my nixos setup https://git.hwebs.info/nixos-config/atom?h=kusanagi-ollama-lan-firewall 2026-08-04T04:26:57Z 2026-08-04T04:26:57Z Henry J. Webster hwebs@hwebs.info 2026-08-04T04:26:57Z urn:sha1:6f135470d274daa3e7a7fec1cb8f36204abd90f0 There is no cross-vendor standard for agent instruction files: claude-code reads CLAUDE.md, opencode and pi read AGENTS.md, each with its own global path. Keep one canonical file (common/AGENTS.md) in this repo, ship it to /etc/AGENTS.md, and symlink every harness's global context path to it via tmpfiles for all normal users: ~/.claude/CLAUDE.md (claude-code 2.1.187 — no AGENTS.md support) ~/.config/opencode/AGENTS.md (opencode 1.15.10) ~/.pi/agent/AGENTS.md (pi 0.75.4) Paths verified against the packaged binaries; see the profile header for details and for the per-repo convention (AGENTS.md + CLAUDE.md symlink). Assisted-by: claude-code:Fable 5 2026-08-04T03:12:32Z Henry J. Webster hwebs@hwebs.info 2026-08-04T03:00:49Z urn:sha1:3df910d75fa98a7d0291e6b8c6889905c6088f64 Move the yokai agent-sandbox account (user, ikai group, /srv/git drop dir, scoped sudo de-escalation, and the local-clones workflow docs) out of machines/enzo into a shared profiles/sandbox.nix that both machines import. The only per-machine value is the human owner allowed to drop into the sandbox, exposed as a `sandbox.owner` string option so the profile stays username-agnostic (enzo: hwebs, kusanagi: henz). kusanagi gains the sandbox it didn't have before; enzo's inline block collapses to one setting. Assisted-by: claude-code:claude-opus-4-8 2026-08-03T18:01:21Z Henry J. Webster hwebs@hwebs.info 2026-08-03T17:59:24Z urn:sha1:9ca21e94b8ade285e749d54441c7d9115da5b522 - replace x-clip with wl-clipboard for wayland machines - add TODOs I noticed while editing Assisted-by: Claude Code:claude-opus-4-8 2026-08-03T18:01:21Z Henry J. Webster hwebs@hwebs.info 2026-08-01T15:27:09Z urn:sha1:cf5470e00e559b91c9905eff22c4def6ba52baa0 Assisted-by: Claude:Opus-4.8 2026-08-01T16:44:49Z Henry J. Webster hwebs@hwebs.info 2026-08-01T16:44:49Z urn:sha1:38a44c7933b6afc81b51e8f0de6537f19eb70359 2026-08-01T14:57:40Z Henry J. Webster hwebs@hwebs.info 2026-08-01T14:57:40Z urn:sha1:726ef32d2631f15f991591ef6879925e08f442f6 kusanagi set XCURSOR_THEME=Bibata-Modern-Classic but never declared the theme in Nix — it only resolved while bibata-cursors lingered in an old nix-env profile. Once that was gone the theme fell off the icon path and the pointer/hand cursor disappeared. Standardize both hosts on Adwaita (matching the shared niri config.kdl): move XCURSOR_THEME/XCURSOR_SIZE and the adwaita-icon-theme package into the shared profiles/desktop.nix so the theme is always on the icon path. Drop the inert HYPRCURSOR_* vars (hyprcursor is unused under niri). Assisted-by: Claude:claude-opus-4-8 2026-07-31T19:48:53Z Henry J. Webster hwebs@hwebs.info 2026-07-31T19:48:53Z urn:sha1:1ae615826dcb98cc9bfa83a0d6c0b550c6f36278 2026-07-31T18:44:54Z Henry J. Webster hwebs@hwebs.info 2026-07-31T18:44:54Z urn:sha1:e3ff89bb779eaa99b9bf9a9d67cfcafd860ac7b4 Replace the KeePassXC-Browser extension, its native-messaging host, and the keepassxc package with Proton Pass (password manager + passkeys) and uBlock Origin. Also disable the Firefox 138+ multi-profile feature so the "Profiles" toolbar button no longer appears. Assisted-by: Claude:claude-opus-4-8 2026-07-31T14:51:20Z Henry J. Webster hwebs@hwebs.info 2026-07-31T14:51:20Z urn:sha1:9cba5e7886b326bfec049c4ca5024274e4b8e201 Move the niri bar (yambar on enzo, waybar on kusanagi) and swaybg wallpaper out of the shared stowed niri config and into per-machine systemd user services bound to graphical-session.target, mirroring the existing xdg-user-dirs-update unit. This makes the bar host-correct (kusanagi previously spawned yambar, which isn't installed there) and keeps host-specific paths out of the shared config. Also switch the greetd session to a small wrapper script that shows a fortune greeting in tuigreet. Assisted-by: Claude:claude-opus-4-8 2026-07-31T12:35:44Z Henry J. Webster hwebs@hwebs.info 2026-07-31T12:35:44Z urn:sha1:2b2e0cc61537fefdddf81f982668d43fe89c0d2f