update agent-lib

.a5c/inputs/fix-eval-warnings-inputs.json

@@ -0,0 +1,5 @@
+{
+  "nixosConfigDir": "/home/m3tam3re/p/NIX/nixos-config",
+  "m3taHomeDir": "/home/m3tam3re/p/NIX/m3ta-home",
+  "specPath": "/home/m3tam3re/p/NIX/nixos-config/.a5c/inputs/fix-eval-warnings-spec.md"
+}

.a5c/inputs/fix-eval-warnings-spec.md

@@ -0,0 +1,10 @@
+Fix the following Nix/Home Manager evaluation warnings except for the gc/nh conflict warning:
+
+- `evaluation warning: 'system' has been renamed to/replaced by 'stdenv.hostPlatform.system'`
+- `evaluation warning: m3tam3re profile: programs.ssh.matchBlocks defined in /nix/store/...-users/m3tam3re/identities/private.nix is deprecated. Use programs.ssh.settings.`
+
+Do not fix or change the warning:
+
+- `evaluation warning: programs.nh.clean.enable and nix.gc.automatic are both enabled. Please use one or the other to avoid conflict.`
+
+The private identity source file is in `/home/m3tam3re/p/NIX/m3ta-home/users/m3tam3re/identities/private.nix`.

.a5c/processes/fix-nix-eval-warnings.js

@@ -0,0 +1,301 @@
+/**
+ * @process local/fix-nix-eval-warnings
+ * @description Fix Nix/Home Manager evaluation warnings except the nh/gc conflict warning.
+ * @skill systematic-debugging methodologies/superpowers/systematic-debugging.js
+ * @skill verification-before-completion methodologies/superpowers/verification-before-completion.js
+ * @skill root-cause-diagnosis methodologies/shared/root-cause-diagnosis.js
+ */
+
+import { defineTask } from '@a5c-ai/babysitter-sdk';
+
+const q = (value) => `'${String(value).replace(/'/g, `'\\''`)}'`;
+
+export async function process(inputs, ctx) {
+  const nixosConfigDir = inputs.nixosConfigDir || '/home/m3tam3re/p/NIX/nixos-config';
+  const m3taHomeDir = inputs.m3taHomeDir || '/home/m3tam3re/p/NIX/m3ta-home';
+  const specPath = inputs.specPath || `${nixosConfigDir}/.a5c/inputs/fix-eval-warnings-spec.md`;
+
+  const spec = await ctx.task(readSpecTask, { specPath });
+
+  const inspection = await ctx.task(inspectWarningSourcesTask, {
+    nixosConfigDir,
+    m3taHomeDir,
+  });
+
+  const implementation = await ctx.task(implementFixesTask, {
+    nixosConfigDir,
+    m3taHomeDir,
+    spec: spec.stdout,
+    inspection: inspection.stdout,
+  });
+
+  const formatting = await ctx.task(formatChangedNixTask, {
+    m3taHomeDir,
+  });
+
+  const verification = await ctx.task(verifyWarningsTask, {
+    nixosConfigDir,
+    m3taHomeDir,
+  });
+
+  const artifacts = await ctx.task(collectArtifactsTask, {
+    nixosConfigDir,
+    m3taHomeDir,
+    verifyStdout: verification.stdout || '',
+    verifyStderr: verification.stderr || '',
+  });
+
+  const acceptance = await ctx.task(acceptanceReviewTask, {
+    spec: spec.stdout,
+    artifacts: artifacts.stdout,
+  });
+
+  if (!acceptance.accepted) {
+    await ctx.breakpoint({
+      title: 'Warning fix acceptance review failed',
+      question: `Acceptance review did not approve the changes: ${acceptance.reason}`,
+      context: {
+        runId: ctx.runId,
+        files: [
+          { path: `${m3taHomeDir}/users/m3tam3re/identities/private.nix`, format: 'nix', label: 'Private SSH identity' },
+          { path: `${m3taHomeDir}/profiles/sets/coding/agents/agents.nix`, format: 'nix', label: 'Agent packages' },
+          { path: `${m3taHomeDir}/profiles/contexts/desktop/default.nix`, format: 'nix', label: 'Desktop packages' },
+        ],
+      },
+    });
+  }
+
+  return {
+    success: acceptance.accepted,
+    summary: implementation.summary,
+    changedFiles: implementation.changedFiles,
+    verification: {
+      formatting: formatting.stdout,
+      warnings: verification.stdout,
+      review: acceptance,
+    },
+  };
+}
+
+export const readSpecTask = defineTask('read-spec', (args, taskCtx) => ({
+  kind: 'shell',
+  title: 'Read warning-fix spec',
+  shell: {
+    command: `cat ${q(args.specPath)}`,
+    expectedExitCode: 0,
+    timeout: 10000,
+  },
+  io: {
+    inputJsonPath: `tasks/${taskCtx.effectId}/input.json`,
+    outputJsonPath: `tasks/${taskCtx.effectId}/output.json`,
+  },
+  labels: ['spec', 'shell'],
+}));
+
+export const inspectWarningSourcesTask = defineTask('inspect-warning-sources', (args, taskCtx) => ({
+  kind: 'shell',
+  title: 'Inspect current warning sources',
+  shell: {
+    command: [
+      'set -euo pipefail',
+      `echo '== nixos-config status =='`,
+      `cd ${q(args.nixosConfigDir)} && git status --short`,
+      `echo`,
+      `echo '== m3ta-home status =='`,
+      `cd ${q(args.m3taHomeDir)} && git status --short`,
+      `echo`,
+      `echo '== active pkgs.system-style package selectors =='`,
+      `grep -RIn --include='*.nix' -E 'packages[.]\\$\\{pkgs[.]system\\}|packages[.]\\$\\{prev[.]system\\}|packages[.]\\$\\{final[.]system\\}' ${q(args.nixosConfigDir)} ${q(args.m3taHomeDir)} || true`,
+      `echo`,
+      `echo '== SSH matchBlocks in m3ta-home identities =='`,
+      `grep -RIn --include='*.nix' 'matchBlocks' ${q(`${args.m3taHomeDir}/users/m3tam3re/identities`)} || true`,
+    ].join('\n'),
+    expectedExitCode: 0,
+    timeout: 30000,
+  },
+  io: {
+    inputJsonPath: `tasks/${taskCtx.effectId}/input.json`,
+    outputJsonPath: `tasks/${taskCtx.effectId}/output.json`,
+  },
+  labels: ['diagnosis', 'shell'],
+}));
+
+export const implementFixesTask = defineTask('implement-warning-fixes', (args, taskCtx) => ({
+  kind: 'agent',
+  title: 'Implement requested warning fixes',
+  agent: {
+    name: 'worker',
+    prompt: {
+      role: 'Nix/Home Manager maintenance engineer',
+      task: 'Edit the repositories to remove the requested evaluation warnings, excluding the nh/gc warning by request.',
+      context: {
+        nixosConfigDir: args.nixosConfigDir,
+        m3taHomeDir: args.m3taHomeDir,
+        specVerbatim: args.spec,
+        inspectionStdout: args.inspection,
+      },
+      instructions: [
+        'Execute the task fully; do not just provide a plan.',
+        'Do not invoke the babysit skill or create another babysitter run.',
+        'Read every file before editing it.',
+        'Preserve unrelated existing user changes, especially any dirty files in nixos-config such as flake.nix or flake.lock.',
+        'Fix active uses of pkgs.system/prev.system/final.system that trigger the Nixpkgs deprecation warning by using stdenv.hostPlatform.system through the appropriate package set.',
+        'Migrate /home/m3tam3re/p/NIX/m3ta-home/users/m3tam3re/identities/private.nix from programs.ssh.matchBlocks to programs.ssh.settings.',
+        'For programs.ssh.settings, use OpenSSH directive names such as HostName, User, Port, and IdentityFile; do not keep legacy camelCase option names under settings.',
