test: update n8n overlay test expectations to 2.31.6

The pinned n8n version moved to 2.31.6 in 30c753f but the test was still
asserting 2.29.8 with the old src/pnpmDeps hashes, so the test broke.
Sync expectedVersion, expectedSrcHash and expectedPnpmHash to the values
currently in overlays/mods/n8n.nix.

.gitea/workflows/nix-update.yml

@@ -352,6 +352,47 @@ jobs:
             done
           fi
 
+          # ── Update overlay modifications (overlays/mods/) ───────────────
+          # Overlay updates live outside pkgs/ because the test suite
+          # (tests/n8n-overlay-test.nix) forbids exporting the overlay target
+          # as a local package. Each `overlays/mods/*/update.sh` or
+          # `overlays/mods/update.sh` is a self-contained updater that handles
+          # version discovery, hash recomputation, and commit on its own.
+          if [ -z "${{ inputs.package }}" ]; then
+            echo ""
+            echo "🔍 Discovering overlay update scripts in overlays/mods/ ..."
+            OVERLAY_SCRIPTS=$(find overlays/mods -maxdepth 2 -name "update.sh" 2>/dev/null | sort)
+
+            if [ -n "$OVERLAY_SCRIPTS" ]; then
+              for script in $OVERLAY_SCRIPTS; do
+                OVERLAY_NAME=$(basename "$(dirname "$script")")
+                echo "::group::Updating overlay: $OVERLAY_NAME"
+                BEFORE_HASH=$(git rev-parse HEAD)
+
+                # Overlay scripts are self-contained and use nix-shell shebangs
+                # for their dependencies. They commit on their own.
+                if bash "$script" 2>&1 | tee /tmp/update-overlay-${OVERLAY_NAME}.log; then
+                  if [ "$(git rev-parse HEAD)" != "$BEFORE_HASH" ]; then
+                    echo "✅ Updated overlay/$OVERLAY_NAME"
+                    UPDATES_FOUND=true
+                    if [ -n "$UPDATED_PACKAGES" ]; then
+                      UPDATED_PACKAGES="$UPDATED_PACKAGES, overlay/$OVERLAY_NAME"
+                    else
+                      UPDATED_PACKAGES="overlay/$OVERLAY_NAME"
+                    fi
+                  else
+                    echo "✓ overlay/$OVERLAY_NAME already up to date"
+                  fi
+                else
+                  echo "⚠️ Update failed for overlay/$OVERLAY_NAME"
+                fi
+                echo "::endgroup::"
+              done
+            else
+              echo "ℹ️ No overlay update scripts found."
+            fi
+          fi
+
           COMMIT_COUNT=$(git rev-list --count origin/master..HEAD)
 
           if [ "$COMMIT_COUNT" -gt 0 ]; then
@@ -382,6 +423,12 @@ jobs:
           SUCCESSFUL_PACKAGES=()
 
           for pkg in "${PKGS[@]}"; do
+            # Overlay updates (e.g. "overlay/n8n") have no top-level flake
+            # attribute — `nix flake check` already verifies them above.
+            if [[ "$pkg" == overlay/* ]]; then
+              echo "⊘ Skipping per-package build for $pkg (verified via flake check)"
+              continue
+            fi
             echo "::group::Building $pkg"
             if nix build .#$pkg 2>&1 | tee /tmp/build-${pkg}.log; then
               echo "✅ Build successful for $pkg"

docs/packages/README.md

@@ -15,7 +15,6 @@ These packages are built from source in `pkgs/<name>/`:
 | `sidecar` | Companion tool for CLI agents with diffs, file trees, and task management | Go | `pkgs/sidecar/` |
 | `td` | Minimalist CLI for tracking tasks across AI coding sessions | Go | `pkgs/td/` |
 | `code2prompt` | Convert code to prompts | Go | `pkgs/code2prompt/` |
-| `eigent` | Eigenvalue tool | Python | `pkgs/eigent/` |
 | `hyprpaper-random` | Random wallpaper setter for Hyprpaper | Shell | `pkgs/hyprpaper-random/` |
 | `kestractl` | CLI for Kestra workflow orchestration | Go | `pkgs/kestractl/` |
 | `launch-webapp` | Launch web applications | Shell | `pkgs/launch-webapp/` |

overlays/mods/n8n.nix

@@ -39,6 +39,11 @@ in
         fi
       '';
 
