chore: remove useless comments

flake.lock: Update
Flake lock file updates: • Updated input 'nixpkgs': 'github:NixOS/nixpkgs/3d46470bb3030020f7e1361f33514854f5bfa86d?narHash=sha256-PkBPmP5ofNtunCU7/tfn6wi9OLlzFGcHAqqmY%2B/mwUI%3D' (2026-06-27) → 'github:NixOS/nixpkgs/d407951447dcd00442e97087bf374aad70c04cea?narHash=sha256-8i/87eeoqiGE4yOTjwSA3Eh/ziJRQEmd/unYU%2BK27sk%3D' (2026-07-05)
2026-07-07 21:35:17 +02:00 · 2026-07-06 23:04:16 +08:00 · 2026-07-06 23:04:16 +08:00 · 2026-07-06 23:04:16 +08:00 · 2026-07-06 22:01:23 +08:00 · 2026-07-06 22:01:18 +08:00
59 changed files with 484 additions and 501 deletions
@@ -141,6 +141,11 @@ niri mode="default":
 #
 ############################################################################
 [macos]
 [group('desktop')]
 brew-upgrade:
  brew upgrade --cask --greedy
 [macos]
 [group('desktop')]
 darwin-set-proxy:
@@ -31,7 +31,7 @@ If rules conflict, follow the higher-priority source and state the conflict brie
 - Never write secret literals into tracked files.
 - Use environment variables, secret managers, or placeholders.
 - Redact sensitive output in logs and summaries.
- For infra/IaC changes, prefer plan/eval/check before apply/switch.
+- For infra/IaC changes, prefer plan/eval/check before apply/deploy.
 ## 4) Scope Discipline
@@ -48,35 +48,35 @@ If rules conflict, follow the higher-priority source and state the conflict brie
 ## 6) Tooling Defaults
 - Use Bash only for quick one-offs, Nushell for personal tooling, Python for everything else.
 - Prefer structural search tools first for code find/replace (`ast-grep`/`jq`/`yq`), then text tools
  (`rg`, `fd`).
- Prefer project task runners (`just`, `make`, `task`, `npm scripts`, etc.) over ad-hoc commands
+- Prefer project task runners (`just`, `make`, `npm scripts`, etc.) over ad-hoc commands when
-  when equivalent.
+  equivalent.
- If a required command is not already available, use only `nix run`, `flake.nix`/`shell.nix` or
+- Only use `nix run`, `flake.nix`/`shell.nix`, or `uv`/`pnpm` for missing commands & packages.
-  `uv`/`pnpm` to provide it.
+  Otherwise, ask the user—never use another installer.
 - If that is still insufficient, stop and ask the user to prepare the environment instead of using
  any other installation method.
 - Use `gh` CLI for GitHub operations, especially code/PR/issue search and inspection.
 ## 7) Environment Defaults
- Primary OS: NixOS.
+- Primary OS: NixOS & macOS.
- Shell: default to `nushell`, `bash` also exists.
+- Shell: default to Nushell, Bash also exists.
 ## 8) Script Engineering Principles
 Treat scripts as interruptible jobs that must be diagnosable and safe to rerun:
- Split workflows into explicit stages; allow running a selected stage via flags/arguments.
+- Verbose logging of progress, decisions, and errors.
- Make reruns idempotent; persist progress after each stage and support resume.
+- Stage workflows with selective execution via cli flags.
- Cache external data with invalidation strategy to speed retries and improve reproducibility.
+- Idempotent reruns; persist progress and support resume.
- For HTTP flows, separate transport success from business success; support retry/backoff.
+- Cache external data with invalidation.
- Provide independent verification commands/checks for key outputs (counts, samples, invariants).
+- Separate HTTP transport from business success; retry with backoff.
 - Verify key outputs independently.
 ## 9) Communication Defaults
 - Respond in the language the user is currently using, prefer English & Chinese.
- Code, commands, identifiers, and code comments: English.
+- Code, commands, identifiers, and code comments: Prefer English.
 - Be concise, concrete, and action-oriented.
 ## 10) Project Overlay
@@ -127,11 +127,11 @@
    },
    "crane": {
      "locked": {
-        "lastModified": 1765145449,
+        "lastModified": 1781825982,
-        "narHash": "sha256-aBVHGWWRzSpfL++LubA0CwOOQ64WNLegrYHwsVuVN7A=",
+        "narHash": "sha256-SlXKwIRIhrOSAcTjCB3ftPLzJWZStQIPS7J1FlZPnKk=",
        "owner": "ipetkov",
        "repo": "crane",
-        "rev": "69f538cdce5955fcd47abfed4395dc6d5194c1c5",
+        "rev": "469fd08d0bcf6926321fa973c6777fbc87785dd7",
        "type": "github"
      },
      "original": {
@@ -186,15 +186,15 @@
    "flake-compat": {
      "flake": false,
      "locked": {
-        "lastModified": 1761588595,
+        "lastModified": 1767039857,
-        "narHash": "sha256-XKUZz9zewJNUj46b4AJdiRZJAvSZ0Dqj2BNfXvFlJC4=",
+        "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
-        "owner": "edolstra",
+        "owner": "NixOS",
        "repo": "flake-compat",
-        "rev": "f387cd2afec9419c8ee37694406ca490c3f34ee5",
+        "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
        "type": "github"
      },
      "original": {
-        "owner": "edolstra",
+        "owner": "NixOS",
        "repo": "flake-compat",
        "type": "github"
      }
@@ -327,24 +327,6 @@
        "type": "github"
      }
    },
    "flake-utils": {
      "inputs": {
        "systems": "systems_4"
      },
      "locked": {
        "lastModified": 1681202837,
        "narHash": "sha256-H+Rh19JDwRtpVPAWp64F+rlEtxUWBAQW28eAi3SRSzg=",
        "owner": "numtide",
        "repo": "flake-utils",
        "rev": "cfacdce06f30d2b68473a46042957675eebb3401",
        "type": "github"
      },
      "original": {
        "owner": "numtide",
        "repo": "flake-utils",
        "type": "github"
      }
    },
    "git-hooks": {
      "inputs": {
        "flake-compat": "flake-compat_2",
@@ -531,16 +513,16 @@
        "rust-overlay": "rust-overlay"
      },
      "locked": {
-        "lastModified": 1765382359,
+        "lastModified": 1782141370,
-        "narHash": "sha256-RJmgVDzjRI18BWVogG6wpsl1UCuV6ui8qr4DJ1LfWZ8=",
+        "narHash": "sha256-hqijVSEETttmo8Okql9/LG0Ua34hdciKW1a5zzlj8mU=",
        "owner": "nix-community",
        "repo": "lanzaboote",
-        "rev": "e8c096ade12ec9130ff931b0f0e25d2f1bc63607",
+        "rev": "7c9a54a7f87b4539ddbd8bda09a8a5f5f9361aa9",
        "type": "github"
      },
      "original": {
        "owner": "nix-community",
-        "ref": "v1.0.0",
+        "ref": "v1.1.0",
        "repo": "lanzaboote",
        "type": "github"
      }
@@ -555,11 +537,11 @@
        "treefmt-nix": "treefmt-nix"
      },
      "locked": {
-        "lastModified": 1780275889,
+        "lastModified": 1782695301,
-        "narHash": "sha256-srcKWB7mBO+mNWsDUmODs5CDDdQ0XjP1NX4iUM45eZo=",
+        "narHash": "sha256-X1xqgUNcYI/UWxDW8W1DC7OEMOjOhTtwWc8v+MGMasY=",
        "owner": "numtide",
        "repo": "llm-agents.nix",
-        "rev": "468bacd83af1b3bf36bceb0366967928b98c9e60",
+        "rev": "76948750034d89409ac9224173f52ffc05afe946",
        "type": "github"
      },
      "original": {
@@ -588,10 +570,10 @@
    "mysecrets": {
      "flake": false,
      "locked": {
-        "lastModified": 1780453481,
+        "lastModified": 1781242064,
-        "narHash": "sha256-kH3iAbIuRVtB8VOjQrV10HtxO1z22fwUH8oFVfJoFVE=",
+        "narHash": "sha256-Bn9mOj7CkdnepiwkiGiHPpvZs0HYrQsjB4Z+EJE+v+s=",
        "ref": "refs/heads/main",
-        "rev": "0e2b90e6d57dfa70c0527c3a4d399bde82998f78",
+        "rev": "490e3aca901fa703083822ee64a65f0a1f4529af",
        "shallow": true,
        "type": "git",
        "url": "ssh://git@github.com/ryan4yin/nix-secrets.git"
@@ -644,21 +626,6 @@
        "type": "github"
      }
    },
    "nixlib": {
      "locked": {
        "lastModified": 1736643958,
