shells: guard platform-specific pcsc tools

.codex/config.toml

@@ -0,0 +1,13 @@
+[mcp_servers.nixos]
+command = "mcp-nixos"
+startup_timeout_sec = 30
+tool_timeout_sec = 60
+required = false
+
+[mcp_servers.github]
+url = "https://api.githubcopilot.com/mcp/"
+bearer_token_env_var = "GITHUB_PERSONAL_ACCESS_TOKEN"
+http_headers = { X-MCP-Readonly = "true", X-MCP-Toolsets = "repos,pull_requests,actions" }
+startup_timeout_sec = 30
+tool_timeout_sec = 60
+required = false

.github/actions/check-nixos/action.yaml

@@ -0,0 +1,15 @@
+# Reference: https://github.com/ryoppippi/dotfiles/blob/main/.github/workflows/nix-build.yaml
+name: Build Linux checks
+description: Build every x86_64-linux flake check in parallel
+runs:
+  using: composite
+  steps:
+    - name: Build all Linux checks
+      shell: bash
+      run: |
+        set -euo pipefail
+        nix run .#nix-fast-build -- \
+          --flake .#checks.x86_64-linux \
+          --skip-cached \
+          --no-nom \
+          --no-link

.github/actions/setup-nix/action.yaml

@@ -0,0 +1,23 @@
+# Reference: https://github.com/ryoppippi/dotfiles/blob/main/.github/actions/setup-nix/action.yaml
+name: Setup Nix
+description: Install Nix and cache the Nix store
+runs:
+  using: composite
+  steps:
+    - name: Allow unprivileged user namespaces
+      if: runner.os == 'Linux'
+      shell: bash
+      run: sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 2>/dev/null || true
+    - name: Install Nix
+      uses: nixbuild/nix-quick-install-action@9f63be77f412a248c9d9a65a4c82cf066cdf8f0c # v35
+      with:
+        nix_conf: |
+          accept-flake-config = true
+          max-jobs = auto
+    - name: Cache Nix store
+      uses: nix-community/cache-nix-action@7df957e333c1e5da7721f60227dbba6d06080569 # v7.0.2
+      with:
+        primary-key: nix-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('flake.lock') }}
+        restore-prefixes-first-match: nix-${{ runner.os }}-${{ runner.arch }}-
+        gc-max-store-size-linux: 4G
+        gc-max-store-size-macos: 4G

.github/workflows/nixos.yaml

@@ -0,0 +1,204 @@
+# Reference: https://github.com/ryoppippi/dotfiles/blob/main/.github/workflows/nix-build.yaml
+name: "CI: Nix"
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - .gitignore
+      - AGENTS.md
+      - README.md
+      - "docs/**"
+      - flake.nix
+      - flake.lock
+      - ".codex/**"
+      - ".github/**"
+      - ".vscode/**"
+      - "flake/**"
+      - "hosts/**"
+      - "libs/**"
+      - "modules/**"
+      - "opencode.json"
+      - "overlays/**"
+      - "scripts/**"
+      - "shells/**"
+      - "skills/**"
+      - "tests/**"
+  pull_request:
+    paths:
+      - .gitignore
+      - AGENTS.md
+      - README.md
+      - "docs/**"
+      - flake.nix
+      - flake.lock
+      - ".codex/**"
+      - ".github/**"
+      - ".vscode/**"
+      - "flake/**"
+      - "hosts/**"
+      - "libs/**"
+      - "modules/**"
+      - "opencode.json"
+      - "overlays/**"
+      - "scripts/**"
+      - "shells/**"
+      - "skills/**"
+      - "tests/**"
+  workflow_dispatch:
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+permissions:
+  contents: read
+jobs:
+  validate:
+    name: Plan, lint, and evaluate
+    runs-on: ubuntu-latest
+    timeout-minutes: 120
+    outputs:
+      build_linux: ${{ steps.plan.outputs.build_linux }}
+      build_darwin: ${{ steps.plan.outputs.build_darwin }}
+      nix_validation: ${{ steps.plan.outputs.nix_validation }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          fetch-depth: 0
+      - name: Setup Nix
+        uses: ./.github/actions/setup-nix
+      - name: Plan validation
+        id: plan
+        env:
+          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          PUSH_BASE_SHA: ${{ github.event.before }}
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          case "${{ github.event_name }}" in
+            pull_request)
+              plan="$(nix run .#check -- plan --base "$PR_BASE_SHA" --json)"
+              ;;
+            push)
+              plan="$(nix run .#check -- plan --base "$PUSH_BASE_SHA" --json)"
+              ;;
+            *)
+              plan="$(nix run .#check -- plan --all-files --all-hosts --json)"
+              ;;
+          esac
+
+          printf '%s\n' "$plan"
+          nix_validation="$(jq -r '.requiresNixValidation' <<<"$plan")"
+
+          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
+            build_linux="$(jq -r '.nativeBuildSystems["x86_64-linux"] // false' <<<"$plan")"
+            build_darwin="$(jq -r '.nativeBuildSystems["aarch64-darwin"] // false' <<<"$plan")"
+          else
+            build_linux="$nix_validation"
+            build_darwin="$nix_validation"
+          fi
+
+          {
+            echo "nix_validation=$nix_validation"
+            echo "build_linux=$build_linux"
+            echo "build_darwin=$build_darwin"
+          } >> "$GITHUB_OUTPUT"
+      - name: Run fast checks
+        env:
+          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          PUSH_BASE_SHA: ${{ github.event.before }}
+        shell: bash
+        run: |
+          set +e
+          set -uo pipefail
+          case "${{ github.event_name }}" in
+            pull_request)
+              nix run .#check -- fast --base "$PR_BASE_SHA"
+              ;;
+            push)
+              nix run .#check -- fast --base "$PUSH_BASE_SHA"
+              ;;
+            *)
+              nix run .#check -- fast --all-files
+              ;;
+          esac
+          status=$?
+          if (( status != 0 )); then
+            git diff -- .
+            exit "$status"
+          fi
+      - name: Evaluate configurations
+        if: steps.plan.outputs.nix_validation == 'true' || github.event_name == 'workflow_dispatch'
+        env:
+          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          PUSH_BASE_SHA: ${{ github.event.before }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          case "${{ github.event_name }}" in
+            pull_request)
+              nix run .#check -- eval --base "$PR_BASE_SHA"
+              ;;
+            push)
+              nix run .#check -- eval --base "$PUSH_BASE_SHA" --all-systems
+              ;;
+            *)
+              nix run .#check -- eval --all-hosts --all-systems
+              ;;
+          esac
+  build-linux:
+    name: Build Linux checks
+    needs: validate
+    if: needs.validate.outputs.build_linux == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 180
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          fetch-depth: 0
+      - name: Setup Nix
+        uses: ./.github/actions/setup-nix
+      - name: Build affected Linux checks
+        if: github.event_name == 'pull_request'
+        env:
+          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          nix run .#check -- build --base "$PR_BASE_SHA"
+      - name: Build all Linux checks
+        if: github.event_name != 'pull_request'
+        uses: ./.github/actions/check-nixos
+  build-darwin:
+    name: Build Darwin checks
+    needs: validate
+    if: needs.validate.outputs.build_darwin == 'true'
+    runs-on: macos-15
+    timeout-minutes: 180
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          fetch-depth: 0
+      - name: Setup Nix
+        uses: ./.github/actions/setup-nix
+      - name: Build affected Darwin checks
+        if: github.event_name == 'pull_request'
+        env:
+          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          nix run .#check -- build --base "$PR_BASE_SHA"
+      - name: Build all Darwin checks
+        if: github.event_name != 'pull_request'
+        shell: bash
+        run: |
+          set -euo pipefail
+          nix run .#nix-fast-build -- \
+            --flake .#checks.aarch64-darwin \
+            --skip-cached \
+            --no-nom \
+            --no-link

.github/workflows/update-flake.yaml

@@ -0,0 +1,109 @@
+# Reference: https://github.com/ryoppippi/dotfiles/blob/main/.github/workflows/update-flake.yaml
+name: "Bot: Update flake inputs"
+on:
+  schedule:
+    - cron: "0 6 * * *"
+  workflow_dispatch:
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: false
+permissions:
+  contents: write
+  pull-requests: write
+jobs:
+  update:
+    name: Update and check Linux
+    runs-on: ubuntu-latest
+    timeout-minutes: 180
+    outputs:
+      changed: ${{ steps.update.outputs.changed }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - name: Setup Nix
+        uses: ./.github/actions/setup-nix
+      - name: Update flake inputs
+        id: update
+        shell: bash
+        run: |
+          set -euo pipefail
+          nix flake update
+          if git diff --quiet -- flake.lock; then
+            echo 'changed=false' >> "$GITHUB_OUTPUT"
+          else
+            echo 'changed=true' >> "$GITHUB_OUTPUT"
+          fi
+      - name: Evaluate every flake system
+        if: steps.update.outputs.changed == 'true'
+        shell: bash
+        run: |
+          set -euo pipefail
+          nix flake check \
+            --no-build \
+            --all-systems \
+            --keep-going \
+            --show-trace
+      - name: Build Linux checks
+        if: steps.update.outputs.changed == 'true'
+        uses: ./.github/actions/check-nixos
+      - name: Upload updated lock file
+        if: steps.update.outputs.changed == 'true'
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: flake-lock
+          path: flake.lock
+          if-no-files-found: error
+  check-darwin:
+    name: Check Darwin
+    needs: update
+    if: needs.update.outputs.changed == 'true'
+    runs-on: macos-15
+    timeout-minutes: 180
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - name: Download updated lock file
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: flake-lock
+          path: .
+      - name: Setup Nix
+        uses: ./.github/actions/setup-nix
+      - name: Build Darwin checks
+        shell: bash
+        run: |
+          set -euo pipefail
+          nix run .#nix-fast-build -- \
+            --flake .#checks.aarch64-darwin \
+            --skip-cached \
+            --no-nom \
+            --no-link
+  pull-request:
+    name: Create update pull request
+    needs:
+      - update
+      - check-darwin
+    if: needs.update.outputs.changed == 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - name: Download validated lock file
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: flake-lock
+          path: .
+      - name: Create update pull request
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          add-paths: flake.lock
+          branch: automation/update-flake-lock
+          delete-branch: true
+          commit-message: "flake: update inputs"
+          title: "flake: update inputs"
+          body: |
+            Automated update of `flake.lock`.
+
+            The updated inputs passed all-system evaluation and native builds of
+            the Linux and Darwin check sets.

