yarn: move pull-update into steamos-update script

system/system-yarn.nix

@@ -11,7 +11,6 @@
     ./disk_yarn.nix
     ./common.nix
     ./impermanence.nix
-    ./pull-update.nix
     ./no-rgb.nix
     ./vr.nix
 
@@ -97,65 +96,102 @@
   # This prevents Steam from requesting reboots for "system updates"
   # Steam client updates will still work normally
   nixpkgs.overlays = [
-    (final: prev: {
-      jovian-stubs = prev.stdenv.mkDerivation {
-        name = "jovian-stubs-no-update";
-        dontUnpack = true;
-        installPhase = ''
-          mkdir -p $out/bin
+    (
+      final: prev:
+      let
+        deploy-url = "https://nix-cache.sigkill.computer/deploy/yarn";
 
-          # steamos-update: always report "no update available" (exit 7)
-          # This disables the kernel mismatch check that triggers reboot prompts
-          cat > $out/bin/steamos-update << 'STUB'
-          #!/bin/sh
-          >&2 echo "[JOVIAN] $0: stub called with: $* (system updates disabled)"
-          exit 7
-          STUB
+        steamos-update-script = final.writeShellScript "steamos-update" ''
+          export PATH=${
+            final.lib.makeBinPath [
+              final.curl
+              final.coreutils
+              final.nix
+            ]
+          }
 
-          # steamos-reboot: reboot the system
-          cat > $out/bin/steamos-reboot << 'STUB'
-          #!/bin/sh
-          >&2 echo "[JOVIAN] $0: stub called with: $*"
-          systemctl reboot
-          STUB
+          STORE_PATH=$(curl -sf --max-time 30 "${deploy-url}" || true)
 
-          # steamos-select-branch: no-op stub
-          cat > $out/bin/steamos-select-branch << 'STUB'
-          #!/bin/sh
-          >&2 echo "[JOVIAN] $0: stub called with: $*"
-          exit 0
-          STUB
+          if [ -z "$STORE_PATH" ]; then
+            >&2 echo "[steamos-update] server unreachable"
+            exit 7
+          fi
 
-          # steamos-factory-reset-config: no-op stub
-          cat > $out/bin/steamos-factory-reset-config << 'STUB'
-          #!/bin/sh
-          >&2 echo "[JOVIAN] $0: stub called with: $*"
-          exit 0
-          STUB
+          CURRENT=$(readlink -f /nix/var/nix/profiles/system)
+          if [ "$CURRENT" = "$STORE_PATH" ]; then
+            >&2 echo "[steamos-update] no update available"
+            exit 7
+          fi
 
-          # steamos-firmware-update: no-op stub
-          cat > $out/bin/steamos-firmware-update << 'STUB'
-          #!/bin/sh
-          >&2 echo "[JOVIAN] $0: stub called with: $*"
-          exit 0
-          STUB
+          # check-only mode: just report that an update exists
+          if [ "''${1:-}" = "check" ] || [ "''${1:-}" = "--check-only" ]; then
+            >&2 echo "[steamos-update] update available"
+            exit 0
+          fi
 
-          # pkexec: pass through to real pkexec
-          cat > $out/bin/pkexec << 'STUB'
-          #!/bin/sh
-          exec /run/wrappers/bin/pkexec "$@"
-          STUB
+          >&2 echo "[steamos-update] downloading update..."
+          nix-store -r "$STORE_PATH" || { >&2 echo "[steamos-update] fetch failed"; exit 1; }
 
-          # sudo: pass through to doas
-          cat > $out/bin/sudo << 'STUB'
-          #!/bin/sh
-          exec /run/wrappers/bin/doas "$@"
-          STUB
+          >&2 echo "[steamos-update] installing update..."
+          nix-env -p /nix/var/nix/profiles/system --set "$STORE_PATH" || { >&2 echo "[steamos-update] profile set failed"; exit 1; }
+          "$STORE_PATH/bin/switch-to-configuration" boot || { >&2 echo "[steamos-update] boot entry failed"; exit 1; }
 
-          chmod 755 $out/bin/*
+          >&2 echo "[steamos-update] update installed, reboot to apply"
         '';
-      };
-    })
+      in
+      {
+        jovian-stubs = prev.stdenv.mkDerivation {
+          name = "jovian-stubs";
+          dontUnpack = true;
+          installPhase = ''
+            mkdir -p $out/bin
+            ln -s ${steamos-update-script} $out/bin/steamos-update
+
+            # steamos-reboot: reboot the system
+            cat > $out/bin/steamos-reboot << 'STUB'
+            #!/bin/sh
+            >&2 echo "[JOVIAN] $0: stub called with: $*"
+            systemctl reboot
+            STUB
+
+            # steamos-select-branch: no-op stub
+            cat > $out/bin/steamos-select-branch << 'STUB'
+            #!/bin/sh
+            >&2 echo "[JOVIAN] $0: stub called with: $*"
+            exit 0
+            STUB
+
+            # steamos-factory-reset-config: no-op stub
+            cat > $out/bin/steamos-factory-reset-config << 'STUB'
+            #!/bin/sh
+            >&2 echo "[JOVIAN] $0: stub called with: $*"
+            exit 0
+            STUB
+
+            # steamos-firmware-update: no-op stub
+            cat > $out/bin/steamos-firmware-update << 'STUB'
+            #!/bin/sh
+            >&2 echo "[JOVIAN] $0: stub called with: $*"
+            exit 0
+            STUB
+
+            # pkexec: pass through to real pkexec
+            cat > $out/bin/pkexec << 'STUB'
+            #!/bin/sh
+            exec /run/wrappers/bin/pkexec "$@"
+            STUB
+
+            # sudo: pass through to doas
+            cat > $out/bin/sudo << 'STUB'
+            #!/bin/sh
+            exec /run/wrappers/bin/doas "$@"
+            STUB
+
+            chmod 755 $out/bin/*
+          '';
+        };
+      }
+    )
   ];
 
   jovian = {