n8n: 2.38.7 -> 2.39.6

n8n >= 2.37.0 demands pnpm >= 11.22.0 via engines.pnpm and serialises
patchedDependencies as plain scalars in pnpm-lock.yaml (same
lockfileVersion '9.0'), which pnpm 10 cannot install. The pinned nixpkgs
only ships pnpm_11 11.17.0, so:

- build with pnpm_11 + fetcherVersion 4 and relax the engines.pnpm gate
  in package.json (relaxPnpmEngine) for both fetchPnpmDeps and the main
  build; swap pnpm_10 -> pnpm_11 in nativeBuildInputs
- drop the workaround once nixpkgs ships pnpm >= 11.22

update.sh: detect ERR_PNPM_UNSUPPORTED_ENGINE /
ERR_PNPM_LOCKFILE_CONFIG_MISMATCH with actionable hints, sync
tests/n8n-overlay-test.nix expectations (checks were stale at 2.32.6),
guard against leftover fake-hash sentinels, and run from the repo root
so the relative nix --expr paths resolve.

Verified: n8n-overlay check green, full n8n 2.37.9 build green.

flake.lock

@@ -46,11 +46,11 @@
         "treefmt-nix": "treefmt-nix"
       },
       "locked": {
-        "lastModified": 1785934673,
-        "narHash": "sha256-U/hMY9kkcdxt497yfGuT7+ytrRmE+E15KF6Sc6VrbZo=",
+        "lastModified": 1788856318,
+        "narHash": "sha256-bOLED82KPrzIXTWELw30y3PVI6MBmlY4Y2F2lwrdOnM=",
         "owner": "mulatta",
         "repo": "buzz.nix",
-        "rev": "f4bb77a87f1ec10e5ad51cfe6d0c4fca481c0534",
+        "rev": "fdd0152c12c6be339fe01d91887122bb10823aaf",
         "type": "github"
       },
       "original": {
@@ -61,11 +61,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1785318670,
-        "narHash": "sha256-dN6Ou5x/+23FZLEpYP3IffO+NyJFzUlGumt1uu3MMaY=",
+        "lastModified": 1789006805,
+        "narHash": "sha256-xB8mKMOx1IA9vTDNLmJZ6n4wCMq/cuWBBOzGCRnqxrU=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "0954f7ee2f6bb3dc7d4e3d0d8bcb8fd4bde4cfc5",
+        "rev": "8ce4ef6cb6f871616146b9fe26d2a5ae594e94fe",
         "type": "github"
       },
       "original": {
@@ -77,11 +77,11 @@
     },
     "nixpkgs-master": {
       "locked": {
-        "lastModified": 1785386845,
-        "narHash": "sha256-CvXXTgWxbwTn6Diev4nLTP5+8tsFtth/SQAtaR9iVY0=",
+        "lastModified": 1789139724,
+        "narHash": "sha256-QEoQ8xoSO3H2tmwHNBYFL/5Y8Gt10U+bg5ETMsWXiIM=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "3c5a718ce27c9283364d4c664fac4e4a23acdfb4",
+        "rev": "e27e37949736566430ed2f6157bebcdade8860c5",
         "type": "github"
       },
       "original": {
@@ -112,11 +112,11 @@
         "nixpkgs": "nixpkgs_2"
       },
       "locked": {
-        "lastModified": 1785386452,
-        "narHash": "sha256-iYfkMmn1ZKbi0cv8XIAXVgPH4idzsVSK4cWyi/KGMJQ=",
+        "lastModified": 1789132601,
+        "narHash": "sha256-2+j5RuHoqrsnjssZ4VfIfSKzGdrPNFT4nazJ2QxNdu0=",
         "owner": "anomalyco",
         "repo": "opencode",
-        "rev": "f7204902192624481e526b1852cdedaadb914e24",
+        "rev": "95daf90670b7c039c436c85537da5fbfe2205b41",
         "type": "github"
       },
       "original": {
@@ -126,26 +126,6 @@
         "type": "github"
       }
     },
-    "openspec": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1785371113,
-        "narHash": "sha256-r3fwnb5gMTV9UXBj7bqkKpTZIWwF4AgghULOIv2Fr4c=",
-        "owner": "Fission-AI",
-        "repo": "OpenSpec",
-        "rev": "2b3d368539132be6311e55db58899abbf5306b81",
-        "type": "github"
-      },
-      "original": {
-        "owner": "Fission-AI",
-        "repo": "OpenSpec",
-        "type": "github"
-      }
-    },
     "root": {
       "inputs": {
         "agents": "agents",
@@ -153,8 +133,7 @@
         "buzz": "buzz",
         "nixpkgs": "nixpkgs",
         "nixpkgs-master": "nixpkgs-master",
-        "opencode": "opencode",
-        "openspec": "openspec"
+        "opencode": "opencode"
       }
     },
     "rust-overlay": {
@@ -165,11 +144,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1785820796,
-        "narHash": "sha256-sZXy8mzUMi2cOGulhoW4HWAZB6JhXOAx1x8J4auZFWk=",
+        "lastModified": 1788591095,
+        "narHash": "sha256-Vh+BeLWfbTT9AecazIsQ/Tkg/RzJeX3lEduANf256WA=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "b6916ba032e02122d6ed3064f40cabe937363d43",
+        "rev": "c361047d3a538f547f1617bb6b410411929ac9cc",
         "type": "github"
       },
       "original": {
@@ -186,11 +165,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1785360170,
-        "narHash": "sha256-XE1lKgQ3eIO3E7zWryqcRsax+mYXod/5RHBn4YaR9YE=",
+        "lastModified": 1786901030,
+        "narHash": "sha256-WSFCsDSE5ffgD2MqzkM2CYjeFiKhRF/dJUN8uedb6YE=",
         "owner": "numtide",
         "repo": "treefmt-nix",
-        "rev": "d1187f8bc71fb8aab02395869ec3f5c1920f75c0",
+        "rev": "27b3b12a8e6375f28ebe122f07d230ca5459bbfa",
         "type": "github"
       },
       "original": {

