chore: update openwork

n8n 2.32 replaced the sheetjs-CDN xlsx@0.20.2 tarball (which lacked an
integrity checksum and had to be patched into pnpm-lock.yaml) with the
regular npm package @e965/xlsx@0.20.3, which already carries an integrity
field. The patchXlsxLockfile workaround is therefore obsolete and actively
harmful: substituteInPlace --replace-fail no longer matches, making
fetchPnpmDeps fail with a build error (not a hash mismatch), which left the
fake-hash sentinel behind in n8n.nix on update.

- overlays/mods/n8n.nix: remove xlsx workaround; bump to 2.32.6 with real
  src (sha256-wWm6...) and pnpmDeps (sha256-QzUJCF+...) hashes.
- tests/n8n-overlay-test.nix: update expectations to 2.32.6; drop the
  obsolete checkXlsxIntegrityPatch.
- overlays/mods/update.sh: use a literal SRI sentinel instead of lib.fakeHash
  (lib is not in scope inside the {prev}: overlay); add a snapshot-based EXIT
  trap that restores n8n.nix on any failure (error/SIGINT/SIGTERM/killed
  build) while preserving pre-existing working-tree edits; surface a clearer
  message when fetchPnpmDeps fails for a non-hash reason.

flake.lock

@@ -3,11 +3,11 @@
     "agents": {
       "flake": false,
       "locked": {
-        "lastModified": 1780133320,
+        "lastModified": 1783016143,
-        "narHash": "sha256-8AiN9tV9PBb5xblJiPlhumBbKj61qLjzqXXFtkj3vvY=",
+        "narHash": "sha256-3qejDAo4g2XfzTyWCaX8RVKH17JXnw/fujsbXQA+Mzc=",
         "ref": "refs/heads/master",
-        "rev": "920c00313ae242bd93275c30131b9ab1e52ee2fb",
+        "rev": "83284d752d2ac325d4bf3ab7b38acad1c2fffe3a",
-        "revCount": 88,
+        "revCount": 98,
         "type": "git",
         "url": "https://code.m3ta.dev/m3tam3re/AGENTS"
       },
@@ -38,11 +38,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1782467914,
+        "lastModified": 1785318670,
-        "narHash": "sha256-pGvFkM8N0xEkIIXDe5YYfbEAvHrk4IxBrjB/x8OomhE=",
+        "narHash": "sha256-dN6Ou5x/+23FZLEpYP3IffO+NyJFzUlGumt1uu3MMaY=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "e73de5be04e0eff4190a1432b946d469c794e7b4",
+        "rev": "0954f7ee2f6bb3dc7d4e3d0d8bcb8fd4bde4cfc5",
         "type": "github"
       },
       "original": {
@@ -54,11 +54,11 @@
     },
     "nixpkgs-master": {
       "locked": {
-        "lastModified": 1782540244,
+        "lastModified": 1785386845,
-        "narHash": "sha256-3skOZJEfAUG7LSB/Ok2AQUiqeagYLSq+8wKjtS1hOyc=",
+        "narHash": "sha256-CvXXTgWxbwTn6Diev4nLTP5+8tsFtth/SQAtaR9iVY0=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "a65184fc373636356fcaf460dc09655a919c66ea",
+        "rev": "3c5a718ce27c9283364d4c664fac4e4a23acdfb4",
         "type": "github"
       },
       "original": {
@@ -110,11 +110,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1782291243,
+        "lastModified": 1785371113,
-        "narHash": "sha256-0pVn5pDqlKpqSgzf4eG9TFCjkjzOtnmGTpbILso7GwI=",
+        "narHash": "sha256-r3fwnb5gMTV9UXBj7bqkKpTZIWwF4AgghULOIv2Fr4c=",
         "owner": "Fission-AI",
         "repo": "OpenSpec",
-        "rev": "737518b36fe4b6fdb09c83eeaf8d873a428c92e6",
+        "rev": "2b3d368539132be6311e55db58899abbf5306b81",
         "type": "github"
       },
       "original": {

