basecamp: 0.7.2 -> 0.8.0-rc.1, vibetyper: 1.4.0 -> 1.4.1

basecamp: bump flake input to github:basecamp/basecamp-cli/v0.8.0-rc.1.
The rc.1 tag ships a stale nix/package.nix whose vendorHash does not
match the tagged go.sum (buildGoModule FOD fails) and whose `version`
was not bumped (still reads 0.7.2). Override both on the pass-through so
the input builds and reports 0.8.0-rc.1. Drop the override back to a
plain pass-through once upstream fixes package.nix for the 0.8.0 final.

vibetyper: 1.4.0 -> 1.4.1 with refreshed AppImage sha256.

.gitea/workflows/nix-update.yml

@@ -352,6 +352,47 @@ jobs:
             done
           fi
 
+          # ── Update overlay modifications (overlays/mods/) ───────────────
+          # Overlay updates live outside pkgs/ because the test suite
+          # (tests/n8n-overlay-test.nix) forbids exporting the overlay target
+          # as a local package. Each `overlays/mods/*/update.sh` or
+          # `overlays/mods/update.sh` is a self-contained updater that handles
+          # version discovery, hash recomputation, and commit on its own.
+          if [ -z "${{ inputs.package }}" ]; then
+            echo ""
+            echo "🔍 Discovering overlay update scripts in overlays/mods/ ..."
+            OVERLAY_SCRIPTS=$(find overlays/mods -maxdepth 2 -name "update.sh" 2>/dev/null | sort)
+
+            if [ -n "$OVERLAY_SCRIPTS" ]; then
+              for script in $OVERLAY_SCRIPTS; do
+                OVERLAY_NAME=$(basename "$(dirname "$script")")
+                echo "::group::Updating overlay: $OVERLAY_NAME"
+                BEFORE_HASH=$(git rev-parse HEAD)
+
+                # Overlay scripts are self-contained and use nix-shell shebangs
+                # for their dependencies. They commit on their own.
+                if bash "$script" 2>&1 | tee /tmp/update-overlay-${OVERLAY_NAME}.log; then
+                  if [ "$(git rev-parse HEAD)" != "$BEFORE_HASH" ]; then
+                    echo "✅ Updated overlay/$OVERLAY_NAME"
+                    UPDATES_FOUND=true
+                    if [ -n "$UPDATED_PACKAGES" ]; then
+                      UPDATED_PACKAGES="$UPDATED_PACKAGES, overlay/$OVERLAY_NAME"
+                    else
+                      UPDATED_PACKAGES="overlay/$OVERLAY_NAME"
+                    fi
+                  else
+                    echo "✓ overlay/$OVERLAY_NAME already up to date"
+                  fi
+                else
+                  echo "⚠️ Update failed for overlay/$OVERLAY_NAME"
+                fi
+                echo "::endgroup::"
+              done
+            else
+              echo "ℹ️ No overlay update scripts found."
+            fi
+          fi
+
           COMMIT_COUNT=$(git rev-list --count origin/master..HEAD)
 
           if [ "$COMMIT_COUNT" -gt 0 ]; then
@@ -382,6 +423,12 @@ jobs:
           SUCCESSFUL_PACKAGES=()
 
           for pkg in "${PKGS[@]}"; do
+            # Overlay updates (e.g. "overlay/n8n") have no top-level flake
+            # attribute — `nix flake check` already verifies them above.
+            if [[ "$pkg" == overlay/* ]]; then
+              echo "⊘ Skipping per-package build for $pkg (verified via flake check)"
+              continue
+            fi
             echo "::group::Building $pkg"
             if nix build .#$pkg 2>&1 | tee /tmp/build-${pkg}.log; then
               echo "✅ Build successful for $pkg"

CHANGELOG.md

@@ -5,6 +5,12 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/).
 
 ## [Unreleased]
 
+### Added
+- `opencode-desktop` re-added as a pure pass-through from the `anomalyco/opencode` flake input (Electron app, tracked on `dev`); the input intentionally does not follow nixpkgs so upstream's `node_modules` FOD hashes stay valid
+
+### Fixed
+- `openwork` 0.17.30: upstream renamed desktop/icon assets from `@openworkdesktop.{desktop,png}` to `openwork.{desktop,png}` and dropped the `Icon=`/`--no-sandbox` substitutions that are no longer needed
+
 ### Changed
 - Remove duplicate opencode-rules.nix (backward-compat alias preserved)
 - Tool-agnostic naming in coding-rules lib internals

docs/packages/README.md

@@ -15,13 +15,11 @@ These packages are built from source in `pkgs/<name>/`:
 | `sidecar` | Companion tool for CLI agents with diffs, file trees, and task management | Go | `pkgs/sidecar/` |
 | `td` | Minimalist CLI for tracking tasks across AI coding sessions | Go | `pkgs/td/` |
 | `code2prompt` | Convert code to prompts | Go | `pkgs/code2prompt/` |
-| `eigent` | Eigenvalue tool | Python | `pkgs/eigent/` |
 | `hyprpaper-random` | Random wallpaper setter for Hyprpaper | Shell | `pkgs/hyprpaper-random/` |
 | `kestractl` | CLI for Kestra workflow orchestration | Go | `pkgs/kestractl/` |
 | `launch-webapp` | Launch web applications | Shell | `pkgs/launch-webapp/` |
 | `mem0` | AI memory assistant with vector storage | Python | `pkgs/mem0/` |
 | `msty-studio` | Msty Studio application | Python | `pkgs/msty-studio/` |
-| `n8n` | Workflow automation tool | Node.js | `pkgs/n8n/` |
 | `openshell` | AI shell assistant | Go | `pkgs/openshell/` |
 | `openwork` | Open-source Claude Cowork alternative powered by opencode | AppImage | `pkgs/openwork/` |
 | `pomodoro-timer` | Pomodoro timer utility | Shell | `pkgs/pomodoro-timer/` |
@@ -31,13 +29,21 @@ These packages are built from source in `pkgs/<name>/`:
 | `vibetyper` | Typing practice tool | Python | `pkgs/vibetyper/` |
 | `zellij-ps` | Project switcher for Zellij | Rust | `pkgs/zellij-ps/` |
 
+### Overlay Modifications
+
+These entries override upstream nixpkgs packages via `overlays.modifications`. They are also included in `overlays.default`.
+
+| Package | Source | Modification | Location |
+|---------|--------|--------------|----------|
+| `n8n` | `nixpkgs#n8n` | Pins a newer release and fetch hashes | `overlays/mods/n8n.nix` |
+
 ### Pass-Through Packages
 
 These packages are imported directly from flake inputs with minor modifications:
 
 | Package | Source | Modification | Location |
 |---------|--------|-------------|----------|
-| `opencode-desktop` | `inputs.opencode` | Tauri desktop wrapper + Wayland fix | `pkgs/opencode-desktop/` |
+| `opencode-desktop` | `inputs.opencode` | Electron desktop app (pure pass-through) | `pkgs/default.nix` |
 
 ## Adding Package Documentation
 

docs/packages/n8n.md

@@ -20,32 +20,24 @@ n8n (pronounced "n-eight-n") is a workflow automation tool that helps you connec
 
 ## Installation
 
+This repository does not publish a standalone `n8n` package. Instead, it provides an overlay that overrides the upstream nixpkgs `n8n` package with a newer pinned release when needed.
+
 ### Via Overlay
 
 ```nix
-{pkgs, ...}: {
+{inputs, pkgs, ...}: {
+  nixpkgs.overlays = [
+    inputs.m3ta-nixpkgs.overlays.default
+    # Or, if you only want package overrides:
+    # inputs.m3ta-nixpkgs.overlays.modifications
+  ];
+
   environment.systemPackages = with pkgs; [
     n8n
   ];
 }
 ```
 
-### Direct Reference
-
-```nix
-{pkgs, ...}: {
-  environment.systemPackages = with pkgs; [
-    inputs.m3ta-nixpkgs.packages.${pkgs.system}.n8n
-  ];
-}
-```
-
-### Run Directly
-
-```bash
-nix run git+https://code.m3ta.dev/m3tam3re/nixpkgs#n8n
-```
-
 ## Usage
 
 ### Basic Usage
@@ -273,7 +265,7 @@ n8n worker
 
 ## Build Information
 
-- **Version**: 2.4.1
+- **Version**: 2.29.8
 - **Language**: TypeScript/JavaScript (Node.js)
 - **Package Manager**: pnpm
 - **License**: Sustainable Use (Fair-Code)

docs/packages/opencode.md

@@ -1,37 +1,56 @@
-# opencode (Deprecated)
+# opencode & opencode-desktop
 
-> **Note**: The `opencode` package has been removed from this repository.
+## opencode (CLI)
 
-## Why was it removed?
+The standalone `opencode` CLI is **not** packaged here. Use the well-maintained
-
+upstream flake instead:
-OpenCode (CLI version) has been removed because there is now a well-maintained upstream repository for AI coding tools:
 