.gitignore

@@ -1,4 +1,6 @@
 /*
+**/__pycache__/
+*.py[cod]
 
 !.gitignore
 !README.md
@@ -6,8 +8,10 @@
 !AGENTS.md
 !/docs/
 
-!.github/
+!/.codex/
+!/.github/
 !.gitea/
+!/.vscode/
 
 !.envrc
 
@@ -15,7 +19,9 @@
 
 !/flake.nix
 !/flake.lock
+!/opencode.json
 
+!/scripts/
 !/shells/
 !/flake/
 !/overlays/
@@ -23,10 +29,11 @@
 !/images/
 !/secrets/
 
+!/windows/
+
 !/hosts/
-
 !/libs/
-
 !/modules/
 
 !/tests/
+!/skills/

.sops.yaml

@@ -3,6 +3,7 @@ keys:
   - &host_x1g13 age12g85cuvg4kjfr79lqf5fx2k0d82tchrgv88xgkt7ukk2cfcsw98s2rjyat
   - &host_ops age18rtm2dq2r62zvnhwdq0gkm24hu85r7zyleyk3jqv22zpdtw064eq7ay7dl
   - &host_internal-app-01 age1mcp5gma7y0k59equhzqfsnn0ed335ljjtn0k08ua77htlxf0x54qsravch
+  - &host_galleria age1wh7r9wnvyrgt5efjvg2324khsf4w6e9atpmz2udr4uw7frhnvvwquzcu72
 creation_rules:
   - path_regex: ^secrets/common/[^/]+\.ya?ml$
     key_groups:
@@ -11,6 +12,7 @@ creation_rules:
           - *host_x1g13
           - *host_ops
           - *host_internal-app-01
+          - *host_galleria
   - path_regex: ^secrets/hosts/x1g13/[^/]+\.ya?ml$
     key_groups:
       - age:

.vscode/settings.json

@@ -0,0 +1,28 @@
+{
+  "nix.enableLanguageServer": true,
+  "nix.serverPath": "nixd",
+  "nix.serverSettings": {
+    "nixd": {
+      "formatting": {
+        "command": ["nixfmt"]
+      },
+      "nixpkgs": {
+        "expr": "import (builtins.getFlake (builtins.toString ./.)).inputs.nixpkgs { }"
+      },
+      "options": {
+        "nixos": {
+          "expr": "(builtins.getFlake (builtins.toString ./.)).nixosConfigurations.galleria.options"
+        },
+        "home-manager-nixos": {
+          "expr": "(builtins.getFlake (builtins.toString ./.)).nixosConfigurations.galleria.options.home-manager.users.type.getSubOptions []"
+        },
+        "darwin": {
+          "expr": "(builtins.getFlake (builtins.toString ./.)).darwinConfigurations.m2.options"
+        },
+        "home-manager-darwin": {
+          "expr": "(builtins.getFlake (builtins.toString ./.)).darwinConfigurations.m2.options.home-manager.users.type.getSubOptions []"
+        }
+      }
+    }
+  }
+}

AGENTS.md

@@ -24,11 +24,16 @@ makes any statement here stale, update `AGENTS.md` in the same change.
 | `overlays/`             | Package replacements and additions                                                                                |
 | `shells/`               | Development shells                                                                                                |
 | `flake/`                | Supporting flake outputs such as formatters, checks, and Git hooks                                                |
+| `skills/`               | Repository-specific Codex workflows that enforce this contract for recurring changes                              |
+
+Before adding or materially extending an application or service, read and
+follow `skills/add-application-or-service/SKILL.md`. `AGENTS.md` remains the
+authoritative contract when the skill and repository ever disagree.
 
 Use **unit** as the generic internal term for a Registry-managed component and
 **profile** for a unit that composes multiple units. Do not introduce a
 `features/` layer. Window managers and desktop environments such as niri and
-GNOME belong in `modules/applications/`; do not create a separate `desktop/`
+labwc belong in `modules/applications/`; do not create a separate `desktop/`
 module category.
 
 Before adding configuration, decide whether it is owned by an application,
@@ -36,21 +41,25 @@ system foundation, service, hardware family, user, profile, or individual host.
 Prefer the following placements:
 
 | Configuration                                        | Placement                                                 |
-| ---------------------------------------------------- | ------------------------------------------------------- |
+| ---------------------------------------------------- | --------------------------------------------------------- |
 | Nix settings shared by every system host             | `modules/systems/nix/common.nix`                          |
 | NixOS-only boot configuration                        | `modules/systems/boot/.../nixos.nix`                      |
 | Disko NixOS module and CLI                           | `modules/systems/disko/`                                  |
+| macOS-wide input, document, and dialog defaults      | `modules/systems/macos-defaults/darwin.nix`               |
 | macOS Dock defaults                                  | `modules/systems/dock/darwin.nix`                         |
 | macOS trackpad defaults                              | `modules/systems/trackpad/darwin.nix`                     |
+| Finder-specific preferences                          | `modules/applications/finder/darwin.nix`                  |
 | Ghostty-specific configuration                       | `modules/applications/ghostty/`                           |
 | niri-specific configuration                          | `modules/applications/niri/`                              |
-| Desktop applications shared by GNOME and niri        | `modules/profiles/interface/linux-desktop/meta.nix`     |
+| Desktop applications shared by labwc and niri        | `modules/profiles/interface/linux-desktop/meta.nix`       |
 | Applications and services specific to niri           | `modules/profiles/interface/niri/meta.nix`                |
-| GNOME itself                                         | `modules/applications/gnome/`                           |
+| labwc and its session configuration                  | `modules/applications/labwc/`                             |
 | A Linux package plus its macOS Homebrew cask         | `modules/applications/<name>/home.nix` and `darwin.nix`   |
 | Docker daemon and Docker group membership            | `modules/services/docker/nixos.nix`                       |
 | The laptop unit composition                          | `modules/profiles/platform/laptop/meta.nix`               |
 | The Intel ThinkPad X1 composition                    | `modules/profiles/platform/thinkpad-x1/meta.nix`          |
+| The Intel/NVIDIA desktop composition                 | `modules/profiles/platform/intel-nvidia-desktop/meta.nix` |
+| NVIDIA GPU driver configuration                      | `modules/hardwares/nvidia/`                               |
 | The development-environment unit composition         | `modules/profiles/workload/development/meta.nix`          |
 | Cross-platform fingerprint selection                 | `modules/profiles/security/fingerprint/meta.nix`          |
 | A user's OS- and Home Manager-specific configuration | `modules/users/<name>/`                                   |
@@ -61,23 +70,30 @@ Prefer the following placements:
 
 ## Unit Discovery and Identity
 
-A directory below `modules/` is a unit if, and only if, it directly contains at
+A directory below `modules/` is a unit if, and only if, it contains at least one
-least one reserved file. Directories used only for classification, such as
+reserved root file or reserved Home Manager fragment. Directories used only for
-`modules/applications/` or `modules/profiles/interface/`, are namespaces rather
+classification, such as `modules/applications/` or
-than units when they have no reserved file of their own.
+`modules/profiles/interface/`, are namespaces rather than units when they have
+no reserved fragment of their own.
 
-The Registry recognizes exactly these five reserved filenames:
+The Registry recognizes exactly these eight reserved paths relative to a unit:
 
 | File              | Target and responsibility                                                        |
-| ------------ | -------------------------------------------------------------------------------- |
+| ----------------- | -------------------------------------------------------------------------------- |
 | `common.nix`      | System-side configuration fragment shared by NixOS and nix-darwin                |
-| `nixos.nix`  | NixOS-only configuration fragment                                                |
+| `nixos.nix`       | NixOS-only system configuration fragment                                         |
-| `darwin.nix` | nix-darwin-only configuration fragment                                           |
+| `darwin.nix`      | nix-darwin-only system configuration fragment                                    |
-| `home.nix`   | Home Manager configuration fragment                                              |
+| `home.nix`        | Home Manager fragment shared by NixOS and nix-darwin                             |
+| `home/common.nix` | Home Manager fragment shared by NixOS and nix-darwin                             |
+| `home/nixos.nix`  | Home Manager fragment loaded only on NixOS                                       |
+| `home/darwin.nix` | Home Manager fragment loaded only on nix-darwin                                  |
 | `meta.nix`        | Registry descriptor for dependencies, external modules, and descriptive metadata |
 
-`common.nix` is never applied to Home Manager. OS-independent Home Manager
+Root `common.nix` is never applied to Home Manager. `home.nix` and
-configuration still belongs in `home.nix`.
+`home/common.nix` have identical dispatch semantics; use either or both when a
+useful file split exists. The `home/` directory is a reserved fragment directory
+of its parent unit when it contains `common.nix`, `nixos.nix`, or `darwin.nix`;
+it is not discovered as a child unit in that case.
 
