vibetyper: 1.5.1 -> 1.5.2

- Refresh AppImage hash (last-modified: Wed, 16 Sep 2026)
- Replace dead VIBE_DISABLE_HYPRLAND_INDICATOR_NO_BLUR env var with
  VIBE_DISABLE_WLROOTS_INDICATOR_RULES (renamed upstream in 1.5.x)
- 1.5.x fixes: multi-monitor Wayland indicator placement (1.3.4),
  stuck Magic Formatter previews (1.3.5)

CHANGELOG.md

@@ -6,24 +6,30 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/).
 ## [Unreleased]
 
 ### Added
+
+- `buzz` / `buzz-desktop` package — Block's "hive mind" desktop app, consumed as a pass-through from the `mulatta/buzz.nix` flake input. The upstream AppImage lacks the sidecars (`buzz-agent`, `buzz-acp`, `buzz-dev-mcp`, `git-credential-nostr`) and the Tauri-specific GStreamer integration needed to actually run, so we consume mulatta's from-source Tauri build instead. Builds entirely from source — no third-party binary cache (deliberate: don't want to trust mulatta's prebuilt artifacts). First build is slow.
 - `opencode-desktop` re-added as a pure pass-through from the `anomalyco/opencode` flake input (Electron app, tracked on `dev`); the input intentionally does not follow nixpkgs so upstream's `node_modules` FOD hashes stay valid
 
 ### Fixed
+
 - `openwork` 0.17.30: upstream renamed desktop/icon assets from `@openworkdesktop.{desktop,png}` to `openwork.{desktop,png}` and dropped the `Icon=`/`--no-sandbox` substitutions that are no longer needed
 
 ### Changed
+
 - Remove duplicate opencode-rules.nix (backward-compat alias preserved)
 - Tool-agnostic naming in coding-rules lib internals
 - Remove redundant overlay entries for non-existent flake inputs
 - Remove redundant 'additions' overlay (identical to 'default')
 
 ### Removed
+
 - Dead overlay entries for non-existent flake inputs
 - Legacy `mkOpencodeRules` alias and `lib.opencode-rules` backward-compat entry (use `mkCodingRules` / `lib.coding-rules`)
 
 ## [0.4.0] - 2026-04-15
 
 ### Added
+
 - Pi-agent wrapper with systemd sandbox and per-host-user policy
 - Containerized Pi agent
 - `lib.agents.nix` with loadCanonical, renderers (OpenCode, Claude Code, Pi), and shellHook
@@ -39,6 +45,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/).
 - Opencode dev shell with mkCodingRules demo
 
 ### Changed
+
 - OpenCode flake input updated through v1.1.65 to v1.3.6
 - Switched from local opencode package to upstream flake input
 - Removed opencode-desktop (awaiting upstream fix), later re-enabled
@@ -46,6 +53,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/).
 - Flake inputs updated throughout
 
 ### Fixed
+
 - Pi settings sync
 - Remove openwork sidecars in preFixup to prevent .opencode-wrapped conflict
 - Remove sidecar binaries from openwork $out/bin to fix buildEnv conflict
@@ -56,6 +64,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/).
 ## [0.3.0] - 2026-02-20
 
 ### Added
+
 - `notesmd-cli` package with flake checks
 - `sidecar` and `td` packages
 - `opencode-desktop` package with Wayland support
@@ -63,12 +72,14 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/).
 - `kestracli` / `kestractl` package (1.0.0 to 1.2.2)
 
 ### Changed
+
 - Nix-update CI workflow optimized with caching and parallel processing
 - Restructured n8n version handling for nix-update compatibility
 - Switched formatter from nixpkgs-fmt to alejandra
 - Replace local opencode with upstream flake input v1.1.27
 
 ### Fixed
+
 - n8n build error
 - n8n pnpm hash
 - n8n update script
@@ -85,6 +96,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/).
 ## [0.2.0] - 2026-01-13
 
 ### Added
+
 - Gitea Actions workflow for automated package updates with nix-update
 - `n8n`, `beads`, and `opencode` packages
 - `stt-ptt` package with auto-language detection
@@ -95,17 +107,20 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/).
 - Port helper library (`lib/ports.nix`)
 
