feat: add support for canokeys

Flake lock file updates:

• Updated input 'mysecrets':
    'git+ssh://git@github.com/ryan4yin/nix-secrets.git?ref=refs/heads/main&rev=0e2b90e6d57dfa70c0527c3a4d399bde82998f78&shallow=1' (2026-06-03)
  → 'git+ssh://git@github.com/ryan4yin/nix-secrets.git?ref=refs/heads/main&rev=490e3aca901fa703083822ee64a65f0a1f4529af&shallow=1' (2026-06-12)

Justfile

@@ -141,6 +141,11 @@ niri mode="default":
 #
 ############################################################################
 
+[macos]
+[group('desktop')]
+brew-upgrade:
+  brew upgrade --cask --greedy
+
 [macos]
 [group('desktop')]
 darwin-set-proxy:

flake.lock

@@ -555,11 +555,11 @@
         "treefmt-nix": "treefmt-nix"
       },
       "locked": {
-        "lastModified": 1780275889,
+        "lastModified": 1781228339,
-        "narHash": "sha256-srcKWB7mBO+mNWsDUmODs5CDDdQ0XjP1NX4iUM45eZo=",
+        "narHash": "sha256-gYIQvLpoGLH34tw3lZp11IrK82mkttLcw5sPErGe3+k=",
         "owner": "numtide",
         "repo": "llm-agents.nix",
-        "rev": "468bacd83af1b3bf36bceb0366967928b98c9e60",
+        "rev": "27d586e930f255a425ec2f9f238f078880333d09",
         "type": "github"
       },
       "original": {
@@ -588,10 +588,10 @@
     "mysecrets": {
       "flake": false,
       "locked": {
-        "lastModified": 1773927262,
+        "lastModified": 1781242064,
-        "narHash": "sha256-nxx7jAiHGTYU6hXdjHYjdR1SJNgFcVPokiFlR8MZwTc=",
+        "narHash": "sha256-Bn9mOj7CkdnepiwkiGiHPpvZs0HYrQsjB4Z+EJE+v+s=",
         "ref": "refs/heads/main",
-        "rev": "c388ca33beb5c099bf4603e6ab25a2e94af00b80",
+        "rev": "490e3aca901fa703083822ee64a65f0a1f4529af",
         "shallow": true,
         "type": "git",
         "url": "ssh://git@github.com/ryan4yin/nix-secrets.git"
@@ -725,11 +725,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1780030872,
+        "lastModified": 1780930886,
-        "narHash": "sha256-u6WU/yd/o8iYQrHX3RAwO1hYa3LkoSL+WNQD0rJfJZQ=",
+        "narHash": "sha256-rppURzHviaQN131F+nLiLdGfcb0uCd9gGP0E5+iw9MI=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "e9a7635a57597d9754eccebdfc7045e6c8600e6b",
+        "rev": "8c3cede7ddc26bd659d2d383b5610efbd2c7a16e",
         "type": "github"
       },
       "original": {
@@ -788,11 +788,11 @@
     },
     "nixpkgs-master": {
       "locked": {
-        "lastModified": 1780278297,
+        "lastModified": 1781229721,
-        "narHash": "sha256-ZR9YfHXIBOCDYWEKvGaLdYqwm5lwQPSMVPjg7Hb7uHE=",
+        "narHash": "sha256-ORvqDbb/LYxiJljGIejapjkc/kJbVote2N1WSb9W45I=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "c2a4e65eaf219d52ec3bf3a04e69a1e5631500d4",
+        "rev": "173d0ad7a974f8543a9ab01d2271b2e290341b33",
         "type": "github"
       },
       "original": {
@@ -804,11 +804,11 @@
     },
     "nixpkgs-patched": {
       "locked": {
-        "lastModified": 1774012337,
+        "lastModified": 1780458942,
-        "narHash": "sha256-75W3YfzkkKvpE3/wtHMihlT9kOnQZxWpLoshw1xu0T8=",
+        "narHash": "sha256-pu3loLm4gvcbh8iibeYDGgPHOVFXb8sAKEzJ9AxX5L4=",
         "owner": "ryan4yin",
         "repo": "nixpkgs",
-        "rev": "d373b16187b32770d99f6ff54a133d9543e68702",
+        "rev": "4425024452e93ce3d10e11bcd9b47f1dfa78593b",
         "type": "github"
       },
       "original": {

hardening/nixpaks/default.nix

@@ -1,6 +1,6 @@
 {
   pkgs,
-  pkgs-master,
+  pkgs-patched,
   nixpak,
   ...
 }:
@@ -22,7 +22,7 @@ in
   nixpkgs.overlays = [
     (_: super: {
       nixpaks = {
-        qq = wrapper super ./qq.nix;
+        qq = wrapper pkgs-patched ./qq.nix;
         telegram-desktop = wrapper super ./telegram-desktop.nix;
         firefox = wrapper super ./firefox.nix;
       };

home/base/core/editors/helix/README.md

@@ -51,8 +51,7 @@ In Helix, `|` / `!` and variants pipe or insert shell output on selections (see
 
 This flake’s Helix Home Manager module keeps **almost all default keys**; the only remap is
 **`Ctrl+Shift+o`** → jump backward, because Zellij uses **`Ctrl+o`** for Session (see
-`home/base/core/editors/helix/default.nix`). For other Zellij clashes, use **locked mode**
+`home/base/core/editors/helix/default.nix`).
-(`Ctrl+g`), **`:`** commands, or the built-in **`Space`** menu.
 