 The Registry derives a unit ID from the path relative to `modules/`, joining
 path components with dots. Category names remain plural. It also derives the
@@ -133,10 +149,13 @@ of the following are valid units:
 # Home Manager only
 modules/applications/ghostty/
 ├── home.nix
+├── home/
+│   ├── nixos.nix
+│   └── darwin.nix
 └── settings.nix
 
 # NixOS only
-modules/applications/gnome/
+modules/services/docker/
 └── nixos.nix
 
 # nix-darwin only
@@ -160,16 +179,16 @@ modules/systems/nix/
 └── common.nix
 ```
 
-If a unit has no `home.nix`, do not generate or apply a Home Manager module for
+Each fragment is optional and registered independently. A unit may therefore
-it. The same rule applies independently to `common.nix`, `nixos.nix`, and
+contain only `home/nixos.nix` or `home/darwin.nix`; it does not need a
-`darwin.nix`.
+placeholder `home.nix` or `home/common.nix`.
 
 ### Configuration fragments
 
-`common.nix`, `nixos.nix`, `darwin.nix`, and `home.nix` are configuration
+Every reserved path except `meta.nix` is a configuration fragment to which the
-fragments to which the Registry adds the enable condition. They return the
+Registry adds the enable condition. These fragments return the configuration
-configuration for their class directly and must not define top-level `imports`,
+for their class directly and must not define top-level `imports`, `options`, or
-`options`, or `config` attributes:
+`config` attributes:
 
 ```nix
 # modules/services/docker/nixos.nix
@@ -204,9 +223,9 @@ fragment.
 
 ### Helper files and directories
 
-Every filename other than the five reserved names is an ordinary helper,
+Every path other than the eight reserved paths is an ordinary helper, regardless
-regardless of its extension. The Registry neither discovers nor automatically
+of its extension. The Registry neither discovers nor automatically imports
-imports helper files such as `settings.nix`, `keybindings.nix`, `packages.nix`,
+helper files such as `settings.nix`, `keybindings.nix`, `packages.nix`,
 `colors.nix`, `rules.nix`, or `helpers.nix`. Import a helper explicitly from the
 reserved fragment that uses it:
 
@@ -249,9 +268,10 @@ modules/applications/niri/
 ```
 
 Here `parts/` is not a unit because it directly contains no reserved file. A
-helper directory that directly contains `home.nix` or another reserved file is
+helper directory that directly contains a root reserved file is itself
-itself discovered as a unit, so never use reserved filenames inside a directory
+discovered as a unit, so never use reserved filenames inside a directory that
-that is intended to contain helpers only.
+is intended to contain helpers only. The reserved `home/` fragment directory is
+the sole exception to ordinary recursive child-unit discovery.
 
 ### Registry metadata
 
@@ -298,7 +318,6 @@ use fully qualified unit IDs:
     "applications.noctalia"
     "services.ly"
     "services.swayidle"
-    "services.swaylock"
   ];
 }
 ```
@@ -314,10 +333,11 @@ the application to work. A profile owns the user's choice to adopt several
 otherwise independent applications together. For example, the niri application
 includes the Wayland foundation as a technical dependency. The
 `profiles.interface.linux-desktop` profile selects Ghostty and Nautilus because
-both GNOME and niri use them, while the cross-platform `profiles.interface.gui`
+both labwc and niri use them, while the cross-platform `profiles.interface.gui`
-profile selects Vicinae for graphical hosts. `profiles.interface.niri` selects
+profile selects Vicinae for graphical hosts. The labwc and niri profiles select
-only the niri-specific shell and services. Ghostty and Vicinae must not depend
+their compositor, Noctalia, and the session services they require. Ghostty and
-on niri, and niri-specific keybindings remain owned by the niri unit.
+Vicinae must not depend on either compositor, and compositor-specific
+keybindings remain owned by the corresponding application unit.
 
 ## Profiles
 
@@ -334,13 +354,14 @@ modules/profiles/
 │   ├── gui/
 │   ├── macos/
 │   ├── linux-desktop/
-│   ├── gnome/
+│   ├── labwc/
 │   └── niri/
 ├── networking/
 │   ├── tailscale-client/
 │   └── tailscale-subnet-router/
 ├── platform/
 │   ├── nixos/
+│   ├── intel-nvidia-desktop/
 │   ├── laptop/
 │   ├── thinkpad-x1/
 │   ├── desktop/
@@ -365,15 +386,16 @@ do not retain compatibility aliases.
 
 The profile layers have these responsibilities:
 
-- `base` contains only invariants required by every supported host. It currently
+- `base` contains only invariants required by every supported host. It includes
-  includes only `systems.nix`; optional secrets, interface, hardware, and
+  `systems.nix` and the universal Atuin, tealdeer, trippy, and xh CLI tools;
-  workloads do not belong there.
+  optional secrets, interface, hardware, and workloads do not belong there.
 - `interface` describes how the host is operated. `interface.cli` is shared by
   NixOS and macOS and includes `tio`. `interface.gui` owns cross-platform
   graphical interface applications such as Vicinae. `interface.macos` owns the
-  macOS Dock and trackpad defaults and includes `interface.gui`.
+  macOS Finder, Dock, trackpad, and shared default preferences and includes
-  `interface.linux-desktop` owns the common GNOME/niri desktop selection,
+  `interface.gui`.
-  including Ghostty and Nautilus, and also includes `interface.gui`. GNOME and
+  `interface.linux-desktop` owns the common labwc/niri desktop selection,
+  including Ghostty and Nautilus, and also includes `interface.gui`. Labwc and
   niri remain independently selectable and do not imply CLI or personal
   workloads.
 - `platform` describes NixOS foundations and physical or virtual form factors.
@@ -429,8 +451,10 @@ mechanism, and do not design the repository around `import-tree`. Registry logic
 has these responsibilities:
 
 1. Recursively visit directories below `modules/`.
-2. Check only the five reserved filenames directly within each directory.
+2. Check the five reserved root filenames and the three reserved filenames
-3. Register a directory as a unit when at least one reserved file exists there.
+   directly inside the unit's `home/` fragment directory.
+3. Register a directory as a unit when at least one reserved fragment exists
+   there, including a unit that has only a reserved `home/` fragment.
 4. Derive the unit ID from the path relative to `modules/`.
 5. Record only class fragments that exist.
 6. Evaluate `meta.nix` as a descriptor only when it exists.
@@ -439,7 +463,8 @@ has these responsibilities:
 9. Enable included units from `meta.includes`.
 10. Raise a clear evaluation error for a reference to a missing unit ID.
 11. Apply only the fragments appropriate to the current host class.
-12. Pass `home.nix` to Home Manager only for hosts that enable Home Manager.
+12. Pass `home.nix`, `home/common.nix`, and the matching OS-specific Home
+    Manager fragment only for hosts that enable Home Manager.
 
 A unit record may conceptually look like this; the implementation need not use
 this exact representation:
@@ -454,6 +479,9 @@ this exact representation:
     nixos = null;
     darwin = null;
     home = ./applications/ghostty/home.nix;
+    homeCommon = null;
+    homeNixos = ./applications/ghostty/home/nixos.nix;
+    homeDarwin = ./applications/ghostty/home/darwin.nix;
   };
 
   meta = { };
@@ -487,6 +515,59 @@ A host registry may use a specification like this:
 ```nix
 # hosts/default.nix
 {
+  nix-example = {
+    system = "x86_64-linux";
+    stateVersion = "26.05";
+    user = "moons";
+    path = ./nix-example;
+
+    profiles = [
+      "base"
+      "interface.cli"
+      "platform.vm"
+      "workload.development"
+      "workload.remote-access"
+    ];
+  };
+
+  ops = {
+    system = "x86_64-linux";
+    stateVersion = "26.05";
+    user = "moons";
+    path = ./ops;
+
+    profiles = [
+      "base"
+      "interface.cli"
+      "platform.vm"
+      "workload.remote-access"
+    ];
+  };
+
+  internal-app-01 = {
+    system = "x86_64-linux";
+    stateVersion = "26.05";
+    user = "moons";
+    path = ./internal-app-01;
+
+    profiles = [
+      "base"
+      "interface.cli"
+      "platform.vm"
+      "workload.server"
+    ];
+  };
+
+  installer = {
+    system = "x86_64-linux";
+    stateVersion = "26.05";
+    user = "moons";
+    path = ./installer;
+    homeManager = false;
+
+    profiles = [ "base" ];
+  };
+
   x1g9 = {
     system = "x86_64-linux";
     stateVersion = "26.05";
@@ -496,7 +577,7 @@ A host registry may use a specification like this:
     profiles = [
       "base"
       "interface.cli"
-      "interface.gnome"
+      "interface.labwc"
       "interface.niri"
       "platform.thinkpad-x1"
       "security.fingerprint"
@@ -513,7 +594,7 @@ A host registry may use a specification like this:
     profiles = [
       "base"
       "interface.cli"
-      "interface.gnome"
+      "interface.labwc"
       "interface.niri"
       "networking.tailscale-client"
       "platform.thinkpad-x1"
@@ -526,6 +607,27 @@ A host registry may use a specification like this:
     ];
   };
 
+  galleria = {
+    system = "x86_64-linux";
+    stateVersion = "26.05";
+    user = "moons";
+    path = ./galleria;
+
+    profiles = [
+      "base"
+      "interface.cli"
+      "interface.labwc"
+      "interface.niri"
+      "platform.intel-nvidia-desktop"
+      "security.secrets"
+      "security.secure-boot"
+      "security.tpm-storage"
+      "workload.development"
+      "workload.game"
+      "workload.personal"
+    ];
+  };
+
   m2 = {
     system = "aarch64-darwin";
     stateVersion = "26.05";
@@ -544,14 +646,18 @@ A host registry may use a specification like this:
 }
 ```
 
