From 9ba2cf52292c58e103e471defed6d3c1380c1df2 Mon Sep 17 00:00:00 2001
From: Ryan Yin <xiaoyin_c@qq.com>
Date: Thu, 8 Oct 2026 15:42:39 +0800
Subject: [PATCH] chore: pin tuios to v0.9.0; require pinned third-party inputs

---
 .agents/skills/nix-config-update/SKILL.md | 5 +++++
 flake.lock                                | 7 ++++---
 flake.nix                                 | 2 +-
 3 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/.agents/skills/nix-config-update/SKILL.md b/.agents/skills/nix-config-update/SKILL.md
index 45c35662..0462966d 100644
--- a/.agents/skills/nix-config-update/SKILL.md
+++ b/.agents/skills/nix-config-update/SKILL.md
@@ -21,6 +21,11 @@ deploying the result to any host.
    `boot` mode, `just darwin-rollback`, or `git revert`.
 5. **Security first.** An update re-opens the supply chain. Re-audit every input whose revision
    moved before you deploy it.
+6. **Pin third-party inputs.** A third-party input — not one of the user's own `ryan4yin/*`
+   repositories — MUST name a version tag or a fixed commit, not a branch. Official channel
+   upstreams that publish no release (nixpkgs' `nixos-unstable`/`master`) are the exception. When
+   only a branch carries a needed third-party change, keep the resolved revision in the lock, record
+   why next to the declaration, and re-audit each update.
 
 ## 1. Pre-flight
 
diff --git a/flake.lock b/flake.lock
index 0fc8af43..ea36a9d6 100644
--- a/flake.lock
+++ b/flake.lock
@@ -1234,15 +1234,16 @@
         "treefmt-nix": "treefmt-nix_2"
       },
       "locked": {
-        "lastModified": 1790956816,
-        "narHash": "sha256-NGYHcUREpbCNfynyid6DMFCxK7cvvbkF2n2UWk0Swyk=",
+        "lastModified": 1791438265,
+        "narHash": "sha256-FcnDACL7h7V0s/fKx1MiM5ahsePfO0wEf/Q7KLgkOgU=",
         "owner": "Gaurav-Gosain",
         "repo": "tuios",
-        "rev": "661bd4fb2e451613442d593c09631bb321492e98",
+        "rev": "93fa8d53dc6220c7dd763dc62696046a0a99d0f2",
         "type": "github"
       },
       "original": {
         "owner": "Gaurav-Gosain",
+        "ref": "v0.9.0",
         "repo": "tuios",
         "type": "github"
       }
diff --git a/flake.nix b/flake.nix
index 090cbc88..a220937b 100644
--- a/flake.nix
+++ b/flake.nix
@@ -208,7 +208,7 @@
     # terminal window manager / multiplexer; nixpkgs lags behind upstream,
     # so track the upstream flake.
     tuios = {
-      url = "github:Gaurav-Gosain/tuios";
+      url = "github:Gaurav-Gosain/tuios/v0.9.0";
       inputs.nixpkgs.follows = "nixpkgs";
     };
   };