refactor(editors): standardize on helix, keep neovim as backup (#345)

.agents/skills/nix-config-secrets/SKILL.md

@@ -70,14 +70,18 @@ Changing only a secret's value is steps 1, 2, and the deploy.
 ## 3. The private repository
 
 The agenix operations run against `~/codes/nix-secrets`. Their single source is
-[`secrets/Justfile`](../../../secrets/Justfile), which pins the identity and option order; run them
-from this repository's root and keep each path identical to its key in `secrets.nix`:
+[`secrets/Justfile`](../../../secrets/Justfile), which pins the identity, option order, and
+`$EDITOR`; run them from this repository's root and keep each path identical to its key in
+`secrets.nix`:
 
 ```bash
 just -f secrets/Justfile edit ./desktop/xxx.age   # edit or create (interactive)
 just -f secrets/Justfile rekey                    # re-encrypt after a recipient change
 ```
 
+`edit` passes `EDITOR=hx` to the root `agenix` process, because `sudo` resets the environment and
+the invoking user's `EDITOR` would not reach it; do not add `sudo -E` or set `EDITOR` yourself.
+
 The repository keeps a single amended commit: `git commit --amend -a --no-edit`,
 `git reflog expire --expire-unreachable=now --all`, `git gc --prune=now`, then force push. Treat
 amend and force push as impactful and get authorization first.

home/base/core/editors/README.md

@@ -5,10 +5,9 @@ Shared editor configuration and **usage notes** for terminal-focused editing.
 ## Roles
 
 - **Helix** (`helix/`): Primary TUI editor — batteries-included, small attack surface. `$EDITOR` /
-  `$VISUAL` default to `hx` (`session-env.nix`).
-- **Neovim** (`neovim/`): Backup editor — classic vim-style workflow and `:help` when needed. For
-  privileged edits (`sudoedit`) and other security-sensitive inputs, `$SUDO_EDITOR` is
-  `nvim --clean`; use that explicitly when `$EDITOR` must avoid user config/plugins.
+  `$VISUAL` / `$SUDO_EDITOR` default to `hx` system-wide (`modules/base/packages.nix`), for
+  interactive and privileged (`sudoedit`) edits alike.
+- **Neovim** (`neovim/`): Backup editor — classic vim-style workflow and `:help` when needed.
 
 Terminal layout and files: **Zellij** and **Yazi** live under `core/zellij/` and `core/yazi.nix`
 (not in this folder).

home/base/core/editors/helix/README.md

@@ -8,9 +8,8 @@ multi-cursor, surround), and a smaller moving part than a large Neovim plugin st
 
 ## Tips
 
-1. This flake sets `$EDITOR` / `$VISUAL` to **`hx`** by default. For security-sensitive edits
-   (privileged files, unfamiliar binaries, secrets), prefer **`nvim --clean`** — `$SUDO_EDITOR` uses
-   it so `sudoedit` stays minimal; invoke it yourself in other trust-boundary cases.
+1. This flake sets `$EDITOR` / `$VISUAL` / `$SUDO_EDITOR` to **`hx`** by default, for interactive
+   and privileged (`sudoedit`) edits alike. Neovim stays installed as a backup editor.
 1. Helix is **selection-first** (like Kakoune): extend a selection, then run an action (`d`, `c`,
    `y`, …). A lone cursor is a zero-width selection.
 1. Read the official docs before reinventing workflows:

home/base/core/editors/neovim/default.nix

@@ -31,10 +31,9 @@ in
   # itself comes from `home/base/core/theme.nix` (catppuccin.nvim is enabled
   # there and appends its own plugin + setup).
   #
-  # The plain system package (modules/base/packages.nix) stays in place for
-  # privileged edits: `sudo` uses the system PATH, so
-  # `$SUDO_EDITOR = "nvim --clean"` keeps this user config out of root-owned
-  # files.
+  # The plain system package (modules/base/packages.nix) stays installed as a
+  # backup. Helix (`hx`) is the default `$EDITOR`/`$VISUAL`, so this config is
+  # only loaded when you start Neovim directly.
   programs.neovim = {
     enable = true;
     vimAlias = true;

home/base/core/editors/session-env.nix

@@ -1,9 +0,0 @@
-# Default interactive editor is Helix (`hx`). For trust-boundary edits (e.g. `sudoedit`,
-# secrets, unfamiliar payloads), prefer `nvim --clean` — wired via `SUDO_EDITOR`.
-{
-  home.sessionVariables = {
-    EDITOR = "hx";
-    VISUAL = "hx";
-    SUDO_EDITOR = "nvim --clean";
-  };
-}

home/base/core/shells/config.nu

@@ -102,7 +102,7 @@ def genpass [length: int = 12] {
 $env.config.edit_mode = "vi"
 
 # Command that will be used to edit the current line buffer with Ctrl+O.
-# If unset, uses $env.VISUAL and then $env.EDITOR ($EDITOR is `hx` via session-env).
+# If unset, uses $env.VISUAL and then $env.EDITOR ($EDITOR is `hx` from the system environment).
 #
 $env.config.buffer_editor = ["hx"]
 

modules/base/packages.nix

@@ -1,11 +1,13 @@
 { pkgs, ... }:
 {
-  # Default editor: Helix (`hx`). Privileged edits (`sudoedit`, …) prefer `nvim --clean`
-  # via `SUDO_EDITOR`; invoke `nvim --clean` manually for other sensitive workflows.
+  # Default editor: Helix (`hx`), for interactive and privileged (`sudoedit`) edits alike. This is
+  # the single source for the editor env; Home Manager does not duplicate it. `SUDO_EDITOR` is
+  # explicit rather than relying on the `$VISUAL`/`$EDITOR` fallback. Neovim stays installed as a
+  # backup.
   environment.variables = {
     EDITOR = "hx";
     VISUAL = "hx";
-    SUDO_EDITOR = "nvim --clean";
+    SUDO_EDITOR = "hx";
   };
 
   environment.systemPackages = with pkgs; [
@@ -13,7 +15,7 @@
     nushell # nushell
     fastfetch
     helix # default $EDITOR (`hx`)
-    neovim # backup editor; `nvim --clean` for sensitive / privileged edits (`$SUDO_EDITOR`)
+    neovim # backup editor
     gnumake # Makefile
     just # a command runner like gnumake, but simpler
     git # used by nix flakes

secrets/Justfile

@@ -5,6 +5,9 @@ set shell := ["nu", "-c"]
 set working-directory := "../../codes/nix-secrets"
 
 identity := "/etc/ssh/ssh_host_ed25519_key"
+# `sudo` resets the environment, so the invoking user's `EDITOR` never reaches `agenix`.
+# Pin the editor here instead of using `sudo -E`, which would trust the caller's environment.
+editor := "hx"
 
 # List all recipes
 default:
@@ -12,10 +15,10 @@ default:
 
 # Edit or create a secret (interactive); pipe the plaintext to write non-interactively
 edit file:
-    sudo -E agenix -i {{identity}} -e {{quote(file)}}
+    sudo env EDITOR={{quote(editor)}} agenix -i {{identity}} -e {{quote(file)}}
 
 # Re-encrypt every secret after adding or changing a recipient key
 [confirm("Re-encrypt every secret in ~/codes/nix-secrets?")]
 rekey:
-    sudo -E agenix -r -i {{identity}}
+    sudo agenix -r -i {{identity}}
     sudo chown -R ryan:ryan *