 **[numtide/llm-agents.nix](https://github.com/numtide/llm-agents.nix)**
 
-This repository provides Nix packages for various AI coding agents, including OpenCode and others, with active maintenance and updates.
-
-## What should I use instead?
-
-Use the [llm-agents.nix](https://github.com/numtide/llm-agents.nix) flake directly:
-
 ```nix
 {
-  inputs = {
+  inputs.llm-agents.url = "github:numtide/llm-agents.nix";
-    llm-agents.url = "github:numtide/llm-agents.nix";
-  };
-
-  outputs = { inputs, ... }: {
-    # Access packages via inputs.llm-agents.packages.${system}
-  };
 }
 ```
 
-Or run directly:
-
 ```bash
 nix run github:numtide/llm-agents.nix#opencode
 ```
 
-## What about opencode-desktop?
+## opencode-desktop
 
-The `opencode-desktop` package remains available in this repository as it includes a Wayland support workaround for [upstream issue #11755](https://github.com/opencode-ai/opencode/issues/11755). Once this issue is resolved upstream, `opencode-desktop` may also be removed in favor of the llm-agents.nix repository.
+`opencode-desktop` is provided as a **pure pass-through** from the upstream
+flake input [`anomalyco/opencode`](https://github.com/anomalyco/opencode)
+(tracked on the `dev` branch). It is the official Electron desktop app built
+upstream via `nix/desktop.nix`.
+
+```bash
+nix build git+https://code.m3ta.dev/m3tam3re/nixpkgs#opencode-desktop
+nix run   git+https://code.m3ta.dev/m3tam3re/nixpkgs#opencode-desktop
+```
+
+### How it is wired
+
+- **Flake input** (`flake.nix`):
+
+  ```nix
+  opencode.url = "github:anomalyco/opencode/dev";
+  ```
+
+  It intentionally does **not** follow this repo's `nixpkgs`: upstream pins a
+  `node_modules` fixed-output derivation hash in `nix/hashes.json` against its
+  own nixpkgs snapshot, so following would risk FOD hash mismatches.
+
+- **Registry** (`pkgs/default.nix`):
+
+  ```nix
+  opencode-desktop = inputs.opencode.packages.${system}.opencode-desktop;
+  ```
+
+  No local derivation exists — the package is imported as-is.
+
+### Wayland
+
+The upstream wrapper already passes `--ozone-platform-hint=auto` (plus Wayland
+window decorations and IME flags) when `NIXOS_OZONE_WL` is set, so no local
+Wayland wrapper is required.

flake.lock

@@ -3,11 +3,11 @@
     "agents": {
       "flake": false,
       "locked": {
-        "lastModified": 1780133320,
+        "lastModified": 1783016143,
-        "narHash": "sha256-8AiN9tV9PBb5xblJiPlhumBbKj61qLjzqXXFtkj3vvY=",
+        "narHash": "sha256-3qejDAo4g2XfzTyWCaX8RVKH17JXnw/fujsbXQA+Mzc=",
         "ref": "refs/heads/master",
-        "rev": "920c00313ae242bd93275c30131b9ab1e52ee2fb",
+        "rev": "83284d752d2ac325d4bf3ab7b38acad1c2fffe3a",
-        "revCount": 88,
+        "revCount": 98,
         "type": "git",
         "url": "https://code.m3ta.dev/m3tam3re/AGENTS"
       },
@@ -23,27 +23,27 @@
         ]
       },
       "locked": {
-        "lastModified": 1774505501,
+        "lastModified": 1785348116,
-        "narHash": "sha256-7UiRrDptj7yuEFwToOfdunUMz/i3jRLR7CmMoYQjq6k=",
+        "narHash": "sha256-AVycTcomtfvQJ/AHvMg5xu7lVoOzDXxjN+pV7mqUIQ4=",
         "owner": "basecamp",
         "repo": "basecamp-cli",
-        "rev": "f087e6ef84002503d0dbc75ea1c8c928a8928d9e",
+        "rev": "e1059fb123a03295ce6176272e4bbaf43d7971c6",
         "type": "github"
       },
       "original": {
         "owner": "basecamp",
-        "ref": "v0.7.2",
+        "ref": "v0.8.0-rc.1",
         "repo": "basecamp-cli",
         "type": "github"
       }
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1782467914,
+        "lastModified": 1785318670,
-        "narHash": "sha256-pGvFkM8N0xEkIIXDe5YYfbEAvHrk4IxBrjB/x8OomhE=",
+        "narHash": "sha256-dN6Ou5x/+23FZLEpYP3IffO+NyJFzUlGumt1uu3MMaY=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "e73de5be04e0eff4190a1432b946d469c794e7b4",
+        "rev": "0954f7ee2f6bb3dc7d4e3d0d8bcb8fd4bde4cfc5",
         "type": "github"
       },
       "original": {
@@ -55,11 +55,11 @@
     },
     "nixpkgs-master": {
       "locked": {
-        "lastModified": 1782540244,
+        "lastModified": 1785386845,
-        "narHash": "sha256-3skOZJEfAUG7LSB/Ok2AQUiqeagYLSq+8wKjtS1hOyc=",
+        "narHash": "sha256-CvXXTgWxbwTn6Diev4nLTP5+8tsFtth/SQAtaR9iVY0=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "a65184fc373636356fcaf460dc09655a919c66ea",
+        "rev": "3c5a718ce27c9283364d4c664fac4e4a23acdfb4",
         "type": "github"
       },
       "original": {
@@ -69,6 +69,41 @@
         "type": "github"
       }
     },
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1776683584,
+        "narHash": "sha256-NuTLMrr10Tng72hurYG8jYQ4XKK8wnpJmOGcPiis96g=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "9dd5558b06dbdacbf635a3dd36dce1b1a7ee3a89",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "opencode": {
+      "inputs": {
+        "nixpkgs": "nixpkgs_2"
+      },
+      "locked": {
+        "lastModified": 1785386452,
+        "narHash": "sha256-iYfkMmn1ZKbi0cv8XIAXVgPH4idzsVSK4cWyi/KGMJQ=",
+        "owner": "anomalyco",
+        "repo": "opencode",
+        "rev": "f7204902192624481e526b1852cdedaadb914e24",
+        "type": "github"
+      },
+      "original": {
+        "owner": "anomalyco",
+        "ref": "dev",
+        "repo": "opencode",
+        "type": "github"
+      }
+    },
     "openspec": {
       "inputs": {
         "nixpkgs": [
@@ -76,11 +111,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1782291243,
+        "lastModified": 1785371113,
-        "narHash": "sha256-0pVn5pDqlKpqSgzf4eG9TFCjkjzOtnmGTpbILso7GwI=",
+        "narHash": "sha256-r3fwnb5gMTV9UXBj7bqkKpTZIWwF4AgghULOIv2Fr4c=",
         "owner": "Fission-AI",
         "repo": "OpenSpec",
-        "rev": "737518b36fe4b6fdb09c83eeaf8d873a428c92e6",
+        "rev": "2b3d368539132be6311e55db58899abbf5306b81",
         "type": "github"
       },
       "original": {
@@ -95,6 +130,7 @@
         "basecamp": "basecamp",
         "nixpkgs": "nixpkgs",
         "nixpkgs-master": "nixpkgs-master",
+        "opencode": "opencode",
         "openspec": "openspec"
       }
     }

flake.nix

@@ -6,7 +6,7 @@
     nixpkgs-master.url = "github:NixOS/nixpkgs/master";
 
     basecamp = {
-      url = "github:basecamp/basecamp-cli/v0.7.2";
+      url = "github:basecamp/basecamp-cli/v0.8.0-rc.1";
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
@@ -16,6 +16,13 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
+    # opencode - open-source coding agent; provides the opencode-desktop
+    # Electron app. NOTE: intentionally does NOT follow nixpkgs. Upstream
+    # pins a node_modules fixed-output derivation hash in nix/hashes.json
+    # against its own nixpkgs snapshot; following would risk FOD hash
+    # mismatches. Tracking the `dev` default branch (flake.lock pins the rev).
+    opencode.url = "github:anomalyco/opencode/dev";
+
     # Agent definitions and coding rules
     agents = {
       url = "git+https://code.m3ta.dev/m3tam3re/AGENTS";
@@ -48,16 +55,7 @@
       import ./pkgs {inherit pkgs inputs;});
 
     # Overlays - can be imported in your system configuration
-    overlays = {
+    overlays = import ./overlays {inherit inputs;};
-      # Default overlay: adds all custom packages
-      default = final: prev:
-        import ./pkgs {
-          pkgs = final;
-          inputs = inputs;
-        };
-
-      modifications = final: prev: import ./overlays/mods {inherit prev;};
-    };
 