 ### Changed
+
 - Beads updated through v0.49.1
 - N8n updated through v2.8.1
 - Opencode updated through v1.1.18
 - Documentation expanded with comprehensive patterns and HM module docs
 
 ### Fixed
+
 - Python env version fix for marimo
 
 ## [0.1.0] - 2025-10-04
 
 ### Added
+
 - Initial flake setup with packages, overlays, modules, and shells
 - NixOS and Home Manager module infrastructure
 - `lib/` shared utilities

docs/packages/README.md

@@ -20,6 +20,7 @@ These packages are built from source in `pkgs/<name>/`:
 | `launch-webapp` | Launch web applications | Shell | `pkgs/launch-webapp/` |
 | `mem0` | AI memory assistant with vector storage | Python | `pkgs/mem0/` |
 | `msty-studio` | Msty Studio application | Python | `pkgs/msty-studio/` |
+| `buzz` | Hive mind communication platform (desktop app) | Pass-through | `pkgs/default.nix` |
 | `openshell` | AI shell assistant | Go | `pkgs/openshell/` |
 | `openwork` | Open-source Claude Cowork alternative powered by opencode | AppImage | `pkgs/openwork/` |
 | `pomodoro-timer` | Pomodoro timer utility | Shell | `pkgs/pomodoro-timer/` |
@@ -44,6 +45,7 @@ These packages are imported directly from flake inputs with minor modifications:
 | Package | Source | Modification | Location |
 |---------|--------|-------------|----------|
 | `opencode-desktop` | `inputs.opencode` | Electron desktop app (pure pass-through) | `pkgs/default.nix` |
+| `buzz` / `buzz-desktop` | `inputs.buzz` (mulatta/buzz.nix) | From-source Tauri build with sidecars; the upstream AppImage lacks the sidecars + Tauri GStreamer integration. Builds from source without any third-party binary cache — first build is slow (Rust + sherpa-onnx), subsequent builds cached locally | `pkgs/default.nix` |
 