flake.nix

@@ -10,11 +10,6 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
-    openspec = {
-      url = "github:Fission-AI/OpenSpec";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-
     opencode.url = "github:anomalyco/opencode/dev";
 
     buzz = {

modules/home-manager/coding/opencode.nix

@@ -15,8 +15,8 @@ in {
       default = {};
       description = ''
         Attributes merged (via recursiveUpdate) on top of the default
-        oh-my-opencode.json. Use this to set provider-specific model
-        assignments per machine.
+        oh-my-openagent.json (the plugin's canonical config file).
+        Use this to set provider-specific model assignments per machine.
       '';
       example = literalExpression ''
         {
@@ -73,7 +73,7 @@ in {
       ];
     };
 
-    home.file.".config/opencode/oh-my-opencode.json".text = builtins.toJSON (
+    home.file.".config/opencode/oh-my-openagent.json".text = builtins.toJSON (
       recursiveUpdate
       {
         "$schema" = "https://raw.githubusercontent.com/code-yeongyu/oh-my-opencode/master/assets/oh-my-opencode.schema.json";

overlays/mods/n8n.nix

@@ -4,24 +4,52 @@
   # regular npm package `@e965/xlsx@0.20.3`, which already carries an integrity
   # field. The old lockfile-integrity workaround is therefore obsolete and has
   # been removed.
+  #
+  # n8n >= 2.37.0 demands pnpm >= 11.22.0 via `engines.pnpm`, but the pinned
+  # nixpkgs only ships pnpm_10 (10.34.5) and pnpm_11 (11.17.0) — both too old.
+  # pnpm enforces that gate for ITSELF regardless of `engine-strict`, so both
+  # fetchPnpmDeps and the main build die with ERR_PNPM_UNSUPPORTED_ENGINE
+  # before any hash mismatch is even reached. Additionally n8n's lockfile,
+  # while still declaring lockfileVersion '9.0', now serialises
+  # patchedDependencies as plain `name@version: hash` scalars (no `path:`
+  # mapping), which pnpm 10 cannot parse (ERR_PNPM_LOCKFILE_CONFIG_MISMATCH).
+  # We therefore build with pnpm_11 + fetcherVersion 4 and relax the engine
+  # gate in package.json. Drop the sed once nixpkgs ships pnpm >= 11.22 and
+  # this overlay's nixpkgs pin has caught up.
+  relaxPnpmEngine = ''
+    sed -i -E 's/"pnpm": *"[^"]*"/"pnpm": "*"/' package.json
+  '';
 in
   prev.n8n.overrideAttrs (finalAttrs: previousAttrs: {
-    version = "2.33.4";
+    version = "2.39.6";
 