     # NixOS modules - for system-level configuration
     nixosModules = {
@@ -104,6 +102,9 @@
           ${pkgs.alejandra}/bin/alejandra --check ${./.}
           touch $out
         '';
+        n8n-overlay = import ./tests/n8n-overlay-test.nix {
+          inherit pkgs inputs self;
+        };
         # Lib unit tests
         lib-agents = import ./tests/lib/agents-test.nix {
           inherit pkgs;

overlays/default.nix

@@ -0,0 +1,16 @@
+{inputs, ...}: let
+  # Package modifications for upstream nixpkgs packages.
+  modifications = final: prev: {
+    n8n = import ./mods/n8n.nix {inherit prev;};
+  };
+in {
+  # Default overlay: adds all custom packages and applies package modifications.
+  default = final: prev:
+    import ../pkgs {
+      pkgs = final;
+      inherit inputs;
+    }
+    // (modifications final prev);
+
+  inherit modifications;
+}

overlays/mods/default.nix

@@ -1,7 +0,0 @@
-{prev}: {
-  # Package modifications
-  # This overlay contains package overrides and modifications
-
-  # Add more modifications here as needed
-  # example-package = prev.example-package.override { ... };
-}

overlays/mods/n8n.nix

@@ -0,0 +1,46 @@
+{prev}: let
+  # n8n >= 2.32 replaced the sheetjs-CDN `xlsx@0.20.2` tarball (which lacked an
+  # integrity checksum and had to be patched into pnpm-lock.yaml) with the
+  # regular npm package `@e965/xlsx@0.20.3`, which already carries an integrity
+  # field. The old lockfile-integrity workaround is therefore obsolete and has
+  # been removed.
+in
+  prev.n8n.overrideAttrs (finalAttrs: previousAttrs: {
+    version = "2.32.7";
+
+    src = prev.fetchFromGitHub {
+      owner = "n8n-io";
+      repo = "n8n";
+      tag = "n8n@${finalAttrs.version}";
+      hash = "sha256-Lyz0k5LD+lVPt5yeNUm08p9x2xqRIqW4AsMp3IGZGdc=";
+    };
+
+    pnpmDeps = prev.fetchPnpmDeps {
+      inherit (finalAttrs) pname version src;
+      pnpm = prev.pnpm_10;
+      fetcherVersion = 3;
+      hash = "sha256-QzUJCF+VIku9/HrmiUR9FNCU3MlYtyKOILZjFNXvN8U=";
+    };
+
+    preBuild =
+      (previousAttrs.preBuild or "")
+      + ''
+        if [ ! -e node_modules/sass-embedded ] && [ -e node_modules/.pnpm/node_modules/sass-embedded ]; then
+          ln -s .pnpm/node_modules/sass-embedded node_modules/sass-embedded
+        fi
+        if [ ! -e node_modules/sqlite3 ] && [ -e node_modules/.pnpm/node_modules/sqlite3 ]; then
+          ln -s .pnpm/node_modules/sqlite3 node_modules/sqlite3
+        fi
+      '';
+
+    # Self-contained update script (./update.sh) — fetches latest stable
+    # release from n8n-io/n8n, recomputes both src and pnpmDeps hashes.
+    # The CI workflow in .gitea/workflows/nix-update.yml discovers and runs it.
+    passthru = (previousAttrs.passthru or {}) // {updateScript = ./update.sh;};
+
+    meta =
+      previousAttrs.meta
+      // {
+        changelog = "https://github.com/n8n-io/n8n/releases/tag/n8n@${finalAttrs.version}";
+      };
+  })

overlays/mods/update.sh

@@ -0,0 +1,172 @@
+#!/usr/bin/env nix-shell
+#!nix-shell --pure -i bash -p bash curl jq nix nix-prefetch cacert git
+# shellcheck shell=bash
+set -euo pipefail
+
+# Update the n8n overlay (overlays/mods/n8n.nix) to the latest stable GitHub
+# release of n8n-io/n8n.
+#
+# This is a self-contained updater (not nix-update), because the overlay file
+# is a `prev.n8n.overrideAttrs` form rather than a standalone derivation and
+# the test suite (tests/n8n-overlay-test.nix) explicitly forbids exporting a
+# local n8n package. The CI workflow discovers and runs this script directly.
+#
+# What it does, in order:
+#   1. Fetch latest stable (non-prerelease) tag from the GitHub API
+#   2. Strip the `n8n@` prefix → version
+#   3. Compare to the version pinned in overlays/mods/n8n.nix
+#   4. Compute new src hash (fetchFromGitHub tarball) via nix-prefetch-url
+#   5. Compute new pnpmDeps hash via the fake-hash trick
+#   6. Commit
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+NIX_FILE="$SCRIPT_DIR/n8n.nix"
+NIXPKGS_ROOT=$(git -C "$SCRIPT_DIR" rev-parse --show-toplevel 2>/dev/null || true)
+
+# Snapshot the current n8n.nix so we can restore it if anything goes wrong
+# (error, SIGINT, SIGTERM, or a killed build) — otherwise a failed/aborted run
+# leaves a stale version bump and/or the fake-hash sentinel behind. Restoring
+# from the snapshot (rather than `git checkout`) also preserves any
+# pre-existing working-tree edits the user may have made. The trap is disarmed
+# once we reach a successful commit.
+RESTORE_FILE="$(mktemp)"
+cp "$NIX_FILE" "$RESTORE_FILE"
+restore_on_failure() {
+	if [[ -z "${UPDATE_SUCCEEDED:-}" ]]; then
+		cp -f "$RESTORE_FILE" "$NIX_FILE" 2>/dev/null || true
+	fi
+	rm -f "$RESTORE_FILE"
+}
+trap restore_on_failure EXIT
+
+REPO="n8n-io/n8n"
+TAG_PREFIX="n8n@"
+
+# ── 1. Latest stable release ───────────────────────────────────────────────
+echo "Fetching latest stable release of $REPO ..."
+LATEST_TAG=$(curl -fsSL "https://api.github.com/repos/$REPO/releases/latest" |
+	jq -r 'select(.prerelease == false) | .tag_name')
+
+if [[ -z "$LATEST_TAG" ]]; then
+	echo "ERROR: No stable release found for $REPO" >&2
+	exit 1
+fi
+
+VERSION="${LATEST_TAG#"${TAG_PREFIX}"}"
+echo "Latest version: $VERSION"
+
+# ── 2. Current version from the nix file ───────────────────────────────────
+CURRENT=$(awk '
+  /^[[:space:]]*version = "/ {
+    gsub(/^[[:space:]]*version = "/, "")
+    gsub(/".*/, "")
+    print
+    exit
+  }
+' "$NIX_FILE")
+echo "Current version: $CURRENT"
+
+if [[ "$VERSION" == "$CURRENT" ]]; then
+	echo "Already at latest version, nothing to do."
+	exit 0
+fi
+
+echo "==> Updating n8n $CURRENT -> $VERSION"
+
+# ── 3. Bump version in the file ────────────────────────────────────────────
+sed -i "s|^\([[:space:]]*\)version = \"[^\"]*\";|\1version = \"$VERSION\";|" "$NIX_FILE"
+
+# ── 4. Compute and apply src hash ──────────────────────────────────────────
+echo "==> Computing src hash ..."
+SRC_URL="https://github.com/$REPO/archive/refs/tags/${TAG_PREFIX}${VERSION}.tar.gz"
+# `--name n8n-source` works around the `@` in the upstream tag name
+# (nix-prefetch-url refuses filenames containing `@`).
+SRC_HASH=$(nix-prefetch-url --unpack --type sha256 --name n8n-source "$SRC_URL" 2>/dev/null)
+SRC_SRI=$(nix hash convert --hash-algo sha256 --to sri "$SRC_HASH")
+echo "    src hash: $SRC_SRI"
+
+# Replace the FIRST `hash = "sha256-...";` occurrence (the src block sits above pnpmDeps)
+awk -v sri="$SRC_SRI" '
+  !src_done && /^[[:space:]]*hash = "sha256-/ {
+    sub(/"sha256-[A-Za-z0-9+/=]+"/, "\"" sri "\"")
+    src_done = 1
+  }
+  { print }
+' "$NIX_FILE" >"$NIX_FILE.tmp" && mv "$NIX_FILE.tmp" "$NIX_FILE"
+
+# ── 5. Compute pnpmDeps hash via the fake-hash trick ───────────────────────
+echo "==> Computing pnpmDeps hash (this may take a while) ..."
+
+# A literal SRI sentinel (equal to lib.fakeHash). We write the literal rather
+# than `lib.fakeHash` so we don't depend on `lib` being in scope inside
+# n8n.nix — the overlay is imported with just `{ prev = pkgs; }`, so `lib`
+# is not bound there.
+FAKE_HASH='sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA='
+
+# 5a. Temporarily set the pnpmDeps hash to the fake sentinel.
+awk -v fake="\"$FAKE_HASH\"" '
+  !pnpm_started && /^[[:space:]]*pnpmDeps = / { pnpm_started = 1 }
+  pnpm_started && !pnpm_done && /^[[:space:]]*hash = "sha256-/ {
+    sub(/"sha256-[A-Za-z0-9+/=]+"/, fake)
+    pnpm_done = 1
+  }
+  { print }
+' "$NIX_FILE" >"$NIX_FILE.tmp" && mv "$NIX_FILE.tmp" "$NIX_FILE"
+
+# 5b. Evaluate n8nModified.pnpmDeps — fixed-output derivation with a wrong hash
+#     will fail and print the correct hash in the "got:" line.
+NIX_EXPR="(let
+    flake = builtins.getFlake (toString ./.);
+    pkgs = flake.inputs.nixpkgs.legacyPackages.\${builtins.currentSystem};
+    n8nModified = import ./overlays/mods/n8n.nix { prev = pkgs; };
+  in n8nModified.pnpmDeps)"
+
+BUILD_OUTPUT=$(nix build --impure --no-link --expr "$NIX_EXPR" 2>&1 || true)
+
+# Hash mismatch errors list two sha256 values: the fake sentinel (all A's) as
+# "specified"/"Expected" and the correct one as "got:"/"Got:". Different nix
+# versions label/capitalise differently, so filter out the sentinel and take
+# whatever real sha256 remains.
+PNPM_HASH=$(echo "$BUILD_OUTPUT" |
+	grep -oE 'sha256-[A-Za-z0-9+/=]+' |
+	grep -v 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA' |
+	tail -1)
+
+if [[ -z "$PNPM_HASH" ]]; then
+	echo "ERROR: could not extract a pnpmDeps hash from the build output." >&2
+	echo "       This usually means fetchPnpmDeps failed for a reason OTHER than" >&2
+	echo "       a hash mismatch (e.g. a pnpm-lock patch in n8n.nix no longer applies," >&2
+	echo "       a tarball vanished, or the build was interrupted). Full output:" >&2
+	echo "$BUILD_OUTPUT" >&2
+	echo "Restoring n8n.nix via the EXIT trap." >&2
+	exit 1
+fi
+
+echo "    pnpmDeps hash: $PNPM_HASH"
+
+# 5c. Replace the fake sentinel with the real hash. The sentinel only appears
+#     in the pnpmDeps block (the src hash was already updated in step 4), so a
+#     plain literal substitution is sufficient.
+sed -i "s|$FAKE_HASH|$PNPM_HASH|" "$NIX_FILE"
+
+# ── 6. Verify the file parses and commit ───────────────────────────────────
+echo "==> Verifying nix evaluation ..."
+if ! nix eval --impure --expr "
+  let
+    flake = builtins.getFlake (toString ./.);
+    pkgs = flake.inputs.nixpkgs.legacyPackages.\${builtins.currentSystem};
+  in (import ./overlays/mods/n8n.nix { prev = pkgs; }).version
+" >/dev/null 2>&1; then
+	echo "ERROR: nix evaluation failed after update; restoring n8n.nix via the EXIT trap." >&2
+	exit 1
+fi
+
+if [[ -n "$NIXPKGS_ROOT" ]] &&
+	[[ -n "$(git -C "$NIXPKGS_ROOT" status --porcelain "$NIX_FILE")" ]]; then
+	git -C "$NIXPKGS_ROOT" add "$NIX_FILE"
+	git -C "$NIXPKGS_ROOT" commit -m "n8n: $CURRENT -> $VERSION"
+	echo "==> Committed"
+fi
+
+UPDATE_SUCCEEDED=1
+echo "==> Done"