+        'Do not change programs.nh.clean.enable or nix.gc.automatic; the user explicitly excluded that warning.',
+        'Keep the change minimal and focused on the warnings in the spec.',
+        'Run a quick static check of the edited files if practical, but leave deterministic verification to the process quality gate.',
+      ],
+      outputFormat: 'JSON with summary, changedFiles, and verificationNotes.',
+    },
+    outputSchema: {
+      type: 'object',
+      required: ['summary', 'changedFiles', 'verificationNotes'],
+      properties: {
+        summary: { type: 'string' },
+        changedFiles: { type: 'array', items: { type: 'string' } },
+        verificationNotes: { type: 'array', items: { type: 'string' } },
+      },
+    },
+  },
+  io: {
+    inputJsonPath: `tasks/${taskCtx.effectId}/input.json`,
+    outputJsonPath: `tasks/${taskCtx.effectId}/output.json`,
+  },
+  labels: ['implementation', 'agent', 'nix'],
+}));
+
+export const formatChangedNixTask = defineTask('format-changed-nix', (args, taskCtx) => ({
+  kind: 'shell',
+  title: 'Format changed Nix files',
+  shell: {
+    command: [
+      'set -euo pipefail',
+      `cd ${q(args.m3taHomeDir)}`,
+      `if command -v alejandra >/dev/null 2>&1; then`,
+      `  alejandra users/m3tam3re/identities/private.nix profiles/sets/coding/agents/agents.nix profiles/contexts/desktop/default.nix`,
+      `else`,
+      `  nix run nixpkgs#alejandra -- users/m3tam3re/identities/private.nix profiles/sets/coding/agents/agents.nix profiles/contexts/desktop/default.nix`,
+      `fi`,
+    ].join('\n'),
+    expectedExitCode: 0,
+    timeout: 120000,
+  },
+  io: {
+    inputJsonPath: `tasks/${taskCtx.effectId}/input.json`,
+    outputJsonPath: `tasks/${taskCtx.effectId}/output.json`,
+  },
+  labels: ['format', 'shell'],
+}));
+
+export const verifyWarningsTask = defineTask('verify-warning-removal', (args, taskCtx) => ({
+  kind: 'shell',
+  title: 'Verify requested warnings are gone',
+  shell: {
+    command: [
+      'set -euo pipefail',
+      `echo '== static checks =='`,
+      `! grep -RIn --include='*.nix' -E 'packages[.]\\$\\{pkgs[.]system\\}|packages[.]\\$\\{prev[.]system\\}|packages[.]\\$\\{final[.]system\\}' ${q(`${args.m3taHomeDir}/profiles`)} || { echo 'Found deprecated package system selector' >&2; exit 1; }`,
+      `! grep -n 'matchBlocks' ${q(`${args.m3taHomeDir}/users/m3tam3re/identities/private.nix`)} || { echo 'private.nix still uses matchBlocks' >&2; exit 1; }`,
+      `grep -n 'settings = {' ${q(`${args.m3taHomeDir}/users/m3tam3re/identities/private.nix`)}`,
+      `echo`,
+      `echo '== nix eval m3-ares =='`,
+      `cd ${q(args.nixosConfigDir)}`,
+      `eval_stdout=$(mktemp)`,
+      `eval_stderr=$(mktemp)`,
+      `set +e`,
+      `nix eval .#nixosConfigurations.m3-ares.config.system.build.toplevel.drvPath --show-trace >"$eval_stdout" 2>"$eval_stderr"`,
+      `status=$?`,
+      `set -e`,
+      `cat "$eval_stdout"`,
+      `cat "$eval_stderr" >&2`,
+      `if [ "$status" -ne 0 ]; then exit "$status"; fi`,
+      `if grep -F "'system' has been renamed" "$eval_stderr"; then echo 'Deprecated system warning still present' >&2; exit 1; fi`,
+      `if grep -F 'programs.ssh.matchBlocks' "$eval_stderr"; then echo 'Deprecated SSH matchBlocks warning still present' >&2; exit 1; fi`,
+      `if grep -F 'programs.nh.clean.enable and nix.gc.automatic' "$eval_stderr" >/dev/null; then echo 'Allowed nh/gc warning remains by request.'; fi`,
+    ].join('\n'),
+    expectedExitCode: 0,
+    timeout: 300000,
+  },
+  io: {
+    inputJsonPath: `tasks/${taskCtx.effectId}/input.json`,
+    outputJsonPath: `tasks/${taskCtx.effectId}/output.json`,
+  },
+  labels: ['verification', 'shell', 'nix'],
+}));
+
+export const collectArtifactsTask = defineTask('collect-artifacts', (args, taskCtx) => ({
+  kind: 'shell',
+  title: 'Collect diffs and verification output',
+  shell: {
+    command: [
+      'set -euo pipefail',
+      `echo '== m3ta-home diff =='`,
+      `cd ${q(args.m3taHomeDir)} && git diff -- users/m3tam3re/identities/private.nix profiles/sets/coding/agents/agents.nix profiles/contexts/desktop/default.nix`,
+      `echo`,
+      `echo '== nixos-config diff (should not include warning fix unless needed) =='`,
+      `cd ${q(args.nixosConfigDir)} && git diff -- overlays/default.nix flake.nix flake.lock || true`,
+      `echo`,
+      `echo '== verification stdout =='`,
+      `cat <<'VERIFY_STDOUT'`,
+      args.verifyStdout || '',
+      `VERIFY_STDOUT`,
+      `echo`,
+      `echo '== verification stderr =='`,
+      `cat <<'VERIFY_STDERR'`,
+      args.verifyStderr || '',
+      `VERIFY_STDERR`,
+    ].join('\n'),
+    expectedExitCode: 0,
+    timeout: 30000,
+  },
+  io: {
+    inputJsonPath: `tasks/${taskCtx.effectId}/input.json`,
+    outputJsonPath: `tasks/${taskCtx.effectId}/output.json`,
+  },
+  labels: ['artifacts', 'shell'],
+}));
+
+export const acceptanceReviewTask = defineTask('acceptance-review', (args, taskCtx) => ({
+  kind: 'agent',
+  title: 'Review changes against requested warning fixes',
+  agent: {
+    name: 'reviewer',
+    prompt: {
+      role: 'Acceptance reviewer for a Nix/Home Manager warning fix',
+      task: 'Compare SPEC to ARTIFACTS directly and decide whether the requested warnings were fixed without touching the excluded nh/gc warning.',
+      instructions: [
+        'Ignore any narrative in your context about how ARTIFACTS were built.',
+        'Do not ask for additional changes unless they are required by the SPEC.',
+        'Accept if the system deprecation warning and private SSH matchBlocks warning are addressed, and the nh/gc conflict remains untouched.',
+        '',
+        'SPEC (verbatim):',
+        '---',
+        args.spec,
+        '---',
+        '',
+        'ARTIFACTS (verbatim):',
+        '---',
+        args.artifacts,
+        '---',
+        '',
+        'Compare SPEC to ARTIFACTS directly. Ignore any narrative in your context about how ARTIFACTS were built.',
+      ],
+      outputFormat: 'JSON with accepted boolean, reason string, and checkedCriteria array.',
+    },
+    outputSchema: {
+      type: 'object',
+      required: ['accepted', 'reason', 'checkedCriteria'],
+      properties: {
+        accepted: { type: 'boolean' },
+        reason: { type: 'string' },
+        checkedCriteria: { type: 'array', items: { type: 'string' } },
+      },
+    },
+  },
+  io: {
+    inputJsonPath: `tasks/${taskCtx.effectId}/input.json`,
+    outputJsonPath: `tasks/${taskCtx.effectId}/output.json`,
+  },
+  labels: ['acceptance', 'agent', 'review'],
+}));