+    # Self-contained update script (./update.sh) — fetches latest stable
+    # release from n8n-io/n8n, recomputes both src and pnpmDeps hashes.
+    # The CI workflow in .gitea/workflows/nix-update.yml discovers and runs it.
+    passthru = (previousAttrs.passthru or {}) // {updateScript = ./update.sh;};
+
     meta =
       previousAttrs.meta
       // {

overlays/mods/update.sh

@@ -0,0 +1,153 @@
+#!/usr/bin/env nix-shell
+#!nix-shell --pure -i bash -p bash curl jq nix nix-prefetch cacert git
+set -euo pipefail
+
+# Update the n8n overlay (overlays/mods/n8n.nix) to the latest stable GitHub
+# release of n8n-io/n8n.
+#
+# This is a self-contained updater (not nix-update), because the overlay file
+# is a `prev.n8n.overrideAttrs` form rather than a standalone derivation and
+# the test suite (tests/n8n-overlay-test.nix) explicitly forbids exporting a
+# local n8n package. The CI workflow discovers and runs this script directly.
+#
+# What it does, in order:
+#   1. Fetch latest stable (non-prerelease) tag from the GitHub API
+#   2. Strip the `n8n@` prefix → version
+#   3. Compare to the version pinned in overlays/mods/n8n.nix
+#   4. Compute new src hash (fetchFromGitHub tarball) via nix-prefetch-url
+#   5. Compute new pnpmDeps hash via the lib.fakeHash trick
+#   6. Commit
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+NIX_FILE="$SCRIPT_DIR/n8n.nix"
+
+REPO="n8n-io/n8n"
+TAG_PREFIX="n8n@"
+
+# ── 1. Latest stable release ───────────────────────────────────────────────
+echo "Fetching latest stable release of $REPO ..."
+LATEST_TAG=$(curl -fsSL "https://api.github.com/repos/$REPO/releases/latest" \
+  | jq -r 'select(.prerelease == false) | .tag_name')
+
+if [[ -z "$LATEST_TAG" ]]; then
+  echo "ERROR: No stable release found for $REPO" >&2
+  exit 1
+fi
+
+VERSION="${LATEST_TAG#${TAG_PREFIX}}"
+echo "Latest version: $VERSION"
+
+# ── 2. Current version from the nix file ───────────────────────────────────
+CURRENT=$(awk '
+  /^[[:space:]]*version = "/ {
+    gsub(/^[[:space:]]*version = "/, "")
+    gsub(/".*/, "")
+    print
+    exit
+  }
+' "$NIX_FILE")
+echo "Current version: $CURRENT"
+
+if [[ "$VERSION" == "$CURRENT" ]]; then
+  echo "Already at latest version, nothing to do."
+  exit 0
+fi
+
+echo "==> Updating n8n $CURRENT -> $VERSION"
+
+# ── 3. Bump version in the file ────────────────────────────────────────────
+sed -i "s|^\([[:space:]]*\)version = \"[^\"]*\";|\1version = \"$VERSION\";|" "$NIX_FILE"
+
+# ── 4. Compute and apply src hash ──────────────────────────────────────────
+echo "==> Computing src hash ..."
+SRC_URL="https://github.com/$REPO/archive/refs/tags/${TAG_PREFIX}${VERSION}.tar.gz"
+# `--name n8n-source` works around the `@` in the upstream tag name
+# (nix-prefetch-url refuses filenames containing `@`).
+SRC_HASH=$(nix-prefetch-url --unpack --type sha256 --name n8n-source "$SRC_URL" 2>/dev/null)
+SRC_SRI=$(nix hash convert --hash-algo sha256 --to sri "$SRC_HASH")
+echo "    src hash: $SRC_SRI"
+
+# Replace the FIRST `hash = "sha256-...";` occurrence (the src block sits above pnpmDeps)
+awk -v sri="$SRC_SRI" '
+  !src_done && /^[[:space:]]*hash = "sha256-/ {