pkgs/crunch/README.md

@@ -0,0 +1,130 @@
+# crunch
+
+Voice-notified reminders and AI crunch jobs via systemd transient timers. Schedules tasks that fire through `talk` (ElevenLabs TTS) — no NixOS rebuild needed, survives reboots.
+
+## Usage
+
+### Simple voice reminders
+
+```bash
+crunch at "14:30" "Müll rausbringen"
+crunch at "2026-07-03 10:00" "Zahnarzttermin"
+crunch in "30m" "Build checken"
+crunch daily "09:00" "Daily standup"
+crunch weekly "Mon 09:00" "Weekly review"
+crunch weekly "Montag 09:00" "Weekly review"    # German day names
+```
+
+### AI crunch jobs
+
+Runs a prompt through `pi` or `opencode` in print mode, pipes result to `talk`:
+
+```bash
+crunch ai pi in "1h" "Fasse die neuesten Commits zusammen"
+crunch ai opencode daily "08:00" "Review offene Issues und gib 3 Key-Points"
+crunch ai pi weekly "Mon 09:00" "Generiere Weekly Summary aus git log"
+```
+
+### Custom script jobs
+
+Runs any shell script on schedule. Script stdout → `talk`:
+
+```bash
+crunch script daily "08:00" ~/scripts/basecamp-daily.sh
+crunch script in "2h" ~/scripts/deploy-check.sh -- --verbose
+crunch script weekly "Mon 09:00" ~/scripts/weekly-report.sh
+```
+
+Example script:
+
+```bash
+#!/usr/bin/env bash
+# ~/scripts/basecamp-daily.sh
+TODOS=$(basecamp todos --today 2>/dev/null) || exit 0
+echo "$TODOS" | pi -p "Erstelle Summary als ~/reports/daily.md. Antworte mit Top 3."
+```
+
+### Management
+
+```bash
+crunch list                          # List active jobs
+crunch cancel crunch-mll-rausbringen-12345   # Cancel a job
+crunch purge                         # Remove fired one-shot jobs
+```
+
+## Command Reference
+
+```
+crunch at <time> <message>                    One-shot (14:30 or "2026-07-03 14:30")
+crunch in <duration> <message>                One-shot after delay (30m, 2h, 1h30m)
+crunch daily <time> <message>                 Recurring daily
+crunch weekly <day> <time> <message>          Recurring weekly (Mon/Montag)
+crunch ai <engine> <type> <time> <prompt>     AI crunch (pi|opencode)
+crunch script <type> <time> <script.sh> [args]  Custom script → talk
+crunch list                                    List active jobs
+crunch cancel <name>                           Cancel a job
+crunch purge                                   Remove fired one-shot jobs
+```
+
+## Day Names
+
+Supports English and German:
+
+| English | German | systemd |
+|---|---|---|
+| Mon, Monday | Mo, Montag | Mon |
+| Tue, Tuesday | Di, Dienstag | Tue |
+| Wed, Wednesday | Mi, Mittwoch | Wed |
+| Thu, Thursday | Do, Donnerstag | Thu |
+| Fri, Friday | Fr, Freitag | Fri |
+| Sat, Saturday | Sa, Samstag | Sat |
+| Sun, Sunday | So, Sonntag | Sun |
+
+## Environment Variables
+
+| Variable | Required | Default | Description |
+|---|---|---|---|
+| `ELEVENLABS_API_KEY` | ✅ | — | Required by `talk` |
+| `VOICE_NOTIFY` | ❌ | `1` | `0` silences talk globally |
+| `TALK` | ❌ | `talk` | Override path to talk binary |
+
+## How It Works
+
+```
+┌─────────────────────────────────────────────┐
+│  systemd --user transient timer fires       │
+│                                             │
+│  crunch _say "message"                      │
+│    └─ talk "message"  (TTS via ElevenLabs)  │
+│                                             │
+│  crunch _ai pi "prompt"                     │
+│    └─ pi -p "prompt" | talk  (AI → TTS)    │
+│                                             │
+│  crunch _script ~/script.sh                 │
+│    └─ bash ~/script.sh | talk  (pipe → TTS)│
+└─────────────────────────────────────────────┘
+```
+
+Uses `systemd-run --user` to create transient `.timer` + `.service` units. No NixOS rebuild needed — jobs are created and managed at runtime.
+
+## Prerequisites
+
+- `talk` package installed and in PATH
+- `pi` and/or `opencode` for AI crunch mode
+- `loginctl enable-linger <username>` — **critical** for timers to fire when logged out
+- `ELEVENLABS_API_KEY` in environment (or agenix secrets)
+
+## NixOS Installation
+
+```nix
+# home-manager
+home.packages = [ pkgs.m3ta.crunch pkgs.m3ta.talk ];
+```
+
+Verify lingering is enabled:
+
+```bash
+loginctl show-user $(whoami) | grep Linger=yes
+# If not:
+sudo loginctl enable-linger $(whoami)
+```

pkgs/crunch/default.nix

@@ -32,6 +32,7 @@
       crunch daily <time> <message>           Recurring daily at time
       crunch weekly <day> <time> <message>    Recurring weekly (Mon or Montag)
       crunch ai <engine> <type> <time> <prompt>  AI crunch (pi|opencode)
+      crunch script <type> <time> <script.sh> [args]  Custom script → talk
       crunch list                              List active jobs
       crunch cancel <name>                     Cancel a job
       crunch purge                             Remove fired one-shot jobs
@@ -45,6 +46,7 @@
       crunch weekly "Montag 09:00" "Weekly review"
       crunch ai pi in "1h" "Fasse neueste Commits zusammen"
       crunch ai opencode daily "08:00" "Review offene Issues"
+      crunch script daily "08:00" ~/scripts/basecamp-daily.sh
       crunch list
       crunch cancel mll-rausbringen-12345
 