overlays/mods/n8n.nix

@@ -1,33 +1,27 @@
 {prev}: let
-  xlsxTarball = "https://cdn.sheetjs.com/xlsx-0.20.2/xlsx-0.20.2.tgz";
+  # n8n >= 2.32 replaced the sheetjs-CDN `xlsx@0.20.2` tarball (which lacked an
-  xlsxIntegrity = "sha512-+nKZ39+nvK7Qq6i0PvWWRA4j/EkfWOtkP/YhMtupm+lJIiHxUrgTr1CcKv1nBk1rHtkRRQ3O2+Ih/q/sA+FXZA==";
+  # integrity checksum and had to be patched into pnpm-lock.yaml) with the
-  patchXlsxLockfile = ''
+  # regular npm package `@e965/xlsx@0.20.3`, which already carries an integrity
-    substituteInPlace pnpm-lock.yaml \
+  # field. The old lockfile-integrity workaround is therefore obsolete and has
-      --replace-fail \
+  # been removed.
-        "resolution: {tarball: ${xlsxTarball}}" \
-        "resolution: {integrity: ${xlsxIntegrity}, tarball: ${xlsxTarball}}"
-  '';
 in
   prev.n8n.overrideAttrs (finalAttrs: previousAttrs: {
-    version = "2.31.6";
+    version = "2.32.6";
 
     src = prev.fetchFromGitHub {
       owner = "n8n-io";
       repo = "n8n";
       tag = "n8n@${finalAttrs.version}";
-      hash = "sha256-OTVfIHnGTaBogEd93Ak2Pu3Jh7VweQNYbUeahq1Z/64=";
+      hash = "sha256-wWm6vGyJ2I2SBU38gRGaZG2FR5FBxH6V/sWQwn5B4Ac=";
     };
 
     pnpmDeps = prev.fetchPnpmDeps {
       inherit (finalAttrs) pname version src;
       pnpm = prev.pnpm_10;
       fetcherVersion = 3;
-      prePnpmInstall = patchXlsxLockfile;
+      hash = "sha256-QzUJCF+VIku9/HrmiUR9FNCU3MlYtyKOILZjFNXvN8U=";
-      hash = "sha256-Q3HCJg1KjdRJnPZJEUKcaCrh8tBhT9B3gqMz8xbBZVg=";
     };
 
-    prePnpmInstall = (previousAttrs.prePnpmInstall or "") + patchXlsxLockfile;
-
     preBuild =
       (previousAttrs.preBuild or "")
       + ''

overlays/mods/update.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env nix-shell
 #!nix-shell --pure -i bash -p bash curl jq nix nix-prefetch cacert git
+# shellcheck shell=bash
 set -euo pipefail
 
 # Update the n8n overlay (overlays/mods/n8n.nix) to the latest stable GitHub
@@ -15,26 +16,43 @@ set -euo pipefail
 #   2. Strip the `n8n@` prefix → version
 #   3. Compare to the version pinned in overlays/mods/n8n.nix
 #   4. Compute new src hash (fetchFromGitHub tarball) via nix-prefetch-url
-#   5. Compute new pnpmDeps hash via the lib.fakeHash trick
+#   5. Compute new pnpmDeps hash via the fake-hash trick
 #   6. Commit
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 NIX_FILE="$SCRIPT_DIR/n8n.nix"
+NIXPKGS_ROOT=$(git -C "$SCRIPT_DIR" rev-parse --show-toplevel 2>/dev/null || true)
+
+# Snapshot the current n8n.nix so we can restore it if anything goes wrong
+# (error, SIGINT, SIGTERM, or a killed build) — otherwise a failed/aborted run
+# leaves a stale version bump and/or the fake-hash sentinel behind. Restoring
+# from the snapshot (rather than `git checkout`) also preserves any
+# pre-existing working-tree edits the user may have made. The trap is disarmed
+# once we reach a successful commit.
+RESTORE_FILE="$(mktemp)"
+cp "$NIX_FILE" "$RESTORE_FILE"
+restore_on_failure() {
+	if [[ -z "${UPDATE_SUCCEEDED:-}" ]]; then
+		cp -f "$RESTORE_FILE" "$NIX_FILE" 2>/dev/null || true
+	fi
+	rm -f "$RESTORE_FILE"
+}
+trap restore_on_failure EXIT
 