flake.lock

@@ -43,26 +43,6 @@
       }
     },
     "agent-lib": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1780157040,
-        "narHash": "sha256-j2d3nj3FvOlxQ+Zlse+rMo3qHD3m4Gick5uiwtTaA2o=",
-        "ref": "refs/heads/master",
-        "rev": "f63712a9ba03da6e2f591766d0f055aa65e6d237",
-        "revCount": 24,
-        "type": "git",
-        "url": "ssh://gitea@code.m3ta.dev/m3tam3re/agent-lib"
-      },
-      "original": {
-        "type": "git",
-        "url": "ssh://gitea@code.m3ta.dev/m3tam3re/agent-lib"
-      }
-    },
-    "agent-lib_2": {
       "inputs": {
         "nixpkgs": [
           "m3ta-home",
@@ -70,11 +50,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1780157040,
-        "narHash": "sha256-j2d3nj3FvOlxQ+Zlse+rMo3qHD3m4Gick5uiwtTaA2o=",
+        "lastModified": 1781348569,
+        "narHash": "sha256-1BJtmKSqtD0CD753ZE37RgxvCJK6Iw3iKLDDaS8trY4=",
         "ref": "refs/heads/master",
-        "rev": "f63712a9ba03da6e2f591766d0f055aa65e6d237",
-        "revCount": 24,
+        "rev": "75a2ed2533b4d6d8e4a34acd37e83d98d81a5fb0",
+        "revCount": 30,
         "type": "git",
         "url": "ssh://gitea@code.m3ta.dev/m3tam3re/agent-lib"
       },
@@ -104,11 +84,11 @@
     "agents_2": {
       "flake": false,
       "locked": {
-        "lastModified": 1778518220,
-        "narHash": "sha256-6AQs9VZ0/DuD4njPbYHRE4v+SgJc6SBrGwemTWxikVc=",
+        "lastModified": 1780133320,
+        "narHash": "sha256-8AiN9tV9PBb5xblJiPlhumBbKj61qLjzqXXFtkj3vvY=",
         "ref": "refs/heads/master",
-        "rev": "b6e1aaa6261c5056d024d8d4785659eaa4e675e6",
-        "revCount": 87,
+        "rev": "920c00313ae242bd93275c30131b9ab1e52ee2fb",
+        "revCount": 88,
         "type": "git",
         "url": "https://code.m3ta.dev/m3tam3re/AGENTS"
       },
@@ -120,11 +100,11 @@
     "agents_3": {
       "flake": false,
       "locked": {
-        "lastModified": 1778518220,
-        "narHash": "sha256-6AQs9VZ0/DuD4njPbYHRE4v+SgJc6SBrGwemTWxikVc=",
+        "lastModified": 1780133320,
+        "narHash": "sha256-8AiN9tV9PBb5xblJiPlhumBbKj61qLjzqXXFtkj3vvY=",
         "ref": "refs/heads/master",
-        "rev": "b6e1aaa6261c5056d024d8d4785659eaa4e675e6",
-        "revCount": 87,
+        "rev": "920c00313ae242bd93275c30131b9ab1e52ee2fb",
+        "revCount": 88,
         "type": "git",
         "url": "https://code.m3ta.dev/m3tam3re/AGENTS"
       },
@@ -320,11 +300,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1780290312,
-        "narHash": "sha256-eTAlX0CwgB84Ts3GaBd944A3DRXVMzgA0EqroZBISUo=",
+        "lastModified": 1781152676,
+        "narHash": "sha256-RxWs5ND31KzTG7wvMM+PMfUjyNpmIEr999lqNARaM5o=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "115e5211780054d8a890b41f0b7734cafad54dfe",
+        "rev": "ff8702b4de27f72b4c78573dfb89ec74e36abdf1",
         "type": "github"
       },
       "original": {
@@ -364,11 +344,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1780281921,
-        "narHash": "sha256-ZDsDl7lTOfM+Le2l6gDyEP3o+KHR3TUCkuxd9hQaLro=",
+        "lastModified": 1781317940,
+        "narHash": "sha256-uMVOhV6pVPgm2hn1WGEbIcJRWjnsyWKy8PHCUn0++iI=",
         "owner": "AvengeMedia",
         "repo": "dms-plugin-registry",
-        "rev": "ee4eeacce5a7041ed39f8cd7fe64b6e0e888e73b",
+        "rev": "4ab59f3da3df33bf106045b856db8de875cc42c6",
         "type": "github"
       },
       "original": {
@@ -420,6 +400,28 @@
       }
     },
     "flake-parts_3": {
+      "inputs": {
+        "nixpkgs-lib": [
+          "m3ta-home",
+          "hermes-agent",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1772408722,
+        "narHash": "sha256-rHuJtdcOjK7rAHpHphUb1iCvgkU3GpfvicLMwwnfMT0=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "f20dc5d9b8027381c474144ecabc9034d6a839a3",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
+    "flake-parts_4": {
       "inputs": {
         "nixpkgs-lib": [
           "m3ta-home",
@@ -441,7 +443,7 @@
         "type": "github"
       }
     },
-    "flake-parts_4": {
+    "flake-parts_5": {
       "inputs": {
         "nixpkgs-lib": [
           "nur",
@@ -472,16 +474,42 @@
         "uv2nix": "uv2nix_2"
       },
       "locked": {
-        "lastModified": 1780061757,
-        "narHash": "sha256-0CmNH879jnsAAszo1nkkFm8RNE49xtwUditYdFIYBCM=",
+        "lastModified": 1780707343,
+        "narHash": "sha256-ngpkopVczNrT0bfCXHm38QjgrZT96Bm/rO89NA/ls3Y=",
         "owner": "NousResearch",
         "repo": "hermes-agent",
-        "rev": "77a1650c78a4cb1813d8a81fa1da40a15b6a3ec5",
+        "rev": "3c231eb3979ab9c57d5cd6d02f1d577a3b718b43",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NousResearch",
+        "ref": "v2026.6.5",
+        "repo": "hermes-agent",
+        "type": "github"
+      }
+    },
+    "hermes-agent_2": {
+      "inputs": {
+        "flake-parts": "flake-parts_3",
+        "nixpkgs": [
+          "m3ta-home",
+          "nixpkgs"
+        ],
+        "npm-lockfile-fix": "npm-lockfile-fix_2",
+        "pyproject-build-systems": "pyproject-build-systems_2",
+        "pyproject-nix": "pyproject-nix_5",
+        "uv2nix": "uv2nix_4"
+      },
+      "locked": {
+        "lastModified": 1781346807,
+        "narHash": "sha256-ytT4ojx0qFW4b/oYeW+MkmaA3b/BZ9pqkPmpAg8j1gg=",
+        "owner": "NousResearch",
+        "repo": "hermes-agent",
+        "rev": "2a5dc0ef3df433a36abed9ee544ea067d807c438",
         "type": "github"
       },
       "original": {
         "owner": "NousResearch",
-        "ref": "v2026.5.29.2",
         "repo": "hermes-agent",
         "type": "github"
       }
@@ -514,11 +542,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1780408569,
-        "narHash": "sha256-s7Tv6FUQThRAvW8En8XVC6HMb0uiikzVccCcCo9u/Bg=",
+        "lastModified": 1781129616,
+        "narHash": "sha256-Hl0Pz/QIKpePSU7SdK3BMe5VNmUhFvfWyg57GyawxzE=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "f384af1bec6423a0d4ba1855917ab948f64e5808",
+        "rev": "7dbd305f8b81050f223f00bcfbc8a6b74e048806",
         "type": "github"
       },
       "original": {
@@ -557,11 +585,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1780099287,
-        "narHash": "sha256-efIPwVGtIWIjWcznhaop6XN6HxnOL8800hF6CBNvlqQ=",
+        "lastModified": 1781305496,
+        "narHash": "sha256-g8Vv4Qfc7n+lgov97REu3X6BeJtvYY0hlSUZR1GrGQQ=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "7d8127d308c3fb9664f7e643eec944be74ebb37d",
+        "rev": "c87a39aa979acc4848016d2220c6238390d84779",
         "type": "github"
       },
       "original": {
@@ -602,11 +630,11 @@
         "treefmt-nix": "treefmt-nix"
       },
       "locked": {
-        "lastModified": 1780411792,
-        "narHash": "sha256-aaO6ogxzNZNcHU0vQ2yN3Cnkhj5gAnOQ8JceAQSERVw=",
+        "lastModified": 1781330261,
+        "narHash": "sha256-2fFAGel2VVXr5mwrTXldqXva2ng3T3HHxyuBKRIxauI=",
         "owner": "numtide",
         "repo": "llm-agents.nix",
-        "rev": "2f2a2d3e3422a7ad6a105c115db2a08a630a03c4",
+        "rev": "24ec6b7b1ddf8896ac8df3b65dc564575e0a1928",