@@ -146,6 +148,15 @@
         esac
         exit $?
         ;;
+      _script)
+        script_path="$2"; shift 2
+        rc=0
+        output=$(bash "$script_path" "$@" 2>&1) || rc=$?
+        if [ -n "''${output:-}" ]; then
+          printf '%s' "$output" | "$TALK"
+        fi
+        exit "$rc"
+        ;;
     esac
 
     # ── CLI ───────────────────────────────────────────────────────
@@ -198,6 +209,20 @@
           "$SELF _ai $engine $(printf '%q' "$prompt")" "$name"
         ;;
 
+      # ── Custom script crunch jobs ──
+      script)
+        [ $# -lt 3 ] && { echo "Usage: crunch script <at|in|daily|weekly> <time> <script.sh> [args...]" >&2; exit 1; }
+        sub_type="$1"; time_spec="$2"; script_path="$3"; shift 3
+        script_path="$(readlink -f "$script_path")"
+        [ ! -f "$script_path" ] && { echo "Script not found: $script_path" >&2; exit 1; }
+        name="$(make_name "$(basename "$script_path" .sh)")"
+        exec_cmd="$SELF _script $(printf '%q' "$script_path")"
+        if [ $# -gt 0 ]; then
+          exec_cmd+=" $(printf '%q ' "$@")"
+        fi
+        schedule "$sub_type" "$time_spec" "$exec_cmd" "$name"
+        ;;
+
       # ── Management ──
       list)
         echo "Active crunch jobs:"

pkgs/default.nix

@@ -3,7 +3,7 @@
 # Flake inputs used:
 #   inputs.basecamp  → basecamp (pass-through)
 #   inputs.openspec → openspec (pass-through)
-#   inputs.opencode → opencode-desktop (build inputs + patches)
+#   inputs.opencode → opencode-desktop (Electron desktop app, pure pass-through)
 #   inputs.agents   → not used directly here (used by lib/)
 {
   pkgs,
@@ -18,12 +18,10 @@ in {
 
   sidecar = pkgs.callPackage ./sidecar {};
   td = pkgs.callPackage ./td {};
-  eigent = pkgs.callPackage ./eigent {};
   hyprpaper-random = pkgs.callPackage ./hyprpaper-random {};
   launch-webapp = pkgs.callPackage ./launch-webapp {};
   mem0 = pkgs.callPackage ./mem0 {};
   msty-studio = pkgs.callPackage ./msty-studio {};
-  n8n = pkgs.callPackage ./n8n {};
   pomodoro-timer = pkgs.callPackage ./pomodoro-timer {};
   rofi-project-opener = pkgs.callPackage ./rofi-project-opener {};
   stt-ptt = pkgs.callPackage ./stt-ptt {};
@@ -39,6 +37,20 @@ in {
   # ── Pass-through packages ──────────────────────────────────────────
   # Imported directly from flake inputs. No local modifications.
 
-  basecamp = inputs.basecamp.packages.${system}.default;
+  # basecamp: tracked at github:basecamp/basecamp-cli/v0.8.0-rc.1.
+  # The rc.1 tag ships a stale nix/package.nix:
+  #   - vendorHash does not match the tagged go.sum (buildGoModule FOD fails)
+  #   - `version` was not bumped and still reads "0.7.2"
+  # We override both here so the input builds and reports the rc.1 version.
+  # When upstream fixes package.nix (expected for the 0.8.0 final), drop this
+  # override back to the plain pass-through.
+  basecamp = inputs.basecamp.packages.${system}.default.overrideAttrs (_: {
+    version = "0.8.0-rc.1";
+    vendorHash = "sha256-m1UF/Ga9C9GJF0JtZMXFOX88chb+f279/aoAaiwfxvg=";
+    # src stays the flake input (lib.cleanSource ./.. pinned by flake.lock to
+    # rc.1) — only the version label that upstream forgot to bump is corrected.
+    __intentionallyOverridingVersion = true;
+  });
   openspec = inputs.openspec.packages.${system}.default;
+  opencode-desktop = inputs.opencode.packages.${system}.opencode-desktop;
 }

pkgs/msty-studio/default.nix

@@ -1,3 +1,4 @@
+# last-modified: Wed, 24 Sep 2025 00:17:41 GMT
 {
   appimageTools,
   fetchurl,
@@ -9,6 +10,8 @@
 }: let
   pname = "msty-studio";
   version = "2.0.0-beta.4";
+  # Upstream publishes to an unversioned URL — ./update.sh watches Last-Modified
+  # and refreshes the sha256 when the binary changes. Bump `version` manually.
   src = fetchurl {
     url = "https://next-assets.msty.studio/app/alpha/linux/MstyStudio_x86_64.AppImage";
     sha256 = "sha256-zJcGK7QEL3ROgVJy13mMdY/437H3Zx8EwSXy7rEhV9w=";
@@ -34,6 +37,8 @@ in
               wrapProgram $out/bin/${pname} \
                       --prefix PATH : ${nodejs}/bin:${uv}/bin:${python3}/bin
     '';
+    passthru.updateScript = ./update.sh;
+
     meta = {
       description = "Msty Studio enables advanced, privacy‑preserving AI workflows entirely on your local machine.";
       license = lib.licenses.unfree;

pkgs/msty-studio/update.sh

@@ -0,0 +1,62 @@
+#!/usr/bin/env nix-shell
+#!nix-shell --pure -i bash -p bash curl nix nix-prefetch cacert git
+set -euo pipefail
+
+# Update msty-studio AppImage hash.
+#
+# Upstream publishes to an unversioned URL (MstyStudio_x86_64.AppImage) — no
+# version-pinned URL and no usable GitHub release. To still catch updates, we:
+#   1. HEAD the URL and read the Last-Modified header
+#   2. Compare to the value stored as a `# last-modified:` comment in default.nix
+#   3. If changed: re-download, compute sha256, update hash + comment, commit
+#
+# The version attribute stays static (manual bump) — only the binary hash is
+# refreshed automatically.
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+NIX_FILE="$SCRIPT_DIR/default.nix"
+URL="https://next-assets.msty.studio/app/alpha/linux/MstyStudio_x86_64.AppImage"
+
+echo "Checking $URL ..."
+HEADERS=$(curl -fsSIL "$URL")
+NEW_LAST_MODIFIED=$(echo "$HEADERS" | tr -d '\r' \
+  | awk -F': ' 'tolower($1)=="last-modified" {print $2; exit}')
+
+if [[ -z "$NEW_LAST_MODIFIED" ]]; then
+  echo "ERROR: Could not read Last-Modified header from $URL" >&2
+  exit 1
+fi
+
+CURRENT_LAST_MODIFIED=$(awk -F': ' '/^# last-modified:/ {sub(/^# last-modified: /, ""); print; exit}' "$NIX_FILE")
+
+echo "Current: ${CURRENT_LAST_MODIFIED:-<none>}"
+echo "Latest:  $NEW_LAST_MODIFIED"
+
+if [[ "$NEW_LAST_MODIFIED" == "$CURRENT_LAST_MODIFIED" ]]; then
+  echo "No change, nothing to do."
+  exit 0
+fi
+
+echo "==> Content changed, refreshing hash..."
+
+HASH=$(nix-prefetch-url --type sha256 "$URL" 2>/dev/null)
+SRI=$(nix hash convert --hash-algo sha256 --to sri "$HASH")
+echo "New sha256: $SRI"
+
+sed -i "s|^\([[:space:]]*\)sha256 = \"[^\"]*\";|\1sha256 = \"$SRI\";|" "$NIX_FILE"
+
+if grep -q '^# last-modified:' "$NIX_FILE"; then
+  sed -i "s|^# last-modified:.*|# last-modified: $NEW_LAST_MODIFIED|" "$NIX_FILE"
+else
+  sed -i "1i # last-modified: $NEW_LAST_MODIFIED" "$NIX_FILE"
+fi
+
+echo "Updated $NIX_FILE"
+
+NIXPKGS_ROOT=$(git -C "$SCRIPT_DIR" rev-parse --show-toplevel 2>/dev/null || true)
+if [[ -n "$NIXPKGS_ROOT" ]] && \
+   [[ -n "$(git -C "$NIXPKGS_ROOT" status --porcelain "$NIX_FILE")" ]]; then
+  git -C "$NIXPKGS_ROOT" add "$NIX_FILE"
+  git -C "$NIXPKGS_ROOT" commit -m "msty-studio: refresh AppImage ($NEW_LAST_MODIFIED)"
+  echo "==> Committed"
+fi