        "narHash": "sha256-tmpqTSWVRJVhpvfSN9KXBvKEXplrwKnSZNAoNPf/S/s=",
        "owner": "nix-community",
        "repo": "nixpkgs.lib",
        "rev": "1418bc28a52126761c02dd3d89b2d8ca0f521181",
        "type": "github"
      },
      "original": {
        "owner": "nix-community",
        "repo": "nixpkgs.lib",
        "type": "github"
      }
    },
    "nixos-apple-silicon": {
      "inputs": {
        "flake-compat": "flake-compat_3",
@@ -680,27 +647,6 @@
        "type": "github"
      }
    },
    "nixos-generators": {
      "inputs": {
        "nixlib": "nixlib",
        "nixpkgs": [
          "nixpkgs"
        ]
      },
      "locked": {
        "lastModified": 1769813415,
        "narHash": "sha256-nnVmNNKBi1YiBNPhKclNYDORoHkuKipoz7EtVnXO50A=",
        "owner": "nix-community",
        "repo": "nixos-generators",
        "rev": "8946737ff703382fda7623b9fab071d037e897d5",
        "type": "github"
      },
      "original": {
        "owner": "nix-community",
        "repo": "nixos-generators",
        "type": "github"
      }
    },
    "nixpak": {
      "inputs": {
        "flake-parts": "flake-parts_3",
@@ -725,11 +671,11 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1780030872,
+        "lastModified": 1782175435,
-        "narHash": "sha256-u6WU/yd/o8iYQrHX3RAwO1hYa3LkoSL+WNQD0rJfJZQ=",
+        "narHash": "sha256-EMzXKmnOtBQ2MnvpiNOm7E+kOMvdPrIKaeg52Tip2Uk=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "e9a7635a57597d9754eccebdfc7045e6c8600e6b",
+        "rev": "89570f24e97e614aa34aa9ab1c927b6578a43775",
        "type": "github"
      },
      "original": {
@@ -788,11 +734,11 @@
    },
    "nixpkgs-master": {
      "locked": {
-        "lastModified": 1780278297,
+        "lastModified": 1781229721,
-        "narHash": "sha256-ZR9YfHXIBOCDYWEKvGaLdYqwm5lwQPSMVPjg7Hb7uHE=",
+        "narHash": "sha256-ORvqDbb/LYxiJljGIejapjkc/kJbVote2N1WSb9W45I=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "c2a4e65eaf219d52ec3bf3a04e69a1e5631500d4",
+        "rev": "173d0ad7a974f8543a9ab01d2271b2e290341b33",
        "type": "github"
      },
      "original": {
@@ -836,11 +782,11 @@
    },
    "nixpkgs_2": {
      "locked": {
-        "lastModified": 1780030872,
+        "lastModified": 1783224372,
-        "narHash": "sha256-u6WU/yd/o8iYQrHX3RAwO1hYa3LkoSL+WNQD0rJfJZQ=",
+        "narHash": "sha256-8i/87eeoqiGE4yOTjwSA3Eh/ziJRQEmd/unYU+K27sk=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "e9a7635a57597d9754eccebdfc7045e6c8600e6b",
+        "rev": "d407951447dcd00442e97087bf374aad70c04cea",
        "type": "github"
      },
      "original": {
@@ -889,27 +835,6 @@
        "type": "github"
      }
    },
    "nuenv": {
      "inputs": {
        "nixpkgs": [
          "nixpkgs"
        ],
        "rust-overlay": "rust-overlay_2"
      },
      "locked": {
        "lastModified": 1731006591,
        "narHash": "sha256-zCh7F0XKC5IEJKBTSNnUQ3SwJz3izPdxEU3C4udG8qI=",
        "owner": "DeterminateSystems",
        "repo": "nuenv",
        "rev": "45693a438df82b3a604f855c3372f4f7d9efb3eb",
        "type": "github"
      },
      "original": {
        "owner": "DeterminateSystems",
        "repo": "nuenv",
        "type": "github"
      }
    },
    "nur-ryan4yin": {
      "inputs": {
        "nixpkgs": [
@@ -940,11 +865,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1765016596,
+        "lastModified": 1781733627,
-        "narHash": "sha256-rhSqPNxDVow7OQKi4qS5H8Au0P4S3AYbawBSmJNUtBQ=",
+        "narHash": "sha256-U3yTuGBnmXvXoQI3qkpfEDsn9RovQPAjN7ndRco+3u0=",
        "owner": "cachix",
        "repo": "pre-commit-hooks.nix",
-        "rev": "548fc44fca28a5e81c5d6b846e555e6b9c2a5a3c",
+        "rev": "3bbec39bc90eadfa031e6f3b77272f3f60803e39",
        "type": "github"
      },
      "original": {
@@ -1005,7 +930,6 @@
        "nix-darwin": "nix-darwin",
        "nix-gaming": "nix-gaming",
        "nixos-apple-silicon": "nixos-apple-silicon",
        "nixos-generators": "nixos-generators",
        "nixpak": "nixpak",
        "nixpkgs": "nixpkgs_2",
        "nixpkgs-2505": "nixpkgs-2505",
@@ -1015,7 +939,6 @@
        "nixpkgs-stable": "nixpkgs-stable",
        "nixvim": "nixvim",
        "nu_scripts": "nu_scripts",
        "nuenv": "nuenv",
        "nur-ryan4yin": "nur-ryan4yin",
        "pre-commit-hooks": "pre-commit-hooks",
        "preservation": "preservation",
@@ -1030,33 +953,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1765075567,
+        "lastModified": 1782012058,
-        "narHash": "sha256-KFDCdQcHJ0hE3Nt5Gm5enRIhmtEifAjpxgUQ3mzSJpA=",
+        "narHash": "sha256-9mWUnReOUXfKjZuJAL/bAFH3LUyECTRtXgSNVjRw3UY=",
        "owner": "oxalica",
        "repo": "rust-overlay",
-        "rev": "769156779b41e8787a46ca3d7d76443aaf68be6f",
+        "rev": "8534567325bd8a8d2928e6afd81e0a87d19efd3c",
        "type": "github"
      },
      "original": {
        "owner": "oxalica",
        "repo": "rust-overlay",
        "type": "github"
      }
    },
    "rust-overlay_2": {
      "inputs": {
        "flake-utils": "flake-utils",
        "nixpkgs": [
          "nuenv",
          "nixpkgs"
        ]
      },
      "locked": {
        "lastModified": 1701397143,
        "narHash": "sha256-nYUJxZXwCWWVBYZXPgRxGDuQcZRhKTtD/Jp5Jl+9EWU=",
        "owner": "oxalica",
        "repo": "rust-overlay",
        "rev": "bb71557c93cad40f5921b2342d7fd69f9e6497ab",
        "type": "github"
      },
      "original": {
@@ -1110,21 +1011,6 @@
        "type": "github"
      }
    },
    "systems_4": {
      "locked": {
        "lastModified": 1681028828,
        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
        "owner": "nix-systems",
        "repo": "default",
        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
        "type": "github"
      },
      "original": {
        "owner": "nix-systems",
        "repo": "default",
        "type": "github"
      }
    },
    "treefmt-nix": {
      "inputs": {
        "nixpkgs": [
@@ -79,7 +79,7 @@
    };
    lanzaboote = {
-      url = "github:nix-community/lanzaboote/v1.0.0";
+      url = "github:nix-community/lanzaboote/v1.1.0";
      inputs.nixpkgs.follows = "nixpkgs";
    };
@@ -87,11 +87,6 @@
      url = "github:nix-community/preservation";
    };
    # generate iso/qcow2/docker/... image from nixos configuration
    nixos-generators = {
      url = "github:nix-community/nixos-generators";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    # secrets management
    agenix = {
      # lock with git commit at May 18, 2025
@@ -112,11 +107,6 @@
      inputs.nixpkgs.follows = "nixpkgs";
    };
    nuenv = {
      url = "github:DeterminateSystems/nuenv";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    haumea = {
      url = "github:nix-community/haumea/v0.2.2";
      inputs.nixpkgs.follows = "nixpkgs";
@@ -133,7 +123,6 @@
    };
    nixos-apple-silicon = {
      # asahi-6.18.9
      url = "github:nix-community/nixos-apple-silicon";
      inputs.nixpkgs.follows = "nixpkgs";
    };
@@ -51,8 +51,7 @@ In Helix, `|` / `!` and variants pipe or insert shell output on selections (see
 This flake’s Helix Home Manager module keeps **almost all default keys**; the only remap is
 **`Ctrl+Shift+o`** → jump backward, because Zellij uses **`Ctrl+o`** for Session (see
-`home/base/core/editors/helix/default.nix`). For other Zellij clashes, use **locked mode**
+`home/base/core/editors/helix/default.nix`).
 (`Ctrl+g`), **`:`** commands, or the built-in **`Space`** menu.