-The current role assignment is intentional: x1g9 is a full NixOS desktop with
+The current role assignment is intentional: nix-example is the development VM;
-niri, GNOME, ly, the shared Linux desktop applications, and the personal
+ops is the remote-access VM with host-specific static networking;
-workload. x1g13 is the secure NixOS development and personal ThinkPad, with the
+internal-app-01 is the container server VM; and installer builds the minimal
-same desktop sessions plus Tailscale client, SOPS, Secure Boot, and TPM-backed
+installation ISO without Home Manager. x1g9 is a full NixOS desktop with niri,
-disk unlock. m2 is the daily-use macOS development and personal machine with
+labwc, ly, the shared Linux desktop applications, and the personal workload.
-the macOS interface defaults. Keep the desktop sessions independently
+x1g13 is the secure NixOS development and personal ThinkPad, with the same
-selectable, and keep the development and personal profiles usable across NixOS
+desktop sessions plus Tailscale client, SOPS, Secure Boot, and TPM-backed disk
-and Darwin.
+unlock. galleria is the Intel/NVIDIA physical desktop shared with Windows; it
+uses dedicated NixOS partitions, LUKS, Secure Boot, and TPM-backed disk unlock.
+m2 is the daily-use macOS development and personal machine with the macOS
+interface defaults. Keep the desktop sessions independently selectable, and
+keep the development and personal profiles usable across NixOS and Darwin.
 