pkgs/n8n/default.nix

@@ -1,163 +0,0 @@
-{
-  stdenv,
-  lib,
-  nixosTests,
-  fetchFromGitHub,
-  nodejs,
-  pnpm_10,
-  fetchPnpmDeps,
-  pnpmConfigHook,
-  python3,
-  node-gyp,
-  cctools,
-  xcbuild,
-  dart-sass,
-  libkrb5,
-  libmongocrypt,
-  libpq,
-  makeWrapper,
-}: let
-  python = python3.withPackages (
-    ps:
-      with ps; [
-        websockets
-      ]
-  );
-in
-  stdenv.mkDerivation (finalAttrs: {
-    pname = "n8n";
-    version = "2.29.2";
-
-    src = fetchFromGitHub {
-      owner = "n8n-io";
-      repo = "n8n";
-      tag = "n8n@${finalAttrs.version}";
-      hash = "sha256-1Q6bYSSC1962Ec4zH5kT9faivZZ4pLdFtompsB7fTyk=";
-    };
-
-    pnpmDeps = fetchPnpmDeps {
-      inherit (finalAttrs) pname version src;
-      pnpm = pnpm_10;
-      fetcherVersion = 3;
-      hash = "sha256-uta5AP51sL6fB2BOgFtB8PS1zoXFrxEGcFd3vEBy0+U=";
-    };
-
-    nativeBuildInputs =
-      [
-        pnpmConfigHook
-        pnpm_10
-        python3 # required to build sqlite3 bindings
-        node-gyp # required to build sqlite3 bindings
-        makeWrapper
-      ]
-      ++ lib.optional stdenv.hostPlatform.isDarwin [
-        cctools
-        xcbuild
-      ];
-
-    buildInputs = [
-      nodejs
-      libkrb5
-      libmongocrypt
-      libpq
-    ];
-
-    preBuild = ''
-      # Force sass-embedded to use our dart-sass instead of bundled binaries.
-      # The bundled Dart binary can't run in the Nix sandbox (no /lib64/ld-linux-x86-64.so.2).
-      for dep in node_modules/.pnpm/sass-embedded@*; do
-        substituteInPlace "$dep/node_modules/sass-embedded/dist/lib/src/compiler-path.js" \
-          --replace-fail \
-            'compilerCommand = (() => {' \
-            'compilerCommand = (() => { return ["${lib.getExe dart-sass}"];'
-      done
-    '';
-
-    buildPhase = ''
-      runHook preBuild
-
-      pushd node_modules/sqlite3
-      node-gyp rebuild
-      popd
-
-      # isolated-vm is a native addon required by n8n-nodes-base (Merge node SQL sandbox)
-      # since n8n 2.11.x; must be compiled before pnpm build runs generate-metadata
-      pushd node_modules/isolated-vm
-      node-gyp rebuild
-      popd
-
-      # TODO: use deploy after resolved https://github.com/pnpm/pnpm/issues/5315
-      pnpm build --filter=n8n
-
-      runHook postBuild
-    '';
-
-    preInstall = ''
-      echo "Removing non-deterministic and unnecessary files"
-
-      find -type d -name .turbo -exec rm -rf {} +
-      rm node_modules/.modules.yaml
-      rm packages/nodes-base/dist/types/nodes.json
-
-      CI=true pnpm --ignore-scripts prune --prod
-      find -type f \( -name "*.ts" -o -name "*.map" \) -exec rm -rf {} +
-      rm -rf node_modules/.pnpm/{typescript*,prettier*}
-      shopt -s globstar
-      # https://github.com/pnpm/pnpm/issues/3645
-      find node_modules packages/**/node_modules -xtype l -delete
-
-      echo "Removed non-deterministic and unnecessary files"
-    '';
-
-    installPhase = ''
-      runHook preInstall
-
-      mkdir -p $out/{bin,lib/n8n}
-      cp -r {packages,node_modules} $out/lib/n8n
-
-      makeWrapper $out/lib/n8n/packages/cli/bin/n8n $out/bin/n8n \
-        --set N8N_RELEASE_TYPE "stable"
-
-      # JavaScript runner
-      makeWrapper ${nodejs}/bin/node $out/bin/n8n-task-runner \
-        --add-flags "$out/lib/n8n/packages/@n8n/task-runner/dist/start.js"
-
-      # Python runner
-      mkdir -p $out/lib/n8n-task-runner-python
-      cp -r packages/@n8n/task-runner-python/* $out/lib/n8n-task-runner-python/
-      makeWrapper ${python}/bin/python $out/bin/n8n-task-runner-python \
-        --add-flags "$out/lib/n8n-task-runner-python/src/main.py" \
-        --prefix PYTHONPATH : "$out/lib/n8n-task-runner-python"
-
-      runHook postInstall
-    '';
-
-    passthru = {
-      tests = nixosTests.n8n;
-      updateScript = ./update.sh;
-    };
-
-    # this package has ~80000 files, these take too long and seem to be unnecessary
-    dontStrip = true;
-    dontPatchELF = true;
-    dontRewriteSymlinks = true;
-
-    meta = {
-      description = "Free and source-available fair-code licensed workflow automation tool";
-      longDescription = ''
-        Free and source-available fair-code licensed workflow automation tool.
-        Easily automate tasks across different services.
-      '';
-      homepage = "https://n8n.io";
-      changelog = "https://github.com/n8n-io/n8n/releases/tag/n8n@${finalAttrs.version}";
-      maintainers = with lib.maintainers; [
-        gepbird
-        AdrienLemaire
-        sweenu
-        wrbbz
-      ];
-      license = lib.licenses.sustainableUse;
-      mainProgram = "n8n";
-      platforms = lib.platforms.unix;
-    };
-  })

pkgs/n8n/update.sh

@@ -1,29 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p bash curl jq nix-update cacert git nix
-set -euo pipefail
-
-# n8n releases are published with two tags per version:
-#   - "n8n@X.Y.Z" - the versioned tag
-#   - "stable"   - always points to the latest stable version
-#
-# We query the "stable" tag and extract the version from its target commitish (e.g., "release/2.18.5").
-# This ensures we always get the actual latest stable version, not the most recently created tag.
-
-set -euo pipefail
-
-# Get the directory where this script lives (should be pkgs/n8n/)
-script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-
-# Get the nixpkgs root (parent of pkgs/)
-nixpkgs_root="$(cd "$script_dir/../.." && pwd)"
-
-cd "$nixpkgs_root"
-
-# Query the "stable" tag and extract version from target_commitish (e.g., "release/2.18.5")
-new_version=$(curl -s "https://api.github.com/repos/n8n-io/n8n/releases/tags/stable" | jq --raw-output '.target_commitish | ltrimstr("release/")')
-
-echo "Latest stable version: n8n@${new_version}"
-echo "Running from: $(pwd)"
-
-# Use --flake --system to properly evaluate the flake-based package
-nix-update --flake --system x86_64-linux n8n --version "$new_version"

pkgs/openwork/default.nix

@@ -6,7 +6,7 @@
   stdenvNoCC,
 }: let
   pname = "openwork";
-  version = "0.17.3";
+  version = "0.18.11";
 
   src = fetchurl {
     url =
@@ -16,7 +16,7 @@
     hash =
       if stdenvNoCC.hostPlatform.system == "aarch64-linux"
       then "sha256-ZSoAcOH0/gQynSCY8qCvysaNBnUl/G8Zz66a11y60Qs="
-      else "sha256-vrbakPeBY+6N12KOfjRzqTt5CsJ98G1rFH0caaI2qX8=";
+      else "sha256-wh2I5Il4f/VruMA2mRskaB7ldcbSan0upon6Y+Vm1Rw=";
   };
 
   appimageContents = appimageTools.extractType2 {inherit pname version src;};
@@ -25,12 +25,11 @@ in
     inherit pname version src;
 
     extraInstallCommands = ''
-      install -m 444 -D ${appimageContents}/@openworkdesktop.desktop \
+      install -m 444 -D ${appimageContents}/com.differentai.openwork.desktop \
         $out/share/applications/openwork.desktop
       substituteInPlace $out/share/applications/openwork.desktop \
-        --replace-fail 'Exec=AppRun --no-sandbox %U' 'Exec=${pname} %U' \
+        --replace-fail 'Exec=AppRun %U' 'Exec=${pname} %U'
-        --replace-fail 'Icon=@openworkdesktop' 'Icon=${pname}'
+      install -m 444 -D ${appimageContents}/openwork.png \
-      install -m 444 -D ${appimageContents}/@openworkdesktop.png \
         $out/share/icons/hicolor/512x512/apps/${pname}.png
     '';
 