     src = prev.fetchFromGitHub {
       owner = "n8n-io";
       repo = "n8n";
       tag = "n8n@${finalAttrs.version}";
-      hash = "sha256-tTsI6XAWdakN+sX9jUIoIH7msLwWS0NQDyE1YnOrnso=";
+      hash = "sha256-fmo0xL6IF6J+D5ZamkoBXyZ4Q8s3l5MeBWaXc39OsTU=";
     };
 
     pnpmDeps = prev.fetchPnpmDeps {
       inherit (finalAttrs) pname version src;
-      pnpm = prev.pnpm_10;
-      fetcherVersion = 3;
-      hash = "sha256-o3qDP52YC5YxLSRCxMhH/8GRVXVduRM3IpB7xgPG5P8=";
+      pnpm = prev.pnpm_11;
+      fetcherVersion = 4;
+      postPatch = relaxPnpmEngine;
+      hash = "sha256-yL95w+Jd5I5R6r/qNihvAJ4MX2LMyS9ICZzJnLxHR4s=";
     };
 
+    postPatch = (previousAttrs.postPatch or "") + relaxPnpmEngine;
+
+    # Swap pnpm_10 -> pnpm_11 from the inherited nativeBuildInputs: upstream
+    # n8n calls pnpm directly during the build (install/build/prune) and pnpm 10
+    # cannot parse the pnpm-11 lockfile. The top-level pnpmConfigHook stays as
+    # is — it discovers the fetcher version from pnpmDeps' .fetcher-version.
+    nativeBuildInputs = builtins.map (x:
+      if (x.outPath or null) == prev.pnpm_10.outPath
+      then prev.pnpm_11
+      else x)
+    previousAttrs.nativeBuildInputs;
+
     preBuild =
       (previousAttrs.preBuild or "")
       + ''

overlays/mods/update.sh

@@ -17,25 +17,52 @@ set -euo pipefail
 #   3. Compare to the version pinned in overlays/mods/n8n.nix
 #   4. Compute new src hash (fetchFromGitHub tarball) via nix-prefetch-url
 #   5. Compute new pnpmDeps hash via the fake-hash trick
-#   6. Commit
+#   6. Sync tests/n8n-overlay-test.nix expectations (version + both hashes)
+#   7. Verify evaluation + test expectations, then commit
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 NIX_FILE="$SCRIPT_DIR/n8n.nix"
+TEST_FILE="$SCRIPT_DIR/../../tests/n8n-overlay-test.nix"
 NIXPKGS_ROOT=$(git -C "$SCRIPT_DIR" rev-parse --show-toplevel 2>/dev/null || true)
 