 ## Adding Package Documentation
 

flake.lock

@@ -23,27 +23,49 @@
         ]
       },
       "locked": {
-        "lastModified": 1785348116,
-        "narHash": "sha256-AVycTcomtfvQJ/AHvMg5xu7lVoOzDXxjN+pV7mqUIQ4=",
+        "lastModified": 1785979955,
+        "narHash": "sha256-OP96Ak4OBydR98keoNYKdGY8j+wrIys0LafSZgwS20g=",
         "owner": "basecamp",
         "repo": "basecamp-cli",
-        "rev": "e1059fb123a03295ce6176272e4bbaf43d7971c6",
+        "rev": "61a5591de1da9bc99c56b8072a4d6bad2c9b9e47",
         "type": "github"
       },
       "original": {
         "owner": "basecamp",
-        "ref": "v0.8.0-rc.1",
+        "ref": "v0.9.0",
         "repo": "basecamp-cli",
         "type": "github"
       }
     },
+    "buzz": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "rust-overlay": "rust-overlay",
+        "treefmt-nix": "treefmt-nix"
+      },
+      "locked": {
+        "lastModified": 1788856318,
+        "narHash": "sha256-bOLED82KPrzIXTWELw30y3PVI6MBmlY4Y2F2lwrdOnM=",
+        "owner": "mulatta",
+        "repo": "buzz.nix",
+        "rev": "fdd0152c12c6be339fe01d91887122bb10823aaf",
+        "type": "github"
+      },
+      "original": {
+        "owner": "mulatta",
+        "repo": "buzz.nix",
+        "type": "github"
+      }
+    },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1785318670,
-        "narHash": "sha256-dN6Ou5x/+23FZLEpYP3IffO+NyJFzUlGumt1uu3MMaY=",
+        "lastModified": 1789006805,
+        "narHash": "sha256-xB8mKMOx1IA9vTDNLmJZ6n4wCMq/cuWBBOzGCRnqxrU=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "0954f7ee2f6bb3dc7d4e3d0d8bcb8fd4bde4cfc5",
+        "rev": "8ce4ef6cb6f871616146b9fe26d2a5ae594e94fe",
         "type": "github"
       },
       "original": {
@@ -55,11 +77,11 @@
     },
     "nixpkgs-master": {
       "locked": {
-        "lastModified": 1785386845,
-        "narHash": "sha256-CvXXTgWxbwTn6Diev4nLTP5+8tsFtth/SQAtaR9iVY0=",
+        "lastModified": 1789139724,
+        "narHash": "sha256-QEoQ8xoSO3H2tmwHNBYFL/5Y8Gt10U+bg5ETMsWXiIM=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "3c5a718ce27c9283364d4c664fac4e4a23acdfb4",
+        "rev": "e27e37949736566430ed2f6157bebcdade8860c5",
         "type": "github"
       },
       "original": {
@@ -90,11 +112,11 @@
         "nixpkgs": "nixpkgs_2"
       },
       "locked": {
-        "lastModified": 1785386452,
-        "narHash": "sha256-iYfkMmn1ZKbi0cv8XIAXVgPH4idzsVSK4cWyi/KGMJQ=",
+        "lastModified": 1789132601,
+        "narHash": "sha256-2+j5RuHoqrsnjssZ4VfIfSKzGdrPNFT4nazJ2QxNdu0=",
         "owner": "anomalyco",
         "repo": "opencode",
-        "rev": "f7204902192624481e526b1852cdedaadb914e24",
+        "rev": "95daf90670b7c039c436c85537da5fbfe2205b41",
         "type": "github"
       },
       "original": {
@@ -104,34 +126,56 @@
         "type": "github"
       }
     },
-    "openspec": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1785371113,
-        "narHash": "sha256-r3fwnb5gMTV9UXBj7bqkKpTZIWwF4AgghULOIv2Fr4c=",
-        "owner": "Fission-AI",
-        "repo": "OpenSpec",
-        "rev": "2b3d368539132be6311e55db58899abbf5306b81",
-        "type": "github"
-      },
-      "original": {
-        "owner": "Fission-AI",
-        "repo": "OpenSpec",
-        "type": "github"
-      }
-    },
     "root": {
       "inputs": {
         "agents": "agents",
         "basecamp": "basecamp",
+        "buzz": "buzz",
         "nixpkgs": "nixpkgs",
         "nixpkgs-master": "nixpkgs-master",
-        "opencode": "opencode",
-        "openspec": "openspec"
+        "opencode": "opencode"
+      }
+    },
+    "rust-overlay": {
+      "inputs": {
+        "nixpkgs": [
+          "buzz",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1788591095,
+        "narHash": "sha256-Vh+BeLWfbTT9AecazIsQ/Tkg/RzJeX3lEduANf256WA=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "c361047d3a538f547f1617bb6b410411929ac9cc",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
+      }
+    },
+    "treefmt-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "buzz",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1786901030,
+        "narHash": "sha256-WSFCsDSE5ffgD2MqzkM2CYjeFiKhRF/dJUN8uedb6YE=",
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "rev": "27b3b12a8e6375f28ebe122f07d230ca5459bbfa",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "type": "github"
       }
     }
   },

flake.nix

@@ -6,23 +6,17 @@
     nixpkgs-master.url = "github:NixOS/nixpkgs/master";
 
     basecamp = {
-      url = "github:basecamp/basecamp-cli/v0.8.0-rc.1";
+      url = "github:basecamp/basecamp-cli/v0.9.0";
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
-    # openspec - spec-driven development for AI coding assistants
-    openspec = {
-      url = "github:Fission-AI/OpenSpec";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-
-    # opencode - open-source coding agent; provides the opencode-desktop
-    # Electron app. NOTE: intentionally does NOT follow nixpkgs. Upstream
-    # pins a node_modules fixed-output derivation hash in nix/hashes.json
-    # against its own nixpkgs snapshot; following would risk FOD hash
-    # mismatches. Tracking the `dev` default branch (flake.lock pins the rev).
     opencode.url = "github:anomalyco/opencode/dev";
 