pkgs/talk/README.md

@@ -0,0 +1,98 @@
+# talk
+
+ElevenLabs TTS voice notifications with a dismissable desktop popup. Generates speech from text via the ElevenLabs API, plays it through `mpv`, and shows a notification with a **⛔ Abbrechen** button to stop playback.
+
+## Usage
+
+### Argument
+
+```bash
+talk "Build abgeschlossen. Alle Tests erfolgreich."
+```
+
+### Stdin (pipe)
+
+```bash
+echo "Deployment fertig" | talk
+nixos-rebuild build 2>&1 | tail -3 | talk
+pi -p "Fasse zusammen" | talk
+```
+
+## Environment Variables
+
+| Variable | Required | Default | Description |
+|---|---|---|---|
+| `ELEVENLABS_API_KEY` | ⚠️ | — | Fallback if agenix file is absent |
+| `ELEVENLABS_KEY_FILE` | ❌ | `/run/agenix/elevenlabs-key` | Path to agenix secrets file (preferred) |
+| `ELEVENLABS_VOICE_ID` | ❌ | `KXxZd16DiBqt82nbarJx` | Voice ID to use |
+| `VOICE_NOTIFY` | ❌ | `1` | Set to `0` to silence all output |
+
+The API key is read from the agenix file at `/run/agenix/elevenlabs-key` by default. The file should contain just the key (trailing newline is stripped automatically via `read -r`). If the file doesn't exist, `talk` falls back to the `ELEVENLABS_API_KEY` environment variable.
+
+## How It Works
+
+1. Sends text to ElevenLabs `text-to-speech` API → receives MP3
+2. Plays audio via `mpv` (background)
+3. Shows `notify-send` popup with **⛔ Abbrechen** action (background)
+4. Polls every 0.2s:
+   - If mpv finished → kill notification, exit
+   - If user clicked **Abbrechen** → kill mpv, exit
+5. Cleans up temp files on exit
+
+## Cancel Button
+
+The notification popup has a **⛔ Abbrechen** action button. Clicking it kills `mpv` playback immediately. The popup disappears when audio finishes or is cancelled.
+
+The poll loop uses `[ -s ]` (non-empty file check) on the action output file. This ensures the loop only reacts when `notify-send` actually writes the action key — not when the empty file is created by the shell redirect.
+
+## Integration Patterns
+
+### After long-running tasks
+
+```bash
+nixos-rebuild switch 2>&1 | tail -5 | talk
+```
+
+### With AI agents (print mode)
+
+```bash
+# Pi
+pi -p "Review diesen Code" | talk
+
+# OpenCode
+opencode run "Erkläre diese Funktion" -q | talk
+```
+
+### With crunch (scheduled jobs)
+
+```bash
+crunch ai pi daily "08:00" "Fasse Basecamp Todos zusammen"
+# → talk speaks the summary at 08:00
+```
+
+## NixOS Installation
+
+```nix
+# home-manager
+home.packages = [ pkgs.m3ta.talk ];
+```
+
+The API key is read from `/run/agenix/elevenlabs-key` at runtime — set up the secret in your agenix configuration:
+
+```nix
+# secrets.nix
+age.secrets."elevenlabs-key" = {
+  file = ./secrets/elevenlabs-key.age;
+  # Optionally set owner/group if needed
+};
+```
+
+No need to export `ELEVENLABS_API_KEY` in shell environment anymore.
+
+## Dependencies
+
+- `curl` — API calls
+- `python3` — JSON payload construction
+- `mpv` — audio playback
+- `libnotify` — desktop notification
+- `busybox` — coreutils (rm, cat, grep, sleep, kill, stat)

pkgs/talk/default.nix

@@ -23,7 +23,18 @@
     fi
 
     # ── Config ──────────────────────────────────────────────────────
-    API_KEY="''${ELEVENLABS_API_KEY:?Set ELEVENLABS_API_KEY in your environment}"
+    # API key: read from agenix file (preferred), fall back to env var.
+    # `read -r` strips the trailing newline that agenix files contain.
+    ELEVENLABS_KEY_FILE="''${ELEVENLABS_KEY_FILE:-/run/agenix/elevenlabs-key}"
+    if [ -f "$ELEVENLABS_KEY_FILE" ]; then
+      read -r API_KEY < "$ELEVENLABS_KEY_FILE"
+    elif [ -n "''${ELEVENLABS_API_KEY:-}" ]; then
+      API_KEY="''${ELEVENLABS_API_KEY}"
+    else
+      echo "Error: No ElevenLabs API key found." >&2
+      echo "Create $ELEVENLABS_KEY_FILE (agenix) or set ELEVENLABS_API_KEY env var." >&2
+      exit 1
+    fi
     VOICE_ID="''${ELEVENLABS_VOICE_ID:-KXxZd16DiBqt82nbarJx}"
     # Argument hat Vorrang, sonst stdin lesen wenn Pipe
     if [ $# -ge 1 ]; then

pkgs/vibetyper/default.nix

@@ -1,3 +1,4 @@
+# last-modified: Fri, 24 Jul 2026 10:50:57 GMT
 {
   appimageTools,
   fetchurl,
@@ -5,10 +6,12 @@
   makeWrapper,
 }: let
   pname = "vibetyper";
-  version = "1.3.6";
+  version = "1.4.1";
+  # Upstream publishes to an unversioned URL — ./update.sh watches Last-Modified
+  # and refreshes the sha256 when the binary changes. Bump `version` manually.
   src = fetchurl {
     url = "https://cdn.vibetyper.com/releases/linux/VibeTyper.AppImage";
-    sha256 = "sha256-uJ8OlV6L8omWAM14YYEBW9+bC0RqB4wqzdY8o1Ac6fI=";
+    sha256 = "sha256-mhXWEKvDgzxJrqIjzUWpfPM8qwKf6YYLsbjqqjtEk5s=";
   };
   appimageContents = appimageTools.extractType2 {inherit pname version src;};
 in
@@ -29,6 +32,8 @@ in
               --set VIBE_DISABLE_HYPRLAND_INDICATOR_NO_BLUR 1
     '';
 
+    passthru.updateScript = ./update.sh;
+
     meta = {
       description = "VibeTyper - AI-powered typing assistant";
       homepage = "https://vibetyper.com";

pkgs/vibetyper/update.sh

@@ -0,0 +1,68 @@
+#!/usr/bin/env nix-shell
+#!nix-shell --pure -i bash -p bash curl nix nix-prefetch cacert git
+set -euo pipefail
+
+# Update vibetyper AppImage hash.
+#
+# Upstream publishes to an unversioned URL (VibeTyper.AppImage) — there is no
+# version-pinned URL and no usable GitHub release. To still catch updates, we:
+#   1. HEAD the URL and read the Last-Modified header
+#   2. Compare to the value stored as a `# last-modified:` comment in default.nix
+#   3. If changed: re-download, compute sha256, update hash + comment, commit
+#
+# The version attribute stays static (manual bump) — only the binary hash is
+# refreshed automatically.
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+NIX_FILE="$SCRIPT_DIR/default.nix"
+URL="https://cdn.vibetyper.com/releases/linux/VibeTyper.AppImage"
+
+echo "Checking $URL ..."
+# -f: fail on HTTP errors, -s: silent, -S: show errors, -I: HEAD, -L: follow redirects
+HEADERS=$(curl -fsSIL "$URL")
+NEW_LAST_MODIFIED=$(echo "$HEADERS" | tr -d '\r' \
+  | awk -F': ' 'tolower($1)=="last-modified" {print $2; exit}')
+
+if [[ -z "$NEW_LAST_MODIFIED" ]]; then
+  echo "ERROR: Could not read Last-Modified header from $URL" >&2
+  exit 1
+fi
+
+# Read stored Last-Modified from `# last-modified:` comment in the nix file
+CURRENT_LAST_MODIFIED=$(awk -F': ' '/^# last-modified:/ {sub(/^# last-modified: /, ""); print; exit}' "$NIX_FILE")
+
+echo "Current: ${CURRENT_LAST_MODIFIED:-<none>}"
+echo "Latest:  $NEW_LAST_MODIFIED"
+
+if [[ "$NEW_LAST_MODIFIED" == "$CURRENT_LAST_MODIFIED" ]]; then
+  echo "No change, nothing to do."
+  exit 0
+fi
+
+echo "==> Content changed, refreshing hash..."
+
+# Compute new sha256 (SRI form, matches existing `sha256 = "sha256-..."` style)
+HASH=$(nix-prefetch-url --type sha256 "$URL" 2>/dev/null)
+SRI=$(nix hash convert --hash-algo sha256 --to sri "$HASH")
+echo "New sha256: $SRI"
+
+# Update the sha256 attribute (keeps the existing `sha256 = "sha256-..."` shape)
+sed -i "s|^\([[:space:]]*\)sha256 = \"[^\"]*\";|\1sha256 = \"$SRI\";|" "$NIX_FILE"
+
+# Update or insert the last-modified marker comment
+if grep -q '^# last-modified:' "$NIX_FILE"; then
+  sed -i "s|^# last-modified:.*|# last-modified: $NEW_LAST_MODIFIED|" "$NIX_FILE"
+else
+  sed -i "1i # last-modified: $NEW_LAST_MODIFIED" "$NIX_FILE"
+fi
+
+echo "Updated $NIX_FILE"
+
+# Commit when inside a git repo
+NIXPKGS_ROOT=$(git -C "$SCRIPT_DIR" rev-parse --show-toplevel 2>/dev/null || true)
+if [[ -n "$NIXPKGS_ROOT" ]] && \
+   [[ -n "$(git -C "$NIXPKGS_ROOT" status --porcelain "$NIX_FILE")" ]]; then
+  git -C "$NIXPKGS_ROOT" add "$NIX_FILE"
+  git -C "$NIXPKGS_ROOT" commit -m "vibetyper: refresh AppImage ($NEW_LAST_MODIFIED)"
+  echo "==> Committed"
+fi

pkgs/zellij-ps/default.nix

@@ -12,12 +12,15 @@ with lib;
     pname = "zellij-ps";
     version = "0.1.0";
 
