencode-antigravity-auth@beta" "opencode-memory"];
+      plugin = ["oh-my-opencode" "opencode-antigravity-auth@beta"];
       agent =
         builtins.fromJSON
         (builtins.readFile "${inputs.agents}/agents/agents.json");
@@ -211,7 +211,7 @@
 
   home.file.".config/opencode/oh-my-opencode.json".text = builtins.toJSON {
     "$schema" = "https://raw.githubusercontent.com/code-yeongyu/oh-my-opencode/master/assets/oh-my-opencode.schema.json";
-    google_auth = false;
+    # google_auth removed - use opencode-antigravity-auth plugin instead (already in plugin array)
     agents = {
       sisyphus = {
         model = "zai-coding-plan/glm-5";
@@ -226,7 +226,7 @@
         model = "zai-coding-plan/glm-4.5-air";
       };
       multimodal-looker = {
-        model = "zai-coding-plan/glm-5";
+        model = "zai-coding-plan/glm-4.6v";
       };
       prometheus = {
         model = "zai-coding-plan/glm-5";
@@ -243,28 +243,36 @@
     };
     categories = {
       visual-engineering = {
-        model = "zai-coding-plan/glm-4.7";
+        model = "zai-coding-plan/glm-5";
       };
       ultrabrain = {
-        model = "zai-coding-plan/glm-4.7";
+        model = "zai-coding-plan/glm-5";
       };
       artistry = {
-        model = "zai-coding-plan/glm-4.7";
+        model = "zai-coding-plan/glm-5";
       };
       quick = {
-        model = "zai-coding-plan/glm-4.7";
+        model = "zai-coding-plan/glm-5";
       };
       unspecified-low = {
-        model = "zai-coding-plan/glm-4.7";
+        model = "zai-coding-plan/glm-5";
       };
       unspecified-high = {
-        model = "zai-coding-plan/glm-4.7";
+        model = "zai-coding-plan/glm-5";
       };
       writing = {
-        model = "zai-coding-plan/glm-4.7";
+        model = "zai-coding-plan/glm-5";
       };
     };
     disabled_mcps = ["context7" "websearch"];
-    disabled_hooks = ["comment-checker"]; #Temporarily added to address bug in 3.5.1 (MCP)
+    disabled_hooks = ["comment-checker"];
+    git_master = {
+      commit_footer = false;
+      include_co_authored_by = false;
+    };
+    experimental = {
+      truncate_all_tool_outputs = true;
+      aggressive_truncation = false;
+    };
   };
 }

hosts/m3-atlas/secrets.nix

@@ -1,25 +1,25 @@
 {
   age = {
     secrets = {
-      baserow-env = { file = ../../secrets/baserow-env.age; };
-      ghost-env = { file = ../../secrets/ghost-env.age; };
+      baserow-env = {file = ../../secrets/baserow-env.age;};
+      ghost-env = {file = ../../secrets/ghost-env.age;};
       kestra-config = {
         file = ../../secrets/kestra-config.age;
         mode = "644";
       };
-      kestra-env = { file = ../../secrets/kestra-env.age; };
-      littlelink-m3tam3re = { file = ../../secrets/littlelink-m3tam3re.age; };
-      minio-root-cred = { file = ../../secrets/minio-root-cred.age; };
-      n8n-env = { file = ../../secrets/n8n-env.age; };
-      paperless-key = { file = ../../secrets/paperless-key.age; };
-      restreamer-env = { file = ../../secrets/restreamer-env.age; };
-      searx = { file = ../../secrets/searx.age; };
-      tailscale-key = { file = ../../secrets/tailscale-key.age; };
+      kestra-env = {file = ../../secrets/kestra-env.age;};
+      littlelink-m3tam3re = {file = ../../secrets/littlelink-m3tam3re.age;};
+      minio-root-cred = {file = ../../secrets/minio-root-cred.age;};
+      n8n-env = {file = ../../secrets/n8n-env.age;};
+      paperless-key = {file = ../../secrets/paperless-key.age;};
+      restreamer-env = {file = ../../secrets/restreamer-env.age;};
+      searx = {file = ../../secrets/searx.age;};
+      tailscale-key = {file = ../../secrets/tailscale-key.age;};
       traefik = {
         file = ../../secrets/traefik.age;
         owner = "traefik";
       };
-      vaultwarden-env = { file = ../../secrets/vaultwarden-env.age; };
+      vaultwarden-env = {file = ../../secrets/vaultwarden-env.age;};
       m3tam3re-secrets = {
         file = ../../secrets/m3tam3re-secrets.age;
         owner = "m3tam3re";
@@ -30,6 +30,26 @@
         owner = "gitea-runner";
         group = "gitea-runner";
       };
+      ref-key = {
+        file = ../../secrets/ref-key.age;
+        owner = "m3tam3re";
+      };
+      exa-key = {
+        file = ../../secrets/exa-key.age;
+        owner = "m3tam3re";
+      };
+      outline-key = {
+        file = ../../secrets/outline-key.age;
+        owner = "m3tam3re";
+      };
+      basecamp-client-id = {
+        file = ../../secrets/basecamp-client-id.age;
+        owner = "m3tam3re";
+      };
+      basecamp-client-secret = {
+        file = ../../secrets/basecamp-client-secret.age;
+        owner = "m3tam3re";
+      };
     };
   };
 }

hosts/m3-kratos/secrets.nix

@@ -5,7 +5,7 @@
         file = ../../secrets/anytype-key.age;
         owner = "m3tam3re";
       };
-      tailscale-key = { file = ../../secrets/tailscale-key.age; };
+      tailscale-key = {file = ../../secrets/tailscale-key.age;};
       wg-DE = {
         file = ../../secrets/wg-DE.age;
         path = "/etc/wireguard/DE.conf";

hosts/m3-kratos/services/tailscale.nix

@@ -1,12 +1,13 @@
 {config, ...}: {
   services.tailscale = {
-    enable = false;
+    enable = true;
     authKeyFile = config.age.secrets.tailscale-key.path;
     useRoutingFeatures = "both";
     extraUpFlags = [
       "--login-server=https://va.m3tam3re.com"
       "--accept-routes"
-      "--exit-node-allow-lan-access"
+      "--ssh"
+      "--reset"
     ];
   };
 }