update

flake.lock

@@ -79,11 +79,11 @@
     "cachyos-kernel-patches": {
       "flake": false,
       "locked": {
-        "lastModified": 1776181525,
+        "lastModified": 1776355454,
-        "narHash": "sha256-g07GhYlAOH0agNE8dIOT33vZ0eviF/HY5xgAQRwLytk=",
+        "narHash": "sha256-b9Hc0sTxjEzDbphzS9yQqxVha/7bsPIs2cQQQvaG45E=",
         "owner": "CachyOS",
         "repo": "kernel-patches",
-        "rev": "fcd21edaf0ff9b69f9d32ea8590002d6acd1c503",
+        "rev": "b5e029226df5cc30c103651072d49a7af2878202",
         "type": "github"
       },
       "original": {
@@ -131,11 +131,11 @@
     "doomemacs": {
       "flake": false,
       "locked": {
-        "lastModified": 1776049930,
+        "lastModified": 1776400245,
-        "narHash": "sha256-6nuelk+8qSRsh5Ryj9EpWOWXeeh/g3lI5mZsBfiFZQI=",
+        "narHash": "sha256-RuQB1PxazI4DOw3O+rEVU2FPT0vP0Xb+Gp/M6Yqer20=",
         "owner": "doomemacs",
         "repo": "doomemacs",
-        "rev": "5eb006f455f0558c97210ba7579880aacb045b67",
+        "rev": "860a91aaac235701f30b70fdc74259d438818968",
         "type": "github"
       },
       "original": {
@@ -154,11 +154,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1776362623,
+        "lastModified": 1776478519,
-        "narHash": "sha256-GT9GB1EWzAS9sVxeqL8zEdXpBJFFp/qoklaVeLzL76o=",
+        "narHash": "sha256-4TWCOVYe0iWEKuW7OH93nRI4Z7u68wNT6k9UJn0FZ5w=",
         "owner": "nix-community",
         "repo": "emacs-overlay",
-        "rev": "1a0129b355cbc765ae868529997175a5af59959d",
+        "rev": "513e332b074507e1b46992952e7d83f329f2c22c",
         "type": "github"
       },
       "original": {
@@ -175,11 +175,11 @@
       },
       "locked": {
         "dir": "pkgs/firefox-addons",
-        "lastModified": 1776312172,
+        "lastModified": 1776398575,
-        "narHash": "sha256-jxZfeRd9mxqrLlsFc9+MLcqTy1eN1hQMLWhX0MJMno8=",
+        "narHash": "sha256-WArU6WOdWxzbzGqYk4w1Mucg+bw/SCl6MoSp+/cZMio=",
         "owner": "rycee",
         "repo": "nur-expressions",
-        "rev": "501d3ee969edad2167e57a1499312cd4fdfdbc78",
+        "rev": "05815686caf4e3678f5aeb5fd36e567886ab0d30",
         "type": "gitlab"
       },
       "original": {
@@ -307,11 +307,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1776184304,
+        "lastModified": 1776454077,
-        "narHash": "sha256-No6QGBmIv5ChiwKCcbkxjdEQ/RO2ZS1gD7SFy6EZ7rc=",
+        "narHash": "sha256-7zSUFWsU0+jlD7WB3YAxQ84Z/iJurA5hKPm8EfEyGJk=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "3c7524c68348ef79ce48308e0978611a050089b2",
+        "rev": "565e5349208fe7d0831ef959103c9bafbeac0681",
         "type": "github"
       },
       "original": {
@@ -366,11 +366,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1776335039,
+        "lastModified": 1776428236,
-        "narHash": "sha256-2lkQhrv6YUCeMlC/lclzq9vkTALv/ptv7d0jIhZnrPQ=",
+        "narHash": "sha256-+0SyQglnT2xUiyY07155G+O7aUWISELwqtTnfURufRU=",
         "owner": "Jovian-Experiments",
         "repo": "Jovian-NixOS",
-        "rev": "cbdf76c063b48d5d755fb26540367b8c2457c2ca",
+        "rev": "eac78fc379ca47f7e21be8539c405e5fb489a857",
         "type": "github"
       },
       "original": {
@@ -437,11 +437,11 @@
         "treefmt-nix": "treefmt-nix"
       },
       "locked": {
-        "lastModified": 1776351423,
+        "lastModified": 1776482297,
-        "narHash": "sha256-JySMZu8hLD8kV2HerIZ6uZyrijc7SUaGhRAKH63X6R4=",
+        "narHash": "sha256-KmsWPwtbO8vrlH/R9stIun0LKZ4PFSCCEdqWDeLgbTE=",