+    # Branch-tracking source: follows the tip of the master branch of
+    # code.m3ta.dev/m3tam3re/helper-scripts. The repo has no tags, so we
+    # track commits via the Gitea API (see ./update.sh).
     src = fetchFromGitea {
       domain = "code.m3ta.dev";
       owner = "m3tam3re";
       repo = "helper-scripts";
-      rev = "08a3217b83391c1110545c1ee3161eecd5dbe5e9";
+      rev = "d30382d8692399d952a1aacbdb77e6ab87ba046d";
-      sha256 = "1sc4i58mwcg3qsq0wwl5rvk08ykbxc497bq7mrxiirndsarskby7";
+      sha256 = "0zrl8089qj14gwn9k3b73vnw2zn48f9yh9w0qbh8g8mb171sxyaj";
     };
 
     propagatedBuildInputs = [fish fd fzf zellij];
@@ -33,6 +36,8 @@ with lib;
       chmod +x $out/bin/zellij-ps
     '';
 
+    passthru.updateScript = ./update.sh;
+
     meta = {
       description = "Zellij project switcher - quickly switch between project folders";
       license = lib.licenses.mit;

pkgs/zellij-ps/update.sh

@@ -0,0 +1,75 @@
+#!/usr/bin/env nix-shell
+#!nix-shell --pure -i bash -p bash curl jq nix nix-prefetch cacert git
+set -euo pipefail
+
+# Update zellij-ps to the latest commit on the helper-scripts master branch.
+# The upstream repo (m3ta.dev/m3tam3re/helper-scripts) has no tags/releases,
+# so we track the tip of master via the Gitea API.
+#
+# This is a "branch-tracking" updater: always pulls the newest commit,
+# NOT a stable release. Suitable for personal script repos.
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+NIX_FILE="$SCRIPT_DIR/default.nix"
+
+DOMAIN="code.m3ta.dev"
+OWNER="m3tam3re"
+REPO="helper-scripts"
+BRANCH="master"
+
+echo "Fetching latest commit on $BRANCH of $DOMAIN/$OWNER/$REPO..."
+LATEST_SHA=$(curl -fsSL "https://$DOMAIN/api/v1/repos/$OWNER/$REPO/branches/$BRANCH" \
+  | jq -r '.commit.id')
+
+if [[ -z "$LATEST_SHA" ]]; then
+  echo "ERROR: Failed to fetch latest commit from $DOMAIN/$OWNER/$REPO" >&2
+  exit 1
+fi
+
+# Read current rev from the nix file
+CURRENT_SHA=$(awk '
+  /^[[:space:]]*rev = "/ {
+    gsub(/^[[:space:]]*rev = "/, "")
+    gsub(/".*/, "")
+    print
+    exit
+  }
+' "$NIX_FILE")
+
+echo "Current: ${CURRENT_SHA:0:10}"
+echo "Latest:  ${LATEST_SHA:0:10}"
+
+if [[ "$LATEST_SHA" == "$CURRENT_SHA" ]]; then
+  echo "Already at latest commit, nothing to do."
+  exit 0
+fi
+
+echo "==> Updating zellij-ps: ${CURRENT_SHA:0:10} -> ${LATEST_SHA:0:10}"
+
+# Compute new sha256 via nix-prefetch-url (matches existing sha256 = "..." style)
+ARCHIVE_URL="https://$DOMAIN/$OWNER/$REPO/archive/$LATEST_SHA.tar.gz"
+echo "Prefetching: $ARCHIVE_URL"
+HASH=$(nix-prefetch-url --unpack --type sha256 "$ARCHIVE_URL" 2>/dev/null)
+
+if [[ -z "$HASH" ]]; then
+  echo "ERROR: nix-prefetch-url failed" >&2
+  exit 1
+fi
+
+echo "New sha256: $HASH"
+
+# Update rev and sha256 in the nix file
+sed -i "s|^\([[:space:]]*\)rev = \"[^\"]*\";|\1rev = \"$LATEST_SHA\";|" "$NIX_FILE"
+sed -i "s|^\([[:space:]]*\)sha256 = \"[^\"]*\";|\1sha256 = \"$HASH\";|" "$NIX_FILE"
+
+echo "Updated $NIX_FILE"
+
+# Commit when inside a git repo
+NIXPKGS_ROOT=$(git -C "$SCRIPT_DIR" rev-parse --show-toplevel 2>/dev/null || true)
+if [[ -n "$NIXPKGS_ROOT" ]] && \
+   [[ -n "$(git -C "$NIXPKGS_ROOT" status --porcelain "$NIX_FILE")" ]]; then
+  SHORT="${LATEST_SHA:0:10}"
+  git -C "$NIXPKGS_ROOT" add "$NIX_FILE"
+  git -C "$NIXPKGS_ROOT" commit -m "zellij-ps: update helper-scripts to $SHORT"
+  echo "==> Committed"
+fi

tests/n8n-overlay-test.nix

@@ -0,0 +1,65 @@
+{
+  pkgs,
+  inputs,
+  self,
+}: let
+  localPackages = import ../pkgs {inherit pkgs inputs;};
+  mkPkgs = overlays:
+    import inputs.nixpkgs {
+      system = pkgs.stdenv.hostPlatform.system;
+      config.allowUnfree = true;
+      inherit overlays;
+    };
+
+  upstreamPkgs = mkPkgs [];
+  modifiedPkgs = mkPkgs [self.overlays.modifications];
+  defaultPkgs = mkPkgs [self.overlays.default];
+
+  expectedVersion = "2.32.6";
+  expectedSrcHash = "sha256-wWm6vGyJ2I2SBU38gRGaZG2FR5FBxH6V/sWQwn5B4Ac=";
+  expectedPnpmHash = "sha256-QzUJCF+VIku9/HrmiUR9FNCU3MlYtyKOILZjFNXvN8U=";
+  expectedChangelog = "https://github.com/n8n-io/n8n/releases/tag/n8n@${expectedVersion}";
+  expectedRootNodeModuleSymlinks = [
+    "ln -s .pnpm/node_modules/sass-embedded node_modules/sass-embedded"
+    "ln -s .pnpm/node_modules/sqlite3 node_modules/sqlite3"
+  ];
+
+  checkN8nOverride = overlayName: package:
+    if package.version != expectedVersion
+    then throw "${overlayName} n8n version is ${package.version}, expected ${expectedVersion}"
+    else if package.src.outputHash != expectedSrcHash
+    then throw "${overlayName} n8n src hash is ${package.src.outputHash}, expected ${expectedSrcHash}"
+    else if package.pnpmDeps.outputHash != expectedPnpmHash
+    then throw "${overlayName} n8n pnpmDeps hash is ${package.pnpmDeps.outputHash}, expected ${expectedPnpmHash}"
+    else if package.meta.changelog != expectedChangelog
+    then throw "${overlayName} n8n changelog is ${package.meta.changelog}, expected ${expectedChangelog}"
+    else "ok";
+
+  checkBuildPhaseInherited = overlayName: package:
+    if package.buildPhase != upstreamPkgs.n8n.buildPhase
+    then throw "${overlayName} n8n buildPhase should be inherited from upstream nixpkgs"
+    else "ok";
+
+  checkRootNodeModuleSymlinks = overlayName: package:
+    if !(pkgs.lib.all (symlink: pkgs.lib.hasInfix symlink (package.preBuild or "")) expectedRootNodeModuleSymlinks)
+    then throw "${overlayName} n8n preBuild should create root node_modules symlinks required by the upstream buildPhase"
+    else "ok";
+in
+  pkgs.runCommand "n8n-overlay-test" {
+    n8nOverlayFile =
+      if builtins.pathExists ../overlays/mods/n8n.nix
+      then "ok"
+      else throw "n8n overlay override must live in overlays/mods/n8n.nix";
+    localN8nAbsent =
+      if localPackages ? n8n
+      then throw "pkgs/default.nix must not export a local n8n package"
+      else "ok";
+    modificationsOverlayN8n = checkN8nOverride "overlays.modifications" modifiedPkgs.n8n;
+    defaultOverlayN8n = checkN8nOverride "overlays.default" defaultPkgs.n8n;
+    modificationsOverlayBuildPhase = checkBuildPhaseInherited "overlays.modifications" modifiedPkgs.n8n;
+    defaultOverlayBuildPhase = checkBuildPhaseInherited "overlays.default" defaultPkgs.n8n;
+    modificationsOverlayRootNodeModuleSymlinks = checkRootNodeModuleSymlinks "overlays.modifications" modifiedPkgs.n8n;
+    defaultOverlayRootNodeModuleSymlinks = checkRootNodeModuleSymlinks "overlays.default" defaultPkgs.n8n;
+  } ''
+    touch $out
+  ''