+    buzz = {
+      url = "github:mulatta/buzz.nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
     # Agent definitions and coding rules
     agents = {
       url = "git+https://code.m3ta.dev/m3tam3re/AGENTS";

modules/home-manager/coding/opencode.nix

@@ -15,8 +15,8 @@ in {
       default = {};
       description = ''
         Attributes merged (via recursiveUpdate) on top of the default
-        oh-my-opencode.json. Use this to set provider-specific model
-        assignments per machine.
+        oh-my-openagent.json (the plugin's canonical config file).
+        Use this to set provider-specific model assignments per machine.
       '';
       example = literalExpression ''
         {
@@ -73,7 +73,7 @@ in {
       ];
     };
 
-    home.file.".config/opencode/oh-my-opencode.json".text = builtins.toJSON (
+    home.file.".config/opencode/oh-my-openagent.json".text = builtins.toJSON (
       recursiveUpdate
       {
         "$schema" = "https://raw.githubusercontent.com/code-yeongyu/oh-my-opencode/master/assets/oh-my-opencode.schema.json";

overlays/mods/n8n.nix

@@ -4,24 +4,52 @@
   # regular npm package `@e965/xlsx@0.20.3`, which already carries an integrity
   # field. The old lockfile-integrity workaround is therefore obsolete and has
   # been removed.
+  #
+  # n8n >= 2.37.0 demands pnpm >= 11.22.0 via `engines.pnpm`, but the pinned
+  # nixpkgs only ships pnpm_10 (10.34.5) and pnpm_11 (11.17.0) — both too old.
+  # pnpm enforces that gate for ITSELF regardless of `engine-strict`, so both
+  # fetchPnpmDeps and the main build die with ERR_PNPM_UNSUPPORTED_ENGINE
+  # before any hash mismatch is even reached. Additionally n8n's lockfile,
+  # while still declaring lockfileVersion '9.0', now serialises
+  # patchedDependencies as plain `name@version: hash` scalars (no `path:`
+  # mapping), which pnpm 10 cannot parse (ERR_PNPM_LOCKFILE_CONFIG_MISMATCH).
+  # We therefore build with pnpm_11 + fetcherVersion 4 and relax the engine
+  # gate in package.json. Drop the sed once nixpkgs ships pnpm >= 11.22 and
+  # this overlay's nixpkgs pin has caught up.
+  relaxPnpmEngine = ''
+    sed -i -E 's/"pnpm": *"[^"]*"/"pnpm": "*"/' package.json
+  '';
 in
   prev.n8n.overrideAttrs (finalAttrs: previousAttrs: {
-    version = "2.32.7";
+    version = "2.39.6";
 
     src = prev.fetchFromGitHub {
       owner = "n8n-io";
       repo = "n8n";
       tag = "n8n@${finalAttrs.version}";
-      hash = "sha256-Lyz0k5LD+lVPt5yeNUm08p9x2xqRIqW4AsMp3IGZGdc=";
+      hash = "sha256-fmo0xL6IF6J+D5ZamkoBXyZ4Q8s3l5MeBWaXc39OsTU=";
     };
 
     pnpmDeps = prev.fetchPnpmDeps {
       inherit (finalAttrs) pname version src;
-      pnpm = prev.pnpm_10;
-      fetcherVersion = 3;
-      hash = "sha256-QzUJCF+VIku9/HrmiUR9FNCU3MlYtyKOILZjFNXvN8U=";
+      pnpm = prev.pnpm_11;
+      fetcherVersion = 4;
+      postPatch = relaxPnpmEngine;
+      hash = "sha256-yL95w+Jd5I5R6r/qNihvAJ4MX2LMyS9ICZzJnLxHR4s=";
     };
 
+    postPatch = (previousAttrs.postPatch or "") + relaxPnpmEngine;
+
+    # Swap pnpm_10 -> pnpm_11 from the inherited nativeBuildInputs: upstream
+    # n8n calls pnpm directly during the build (install/build/prune) and pnpm 10
+    # cannot parse the pnpm-11 lockfile. The top-level pnpmConfigHook stays as
+    # is — it discovers the fetcher version from pnpmDeps' .fetcher-version.
+    nativeBuildInputs = builtins.map (x:
+      if (x.outPath or null) == prev.pnpm_10.outPath
+      then prev.pnpm_11
+      else x)
+    previousAttrs.nativeBuildInputs;
+
     preBuild =
       (previousAttrs.preBuild or "")
       + ''