 REPO="n8n-io/n8n"
 TAG_PREFIX="n8n@"
 
 # ── 1. Latest stable release ───────────────────────────────────────────────
 echo "Fetching latest stable release of $REPO ..."
-LATEST_TAG=$(curl -fsSL "https://api.github.com/repos/$REPO/releases/latest" \
+LATEST_TAG=$(curl -fsSL "https://api.github.com/repos/$REPO/releases/latest" |
-  | jq -r 'select(.prerelease == false) | .tag_name')
+	jq -r 'select(.prerelease == false) | .tag_name')
 
 if [[ -z "$LATEST_TAG" ]]; then
 	echo "ERROR: No stable release found for $REPO" >&2
 	exit 1
 fi
 
-VERSION="${LATEST_TAG#${TAG_PREFIX}}"
+VERSION="${LATEST_TAG#"${TAG_PREFIX}"}"
 echo "Latest version: $VERSION"
 
 # ── 2. Current version from the nix file ───────────────────────────────────
@@ -74,24 +92,29 @@ awk -v sri="$SRC_SRI" '
     src_done = 1
   }
   { print }
-' "$NIX_FILE" > "$NIX_FILE.tmp" && mv "$NIX_FILE.tmp" "$NIX_FILE"
+' "$NIX_FILE" >"$NIX_FILE.tmp" && mv "$NIX_FILE.tmp" "$NIX_FILE"
 
-# ── 5. Compute pnpmDeps hash via lib.fakeHash ──────────────────────────────
+# ── 5. Compute pnpmDeps hash via the fake-hash trick ───────────────────────
 echo "==> Computing pnpmDeps hash (this may take a while) ..."
 
-# 5a. Temporarily set the pnpmDeps hash to lib.fakeHash
+# A literal SRI sentinel (equal to lib.fakeHash). We write the literal rather
-awk '
+# than `lib.fakeHash` so we don't depend on `lib` being in scope inside
+# n8n.nix — the overlay is imported with just `{ prev = pkgs; }`, so `lib`
+# is not bound there.
+FAKE_HASH='sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA='
+
+# 5a. Temporarily set the pnpmDeps hash to the fake sentinel.
+awk -v fake="\"$FAKE_HASH\"" '
   !pnpm_started && /^[[:space:]]*pnpmDeps = / { pnpm_started = 1 }
   pnpm_started && !pnpm_done && /^[[:space:]]*hash = "sha256-/ {
-    sub(/"sha256-[A-Za-z0-9+/=]+"/, "lib.fakeHash")
+    sub(/"sha256-[A-Za-z0-9+/=]+"/, fake)
     pnpm_done = 1
   }
   { print }
-' "$NIX_FILE" > "$NIX_FILE.tmp" && mv "$NIX_FILE.tmp" "$NIX_FILE"
+' "$NIX_FILE" >"$NIX_FILE.tmp" && mv "$NIX_FILE.tmp" "$NIX_FILE"
 
 # 5b. Evaluate n8nModified.pnpmDeps — fixed-output derivation with a wrong hash
 #     will fail and print the correct hash in the "got:" line.
-SYSTEM=$(nix eval --impure --raw --expr 'builtins.currentSystem' 2>/dev/null || echo "x86_64-linux")
 NIX_EXPR="(let
     flake = builtins.getFlake (toString ./.);
     pkgs = flake.inputs.nixpkgs.legacyPackages.\${builtins.currentSystem};
@@ -100,34 +123,31 @@ NIX_EXPR="(let
 
 BUILD_OUTPUT=$(nix build --impure --no-link --expr "$NIX_EXPR" 2>&1 || true)
 