 Treat entries in `profiles` and the exceptional `applications` field as IDs
 relative to their respective category roots. Add the category prefixes during
@@ -581,6 +687,22 @@ configuration fragments. For example:
 
 ```text
 hosts/
+├── installer/
+│   └── nixos.nix
+├── internal-app-01/
+│   ├── nixos.nix
+│   └── hardware-configuration.nix
+├── nix-example/
+│   ├── nixos.nix
+│   └── hardware-configuration.nix
+├── ops/
+│   ├── nixos.nix
+│   └── hardware-configuration.nix
+├── galleria/
+│   ├── disk-identifiers.nix
+│   ├── disko.nix
+│   ├── hardware-configuration.nix
+│   └── nixos.nix
 ├── x1g9/
 │   ├── nixos.nix
 │   └── hardware-configuration.nix
@@ -597,18 +719,24 @@ hosts/
 normal top-level Nix module `imports`. `hosts/x1g13/nixos.nix` loads its
 generated hardware configuration and host-local `disko.nix` the same way. Do
 not confuse these host imports with the prohibition on top-level `imports` in
-unit configuration fragments.
+unit configuration fragments. `hosts/galleria/disko.nix` manages only the two
+dedicated NixOS partitions by PARTUUID and deliberately excludes the Windows
+disk, Windows partitions, and the Windows EFI System Partition.
 
 Derive the system class from the host's `system`:
 
 - A Linux NixOS host receives `common.nix` and `nixos.nix`.
 - A nix-darwin host receives `common.nix` and `darwin.nix`.
-- A host with integrated Home Manager additionally receives `home.nix`.
+- A NixOS host with integrated Home Manager additionally receives `home.nix`,
+  `home/common.nix`, and `home/nixos.nix`.
+- A nix-darwin host with integrated Home Manager additionally receives
+  `home.nix`, `home/common.nix`, and `home/darwin.nix`.
 
 Home Manager is additive, not a system class mutually exclusive with NixOS or
-nix-darwin. The supported combinations are NixOS plus Home Manager and
+nix-darwin. Normal machine configurations combine NixOS or nix-darwin with Home
-nix-darwin plus Home Manager. If standalone Home Manager is supported later, add
+Manager; the installer ISO explicitly sets `homeManager = false`. If standalone
-an explicit host kind because `system` alone cannot distinguish it from NixOS.
+Home Manager is supported later, add an explicit host kind because `system`
+alone cannot distinguish it from NixOS.
 
 Do not duplicate reusable settings in hosts, but do not force genuinely
 machine-specific values into a common unit merely to remove a host-local line.
@@ -631,16 +759,16 @@ When implementing or modifying modules:
   unit's enable option from a class fragment.
 - Do not assume any non-reserved file is discovered or loaded automatically.
 - Do not require an `_` prefix for helper or private files.
-- Do not create unused `common.nix`, `nixos.nix`, `darwin.nix`, `home.nix`, or
+- Do not create unused reserved fragments, including placeholder files under the
-  `meta.nix` files.
+  reserved `home/` fragment directory.
 - Do not override a path-derived unit ID from `meta.nix`.
 - Keep technical application dependencies separate from the applications a
   personal environment chooses to combine in a profile.
 - Keep cross-platform profile names semantic. Put Linux package installation in
   an application's `home.nix` and the corresponding macOS Homebrew cask in its
   `darwin.nix`; do not create a thin `*-linux` profile for that difference.
-- Keep shared GNOME/niri selections in `profiles.interface.linux-desktop` and
+- Keep shared labwc/niri selections in `profiles.interface.linux-desktop` and
-  session-specific applications or services in the respective GNOME or niri
+  session-specific applications or services in the respective labwc or niri
   profile.
 - Keep `modules/profiles/README.md`, the profile directories, and host profile
   selections synchronized whenever any of them changes.
@@ -694,10 +822,14 @@ For profile changes, additionally:
   required host-owned values.
 - When adding a Darwin application fragment, verify the resulting
   `homebrew.casks` selection as well as module evaluation.
-- Preserve the intended host roles: x1g9 provides niri, GNOME, ly, and the
+- Preserve the intended host roles: nix-example remains the development VM;
-  personal application set; x1g13 additionally provides the development,
+  ops remains the statically networked remote-access VM; internal-app-01 remains
-  Tailscale client, secrets, Secure Boot, and TPM storage roles; m2 remains the
+  the container server VM; installer remains the Home Manager-free installation
-  daily-use development and personal machine.
+  ISO; x1g9 provides niri, labwc, ly, and the personal application set; x1g13
+  additionally provides the development, Tailscale client, secrets, Secure Boot,
+  and TPM storage roles; galleria remains the Intel/NVIDIA dual-boot desktop
+  with LUKS, Secure Boot, and TPM storage; m2 remains the daily-use development
+  and personal machine.
 
 ## Commit and Pull Request Guidelines
 

README.md

@@ -1,3 +1,6 @@
 # moons14 dotfiles
 
-My NixOS + Home Manager configurations build with flake.
+My NixOS, nix-darwin, and Home Manager configurations built with flakes.
+
+See [Coding-agent validation](docs/coding-agents.md) for the non-activating,
+change-aware validation workflow used by Codex, OpenCode, and CI.

docs/coding-agents.md

@@ -0,0 +1,86 @@
+# Coding-agent workflow
+
+This repository exposes deterministic validation and narrowly scoped research
+tools for Codex, OpenCode, and editor agents. Live system activation is outside
+this workflow.
+
+## Validation commands
+
+Use task-owned paths during the edit loop:
+
+```console
+nix run .#check -- plan --paths modules/applications/example/home.nix --json
+nix run .#check -- fast --paths modules/applications/example/home.nix
+nix run .#check -- eval --paths modules/applications/example/home.nix
+nix run .#check -- build --paths modules/applications/example/home.nix
+nix run .#check -- all --paths modules/applications/example/home.nix
+```
+
+For a committed pull-request range, replace `--paths ...` with
+`--base <base-sha>`. `full` is reserved for CI, scheduled maintenance, or an
+explicit repository-wide audit:
+
+```console
+nix run .#check -- full
+```
+
+The stages have distinct meanings:
+
+- `plan` maps changed paths to Registry units, reverse `meta.includes`
+  dependencies, real hosts, and compatible build systems.
+- `fast` parses changed Nix files, validates JSON, TOML, Python, and Agent Skill
+  frontmatter, checks whitespace, and runs configured hooks only for the
+  selected files.
+- `eval` instantiates affected NixOS and nix-darwin configurations. Flake-wide,
+  validation-tool, shell, overlay, and test changes additionally evaluate every
+  flake system.
+- `build` realizes affected configurations supported by the current platform
+  with no result link. Incompatible targets remain evaluation-only until a
+  matching runner handles them.
+- `all` performs task-scoped file checks, all-system evaluation, and compatible
+  targeted builds.
+- `full` runs all-file hooks, all-system evaluation, and every check for the
+  current platform through `nix-fast-build`.
+
+The validation app constructs a filtered temporary `path:` flake from the
+committed `HEAD` tree and overlays only task-owned changed paths. This isolates
+unrelated worktree changes, makes new untracked Registry fragments visible to
+Nix without staging them, and avoids copying ignored state such as `.direnv`.
+
+None of these commands runs `nh os switch`, `nixos-rebuild switch`,
+`darwin-rebuild switch`, `home-manager switch`, or another activation command.
+The user performs activation separately.
+
+## Agent Skills
+
+Read `AGENTS.md` first. Use the repository skills as follows:
+
+- `validate-nix-change` controls validation scope and evidence.
+- `debug-nix-failure` classifies parse, evaluation, build, test, activation-log,
+  and runtime failures before proposing a correction.
+- `test-nixos-service` adds a `pkgs.testers.runNixOSTest` check when a build
+  cannot prove service behavior.
+- `update-flake-input` limits lock-file updates and validates them without
+  activating a host.
+- `add-application-or-service` preserves Registry ownership and delegates
+  validation to `validate-nix-change`.
+
+## MCP and language-server setup
+
+The development workload installs `mcp-nixos`, `nixd`, `nix-fast-build`, and
+`nix-tree`.
+
+Project-local Codex and OpenCode configuration exposes:
+
+- `mcp-nixos` for current NixOS, Home Manager, nix-darwin, package, and Nix
+  documentation queries;
+- GitHub's remote MCP endpoint for Codex and OpenCode in read-only mode,
+  restricted to repository, pull-request, and Actions toolsets.
+
+Set `GITHUB_PERSONAL_ACCESS_TOKEN` in the launching environment when GitHub MCP
+access is needed. Do not commit the token or put it in a Nix expression because
+that would expose it through source control or the Nix store.
+
+The workspace VS Code settings use `nixd` and expose option sets for the
+`galleria` NixOS configuration, its integrated Home Manager configuration, the
+`m2` nix-darwin configuration, and its integrated Home Manager configuration.

flake.lock

@@ -68,7 +68,55 @@
         "type": "github"
       }
     },
+    "browser-previews": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1785530251,
+        "narHash": "sha256-WdjqE36StkaKYhYxmltncwo4cxwrkMwPpJTAftAnRAM=",
+        "owner": "nix-community",
+        "repo": "browser-previews",
+        "rev": "79c9ddd90e793869fa587859b9911bb6050067ec",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "browser-previews",
+        "type": "github"
+      }
+    },
     "bun2nix": {
+      "inputs": {
+        "flake-parts": "flake-parts_2",
+        "import-tree": "import-tree",
+        "nixpkgs": [
+          "handy",
+          "nixpkgs"
+        ],
+        "systems": "systems_4",
+        "treefmt-nix": "treefmt-nix"
+      },
+      "locked": {
+        "lastModified": 1770895533,
+        "narHash": "sha256-v3QaK9ugy9bN9RXDnjw0i2OifKmz2NnKM82agtqm/UY=",
+        "owner": "nix-community",
+        "repo": "bun2nix",
+        "rev": "c843f477b15f51151f8c6bcc886954699440a6e1",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "ref": "2.0.8",
+        "repo": "bun2nix",
+        "type": "github"