 ### Command mode (`:`)
@@ -64,6 +63,7 @@ This flake’s Helix Home Manager module keeps **almost all default keys**; the
 | Quit view / quit all   | `:q` / `:qa` — add `!` to discard changes                            |
 | Write and quit         | `:wq`, `:x`                                                          |
 | Write all and quit all | `:wqa`, `:xa`                                                        |
 | Save to path           | `:w path`                                                            |
 | Open file              | `:open path`, `:e path`                                              |
 | Next / previous buffer | `:bn` / `:bp` (also `gn` / `gp` in normal)                           |
 | Close buffer           | `:bc` (add `!` to force)                                             |
@@ -73,37 +73,51 @@ This flake’s Helix Home Manager module keeps **almost all default keys**; the
 ### Movement (normal mode)
-| Action                | Keys / notes                                        |
+| Action                | Keys / notes                                                         |
-| --------------------- | --------------------------------------------------- |
+| --------------------- | -------------------------------------------------------------------- |
-| Arrow keys            | `h` `j` `k` `l`                                     |
+| Arrow keys            | `h` `j` `k` `l`                                                      |
-| Words                 | `w` `b` `e` — `W` `B` `E` for WORD-style            |
+| Words                 | `w` `b` `e` — `W` `B` `E` for WORD-style                             |
-| Find char / till char | `f` `F` `t` `T` (not limited to current line)       |
+| Counts                | Prefix motions with a count: `2w`, `3e`, `2b`, `2x`                  |
-| Line / file           | `Home` / `End`; `gg` start or goto line; `G` line   |
+| Find char / till char | `f` `F` `t` `T` (not limited to current line)                        |
-| Half / full page      | `Ctrl-u` / `Ctrl-d`; `Ctrl-b` / `Ctrl-f`            |
+| Repeat find / till    | `Alt-.` repeats the last `f` / `t` selection                         |
-| Jumplist              | `Ctrl-o` back, `Ctrl-i` forward; `Ctrl-s` save spot |
+| Word-label jump       | `gw` shows two-character labels; type a label to jump, `Esc` cancels |
 | Line / file           | `Home` / `End`; `gg` start or goto line; `G` line                    |
 | Half / full page      | `Ctrl-u` / `Ctrl-d`; `Ctrl-b` / `Ctrl-f`                             |
 | Jumplist              | `Ctrl-o` back, `Ctrl-i` forward; `Ctrl-s` save spot                  |
 ### Selection & changes
-| Action                 | Keys / notes                                                      |
+| Action                 | Keys / notes                                                                |
-| ---------------------- | ----------------------------------------------------------------- |
+| ---------------------- | --------------------------------------------------------------------------- |
-| Extend selections      | `v` select mode; motions extend instead of moving                 |
+| Extend selections      | `v` select mode; motions extend instead of moving; `v` or `Esc` leaves mode |
-| Line selection         | `x` extend line; `X` line bounds                                  |
+| Line selection         | `x` extend line; `X` line bounds; repeat or use a count for more lines      |
-| Select all / regex     | `%`; `s` regex in selections; `S` split on regex                  |
+| Collapse selections    | `;` collapse selections back to cursors                                     |
-| Undo / redo            | `u` / `U`                                                         |
+| Select all / regex     | `%`; `s` regex in selections; `S` split on regex                            |
-| Delete / change / yank | `d` / `c` / `y` — acts on selection                               |
+| Multiple cursors       | `C` duplicate to next suitable line; `Alt-C` above; `,` remove one cursor   |
-| Paste                  | `p` / `P`; registers `"` …                                        |
+| Align selections       | `&` align selection contents                                                |
-| Insert                 | `i` `a` `I` `A` `o` `O`                                           |
+| Undo / redo            | `u` / `U`                                                                   |
-| Indent / format        | `>` / `<`; `=` format (LSP)                                       |
+| Delete / change / yank | `d` / `c` / `y` — acts on selection                                         |
-| Case                   | `~` toggle; lower/upper case via grave / `Alt-grave` (see keymap) |
+| Replace with yank      | `R` replace selection with yanked text                                      |
-| Join lines             | `J`; `Alt-J` join keeping space                                   |
+| Paste                  | `p` / `P`; registers `"` …                                                  |
 | Register prefix        | `"<char>` selects a register for yank/paste/macro operations                |
 | Insert                 | `i` `a` `I` `A` `o` `O`                                                     |
 | Repeat insert          | `.` repeat the last insertion                                               |
 | Replace selected chars | `r<char>`                                                                   |
 | Indent / format        | `>` / `<`; `=` format (LSP)                                                 |
 | Increment / decrement  | `Ctrl-a` / `Ctrl-x` on selected numbers                                     |
 | Case                   | `~` toggle; lower/upper case via grave / `Alt-grave` (see Alt caveat above) |
 | Join lines             | `J`; `Alt-J` join keeping space (see Alt caveat above)                      |
 | Toggle line comment    | `Ctrl-c`                                                                    |
 | Macro record / replay  | `Q` start/stop recording; `q` replay from the default `@` register          |
 ### Search
-| Action               | Keys                                     |
+| Action               | Keys                                                            |
-| -------------------- | ---------------------------------------- |
+| -------------------- | --------------------------------------------------------------- |
-| Search / reverse     | `/` / `?`                                |
+| Search / reverse     | `/` / `?`                                                       |
-| Next / prev match    | `n` / `N`                                |
+| Next / prev match    | `n` / `N`                                                       |
-| Selection as pattern | `*` (word bounds); `Alt-*` raw selection |
+| Selection as pattern | `*` (word bounds); `Alt-*` raw selection (see Alt caveat above) |
 | Split on newlines    | `Alt-s`                                                         |
 Use **extend mode** (`v`) with `n` / `N` to add matches to multi-cursors
 ([keymap](https://docs.helix-editor.com/keymap.html#select--extend-mode)).
@@ -1,9 +1,14 @@
 { config, ... }:
 {
-  # 1. make `npm install -g <pkg>` happey
+  # make `npm install -g <pkg>` happey
-  # 2. set min-release-age for security
+  # npm - set min-release-age(in days) for supply-chain security
  home.file.".npmrc".text = ''
    prefix=${config.home.homeDirectory}/.npm
-    min-release-age=7
+    min-release-age=2
  '';
  # npm - set min release age (in minutes) for supply-chain security
  xdg.configFile."pnpm/config.yaml".text = ''
    minimumReleaseAge: 2880
  '';
 }
@@ -1,7 +1,14 @@
 _: {
-  # use mirror for pip install
+  # use pypi mirror
  # filter packages via upload time for supply-chain security
  xdg.configFile."pip/pip.conf".text = ''
    [global]
    index-url = https://mirrors.bfsu.edu.cn/pypi/web/simple
    [install]
    uploaded-prior-to = P2D
  '';
  xdg.configFile."uv/uv.toml".text = ''
    exclude-newer = "2 days"
  '';
 }
@@ -0,0 +1,137 @@
 { lib, ... }:
 {
  catppuccin.zed.enable = true;
  programs.zed-editor = {
    enable = true;
    mutableUserSettings = true;
    userSettings = {
      # Language-specific settings
      languages = {
        Python = {
          formatter.language_server.name = "ruff";
          language_servers = [
            "ty"
            "ruff"
            "!basedpyright"
            "!pyrefly"
            "!pyright"
            "!pylsp"
          ];
        };
        Rust = {
          hard_tabs = false;
          formatter.language_server.name = "rust-analyzer";
          language_servers = [
            "rust-analyzer"
            "!rustc"
          ];
        };
        Go = {
          formatter.language_server.name = "gopls";
          language_servers = [
            "gopls"
            "!goimports"
          ];
        };
      };
      # Terminal
      terminal.shell.with_arguments = {
        program = "bash";
        args = [
          "--login"
          "-c"
          "nu --login --interactive"
        ];
      };
      # Editor behavior
      auto_signature_help = true;
      autosave = "on_focus_change";
      code_lens = "on";
      completion_menu_item_kind = "symbol";
      completions.lsp_fetch_timeout_ms = 2000;
      diagnostics.inline.enabled = true;
      document_folding_ranges = "off";
      inlay_hints.enabled = true;
      minimap.show = "auto";
      relative_line_numbers = "enabled";
      semantic_tokens = "combined";
      soft_wrap = "editor_width";
      vertical_scroll_margin = 5.0;
      which_key.enabled = true;
      indent_guides = {
        background_coloring = "indent_aware";
        coloring = "indent_aware";
      };
      # Search
      search.regex = true;
      use_smartcase_search = true;
      # Formatting
      prettier.allowed = true;
      # UI chrome
      tabs = {
        file_icons = true;
        git_status = true;
      };
      title_bar = {
        show_branch_status_icon = true;
        show_menus = false;
        show_user_menu = true;
      };
      # Git
      git.inline_blame.show_commit_summary = true;
      # Modal editing
      helix_mode = true;
      vim = {
        use_smartcase_find = true;
        toggle_relative_line_numbers = true;
      };
      # Fonts
      ui_font_family = lib.mkDefault "LXGW WenKai Screen";
      ui_font_size = lib.mkDefault 16.0;
      buffer_font_family = lib.mkDefault "Maple Mono NF CN";
      buffer_font_size = lib.mkDefault 14.0;
      agent_ui_font_size = lib.mkDefault 16.0;
      agent_buffer_font_size = lib.mkDefault 15.0;
      # App behavior
      auto_update = false;
      cli_default_open_behavior = "existing_window";
      # AI/editor integrations
      agent.play_sound_when_agent_done = "when_hidden";
      agent_servers = {
        opencode.type = "registry";
        cursor.type = "registry";
        codex-acp.type = "registry";
        claude-acp.type = "registry";
      };
      # Privacy
      edit_predictions.allow_data_collection = "no";
      telemetry = {
        diagnostics = false;
        metrics = false;
      };
    };
    extensions = [
      "catppuccin"
      "dockerfile"
      "just"
      "nix"
      "nu"
      "terraform"
      "toml"
    ];
  };
 }
@@ -21,16 +21,14 @@
    # pulumiPackages.pulumi-language-python
    # pulumiPackages.pulumi-language-nodejs
    # doctl # digitalocean
    aliyun-cli
    # aws
    awscli2
    ssm-session-manager-plugin # Amazon SSM Session Manager Plugin
    aws-iam-authenticator
    eksctl
    # aliyun
    aliyun-cli
    # digitalocean
    doctl
    # google cloud
    (pkgs-stable.google-cloud-sdk.withExtraComponents (
      with pkgs-stable.google-cloud-sdk.components;
@@ -38,6 +36,8 @@
        gke-gcloud-auth-plugin
      ]
    ))