+    sub(/"sha256-[A-Za-z0-9+/=]+"/, "\"" sri "\"")
+    src_done = 1
+  }
+  { print }
+' "$NIX_FILE" > "$NIX_FILE.tmp" && mv "$NIX_FILE.tmp" "$NIX_FILE"
+
+# ── 5. Compute pnpmDeps hash via lib.fakeHash ──────────────────────────────
+echo "==> Computing pnpmDeps hash (this may take a while) ..."
+
+# 5a. Temporarily set the pnpmDeps hash to lib.fakeHash
+awk '
+  !pnpm_started && /^[[:space:]]*pnpmDeps = / { pnpm_started = 1 }
+  pnpm_started && !pnpm_done && /^[[:space:]]*hash = "sha256-/ {
+    sub(/"sha256-[A-Za-z0-9+/=]+"/, "lib.fakeHash")
+    pnpm_done = 1
+  }
+  { print }
+' "$NIX_FILE" > "$NIX_FILE.tmp" && mv "$NIX_FILE.tmp" "$NIX_FILE"
+
+# 5b. Evaluate n8nModified.pnpmDeps — fixed-output derivation with a wrong hash
+#     will fail and print the correct hash in the "got:" line.
+SYSTEM=$(nix eval --impure --raw --expr 'builtins.currentSystem' 2>/dev/null || echo "x86_64-linux")
+NIX_EXPR="(let
+    flake = builtins.getFlake (toString ./.);
+    pkgs = flake.inputs.nixpkgs.legacyPackages.\${builtins.currentSystem};
+    n8nModified = import ./overlays/mods/n8n.nix { prev = pkgs; };
+  in n8nModified.pnpmDeps)"
+
+BUILD_OUTPUT=$(nix build --impure --no-link --expr "$NIX_EXPR" 2>&1 || true)
+
+# Hash mismatch errors list two sha256 values: the wrong "Expected"/"specified"
+# one (our lib.fakeHash = all A's) and the correct "Got"/"got" one. Different
+# nix versions capitalise the label differently, so we filter out the fakeHash
+# sentinel and take whatever real sha256 remains.
+PNPM_HASH=$(echo "$BUILD_OUTPUT" \
+  | grep -oE 'sha256-[A-Za-z0-9+/=]+' \
+  | grep -v 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA' \
+  | tail -1)
+
+if [[ -z "$PNPM_HASH" ]]; then
+  echo "ERROR: Failed to compute pnpmDeps hash. nix build output:" >&2
+  echo "$BUILD_OUTPUT" >&2
+  echo "Restoring original file..." >&2
+  git checkout -- "$NIX_FILE" 2>/dev/null || true
+  exit 1
+fi
+
+echo "    pnpmDeps hash: $PNPM_HASH"
+
+# 5d. Replace lib.fakeHash with the real hash
+awk -v sri="$PNPM_HASH" '
+  !pnpm_started && /^[[:space:]]*pnpmDeps = / { pnpm_started = 1 }
+  pnpm_started && !pnpm_done && /^[[:space:]]*hash = / {
+    sub(/lib\.fakeHash/, "\"" sri "\"")
+    pnpm_done = 1
+  }
+  { print }
+' "$NIX_FILE" > "$NIX_FILE.tmp" && mv "$NIX_FILE.tmp" "$NIX_FILE"
+
+# ── 6. Verify the file parses and commit ───────────────────────────────────
+echo "==> Verifying nix evaluation ..."
+if ! nix eval --impure --expr "
+  let
+    flake = builtins.getFlake (toString ./.);
+    pkgs = flake.inputs.nixpkgs.legacyPackages.\${builtins.currentSystem};
+  in (import ./overlays/mods/n8n.nix { prev = pkgs; }).version
+" >/dev/null 2>&1; then
+  echo "ERROR: nix evaluation failed after update; restoring original." >&2
+  git checkout -- "$NIX_FILE" 2>/dev/null || true
+  exit 1
+fi
+
+NIXPKGS_ROOT=$(git -C "$SCRIPT_DIR" rev-parse --show-toplevel 2>/dev/null || true)
+if [[ -n "$NIXPKGS_ROOT" ]] && \
+   [[ -n "$(git -C "$NIXPKGS_ROOT" status --porcelain "$NIX_FILE")" ]]; then
+  git -C "$NIXPKGS_ROOT" add "$NIX_FILE"
+  git -C "$NIXPKGS_ROOT" commit -m "n8n: $CURRENT -> $VERSION"
+  echo "==> Committed"
+fi
+
+echo "==> Done"