         "type": "github"
       },
       "original": {
@@ -618,10 +646,11 @@
     "m3ta-home": {
       "inputs": {
         "agenix": "agenix_2",
-        "agent-lib": "agent-lib_2",
+        "agent-lib": "agent-lib",
         "agents": "agents",
         "dms": "dms",
         "dms-plugin-registry": "dms-plugin-registry",
+        "hermes-agent": "hermes-agent_2",
         "home-manager": "home-manager_4",
         "m3ta-nixpkgs": "m3ta-nixpkgs",
         "nix-colors": "nix-colors",
@@ -631,11 +660,11 @@
         "nur": "nur"
       },
       "locked": {
-        "lastModified": 1780420920,
-        "narHash": "sha256-dxcRmexgCX+DlmlFRE/eW3gzdohVU7+JTAkzUzvG/1Y=",
+        "lastModified": 1781348716,
+        "narHash": "sha256-viUQs4x2KGYNKDbcZJAb48EnJAgMD2ENDHajPUn5lN0=",
         "ref": "refs/heads/master",
-        "rev": "19dea8277ef9c473e95e2dc3be367044dfa3f65c",
-        "revCount": 45,
+        "rev": "d1494476b864173592c6dc4a1f0645189cdca192",
+        "revCount": 61,
         "type": "git",
         "url": "ssh://gitea@code.m3ta.dev/m3tam3re/m3ta-home"
       },
@@ -656,11 +685,11 @@
         "openspec": "openspec"
       },
       "locked": {
-        "lastModified": 1779944037,
-        "narHash": "sha256-jO6zAJjgc9n3SeDJW1EbV6CEqOa9DK+2AhTgWc+ImHQ=",
+        "lastModified": 1781153970,
+        "narHash": "sha256-OtC89zreW6Api7wpF5u76Jvkn8uQJiM+0yFFn/r+rj8=",
         "ref": "refs/heads/master",
-        "rev": "ae1fb97c21b311dc03a46e8d50867048e5568c88",
-        "revCount": 323,
+        "rev": "8fae0726a53ecabb04f4a0931a17a25de6a05fbf",
+        "revCount": 324,
         "type": "git",
         "url": "ssh://gitea@code.m3ta.dev/m3tam3re/nixpkgs"
       },
@@ -678,11 +707,11 @@
         "openspec": "openspec_2"
       },
       "locked": {
-        "lastModified": 1779944037,
-        "narHash": "sha256-jO6zAJjgc9n3SeDJW1EbV6CEqOa9DK+2AhTgWc+ImHQ=",
+        "lastModified": 1781153970,
+        "narHash": "sha256-OtC89zreW6Api7wpF5u76Jvkn8uQJiM+0yFFn/r+rj8=",
         "ref": "refs/heads/master",
-        "rev": "ae1fb97c21b311dc03a46e8d50867048e5568c88",
-        "revCount": 323,
+        "rev": "8fae0726a53ecabb04f4a0931a17a25de6a05fbf",
+        "revCount": 324,
         "type": "git",
         "url": "ssh://gitea@code.m3ta.dev/m3tam3re/nixpkgs"
       },
@@ -859,11 +888,11 @@
     },
     "nixpkgs-master": {
       "locked": {
-        "lastModified": 1779457550,
-        "narHash": "sha256-yALoy2CrvwvNfwMtGZDRdc+jqVNHulyuM5iVK12lUAI=",
+        "lastModified": 1781153468,
+        "narHash": "sha256-ZBRmjFtJn/XmHBV230OSabKQqxOoOJunJmBtSt1sLs0=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "a9c18fd234dbe4fd8de4bac53760b785c47e94ff",
+        "rev": "cd265fd6b43f2ec1257c2e400f648895d2ad7ccd",
         "type": "github"
       },
       "original": {
@@ -875,11 +904,11 @@
     },
     "nixpkgs-master_2": {
       "locked": {
-        "lastModified": 1779457550,
-        "narHash": "sha256-yALoy2CrvwvNfwMtGZDRdc+jqVNHulyuM5iVK12lUAI=",
+        "lastModified": 1781153468,
+        "narHash": "sha256-ZBRmjFtJn/XmHBV230OSabKQqxOoOJunJmBtSt1sLs0=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "a9c18fd234dbe4fd8de4bac53760b785c47e94ff",
+        "rev": "cd265fd6b43f2ec1257c2e400f648895d2ad7ccd",
         "type": "github"
       },
       "original": {
@@ -891,11 +920,11 @@
     },
     "nixpkgs-master_3": {
       "locked": {
-        "lastModified": 1780414927,
-        "narHash": "sha256-Es9BrZp/QWTFajDsQwD3l9/GbWSohmMiMm23RTt1L5o=",
+        "lastModified": 1781160346,
+        "narHash": "sha256-fYh977TEG3NQN8sAQRMVtyuidoiqKuRRgrMWLD+s01A=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "95441e6bca60dd523c40613156e97deee90479b9",
+        "rev": "9e70637b2cb27f7d49c852f9fb7e0080ae953adb",
         "type": "github"
       },
       "original": {
@@ -907,11 +936,11 @@
     },
     "nixpkgs-stable": {
       "locked": {
-        "lastModified": 1779796641,
-        "narHash": "sha256-ZsIrKmhp4vbBXoXXmR/tBXA/UCsAQiJL9vsgZEduhVY=",
+        "lastModified": 1780952837,
+        "narHash": "sha256-Fwd1+spDtQ0hDyBwme6ufG3n4mY0UrjjFdYHv+G/Hds=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "25f538306313eae3927264466c70d7001dcea1df",
+        "rev": "e820eb4a444b46a19b2e03e8dfd2359439ff30fe",
         "type": "github"
       },
       "original": {
@@ -955,11 +984,11 @@
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1780336545,
-        "narHash": "sha256-vhVhuXzFrIOfcssC/9hDHx7MHzDKjF3keHuREOQqQiQ=",
+        "lastModified": 1781268102,
+        "narHash": "sha256-Zn5KTggEmUB3lXn/ccERNcBdddE6IaOFber9dWViWDg=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "4df1b885d76a54e1aa1a318f8d16fd6005b6401f",
+        "rev": "49a4bd0573c376468dd7996ddb6f9fa31d8c4d97",
         "type": "github"
       },
       "original": {
@@ -1003,11 +1032,11 @@
     },
     "nixpkgs_6": {
       "locked": {
-        "lastModified": 1779560665,
-        "narHash": "sha256-tpyBcxPpcQb8ukyNF7DoCwfSY3VPsxHoYwj00Cayv5o=",
+        "lastModified": 1781074563,
+        "narHash": "sha256-md8WlXOlfnIeHeOScMTTHFyf2d6iaTwPl2apR5EQ3P4=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "64c08a7ca051951c8eae34e3e3cb1e202fe36786",
+        "rev": "9ae611a455b90cf061d8f332b977e387bda8e1ca",
         "type": "github"
       },
       "original": {
@@ -1019,11 +1048,11 @@
     },
     "nixpkgs_7": {
       "locked": {
-        "lastModified": 1778869304,
-        "narHash": "sha256-30sZNZoA1cqF5JNO9fVX+wgiQYjB7HJqqJ4ztCDeBZE=",
+        "lastModified": 1780749050,
+        "narHash": "sha256-3av0pIjlOWQ6rDbNOmpUSvbNnJkGORQKKjb4LtCZsIY=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "d233902339c02a9c334e7e593de68855ad26c4cb",
+        "rev": "a799d3e3886da994fa307f817a6bc705ae538eeb",
         "type": "github"
       },
       "original": {
@@ -1051,11 +1080,11 @@
     },
     "nixpkgs_9": {
       "locked": {
-        "lastModified": 1780336545,
-        "narHash": "sha256-vhVhuXzFrIOfcssC/9hDHx7MHzDKjF3keHuREOQqQiQ=",
+        "lastModified": 1780930886,
+        "narHash": "sha256-rppURzHviaQN131F+nLiLdGfcb0uCd9gGP0E5+iw9MI=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "4df1b885d76a54e1aa1a318f8d16fd6005b6401f",
+        "rev": "8c3cede7ddc26bd659d2d383b5610efbd2c7a16e",
         "type": "github"
       },
       "original": {
@@ -1086,17 +1115,39 @@
         "type": "github"
       }
     },
+    "npm-lockfile-fix_2": {
+      "inputs": {
+        "nixpkgs": [
+          "m3ta-home",
+          "hermes-agent",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1775903712,
+        "narHash": "sha256-2GV79U6iVH4gKAPWYrxUReB0S41ty/Y3dBLquU8AlaA=",
+        "owner": "jeslie0",
+        "repo": "npm-lockfile-fix",
+        "rev": "c6093acb0c0548e0f9b8b3d82918823721930fe8",
+        "type": "github"
+      },
+      "original": {
+        "owner": "jeslie0",
+        "repo": "npm-lockfile-fix",
+        "type": "github"
+      }
+    },
     "nur": {
       "inputs": {