overlays/mods/update.sh

@@ -17,25 +17,52 @@ set -euo pipefail
 #   3. Compare to the version pinned in overlays/mods/n8n.nix
 #   4. Compute new src hash (fetchFromGitHub tarball) via nix-prefetch-url
 #   5. Compute new pnpmDeps hash via the fake-hash trick
-#   6. Commit
+#   6. Sync tests/n8n-overlay-test.nix expectations (version + both hashes)
+#   7. Verify evaluation + test expectations, then commit
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 NIX_FILE="$SCRIPT_DIR/n8n.nix"
+TEST_FILE="$SCRIPT_DIR/../../tests/n8n-overlay-test.nix"
 NIXPKGS_ROOT=$(git -C "$SCRIPT_DIR" rev-parse --show-toplevel 2>/dev/null || true)
 
-# Snapshot the current n8n.nix so we can restore it if anything goes wrong
-# (error, SIGINT, SIGTERM, or a killed build) — otherwise a failed/aborted run
-# leaves a stale version bump and/or the fake-hash sentinel behind. Restoring
-# from the snapshot (rather than `git checkout`) also preserves any
-# pre-existing working-tree edits the user may have made. The trap is disarmed
-# once we reach a successful commit.
+# A literal SRI sentinel (equal to lib.fakeHash). We write the literal rather
+# than `lib.fakeHash` so we don't depend on `lib` being in scope inside
+# n8n.nix — the overlay is imported with just `{ prev = pkgs; }`, so `lib`
+# is not bound there.
+FAKE_HASH='sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA='
+
+if [[ -z "$NIXPKGS_ROOT" ]]; then
+	echo "ERROR: could not locate the git checkout root from $SCRIPT_DIR." >&2
+	echo "       The updater needs the flake context (flake.lock nixpkgs pin)." >&2
+	exit 1
+fi
+
+# The `nix build/eval --expr` calls below resolve `./` against the current
+# working directory, not against this script — always run from the repo root.
+cd "$NIXPKGS_ROOT"
+
+# Snapshot the current n8n.nix (and the test expectations) so we can restore
+# them if anything goes wrong (error, SIGINT, SIGTERM, or a killed build) —
+# otherwise a failed/aborted run leaves a stale version bump and/or the
+# fake-hash sentinel behind. Restoring from the snapshots (rather than
+# `git checkout`) also preserves any pre-existing working-tree edits the user
+# may have made. The trap is disarmed once we reach a successful commit.
 RESTORE_FILE="$(mktemp)"
+TEST_RESTORE_FILE="$(mktemp)"
 cp "$NIX_FILE" "$RESTORE_FILE"
+if [[ -f "$TEST_FILE" ]]; then
+	cp "$TEST_FILE" "$TEST_RESTORE_FILE"
+else
+	: >"$TEST_RESTORE_FILE"
+fi
 restore_on_failure() {
 	if [[ -z "${UPDATE_SUCCEEDED:-}" ]]; then
 		cp -f "$RESTORE_FILE" "$NIX_FILE" 2>/dev/null || true
+		if [[ -s "$TEST_RESTORE_FILE" ]]; then
+			cp -f "$TEST_RESTORE_FILE" "$TEST_FILE" 2>/dev/null || true
+		fi
 	fi
-	rm -f "$RESTORE_FILE"
+	rm -f "$RESTORE_FILE" "$TEST_RESTORE_FILE"
 }
 trap restore_on_failure EXIT
 
@@ -66,6 +93,13 @@ CURRENT=$(awk '
 ' "$NIX_FILE")
 echo "Current version: $CURRENT"
 
+if grep -q "$FAKE_HASH" "$NIX_FILE"; then
+	echo "ERROR: $NIX_FILE already contains the fake-hash sentinel." >&2
+	echo "       A previous update run was interrupted before it could restore." >&2
+	echo "       Fix up the file first (git diff / git checkout -- overlays/mods/n8n.nix)." >&2
+	exit 1
+fi
+
 if [[ "$VERSION" == "$CURRENT" ]]; then
 	echo "Already at latest version, nothing to do."
 	exit 0
@@ -97,12 +131,6 @@ awk -v sri="$SRC_SRI" '
 # ── 5. Compute pnpmDeps hash via the fake-hash trick ───────────────────────
 echo "==> Computing pnpmDeps hash (this may take a while) ..."
 