pkgs/default.nix

@@ -18,7 +18,6 @@ in {
 
   sidecar = pkgs.callPackage ./sidecar {};
   td = pkgs.callPackage ./td {};
-  eigent = pkgs.callPackage ./eigent {};
   hyprpaper-random = pkgs.callPackage ./hyprpaper-random {};
   launch-webapp = pkgs.callPackage ./launch-webapp {};
   mem0 = pkgs.callPackage ./mem0 {};

pkgs/msty-studio/default.nix

@@ -1,3 +1,4 @@
+# last-modified: Wed, 24 Sep 2025 00:17:41 GMT
 {
   appimageTools,
   fetchurl,
@@ -9,6 +10,8 @@
 }: let
   pname = "msty-studio";
   version = "2.0.0-beta.4";
+  # Upstream publishes to an unversioned URL — ./update.sh watches Last-Modified
+  # and refreshes the sha256 when the binary changes. Bump `version` manually.
   src = fetchurl {
     url = "https://next-assets.msty.studio/app/alpha/linux/MstyStudio_x86_64.AppImage";
     sha256 = "sha256-zJcGK7QEL3ROgVJy13mMdY/437H3Zx8EwSXy7rEhV9w=";
@@ -34,6 +37,8 @@ in
               wrapProgram $out/bin/${pname} \
                       --prefix PATH : ${nodejs}/bin:${uv}/bin:${python3}/bin
     '';
+    passthru.updateScript = ./update.sh;
+
     meta = {
       description = "Msty Studio enables advanced, privacy‑preserving AI workflows entirely on your local machine.";
       license = lib.licenses.unfree;

pkgs/msty-studio/update.sh

@@ -0,0 +1,62 @@
+#!/usr/bin/env nix-shell
+#!nix-shell --pure -i bash -p bash curl nix nix-prefetch cacert git
+set -euo pipefail
+
+# Update msty-studio AppImage hash.
+#
+# Upstream publishes to an unversioned URL (MstyStudio_x86_64.AppImage) — no
+# version-pinned URL and no usable GitHub release. To still catch updates, we:
+#   1. HEAD the URL and read the Last-Modified header
+#   2. Compare to the value stored as a `# last-modified:` comment in default.nix
+#   3. If changed: re-download, compute sha256, update hash + comment, commit
+#
+# The version attribute stays static (manual bump) — only the binary hash is
+# refreshed automatically.
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+NIX_FILE="$SCRIPT_DIR/default.nix"
+URL="https://next-assets.msty.studio/app/alpha/linux/MstyStudio_x86_64.AppImage"
+
+echo "Checking $URL ..."
+HEADERS=$(curl -fsSIL "$URL")
+NEW_LAST_MODIFIED=$(echo "$HEADERS" | tr -d '\r' \
+  | awk -F': ' 'tolower($1)=="last-modified" {print $2; exit}')
+
+if [[ -z "$NEW_LAST_MODIFIED" ]]; then
+  echo "ERROR: Could not read Last-Modified header from $URL" >&2
+  exit 1
+fi
+
+CURRENT_LAST_MODIFIED=$(awk -F': ' '/^# last-modified:/ {sub(/^# last-modified: /, ""); print; exit}' "$NIX_FILE")
+
+echo "Current: ${CURRENT_LAST_MODIFIED:-<none>}"
+echo "Latest:  $NEW_LAST_MODIFIED"
+
+if [[ "$NEW_LAST_MODIFIED" == "$CURRENT_LAST_MODIFIED" ]]; then
+  echo "No change, nothing to do."
+  exit 0
+fi
+
+echo "==> Content changed, refreshing hash..."
+
+HASH=$(nix-prefetch-url --type sha256 "$URL" 2>/dev/null)
+SRI=$(nix hash convert --hash-algo sha256 --to sri "$HASH")
+echo "New sha256: $SRI"
+
+sed -i "s|^\([[:space:]]*\)sha256 = \"[^\"]*\";|\1sha256 = \"$SRI\";|" "$NIX_FILE"
+
+if grep -q '^# last-modified:' "$NIX_FILE"; then
+  sed -i "s|^# last-modified:.*|# last-modified: $NEW_LAST_MODIFIED|" "$NIX_FILE"
+else
+  sed -i "1i # last-modified: $NEW_LAST_MODIFIED" "$NIX_FILE"
+fi
+
+echo "Updated $NIX_FILE"
+
+NIXPKGS_ROOT=$(git -C "$SCRIPT_DIR" rev-parse --show-toplevel 2>/dev/null || true)
+if [[ -n "$NIXPKGS_ROOT" ]] && \
+   [[ -n "$(git -C "$NIXPKGS_ROOT" status --porcelain "$NIX_FILE")" ]]; then
+  git -C "$NIXPKGS_ROOT" add "$NIX_FILE"
+  git -C "$NIXPKGS_ROOT" commit -m "msty-studio: refresh AppImage ($NEW_LAST_MODIFIED)"
+  echo "==> Committed"
+fi