+      }
+    },
+    "bun2nix_2": {
       "inputs": {
         "flake-parts": [
           "llm-agents",
@@ -103,15 +151,15 @@
     },
     "codex-desktop-linux": {
       "inputs": {
-        "flake-utils": "flake-utils",
+        "flake-utils": "flake-utils_2",
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1785087211,
+        "lastModified": 1785831553,
-        "narHash": "sha256-lmIZA1LPcCB7vPagN3lS5mcSwVgN5GAvOxHS7CjqWzI=",
+        "narHash": "sha256-9q7WKbhq6bOGUdeo9Q/e3PmapJew0b2LCpaCio1X17k=",
         "owner": "ilysenko",
         "repo": "codex-desktop-linux",
-        "rev": "bc7b92cf38c74b49dbff568257542eabbc62cf55",
+        "rev": "7166d1153fd99647fb080605c8b2a8f22b50b08f",
         "type": "github"
       },
       "original": {
@@ -122,11 +170,11 @@
     },
     "crane": {
       "locked": {
-        "lastModified": 1784407669,
+        "lastModified": 1784564969,
-        "narHash": "sha256-gcFMcRjw0ZSn380Rx2QLlU1goUQeSrKX/DF12omI6+o=",
+        "narHash": "sha256-TkTWNhJV/8Wk3czlbz4bwHZkFCaCHPsOy+oJe4PUiXg=",
         "owner": "ipetkov",
         "repo": "crane",
-        "rev": "1316b7d278ad77a16aec024b71d971366e123bec",
+        "rev": "7930f6c291de6f83c257839d434592aa085f290a",
         "type": "github"
       },
       "original": {
@@ -158,11 +206,11 @@
     "firefox-gnome-theme": {
       "flake": false,
       "locked": {
-        "lastModified": 1782007937,
+        "lastModified": 1783570805,
-        "narHash": "sha256-PbnJr+eB+9Czol3ReI83dUgEhcn0sDK6TSy6ODTQm88=",
+        "narHash": "sha256-ptl5aRlCv9/uRSv2u8Hq8UFVFeZ6Q/bT049bpqNgc3w=",
         "owner": "rafaelmardojai",
         "repo": "firefox-gnome-theme",
-        "rev": "981bd332015397fb1ca033fa982bd61635160c78",
+        "rev": "5602ed62d638142c1ab31dccd01dfbfb28841225",
         "type": "github"
       },
       "original": {
@@ -256,11 +304,11 @@
         "nixpkgs-lib": "nixpkgs-lib"
       },
       "locked": {
-        "lastModified": 1782949081,
+        "lastModified": 1785627969,
-        "narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=",
+        "narHash": "sha256-4dtXQk/NMePegK/nWp5NSeuZKLATItOq61lpEvmXqGw=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e",
+        "rev": "427bf4bd9435fdf21321c8cc628c24efc14c0f7a",
         "type": "github"
       },
       "original": {
@@ -271,17 +319,14 @@
     },
     "flake-parts_2": {
       "inputs": {
-        "nixpkgs-lib": [
+        "nixpkgs-lib": "nixpkgs-lib_2"
-          "llm-agents",
-          "nixpkgs"
-        ]
       },
       "locked": {
-        "lastModified": 1782949081,
+        "lastModified": 1769996383,
-        "narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=",
+        "narHash": "sha256-AnYjnFWgS49RlqX7LrC4uA+sCCDBj0Ry/WOJ5XWAsa0=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e",
+        "rev": "57928607ea566b5db3ad13af0e57e921e6b12381",
         "type": "github"
       },
       "original": {
@@ -291,6 +336,27 @@
       }
     },
     "flake-parts_3": {
+      "inputs": {
+        "nixpkgs-lib": [
+          "llm-agents",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1785627969,
+        "narHash": "sha256-4dtXQk/NMePegK/nWp5NSeuZKLATItOq61lpEvmXqGw=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "427bf4bd9435fdf21321c8cc628c24efc14c0f7a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
+    "flake-parts_4": {
       "inputs": {
         "nixpkgs-lib": [
           "nixvim",
@@ -311,7 +377,7 @@
         "type": "github"
       }
     },
-    "flake-parts_4": {
+    "flake-parts_5": {
       "inputs": {
         "nixpkgs-lib": [
           "stylix",
@@ -334,7 +400,28 @@
     },
     "flake-utils": {
       "inputs": {
-        "systems": "systems"
+        "systems": [
+          "browser-previews",
+          "systems"
+        ]
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_2": {
+      "inputs": {
+        "systems": "systems_2"
       },
       "locked": {
         "lastModified": 1731533236,
@@ -371,20 +458,20 @@
         "flake-compat": "flake-compat",
         "home-manager": "home-manager",
         "nixpkgs": "nixpkgs_2",
-        "systems": "systems_2",
+        "systems": "systems_3",
         "zig": "zig",
         "zon2nix": "zon2nix"
       },
       "locked": {
-        "lastModified": 1785080636,
+        "lastModified": 1785853205,
-        "narHash": "sha256-ACiF5qaL4yiLSMesIPi4+4Aftw5QiMSR2qzp+5hlMvo=",
+        "narHash": "sha256-rHvUeXh4druPSNPg2EMvY9F+av/NSQzjNLsf7s6lNnI=",
-        "owner": "moons-14",
+        "owner": "ghostty-org",
         "repo": "ghostty",
-        "rev": "f11e5199a6bd2a2e1a536d3c225a7d9a39827ea4",
+        "rev": "594ee212bc3c048ffa06ba90623eaf207a4d145c",
         "type": "github"
       },
       "original": {
-        "owner": "moons-14",
+        "owner": "ghostty-org",
         "repo": "ghostty",
         "type": "github"
       }
@@ -427,6 +514,27 @@
         "type": "gitlab"
       }
     },
+    "handy": {
+      "inputs": {
+        "bun2nix": "bun2nix",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1785763469,
+        "narHash": "sha256-YHfOchlPBKbBbeoaT1amrjKBHJTYMXmcR1Gm31E7TLE=",
+        "owner": "cjpais",
+        "repo": "Handy",
+        "rev": "b1b2d9f9072e55902a46ca6cc655e5893ed7a91d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cjpais",
+        "repo": "Handy",
+        "type": "github"
+      }
+    },
     "home-manager": {
       "inputs": {
         "nixpkgs": [
@@ -455,11 +563,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1784350909,
+        "lastModified": 1785119570,
-        "narHash": "sha256-ZWyzLbS1yKUTeFJLmdVuWNnHttL333/ldJbEE+KzCrM=",
+        "narHash": "sha256-Rgs2xKnGLFWQscxUaXX07oyZeuMDOHEbqDOsgliLFGM=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "4ce190229c73d44536caa7072f6308fb2d8feeb3",
+        "rev": "d4fd24667c8cbef124bb70a20380cab75ec8474d",
         "type": "github"
       },
       "original": {
@@ -469,6 +577,42 @@
         "type": "github"
       }
     },
+    "home-manager_3": {
+      "inputs": {
+        "nixpkgs": [
+          "nix-hazkey",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1778444552,
+        "narHash": "sha256-f18pIiR9q/p1vHY93gmAum7aHhQOG49oGvAB9+lptRo=",
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "rev": "dcebe66f958673729896eec2de4abfd86ef22d21",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "type": "github"
+      }
+    },
+    "import-tree": {
+      "locked": {
+        "lastModified": 1763762820,
+        "narHash": "sha256-ZvYKbFib3AEwiNMLsejb/CWs/OL/srFQ8AogkebEPF0=",
+        "owner": "vic",
+        "repo": "import-tree",
+        "rev": "3c23749d8013ec6daa1d7255057590e9ca726646",
+        "type": "github"
+      },
+      "original": {
+        "owner": "vic",
+        "repo": "import-tree",
+        "type": "github"
+      }
+    },
     "lanzaboote": {
       "inputs": {
         "crane": "crane",
@@ -479,11 +623,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1784568171,
+        "lastModified": 1785749642,
-        "narHash": "sha256-t17AqLEhPG6m27ipkp8mJd8Ug0XkdANFDVsgyIFBZcQ=",
+        "narHash": "sha256-5/wlGe3a4ucxvYq2cuAAsuSFWKcIttQ6En83MLlV2jY=",
         "owner": "nix-community",
         "repo": "lanzaboote",
-        "rev": "f4b0aef3dba28677a5ca4b3416827aade60b5a0b",
+        "rev": "f142433bdbeffd2af51231e0aff7162c2bfbf6ef",
         "type": "github"
       },
       "original": {
@@ -494,18 +638,18 @@
     },
     "llm-agents": {
       "inputs": {
-        "bun2nix": "bun2nix",
+        "bun2nix": "bun2nix_2",
-        "flake-parts": "flake-parts_2",
+        "flake-parts": "flake-parts_3",
         "nixpkgs": "nixpkgs_4",
-        "systems": "systems_3",
+        "systems": "systems_5",
-        "treefmt-nix": "treefmt-nix"
+        "treefmt-nix": "treefmt-nix_2"
       },
       "locked": {
-        "lastModified": 1785094920,
+        "lastModified": 1785826862,
-        "narHash": "sha256-RPhNusC9jaFUkdgb6COZofPz1QLqmm8k2k9Wh7KcQII=",
+        "narHash": "sha256-UOPf9uQHGoNqEMZ2kii8DqlPBd5dYR6uERzdU8wdroQ=",
         "owner": "numtide",
         "repo": "llm-agents.nix",
-        "rev": "56dea2a2de7d50461c502db975e766c2c2d71e84",
+        "rev": "fd0508ef842609ad0c6f5af46c6f572214efebd9",
         "type": "github"
       },
       "original": {
@@ -514,21 +658,39 @@
         "type": "github"
       }
     },
+    "nani-translate-linux": {
+      "inputs": {
+        "nixpkgs": "nixpkgs_5"
+      },
+      "locked": {
+        "lastModified": 1785857772,
+        "narHash": "sha256-JMEQH9x8Pb9cHW4JbWfFBcqxsh4JkPDR5k8dCnphUTU=",
+        "ref": "refs/heads/main",
+        "rev": "9d6fec627a620841c27c7e67e8e7b5719ce9b465",
+        "revCount": 8,
+        "type": "git",
+        "url": "https://github.com/zunoser/nani-translate-linux.git"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://github.com/zunoser/nani-translate-linux.git"
+      }
+    },
     "niri-flake": {
       "inputs": {
         "niri-stable": "niri-stable",
         "niri-unstable": "niri-unstable",
-        "nixpkgs": "nixpkgs_5",
+        "nixpkgs": "nixpkgs_6",
         "nixpkgs-stable": "nixpkgs-stable",
         "xwayland-satellite-stable": "xwayland-satellite-stable",
         "xwayland-satellite-unstable": "xwayland-satellite-unstable"
       },
       "locked": {
-        "lastModified": 1784874881,
+        "lastModified": 1785753837,
-        "narHash": "sha256-u4jhSIf/Un0qZB+Cn3hTTaHSI20XeAxYbA5o4faqdJs=",
+        "narHash": "sha256-Lyy16y+SnRqM+vwODCWYYwwvYkKMPPpc1p6l4wevR0M=",
         "owner": "sodiboo",
         "repo": "niri-flake",
-        "rev": "ef7a2a3d719af46b906c22a3ebfb7d65627b2cd2",
+        "rev": "3c93dc3656160f3aedb21d3acf82b5dfe868a539",
         "type": "github"
       },
       "original": {
@@ -557,11 +719,11 @@
     "niri-unstable": {
       "flake": false,
       "locked": {
-        "lastModified": 1784570726,
+        "lastModified": 1785701241,
-        "narHash": "sha256-9EMn69JBcFWFgUM7f0VBAX+jBby5b9H3M59U75+5yI4=",
+        "narHash": "sha256-ircVOzPWRircI39ac/tqJajr5OoJxEVrDlBb05TULEk=",
         "owner": "YaLTeR",
         "repo": "niri",
-        "rev": "7f26c3ee804fb6ed458ef7fb0e3c794f14e0b3bc",
