From ca36b0783959cda7a33c5bd1ef278bf1163ccd80 Mon Sep 17 00:00:00 2001
From: moons <moons@moons14.com>
Date: Fri, 7 Aug 2026 06:28:27 +0900
Subject: [PATCH] Display OFF

---
 modules/applications/dpms-off/home/nixos.nix  |  16 +
 modules/applications/dpms-off/meta.nix        |   3 +
 modules/applications/noctalia/home.nix        |  35 ++
 modules/applications/opencode/home.nix        | 385 +++++++++++++++++-
 .../profiles/interface/linux-desktop/meta.nix |   1 +
 5 files changed, 436 insertions(+), 4 deletions(-)
 create mode 100644 modules/applications/dpms-off/home/nixos.nix
 create mode 100644 modules/applications/dpms-off/meta.nix

diff --git a/modules/applications/dpms-off/home/nixos.nix b/modules/applications/dpms-off/home/nixos.nix
new file mode 100644
index 0000000..3f95177
--- /dev/null
+++ b/modules/applications/dpms-off/home/nixos.nix
@@ -0,0 +1,16 @@
+{ pkgs, ... }:
+{
+  home.packages = [ pkgs.dpms-off ];
+
+  xdg.desktopEntries.dpms-off = {
+    name = "Display Off";
+    genericName = "Display Power Management";
+    comment = "Turn off all displays using DPMS";
+    exec = "${pkgs.dpms-off}/bin/dpms-off";
+    icon = "display";
+    terminal = false;
+    type = "Application";
+    categories = [ "System" ];
+    settings.Keywords = "Display Off;Screen Saver;DPMS;Power;Monitor;Screen;";
+  };
+}
diff --git a/modules/applications/dpms-off/meta.nix b/modules/applications/dpms-off/meta.nix
new file mode 100644
index 0000000..1259e62
--- /dev/null
+++ b/modules/applications/dpms-off/meta.nix
@@ -0,0 +1,3 @@
+{
+  description = "Manual DPMS-off launcher for Wayland";
+}
diff --git a/modules/applications/noctalia/home.nix b/modules/applications/noctalia/home.nix
index d164c2b..0005a82 100644
--- a/modules/applications/noctalia/home.nix
+++ b/modules/applications/noctalia/home.nix
@@ -203,6 +203,41 @@ in
         corner_radius_scale = 0.2;
         clipboard_enabled = false;
         launch_apps_as_systemd_services = true;
+
+        session = {
+          grid = true;
+          grid_columns = 3;
+
+          actions = [
+            {
+              action = "lock";
+            }
+            {
+              action = "logout";
+            }
+            {
+              action = "lock_and_suspend";
+            }
+            {
+              action = "command";
+              label = "Display OFF";
+
+              command = "${pkgs.dpms-off}/bin/dpms-off";
+
+              variant = "secondary";
+            }
+            {
+              action = "reboot";
+              variant = "destructive";
+              countdown_seconds = 5;
+            }
+            {
+              action = "shutdown";
+              variant = "destructive";
+              countdown_seconds = 5;
+            }
+          ];
+        };
       };
 
       wallpaper = {
diff --git a/modules/applications/opencode/home.nix b/modules/applications/opencode/home.nix
index da192d5..51b5238 100644
--- a/modules/applications/opencode/home.nix
+++ b/modules/applications/opencode/home.nix
@@ -1,6 +1,383 @@
-{ inputs, pkgs, ... }:
 {
-  home.packages = [
-    inputs.llm-agents.packages.${pkgs.stdenv.hostPlatform.system}.opencode
-  ];
+  inputs,
+  pkgs,
+  ...
+}:
+{
+  programs.opencode = {
+    enable = true;
+    package = inputs.llm-agents.packages.${pkgs.stdenv.hostPlatform.system}.opencode;
+
+    # Project-specific tools should normally come from that project's dev shell.