    google-cloud-sql-proxy
    google-alloydb-auth-proxy
    # cloud tools that nix do not have cache for.
    terraform
@@ -16,11 +16,7 @@
        deadnix # Find and remove unused code in .nix source files
        nixfmt # Nix Code Formatter
        #-- nickel lang
        nickel
        #-- json like
        # terraform  # install via brew on macOS
        terraform-ls
        jsonnet
        jsonnet-language-server
@@ -66,23 +62,18 @@
          (python313.withPackages (
            ps: with ps; [
              # python language server
-              pyright
+              ty
              ruff
              black # python formatter
              # my commonly used python packages
              jupyter
              ipython
              pandas
              numpy
              requests
              pyquery
              pyyaml
              boto3
              # misc
              protobuf # protocol buffer compiler
              numpy
            ]
          ))
@@ -104,14 +95,11 @@
          delve # go debugger
          # -- java
-          jdk17
+          # jdk25
-          gradle
+          # gradle
-          maven
+          # maven
-          spring-boot-cli
+          # spring-boot-cli
-          jdt-language-server
+          # jdt-language-server
          #-- zig
          zls
          #-- lua
          stylua
@@ -134,23 +122,9 @@
        tailwindcss-language-server
        emmet-ls
      ]
      # -*- Lisp like Languages -*-#
      # ++ [
      #   guile
      #   racket-minimal
      #   fnlfmt # fennel
      #   (
      #     if pkgs.stdenv.isLinux && pkgs.stdenv.isx86
      #     then pkgs-master.akkuPackages.scheme-langserver
      #     else pkgs.emptyDirectory
      #   )
      # ]
      ++ [
        proselint # English prose linter
        #-- verilog / systemverilog
        verible
        #-- Optional Requirements:
        prettier # common code formatter
        fzf
@@ -14,31 +14,10 @@
      $env.CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC = "1"
      $env.CLAUDE_CODE_ATTRIBUTION_HEADER = "0"
      # using claude-code with kimi llm
      # https://platform.moonshot.cn/docs/guide/agent-support
      # $env.ANTHROPIC_BASE_URL = "https://api.moonshot.cn/anthropic/"
      # $env.ANTHROPIC_AUTH_TOKEN = $env.MOONSHOT_API_KEY
      # $env.ANTHROPIC_DEFAULT_OPUS_MODEL = "kimi-k2.5"
      # $env.ANTHROPIC_DEFAULT_SONNET_MODEL = "kimi-k2.5"
      # $env.ANTHROPIC_DEFAULT_HAIKU_MODEL = "kimi-k2.5"
      # using claude-code with glm llm
      # https://docs.bigmodel.cn/cn/coding-plan/tool/claude
      # $env.ANTHROPIC_BASE_URL = "https://open.bigmodel.cn/api/anthropic"
      # $env.ANTHROPIC_AUTH_TOKEN = $env.ZAI_API_KEY
      # $env.ANTHROPIC_DEFAULT_OPUS_MODEL = "glm-5.1"
      # $env.ANTHROPIC_DEFAULT_SONNET_MODEL = "glm-5-turbo"
      # $env.ANTHROPIC_DEFAULT_HAIKU_MODEL = "glm-4.5-air"
      # using claude-code with minimax llm
      # https://platform.minimax.io/docs/token-plan/claude-code
      # $env.ANTHROPIC_BASE_URL = "https://api.minimax.io/anthropic"
      # $env.ANTHROPIC_AUTH_TOKEN = $env.MINIMAX_API_KEY
      # $env.ANTHROPIC_MODEL = "MiniMax-M2.7"
      # $env.ANTHROPIC_DEFAULT_OPUS_MODEL = "MiniMax-M2.7"
      # $env.ANTHROPIC_DEFAULT_SONNET_MODEL = "MiniMax-M2.7"
      # $env.ANTHROPIC_DEFAULT_HAIKU_MODEL = "MiniMax-M2.7"
      # for work
      $env.ANTHROPIC_BASE_URL = $env.WORK_ANTHROPIC_BASE_URL
      $env.ANTHROPIC_AUTH_TOKEN = $env.WORK_ANTHROPIC_AUTH_TOKEN
      # Directories in this constant are searched by the
      # `use` and `source` commands.
@@ -280,10 +280,6 @@ run = ['layout floating', 'move-node-to-workspace 9File']
 if.app-id = 'com.apple.Preview'
 run = ['layout floating', 'move-node-to-workspace 9File']
 [[on-window-detected]]
 if.app-id = 'com.microsoft.VSCode'
 run = ['layout floating', 'move-node-to-workspace 9File']
 [[on-window-detected]]
 if.app-id = 'com.todesktop.230313mzl4w4u92' # Cursor AI Editor
 run = ['layout floating', 'move-node-to-workspace 9File']
@@ -11,6 +11,13 @@ in
  modules.desktop.niri.enable = true;
  modules.desktop.nvidia.enable = true;
  programs.zed-editor.userSettings = {
    ui_font_size = 18.0;
    buffer_font_size = 17.0;
    agent_ui_font_size = 18.0;
    agent_buffer_font_size = 17.0;
  };
  xdg.configFile."niri/niri-hardware.kdl".source =
    mkSymlink "${config.home.homeDirectory}/nix-config/hosts/idols-ai/niri-hardware.kdl";
 }
@@ -1,21 +1,3 @@
 {
-  programs.gh.enable = true;
+  imports = [ ../../linux/core.nix ];
  programs.git.enable = true;
  programs.zellij.enable = true;
  programs.bash.enable = true;
  programs.nushell.enable = true;
  programs.starship = {
    enable = true;
    enableBashIntegration = true;
    enableNushellIntegration = true;
  };
  programs.neovim = {
    enable = true;
    viAlias = true;
    vimAlias = true;
  };
  home.stateVersion = "25.11";
 }
@@ -1,3 +1,3 @@
 {
-  imports = [ ./idols-aquamarine.nix ];
+  imports = [ ../../linux/core.nix ];
 }
@@ -1,3 +1,3 @@
 {
-  imports = [ ./idols-aquamarine.nix ];
+  imports = [ ../../linux/core.nix ];
 }
@@ -5,13 +5,5 @@
    # misc
    libnotify
    wireguard-tools # manage wireguard vpn manually, via wg-quick
    virt-viewer # vnc connect to VM, used by kubevirt
  ];
  # auto mount usb drives
  services = {
    udiskie.enable = true;
    # syncthing.enable = true;
  };
 }
@@ -14,6 +14,7 @@
      inkscape # vector graphics
      krita # digital painting
      musescore # music notation
      orca-slicer # 3d printer slicer app
      # reaper # audio production
      # sonic-pi # music programming
@@ -27,6 +27,8 @@
    flameshot
    hyprshot # screen shot
    wf-recorder # screen recording
    virt-viewer # vnc connect to VM, used by kubevirt
  ];
  # screen locker
@@ -34,4 +36,10 @@
  # Logout Menu
  programs.wlogout.enable = true;
  # auto mount usb drives
  services = {
    udiskie.enable = true;
    # syncthing.enable = true;
  };
 }
@@ -1,19 +0,0 @@
 {
  lib,
  pkgs-master,
  ...