+        "rev": "feb3e43f1475e0865bb89cbd1e898b34d1d2ccf6",
         "type": "github"
       },
       "original": {
@@ -591,6 +753,27 @@
         "type": "github"
       }
     },
+    "nix-hazkey": {
+      "inputs": {
+        "home-manager": "home-manager_3",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1779529080,
+        "narHash": "sha256-CHa5L3I71NbPUNJp1gmmwbh91tKsZPyuRK50mLHjAVY=",
+        "owner": "aster-void",
+        "repo": "nix-hazkey",
+        "rev": "24cb2926666836988e78ceebeb67ad6c5a387ac3",
+        "type": "github"
+      },
+      "original": {
+        "owner": "aster-void",
+        "repo": "nix-hazkey",
+        "type": "github"
+      }
+    },
     "nix-index-database": {
       "inputs": {
         "nixpkgs": [
@@ -598,11 +781,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1785046085,
+        "lastModified": 1785650611,
-        "narHash": "sha256-UiK+mmZJuLWQVhJ5b2wDzogIYWAesyRm6LA3h3Ulh3Y=",
+        "narHash": "sha256-q4kR7g+pCcz6NASvoVPYu+CWWUurX03wogtBqGmR4h0=",
         "owner": "nix-community",
         "repo": "nix-index-database",
-        "rev": "11665045df8b9938ef811a3bfdc65cffb02b4b70",
+        "rev": "dbc756c9d7287de19b3e0e38c928c47510d42c3e",
         "type": "github"
       },
       "original": {
@@ -613,14 +796,14 @@
     },
     "nixos-hardware": {
       "inputs": {
-        "nixpkgs": "nixpkgs_6"
+        "nixpkgs": "nixpkgs_7"
       },
       "locked": {
-        "lastModified": 1784723954,
+        "lastModified": 1785232496,
-        "narHash": "sha256-1CfD8ZUjCkTgjsneLZ/lxCHhgDfqxxE7/GX0MmsgiqA=",
+        "narHash": "sha256-65EQYIRRpTdpH8lUiB6Mvo5uBkG60aBIzAJuALfx+O0=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "a017f5b72210026af5b3ac5949f08d94380a6fbd",
+        "rev": "2e790b0a6be8ec2b76174ac0931b8ff11919ec98",
         "type": "github"
       },
       "original": {
@@ -633,7 +816,7 @@
     "nixos-wsl": {
       "inputs": {
         "flake-compat": "flake-compat_4",
-        "nixpkgs": "nixpkgs_7"
+        "nixpkgs": "nixpkgs_8"
       },
       "locked": {
         "lastModified": 1784642409,
@@ -667,11 +850,26 @@
     },
     "nixpkgs-lib": {
       "locked": {
-        "lastModified": 1782614948,
+        "lastModified": 1785031560,
-        "narHash": "sha256-ePjCwr1sNm9NYUqywL7QfK3JnlS015msC+eBu2zKlp8=",
+        "narHash": "sha256-OmshNvn2vupOFpYinLUu+1Dnpu4n7Q5N3ggGVNHpkUI=",
         "owner": "nix-community",
         "repo": "nixpkgs.lib",
-        "rev": "db3f255737b94216eb71cce308e2912cf6bc2d7c",
+        "rev": "0e79af5e3d4dcfcd676ab5ba3f95d2e3352e078c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "type": "github"
+      }
+    },
+    "nixpkgs-lib_2": {
+      "locked": {
+        "lastModified": 1769909678,
+        "narHash": "sha256-cBEymOf4/o3FD5AZnzC3J9hLbiZ+QDT/KDuyHXVJOpM=",
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "rev": "72716169fe93074c333e8d0173151350670b824c",
         "type": "github"
       },
       "original": {
@@ -714,11 +912,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1784963784,
+        "lastModified": 1785747939,
-        "narHash": "sha256-IZAjgNI19TdwYus6QUIMvU0cw0vWVb/5oYwpyxQXL1E=",
+        "narHash": "sha256-D740uKsMbgsfK2oaDenJLLPIZfq7W0/g4KN/Fls8eKs=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "38affae6a5768f9b61f81355c7558ee971b2afb1",
+        "rev": "104240a772428cc2e20d8fd86c9ddbb886bbaff2",
         "type": "github"
       },
       "original": {
@@ -729,6 +927,19 @@
       }
     },
     "nixpkgs_10": {
+      "locked": {
+        "lastModified": 1785571196,
+        "narHash": "sha256-xwSqxTsama0YTtS78+4YyCm6jJg09v78QWfP1cAyoVA=",
+        "rev": "148bab9c1c3c53136ecb44a6ea356a0ed5b39b06",
+        "type": "tarball",
+        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.11pre1045728.148bab9c1c3c/nixexprs.tar.xz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://channels.nixos.org/nixos-unstable/nixexprs.tar.xz"
+      }
+    },
+    "nixpkgs_11": {
       "locked": {
         "lastModified": 1770107345,
         "narHash": "sha256-tbS0Ebx2PiA1FRW8mt8oejR0qMXmziJmPaU1d4kYY9g=",
@@ -744,7 +955,7 @@
         "type": "github"
       }
     },
-    "nixpkgs_11": {
+    "nixpkgs_12": {
       "locked": {
         "lastModified": 1772542754,
         "narHash": "sha256-WGV2hy+VIeQsYXpsLjdr4GvHv5eECMISX1zKLTedhdg=",
@@ -760,7 +971,7 @@
         "type": "github"
       }
     },
-    "nixpkgs_12": {
+    "nixpkgs_13": {
       "locked": {
         "lastModified": 1778869304,
         "narHash": "sha256-30sZNZoA1cqF5JNO9fVX+wgiQYjB7HJqqJ4ztCDeBZE=",
@@ -807,11 +1018,11 @@
     },
     "nixpkgs_4": {
       "locked": {
-        "lastModified": 1784872115,
+        "lastModified": 1785747939,
-        "narHash": "sha256-THPEF2po0fsoH8gNtp+Ae0XFDJH3N/ol7xO3v6VMTJU=",
+        "narHash": "sha256-D740uKsMbgsfK2oaDenJLLPIZfq7W0/g4KN/Fls8eKs=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "335f0738cb2fa9708f3f428e39d2eae975d1338d",
+        "rev": "104240a772428cc2e20d8fd86c9ddbb886bbaff2",
         "type": "github"
       },
       "original": {
@@ -823,11 +1034,11 @@
     },
     "nixpkgs_5": {
       "locked": {
-        "lastModified": 1784796856,
+        "lastModified": 1785454630,
-        "narHash": "sha256-wWFrV5/Qbm+lyt5x20E/bSbfJiGKMo4RCxZV8cl/WZI=",
+        "narHash": "sha256-LQy14TZp77TwbQf40gg1V3jo8FwJG0jGDkAH+zRHqg8=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "e2587caef70cea85dd97d7daab492899902dbf5d",
+        "rev": "1559d3daa3ecc813a650b79375ea61b6741b8746",
         "type": "github"
       },
       "original": {
@@ -838,6 +1049,22 @@
       }
     },
     "nixpkgs_6": {
+      "locked": {
+        "lastModified": 1785692966,
+        "narHash": "sha256-vUfIeBEfpbAfZ5zjgIkYk7eHBeVfCYVjLbWnMkseYnk=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "643809054d65fdd466a63e3155b8c498cb483c04",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_7": {
       "locked": {
         "lastModified": 1767892417,
         "narHash": "sha256-8bW3q88CEg2u4hSP66Vf4lpbLonHz7hqDNBMcCY7E9U=",
@@ -850,7 +1077,7 @@
         "url": "https://channels.nixos.org/nixos-unstable/nixexprs.tar.xz"
       }
     },
-    "nixpkgs_7": {
+    "nixpkgs_8": {
       "locked": {
         "lastModified": 1783776592,
         "narHash": "sha256-UgCQzxeWI75XM8G+hPrPh+MKzEPjG3SpAj7dtqSbksA=",
@@ -866,13 +1093,13 @@
         "type": "github"
       }
     },
-    "nixpkgs_8": {
+    "nixpkgs_9": {
       "locked": {
-        "lastModified": 1784856561,
+        "lastModified": 1785734586,
-        "narHash": "sha256-J+Bx1Z6Oeoj2FgnBhRMKyUhhtDoOpTgXYaVLZpDjW4A=",
+        "narHash": "sha256-ODZkEK9Gy50yg6h98u7KkitZ3oc/uuTFK00bh1CRdNA=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "597283ad8aa0b331c788e97c4c262d58877074ef",
+        "rev": "531670d871c0e29724a02f3cbcac170adc65b58c",
         "type": "github"
       },
       "original": {
@@ -882,26 +1109,13 @@
         "type": "github"
       }
     },
-    "nixpkgs_9": {
-      "locked": {
-        "lastModified": 1784796856,
-        "narHash": "sha256-vwxWgF+Gj276WznzGb1LxGsK/39HaQwgQXiU3EkC844=",
-        "rev": "e2587caef70cea85dd97d7daab492899902dbf5d",
-        "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.11pre1040357.e2587caef70c/nixexprs.tar.xz"
-      },
-      "original": {
-        "type": "tarball",
-        "url": "https://channels.nixos.org/nixos-unstable/nixexprs.tar.xz"
-      }
-    },
     "nixvim": {
       "inputs": {
-        "flake-parts": "flake-parts_3",
+        "flake-parts": "flake-parts_4",
         "nixpkgs": [
           "nixpkgs"
         ],
-        "systems": "systems_4"
+        "systems": "systems_6"
       },
       "locked": {
         "lastModified": 1782919967,
@@ -920,14 +1134,14 @@
     },
     "noctalia": {
       "inputs": {
-        "nixpkgs": "nixpkgs_9"
+        "nixpkgs": "nixpkgs_10"
       },
       "locked": {
-        "lastModified": 1785150509,
+        "lastModified": 1785809412,
-        "narHash": "sha256-9YohBD2ceAWQYoT/1/QZIuaqi99hgbiUgBWyV3z6/xM=",
+        "narHash": "sha256-QbFIduUhpNIucJy/WcwRxsvTQocnwIXlSwnYEjmGMSQ=",
         "owner": "noctalia-dev",
         "repo": "noctalia",
-        "rev": "cf5c9a28fc27facf42309a558c075259e512ba66",
+        "rev": "e41c99439605df6d2fa62409139f96ded6ac7345",
         "type": "github"
       },
       "original": {
@@ -949,11 +1163,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1783439237,
+        "lastModified": 1785549842,
-        "narHash": "sha256-WUr8JF2v3n4Y30E5dxv4sAgNJXpVDBoCQNoQ/V4+n4o=",
+        "narHash": "sha256-DCwBZmGsySF7oKGTRgEv2HvpxVXkHT+38VhTM76k0B4=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "b70bb66c7bcd162642f3a609bc16843c7059f503",
+        "rev": "a9f987b57594e845e3e5cdd423b9a70846d70308",
         "type": "github"
       },
       "original": {
@@ -986,28 +1200,32 @@
     },
     "root": {
       "inputs": {
+        "browser-previews": "browser-previews",
         "codex-desktop-linux": "codex-desktop-linux",
         "disko": "disko",
         "flake-parts": "flake-parts",
         "ghostty": "ghostty",
         "git-hooks-nix": "git-hooks-nix",
+        "handy": "handy",
         "home-manager": "home-manager_2",
         "lanzaboote": "lanzaboote",
         "llm-agents": "llm-agents",
+        "nani-translate-linux": "nani-translate-linux",
         "niri-flake": "niri-flake",
         "nix-darwin": "nix-darwin",
+        "nix-hazkey": "nix-hazkey",
         "nix-index-database": "nix-index-database",
         "nixos-hardware": "nixos-hardware",
         "nixos-wsl": "nixos-wsl",
-        "nixpkgs": "nixpkgs_8",
+        "nixpkgs": "nixpkgs_9",
         "nixpkgs-unstable": "nixpkgs-unstable",
         "nixvim": "nixvim",
         "noctalia": "noctalia",
         "services-flake": "services-flake",
         "sops-nix": "sops-nix",
         "stylix": "stylix",
-        "systems": "systems_6",
+        "systems": "systems_8",
-        "treefmt-nix": "treefmt-nix_2",
+        "treefmt-nix": "treefmt-nix_3",
         "vicinae": "vicinae",
         "vicinae-extensions": "vicinae-extensions"
       }
@@ -1020,11 +1238,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1784438913,