-# A literal SRI sentinel (equal to lib.fakeHash). We write the literal rather
-# than `lib.fakeHash` so we don't depend on `lib` being in scope inside
-# n8n.nix — the overlay is imported with just `{ prev = pkgs; }`, so `lib`
-# is not bound there.
-FAKE_HASH='sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA='
-
 # 5a. Temporarily set the pnpmDeps hash to the fake sentinel.
 awk -v fake="\"$FAKE_HASH\"" '
   !pnpm_started && /^[[:space:]]*pnpmDeps = / { pnpm_started = 1 }
@@ -134,9 +162,19 @@ PNPM_HASH=$(echo "$BUILD_OUTPUT" |
 
 if [[ -z "$PNPM_HASH" ]]; then
 	echo "ERROR: could not extract a pnpmDeps hash from the build output." >&2
-	echo "       This usually means fetchPnpmDeps failed for a reason OTHER than" >&2
-	echo "       a hash mismatch (e.g. a pnpm-lock patch in n8n.nix no longer applies," >&2
-	echo "       a tarball vanished, or the build was interrupted). Full output:" >&2
+	if grep -q 'ERR_PNPM_UNSUPPORTED_ENGINE' <<<"$BUILD_OUTPUT"; then
+		echo "       Cause: upstream n8n demands a newer pnpm than the pinned nixpkgs" >&2
+		echo "       ships (engines.pnpm gate). Check the relaxPnpmEngine workaround," >&2
+		echo "       the pnpm major and fetcherVersion in $NIX_FILE." >&2
+	elif grep -q 'ERR_PNPM_LOCKFILE_CONFIG_MISMATCH' <<<"$BUILD_OUTPUT"; then
+		echo "       Cause: the pinned pnpm cannot parse upstream's pnpm-lock.yaml" >&2
+		echo "       anymore (lockfile serialisation changed across pnpm majors)." >&2
+		echo "       Bump the pnpm major and fetcherVersion in $NIX_FILE." >&2
+	else
+		echo "       This usually means fetchPnpmDeps failed for a reason OTHER than" >&2
+		echo "       a hash mismatch (e.g. a pnpm-lock patch in n8n.nix no longer applies," >&2
+		echo "       a tarball vanished, or the build was interrupted). Full output:" >&2
+	fi
 	echo "$BUILD_OUTPUT" >&2
 	echo "Restoring n8n.nix via the EXIT trap." >&2
 	exit 1
@@ -149,6 +187,16 @@ echo "    pnpmDeps hash: $PNPM_HASH"
 #     plain literal substitution is sufficient.
 sed -i "s|$FAKE_HASH|$PNPM_HASH|" "$NIX_FILE"
 
+# 5d. Keep the overlay test expectations (tests/n8n-overlay-test.nix) in sync —
+#     they pin version + both hashes and are evaluated by `nix flake check`.
+if [[ -f "$TEST_FILE" ]]; then
+	sed -i \
+		-e "s|expectedVersion = \"[^\"]*\"|expectedVersion = \"$VERSION\"|" \
+		-e "s|expectedSrcHash = \"sha256-[A-Za-z0-9+/=]*\"|expectedSrcHash = \"$SRC_SRI\"|" \
+		-e "s|expectedPnpmHash = \"sha256-[A-Za-z0-9+/=]*\"|expectedPnpmHash = \"$PNPM_HASH\"|" \
+		"$TEST_FILE"
+fi
+
 # ── 6. Verify the file parses and commit ───────────────────────────────────
 echo "==> Verifying nix evaluation ..."
 if ! nix eval --impure --expr "
@@ -161,9 +209,24 @@ if ! nix eval --impure --expr "
 	exit 1
 fi
 