 }:
 {
  programs.vscode = {
    enable = true;
    package = pkgs-master.vscode.override {
      commandLineArgs = [
        # https://code.visualstudio.com/docs/configure/settings-sync#_recommended-configure-the-keyring-to-use-with-vs-code
        # For use with any package that implements the Secret Service API
        # (for example gnome-keyring, kwallet5, KeepassXC)
        "--password-store=gnome-libsecret"
      ];
    };
  };
 }
@@ -24,4 +24,5 @@
  # allow fontconfig to discover fonts and configurations installed through home.packages
  # Install fonts at system-level, not user-level
  fonts.fontconfig.enable = false;
 }
@@ -221,7 +221,12 @@
    }
  },
  "brightness": {
-    "backlightDeviceMappings": [],
+    "backlightDeviceMappings": [
      {
        "device": "/sys/class/backlight/apple-panel-bl",
        "output": "eDP-1"
      }
    ],
    "brightnessStep": 3,
    "enableDdcSupport": false,
    "enforceMinimum": true
@@ -18,10 +18,9 @@
          "firefox.desktop"
        ];
        editor = [
          "dev.zed.Zed.desktop"
          "nvim.desktop"
          "Helix.desktop"
          "code.desktop"
          "code-insiders.desktop"
        ];
      in
      {
@@ -48,9 +47,6 @@
        "x-scheme-handler/ftp" = browser; # open `ftp:` url with `browser`
        "x-scheme-handler/http" = browser;
        "x-scheme-handler/https" = browser;
        # https://github.com/microsoft/vscode/issues/146408
        "x-scheme-handler/vscode" = [ "code-url-handler.desktop" ]; # open `vscode://` url with `code-url-handler.desktop`
        "x-scheme-handler/vscode-insiders" = [ "code-insiders-url-handler.desktop" ]; # open `vscode-insiders://` url with `code-insiders-url-handler.desktop`
        "x-scheme-handler/zoommtg" = [ "Zoom.desktop" ];
        # all other unknown schemes will be opened by this default application.
@@ -82,7 +82,6 @@ nvme0n1           259:0    0  1.8T  0 disk
                                            /home/ryan/.zoom
                                            /home/ryan/Documents
                                            /home/ryan/.wakatime
                                            /home/ryan/.vscode
                                            /home/ryan/.var
                                            /home/ryan/.terraform.d/plugin-cache
                                            /home/ryan/.steam
@@ -106,6 +105,7 @@ nvme0n1           259:0    0  1.8T  0 disk
                                            /home/ryan/.local/share/password-store
                                            /home/ryan/.local/share/opencode
                                            /home/ryan/.local/share/nvim
                                            /home/ryan/.local/share/zed
                                            /home/ryan/.local/share/nix
                                            /home/ryan/.local/share/krita
                                            /home/ryan/.local/share/lutris
@@ -140,6 +140,7 @@ nvme0n1           259:0    0  1.8T  0 disk
                                            /home/ryan/.config/obs-studio
                                            /home/ryan/.config/mozc
                                            /home/ryan/.config/nushell
                                            /home/ryan/.config/zed
                                            /home/ryan/.config/lutris
                                            /home/ryan/.config/joplin
                                            /home/ryan/.config/heroic
@@ -151,7 +152,6 @@ nvme0n1           259:0    0  1.8T  0 disk
                                            /home/ryan/.config/LDtk
                                            /home/ryan/.config/Joplin
                                            /home/ryan/.config/Cursor
                                            /home/ryan/.config/Code
                                            /home/ryan/.conda
                                            /home/ryan/.cargo
                                            /home/ryan/.codex
@@ -133,9 +133,9 @@ in
        # neovim plugins
        ".wakatime"
-        # vscode
+        # zed
-        ".vscode"
+        ".config/zed"
-        ".config/Code"
+        ".local/share/zed"
        # cursor ai editor / cli
        ".cursor"
@@ -300,6 +300,10 @@ in
        ".local/share/io.github.clash-verge-rev.clash-verge-rev"
        ".local/share/clash-verge"
        # Orca Slicer - 3D Printer Slicer
        ".local/share/orca-slicer"
        ".config/OrcaSlicer"
        # Audio
        ".config/pulse"
        ".local/state/wireplumber"
@@ -15,6 +15,9 @@ in
 {
  imports = (mylib.scanPaths ./.) ++ [
    disko.nixosModules.default
    ../idols-ruby/packages.nix
    ../idols-ruby/oci-containers
  ];
  # supported file systems, so we can mount any removable disks with these filesystems
@@ -1,54 +0,0 @@
 { pkgs, ... }:
 {
  # https://github.com/Mic92/nix-ld
  #
  # nix-ld will install itself at `/lib64/ld-linux-x86-64.so.2` so that
  # it can be used as the dynamic linker for non-NixOS binaries.
  #
  # nix-ld works like a middleware between the actual link loader located at `/nix/store/.../ld-linux-x86-64.so.2`
  # and the non-NixOS binaries. It will:
  #
  #   1. read the `NIX_LD` environment variable and use it to find the actual link loader.
  #   2. read the `NIX_LD_LIBRARY_PATH` environment variable and use it to set the `LD_LIBRARY_PATH` environment variable
  #      for the actual link loader.
  #
  # nix-ld's nixos module will set default values for `NIX_LD` and `NIX_LD_LIBRARY_PATH` environment variables, so
  # it can work out of the box:
  #
  #  - https://github.com/NixOS/nixpkgs/blob/nixos-26.05/nixos/modules/programs/nix-ld.nix#L42-L45
  #
  # You can overwrite `NIX_LD_LIBRARY_PATH` in the environment where you run the non-NixOS binaries to customize the
  # search path for shared libraries.
  programs.nix-ld = {
    enable = true;
    libraries = with pkgs; [
      stdenv.cc.cc
    ];
  };
  environment.systemPackages = with pkgs; [
    nodejs_24
    pnpm
    #-- python
    conda
    uv # python project package manager
    (python313.withPackages (
      ps: with ps; [
        pandas
        requests
        pyquery
        pyyaml
        numpy
        # model downloaders
        huggingface-hub
        modelscope
      ]
    ))
    rustc
    cargo # rust package manager
    go
  ];
 }
@@ -1,4 +1,4 @@
-{ pkgs, ... }:
+{ pkgs, llm-agents, ... }:
 {
  # https://github.com/Mic92/nix-ld
  #
@@ -26,55 +26,68 @@
    ];
  };
-  environment.systemPackages = with pkgs; [
+  environment.systemPackages =
-    nodejs_24
+    with pkgs;
-    pnpm
+    [
      nodejs_24
      pnpm
-    #-- python
+      #-- python
-    conda
+      conda
-    uv # python project package manager
+      uv # python project package manager
-    (python313.withPackages (
+      (python313.withPackages (
-      ps: with ps; [
+        ps: with ps; [
-        pandas
+          pandas
-        requests
+          requests
-        pyquery
+          pyquery
-        pyyaml
+          pyyaml
-        numpy
+          numpy
-        # model downloaders
+          # model downloaders
-        huggingface-hub
+          huggingface-hub
-        modelscope
+          modelscope
-      ]
+        ]
-    ))
+      ))
-    rustc
+      rustc
-    cargo # rust package manager
+      cargo # rust package manager
-    go
+      go
-    # cryptography
+      # cryptography
-    age
+      age
-    sops
+      sops
-    rclone
+      rclone
-    gnupg
+      gnupg
-    # cloud-native
+      # cloud-native
-    kubectl
+      kubectl
-    istioctl
+      istioctl
-    kubevirt # virtctl
+      kubevirt # virtctl
-    kubernetes-helm
+      kubernetes-helm
-    fluxcd
+      fluxcd
-    terraform
+      terraform
-    # db related
+      # db related
-    pgcli
+      pgcli
-    mongosh
+      mongosh
-    sqlite
+      sqlite
-    yt-dlp # youtube/bilibili/soundcloud/... video/music downloader
+      yt-dlp # youtube/bilibili/soundcloud/... video/music downloader
-    # need to run `conda-install` before using it
+      # need to run `conda-install` before using it
-    # need to run `conda-shell` before using command `conda`
+      # need to run `conda-shell` before using command `conda`
-    # conda is not available for MacOS
+      # conda is not available for MacOS
-    conda
+      conda
-  ];
+    ]
    # AI Agent Tools
    ++ (with llm-agents.packages.${pkgs.stdenv.hostPlatform.system}; [
      # Agents
      codex
      cursor-cli
      claude-code
      opencode
      # Utilities
      rtk # CLI proxy that reduces LLM token consumption
    ]);
 }
@@ -10,15 +10,12 @@
  ...