 ### Command mode (`:`)
 
@@ -64,6 +63,7 @@ This flake’s Helix Home Manager module keeps **almost all default keys**; the
 | Quit view / quit all   | `:q` / `:qa` — add `!` to discard changes                            |
 | Write and quit         | `:wq`, `:x`                                                          |
 | Write all and quit all | `:wqa`, `:xa`                                                        |
+| Save to path           | `:w path`                                                            |
 | Open file              | `:open path`, `:e path`                                              |
 | Next / previous buffer | `:bn` / `:bp` (also `gn` / `gp` in normal)                           |
 | Close buffer           | `:bc` (add `!` to force)                                             |
@@ -73,37 +73,51 @@ This flake’s Helix Home Manager module keeps **almost all default keys**; the
 
 ### Movement (normal mode)
 
-| Action                | Keys / notes                                        |
+| Action                | Keys / notes                                                         |
-| --------------------- | --------------------------------------------------- |
+| --------------------- | -------------------------------------------------------------------- |
-| Arrow keys            | `h` `j` `k` `l`                                     |
+| Arrow keys            | `h` `j` `k` `l`                                                      |
-| Words                 | `w` `b` `e` — `W` `B` `E` for WORD-style            |
+| Words                 | `w` `b` `e` — `W` `B` `E` for WORD-style                             |
-| Find char / till char | `f` `F` `t` `T` (not limited to current line)       |
+| Counts                | Prefix motions with a count: `2w`, `3e`, `2b`, `2x`                  |
-| Line / file           | `Home` / `End`; `gg` start or goto line; `G` line   |
+| Find char / till char | `f` `F` `t` `T` (not limited to current line)                        |
-| Half / full page      | `Ctrl-u` / `Ctrl-d`; `Ctrl-b` / `Ctrl-f`            |
+| Repeat find / till    | `Alt-.` repeats the last `f` / `t` selection                         |
-| Jumplist              | `Ctrl-o` back, `Ctrl-i` forward; `Ctrl-s` save spot |
+| Word-label jump       | `gw` shows two-character labels; type a label to jump, `Esc` cancels |
+| Line / file           | `Home` / `End`; `gg` start or goto line; `G` line                    |
+| Half / full page      | `Ctrl-u` / `Ctrl-d`; `Ctrl-b` / `Ctrl-f`                             |
+| Jumplist              | `Ctrl-o` back, `Ctrl-i` forward; `Ctrl-s` save spot                  |
 
 ### Selection & changes
 
-| Action                 | Keys / notes                                                      |
+| Action                 | Keys / notes                                                                |
-| ---------------------- | ----------------------------------------------------------------- |
+| ---------------------- | --------------------------------------------------------------------------- |
-| Extend selections      | `v` select mode; motions extend instead of moving                 |
+| Extend selections      | `v` select mode; motions extend instead of moving; `v` or `Esc` leaves mode |
-| Line selection         | `x` extend line; `X` line bounds                                  |
+| Line selection         | `x` extend line; `X` line bounds; repeat or use a count for more lines      |
-| Select all / regex     | `%`; `s` regex in selections; `S` split on regex                  |
+| Collapse selections    | `;` collapse selections back to cursors                                     |
-| Undo / redo            | `u` / `U`                                                         |
+| Select all / regex     | `%`; `s` regex in selections; `S` split on regex                            |
-| Delete / change / yank | `d` / `c` / `y` — acts on selection                               |
+| Multiple cursors       | `C` duplicate to next suitable line; `Alt-C` above; `,` remove one cursor   |
-| Paste                  | `p` / `P`; registers `"` …                                        |
+| Align selections       | `&` align selection contents                                                |
-| Insert                 | `i` `a` `I` `A` `o` `O`                                           |
+| Undo / redo            | `u` / `U`                                                                   |
-| Indent / format        | `>` / `<`; `=` format (LSP)                                       |
+| Delete / change / yank | `d` / `c` / `y` — acts on selection                                         |
-| Case                   | `~` toggle; lower/upper case via grave / `Alt-grave` (see keymap) |
+| Replace with yank      | `R` replace selection with yanked text                                      |
-| Join lines             | `J`; `Alt-J` join keeping space                                   |
+| Paste                  | `p` / `P`; registers `"` …                                                  |
+| Register prefix        | `"<char>` selects a register for yank/paste/macro operations                |
+| Insert                 | `i` `a` `I` `A` `o` `O`                                                     |
+| Repeat insert          | `.` repeat the last insertion                                               |
+| Replace selected chars | `r<char>`                                                                   |
+| Indent / format        | `>` / `<`; `=` format (LSP)                                                 |
+| Increment / decrement  | `Ctrl-a` / `Ctrl-x` on selected numbers                                     |
+| Case                   | `~` toggle; lower/upper case via grave / `Alt-grave` (see Alt caveat above) |
+| Join lines             | `J`; `Alt-J` join keeping space (see Alt caveat above)                      |
+| Toggle line comment    | `Ctrl-c`                                                                    |
+| Macro record / replay  | `Q` start/stop recording; `q` replay from the default `@` register          |
 
 ### Search
 
-| Action               | Keys                                     |
+| Action               | Keys                                                            |
-| -------------------- | ---------------------------------------- |
+| -------------------- | --------------------------------------------------------------- |
-| Search / reverse     | `/` / `?`                                |
+| Search / reverse     | `/` / `?`                                                       |
-| Next / prev match    | `n` / `N`                                |
+| Next / prev match    | `n` / `N`                                                       |
-| Selection as pattern | `*` (word bounds); `Alt-*` raw selection |
+| Selection as pattern | `*` (word bounds); `Alt-*` raw selection (see Alt caveat above) |
+| Split on newlines    | `Alt-s`                                                         |
 
 Use **extend mode** (`v`) with `n` / `N` to add matches to multi-cursors
 ([keymap](https://docs.helix-editor.com/keymap.html#select--extend-mode)).