-# Snapshot the current n8n.nix so we can restore it if anything goes wrong
-# (error, SIGINT, SIGTERM, or a killed build) — otherwise a failed/aborted run
-# leaves a stale version bump and/or the fake-hash sentinel behind. Restoring
-# from the snapshot (rather than `git checkout`) also preserves any
-# pre-existing working-tree edits the user may have made. The trap is disarmed
-# once we reach a successful commit.
+# A literal SRI sentinel (equal to lib.fakeHash). We write the literal rather
+# than `lib.fakeHash` so we don't depend on `lib` being in scope inside
+# n8n.nix — the overlay is imported with just `{ prev = pkgs; }`, so `lib`
+# is not bound there.
+FAKE_HASH='sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA='
+
+if [[ -z "$NIXPKGS_ROOT" ]]; then
+	echo "ERROR: could not locate the git checkout root from $SCRIPT_DIR." >&2
+	echo "       The updater needs the flake context (flake.lock nixpkgs pin)." >&2
+	exit 1
+fi
+
+# The `nix build/eval --expr` calls below resolve `./` against the current
+# working directory, not against this script — always run from the repo root.
+cd "$NIXPKGS_ROOT"
+
+# Snapshot the current n8n.nix (and the test expectations) so we can restore
+# them if anything goes wrong (error, SIGINT, SIGTERM, or a killed build) —
+# otherwise a failed/aborted run leaves a stale version bump and/or the
+# fake-hash sentinel behind. Restoring from the snapshots (rather than
+# `git checkout`) also preserves any pre-existing working-tree edits the user
+# may have made. The trap is disarmed once we reach a successful commit.
 RESTORE_FILE="$(mktemp)"
+TEST_RESTORE_FILE="$(mktemp)"
 cp "$NIX_FILE" "$RESTORE_FILE"
+if [[ -f "$TEST_FILE" ]]; then
+	cp "$TEST_FILE" "$TEST_RESTORE_FILE"
+else
+	: >"$TEST_RESTORE_FILE"
+fi
 restore_on_failure() {
 	if [[ -z "${UPDATE_SUCCEEDED:-}" ]]; then
 		cp -f "$RESTORE_FILE" "$NIX_FILE" 2>/dev/null || true
+		if [[ -s "$TEST_RESTORE_FILE" ]]; then
+			cp -f "$TEST_RESTORE_FILE" "$TEST_FILE" 2>/dev/null || true
+		fi
 	fi
-	rm -f "$RESTORE_FILE"
+	rm -f "$RESTORE_FILE" "$TEST_RESTORE_FILE"
 }
 trap restore_on_failure EXIT
 
@@ -66,6 +93,13 @@ CURRENT=$(awk '
 ' "$NIX_FILE")
 echo "Current version: $CURRENT"
 
+if grep -q "$FAKE_HASH" "$NIX_FILE"; then
+	echo "ERROR: $NIX_FILE already contains the fake-hash sentinel." >&2
+	echo "       A previous update run was interrupted before it could restore." >&2
+	echo "       Fix up the file first (git diff / git checkout -- overlays/mods/n8n.nix)." >&2
+	exit 1
+fi
+
 if [[ "$VERSION" == "$CURRENT" ]]; then
 	echo "Already at latest version, nothing to do."
 	exit 0
@@ -97,12 +131,6 @@ awk -v sri="$SRC_SRI" '
 # ── 5. Compute pnpmDeps hash via the fake-hash trick ───────────────────────
 echo "==> Computing pnpmDeps hash (this may take a while) ..."
 
-# A literal SRI sentinel (equal to lib.fakeHash). We write the literal rather
-# than `lib.fakeHash` so we don't depend on `lib` being in scope inside
-# n8n.nix — the overlay is imported with just `{ prev = pkgs; }`, so `lib`
-# is not bound there.
-FAKE_HASH='sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA='
-
 # 5a. Temporarily set the pnpmDeps hash to the fake sentinel.
 awk -v fake="\"$FAKE_HASH\"" '
   !pnpm_started && /^[[:space:]]*pnpmDeps = / { pnpm_started = 1 }
@@ -134,9 +162,19 @@ PNPM_HASH=$(echo "$BUILD_OUTPUT" |
 