 }:
 let
-  inherit (inputs) nixpkgs home-manager nixos-generators;
+  inherit (inputs) nixpkgs home-manager;
 in
 nixpkgs.lib.nixosSystem {
  inherit system specialArgs;
  modules =
    nixos-modules
    ++ [
      nixos-generators.nixosModules.all-formats
    ]
    ++ (lib.optionals ((lib.lists.length home-modules) > 0) [
      home-manager.nixosModules.home-manager
      {
@@ -1,7 +1,3 @@
-{ nuenv, ... }@args:
+args: {
-{
+  nixpkgs.overlays = import ../../overlays args;
  nixpkgs.overlays = [
    nuenv.overlays.default
  ]
  ++ (import ../../overlays args);
 }
@@ -101,7 +101,7 @@ in
    onActivation = {
      autoUpdate = true; # Fetch the newest stable branch of Homebrew's git repo
-      upgrade = true; # Upgrade outdated casks, formulae, and App Store apps
+      upgrade = false; # Upgrade outdated casks, formulae, and App Store apps
      # 'zap': uninstalls all formulae(and related files) not listed in the generated Brewfile
      cleanup = "zap";
    };
@@ -111,6 +111,9 @@ in
    # otherwise Apple Store will refuse to install them.
    # For details, see https://github.com/mas-cli/mas
    masApps = {
      Keynote = 409183694;
      Slack = 803453959;
      WireGuard = 1451685025;
      # Xcode = 497799835;
      Wechat = 836500024;
    };
@@ -136,11 +139,6 @@ in
      # commands like `gsed` `gtar` are required by some tools
      "gnu-sed"
      "gnu-tar"
      # misc that nix do not have cache for.
      "git-trim"
      "hashicorp/tap/terraform"
      "terraformer"
    ];
    taps = [
@@ -153,10 +151,7 @@ in
      "firefox"
      "google-chrome"
-      # code editor
+      # "nikitabobko/tap/aerospace" # an i3-like tiling window manager for macOS
      "visual-studio-code"
      "nikitabobko/tap/aerospace" # an i3-like tiling window manager for macOS
      "ghostty" # terminal emulator
      # container & vm
@@ -168,9 +163,6 @@ in
      "tailscale-app" # tailscale macos app (with gui)
      # "netbirdio/tap/netbird-ui" # netbird gui app
      # AI
      "lm-studio"
      # IM & audio & remote desktop & meeting
      "telegram"
      "qq"
@@ -185,6 +177,7 @@ in
      # Misc
      "iina" # video player
      "stats" # beautiful system status monitor in menu bar
      "orcaslicer" # 3d printer slicer app
      # "reaper"  # audio editor
      # "tencent-lemon" # macOS cleaner
@@ -194,7 +187,6 @@ in
      # Development
      "mitmproxy" # HTTP/HTTPS traffic inspector
      "insomnia" # REST client
      "wireshark-app" # network analyzer
      # "google-cloud-sdk" # Google Cloud SDK
      "miniforge" # Miniconda's community-driven distribution
@@ -4,20 +4,10 @@
 # ===================================================================
 let
  brokenPackages = [
    "terraform"
    "terraformer"
    "packer"
    "git-trim"
    "conda"
    "mitmproxy"
    "insomnia"
    "wireshark"
    "jsonnet"
    "zls"
    "verible"
    "gdb"
    "ncdu"
    "racket-minimal"
  ];
 in
 {
@@ -1,8 +1,4 @@
-{
+{ lib, ... }:
  config,
  lib,
  ...
 }:
 {
  # auto upgrade nix to the unstable version
  # https://github.com/NixOS/nixpkgs/blob/nixos-unstable/pkgs/tools/package-management/nix/default.nix#L284
@@ -23,7 +19,28 @@
  # Manual optimise storage: nix-store --optimise
  # https://nixos.org/manual/nix/stable/command-ref/conf-file.html#conf-auto-optimise-store
-  nix.settings.auto-optimise-store = true;
+  nix.settings = {
    auto-optimise-store = true;
    # Reference: https://github.com/NixOS/nixpkgs/pull/478109
    # NixOS tests using systemd-nspawn containers require the Nix daemon to be
    # configured with the following settings:
    auto-allocate-uids = true;
    extra-system-features = [ "uid-range" ];
    experimental-features = [
      "auto-allocate-uids"
      "cgroups"
    ];
    # Use extra-sandbox-paths instead of sandbox-paths here. The plain
    # sandbox-paths setting replaces Nix's compiled sandbox defaults, including
    # the sandbox shell that provides /bin/sh for builders with legacy shebangs.
    # extra-sandbox-paths keeps those defaults and only adds the paths we need.
    # After deploying, verify the effective daemon config with:
    #   nix config show | grep sandbox-paths
    extra-sandbox-paths = [
      "/dev/net"
    ];
  };
  nix.channel.enable = false; # remove nix-channel related tools & configs, we use flakes instead.
 }
@@ -55,19 +55,11 @@
    # It supports a richer feature set than the standard linux console VT,
    # including full unicode support, and when the video card supports drm should be much faster.
    enable = true;
    fonts = with pkgs; [
      {
        name = "Maple Mono NF CN";
        package = maple-mono.NF-CN-unhinted;
      }
      {
        name = "JetBrainsMono Nerd Font";
        package = nerd-fonts.jetbrains-mono;
      }
    ];
    extraOptions = "--term xterm-256color";
-    extraConfig = "font-size=14";
+    config = {
-    # Whether to use 3D hardware acceleration to render the console.
+      font-name = "Maple Mono NF CN";
-    hwRender = true;
+      font-size = 14;
      hwaccel = true;
    };
  };
 }
@@ -48,7 +48,6 @@
    # which resolves bugs involving programs opening inside FHS envs or with unexpected env vars set from wrappers.
    # xdg-open is used by almost all programs to open a unknown file/uri
    # alacritty as an example, it use xdg-open as default, but you can also custom this behavior
    # and vscode has open like `External Uri Openers`
    xdgOpenUsePortal = true;
    # ls /run/current-system/sw/share/xdg-desktop-portal/portals/
@@ -6,7 +6,6 @@
    preservation.url = "github:nix-community/preservation";
    disko.url = "github:nix-community/disko/v1.11.0";
    disko.inputs.nixpkgs.follows = "nixpkgs";
    nuenv.url = "github:DeterminateSystems/nuenv";
    nixos-apple-silicon = {
      # 2025-10-07 asahi-6.16.8-1
@@ -56,6 +56,6 @@ in
  # generate iso image for hosts with desktop environment
  packages = {
-    "${name}-niri" = inputs.self.nixosConfigurations."${name}-niri".config.formats.iso;
+    "${name}-niri" = inputs.self.nixosConfigurations."${name}-niri".config.system.build.images.iso;
  };
 }
@@ -0,0 +1,12 @@
 {
  lib,
  outputs,
 }:
 lib.genAttrs (builtins.attrNames outputs.nixosConfigurations) (_: {
  autoAllocateUids = true;
  hasUidRange = true;
  hasAutoAllocateUidsFeature = true;
  hasCgroupsFeature = true;
  hasNoExplicitSandboxPaths = true;
  hasDevNetExtraSandboxPath = true;
 })
@@ -0,0 +1,22 @@
 {
  lib,
  outputs,
 }:
 lib.genAttrs (builtins.attrNames outputs.nixosConfigurations) (
  name:
  let
    settings = outputs.nixosConfigurations.${name}.config.nix.settings;
    effectiveSystemFeatures =
      (settings.system-features or [ ]) ++ (settings.extra-system-features or [ ]);
  in
  {
    autoAllocateUids = settings.auto-allocate-uids or false;
    hasUidRange = builtins.elem "uid-range" effectiveSystemFeatures;
    hasAutoAllocateUidsFeature = builtins.elem "auto-allocate-uids" (
      settings.experimental-features or [ ]
    );