         "owner": "numtide",
         "repo": "llm-agents.nix",
-        "rev": "1fb51dbe453f1c8ec5b7133df561512e43dc7cc2",
+        "rev": "66c76393570f8fc4730caa2dc2d2c470fe33a3c9",
         "type": "github"
       },
       "original": {
@@ -464,11 +464,11 @@
         "xwayland-satellite-unstable": "xwayland-satellite-unstable"
       },
       "locked": {
-        "lastModified": 1776368615,
+        "lastModified": 1776435348,
-        "narHash": "sha256-JGGdvn645wseAbRzwT/Zz2Y0na7v2FZ7FogIyKIFkk8=",
+        "narHash": "sha256-qsZnMThxTqxCJZ7DEKu3DD3KjIPcuUBvZ0C9a2uIvaQ=",
         "owner": "sodiboo",
         "repo": "niri-flake",
-        "rev": "7d67b9d0857c7efc7a6f9fc70982bdcb1e3d9a88",
+        "rev": "55b5b1fc9481ab267603a1099e5d4b4ebc7394d7",
         "type": "github"
       },
       "original": {
@@ -497,11 +497,11 @@
     "niri-unstable": {
       "flake": false,
       "locked": {
-        "lastModified": 1776363469,
+        "lastModified": 1776432730,
-        "narHash": "sha256-MH7ieeYawsCAjGkoHFZfUDZXplEOiFgSpx2pGr5RK3c=",
+        "narHash": "sha256-Pq1ZVvRGq/IFiFH6vkNwMfZEpWk23NjgGdX50COdj/c=",
         "owner": "YaLTeR",
         "repo": "niri",
-        "rev": "82d4c7569e731379284e0653dcdadb8f17cceec7",
+        "rev": "c814c656c53ea9d69f5afb45c88f4dc4d25338cd",
         "type": "github"
       },
       "original": {
@@ -521,11 +521,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1776278748,
+        "lastModified": 1776386586,
-        "narHash": "sha256-mLvw1+fa6vr0C87XfX0ja8yZMx0H+HWL0ena2SBMdp8=",
+        "narHash": "sha256-eVAUaL/6n8mnmBiPpEVW1NDNVSKLWhYVfycG+P0SvWU=",
         "owner": "xddxdd",
         "repo": "nix-cachyos-kernel",
-        "rev": "65eaf1492a6f0850ef2f08943c6bfc59b144e72a",
+        "rev": "c65c3faf90ae07bae101c15ef502f0bcb06c5d74",
         "type": "github"
       },
       "original": {
@@ -547,11 +547,11 @@
         "systems": "systems_3"
       },
       "locked": {
-        "lastModified": 1776333106,
+        "lastModified": 1776419397,
-        "narHash": "sha256-RR8gh+adHxFzpDm0yqKOtJAao8zqRyBcj8O5N1iIuoc=",
+        "narHash": "sha256-vmWJwNYtQFexLG6r/v8Dlou/5z8FbFCLo3QqZ/stLYQ=",
         "owner": "marienz",
         "repo": "nix-doom-emacs-unstraightened",
-        "rev": "191a0107f4863132f723fdc0bf43b322fe849a0a",
+        "rev": "7623dd4adbdf5f8a8464ecc5fd089e5c5cb5dada",
         "type": "github"
       },
       "original": {
@@ -740,11 +740,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1776350315,
+        "lastModified": 1776481912,
-        "narHash": "sha256-ijD4bgb5Iyap9F3MX73vLAZF/SYu+q7Gd7Ux4cbfCWw=",
+        "narHash": "sha256-Xq7p+Ex3YHFAd+fFFLOYw2Wv67582X7SAmrEDtIDZQ4=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "62e3b8aedabc240e5b0cc9fae003bc9edfebbc9b",
+        "rev": "e611106c527e8ab0adbb641183cda284411d575c",
         "type": "github"
       },
       "original": {
@@ -899,11 +899,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1776317517,
+        "lastModified": 1776403742,
-        "narHash": "sha256-JP1XVRabZquf7pnXvRUjp7DV+EBrB6Qmp3+vG3HMy/k=",
+        "narHash": "sha256-ZmGY9XiOsuMS/THsSNkgp2fnc3asXQX/xRrQpWnY9nA=",
         "owner": "0xc000022070",
         "repo": "zen-browser-flake",
-        "rev": "0a7be59e988bb2cb452080f59aaabae70bc415ae",
+        "rev": "ca7077bea5c830470437ea878da2a1940773324c",
         "type": "github"
       },
       "original": {