 if [[ -z "$PNPM_HASH" ]]; then
 	echo "ERROR: could not extract a pnpmDeps hash from the build output." >&2
-	echo "       This usually means fetchPnpmDeps failed for a reason OTHER than" >&2
-	echo "       a hash mismatch (e.g. a pnpm-lock patch in n8n.nix no longer applies," >&2
-	echo "       a tarball vanished, or the build was interrupted). Full output:" >&2
+	if grep -q 'ERR_PNPM_UNSUPPORTED_ENGINE' <<<"$BUILD_OUTPUT"; then
+		echo "       Cause: upstream n8n demands a newer pnpm than the pinned nixpkgs" >&2
+		echo "       ships (engines.pnpm gate). Check the relaxPnpmEngine workaround," >&2
+		echo "       the pnpm major and fetcherVersion in $NIX_FILE." >&2
+	elif grep -q 'ERR_PNPM_LOCKFILE_CONFIG_MISMATCH' <<<"$BUILD_OUTPUT"; then
+		echo "       Cause: the pinned pnpm cannot parse upstream's pnpm-lock.yaml" >&2
+		echo "       anymore (lockfile serialisation changed across pnpm majors)." >&2
+		echo "       Bump the pnpm major and fetcherVersion in $NIX_FILE." >&2
+	else
+		echo "       This usually means fetchPnpmDeps failed for a reason OTHER than" >&2
+		echo "       a hash mismatch (e.g. a pnpm-lock patch in n8n.nix no longer applies," >&2
+		echo "       a tarball vanished, or the build was interrupted). Full output:" >&2
+	fi
 	echo "$BUILD_OUTPUT" >&2
 	echo "Restoring n8n.nix via the EXIT trap." >&2
 	exit 1
@@ -149,6 +187,16 @@ echo "    pnpmDeps hash: $PNPM_HASH"
 #     plain literal substitution is sufficient.
 sed -i "s|$FAKE_HASH|$PNPM_HASH|" "$NIX_FILE"
 
+# 5d. Keep the overlay test expectations (tests/n8n-overlay-test.nix) in sync —
+#     they pin version + both hashes and are evaluated by `nix flake check`.
+if [[ -f "$TEST_FILE" ]]; then
+	sed -i \
+		-e "s|expectedVersion = \"[^\"]*\"|expectedVersion = \"$VERSION\"|" \
+		-e "s|expectedSrcHash = \"sha256-[A-Za-z0-9+/=]*\"|expectedSrcHash = \"$SRC_SRI\"|" \
+		-e "s|expectedPnpmHash = \"sha256-[A-Za-z0-9+/=]*\"|expectedPnpmHash = \"$PNPM_HASH\"|" \
+		"$TEST_FILE"
+fi
+
 # ── 6. Verify the file parses and commit ───────────────────────────────────
 echo "==> Verifying nix evaluation ..."
 if ! nix eval --impure --expr "
@@ -161,9 +209,24 @@ if ! nix eval --impure --expr "
 	exit 1
 fi
 
+# The overlay test pins version + hashes and runs as part of `nix flake check`;
+# make sure its expectations actually match the updated overlay before committing.
+if [[ -f "$TEST_FILE" ]] &&
+	! nix eval --impure --no-warn-dirty --expr "
+  let
+    flake = builtins.getFlake (toString ./.);
+    check = flake.checks.\${builtins.currentSystem}.n8n-overlay or null;
+  in if check == null then null else check.drvPath
+" >/dev/null 2>&1; then
+	echo "ERROR: tests/n8n-overlay-test.nix expectations do not match the updated" >&2
+	echo "       overlay — restoring files via the EXIT trap." >&2
+	exit 1
+fi
+
 if [[ -n "$NIXPKGS_ROOT" ]] &&
-	[[ -n "$(git -C "$NIXPKGS_ROOT" status --porcelain "$NIX_FILE")" ]]; then
+	[[ -n "$(git -C "$NIXPKGS_ROOT" status --porcelain "$NIX_FILE" "$TEST_FILE")" ]]; then
 	git -C "$NIXPKGS_ROOT" add "$NIX_FILE"
+	[[ -f "$TEST_FILE" ]] && git -C "$NIXPKGS_ROOT" add "$TEST_FILE"
 	git -C "$NIXPKGS_ROOT" commit -m "n8n: $CURRENT -> $VERSION"
 	echo "==> Committed"
 fi

pkgs/default.nix

@@ -2,7 +2,6 @@
 #
 # Flake inputs used:
 #   inputs.basecamp  → basecamp (pass-through)
-#   inputs.openspec → openspec (pass-through)
 #   inputs.opencode → opencode-desktop (Electron desktop app, pure pass-through)
 #   inputs.agents   → not used directly here (used by lib/)
 {
@@ -52,7 +51,6 @@ in {
   #   __intentionallyOverridingVersion = true;
   # });
   basecamp = inputs.basecamp.packages.${system}.default;
-  openspec = inputs.openspec.packages.${system}.default;
   opencode-desktop = inputs.opencode.packages.${system}.opencode-desktop;
 