+    extraPackages = with pkgs; [
+      fd
+      git
+      jq
+      ripgrep
+    ];
+
+    settings = {
+      model = "openai/gpt-5.6-sol";
+      small_model = "opencode-go/deepseek-v4-flash";
+      default_agent = "orchestrator";
+      subagent_depth = 1;
+
+      autoupdate = false;
+      share = "disabled";
+
+      compaction = {
+        auto = true;
+        prune = true;
+        reserved = 10000;
+      };
+
+      # Fallback for built-in or newly-added agents. The custom agents below
+      # override this in their Markdown frontmatter.
+      permission = {
+        "*" = "ask";
+        question = "allow";
+      };
+    };
+
+    agents = {
+      orchestrator = ''
+        ---
+        description: "Technical lead that plans and delegates all repository operations"
+        mode: primary
+        model: openai/gpt-5.6-sol
+        steps: 14
+        reasoningEffort: medium
+        textVerbosity: low
+        permission:
+          "*": deny
+          question: allow
+          task:
+            "*": deny
+            explore-cheap: allow
+            implement-cheap: allow
+            verify-cheap: allow
+        ---
+
+        You are the technical lead and the only expensive model in this workflow.
+        Do not read repository files, edit files, or run shell commands yourself.
+        Obtain repository evidence through subagents and keep raw logs out of your
+        own context.
+
+        For each non-trivial coding task:
+
+        1. Define explicit, testable acceptance criteria.
+        2. Ask `explore-cheap` for the smallest relevant code surface, constraints,
+           existing conventions, and suitable verification commands.
+        3. Decide the design yourself.
+        4. Give `implement-cheap` one bounded implementation task.
+        5. Ask `verify-cheap` to inspect the real diff and verify it independently.
+        6. On failure, request one focused repair and verify again. Stop after two
+           failed repair cycles and explain the concrete blocker.
+
+        Keep architecture, public APIs, authentication, authorization, migrations,
+        and security-boundary decisions at this level. Never run two write-capable
+        tasks concurrently in the same worktree.
+
+        Require subagents to return:
+
+        status: PASS | FAIL | INCONCLUSIVE
+        summary: at most 8 concise lines
+        files_touched: paths or none
+        commands_run: exact command and exit code
+        acceptance_criteria: criterion plus PASS | FAIL | NOT_CHECKED
+        evidence: file, symbol, and concise observation
+        unresolved_risks: risks or none
+        recommended_next_action: exactly one action
+      '';
+
+      explore-cheap = ''
+        ---
+        description: "Cheap read-only repository and dependency reconnaissance"
+        mode: subagent
+        hidden: true
+        model: opencode-go/deepseek-v4-flash
+        steps: 10
+        permission:
+          "*": deny
+          read:
+            "*": allow
+            "*.env": ask
+            "*.env.*": ask
+            "*.env.example": allow
+          glob: allow
+          grep: allow
+          list: allow
+          lsp: allow
+          webfetch: allow
+          websearch: allow
+          question: allow
+          external_directory: ask
+        ---
+
+        Perform read-only reconnaissance. Return only concrete file paths, symbols,
+        execution flow, existing patterns, repository instructions, and the narrowest
+        useful checks. Do not edit files, run shell commands, dump entire files, or
+        propose unrelated refactors. Clearly separate observed evidence from inference.
+        Use the parent-requested handoff and stay under 700 words.
+      '';
+
+      implement-cheap = ''
+        ---
+        description: "Cheap worker that implements one bounded change and runs checks"
+        mode: subagent
+        hidden: true
+        model: opencode-go/kimi-k2.7-code
+        steps: 28
+        permission:
+          "*": deny
+          read:
+            "*": allow
+            "*.env": ask
+            "*.env.*": ask
+            "*.env.example": allow
+          edit:
+            "*": allow
+            "*.env": ask
+            "*.env.*": ask
+            "*.env.example": allow
+            ".opencode/*": ask
+            "*opencode.json*": ask
+            "*AGENTS.md": ask
+            ".github/workflows/*": ask
+          glob: allow
+          grep: allow
+          list: allow
+          lsp: allow
+          webfetch: allow
+          websearch: allow
+          question: allow
+          external_directory: ask
+          doom_loop: ask
+          bash:
+            # Routine local inspection/build/test commands run without approval.
