Drop the custom mkLlmAgentsOverlay factory (172 top-level attrs +
17-entry blocklist guarding against nixpkgs clobbering — the source of
the webcord buildNpmPackage and fetchPnpmDeps stack overflows).
Apply inputs.llm-agents.overlays.shared-nixpkgs directly instead. It
exposes everything under the pkgs.llm-agents.* namespace and clobbers
nothing, so the blocklist becomes unnecessary. Packages stay built
against this system's nixpkgs (allowUnfree), which qmd.override
cudaSupport in the m3-ares NVIDIA specialisation requires.
Consumers switched to namespaced refs:
- hosts/m3-hermes/services/hermes-agent.nix: herdr, opencode, qmd
- m3ta-home agents.nix (input bumped): agent-browser, beads, herdr,
qmd, openspec — unqualified refs would now silently resolve to
outdated nixpkgs attrs (opencode 0.3.x) or vanish.
openspec pass-through dropped from m3ta-nixpkgs (input bumped):
llm-agents is the single source of truth now.
Note: flake.nix/lock carry the pre-existing local path inputs for
m3ta-home and m3ta-nixpkgs (dev state, gitea URLs kept as comments).
Verified: drvPath evals for m3-hermes, m3-atlas, and the m3-ares
NVIDIA specialisation (qmd + CUDA EULA) all pass; statix/deadnix clean.
- New hermes-dashboard.service: runs 'hermes dashboard' on 0.0.0.0:9119
- Firewall restricts port 9119 to Netbird mesh VPN range (100.64.0.0/16)
- Runs as hermes user with NoNewPrivileges + ProtectSystem hardening
- Depends on hermes-agent.service (starts after gateway)
- Added placeholder hermes-api-server-key.age (needs real encryption on host)
- Enable delegation.orchestrator_enabled with max_spawn_depth=2
- Switch TTS from ElevenLabs (paid) to Edge TTS (free)
- Voice: de-DE-SeraphinaMultilingualNeural — friendly, multilingual German female
- No API key required
Add pkgs.uv to systemd.services.hermes-agent.path so that CronJobs
and terminal sessions can execute PEP 723 scripts via 'uv run'
(e.g. garmin-daily.py for Garmin Connect health data).
Also adds uv to environment.systemPackages for general availability.
- Fix hardcoded user path in webapps.nix (use homeDirectory)
- Normalize wallpapers option to use .enable suffix
- Remove duplicate FZF keybind declaration
- Update comments to match actual implementation
matrix-nio is installed in the container's writable venv layer
(~/.venv) but the hermes process uses the read-only Nix store Python.
This adds PYTHONPATH and LD_LIBRARY_PATH as container-level env vars
so matrix-nio + libolm (e2e encryption) are importable.
m3ta-chiron
m3tam3re
m3tam3re