-        "flake-parts": "flake-parts_3",
+        "flake-parts": "flake-parts_4",
         "nixpkgs": "nixpkgs_6"
       },
       "locked": {
-        "lastModified": 1780290189,
-        "narHash": "sha256-2igu6l2/d4RikYmC/SsykZ1jF1e4+Df+2qWPYjq2xto=",
+        "lastModified": 1781346642,
+        "narHash": "sha256-o92OOSMAB08HQgG7pW2BZVIO53Pkv4oAjLk4Iol3Iko=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "8b6210602dcbd4409ab1c3453ea0c292637c2799",
+        "rev": "6e4e8d731fbb3831296607d5f88de727cf7bf6de",
         "type": "github"
       },
       "original": {
@@ -1107,17 +1158,17 @@
     },
     "nur_2": {
       "inputs": {
-        "flake-parts": "flake-parts_4",
+        "flake-parts": "flake-parts_5",
         "nixpkgs": [
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1780415344,
-        "narHash": "sha256-QZ3E34CsynYOJmcRmJZqY7+Ehr67H8KFKTzzrqklVeM=",
+        "lastModified": 1781158001,
+        "narHash": "sha256-cg+genglm+qSyQ0nvu6cvpTuxkpYMw1Oi9GrtXPy6cI=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "5b2185a32f7379509ff958a7939f512ff13d516a",
+        "rev": "e2af4a27c10f1ed1e6b55fb2de40cefe3f4a55e6",
         "type": "github"
       },
       "original": {
@@ -1135,11 +1186,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1779302169,
-        "narHash": "sha256-OOSPtUXC4F2umtsZPkyWlPQxhXBsxF2vqBXLeI/lqIw=",
+        "lastModified": 1780479100,
+        "narHash": "sha256-VZZ/ukjciXqiebwei2JizyOnxx0T3IeoowFWElKec4o=",
         "owner": "Fission-AI",
         "repo": "OpenSpec",
-        "rev": "79303b521068c5f525ee61db06b915fc44b098f4",
+        "rev": "1b06fddd59d8e592d5b5794a1970b22867e85b1f",
         "type": "github"
       },
       "original": {
@@ -1156,11 +1207,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1779302169,
-        "narHash": "sha256-OOSPtUXC4F2umtsZPkyWlPQxhXBsxF2vqBXLeI/lqIw=",
+        "lastModified": 1780479100,
+        "narHash": "sha256-VZZ/ukjciXqiebwei2JizyOnxx0T3IeoowFWElKec4o=",
         "owner": "Fission-AI",
         "repo": "OpenSpec",
-        "rev": "79303b521068c5f525ee61db06b915fc44b098f4",
+        "rev": "1b06fddd59d8e592d5b5794a1970b22867e85b1f",
         "type": "github"
       },
       "original": {
@@ -1192,6 +1243,30 @@
         "type": "github"
       }
     },
+    "pyproject-build-systems_2": {
+      "inputs": {
+        "nixpkgs": [
+          "m3ta-home",
+          "hermes-agent",
+          "nixpkgs"
+        ],
+        "pyproject-nix": "pyproject-nix_4",
+        "uv2nix": "uv2nix_3"
+      },
+      "locked": {
+        "lastModified": 1772555609,
+        "narHash": "sha256-3BA3HnUvJSbHJAlJj6XSy0Jmu7RyP2gyB/0fL7XuEDo=",
+        "owner": "pyproject-nix",
+        "repo": "build-system-pkgs",
+        "rev": "c37f66a953535c394244888598947679af231863",
+        "type": "github"
+      },
+      "original": {
+        "owner": "pyproject-nix",
+        "repo": "build-system-pkgs",
+        "type": "github"
+      }
+    },
     "pyproject-nix": {
       "inputs": {
         "nixpkgs": [
@@ -1257,6 +1332,74 @@
         "type": "github"
       }
     },
+    "pyproject-nix_4": {
+      "inputs": {
+        "nixpkgs": [
+          "m3ta-home",
+          "hermes-agent",
+          "pyproject-build-systems",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1769936401,
+        "narHash": "sha256-kwCOegKLZJM9v/e/7cqwg1p/YjjTAukKPqmxKnAZRgA=",
+        "owner": "nix-community",
+        "repo": "pyproject.nix",
+        "rev": "b0d513eeeebed6d45b4f2e874f9afba2021f7812",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "pyproject.nix",
+        "type": "github"
+      }
+    },
+    "pyproject-nix_5": {
+      "inputs": {
+        "nixpkgs": [
+          "m3ta-home",
+          "hermes-agent",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1772865871,
+        "narHash": "sha256-/ZTSg97aouL0SlPHaokA4r3iuH9QzHVuWPACD2CUCFY=",
+        "owner": "pyproject-nix",
+        "repo": "pyproject.nix",
+        "rev": "e537db02e72d553cea470976b9733581bcf5b3ed",
+        "type": "github"
+      },
+      "original": {
+        "owner": "pyproject-nix",
+        "repo": "pyproject.nix",
+        "type": "github"
+      }
+    },
+    "pyproject-nix_6": {
+      "inputs": {
+        "nixpkgs": [
+          "m3ta-home",
+          "hermes-agent",
+          "uv2nix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1771518446,
+        "narHash": "sha256-nFJSfD89vWTu92KyuJWDoTQJuoDuddkJV3TlOl1cOic=",
+        "owner": "pyproject-nix",
+        "repo": "pyproject.nix",
+        "rev": "eb204c6b3335698dec6c7fc1da0ebc3c6df05937",
+        "type": "github"
+      },
+      "original": {
+        "owner": "pyproject-nix",
+        "repo": "pyproject.nix",
+        "type": "github"
+      }
+    },
     "quickshell": {
       "inputs": {
         "nixpkgs": [
@@ -1283,7 +1426,6 @@
     "root": {
       "inputs": {
         "agenix": "agenix",
-        "agent-lib": "agent-lib",
         "disko": "disko",
         "hermes-agent": "hermes-agent",
         "home-manager": "home-manager_2",
@@ -1330,11 +1472,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1779522750,
-        "narHash": "sha256-IhAhPWYMomohxWmh/u/x8B44hIkt3IcuL2bsKb+vl5U=",
+        "lastModified": 1780564157,
+        "narHash": "sha256-FOemUn2RVIeosaYbe5ukB7V6nHVke0n0Kep3DNYdfh4=",
         "owner": "rustfs",
         "repo": "rustfs-flake",
-        "rev": "31e193047ef40f702261a93f47889c1b1962d10a",
+        "rev": "253266a4361fe87a6ab57a6c630aeb820925f9b7",
         "type": "github"
       },
       "original": {
@@ -1505,6 +1647,58 @@
         "repo": "uv2nix",
         "type": "github"
       }
+    },
+    "uv2nix_3": {
+      "inputs": {
+        "nixpkgs": [
+          "m3ta-home",
+          "hermes-agent",
+          "pyproject-build-systems",
+          "nixpkgs"
+        ],
+        "pyproject-nix": [
+          "m3ta-home",
+          "hermes-agent",
+          "pyproject-build-systems",
+          "pyproject-nix"
+        ]
+      },
+      "locked": {
+        "lastModified": 1770770348,
+        "narHash": "sha256-A2GzkmzdYvdgmMEu5yxW+xhossP+txrYb7RuzRaqhlg=",
+        "owner": "pyproject-nix",
+        "repo": "uv2nix",
+        "rev": "5d1b2cb4fe3158043fbafbbe2e46238abbc954b0",
+        "type": "github"
+      },
+      "original": {
+        "owner": "pyproject-nix",
+        "repo": "uv2nix",
+        "type": "github"
+      }
+    },
+    "uv2nix_4": {
+      "inputs": {
+        "nixpkgs": [
+          "m3ta-home",
+          "hermes-agent",
+          "nixpkgs"
+        ],
+        "pyproject-nix": "pyproject-nix_6"
+      },
+      "locked": {
+        "lastModified": 1773039484,
+        "narHash": "sha256-+boo33KYkJDw9KItpeEXXv8+65f7hHv/earxpcyzQ0I=",
+        "owner": "pyproject-nix",
+        "repo": "uv2nix",
+        "rev": "b68be7cfeacbed9a3fa38a2b5adc0cfb81d9bb1f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "pyproject-nix",
+        "repo": "uv2nix",
+        "type": "github"
+      }
     }
   },
   "root": "root",