home-manager/desktop.nix

@@ -9,9 +9,6 @@
     # niri wayland compositor
     ./progs/niri.nix
 
-    # statusbar
-    # ./progs/eww/eww.nix
-
     # lockscreen
     ./progs/swaylock.nix
 
@@ -29,5 +26,4 @@
     # used by /etc/nixos logic to launch niri
     config.programs.niri.package
   ];
-
 }

home-manager/progs/eww/config/eww.scss

@@ -1,109 +0,0 @@
-$background: #1e1e2e;
-$pink: #f5c2e7;
-$lavendar: #b4befe;
-$red: #f38ba8;
-$maroon: #eba0ac;
-$peach: #fab387;
-$yellow: #f9e2af;
-$green: #a6e3a1;
-$text: #cdd6f4;
-$subtext: #a6adc8;
-$surface: #585b70;
-
-* {
-	color: $text;
-	font-family: CaskaydiaCove Nerd Font Mono;
-	font-weight: 600;
-	font-size: 10pt;
-	padding: 0 1px;
-}
-
-.red {
-	color: $red;
-}
-
-.maroon {
-	color: $maroon;
-}
-
-.peach {
-	color: $peach;
-}
-
-.yellow {
-	color: $yellow;
-}
-
-.green {
-	color: $green;
-}
-
-.lavendar {
-	color: $lavendar;
-}
-
-.symbol {
-	color: $lavendar;
-	font-size: 20px;
-}
-
-.button {
-	* {
-		all: unset;
-		margin: 0 5px;
-		font-size: 14pt;
-		transition: color 0.2s ease-in-out;
-	}
-
-	&:hover * {
-		color: $pink;
-	}
-}
-
-.bluetooth * {
-	font-size: 10pt;
-	padding: 0 0.3em;
-}
-
-.padded>*:not(:last-child) {
-	padding: 0 10px;
-	border-right: 1px solid $surface;
-}
-
-.background {
-	border: 1px solid $pink;
-	background-color: $background;
-	border-radius: 12px;
-	opacity: 0.8;
-}
-
-scale trough {
-	margin: 0 10px;
-	border: none;
-	background-color: #FFF;
-	min-height: 3px;
-	min-width: 100px;
-
-	& slider {
-		box-shadow: none;
-		background-image: none;
-		border: none;
-		background-color: $pink;
-		min-width: 5pt;
-		min-height: 5pt;
-		margin: -5pt;
-	}
-
-	& highlight {
-		border: none;
-		background-color: $lavendar;
-	}
-}
-
-.clipboard {
-	color: $subtext;
-}
-
-.time {
-	padding-right: 10px;
-}

home-manager/progs/eww/config/eww.yuck

@@ -1 +0,0 @@
-(include "./statusbar.yuck")

home-manager/progs/eww/config/scripts/currentWindow.sh

@@ -1,17 +0,0 @@
-#!/usr/bin/env bash
-niri_data=$(niri msg --json focused-window)
-
-if [[ "$niri_data" == "null" ]]; then
-    exit 0
-fi
-
-name=$(echo "$niri_data" | jq -r '.["app_id"], .["title"]' | tr '\n' ' ' | sed 's/.$//')
-proc_name=$(echo "$name" | head -c 55)
-
-
-# TODO! fix this logic, add a '...' at the end
-if [[ "$name" != "$proc_name" ]]; then
-    proc_name="$proc_name..."
-fi
-
-echo "$proc_name"