+            "*": allow
+
+            # Unambiguously high-impact command families require human approval.
+            "sudo *": ask
+            "doas *": ask
+            "su *": ask
+            "bash -c *": ask
+            "sh -c *": ask
+            "zsh -c *": ask
+            "eval *": ask
+            "rm *": ask
+            "unlink *": ask
+            "shred *": ask
+            "dd *": ask
+            "chown *": ask
+            "chmod -R *": ask
+            "kill *": ask
+            "pkill *": ask
+
+            # Local machine or service state; inspection remains automatic.
+            "systemctl *": ask
+            "systemctl status*": allow
+            "systemctl show*": allow
+            "systemctl is-active*": allow
+            "systemctl is-enabled*": allow
+            "systemctl list-*": allow
+            "systemctl --user status*": allow
+            "systemctl --user show*": allow
+            "systemctl --user is-active*": allow
+            "systemctl --user is-enabled*": allow
+            "loginctl *": ask
+            "loginctl show*": allow
+            "loginctl list*": allow
+            "reboot*": ask
+            "shutdown*": ask
+            "poweroff*": ask
+            "mount *": ask
+            "umount *": ask
+
+            # Git mutation and remote writes; read-only Git commands remain automatic.
+            "git *": ask
+            "git status*": allow
+            "git diff*": allow
+            "git log*": allow
+            "git show*": allow
+            "git grep*": allow
+            "git blame*": allow
+            "git ls-*": allow
+            "gh *": ask
+            "gh pr view*": allow
+            "gh pr list*": allow
+            "gh pr diff*": allow
+            "gh pr checks*": allow
+            "gh issue view*": allow
+            "gh issue list*": allow
+            "gh run view*": allow
+            "gh run list*": allow
+            "gh repo view*": allow
+
+            # Activating Nix configurations or changing persistent Nix state.
+            "nh os switch*": ask
+            "nh os boot*": ask
+            "nh os test*": ask
+            "nh darwin switch*": ask
+            "nh home switch*": ask
+            "nixos-rebuild switch*": ask
+            "nixos-rebuild boot*": ask
+            "nixos-rebuild test*": ask
+            "darwin-rebuild switch*": ask
+            "home-manager switch*": ask
+            "nix flake update*": ask
+            "nix flake lock*": ask
+            "nix profile *": ask
+            "nix-env *": ask
+            "nix store delete*": ask
+            "nix-collect-garbage*": ask
+
+            # Remote hosts and infrastructure. Read-only subcommands are exceptions.
+            "ssh *": ask
+            "scp *": ask
+            "rsync *": ask
+            "docker *": ask
+            "docker ps*": allow
+            "docker inspect*": allow
+            "docker logs*": allow
+            "docker images*": allow
+            "kubectl *": ask
+            "kubectl get*": allow
+            "kubectl describe*": allow
+            "kubectl logs*": allow
+            "kubectl diff*": allow
+            "helm *": ask
+            "helm list*": allow
+            "helm status*": allow
+            "helm get*": allow
+            "helm template*": allow
+            "helm lint*": allow
+            "terraform *": ask
+            "terraform plan*": allow
+            "terraform show*": allow
+            "terraform validate*": allow
+            "terraform fmt*": allow
+            "tofu *": ask
+            "tofu plan*": allow
+            "tofu show*": allow
+            "tofu validate*": allow
+            "tofu fmt*": allow
+            "ansible-playbook *": ask
+            "talosctl apply-config*": ask
+            "talosctl upgrade*": ask
+            "talosctl reset*": ask
+
+            # Secrets and direct schema/data mutation.
+            "sops *": ask
+            "gpg *": ask
+            "prisma migrate deploy*": ask
+            "prisma db push*": ask
+            "drizzle-kit push*": ask
+            "alembic upgrade*": ask
+            "rails db:migrate*": ask
+        ---
+
+        Implement only the bounded task assigned by the parent. Follow project
+        instructions and existing architecture. Prefer the smallest coherent diff;
+        do not perform unrelated cleanup.