flake.nix

@@ -25,7 +25,6 @@
     m3ta-nixpkgs.url = "git+ssh://gitea@code.m3ta.dev/m3tam3re/nixpkgs";
     llm-agents.url = "github:numtide/llm-agents.nix";
 
-    #
     nur = {
       url = "github:nix-community/NUR";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -48,12 +47,7 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
-    agent-lib = {
-      url = "git+ssh://gitea@code.m3ta.dev/m3tam3re/agent-lib";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-
-    hermes-agent.url = "github:NousResearch/hermes-agent/v2026.5.29.2";
+    hermes-agent.url = "github:NousResearch/hermes-agent/v2026.6.5";
 
     rustfs = {
       url = "github:rustfs/rustfs-flake";

hosts/m3-ares/services/default.nix

@@ -1,6 +1,7 @@
 {pkgs, ...}: {
   imports = [
     ./containers
+    ./greetd.nix
     ./hermes-agent.nix
     ./netbird.nix
     #./n8n.nix

hosts/m3-ares/services/greetd.nix

@@ -0,0 +1,38 @@
+# greetd login manager for m3-kratos (replaces broken GDM on nixos-unstable).
+# Uses tuigreet as the greeter, launching Hyprland after authentication.
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: let
+  tuigreet = "${lib.getExe pkgs.tuigreet}";
+  # Use start-hyprland wrapper to avoid Hyprland startup warnings
+  # withUWSM=true is set in programs.nix; start-hyprland handles this correctly
+  hyprlandCmd = "${config.programs.hyprland.package}/bin/start-hyprland";
+in {
+  services.greetd = {
+    enable = true;
+
+    settings = {
+      default_session = {
+        user = "greeter";
+        # Minimal config: verified supported flags only
+        # The --time and --remember are tested; power commands omitted
+        # to avoid potential quoting/parsing issues
+        command = builtins.concatStringsSep " " [
+          tuigreet
+          "--time"
+          "--remember"
+          "--asterisks"
+          "--cmd ${hyprlandCmd}"
+        ];
+      };
+    };
+  };
+
+  # Required for --remember to persist username between logins
+  systemd.tmpfiles.rules = [
+    "d /var/cache/tuigreet 0755 greeter greeter - -"
+  ];
+}