home-manager/progs/eww/config/scripts/currentWorkspace.sh

@@ -1,3 +0,0 @@
-#!/usr/bin/env fish
-
-niri msg --json workspaces | jq -r '.[] | select(.is_focused == true) | .["id"]'

home-manager/progs/eww/config/scripts/power_bat.rs

@@ -1,58 +0,0 @@
-#!/usr/bin/env rust-script
-
-use std::{fmt, fs::read_to_string, str::FromStr};
-
-const BASE_PATH: &str = "/sys/class/power_supply/BAT1/";
-const CURRENT_NOW_PATH: &str = "current_now";
-const VOLTAGE_NOW_PATH: &str = "voltage_now";
-const STATUS_PATH: &str = "status";
-const FACTOR: f32 = 1e6_f32;
-
-#[derive(Debug)]
-enum Status {
-    Charging,
-    Discharging,
-    NotCharging,
-}
-
-impl FromStr for Status {
-    type Err = &'static str;
-
-    fn from_str(input: &str) -> Result<Status, Self::Err> {
-        match input {
-            "Charging" => Ok(Status::Charging),
-            "Discharging" => Ok(Status::Discharging),
-            "Not charging" => Ok(Status::NotCharging),
-            _ => Err("unknown state"),
-        }
-    }
-}
-
-impl fmt::Display for Status {
-    fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
-        fmt::Debug::fmt(self, f)
-    }
-}
-
-fn fetch_and_trim_into<T: FromStr<Err = impl fmt::Debug>>(path: &str) -> T {
-    let mut content = read_to_string(BASE_PATH.to_owned() + path).unwrap();
-    content.pop();
-    T::from_str(&content).unwrap()
-}
-
-fn fetch_bat_info(path: &str) -> f32 {
-    let value: f32 = fetch_and_trim_into(path);
-    value / FACTOR
-}
-
-fn main() {
-    let current_now: f32 = fetch_bat_info(CURRENT_NOW_PATH);
-    let voltage_now: f32 = fetch_bat_info(VOLTAGE_NOW_PATH);
-    let watts: f32 = current_now * voltage_now;
-    let status: Status = fetch_and_trim_into(STATUS_PATH);
-
-    println!(
-        "voltage: {:.4}\ncurrent: {:.4}\nwatts: {:.4}\nstatus: {}",
-        voltage_now, current_now, watts, status
-    );
-}

home-manager/progs/eww/config/scripts/sound/getSink.sh

@@ -1,2 +0,0 @@
-#!/usr/bin/env sh
-wpctl inspect @DEFAULT_SINK@ | grep -E "^  +\* node\.description" | cut -d' ' -f6- | tr -d '"'

home-manager/progs/eww/config/scripts/sound/getVolume.sh

@@ -1,22 +0,0 @@
-#!/usr/bin/env bash
-output=$(wpctl get-volume @DEFAULT_SINK@ | cut -d' ' -f2- | sed -E 's/\.//g' | sed 's/^0*//g')
-count=$(echo "$output" | awk -F, '{print $1+0}')
-muted=$(echo "$output" | cut -d'[' -f2 | cut -d ']' -f1)
-
-# if not muted, set to empty string
-if [ "$muted" == "$count" ]; then
-  muted=""
-fi
-
-color="green"
-if ((count > 75)); then color="yellow"; fi
-if ((count > 90)); then color="peach"; fi
-if ((count > 100)); then color="maroon"; fi
-if ((count > 110)); then color="red"; fi
-
-output="${count}%"
-if [ "$muted" != "" ]; then
-  output="${output} [${muted}]"
-fi
-
-echo "{\"count\":\"${output}\", \"color\":\"${color}\"}"

home-manager/progs/eww/config/scripts/wifiInfo.zsh

@@ -1,23 +0,0 @@
-#!/usr/bin/env zsh
-export CHARSET=ASCII
-case $1 in
-	name)
-		nmcli -f IN-USE,SSID d w | grep '*' | sed 's/[\* ]//g' | cat
-		exit 0;;
-	strength)
-		str=$(nmcli -f ACTIVE,BARS d w | grep 'yes' | tr -d ' yesno')
-		case ${str: 0:-1} in
-		'****')
-			icon="󰤨"; colour="green";;
-		'***')
-			icon="󰤥"; colour="yellow";;
-		'**')
-			icon="󰤢"; colour="peach";;
-		'*')
-			icon="󰤟"; colour="maroon";;
-		*)
-			icon="󰤯"; colour="red";;
-		esac
-		echo "{\"icon\":\"$icon\",\"colour\":\"$colour\"}"
-		exit 0;;
-esac