pkgs/vibetyper/default.nix

@@ -1,3 +1,4 @@
+# last-modified: Fri, 24 Jul 2026 10:50:57 GMT
 {
   appimageTools,
   fetchurl,
@@ -6,6 +7,8 @@
 }: let
   pname = "vibetyper";
   version = "1.4.0";
+  # Upstream publishes to an unversioned URL — ./update.sh watches Last-Modified
+  # and refreshes the sha256 when the binary changes. Bump `version` manually.
   src = fetchurl {
     url = "https://cdn.vibetyper.com/releases/linux/VibeTyper.AppImage";
     sha256 = "sha256-p4MOTKbEMIUhwhyGSE/l6ucwpPjeTELJ0lX4TXrKf2Y=";
@@ -29,6 +32,8 @@ in
               --set VIBE_DISABLE_HYPRLAND_INDICATOR_NO_BLUR 1
     '';
 
+    passthru.updateScript = ./update.sh;
+
     meta = {
       description = "VibeTyper - AI-powered typing assistant";
       homepage = "https://vibetyper.com";

pkgs/vibetyper/update.sh

@@ -0,0 +1,68 @@
+#!/usr/bin/env nix-shell
+#!nix-shell --pure -i bash -p bash curl nix nix-prefetch cacert git
+set -euo pipefail
+
+# Update vibetyper AppImage hash.
+#
+# Upstream publishes to an unversioned URL (VibeTyper.AppImage) — there is no
+# version-pinned URL and no usable GitHub release. To still catch updates, we:
+#   1. HEAD the URL and read the Last-Modified header
+#   2. Compare to the value stored as a `# last-modified:` comment in default.nix
+#   3. If changed: re-download, compute sha256, update hash + comment, commit
+#
+# The version attribute stays static (manual bump) — only the binary hash is
+# refreshed automatically.
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+NIX_FILE="$SCRIPT_DIR/default.nix"
+URL="https://cdn.vibetyper.com/releases/linux/VibeTyper.AppImage"
+
+echo "Checking $URL ..."
+# -f: fail on HTTP errors, -s: silent, -S: show errors, -I: HEAD, -L: follow redirects
+HEADERS=$(curl -fsSIL "$URL")
+NEW_LAST_MODIFIED=$(echo "$HEADERS" | tr -d '\r' \
+  | awk -F': ' 'tolower($1)=="last-modified" {print $2; exit}')
+
+if [[ -z "$NEW_LAST_MODIFIED" ]]; then
+  echo "ERROR: Could not read Last-Modified header from $URL" >&2
+  exit 1
+fi
+
+# Read stored Last-Modified from `# last-modified:` comment in the nix file
+CURRENT_LAST_MODIFIED=$(awk -F': ' '/^# last-modified:/ {sub(/^# last-modified: /, ""); print; exit}' "$NIX_FILE")
+
+echo "Current: ${CURRENT_LAST_MODIFIED:-<none>}"
+echo "Latest:  $NEW_LAST_MODIFIED"
+
+if [[ "$NEW_LAST_MODIFIED" == "$CURRENT_LAST_MODIFIED" ]]; then
+  echo "No change, nothing to do."
+  exit 0
+fi
+
+echo "==> Content changed, refreshing hash..."
+
+# Compute new sha256 (SRI form, matches existing `sha256 = "sha256-..."` style)
+HASH=$(nix-prefetch-url --type sha256 "$URL" 2>/dev/null)
+SRI=$(nix hash convert --hash-algo sha256 --to sri "$HASH")
+echo "New sha256: $SRI"
+
+# Update the sha256 attribute (keeps the existing `sha256 = "sha256-..."` shape)
+sed -i "s|^\([[:space:]]*\)sha256 = \"[^\"]*\";|\1sha256 = \"$SRI\";|" "$NIX_FILE"
+
+# Update or insert the last-modified marker comment
+if grep -q '^# last-modified:' "$NIX_FILE"; then
+  sed -i "s|^# last-modified:.*|# last-modified: $NEW_LAST_MODIFIED|" "$NIX_FILE"
+else
+  sed -i "1i # last-modified: $NEW_LAST_MODIFIED" "$NIX_FILE"
+fi
+
+echo "Updated $NIX_FILE"
+
+# Commit when inside a git repo
+NIXPKGS_ROOT=$(git -C "$SCRIPT_DIR" rev-parse --show-toplevel 2>/dev/null || true)
+if [[ -n "$NIXPKGS_ROOT" ]] && \
+   [[ -n "$(git -C "$NIXPKGS_ROOT" status --porcelain "$NIX_FILE")" ]]; then
+  git -C "$NIXPKGS_ROOT" add "$NIX_FILE"
+  git -C "$NIXPKGS_ROOT" commit -m "vibetyper: refresh AppImage ($NEW_LAST_MODIFIED)"
+  echo "==> Committed"
+fi