hosts/m3-atlas/services/containers/ghost.nix

@@ -1,6 +1,6 @@
 {config, ...}: {
   virtualisation.oci-containers.containers."ghost" = {
-    image = "docker.io/ghost:latest";
+    image = "docker.io/ghost:6-alpine";
     environmentFiles = [config.age.secrets.ghost-env.path];
     ports = ["127.0.0.1:3002:2368"];
     volumes = ["ghost_data:/var/lib/ghost/content"];

hosts/m3-hermes/services/hermes-agent.nix

@@ -8,44 +8,34 @@
   # Edge TTS: Seraphina — friendly, multilingual German female voice (free, no API key)
   edgeVoice = "de-DE-SeraphinaMultilingualNeural";
 
-  agentLock = builtins.fromJSON (builtins.readFile ../../../agent-sources.lock.json);
-
-  agentSkillSelections = {
-    m3ta-agents.exclude = [];
-    anthropic.exclude = ["pdf" "skill-creator" "xlsx"];
-    basecamp.exclude = [];
-    kestra.exclude = [];
-    mattpocock.exclude = ["grill-me" "caveman"];
-    superpowers.exclude = ["brainstorming" "systematic-debugging"];
-    vercel.exclude = [];
+  agentSkillExclusions = {
+    m3ta-agents = [];
+    anthropic = ["pdf" "skill-creator" "xlsx"];
+    basecamp = [];
+    kestra = [];
+    mattpocock = ["grill-me" "caveman"];
+    superpowers = ["brainstorming" "systematic-debugging"];
+    vercel = [];
   };
 
-  sourceRoot = source:
-    builtins.fetchGit {
-      inherit (source) url rev;
+  agentLibSourceSelections =
+    lib.mapAttrs (_sourceName: exclude: {
+      skills = {
+        all = true;
+        inherit exclude;
       };
+    })
+    agentSkillExclusions;
 
-  selectedSkillNames = sourceName: let
-    source = agentLock.sources.${sourceName};
-    excluded = agentSkillSelections.${sourceName}.exclude;
-  in
-    lib.subtractLists excluded (builtins.attrNames source.items.skills);
-
-  copySkill = sourceName: skillName: let
-    source = agentLock.sources.${sourceName};
-    item = source.items.skills.${skillName};
-  in ''
-    cp -R ${sourceRoot source}/${source.root}/${item.path} $out/${skillName}
-  '';
-
-  copySourceSkills = sourceName:
-    lib.concatMapStringsSep "\n" (copySkill sourceName) (selectedSkillNames sourceName);
-
-  # Build skills from the agent-lib lockfile instead of the legacy AGENTS flake.
-  hermesSkills = pkgs.runCommand "hermes-agent-lib-skills" {} ''
-    mkdir -p $out
-    ${lib.concatMapStringsSep "\n" copySourceSkills (builtins.attrNames agentSkillSelections)}
-  '';
+  # Deterministic store renderer consumed directly by Hermes. m3ta-home
+  # re-exports the focused helper so nixos-config does not need a direct
+  # agent-lib flake input.
+  hermesSkills = inputs.m3ta-home.lib.mkHermesSkillsDir {
+    system = pkgs.stdenv.hostPlatform.system;
+    name = "hermes-agent-lib-skills";
+    lockFile = ../../../agent-sources.lock.json;
+    sources = agentLibSourceSelections;
+  };
 in {
   virtualisation.docker.enable = true;
 
@@ -63,18 +53,7 @@ in {
     ''}"
   ];
 
-  systemd.services.copy-hermes-skills = {
-    description = "Copy agent skills to hermes home directory";
-    wantedBy = ["hermes-agent.service"];
-    before = ["hermes-agent.service"];
-    serviceConfig.Type = "oneshot";
-    serviceConfig.RemainAfterExit = true;
-    script = ''
-      mkdir -p /var/lib/hermes/.agents
-      cp -rT ${hermesSkills} /var/lib/hermes/.agents/skills
-      chown -R hermes:hermes /var/lib/hermes/.agents
-    '';
-  };
+  systemd.services.hermes-agent.restartTriggers = [hermesSkills];
 
   services.hermes-agent = {
     enable = true;
@@ -92,6 +71,7 @@ in {
     ];
 
     extraPackages = with pkgs; [
+      basecamp
       docker
       git
       curl
@@ -175,7 +155,7 @@ in {
 
       skills = {
         external_dirs = [
-          "/var/lib/hermes/.agents/skills"
+          hermesSkills
         ];
       };
 

hosts/m3-kratos/agent-lib.nix

@@ -1,36 +0,0 @@
-{
-  programs.agent-lib = {
-    enable = true;
-    lockFile = ../../agent-sources.lock.json;
-
-    targets.pi.enable = true;
-    targets.opencode.enable = true;
-
-    profiles.default = {
-      sources = {
-        m3ta-agents = {
-          agents = {
-            all = true;
-          };
-          skills = {
-            all = true;
-            exclude = ["brainstorming" "pdf" "systematic-debugging" "xlsx"];
-          };
-        };
-        anthropic.skills = {
-          all = true;
-          exclude = ["skill-creator"];
-        };
-        basecamp.skills.all = true;
-        kestra.skills.all = true;
-        mattpocock.skills = {
-          all = true;
-        };
-        superpowers.skills = {
-          all = true;
-        };
-        vercel.skills.all = true;
-      };
-    };
-  };
-}

hosts/m3-kratos/home.nix

@@ -4,7 +4,6 @@
 # m3ta-home via the profile mapping in hosts/common/users/m3tam3re.nix.
 {
   config,
-  inputs,
   lib,
   ...
 }:
@@ -15,6 +14,8 @@ with lib; {
   config = mkMerge [
     # ── XDG / MIME defaults ──
     {
+      qt.platformTheme.name = mkForce "qtct";
+
       xdg = {
         enable = true;
         configFile."mimeapps.list".force = true;
@@ -58,6 +59,22 @@ with lib; {
             "6, monitor:DP-2"
             "7, monitor:DP-2"
           ];
+          # m3ta-home sets QT_QPA_PLATFORMTHEME=gtk3 globally for Hyprland.
+          # ksnip crashes with duplicate GDK type registration under that Qt GTK
+          # platform theme, so use qtct for Qt apps on this host instead.
+          env = mkForce [
+            "XCURSOR_SIZE,32"
+            "HYPRCURSOR_THEME,Bibata-Modern-Ice"
+            "WLR_NO_HARDWARE_CURSORS,1"
+            "XDG_CURRENT_DESKTOP,Hyprland"
+            "XDG_SESSION_TYPE,wayland"
+            "XDG_SESSION_DESKTOP,Hyprland"
+            "XKB_DEFAULT_LAYOUT,de"
+            "NIXOS_OZONE_WL,1"
+            "QT_QPA_PLATFORM,wayland;xcb"
+            "QT_QPA_PLATFORMTHEME,qt5ct"
+            "QT_QPA_PLATFORMTHEME_QT6,qt6ct"
+          ];
           windowrule = [
             "match:class dev.zed.Zed, workspace 1"
             "match:class ^(com.obsproject.Studio)$, workspace 2"