home-manager/progs/eww/config/statusbar.yuck

@@ -1,130 +0,0 @@
-(defwindow statusbar
-    :monitor 0
-    :stacking "fg"
-    :exclusive true
-    :geometry (geometry
-               :y "0.5%"
-               :width "100%"
-               :height "24px"
-               :anchor "top center")
-    (statusbar))
-
-(defwidget statusbar []
-  (centerbox
-   (box :space-evenly false :halign 'start' :class 'padded'
-        (window-title))
-   (time)
-   (box :space-evenly false :halign 'end' :class 'padded'
-        (brightness-ctl)
-        (brightness-ctl-opener)
-        (volume)
-        (battery)
-        (bluetooth)
-        (wifi))))
-
-(defwidget cmd-slider [?symbol value command max color]
-           (box :space-evenly false
-                (label :text symbol :class "symbol")
-                (scale
-                 :min 0 :max max
-                 :value value
-                 :round-digits 0
-                 :timeout "200ms"
-                 :onchange command)
-                (label :text "${value}%" :class color)))
-
-(defpoll windowtitle :interval "1s" `scripts/currentWindow.sh`)
-
-(defwidget window-title []
-  (label
-   :text {windowtitle == "" ? "" : "(${windowtitle})"}))
-
-(defwidget brightness-ctl []
-  (box :visible brightnessctl-open
-       (cmd-slider :symbol "󰃠" :value brightness
-                   :command `brightnessctl set {}%`
-                   :max 101 :color {
-                   brightness >= 80 ? "green" :
-                   brightness >= 50 ? "yellow" :
-                   brightness >= 30 ? "peach" :
-                   brightness >= 10 ? "maroon" : "red"
-                   })))
-
-
-(defpoll brightness :interval "1s" :run-while brightnessctl-open `brightnessctl -m | awk -F, '{print $4+0}'`)
-
-
-(defvar brightnessctl-open false)
-(defwidget brightness-ctl-opener []
-  (eventbox :class "button"
-    (button
-      :onclick `${EWW_CMD} update brightnessctl-open=${!brightnessctl-open}`
-    "󰃠")))
-
-(defwidget wifi []
-  (eventbox
-    :class "button ${wifi-strength.colour}"
-    (label
-      :text {wifi-strength.icon}
-    :tooltip "Connected To: ${wifi-name}")))
-
-(defpoll wifi-strength :interval "10s" `scripts/wifiInfo.zsh strength`)
-(defpoll wifi-name :interval "1m" `scripts/wifiInfo.zsh name`)
-
-(defwidget bluetooth []
-  (eventbox
-    :class "bluetooth button ${ bluetooth-name != "" ? "green" : "lavendar" }"
-    :onclick `blueman-manager &`
-    (label
-    :text "${bluetooth-name} 󰂯")))
-
-; `FNR == 1 + head -c 30` so the name doesn't explode the screen
-(defpoll bluetooth-name :interval "10s" `bluetoothctl devices Connected | awk '$1 == "Device" {print $0}' | cut -d' ' -f3-`)
-
-(defwidget time []
-  (box
-    :space-evenly false
-    :class "time"
-    :tooltip {time.long}
-    (label :class "yellow" :text {time.hour})
-    (label :text ":")
-    (label :class "yellow" :text {time.minute})))
-
-(defpoll time :interval "1s" `date +'{"long":"%a %b %e %H:%M:%S %Z %Y","hour":"%H","minute":"%M"}'`)
-
-(defpoll powerstats :interval "2s" `power_bat`)
-
-(defwidget battery []
-  (box :space-evenly false
-    :tooltip powerstats
-    (label
-      :text {EWW_BATTERY.BAT1.status == "Charging" ? "󰂄" :
-      EWW_BATTERY.BAT1.capacity >= 90 ? "󰁹" :
-      EWW_BATTERY.BAT1.capacity >= 80 ? "󰂂" :
-      EWW_BATTERY.BAT1.capacity >= 70 ? "󰂁" :
-      EWW_BATTERY.BAT1.capacity >= 60 ? "󰂀" :
-      EWW_BATTERY.BAT1.capacity >= 50 ? "󰁿" :
-      EWW_BATTERY.BAT1.capacity >= 40 ? "󰁾" :
-      EWW_BATTERY.BAT1.capacity >= 30 ? "󰁽" :
-      EWW_BATTERY.BAT1.capacity >= 20 ? "󰁼" :
-      EWW_BATTERY.BAT1.capacity >= 10 ? "󰁻" : "󰁺"
-      }
-      :class {
-      EWW_BATTERY.BAT1.capacity >= 80 ? "green" :
-      EWW_BATTERY.BAT1.capacity >= 50 ? "yellow" :
-      EWW_BATTERY.BAT1.capacity >= 30 ? "peach" :
-      EWW_BATTERY.BAT1.capacity >= 10 ? "maroon" : "red"
-    })
-    (label :text "${EWW_BATTERY.BAT1.capacity}%" :class "yellow")))
-
-
-(defpoll volumevalue :interval "1s" `scripts/sound/getVolume.sh`)
-(defpoll volumesink :interval "1s" `scripts/sound/getSink.sh`)
-
-(defwidget volume []
-  (eventbox :tooltip volumesink
-  :onclick `pwvucontrol &`
-  (label :text "${volumevalue.count}" :class {volumevalue.color})))
-
-
-(defpoll currentworkspace :interval "1s" `scripts/currentWorkspace.sh`)