home/base/core/editors/neovim/default.nix

@@ -1,7 +1,15 @@
-{ config, nixvim, ... }:
+{
+  config,
+  nixpkgs,
+  nixvim,
+  pkgs,
+  ...
+}:
 {
 
   imports = [ nixvim.homeModules.nixvim ];
+
+  programs.nixvim.nixpkgs.source = nixpkgs;
   home.shellAliases = {
 
     vi = "nvim";
@@ -11,7 +19,7 @@
   programs.nixvim = {
     enable = true;
 
-    clipboard.providers.wl-copy.enable = true;
+    clipboard.providers.wl-copy.enable = pkgs.stdenv.isLinux;
 
     opts = {
       number = true;

home/base/core/npm.nix

@@ -1,9 +1,14 @@
 { config, ... }:
 {
-  # 1. make `npm install -g <pkg>` happey
+  # make `npm install -g <pkg>` happey
-  # 2. set min-release-age for security
+  # npm - set min-release-age(in days) for supply-chain security
   home.file.".npmrc".text = ''
     prefix=${config.home.homeDirectory}/.npm
-    min-release-age=7
+    min-release-age=2
+  '';
+
+  # npm - set min release age (in minutes) for supply-chain security
+  xdg.configFile."pnpm/config.yaml".text = ''
+    minimumReleaseAge: 2880
   '';
 }

home/base/core/pip.nix

@@ -1,7 +1,14 @@
 _: {
-  # use mirror for pip install
+  # use pypi mirror
+  # filter packages via upload time for supply-chain security
   xdg.configFile."pip/pip.conf".text = ''
     [global]
     index-url = https://mirrors.bfsu.edu.cn/pypi/web/simple
+
+    [install]
+    uploaded-prior-to = P2D
+  '';
+  xdg.configFile."uv/uv.toml".text = ''
+    exclude-newer = "2 days"
   '';
 }

home/base/gui/terminal/ghostty.nix

@@ -12,9 +12,9 @@
     enable = true;
     package =
       if pkgs.stdenv.isDarwin then
-        pkgs.hello # pkgs.ghostty is currently broken on darwin
+        null # installed via Homebrew cask on darwin
       else
-        pkgs.ghostty; # the stable version
+        pkgs.ghostty;
     enableBashIntegration = false;
     installBatSyntax = false;
     # installVimSyntax = true;

home/base/gui/zed-editor.nix

@@ -0,0 +1,137 @@
+{ lib, ... }:
+{
+  catppuccin.zed.enable = true;
+
+  programs.zed-editor = {
+    enable = true;
+    mutableUserSettings = true;
+
+    userSettings = {
+      # Language-specific settings
+      languages = {
+        Python = {
+          formatter.language_server.name = "ruff";
+          language_servers = [
+            "ty"
+            "ruff"
+            "!basedpyright"
+            "!pyrefly"
+            "!pyright"
+            "!pylsp"
+          ];
+        };
+        Rust = {
+          hard_tabs = false;
+          formatter.language_server.name = "rust-analyzer";
+          language_servers = [
+            "rust-analyzer"
+            "!rustc"
+          ];
+        };
+        Go = {
+          formatter.language_server.name = "gopls";
+          language_servers = [
+            "gopls"
+            "!goimports"
+          ];
+        };
+      };
+
+      # Terminal
+      terminal.shell.with_arguments = {
+        program = "bash";
+        args = [
+          "--login"
+          "-c"
+          "nu --login --interactive"
+        ];
+      };
+
+      # Editor behavior
+      auto_signature_help = true;
+      autosave = "on_focus_change";
+      code_lens = "on";
+      completion_menu_item_kind = "symbol";
+      completions.lsp_fetch_timeout_ms = 2000;
+      diagnostics.inline.enabled = true;
+      document_folding_ranges = "off";
+      inlay_hints.enabled = true;
+      minimap.show = "auto";
+      relative_line_numbers = "enabled";
+      semantic_tokens = "combined";
+      soft_wrap = "editor_width";
+      vertical_scroll_margin = 5.0;
+      which_key.enabled = true;
+      indent_guides = {
+        background_coloring = "indent_aware";
+        coloring = "indent_aware";
+      };
+
+      # Search
+      search.regex = true;
+      use_smartcase_search = true;
+
+      # Formatting
+      prettier.allowed = true;
+
+      # UI chrome
+      tabs = {
+        file_icons = true;
+        git_status = true;
+      };
+      title_bar = {
+        show_branch_status_icon = true;
+        show_menus = false;
+        show_user_menu = true;
+      };
+
+      # Git
+      git.inline_blame.show_commit_summary = true;
+
+      # Modal editing
+      helix_mode = true;
+      vim = {
+        use_smartcase_find = true;
+        toggle_relative_line_numbers = true;
+      };
+
+      # Fonts
+      ui_font_family = lib.mkDefault "LXGW WenKai Screen";
+      ui_font_size = lib.mkDefault 16.0;
+      buffer_font_family = lib.mkDefault "Maple Mono NF CN";
+      buffer_font_size = lib.mkDefault 14.0;
+      agent_ui_font_size = lib.mkDefault 16.0;
+      agent_buffer_font_size = lib.mkDefault 15.0;
+
+      # App behavior
+      auto_update = false;
+      cli_default_open_behavior = "existing_window";
+
+      # AI/editor integrations
+      agent.play_sound_when_agent_done = "when_hidden";
+      agent_servers = {
+        opencode.type = "registry";
+        cursor.type = "registry";
+        codex-acp.type = "registry";
+        claude-acp.type = "registry";
+      };
+
+      # Privacy
+      edit_predictions.allow_data_collection = "no";
+      telemetry = {
+        diagnostics = false;
+        metrics = false;
+      };
+    };
+
+    extensions = [
+      "catppuccin"
+      "dockerfile"
+      "just"
+      "nix"
+      "nu"
+      "terraform"
+      "toml"
+    ];
+  };
+}

home/base/tui/canokey.nix

@@ -0,0 +1,6 @@
+{ pkgs, ... }:
+{
+  home.packages = with pkgs; [
+    pcsc-tools
+  ];
+}

home/base/tui/cloud/default.nix

@@ -21,16 +21,14 @@
     # pulumiPackages.pulumi-language-python
     # pulumiPackages.pulumi-language-nodejs
 