+
+        Choose and run routine local inspection, formatting, build, type-check, lint,
+        and test commands without asking. Commands matched by an `ask` rule should be
+        invoked normally so OpenCode's permission UI can request approval.
+
+        For a semantically high-impact action not covered by an `ask` pattern, call
+        the `question` tool before acting. High-impact includes deleting or overwriting
+        user data, changing host/service state, remote Git or infrastructure, database
+        data/schema, secrets, dependency choices, or paths outside the worktree.
+
+        Never bypass approval by wrapping, encoding, scripting, aliasing, or replacing
+        a command with an equivalent implementation. A rejection means stop that
+        action and report it. Use the parent-requested handoff, stay under 700 words,
+        and summarize failures instead of pasting raw logs.
+      '';
+
+      verify-cheap = ''
+        ---
+        description: "Independent cheap reviewer that inspects the diff and runs checks"
+        mode: subagent
+        hidden: true
+        model: opencode-go/deepseek-v4-pro
+        steps: 16
+        permission:
+          "*": deny
+          read:
+            "*": allow
+            "*.env": ask
+            "*.env.*": ask
+            "*.env.example": allow
+          edit: deny
+          glob: allow
+          grep: allow
+          list: allow
+          lsp: allow
+          webfetch: allow
+          websearch: allow
+          question: allow
+          external_directory: ask
+          doom_loop: ask
+          bash:
+            # Independent verification is conservative: known inspection/build/test
+            # commands run directly; unusual commands ask the user.
+            "*": ask
+            "git status*": allow
+            "git diff*": allow
+            "git log*": allow
+            "git show*": allow
+            "git grep*": allow
+            "rg *": allow
+            "fd *": allow
+            "find *": allow
+            "ls*": allow
+            "stat *": allow
+            "file *": allow
+            "cat *": allow
+            "head *": allow
+            "tail *": allow
+            "jq *": allow
+            "nix eval*": allow
+            "nix build*": allow
+            "nix flake check*": allow
+            "nix flake show*": allow
+            "nh os build*": allow
+            "nh darwin build*": allow
+            "nh home build*": allow
+            "treefmt*": allow
+            "deadnix*": allow
+            "statix*": allow
+            "npm test*": allow
+            "npm run *": allow
+            "pnpm test*": allow
+            "pnpm run *": allow
+            "yarn test*": allow
+            "yarn run *": allow
+            "bun test*": allow
+            "bun run *": allow
+            "cargo check*": allow
+            "cargo test*": allow
+            "cargo clippy*": allow
+            "go test*": allow
+            "pytest*": allow
+            "python -m pytest*": allow
+            "ruff*": allow
+            "uv run *": allow
+        ---
+
+        Act as an independent verifier. Never edit files and do not trust the
+        implementation worker's conclusion. Inspect the actual diff and repository
+        state. Verify each acceptance criterion with the narrowest useful checks.
+
+        Record `git diff` before and after checks. If a check unexpectedly changes a
+        tracked file, report it instead of accepting the generated diff. Do not run
+        deployment, activation, migration, destructive, credential, or remote-write
+        commands, and never work around an approval prompt. Return PASS only with
+        concrete evidence; otherwise return FAIL or INCONCLUSIVE with one minimal next
+        action. Use the parent-requested handoff and omit raw logs.
+      '';
+    };
+  };
 }
diff --git a/modules/profiles/interface/linux-desktop/meta.nix b/modules/profiles/interface/linux-desktop/meta.nix
index b2ef1af..50770de 100644
--- a/modules/profiles/interface/linux-desktop/meta.nix
+++ b/modules/profiles/interface/linux-desktop/meta.nix
@@ -17,6 +17,7 @@
     "applications.qalculate-gtk"
     "applications.resources"
     "applications.vlc"
+    "applications.dpms-off"
     "hardwares.graphics"
     "services.gvfs"
     "services.polkit-gnome"