home-manager/progs/eww/eww.nix

@@ -1,40 +0,0 @@
-{
-  pkgs,
-  lib,
-  config,
-  ...
-}:
-{
-  home.packages = with pkgs; [
-    zsh
-    bluez
-    brightnessctl
-    (callPackage ./power_bat.nix { })
-  ];
-
-  programs.eww = {
-    enable = true;
-    configDir = ./config;
-  };
-
-  programs.niri.settings.spawn-at-startup = [
-    {
-      command = [
-        (lib.getExe config.programs.eww.package)
-        "-c"
-        "${config.programs.eww.configDir}"
-        "open"
-        "statusbar"
-      ];
-    }
-
-    # swaybg works on more than just sway (sets a wallpaper)
-    {
-      command = [
-        (lib.getExe pkgs.swaybg)
-        "-i"
-        "${../wallpaper.png}"
-      ];
-    }
-  ];
-}

home-manager/progs/eww/power_bat.nix

@@ -1,4 +0,0 @@
-{ pkgs, lib, ... }:
-pkgs.writeShellScriptBin "power_bat" ''
-  exec ${lib.getExe pkgs.rust-script} ${./config/scripts/power_bat.rs} "$@"
-''

home-manager/progs/pi.nix

@@ -10,10 +10,10 @@ let
   #   librarian/explore/quick   → smol/commit = haiku
   ompSettings = {
     modelRoles = {
-      default = "anthropic/claude-opus-4-6:high";
+      default = "anthropic/claude-opus-4-7:high";
       smol = "anthropic/claude-haiku-4-5:low";
-      slow = "anthropic/claude-opus-4-6:xhigh";
+      slow = "anthropic/claude-opus-4-7:xhigh";
-      plan = "anthropic/claude-opus-4-6:high";
+      plan = "anthropic/claude-opus-4-7:high";
       commit = "anthropic/claude-haiku-4-5:low";
     };
   };

system/common.nix

@@ -165,7 +165,7 @@
 
           # staging drivers (experimental/unmaintained)
           STAGING = lib.mkForce no;
-          SND_PCI = lib.mkForce no;
+          # SND_PCI stays — SND_HDA_INTEL (AMD HDA audio) lives under it
           ACCESSIBILITY = lib.mkForce no;
           MTD = lib.mkForce no;
           MEDIA_RC_SUPPORT = lib.mkForce no;