-# Hash mismatch errors list two sha256 values: the wrong "Expected"/"specified"
+# Hash mismatch errors list two sha256 values: the fake sentinel (all A's) as
-# one (our lib.fakeHash = all A's) and the correct "Got"/"got" one. Different
+# "specified"/"Expected" and the correct one as "got:"/"Got:". Different nix
-# nix versions capitalise the label differently, so we filter out the fakeHash
+# versions label/capitalise differently, so filter out the sentinel and take
-# sentinel and take whatever real sha256 remains.
+# whatever real sha256 remains.
-PNPM_HASH=$(echo "$BUILD_OUTPUT" \
+PNPM_HASH=$(echo "$BUILD_OUTPUT" |
-  | grep -oE 'sha256-[A-Za-z0-9+/=]+' \
+	grep -oE 'sha256-[A-Za-z0-9+/=]+' |
-  | grep -v 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA' \
+	grep -v 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA' |
-  | tail -1)
+	tail -1)
 
 if [[ -z "$PNPM_HASH" ]]; then
-  echo "ERROR: Failed to compute pnpmDeps hash. nix build output:" >&2
+	echo "ERROR: could not extract a pnpmDeps hash from the build output." >&2
+	echo "       This usually means fetchPnpmDeps failed for a reason OTHER than" >&2
+	echo "       a hash mismatch (e.g. a pnpm-lock patch in n8n.nix no longer applies," >&2
+	echo "       a tarball vanished, or the build was interrupted). Full output:" >&2
 	echo "$BUILD_OUTPUT" >&2
-  echo "Restoring original file..." >&2
+	echo "Restoring n8n.nix via the EXIT trap." >&2
-  git checkout -- "$NIX_FILE" 2>/dev/null || true
 	exit 1
 fi
 
 echo "    pnpmDeps hash: $PNPM_HASH"
 
-# 5d. Replace lib.fakeHash with the real hash
+# 5c. Replace the fake sentinel with the real hash. The sentinel only appears
-awk -v sri="$PNPM_HASH" '
+#     in the pnpmDeps block (the src hash was already updated in step 4), so a
-  !pnpm_started && /^[[:space:]]*pnpmDeps = / { pnpm_started = 1 }
+#     plain literal substitution is sufficient.
-  pnpm_started && !pnpm_done && /^[[:space:]]*hash = / {
+sed -i "s|$FAKE_HASH|$PNPM_HASH|" "$NIX_FILE"
-    sub(/lib\.fakeHash/, "\"" sri "\"")
-    pnpm_done = 1
-  }
-  { print }
-' "$NIX_FILE" > "$NIX_FILE.tmp" && mv "$NIX_FILE.tmp" "$NIX_FILE"
 
 # ── 6. Verify the file parses and commit ───────────────────────────────────
 echo "==> Verifying nix evaluation ..."
@@ -137,17 +157,16 @@ if ! nix eval --impure --expr "
     pkgs = flake.inputs.nixpkgs.legacyPackages.\${builtins.currentSystem};
   in (import ./overlays/mods/n8n.nix { prev = pkgs; }).version
 " >/dev/null 2>&1; then
-  echo "ERROR: nix evaluation failed after update; restoring original." >&2
+	echo "ERROR: nix evaluation failed after update; restoring n8n.nix via the EXIT trap." >&2
-  git checkout -- "$NIX_FILE" 2>/dev/null || true
 	exit 1
 fi
 
-NIXPKGS_ROOT=$(git -C "$SCRIPT_DIR" rev-parse --show-toplevel 2>/dev/null || true)
+if [[ -n "$NIXPKGS_ROOT" ]] &&
-if [[ -n "$NIXPKGS_ROOT" ]] && \
 	[[ -n "$(git -C "$NIXPKGS_ROOT" status --porcelain "$NIX_FILE")" ]]; then
 	git -C "$NIXPKGS_ROOT" add "$NIX_FILE"
 	git -C "$NIXPKGS_ROOT" commit -m "n8n: $CURRENT -> $VERSION"
 	echo "==> Committed"
 fi
 