+    # doctl # digitalocean
+    aliyun-cli
     # aws
     awscli2
     ssm-session-manager-plugin # Amazon SSM Session Manager Plugin
     aws-iam-authenticator
     eksctl
 
-    # aliyun
-    aliyun-cli
-    # digitalocean
-    doctl
     # google cloud
     (pkgs-stable.google-cloud-sdk.withExtraComponents (
       with pkgs-stable.google-cloud-sdk.components;
@@ -38,6 +36,8 @@
         gke-gcloud-auth-plugin
       ]
     ))
+    google-cloud-sql-proxy
+    google-alloydb-auth-proxy
 
     # cloud tools that nix do not have cache for.
     terraform

home/base/tui/editors/packages.nix

@@ -16,11 +16,7 @@
         deadnix # Find and remove unused code in .nix source files
         nixfmt # Nix Code Formatter
 
-        #-- nickel lang
-        nickel
-
         #-- json like
-        # terraform  # install via brew on macOS
         terraform-ls
         jsonnet
         jsonnet-language-server
@@ -66,23 +62,18 @@
           (python313.withPackages (
             ps: with ps; [
               # python language server
-              pyright
+              ty
               ruff
 
-              black # python formatter
-
               # my commonly used python packages
               jupyter
               ipython
               pandas
+              numpy
               requests
               pyquery
               pyyaml
-              boto3
-
-              # misc
               protobuf # protocol buffer compiler
-              numpy
             ]
           ))
 
@@ -104,14 +95,11 @@
           delve # go debugger
 
           # -- java
-          jdk17
+          # jdk25
-          gradle
+          # gradle
-          maven
+          # maven
-          spring-boot-cli
+          # spring-boot-cli
-          jdt-language-server
+          # jdt-language-server
-
-          #-- zig
-          zls
 
           #-- lua
           stylua
@@ -134,23 +122,9 @@
         tailwindcss-language-server
         emmet-ls
       ]
-      # -*- Lisp like Languages -*-#
-      # ++ [
-      #   guile
-      #   racket-minimal
-      #   fnlfmt # fennel
-      #   (
-      #     if pkgs.stdenv.isLinux && pkgs.stdenv.isx86
-      #     then pkgs-master.akkuPackages.scheme-langserver
-      #     else pkgs.emptyDirectory
-      #   )
-      # ]
       ++ [
         proselint # English prose linter
 
-        #-- verilog / systemverilog
-        verible
-
         #-- Optional Requirements:
         prettier # common code formatter
         fzf

home/base/tui/shell/default.nix

@@ -14,13 +14,10 @@
 
       $env.CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC = "1"
       $env.CLAUDE_CODE_ATTRIBUTION_HEADER = "0"
-      # using claude-code with kimi llm
+
-      # https://platform.moonshot.cn/docs/guide/agent-support
+      # for work
-      # $env.ANTHROPIC_BASE_URL = "https://api.moonshot.cn/anthropic/"
+      $env.ANTHROPIC_BASE_URL = $env.WORK_ANTHROPIC_BASE_URL
-      # $env.ANTHROPIC_AUTH_TOKEN = $env.MOONSHOT_API_KEY
+      $env.ANTHROPIC_AUTH_TOKEN = $env.WORK_ANTHROPIC_AUTH_TOKEN
-      # $env.ANTHROPIC_DEFAULT_OPUS_MODEL = "kimi-k2.5"
-      # $env.ANTHROPIC_DEFAULT_SONNET_MODEL = "kimi-k2.5"
-      # $env.ANTHROPIC_DEFAULT_HAIKU_MODEL = "kimi-k2.5"
 
       # using claude-code with glm llm
       # https://docs.bigmodel.cn/cn/coding-plan/tool/claude
@@ -30,16 +27,6 @@
       # $env.ANTHROPIC_DEFAULT_SONNET_MODEL = "glm-5-turbo"
       # $env.ANTHROPIC_DEFAULT_HAIKU_MODEL = "glm-4.5-air"
 
-      # using claude-code with minimax llm
-      # https://platform.minimax.io/docs/token-plan/claude-code
-      # $env.ANTHROPIC_BASE_URL = "https://api.minimax.io/anthropic"
-      # $env.ANTHROPIC_AUTH_TOKEN = $env.MINIMAX_API_KEY
-      # $env.ANTHROPIC_MODEL = "MiniMax-M2.7"
-      # $env.ANTHROPIC_DEFAULT_OPUS_MODEL = "MiniMax-M2.7"
-      # $env.ANTHROPIC_DEFAULT_SONNET_MODEL = "MiniMax-M2.7"
-      # $env.ANTHROPIC_DEFAULT_HAIKU_MODEL = "MiniMax-M2.7"
-
-
       # Directories in this constant are searched by the
       # `use` and `source` commands.
       const NU_LIB_DIRS = $NU_LIB_DIRS ++ ['${nu_scripts}']

home/base/tui/ssh.nix

@@ -9,42 +9,32 @@
   programs.ssh = {
     enable = true;
 