secrets/hermes-api-server-key.age

@@ -1,26 +1,25 @@
 age-encryption.org/v1
--> ssh-ed25519 4NLKrw 2TwbZwX9SwWg4SVC0A2ICmyRjSfO+xtfBcBOK1lh3T4
-DSf4DrOAvW7L49lh6cq5IqrMM7gqXv2+67rR3ttn+CE
--> ssh-ed25519 5kwcsA K1hqFOAxq2T+oLp3bQjLYpXtlQVkA7RHCM/8ETMGbwU
-xIE4xz50LB5vbDTTLKVcx9vC2iXIsRLThHYYxGjcJyY
--> ssh-ed25519 9d4YIQ bXYb62OM/N+EXpMOZZ6zEbpfaH10Vz62PuUdGODXolw
-j64kKzOn8CmSnykEuWnXHZ0nfqwOfOxX4FPR4GSouR0
--> ssh-ed25519 3Bcr1w C4alN6ud7q0K4I7NHuBgC77D6zeTfZVGjNS3EKpvL00
-NpjOsg3eJ5LvX0lV7NYuVHLeqeYylHdmw60H+KeG1GY
--> ssh-ed25519 c4NQlA In5wsg4+LTIEbP75B83GMXPCItSPGwKWUW8QO+QjXyY
-oK1kikhr4RMq6QMv9kjNjiKrf5srlGh7hGbU2qns2rM
+-> ssh-ed25519 4NLKrw 42tBp6EbDJpC7EBt0++QxmF3N9rQJ/AP+7A/S174rCs
+bRzpQku0GLEBvANvCdeH3L4Kf06k6w2C4FfZCOp2QWI
+-> ssh-ed25519 5kwcsA YAYkQzsxfbHwrCPMW2eqLS9mRuuxr+EjHKl7MV3DDEo
+dN3TitETbdPbXzBtIDBglienhY4oDsFGgfe0VYdsP1o
+-> ssh-ed25519 9d4YIQ 2vTWMSuLrgpgaTWeu0ARoUOukLBKupCfMdqJhLvTqwA
+Lzk2Uo2U3tUJiq29on/a5zYfuUjgOZvCHhZYuFGSDG4
+-> ssh-ed25519 3Bcr1w x689Z0/TsOLLk1JNPXg2jj6y5ucaH37zRt46d/Z1l2w
+Bkzg3umkDYFBemmgev/M5LUFuobFugXe0u85mLmsDSo
+-> ssh-ed25519 c4NQlA 5Dn6e8bILaYl9FVt+ZwuZ6rOC0k0Kg1+KOSP4JakyWI
+AT6LeCo+P7RjgNhRex04kJ/7NHD2DAWRqs33uOJ7e5E
 -> ssh-rsa DQlE7w
-tcP4yPgGWqHYeE1gw/KD6cswik+9WU2s2f7hg5mK78085sQ7npXRsBVAz2OCRn07
-foeAAmnY4YmKriBh421JOVNBDOXHR5dfaIKY9b663L+rYj99ic0rfW26C+dqKitF
-SnvveL3Zf16nqg6duSVA7LIcIFgkIlA+RXnHPVho+P4GwEH7W8nCf/4kUquuhB7B
-F4Hx1qOknmGyNBJBFi27D04ZDDk/ZVxioYsO6P6TUu7MuaGmQCoVKREDl5RRh4zO
-XD8/TFDRsJLqqcbCKIlU+6CN1+L0r4FN4K0UaTjwPNzGvn5EEjBKw9RpOhdvI28I
-WlAQ+w6gdQiz9Ju4e5p7Doz2MbNb6894DimawHjzl968Xy5ifX2XA+FBdcW5hU9A
-u+7VXKZmbfMyvRA7lmKRoi4SurJAyQd6iXBrVKfTwFc53V/tJi48bsKcE3yXxHH+
-lKGuZFNGDDkqCruycjvz94WaIHy3fv5hhmBdgwoCZK1VGSLAnwdm1rG4B9m3t/K8
+M9pUnzZDa1v6X5UbQOE6HILaGU36VkQtnfXaJJdxJSRQ/sE9R3ZQoLjRZAw+UhUf
+09JwLkS55477xaar3bpvvOxeP4MrtTHLJ7593eEkFT3i45FfVmxutq6EYckZrCJB
+WjrCG7Cbvc20o6s54PYiF4Xk8AuPxt+SElRxBtcOK+SPba84f+WWHqrBA1YRzTDK
+fsM15eKWsJgzaz5y36grv4xSj4KbWMFtmEt5V5BEW32+zXBU5CPhonO59TxEQgh4
+hI2+gNmAzKQja7xbuxCyr3jcXWJz7IuXcrklr+2ZjF1wx3BDll1z+vxSX0C88MCc
+OLKDfnUiDa6BlgUfLK90dLIia8v0oIPXs4OWRfYs7SC/Z3QOPpSO62Ky9dKYRrod
+PHvCgxX28QvROE4TekL9PV81AfAbMVJrnkRiybg6id8CscldtDmgaKqoaIoJlAuF
+g5/LGd+FPfmlv2iNfGUn2Glhui8SkrBK1MzGJpeQw+l4CXLH33yQzHX0m6TdQBzr
 
--> ssh-ed25519 CSMyhg FNYYdEIJYcxkjMuM5lnIs9gIilvgD44uazZE8CjNeho
-QHeghlsOOlYNMwhMHT4o7DeuyxGP/3wyqm94HUHjn44
---- zRG6aCTS+X18VpeN+tz38kaUoilk1kN5KrWTWYZ6pV4
-ræX_qÔÁ’Ð껿H#p¯f™”}(žA(ã|»?ë0ªyJk¥SD‡\Jm&uõÃ&Ô9€ýÄ5Ù+çÊ…!v%Y˜ù~ãÁ$û“šZÇÓ°j„z–Â\ßá1,Vf˜
-£’æ1zª»#Ó
+-> ssh-ed25519 CSMyhg 5YHqBNbkkUFVhDEfOM4P2tAxT2t1rDn5KItUcjUs4DY
+oWEKUGiIVkRQvEkY33PpOUcoqsmacgHAaX58H6sRpP4
+--- KH+IYh4+bS3JMeEmFYakwIceMxOrlEZj0Fqt3VMgFRk
+�96¨ºà·ènÅϬuk!ß±1ÝNItŽNŸ8E�çwĹ]3µ”S*¡õ«0>!ý9zc‡(”2O;åI.^jC”&$ºÚ\ÛËWtÇÃNÿ#Õ€Å3
¾ÜøÞÌÏcMuÈAߢ•<¾)¬MÄ´¼a¥rdí'p’ÄggPä5’ÆõOQòNfà”×1AZ|1v\š4F›‡�Ò6;„T<l£