    hasCgroupsFeature = builtins.elem "cgroups" (settings.experimental-features or [ ]);
    hasNoExplicitSandboxPaths = !(settings ? sandbox-paths);
    hasDevNetExtraSandboxPath = builtins.elem "/dev/net" (settings.extra-sandbox-paths or [ ]);
  }
 )
@@ -142,7 +142,7 @@ in
    pre-commit-check = pre-commit-hooks.lib.${system}.run {
      src = mylib.relativeToRoot ".";
      hooks = {
-        nixfmt-rfc-style = {
+        nixfmt = {
          enable = true;
          settings.width = 100;
        };
@@ -56,6 +56,6 @@ in
  # generate iso image for hosts with desktop environment
  packages = {
-    "${name}-niri" = inputs.self.nixosConfigurations."${name}-niri".config.formats.iso;
+    "${name}-niri" = inputs.self.nixosConfigurations."${name}-niri".config.system.build.images.iso;
  };
 }
@@ -47,5 +47,5 @@ in
  colmena.${name} = mylib.colmenaSystem (systemArgs // { inherit tags ssh-user; });
-  packages.${name} = inputs.self.nixosConfigurations.${name}.config.formats.kubevirt;
+  packages.${name} = inputs.self.nixosConfigurations.${name}.config.system.build.images.kubevirt;
 }
@@ -44,5 +44,5 @@ in
  colmena.${name} = mylib.colmenaSystem (systemArgs // { inherit tags ssh-user; });
-  packages.${name} = inputs.self.nixosConfigurations.${name}.config.formats.kubevirt;
+  packages.${name} = inputs.self.nixosConfigurations.${name}.config.system.build.images.kubevirt;
 }
@@ -44,7 +44,7 @@ in
  colmena.${name} = mylib.colmenaSystem (systemArgs // { inherit tags ssh-user; });
-  packages.${name} = inputs.self.nixosConfigurations.${name}.config.formats.kubevirt;
+  packages.${name} = inputs.self.nixosConfigurations.${name}.config.system.build.images.kubevirt;
  # nixos tests
  packages."${name}-nixos-tests" = import ../nixos-tests/idols-ruby.nix systemArgs;
@@ -40,5 +40,5 @@ in
  colmena.${name} = mylib.colmenaSystem (systemArgs // { inherit tags ssh-user; });
-  packages.${name} = inputs.self.nixosConfigurations.${name}.config.formats.kubevirt;
+  packages.${name} = inputs.self.nixosConfigurations.${name}.config.system.build.images.kubevirt;
 }
@@ -37,5 +37,5 @@ in
  colmena.${name} = mylib.colmenaSystem (systemArgs // { inherit tags ssh-user; });
-  packages.${name} = inputs.self.nixosConfigurations.${name}.config.formats.kubevirt;
+  packages.${name} = inputs.self.nixosConfigurations.${name}.config.system.build.images.kubevirt;
 }
@@ -37,5 +37,5 @@ in
  colmena.${name} = mylib.colmenaSystem (systemArgs // { inherit tags ssh-user; });
-  packages.${name} = inputs.self.nixosConfigurations.${name}.config.formats.kubevirt;
+  packages.${name} = inputs.self.nixosConfigurations.${name}.config.system.build.images.kubevirt;
 }
@@ -37,5 +37,5 @@ in
  colmena.${name} = mylib.colmenaSystem (systemArgs // { inherit tags ssh-user; });
-  packages.${name} = inputs.self.nixosConfigurations.${name}.config.formats.kubevirt;
+  packages.${name} = inputs.self.nixosConfigurations.${name}.config.system.build.images.kubevirt;
 }
@@ -37,5 +37,5 @@ in
  colmena.${name} = mylib.colmenaSystem (systemArgs // { inherit tags ssh-user; });
-  packages.${name} = inputs.self.nixosConfigurations.${name}.config.formats.kubevirt;
+  packages.${name} = inputs.self.nixosConfigurations.${name}.config.system.build.images.kubevirt;
 }
@@ -37,5 +37,5 @@ in
  colmena.${name} = mylib.colmenaSystem (systemArgs // { inherit tags ssh-user; });
-  packages.${name} = inputs.self.nixosConfigurations.${name}.config.formats.kubevirt;
+  packages.${name} = inputs.self.nixosConfigurations.${name}.config.system.build.images.kubevirt;
 }
@@ -40,5 +40,5 @@ in
  colmena.${name} = mylib.colmenaSystem (systemArgs // { inherit tags ssh-user; });
-  packages.${name} = inputs.self.nixosConfigurations.${name}.config.formats.kubevirt;
+  packages.${name} = inputs.self.nixosConfigurations.${name}.config.system.build.images.kubevirt;
 }
@@ -37,5 +37,5 @@ in
  colmena.${name} = mylib.colmenaSystem (systemArgs // { inherit tags ssh-user; });
-  packages.${name} = inputs.self.nixosConfigurations.${name}.config.formats.kubevirt;
+  packages.${name} = inputs.self.nixosConfigurations.${name}.config.system.build.images.kubevirt;
 }
@@ -37,5 +37,5 @@ in
  colmena.${name} = mylib.colmenaSystem (systemArgs // { inherit tags ssh-user; });
-  packages.${name} = inputs.self.nixosConfigurations.${name}.config.formats.kubevirt;
+  packages.${name} = inputs.self.nixosConfigurations.${name}.config.system.build.images.kubevirt;
 }
@@ -45,5 +45,5 @@ in
  colmena.${name} = mylib.colmenaSystem (systemArgs // { inherit tags ssh-user; });
-  packages.${name} = inputs.self.nixosConfigurations.${name}.config.formats.iso;
+  packages.${name} = inputs.self.nixosConfigurations.${name}.config.system.build.images.iso;
 }
@@ -42,5 +42,5 @@ in
  colmena.${name} = mylib.colmenaSystem (systemArgs // { inherit tags ssh-user; });
-  packages.${name} = inputs.self.nixosConfigurations.${name}.config.formats.iso;
+  packages.${name} = inputs.self.nixosConfigurations.${name}.config.system.build.images.iso;
 }
@@ -42,5 +42,5 @@ in
  colmena.${name} = mylib.colmenaSystem (systemArgs // { inherit tags ssh-user; });
-  packages.${name} = inputs.self.nixosConfigurations.${name}.config.formats.iso;
+  packages.${name} = inputs.self.nixosConfigurations.${name}.config.system.build.images.iso;
 }
@@ -0,0 +1,12 @@
 {
  lib,
  outputs,
 }:
 lib.genAttrs (builtins.attrNames outputs.nixosConfigurations) (_: {
  autoAllocateUids = true;
  hasUidRange = true;
  hasAutoAllocateUidsFeature = true;
  hasCgroupsFeature = true;
  hasNoExplicitSandboxPaths = true;
  hasDevNetExtraSandboxPath = true;
 })
@@ -0,0 +1,22 @@
 {
  lib,
  outputs,
 }:
 lib.genAttrs (builtins.attrNames outputs.nixosConfigurations) (
  name:
  let
    settings = outputs.nixosConfigurations.${name}.config.nix.settings;
    effectiveSystemFeatures =
      (settings.system-features or [ ]) ++ (settings.extra-system-features or [ ]);
  in
  {
    autoAllocateUids = settings.auto-allocate-uids or false;
    hasUidRange = builtins.elem "uid-range" effectiveSystemFeatures;
    hasAutoAllocateUidsFeature = builtins.elem "auto-allocate-uids" (
      settings.experimental-features or [ ]
    );
    hasCgroupsFeature = builtins.elem "cgroups" (settings.experimental-features or [ ]);
    hasNoExplicitSandboxPaths = !(settings ? sandbox-paths);
    hasDevNetExtraSandboxPath = builtins.elem "/dev/net" (settings.extra-sandbox-paths or [ ]);
  }
 )
@@ -8,9 +8,11 @@ rec {
  proxyGateway6 = "fe80::8";
  nameservers = [
    # IPv4
-    "119.29.29.29" # DNSPod
+    "119.29.29.29" # DNSPod https://www.dnspod.cn/Products/publicdns
    "223.5.5.5" # AliDNS
    "1.1.1.1" # Cloudflare https://one.one.one.one/dns/
    # IPv6
    "2402:4e00::" # DNSPod
    "2400:3200::1" # Alidns
    "2606:4700:4700::1111" # Cloudflare
  ];
Author	SHA1	Message	Date
Ryan Yin	410b3c5312	chore: remove useless comments	2026-07-06 23:04:16 +08:00