+# The overlay test pins version + hashes and runs as part of `nix flake check`;
+# make sure its expectations actually match the updated overlay before committing.
+if [[ -f "$TEST_FILE" ]] &&
+	! nix eval --impure --no-warn-dirty --expr "
+  let
+    flake = builtins.getFlake (toString ./.);
+    check = flake.checks.\${builtins.currentSystem}.n8n-overlay or null;
+  in if check == null then null else check.drvPath
+" >/dev/null 2>&1; then
+	echo "ERROR: tests/n8n-overlay-test.nix expectations do not match the updated" >&2
+	echo "       overlay — restoring files via the EXIT trap." >&2
+	exit 1
+fi
+
 if [[ -n "$NIXPKGS_ROOT" ]] &&
-	[[ -n "$(git -C "$NIXPKGS_ROOT" status --porcelain "$NIX_FILE")" ]]; then
+	[[ -n "$(git -C "$NIXPKGS_ROOT" status --porcelain "$NIX_FILE" "$TEST_FILE")" ]]; then
 	git -C "$NIXPKGS_ROOT" add "$NIX_FILE"
+	[[ -f "$TEST_FILE" ]] && git -C "$NIXPKGS_ROOT" add "$TEST_FILE"
 	git -C "$NIXPKGS_ROOT" commit -m "n8n: $CURRENT -> $VERSION"
 	echo "==> Committed"
 fi

pkgs/default.nix

@@ -2,7 +2,6 @@
 #
 # Flake inputs used:
 #   inputs.basecamp  → basecamp (pass-through)
-#   inputs.openspec → openspec (pass-through)
 #   inputs.opencode → opencode-desktop (Electron desktop app, pure pass-through)
 #   inputs.agents   → not used directly here (used by lib/)
 {
@@ -44,13 +43,24 @@ in {
   # We override both here so the input builds and reports the rc.1 version.
   # When upstream fixes package.nix (expected for the 0.8.0 final), drop this
   # override back to the plain pass-through.
-  basecamp = inputs.basecamp.packages.${system}.default.overrideAttrs (_: {
-    version = "0.8.0-rc.1";
-    vendorHash = "sha256-m1UF/Ga9C9GJF0JtZMXFOX88chb+f279/aoAaiwfxvg=";
-    # src stays the flake input (lib.cleanSource ./.. pinned by flake.lock to
-    # rc.1) — only the version label that upstream forgot to bump is corrected.
-    __intentionallyOverridingVersion = true;
-  });
-  openspec = inputs.openspec.packages.${system}.default;
+  # basecamp = inputs.basecamp.packages.${system}.default.overrideAttrs (_: {
+  #   version = "0.8.0-rc.1";
+  #   vendorHash = "sha256-m1UF/Ga9C9GJF0JtZMXFOX88chb+f279/aoAaiwfxvg=";
+  #   # src stays the flake input (lib.cleanSource ./.. pinned by flake.lock to
+  #   # rc.1) — only the version label that upstream forgot to bump is corrected.
+  #   __intentionallyOverridingVersion = true;
+  # });
+  basecamp = inputs.basecamp.packages.${system}.default;
   opencode-desktop = inputs.opencode.packages.${system}.opencode-desktop;
+
+  # buzz: Block's "hive mind" desktop app. Consumed from mulatta/buzz.nix
+  # because the upstream AppImage lacks the sidecars + Tauri GStreamer
+  # integration needed to actually run. Exposed under both `buzz-desktop`
+  # (mulatta's name) and `buzz` (the short alias). Builds entirely from
+  # source — no third-party binary cache. First build is slow (Rust + Tauri
+  # + sherpa-onnx); subsequent builds are cached in the local nix store.
+  # Note: mulatta only publishes packages for x86_64-linux, aarch64-linux,
+  # aarch64-darwin — x86_64-darwin will throw at build time.
+  buzz-desktop = inputs.buzz.packages.${system}.buzz-desktop;
+  buzz = inputs.buzz.packages.${system}.buzz-desktop;
 }

pkgs/msty-studio/default.nix

@@ -16,7 +16,7 @@
     url = "https://next-assets.msty.studio/app/alpha/linux/MstyStudio_x86_64.AppImage";
     sha256 = "sha256-zJcGK7QEL3ROgVJy13mMdY/437H3Zx8EwSXy7rEhV9w=";
   };
-  appimageContents = appimageTools.extractType2 {inherit pname version src;};
+  appimageContents = appimageTools.extract {inherit pname version src;};
 in
   appimageTools.wrapType2 {
     inherit pname version src;

