The v6 fake pool is a lookup key, not the egress path, so it can be a public range: the
shipped ULA default reads as "local" to browsers and prompts for local-network access on
every site. The gvisor stack override goes with it -- mips is upstream's default, and
nftables rules out the kernel stack here.
fake-ip needs one pool per family, and the family a client picks does not pick the
egress family. Exclude the cluster ULA and the Tailscale ranges from the TUN; the ssh
pin and the WA-028 record cover the fake-AAAA stall.
`dsh-llm-pi-ai` registers its built-in providers once, so a second instance
in the profile patch fails on mount with `provider "..." is already declared`.
Extend the base `llm-pi-ai` row instead.
dsh rewrites a profile's cordis.patch.yml at runtime, so linking the web
profile put GUI state in the checkout and let runtime writes clobber manual
edits. Link the stable policy as the $DSH_HOME home layer instead: dsh applies
it after every profile and only reads it.
The host-plane compaction-basic row is disabled on the web surface and each
agent preset owns its own copy, so the top-level override was inert. Drop it;
the model contextWindow/maxTokens are the effective knobs.
- add home/base/tui/agents/dsh/cordis.patch.yml, linked from default.nix
- drop the ~/.dsh/profiles/web link and the tracked web/ profile
- keep runtime state and private/local model routes in the profile patch
- update the eval test and README
Kimi Code moved its desktop client into an internal repository in July 2026 (MoonshotAI/kimi-code#1849), so the polished surface is no longer open source; the CLI that stays behind overlaps opencode2 and pi. Removing it drops one more redundant harness.
oh-my-pi is a feature-complete superset of pi, so its role is already covered: opencode2 for a batteries-included harness, pi for the minimal/local-model one. Keeping it meant maintaining two nearly identical harnesses.
* feat!: replace zellij with tuios and switch to ghostty + kitty
Terminal environment overhaul:
- add the tuios flake input (upstream 0.8.5; nixpkgs has 0.8.1) and link
the checked-in config out-of-store; auto-start tuios in nushell instead
of zellij
- remove zellij entirely: both modules, config, README and nushell
completions
- remove foot and alacritty, which lack the Kitty graphics protocol;
Crush hardcodes banned bash commands, blocking many operations. Drop the package, its AGENTS.md/CRUSH.md install target, env vars, and preservation entries.
Only three secrets are readable as the login user (nix-access-tokens,
ssh-key-romantic and the nushell one); everything else is root-only and
the filesystem already keeps agents out.
Update the user-facing bits that still pointed at KubeVirt: the homepage
dashboard group and entries (and drop the dead LongHorn one), the docs,
and remove the now-unneeded virtctl package.
home.sessionVariables writes export NAME="value" without escaping embedded double quotes, so the JSON {"share":"disabled"} reached opencode as the shell word {share:disabled} and failed config parsing. Emit the export with sessionVariablesExtra instead.
`use modules/argx *` glob-imports argx's `parse` command into the global
scope, shadowing nushell's builtin `parse`. Any script sourced afterwards
that relies on the builtin (e.g. fzf's nushell integration, which uses
`parse --regex`) then fails to parse with `unknown flag`.
Use prefixed imports for `argx` and `lg` instead of `*`: both modules are
still registered for the kubernetes module's submodules (which call
`argx parse` / `lg level`), there are no bare `parse`/`main`/`level` call
sites, and the builtin `parse` stays available.
Explicitly set programs.nixvim.nixpkgs.source to suppress the follows
warning, and migrate all programs.ssh.matchBlocks to programs.ssh.settings
using upstream PascalCase directive names.
* chore(home): drop AstroNvim bundle and centralize editors
Remove the bundled Neovim plugin tree to shrink supply-chain exposure; keep a
minimal programs.neovim backup. Daily editing stays Helix-first with Yazi and
Zellij.
- Add Helix/Neovim docs, glossary, and cheatsheets under core/editors/.
- Default EDITOR/VISUAL to hx; use SUDO_EDITOR nvim --clean for sudoedit and
other sensitive edits; adjust Nushell buffer_editor accordingly.
- Apply Helix Home Manager settings (keys, editor UI) in core/editors/helix.
- Keep heavy language-server tooling only in home/base/tui/editors/packages.nix;
wire it via an explicit default.nix import so core stays lightweight.
- Extend modules/base packages.nix where that profile sets global editor env.
* docs: link editors, VS Code, and agents from README
Document tui/editors versus core/editors; add root README pointers to GUI
vscode (Home Manager) and agents/. Cross-link heavy packages README from
core/editors.
ryan4yin | 二花
Ryan Yin