system/pull-update.nix

@@ -1,70 +0,0 @@
-# Pull-based NixOS updates for hosts that can't be pushed to reliably.
-# CI builds the system closure on muffin (which Harmonia serves), then
-# records the output store path at /deploy/<hostname>.  On boot this
-# service fetches that path, pulls the closure from the binary cache,
-# sets it as the boot profile, and reboots into it.
-{ pkgs, hostname, lib, ... }:
-let
-  deploy-url = "https://nix-cache.sigkill.computer/deploy/${hostname}";
-
-  pull-update = pkgs.writeShellApplication {
-    name = "pull-update";
-
-    runtimeInputs = with pkgs; [
-      pkgs.curl
-      pkgs.coreutils
-      pkgs.nix
-      pkgs.systemd
-      pkgs.util-linux
-    ];
-
-    text = ''
-      set -uo pipefail
-
-      # wait for actual connectivity, not just networkd "up"
-      for i in $(seq 1 30); do
-        if curl -sf --max-time 5 "${deploy-url}" >/dev/null; then
-          break
-        fi
-        echo "Waiting for network... ($i/30)"
-        sleep 2
-      done
-
-      STORE_PATH=$(curl -sf --max-time 30 "${deploy-url}" || true)
-
-      if [ -z "$STORE_PATH" ]; then
-        echo "Server unreachable or no deployment available, skipping"
-        exit 0
-      fi
-
-      CURRENT=$(readlink -f /nix/var/nix/profiles/system)
-      if [ "$CURRENT" = "$STORE_PATH" ]; then
-        echo "Already on latest configuration"
-        exit 0
-      fi
-
-      echo "Update available: $CURRENT -> $STORE_PATH"
-
-      nix-store -r "$STORE_PATH" || { echo "Failed to fetch closure"; exit 1; }
-      nix-env -p /nix/var/nix/profiles/system --set "$STORE_PATH" || { echo "Failed to set profile"; exit 1; }
-      "$STORE_PATH/bin/switch-to-configuration" boot || { echo "Failed to install boot entry"; exit 1; }
-
-      wall "System update installed. Rebooting in 10 seconds..."
-      sleep 10
-      systemctl reboot
-    '';
-  };
-in
-{
-  systemd.services.pull-update = {
-    description = "Pull latest NixOS configuration from binary cache";
-    after = [ "network-online.target" ];
-    wants = [ "network-online.target" ];
-    wantedBy = [ "multi-user.target" ];
-    restartIfChanged = false;
-    serviceConfig = {
-      Type = "oneshot";
-      ExecStart = lib.getExe pull-update;
-    };
-  };
-}

system/system-yarn.nix

@@ -11,7 +11,6 @@
     ./disk_yarn.nix
     ./common.nix
     ./impermanence.nix
-    ./pull-update.nix
     ./no-rgb.nix
     ./vr.nix
 
@@ -76,12 +75,54 @@
   # LACT (Linux AMDGPU Configuration Tool): https://github.com/ilya-zlobintsev/LACT
   environment.systemPackages = with pkgs; [
     lact
+    jovian-stubs
   ];
   systemd.packages = with pkgs; [ lact ];
   systemd.services.lactd.wantedBy = [ "multi-user.target" ];
 
   systemd.services.lactd.serviceConfig.ExecStartPre = "${lib.getExe pkgs.bash} -c \"sleep 3s\"";
 