Ryan Yin	f0126c69d0	flake.lock: Update Flake lock file updates: • Updated input 'nixpkgs': 'github:NixOS/nixpkgs/3d46470bb3030020f7e1361f33514854f5bfa86d?narHash=sha256-PkBPmP5ofNtunCU7/tfn6wi9OLlzFGcHAqqmY%2B/mwUI%3D' (2026-06-27) → 'github:NixOS/nixpkgs/d407951447dcd00442e97087bf374aad70c04cea?narHash=sha256-8i/87eeoqiGE4yOTjwSA3Eh/ziJRQEmd/unYU%2BK27sk%3D' (2026-07-05)	2026-07-06 23:04:16 +08:00
Ryan Yin	0fe12bef5a	fix(nix): preserve default sandbox shell Setting nix.settings.sandbox-paths replaces Nix compiled sandbox defaults. Keeping only /dev/net made local builds lose the sandbox shell that normally provides /bin/sh, which broke upstream scripts with /bin/sh shebangs in packages such as X11-fonts and openldap. Use extra-sandbox-paths for /dev/net instead. This keeps Nix daemon defaults intact, including the configured sandbox shell, while still allowing builds that need /dev/net. Add eval coverage for both Linux output sets so future changes keep /dev/net in extra-sandbox-paths and do not reintroduce an explicit sandbox-paths override.	2026-07-06 23:04:16 +08:00
Ryan Yin	049390581e	fix(flake): update lanzaboote after bootspec removal The pinned lanzaboote module still defined boot.bootspec.enable, but nixpkgs now always generates bootspec data and rejects attempts to set that removed option. Update the lanzaboote input to a revision compatible with the new nixpkgs module behavior.	2026-07-06 22:01:23 +08:00
Ryan Yin	46398fc688	fix(nixos): migrate kmscon to config attrset Nixpkgs removed services.kmscon.fonts and services.kmscon.extraConfig, so the old font module failed evaluation on current nixos-unstable. Move the selected font, font size, and hardware acceleration settings into services.kmscon.config while keeping the existing terminal type option.	2026-07-06 22:01:18 +08:00
Ryan Yin	c7b82b9e3e	flake.lock: Update Flake lock file updates: • Updated input 'llm-agents': 'github:numtide/llm-agents.nix/129d65240d8c27ab2875f415e0c0b1da8ca28552?narHash=sha256-7%2BuI3P7u%2Btgl0ZfCusw3g9yoG74yogO/l/QLwNmNDEU%3D' (2026-06-21) → 'github:numtide/llm-agents.nix/76948750034d89409ac9224173f52ffc05afe946?narHash=sha256-X1xqgUNcYI/UWxDW8W1DC7OEMOjOhTtwWc8v%2BMGMasY%3D' (2026-06-29) • Updated input 'llm-agents/nixpkgs': 'github:NixOS/nixpkgs/3e41b24abd260e8f71dbe2f5737d24122f972158?narHash=sha256-rxO%2Buc/KFbSJp%2BpgyXRuAX6QlG9hJdnt0BXpEQRXY%2BU%3D' (2026-06-16) → 'github:NixOS/nixpkgs/89570f24e97e614aa34aa9ab1c927b6578a43775?narHash=sha256-EMzXKmnOtBQ2MnvpiNOm7E%2BkOMvdPrIKaeg52Tip2Uk%3D' (2026-06-23)	2026-06-29 10:37:26 +08:00
Ryan Yin	c02459fabc	flake.lock: Update Flake lock file updates: • Updated input 'nixpkgs': 'github:NixOS/nixpkgs/e9a7635a57597d9754eccebdfc7045e6c8600e6b?narHash=sha256-u6WU/yd/o8iYQrHX3RAwO1hYa3LkoSL%2BWNQD0rJfJZQ%3D' (2026-05-29) → 'github:NixOS/nixpkgs/3d46470bb3030020f7e1361f33514854f5bfa86d?narHash=sha256-PkBPmP5ofNtunCU7/tfn6wi9OLlzFGcHAqqmY%2B/mwUI%3D' (2026-06-27)	2026-06-29 10:30:01 +08:00
Ryan Yin	30a6ad89ef	chore(nixos): dns servers	2026-06-27 22:11:17 +08:00
Ryan Yin	a5110c3aa7	feat(darwin): add orca slicer	2026-06-25 22:41:17 +08:00
Ryan Yin	0e5f1801cf	feat(nixos): add orca-slicer Signed-off-by: Ryan Yin <xiaoyin_c@qq.com>	2026-06-25 22:19:14 +08:00
Ryan Yin	6279ac663f	docs: AGENTS.md - script languages	2026-06-23 20:46:35 +08:00
Ryan Yin	92b92969b3	docs: AGENTS.md - script languages	2026-06-23 20:43:11 +08:00
Ryan Yin	ef1c02f3cf	docs: AGENTS.md Signed-off-by: Ryan Yin <xiaoyin_c@qq.com>	2026-06-23 20:34:58 +08:00
Ryan Yin	b493cbae45	flake.lock: Update Flake lock file updates: • Updated input 'llm-agents': 'github:numtide/llm-agents.nix/27d586e930f255a425ec2f9f238f078880333d09?narHash=sha256-gYIQvLpoGLH34tw3lZp11IrK82mkttLcw5sPErGe3%2Bk%3D' (2026-06-12) → 'github:numtide/llm-agents.nix/129d65240d8c27ab2875f415e0c0b1da8ca28552?narHash=sha256-7%2BuI3P7u%2Btgl0ZfCusw3g9yoG74yogO/l/QLwNmNDEU%3D' (2026-06-21) • Updated input 'llm-agents/nixpkgs': 'github:NixOS/nixpkgs/8c3cede7ddc26bd659d2d383b5610efbd2c7a16e?narHash=sha256-rppURzHviaQN131F%2BnLiLdGfcb0uCd9gGP0E5%2Biw9MI%3D' (2026-06-08) → 'github:NixOS/nixpkgs/3e41b24abd260e8f71dbe2f5737d24122f972158?narHash=sha256-rxO%2Buc/KFbSJp%2BpgyXRuAX6QlG9hJdnt0BXpEQRXY%2BU%3D' (2026-06-16)	2026-06-22 09:07:06 +08:00
Ryan Yin	8462d34ade	feat: NixOS tests using systemd-nspawn containers	2026-06-22 09:02:06 +08:00
Ryan Yin	be429dea2e	docs: remove comment	2026-06-14 14:25:33 +08:00
Ryan Yin	691af4ae54	chore: use nixfmt pre-commit hook	2026-06-14 14:15:37 +08:00
Ryan Yin	400725b36c	chore: replace nixos-generators image outputs	2026-06-14 14:10:08 +08:00
Ryan Yin	2ed03e23e3	chore: remove nuenv input	2026-06-14 14:09:40 +08:00
Ryan Yin	eaacb0f9e7	chore: update zed-editor settings, remove unused packages(java,zig,etc)	2026-06-12 22:30:04 +08:00
Ryan Yin	86f316cfdb	fix: shoukei - noctalia - adjust brightness	2026-06-12 15:55:51 +08:00
Ryan Yin	e18f94dca1	chore: claude-code: use work credentials	2026-06-12 14:10:20 +08:00
Ryan Yin	b142f1acb7	flake.lock: Update Flake lock file updates: • Updated input 'mysecrets': 'git+ssh://git@github.com/ryan4yin/nix-secrets.git?ref=refs/heads/main&rev=0e2b90e6d57dfa70c0527c3a4d399bde82998f78&shallow=1' (2026-06-03) → 'git+ssh://git@github.com/ryan4yin/nix-secrets.git?ref=refs/heads/main&rev=490e3aca901fa703083822ee64a65f0a1f4529af&shallow=1' (2026-06-12)	2026-06-12 14:07:37 +08:00
Ryan Yin	e6245cad17	chore(darwin): install some packages via nix instead of brew	2026-06-12 14:04:13 +08:00
Ryan Yin	582c643f2e	flake.lock: Update Flake lock file updates: • Updated input 'nixpkgs-master': 'github:nixos/nixpkgs/c2a4e65' (2026-06-01) → 'github:nixos/nixpkgs/173d0ad' (2026-06-12)	2026-06-12 13:21:01 +08:00
Ryan Yin	d5c1177ef4	flake.lock: Update Flake lock file updates: • Updated input 'llm-agents': 'github:numtide/llm-agents.nix/468bacd' (2026-06-01) → 'github:numtide/llm-agents.nix/27d586e' (2026-06-12) • Updated input 'llm-agents/nixpkgs': 'github:NixOS/nixpkgs/e9a7635' (2026-05-29) → 'github:NixOS/nixpkgs/8c3cede' (2026-06-08)	2026-06-12 13:20:37 +08:00
Ryan Yin	8e14bc3c28	chore(darwin): remove lm-studio, we use omlx instead	2026-06-11 13:37:30 +08:00
Ryan Yin	6116278251	chore: brew upgrade casks greedy	2026-06-11 11:54:30 +08:00
Ryan Yin	fc1abca4f0	feat: gcp - add plugins	2026-06-10 16:27:57 +08:00
Ryan Yin	c546358888	chore: zed-editor - adjust fonts for idols-ai	2026-06-05 17:17:02 +08:00
Ryan Yin	4e2bf491a0	chore(zed): sync editor settings	2026-06-04 23:48:45 +08:00
Ryan Yin	cfc192afc4	feat: replace vscode with zed-editor (#263 ) * feat: replace vscode with zed-editor * docs: helix	2026-06-04 23:20:59 +08:00
Ryan Yin	008bc8857b	fix(darwin): brew packages	2026-06-04 21:26:19 +08:00
Ryan Yin	839bd3c330	chore: adjust pnpm/pip/uv min-release-age https://cooldowns.dev/	2026-06-03 18:28:35 +08:00
Ryan Yin	92aca13c40	chore: adjust npm min-release-age	2026-06-03 18:07:14 +08:00
Ryan Yin	bea4f7cf06	chore: add llm agents & helix for ruby/kana/akane Signed-off-by: Ryan Yin <xiaoyin_c@qq.com>	2026-06-03 15:48:03 +08:00