-    # default config
     enableDefaultConfig = false;
-    matchBlocks."*" = {
+    settings."*" = {
-      forwardAgent = false;
+      ForwardAgent = false;
-      # "a private key that is used during authentication will be added to ssh-agent if it is running"
+      AddKeysToAgent = "yes";
-      addKeysToAgent = "yes";
+      Compression = true;
-      compression = true;
+      ServerAliveInterval = 0;
-      serverAliveInterval = 0;
+      ServerAliveCountMax = 3;
-      serverAliveCountMax = 3;
+      HashKnownHosts = false;
-      hashKnownHosts = false;
+      UserKnownHostsFile = "~/.ssh/known_hosts";
-      userKnownHostsFile = "~/.ssh/known_hosts";
+      ControlMaster = "no";
-      controlMaster = "no";
+      ControlPath = "~/.ssh/master-%r@%n:%p";
-      controlPath = "~/.ssh/master-%r@%n:%p";
+      ControlPersist = "no";
-      controlPersist = "no";
     };
 
-    matchBlocks = {
+    settings = {
       "github.com" = {
-        # "Using SSH over the HTTPS port for GitHub"
+        HostName = "ssh.github.com";
-        # "(port 22 is banned by some proxies / firewalls)"
+        Port = 443;
-        hostname = "ssh.github.com";
+        User = "git";
-        port = 443;
+        IdentitiesOnly = true;
-        user = "git";
-
-        # Specifies that ssh should only use the identity file explicitly configured above
-        # required to prevent sending default identity files first.
-        identitiesOnly = true;
       };
 
       "192.168.*" = {
-        # "allow to securely use local SSH agent to authenticate on the remote machine."
+        ForwardAgent = true;
-        # "It has the same effect as adding cli option `ssh -A user@host`"
+        IdentityFile = "/etc/agenix/ssh-key-romantic";
-        forwardAgent = true;
+        IdentitiesOnly = true;
-        # "romantic holds my homelab~"
-        identityFile = "/etc/agenix/ssh-key-romantic";
-        identitiesOnly = true;
       };
     };
   };

home/darwin/aerospace/aerospace.toml

@@ -280,10 +280,6 @@ run = ['layout floating', 'move-node-to-workspace 9File']
 if.app-id = 'com.apple.Preview'
 run = ['layout floating', 'move-node-to-workspace 9File']
 
-[[on-window-detected]]
-if.app-id = 'com.microsoft.VSCode'
-run = ['layout floating', 'move-node-to-workspace 9File']
-
 [[on-window-detected]]
 if.app-id = 'com.todesktop.230313mzl4w4u92' # Cursor AI Editor
 run = ['layout floating', 'move-node-to-workspace 9File']

home/hosts/darwin/darwin-fern.nix

@@ -5,6 +5,5 @@ in
 {
   imports = [ ../../darwin ];
 
-  programs.ssh.matchBlocks."github.com".identityFile =
+  programs.ssh.settings."github.com".IdentityFile = "${config.home.homeDirectory}/.ssh/${hostName}";
-    "${config.home.homeDirectory}/.ssh/${hostName}";
 }

home/hosts/darwin/darwin-frieren.nix

@@ -5,6 +5,5 @@ in
 {
   imports = [ ../../darwin ];
 
-  programs.ssh.matchBlocks."github.com".identityFile =
+  programs.ssh.settings."github.com".IdentityFile = "${config.home.homeDirectory}/.ssh/${hostName}";
-    "${config.home.homeDirectory}/.ssh/${hostName}";
 }

home/hosts/linux/12kingdoms-shoukei.nix

@@ -6,8 +6,7 @@ in
 {
   imports = [ ../../linux/gui.nix ];
 
-  programs.ssh.matchBlocks."github.com".identityFile =
+  programs.ssh.settings."github.com".IdentityFile = "${config.home.homeDirectory}/.ssh/${hostName}";
-    "${config.home.homeDirectory}/.ssh/${hostName}";
 
   modules.desktop.gaming.enable = false;
   modules.desktop.niri.enable = true;

home/hosts/linux/idols-ai.nix

@@ -5,12 +5,19 @@ in
 {
   imports = [ ../../linux/gui.nix ];
 
-  programs.ssh.matchBlocks."github.com".identityFile = "${config.home.homeDirectory}/.ssh/idols-ai";
+  programs.ssh.settings."github.com".IdentityFile = "${config.home.homeDirectory}/.ssh/idols-ai";
 
   modules.desktop.gaming.enable = true;
   modules.desktop.niri.enable = true;
   modules.desktop.nvidia.enable = true;
 
+  programs.zed-editor.userSettings = {
+    ui_font_size = 18.0;
+    buffer_font_size = 17.0;
+    agent_ui_font_size = 18.0;
+    agent_buffer_font_size = 17.0;
+  };
+
   xdg.configFile."niri/niri-hardware.kdl".source =
     mkSymlink "${config.home.homeDirectory}/nix-config/hosts/idols-ai/niri-hardware.kdl";
 }

home/hosts/linux/idols-aquamarine.nix

@@ -1,21 +1,3 @@
 {
-  programs.gh.enable = true;
+  imports = [ ../../linux/core.nix ];
-  programs.git.enable = true;
-
-  programs.zellij.enable = true;
-  programs.bash.enable = true;
-  programs.nushell.enable = true;
-
-  programs.starship = {
-    enable = true;
-    enableBashIntegration = true;
-    enableNushellIntegration = true;
-  };
-  programs.neovim = {
-    enable = true;
-    viAlias = true;
-    vimAlias = true;
-  };
-
-  home.stateVersion = "25.11";
 }

home/hosts/linux/idols-kana.nix

@@ -1,3 +1,3 @@
 {
-  imports = [ ./idols-aquamarine.nix ];
+  imports = [ ../../linux/core.nix ];
 }