pkgs/openwork/default.nix

@@ -6,7 +6,7 @@
   stdenvNoCC,
 }: let
   pname = "openwork";
-  version = "0.18.11";
+  version = "0.18.46";
 
   src = fetchurl {
     url =
@@ -16,10 +16,10 @@
     hash =
       if stdenvNoCC.hostPlatform.system == "aarch64-linux"
       then "sha256-ZSoAcOH0/gQynSCY8qCvysaNBnUl/G8Zz66a11y60Qs="
-      else "sha256-wh2I5Il4f/VruMA2mRskaB7ldcbSan0upon6Y+Vm1Rw=";
+      else "sha256-Ukz163c5VHpphMQa8GHxrq5mFnKmIPv623WUDJ89cqk=";
   };
 
-  appimageContents = appimageTools.extractType2 {inherit pname version src;};
+  appimageContents = appimageTools.extract {inherit pname version src;};
 in
   appimageTools.wrapType2 {
     inherit pname version src;

pkgs/vibetyper/default.nix

@@ -1,4 +1,4 @@
-# last-modified: Fri, 24 Jul 2026 10:50:57 GMT
+# last-modified: Wed, 16 Sep 2026 09:48:47 GMT
 {
   appimageTools,
   fetchurl,
@@ -6,14 +6,14 @@
   makeWrapper,
 }: let
   pname = "vibetyper";
-  version = "1.4.1";
+  version = "1.5.2";
   # Upstream publishes to an unversioned URL — ./update.sh watches Last-Modified
   # and refreshes the sha256 when the binary changes. Bump `version` manually.
   src = fetchurl {
     url = "https://cdn.vibetyper.com/releases/linux/VibeTyper.AppImage";
-    sha256 = "sha256-mhXWEKvDgzxJrqIjzUWpfPM8qwKf6YYLsbjqqjtEk5s=";
+    sha256 = "sha256-rlbpvUcn84fil7aQci/XANcl/x/u6qIM2dmhypwI7mU=";
   };
-  appimageContents = appimageTools.extractType2 {inherit pname version src;};
+  appimageContents = appimageTools.extract {inherit pname version src;};
 in
   appimageTools.wrapType2 {
     inherit pname version src;
@@ -29,7 +29,7 @@ in
       install -m 444 -D ${appimageContents}/vibe-typer.png \
               $out/share/icons/hicolor/512x512/apps/vibe-typer.png
       wrapProgram $out/bin/${pname} \
-              --set VIBE_DISABLE_HYPRLAND_INDICATOR_NO_BLUR 1
+              --set VIBE_DISABLE_WLROOTS_INDICATOR_RULES 1
     '';
 
     passthru.updateScript = ./update.sh;

tests/n8n-overlay-test.nix

@@ -15,9 +15,9 @@
   modifiedPkgs = mkPkgs [self.overlays.modifications];
   defaultPkgs = mkPkgs [self.overlays.default];
 
-  expectedVersion = "2.32.6";
-  expectedSrcHash = "sha256-wWm6vGyJ2I2SBU38gRGaZG2FR5FBxH6V/sWQwn5B4Ac=";
-  expectedPnpmHash = "sha256-QzUJCF+VIku9/HrmiUR9FNCU3MlYtyKOILZjFNXvN8U=";
+  expectedVersion = "2.39.6";
+  expectedSrcHash = "sha256-fmo0xL6IF6J+D5ZamkoBXyZ4Q8s3l5MeBWaXc39OsTU=";
+  expectedPnpmHash = "sha256-yL95w+Jd5I5R6r/qNihvAJ4MX2LMyS9ICZzJnLxHR4s=";
   expectedChangelog = "https://github.com/n8n-io/n8n/releases/tag/n8n@${expectedVersion}";
   expectedRootNodeModuleSymlinks = [
     "ln -s .pnpm/node_modules/sass-embedded node_modules/sass-embedded"