+UPDATE_SUCCEEDED=1
 echo "==> Done"

pkgs/openwork/default.nix

@@ -6,7 +6,7 @@
   stdenvNoCC,
 }: let
   pname = "openwork";
-  version = "0.17.30";
+  version = "0.18.11";
 
   src = fetchurl {
     url =
@@ -16,7 +16,7 @@
     hash =
       if stdenvNoCC.hostPlatform.system == "aarch64-linux"
       then "sha256-ZSoAcOH0/gQynSCY8qCvysaNBnUl/G8Zz66a11y60Qs="
-      else "sha256-JyDmPXXTx+XwjY3d41cGbLxA2+Uxj8BYPa6eUekvWgU=";
+      else "sha256-wh2I5Il4f/VruMA2mRskaB7ldcbSan0upon6Y+Vm1Rw=";
   };
 
   appimageContents = appimageTools.extractType2 {inherit pname version src;};

tests/n8n-overlay-test.nix

@@ -15,12 +15,10 @@
   modifiedPkgs = mkPkgs [self.overlays.modifications];
   defaultPkgs = mkPkgs [self.overlays.default];
 
-  expectedVersion = "2.31.6";
+  expectedVersion = "2.32.6";
-  expectedSrcHash = "sha256-OTVfIHnGTaBogEd93Ak2Pu3Jh7VweQNYbUeahq1Z/64=";
+  expectedSrcHash = "sha256-wWm6vGyJ2I2SBU38gRGaZG2FR5FBxH6V/sWQwn5B4Ac=";
-  expectedPnpmHash = "sha256-Q3HCJg1KjdRJnPZJEUKcaCrh8tBhT9B3gqMz8xbBZVg=";
+  expectedPnpmHash = "sha256-QzUJCF+VIku9/HrmiUR9FNCU3MlYtyKOILZjFNXvN8U=";
   expectedChangelog = "https://github.com/n8n-io/n8n/releases/tag/n8n@${expectedVersion}";
-  expectedXlsxTarball = "https://cdn.sheetjs.com/xlsx-0.20.2/xlsx-0.20.2.tgz";
-  expectedXlsxIntegrity = "sha512-+nKZ39+nvK7Qq6i0PvWWRA4j/EkfWOtkP/YhMtupm+lJIiHxUrgTr1CcKv1nBk1rHtkRRQ3O2+Ih/q/sA+FXZA==";
   expectedRootNodeModuleSymlinks = [
     "ln -s .pnpm/node_modules/sass-embedded node_modules/sass-embedded"
     "ln -s .pnpm/node_modules/sqlite3 node_modules/sqlite3"
@@ -46,17 +44,6 @@
     if !(pkgs.lib.all (symlink: pkgs.lib.hasInfix symlink (package.preBuild or "")) expectedRootNodeModuleSymlinks)
     then throw "${overlayName} n8n preBuild should create root node_modules symlinks required by the upstream buildPhase"
     else "ok";
-
-  checkXlsxIntegrityPatch = overlayName: package:
-    pkgs.runCommand "${overlayName}-n8n-xlsx-integrity-patch-test" {
-      inherit expectedXlsxTarball expectedXlsxIntegrity;
-    } ''
-      cp ${package.src}/pnpm-lock.yaml pnpm-lock.yaml
-      ${package.prePnpmInstall or ""}
-      grep -F "xlsx@$expectedXlsxTarball:" pnpm-lock.yaml
-      grep -F "resolution: {integrity: $expectedXlsxIntegrity, tarball: $expectedXlsxTarball}" pnpm-lock.yaml
-      touch $out
-    '';
 in
   pkgs.runCommand "n8n-overlay-test" {
     n8nOverlayFile =
@@ -73,8 +60,6 @@ in
     defaultOverlayBuildPhase = checkBuildPhaseInherited "overlays.default" defaultPkgs.n8n;
     modificationsOverlayRootNodeModuleSymlinks = checkRootNodeModuleSymlinks "overlays.modifications" modifiedPkgs.n8n;
     defaultOverlayRootNodeModuleSymlinks = checkRootNodeModuleSymlinks "overlays.default" defaultPkgs.n8n;
-    modificationsOverlayXlsxIntegrityPatch = checkXlsxIntegrityPatch "overlays.modifications" modifiedPkgs.n8n;
-    defaultOverlayXlsxIntegrityPatch = checkXlsxIntegrityPatch "overlays.default" defaultPkgs.n8n;
   } ''
     touch $out
   ''