home/hosts/linux/idols-ruby.nix

@@ -1,3 +1,3 @@
 {
-  imports = [ ./idols-aquamarine.nix ];
+  imports = [ ../../linux/core.nix ];
 }

home/linux/base/tools.nix

@@ -5,13 +5,5 @@
     # misc
     libnotify
     wireguard-tools # manage wireguard vpn manually, via wg-quick
-
-    virt-viewer # vnc connect to VM, used by kubevirt
   ];
-
-  # auto mount usb drives
-  services = {
-    udiskie.enable = true;
-    # syncthing.enable = true;
-  };
 }

home/linux/gui/base/creative.nix

@@ -1,12 +1,13 @@
 {
   lib,
   pkgs,
+  pkgs-stable,
   blender-bin,
   ...
 }:
 {
   home.packages =
-    with pkgs;
+    with pkgs-stable;
     [
       # creative
       # gimp      # image editing, I prefer using figma in browser instead of this one

home/linux/gui/base/desktop-tools.nix

@@ -27,6 +27,8 @@
     flameshot
     hyprshot # screen shot
     wf-recorder # screen recording
+
+    virt-viewer # vnc connect to VM, used by kubevirt
   ];
 
   # screen locker
@@ -34,4 +36,10 @@
 
   # Logout Menu
   programs.wlogout.enable = true;
+
+  # auto mount usb drives
+  services = {
+    udiskie.enable = true;
+    # syncthing.enable = true;
+  };
 }

home/linux/gui/base/editors.nix

@@ -1,19 +0,0 @@
-{
-  lib,
-  pkgs-master,
-  ...
-}:
-
-{
-  programs.vscode = {
-    enable = true;
-    package = pkgs-master.vscode.override {
-      commandLineArgs = [
-        # https://code.visualstudio.com/docs/configure/settings-sync#_recommended-configure-the-keyring-to-use-with-vs-code
-        # For use with any package that implements the Secret Service API
-        # (for example gnome-keyring, kwallet5, KeepassXC)
-        "--password-store=gnome-libsecret"
-      ];
-    };
-  };
-}

home/linux/gui/base/misc.nix

@@ -24,4 +24,5 @@
   # allow fontconfig to discover fonts and configurations installed through home.packages
   # Install fonts at system-level, not user-level
   fonts.fontconfig.enable = false;
+
 }

home/linux/gui/base/noctalia/config/settings.json

@@ -176,8 +176,8 @@
           "unreadBadgeColor": "primary"
         },
         {
-          "deviceNativePath": "",
+          "deviceNativePath": "__default__",
-          "displayMode": "alwaysShow",
+          "displayMode": "icon-always",
           "hideIfIdle": false,
           "hideIfNotDetected": true,
           "id": "Battery",
@@ -221,7 +221,12 @@
     }
   },
   "brightness": {
-    "backlightDeviceMappings": [],
+    "backlightDeviceMappings": [
+      {
+        "device": "/sys/class/backlight/apple-panel-bl",
+        "output": "eDP-1"
+      }
+    ],
     "brightnessStep": 3,
     "enableDdcSupport": false,
     "enforceMinimum": true

home/linux/gui/base/xdg/mime.nix

@@ -18,10 +18,9 @@
           "firefox.desktop"
         ];
         editor = [
+          "dev.zed.Zed.desktop"
           "nvim.desktop"
           "Helix.desktop"
-          "code.desktop"
-          "code-insiders.desktop"
         ];
       in
       {
@@ -48,9 +47,6 @@
         "x-scheme-handler/ftp" = browser; # open `ftp:` url with `browser`
         "x-scheme-handler/http" = browser;
         "x-scheme-handler/https" = browser;
-        # https://github.com/microsoft/vscode/issues/146408
-        "x-scheme-handler/vscode" = [ "code-url-handler.desktop" ]; # open `vscode://` url with `code-url-handler.desktop`
-        "x-scheme-handler/vscode-insiders" = [ "code-insiders-url-handler.desktop" ]; # open `vscode-insiders://` url with `code-insiders-url-handler.desktop`
         "x-scheme-handler/zoommtg" = [ "Zoom.desktop" ];
 
         # all other unknown schemes will be opened by this default application.

hosts/idols-ai/README.md

@@ -82,7 +82,6 @@ nvme0n1           259:0    0  1.8T  0 disk
                                             /home/ryan/.zoom
                                             /home/ryan/Documents
                                             /home/ryan/.wakatime
-                                            /home/ryan/.vscode
                                             /home/ryan/.var
                                             /home/ryan/.terraform.d/plugin-cache
                                             /home/ryan/.steam
@@ -106,6 +105,7 @@ nvme0n1           259:0    0  1.8T  0 disk
                                             /home/ryan/.local/share/password-store
                                             /home/ryan/.local/share/opencode
                                             /home/ryan/.local/share/nvim
+                                            /home/ryan/.local/share/zed
                                             /home/ryan/.local/share/nix
                                             /home/ryan/.local/share/krita
                                             /home/ryan/.local/share/lutris
@@ -140,6 +140,7 @@ nvme0n1           259:0    0  1.8T  0 disk
                                             /home/ryan/.config/obs-studio
                                             /home/ryan/.config/mozc
                                             /home/ryan/.config/nushell
+                                            /home/ryan/.config/zed
                                             /home/ryan/.config/lutris
                                             /home/ryan/.config/joplin
                                             /home/ryan/.config/heroic
@@ -151,7 +152,6 @@ nvme0n1           259:0    0  1.8T  0 disk
                                             /home/ryan/.config/LDtk
                                             /home/ryan/.config/Joplin
                                             /home/ryan/.config/Cursor
-                                            /home/ryan/.config/Code
                                             /home/ryan/.conda
                                             /home/ryan/.cargo
                                             /home/ryan/.codex

hosts/idols-ai/preservation.nix

@@ -133,9 +133,9 @@ in
         # neovim plugins
         ".wakatime"
 