   # buzz: Block's "hive mind" desktop app. Consumed from mulatta/buzz.nix

pkgs/msty-studio/default.nix

@@ -16,7 +16,7 @@
     url = "https://next-assets.msty.studio/app/alpha/linux/MstyStudio_x86_64.AppImage";
     sha256 = "sha256-zJcGK7QEL3ROgVJy13mMdY/437H3Zx8EwSXy7rEhV9w=";
   };
-  appimageContents = appimageTools.extractType2 {inherit pname version src;};
+  appimageContents = appimageTools.extract {inherit pname version src;};
 in
   appimageTools.wrapType2 {
     inherit pname version src;

pkgs/openwork/default.nix

@@ -6,7 +6,7 @@
   stdenvNoCC,
 }: let
   pname = "openwork";
-  version = "0.18.17";
+  version = "0.18.46";
 
   src = fetchurl {
     url =
@@ -16,10 +16,10 @@
     hash =
       if stdenvNoCC.hostPlatform.system == "aarch64-linux"
       then "sha256-ZSoAcOH0/gQynSCY8qCvysaNBnUl/G8Zz66a11y60Qs="
-      else "sha256-FFlR6pEHePuD10GC3SXe2HMO1P7lM1qLVWEf6AJ9IYw=";
+      else "sha256-Ukz163c5VHpphMQa8GHxrq5mFnKmIPv623WUDJ89cqk=";
   };
 
-  appimageContents = appimageTools.extractType2 {inherit pname version src;};
+  appimageContents = appimageTools.extract {inherit pname version src;};
 in
   appimageTools.wrapType2 {
     inherit pname version src;

pkgs/vibetyper/default.nix

@@ -6,14 +6,14 @@
   makeWrapper,
 }: let
   pname = "vibetyper";
-  version = "1.4.1";
+  version = "1.5.1";
   # Upstream publishes to an unversioned URL — ./update.sh watches Last-Modified
   # and refreshes the sha256 when the binary changes. Bump `version` manually.
   src = fetchurl {
     url = "https://cdn.vibetyper.com/releases/linux/VibeTyper.AppImage";
-    sha256 = "sha256-mhXWEKvDgzxJrqIjzUWpfPM8qwKf6YYLsbjqqjtEk5s=";
+    sha256 = "sha256-QEVFCUkcA/qK+1en3oLDGZlNvALLL6ojT+opL9K/PVU=";
   };
-  appimageContents = appimageTools.extractType2 {inherit pname version src;};
+  appimageContents = appimageTools.extract {inherit pname version src;};
 in
   appimageTools.wrapType2 {
     inherit pname version src;

tests/n8n-overlay-test.nix

@@ -15,9 +15,9 @@
   modifiedPkgs = mkPkgs [self.overlays.modifications];
   defaultPkgs = mkPkgs [self.overlays.default];
 
-  expectedVersion = "2.32.6";
-  expectedSrcHash = "sha256-wWm6vGyJ2I2SBU38gRGaZG2FR5FBxH6V/sWQwn5B4Ac=";
-  expectedPnpmHash = "sha256-QzUJCF+VIku9/HrmiUR9FNCU3MlYtyKOILZjFNXvN8U=";
+  expectedVersion = "2.39.6";
+  expectedSrcHash = "sha256-fmo0xL6IF6J+D5ZamkoBXyZ4Q8s3l5MeBWaXc39OsTU=";
+  expectedPnpmHash = "sha256-yL95w+Jd5I5R6r/qNihvAJ4MX2LMyS9ICZzJnLxHR4s=";
   expectedChangelog = "https://github.com/n8n-io/n8n/releases/tag/n8n@${expectedVersion}";
   expectedRootNodeModuleSymlinks = [
     "ln -s .pnpm/node_modules/sass-embedded node_modules/sass-embedded"