pkgs/zellij-ps/default.nix

@@ -12,12 +12,15 @@ with lib;
     pname = "zellij-ps";
     version = "0.1.0";
 
+    # Branch-tracking source: follows the tip of the master branch of
+    # code.m3ta.dev/m3tam3re/helper-scripts. The repo has no tags, so we
+    # track commits via the Gitea API (see ./update.sh).
     src = fetchFromGitea {
       domain = "code.m3ta.dev";
       owner = "m3tam3re";
       repo = "helper-scripts";
-      rev = "08a3217b83391c1110545c1ee3161eecd5dbe5e9";
-      sha256 = "1sc4i58mwcg3qsq0wwl5rvk08ykbxc497bq7mrxiirndsarskby7";
+      rev = "d30382d8692399d952a1aacbdb77e6ab87ba046d";
+      sha256 = "0zrl8089qj14gwn9k3b73vnw2zn48f9yh9w0qbh8g8mb171sxyaj";
     };
 
     propagatedBuildInputs = [fish fd fzf zellij];
@@ -33,6 +36,8 @@ with lib;
       chmod +x $out/bin/zellij-ps
     '';
 
+    passthru.updateScript = ./update.sh;
+
     meta = {
       description = "Zellij project switcher - quickly switch between project folders";
       license = lib.licenses.mit;