-        # vscode
+        # zed
-        ".vscode"
+        ".config/zed"
-        ".config/Code"
+        ".local/share/zed"
 
         # cursor ai editor / cli
         ".cursor"

hosts/idols-akane/default.nix

@@ -15,6 +15,9 @@ in
 {
   imports = (mylib.scanPaths ./.) ++ [
     disko.nixosModules.default
+
+    ../idols-ruby/packages.nix
+    ../idols-ruby/oci-containers
   ];
 
   # supported file systems, so we can mount any removable disks with these filesystems

hosts/idols-akane/packages.nix

@@ -1,54 +0,0 @@
-{ pkgs, ... }:
-{
-  # https://github.com/Mic92/nix-ld
-  #
-  # nix-ld will install itself at `/lib64/ld-linux-x86-64.so.2` so that
-  # it can be used as the dynamic linker for non-NixOS binaries.
-  #
-  # nix-ld works like a middleware between the actual link loader located at `/nix/store/.../ld-linux-x86-64.so.2`
-  # and the non-NixOS binaries. It will:
-  #
-  #   1. read the `NIX_LD` environment variable and use it to find the actual link loader.
-  #   2. read the `NIX_LD_LIBRARY_PATH` environment variable and use it to set the `LD_LIBRARY_PATH` environment variable
-  #      for the actual link loader.
-  #
-  # nix-ld's nixos module will set default values for `NIX_LD` and `NIX_LD_LIBRARY_PATH` environment variables, so
-  # it can work out of the box:
-  #
-  #  - https://github.com/NixOS/nixpkgs/blob/nixos-26.05/nixos/modules/programs/nix-ld.nix#L42-L45
-  #
-  # You can overwrite `NIX_LD_LIBRARY_PATH` in the environment where you run the non-NixOS binaries to customize the
-  # search path for shared libraries.
-  programs.nix-ld = {
-    enable = true;
-    libraries = with pkgs; [
-      stdenv.cc.cc
-    ];
-  };
-
-  environment.systemPackages = with pkgs; [
-    nodejs_24
-    pnpm
-
-    #-- python
-    conda
-    uv # python project package manager
-    (python313.withPackages (
-      ps: with ps; [
-        pandas
-        requests
-        pyquery
-        pyyaml
-        numpy
-
-        # model downloaders
-        huggingface-hub
-        modelscope
-      ]
-    ))
-
-    rustc
-    cargo # rust package manager
-    go
-  ];
-}

hosts/idols-ruby/packages.nix

@@ -1,4 +1,4 @@
-{ pkgs, ... }:
+{ pkgs, llm-agents, ... }:
 {
   # https://github.com/Mic92/nix-ld
   #
@@ -26,55 +26,68 @@
     ];
   };
 
-  environment.systemPackages = with pkgs; [
+  environment.systemPackages =
-    nodejs_24
+    with pkgs;
-    pnpm
+    [
+      nodejs_24
+      pnpm
 
-    #-- python
+      #-- python
-    conda
+      conda
-    uv # python project package manager
+      uv # python project package manager
-    (python313.withPackages (
+      (python313.withPackages (
-      ps: with ps; [
+        ps: with ps; [
-        pandas
+          pandas
-        requests
+          requests
-        pyquery
+          pyquery
-        pyyaml
+          pyyaml
-        numpy
+          numpy
 
-        # model downloaders
+          # model downloaders
-        huggingface-hub
+          huggingface-hub
-        modelscope
+          modelscope
-      ]
+        ]
-    ))
+      ))
 
-    rustc
+      rustc
-    cargo # rust package manager
+      cargo # rust package manager
-    go
+      go
 
-    # cryptography
+      # cryptography
-    age
+      age
-    sops
+      sops
-    rclone
+      rclone
-    gnupg
+      gnupg
 
-    # cloud-native
+      # cloud-native
-    kubectl
+      kubectl
-    istioctl
+      istioctl
-    kubevirt # virtctl
+      kubevirt # virtctl
-    kubernetes-helm
+      kubernetes-helm
-    fluxcd
+      fluxcd
-    terraform
+      terraform
 
-    # db related
+      # db related
-    pgcli
+      pgcli
-    mongosh
+      mongosh
-    sqlite
+      sqlite
 
-    yt-dlp # youtube/bilibili/soundcloud/... video/music downloader
+      yt-dlp # youtube/bilibili/soundcloud/... video/music downloader
 
-    # need to run `conda-install` before using it
+      # need to run `conda-install` before using it
-    # need to run `conda-shell` before using command `conda`
+      # need to run `conda-shell` before using command `conda`
-    # conda is not available for MacOS
+      # conda is not available for MacOS
-    conda
+      conda
-  ];
+    ]
+    # AI Agent Tools
+    ++ (with llm-agents.packages.${pkgs.stdenv.hostPlatform.system}; [
+      # Agents
+      codex
+      cursor-cli
+      claude-code
+      opencode
+
+      # Utilities
+      rtk # CLI proxy that reduces LLM token consumption
+    ]);
 }

modules/darwin/apps.nix

@@ -70,6 +70,8 @@ in
     nushell # my custom shell
     gnugrep # replacee macos's grep
     gnutar # replacee macos's tar
+    pcsclite
+    pcsc-tools
   ];
   environment.variables = {
     # Fix https://github.com/LnL7/nix-darwin/wiki/Terminfo-issues
@@ -101,7 +103,7 @@ in
 