+  # root-level service that applies a pending update. Triggered by
+  # steamos-update (via systemctl start) when the user accepts an update.
+  # Runs as root so it can write the system profile and boot entry.
+  systemd.services.pull-update-apply = {
+    description = "Apply pending NixOS update pulled from binary cache";
+    serviceConfig = {
+      Type = "oneshot";
+      ExecStart = pkgs.writeShellScript "pull-update-apply" ''
+        set -uo pipefail
+        export PATH=${
+          pkgs.lib.makeBinPath [
+            pkgs.curl
+            pkgs.coreutils
+            pkgs.nix
+          ]
+        }
+        STORE_PATH=$(curl -sf --max-time 30 "https://nix-cache.sigkill.computer/deploy/yarn" || true)
+        if [ -z "$STORE_PATH" ]; then
+          echo "server unreachable"
+          exit 1
+        fi
+        echo "applying $STORE_PATH"
+        nix-store -r "$STORE_PATH" || { echo "fetch failed"; exit 1; }
+        nix-env -p /nix/var/nix/profiles/system --set "$STORE_PATH" || { echo "profile set failed"; exit 1; }
+        "$STORE_PATH/bin/switch-to-configuration" boot || { echo "boot entry failed"; exit 1; }
+        echo "update applied; reboot required"
+      '';
+    };
+  };
+
+  # Allow primary user to start pull-update-apply.service without a password
+  security.polkit.extraConfig = ''
+    polkit.addRule(function(action, subject) {
+      if (action.id == "org.freedesktop.systemd1.manage-units" &&
+          action.lookup("unit") == "pull-update-apply.service" &&
+          subject.user == "${username}") {
+        return polkit.Result.YES;
+      }
+    });
+  '';
+
   nixpkgs.config.allowUnfreePredicate =
     pkg:
     builtins.elem (lib.getName pkg) [
@@ -97,19 +138,69 @@
   # This prevents Steam from requesting reboots for "system updates"
   # Steam client updates will still work normally
   nixpkgs.overlays = [
-    (final: prev: {
+    (
+      final: prev:
+      let
+        deploy-url = "https://nix-cache.sigkill.computer/deploy/yarn";
+
+        steamos-update-script = final.writeShellScript "steamos-update" ''
+          export PATH=${
+            final.lib.makeBinPath [
+              final.curl
+              final.coreutils
+              final.systemd
+            ]
+          }
+
+          STORE_PATH=$(curl -sf --max-time 30 "${deploy-url}" || true)
+
+          if [ -z "$STORE_PATH" ]; then
+            >&2 echo "[steamos-update] server unreachable"
+            exit 7
+          fi
+
+          CURRENT=$(readlink -f /nix/var/nix/profiles/system)
+          if [ "$CURRENT" = "$STORE_PATH" ]; then
+            >&2 echo "[steamos-update] no update available"
+            exit 0
+          fi
+
+          # check-only mode: just report that an update exists
+          if [ "''${1:-}" = "check" ] || [ "''${1:-}" = "--check-only" ]; then
+            >&2 echo "[steamos-update] update available"
+            exit 0
+          fi
+
+          # apply: trigger the root-running systemd service to install the update
+          >&2 echo "[steamos-update] applying update..."
+          if systemctl start --wait pull-update-apply.service; then
+            >&2 echo "[steamos-update] update installed, reboot to apply"
+            exit 0
+          else
+            >&2 echo "[steamos-update] apply failed; see 'journalctl -u pull-update-apply'"
+            exit 1
+          fi
+        '';
+      in
+      {
         jovian-stubs = prev.stdenv.mkDerivation {
-        name = "jovian-stubs-no-update";
+          name = "jovian-stubs";
           dontUnpack = true;
           installPhase = ''
             mkdir -p $out/bin
+            ln -s ${steamos-update-script} $out/bin/steamos-update
+            ln -s ${steamos-update-script} $out/bin/steamos-mandatory-update
 
-          # steamos-update: always report "no update available" (exit 7)
+            # jupiter-initial-firmware-update: no-op (not a real steam deck)
-          # This disables the kernel mismatch check that triggers reboot prompts
+            cat > $out/bin/jupiter-initial-firmware-update << 'STUB'
-          cat > $out/bin/steamos-update << 'STUB'
             #!/bin/sh
-          >&2 echo "[JOVIAN] $0: stub called with: $* (system updates disabled)"
+            exit 0
-          exit 7
+            STUB
+
+            # jupiter-biosupdate: no-op (not a real steam deck)
+            cat > $out/bin/jupiter-biosupdate << 'STUB'
+            #!/bin/sh
+            exit 0
             STUB
 
             # steamos-reboot: reboot the system
@@ -146,16 +237,24 @@
             exec /run/wrappers/bin/pkexec "$@"
             STUB
 
-          # sudo: pass through to doas
+            # sudo: strip flags and run the command directly (no escalation).
+            # privileged ops are delegated to root systemd services via systemctl.
             cat > $out/bin/sudo << 'STUB'
             #!/bin/sh
-          exec /run/wrappers/bin/doas "$@"
+            while [ $# -gt 0 ]; do
+              case "$1" in
+                -*) shift ;;
+                *) break ;;
+              esac
+            done
+            exec "$@"
             STUB
 
-          chmod 755 $out/bin/*
+            find $out/bin -type f -exec chmod 755 {} +
           '';
         };
-    })
+      }
+    )
   ];
 
   jovian = {