pkgs/zellij-ps/update.sh

@@ -0,0 +1,75 @@
+#!/usr/bin/env nix-shell
+#!nix-shell --pure -i bash -p bash curl jq nix nix-prefetch cacert git
+set -euo pipefail
+
+# Update zellij-ps to the latest commit on the helper-scripts master branch.
+# The upstream repo (m3ta.dev/m3tam3re/helper-scripts) has no tags/releases,
+# so we track the tip of master via the Gitea API.
+#
+# This is a "branch-tracking" updater: always pulls the newest commit,
+# NOT a stable release. Suitable for personal script repos.
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+NIX_FILE="$SCRIPT_DIR/default.nix"
+
+DOMAIN="code.m3ta.dev"
+OWNER="m3tam3re"
+REPO="helper-scripts"
+BRANCH="master"
+
+echo "Fetching latest commit on $BRANCH of $DOMAIN/$OWNER/$REPO..."
+LATEST_SHA=$(curl -fsSL "https://$DOMAIN/api/v1/repos/$OWNER/$REPO/branches/$BRANCH" \
+  | jq -r '.commit.id')
+
+if [[ -z "$LATEST_SHA" ]]; then
+  echo "ERROR: Failed to fetch latest commit from $DOMAIN/$OWNER/$REPO" >&2
+  exit 1
+fi
+
+# Read current rev from the nix file
+CURRENT_SHA=$(awk '
+  /^[[:space:]]*rev = "/ {
+    gsub(/^[[:space:]]*rev = "/, "")
+    gsub(/".*/, "")
+    print
+    exit
+  }
+' "$NIX_FILE")
+
+echo "Current: ${CURRENT_SHA:0:10}"
+echo "Latest:  ${LATEST_SHA:0:10}"
+
+if [[ "$LATEST_SHA" == "$CURRENT_SHA" ]]; then
+  echo "Already at latest commit, nothing to do."
+  exit 0
+fi
+
+echo "==> Updating zellij-ps: ${CURRENT_SHA:0:10} -> ${LATEST_SHA:0:10}"
+
+# Compute new sha256 via nix-prefetch-url (matches existing sha256 = "..." style)
+ARCHIVE_URL="https://$DOMAIN/$OWNER/$REPO/archive/$LATEST_SHA.tar.gz"
+echo "Prefetching: $ARCHIVE_URL"
+HASH=$(nix-prefetch-url --unpack --type sha256 "$ARCHIVE_URL" 2>/dev/null)
+
+if [[ -z "$HASH" ]]; then
+  echo "ERROR: nix-prefetch-url failed" >&2
+  exit 1
+fi
+
+echo "New sha256: $HASH"
+
+# Update rev and sha256 in the nix file
+sed -i "s|^\([[:space:]]*\)rev = \"[^\"]*\";|\1rev = \"$LATEST_SHA\";|" "$NIX_FILE"
+sed -i "s|^\([[:space:]]*\)sha256 = \"[^\"]*\";|\1sha256 = \"$HASH\";|" "$NIX_FILE"
+
+echo "Updated $NIX_FILE"
+
+# Commit when inside a git repo
+NIXPKGS_ROOT=$(git -C "$SCRIPT_DIR" rev-parse --show-toplevel 2>/dev/null || true)
+if [[ -n "$NIXPKGS_ROOT" ]] && \
+   [[ -n "$(git -C "$NIXPKGS_ROOT" status --porcelain "$NIX_FILE")" ]]; then
+  SHORT="${LATEST_SHA:0:10}"
+  git -C "$NIXPKGS_ROOT" add "$NIX_FILE"
+  git -C "$NIXPKGS_ROOT" commit -m "zellij-ps: update helper-scripts to $SHORT"
+  echo "==> Committed"
+fi

tests/n8n-overlay-test.nix

@@ -15,9 +15,9 @@
   modifiedPkgs = mkPkgs [self.overlays.modifications];
   defaultPkgs = mkPkgs [self.overlays.default];
 
-  expectedVersion = "2.29.8";
-  expectedSrcHash = "sha256-+eiAdofrX1TRNFeD9MtTHt+XBH06c8NQHvTk6vrOU/k=";
-  expectedPnpmHash = "sha256-XMPvxTb7cKz3XmJFOAqN42B2VGyzyFPrF0eUU8g/KPU=";
+  expectedVersion = "2.31.6";
+  expectedSrcHash = "sha256-OTVfIHnGTaBogEd93Ak2Pu3Jh7VweQNYbUeahq1Z/64=";
+  expectedPnpmHash = "sha256-Q3HCJg1KjdRJnPZJEUKcaCrh8tBhT9B3gqMz8xbBZVg=";
   expectedChangelog = "https://github.com/n8n-io/n8n/releases/tag/n8n@${expectedVersion}";
   expectedXlsxTarball = "https://cdn.sheetjs.com/xlsx-0.20.2/xlsx-0.20.2.tgz";
   expectedXlsxIntegrity = "sha512-+nKZ39+nvK7Qq6i0PvWWRA4j/EkfWOtkP/YhMtupm+lJIiHxUrgTr1CcKv1nBk1rHtkRRQ3O2+Ih/q/sA+FXZA==";