     onActivation = {
       autoUpdate = true; # Fetch the newest stable branch of Homebrew's git repo
-      upgrade = true; # Upgrade outdated casks, formulae, and App Store apps
+      upgrade = false; # Upgrade outdated casks, formulae, and App Store apps
       # 'zap': uninstalls all formulae(and related files) not listed in the generated Brewfile
       cleanup = "zap";
     };
@@ -111,6 +113,9 @@ in
     # otherwise Apple Store will refuse to install them.
     # For details, see https://github.com/mas-cli/mas
     masApps = {
+      Keynote = 409183694;
+      Slack = 803453959;
+      WireGuard = 1451685025;
       # Xcode = 497799835;
       Wechat = 836500024;
     };
@@ -136,11 +141,6 @@ in
       # commands like `gsed` `gtar` are required by some tools
       "gnu-sed"
       "gnu-tar"
-
-      # misc that nix do not have cache for.
-      "git-trim"
-      "hashicorp/tap/terraform"
-      "terraformer"
     ];
 
     taps = [
@@ -153,10 +153,7 @@ in
       "firefox"
       "google-chrome"
 
-      # code editor
+      # "nikitabobko/tap/aerospace" # an i3-like tiling window manager for macOS
-      "visual-studio-code"
-
-      "nikitabobko/tap/aerospace" # an i3-like tiling window manager for macOS
       "ghostty" # terminal emulator
 
       # container & vm
@@ -168,9 +165,6 @@ in
       "tailscale-app" # tailscale macos app (with gui)
       # "netbirdio/tap/netbird-ui" # netbird gui app
 
-      # AI
-      "lm-studio"
-
       # IM & audio & remote desktop & meeting
       "telegram"
       "qq"
@@ -194,7 +188,6 @@ in
 
       # Development
       "mitmproxy" # HTTP/HTTPS traffic inspector
-      "insomnia" # REST client
       "wireshark-app" # network analyzer
       # "google-cloud-sdk" # Google Cloud SDK
       "miniforge" # Miniconda's community-driven distribution

modules/darwin/broken-packages.nix

@@ -4,20 +4,10 @@
 # ===================================================================
 let
   brokenPackages = [
-    "terraform"
-    "terraformer"
-    "packer"
-    "git-trim"
     "conda"
     "mitmproxy"
-    "insomnia"
     "wireshark"
-    "jsonnet"
-    "zls"
     "verible"
-    "gdb"
-    "ncdu"
-    "racket-minimal"
   ];
 in
 {

modules/nixos/base/user-group.nix

@@ -39,6 +39,7 @@
       "wireshark"
       "adbusers" # android debugging
       "libvirtd" # virt-viewer / qemu
+      "plugdev" # canokey / openocd udev
       "fileshare"
     ];
   };

modules/nixos/desktop/canokey.nix

@@ -0,0 +1,37 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}:
+let
+  cfg = config.modules.desktop.canokey;
+in
+{
+  options.modules.desktop.canokey = {
+    enable = lib.mkEnableOption "CanoKey hardware security key support";
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.pcscd.enable = true;
+
+    services.udev.extraRules = ''
+      # CanoKey - GnuPG/pcsclite
+      SUBSYSTEM!="usb", GOTO="canokey_rules_end"
+      ACTION!="add|change", GOTO="canokey_rules_end"
+      ATTRS{idVendor}=="20a0", ATTRS{idProduct}=="42d4", ENV{ID_SMARTCARD_READER}="1"
+      LABEL="canokey_rules_end"
+
+      # CanoKey - FIDO2
+      KERNEL=="hidraw*", SUBSYSTEM=="hidraw", ATTRS{idVendor}=="20a0", ATTRS{idProduct}=="42d4", TAG+="uaccess", GROUP="plugdev", MODE="0660"
+
+      # CanoKey - WebUSB
+      SUBSYSTEMS=="usb", ATTR{idVendor}=="20a0", ATTR{idProduct}=="42d4", MODE:="0666"
+    '';
+
+    environment.systemPackages = with pkgs; [
+      ccid
+      pcsc-tools
+    ];
+  };
+}

modules/nixos/desktop/xdg.nix

@@ -48,7 +48,6 @@
     # which resolves bugs involving programs opening inside FHS envs or with unexpected env vars set from wrappers.
     # xdg-open is used by almost all programs to open a unknown file/uri
     # alacritty as an example, it use xdg-open as default, but you can also custom this behavior
-    # and vscode has open like `External Uri Openers`
     xdgOpenUsePortal = true;
 
     # ls /run/current-system/sw/share/xdg-desktop-portal/portals/

outputs/aarch64-linux/src/12kingdoms-shoukei.nix

@@ -34,6 +34,7 @@ let
           modules.secrets.preservation.enable = true;
           # not supported yet
           modules.desktop.gaming.enable = false;
+          modules.desktop.canokey.enable = true;
         }
       ];
     home-modules = map mylib.relativeToRoot [

outputs/x86_64-linux/src/idols-ai.nix

@@ -34,6 +34,7 @@ let
           modules.secrets.desktop.enable = true;
           modules.secrets.preservation.enable = true;
           modules.desktop.gaming.enable = true;
+          modules.desktop.canokey.enable = true;
         }
       ];
     home-modules = map mylib.relativeToRoot [

utils.nu

@@ -14,6 +14,8 @@ export def nixos-switch [
         # show details via nix-output-monitor
         nom build $".#nixosConfigurations.($name).config.system.build.toplevel" --show-trace --verbose
         nixos-rebuild switch --sudo --flake $".#($name)" --show-trace --verbose
+    } else if "boot" == $mode {
+        nixos-rebuild boot --sudo --flake $".#($name)"
     } else {
         nixos-rebuild switch --sudo --flake $".#($name)"
     }