+        "lastModified": 1785044261,
-        "narHash": "sha256-NYF7ZM5ip0u+w1pBFDpIGEbrbgN/wpnLFAmBkWkYMXw=",
+        "narHash": "sha256-ehF/c4fLdgmNu7YXEClnmwhoBYddhYIVoSQpsZoorC4=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "afacd6819d3765a05814ee8e3de74c77d42ac799",
+        "rev": "fe2124391e739e7b3e8720cd8a73f06edd0aceba",
         "type": "github"
       },
       "original": {
@@ -1070,7 +1288,7 @@
     },
     "soulver-cpp": {
       "inputs": {
-        "nixpkgs": "nixpkgs_12",
+        "nixpkgs": "nixpkgs_13",
         "nixpkgs-libxml2": "nixpkgs-libxml2"
       },
       "locked": {
@@ -1094,24 +1312,24 @@
         "base16-helix": "base16-helix",
         "base16-vim": "base16-vim",
         "firefox-gnome-theme": "firefox-gnome-theme",
-        "flake-parts": "flake-parts_4",
+        "flake-parts": "flake-parts_5",
         "gnome-shell": "gnome-shell",
         "nixpkgs": [
           "nixpkgs"
         ],
         "nur": "nur",
-        "systems": "systems_5",
+        "systems": "systems_7",
         "tinted-kitty": "tinted-kitty",
         "tinted-schemes": "tinted-schemes",
         "tinted-tmux": "tinted-tmux",
         "tinted-zed": "tinted-zed"
       },
       "locked": {
-        "lastModified": 1784676123,
+        "lastModified": 1785794750,
-        "narHash": "sha256-ndyanKzw90yX2nUVFmTuYqXidUNymtMfgmIHyNdhht0=",
+        "narHash": "sha256-OqIrGVL7AX462ISyJFAqjbqTc1RZlBkVHCa4dwPEZU4=",
         "owner": "nix-community",
         "repo": "stylix",
-        "rev": "66714e5ce44269ecc58c20d9196da8dbe1b27a31",
+        "rev": "cb5eb3a7343faba61fd694fac8040a326485a339",
         "type": "github"
       },
       "original": {
@@ -1121,6 +1339,21 @@
       }
     },
     "systems": {
+      "locked": {
+        "lastModified": 1680978846,
+        "narHash": "sha256-Gtqg8b/v49BFDpDetjclCYXm8mAnTrUzR0JnE2nv5aw=",
+        "owner": "nix-systems",
+        "repo": "x86_64-linux",
+        "rev": "2ecfcac5e15790ba6ce360ceccddb15ad16d08a8",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "x86_64-linux",
+        "type": "github"
+      }
+    },
+    "systems_10": {
       "locked": {
         "lastModified": 1681028828,
         "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
@@ -1136,7 +1369,6 @@
       }
     },
     "systems_2": {
-      "flake": false,
       "locked": {
         "lastModified": 1681028828,
         "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
@@ -1152,6 +1384,7 @@
       }
     },
     "systems_3": {
+      "flake": false,
       "locked": {
         "lastModified": 1681028828,
         "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
@@ -1212,6 +1445,22 @@
       }
     },
     "systems_7": {
+      "locked": {
+        "lastModified": 1774449309,
+        "narHash": "sha256-brhZ8DmuGtzkCYHJg4HEd602amKm89Y9ytsFZ5uWD1w=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "c29398b59d2048c4ab79345812849c9bd15e9150",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "ref": "future-26.11",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_8": {
       "locked": {
         "lastModified": 1681028828,
         "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
@@ -1226,7 +1475,7 @@
         "type": "github"
       }
     },
-    "systems_8": {
+    "systems_9": {
       "locked": {
         "lastModified": 1681028828,
         "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
@@ -1260,11 +1509,11 @@
     "tinted-schemes": {
       "flake": false,
       "locked": {
-        "lastModified": 1781968807,
+        "lastModified": 1785153830,
-        "narHash": "sha256-yYO3Vw2M0y3TAUqt+9+Mj0zwP3XDTF5/PXcPhhFQ1ZM=",
+        "narHash": "sha256-fNdfCTeCXU3tZG3TMincd+u68qBHQgCr2Ljr/M1mWP0=",
         "owner": "tinted-theming",
         "repo": "schemes",
-        "rev": "2ccef2f4b22e3cab5a9292811f7133a07eeba4a7",
+        "rev": "9bd28ed313560db3c5b605c63bc4e309e78e3fc8",
         "type": "github"
       },
       "original": {
@@ -1276,11 +1525,11 @@
     "tinted-tmux": {
       "flake": false,
       "locked": {
-        "lastModified": 1782012462,
+        "lastModified": 1785031658,
-        "narHash": "sha256-2iDiD8DQLwS1lGuD9TS8WlvNyDoTs6krWntJbtB2zGo=",
+        "narHash": "sha256-mZp9O2LjzdMzlqQF3l3fjqsuPBzXy+1qTfBEUGjTlpk=",
         "owner": "tinted-theming",
         "repo": "tinted-tmux",
-        "rev": "8c4e750f738a742bd73377ee41d3dadedebedef4",
+        "rev": "5d2c67f61ea7af36f16865ab6d541cdba41dc257",
         "type": "github"
       },
       "original": {
@@ -1292,11 +1541,11 @@
     "tinted-zed": {
       "flake": false,
       "locked": {
-        "lastModified": 1782009766,
+        "lastModified": 1785030526,
-        "narHash": "sha256-VUhBjpGvWqHI7rWeyMYb/u87YJSXHKfVV6S+IelWeO8=",
+        "narHash": "sha256-klZf8UviewRkxuu74Bhbq6tqy7oxebQC7UVRWbbtQxU=",
         "owner": "tinted-theming",
         "repo": "base16-zed",
-        "rev": "5e8350bcd354e3241ab681a265fa6ef060c40be1",
+        "rev": "16f5a8adf4a6b1310d0a61ab172de963e8f76a02",
         "type": "github"
       },
       "original": {
@@ -1308,16 +1557,17 @@
     "treefmt-nix": {
       "inputs": {
         "nixpkgs": [
-          "llm-agents",
+          "handy",
+          "bun2nix",
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1784369104,
+        "lastModified": 1770228511,
-        "narHash": "sha256-47cxbcZODibHv3rELFQ9vZly0vUNkND/atn/U7HLeb0=",
+        "narHash": "sha256-wQ6NJSuFqAEmIg2VMnLdCnUc0b7vslUohqqGGD+Fyxk=",
         "owner": "numtide",
         "repo": "treefmt-nix",
-        "rev": "df3c0640565d04a0261253cdd89fce78ec50168a",
+        "rev": "337a4fe074be1042a35086f15481d763b8ddc0e7",
         "type": "github"
       },
       "original": {
@@ -1328,14 +1578,35 @@
     },
     "treefmt-nix_2": {
       "inputs": {
-        "nixpkgs": "nixpkgs_10"
+        "nixpkgs": [
+          "llm-agents",
+          "nixpkgs"
+        ]
       },
       "locked": {
-        "lastModified": 1784369104,
+        "lastModified": 1785360170,
-        "narHash": "sha256-47cxbcZODibHv3rELFQ9vZly0vUNkND/atn/U7HLeb0=",
+        "narHash": "sha256-XE1lKgQ3eIO3E7zWryqcRsax+mYXod/5RHBn4YaR9YE=",
         "owner": "numtide",
         "repo": "treefmt-nix",
-        "rev": "df3c0640565d04a0261253cdd89fce78ec50168a",
+        "rev": "d1187f8bc71fb8aab02395869ec3f5c1920f75c0",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "type": "github"
+      }
+    },
+    "treefmt-nix_3": {
+      "inputs": {
+        "nixpkgs": "nixpkgs_11"
+      },
+      "locked": {
+        "lastModified": 1785360170,
+        "narHash": "sha256-XE1lKgQ3eIO3E7zWryqcRsax+mYXod/5RHBn4YaR9YE=",
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "rev": "d1187f8bc71fb8aab02395869ec3f5c1920f75c0",
         "type": "github"
       },
       "original": {
@@ -1346,16 +1617,16 @@
     },
     "vicinae": {
       "inputs": {
-        "nixpkgs": "nixpkgs_11",
+        "nixpkgs": "nixpkgs_12",
         "soulver-cpp": "soulver-cpp",
-        "systems": "systems_7"
+        "systems": "systems_9"
       },
       "locked": {
-        "lastModified": 1785027961,
+        "lastModified": 1785823793,
-        "narHash": "sha256-F8yaTqRGGKzl5QTtMM+4I2zUCpOq4or7zuzTmXSiTMA=",
+        "narHash": "sha256-iGKyp+peQzXI0T9LzYmRHr2tevkbhF5GfzDlVldVm2Q=",
         "owner": "vicinaehq",
         "repo": "vicinae",
-        "rev": "65c973b55df4b8f9a80e1663feeca570e3bf016c",
+        "rev": "b3130be7b480817d2255b4781476a91593267afb",
         "type": "github"
       },
       "original": {
@@ -1370,15 +1641,15 @@
         "nixpkgs": [
           "nixpkgs"
         ],
-        "systems": "systems_8",
+        "systems": "systems_10",
         "vicinae": "vicinae_2"
       },
       "locked": {
-        "lastModified": 1785084836,
+        "lastModified": 1785689597,
-        "narHash": "sha256-iww/OcxGK8isAgNh8k4E1IJkR5bGUvEK/K+q86g2ISk=",
+        "narHash": "sha256-WF3eenopWI9tvwcEhDsgEp2T46QFWw7ttEGefokLEZ0=",
         "owner": "vicinaehq",
         "repo": "extensions",
-        "rev": "2d5176bcb19498ff862ca1caa5eb97f03f60faac",
+        "rev": "37724bc3f2bcdf9f273bb160359cf22f453b5ef6",
         "type": "github"
       },
       "original": {

flake.nix

@@ -23,6 +23,11 @@
     # Desktop
     niri-flake.url = "github:sodiboo/niri-flake";
 
+    nix-hazkey = {
+      url = "github:aster-void/nix-hazkey";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
     stylix = {
       url = "github:nix-community/stylix";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -30,7 +35,13 @@
 
     # Terminal
     ghostty = {
-      url = "github:moons-14/ghostty";
+      url = "github:ghostty-org/ghostty";
+    };
+
+    # Speech to text
+    handy = {
+      url = "github:cjpais/Handy";
+      inputs.nixpkgs.follows = "nixpkgs";
     };
 
     # Shell / Launcher
@@ -94,6 +105,14 @@
 
     # Systems
     systems.url = "github:nix-systems/default";
+
+    browser-previews = {
+      url = "github:nix-community/browser-previews";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    nani-translate-linux.url = "git+https://github.com/zunoser/nani-translate-linux.git";
+
   };
 
   outputs =

flake/default.nix

@@ -3,5 +3,6 @@
     ./formatter.nix
     ./git-hooks.nix
     ./registry.nix
+    ./validation.nix
   ];
 }

flake/git-hooks.nix

@@ -34,7 +34,9 @@
             ];
           };
 
+          actionlint.enable = true;
           deadnix.enable = true;
+          ruff.enable = true;
           statix.enable = true;
           shellcheck.enable = true;
         };

flake/registry.nix

@@ -25,11 +25,42 @@ let
     else
       { };
   configurations = dotfilesLib.hosts.mkConfigurations hostSpecs;
+
+  validationMetadata = {
+    schemaVersion = 1;
+
+    hosts = lib.mapAttrs (
+      name: spec:
+      let
+        isDarwin = lib.hasSuffix "-darwin" spec.system;
+      in
+      {
+        inherit (spec) system user;
+        kind = if isDarwin then "darwin" else "nixos";
+        homeManager = spec.homeManager or true;
+        selectedUnits = dotfilesLib.hosts.selectedUnits spec;
+        buildAttr =
+          if isDarwin then
+            "darwinConfigurations.${name}.system"
+          else
+            "nixosConfigurations.${name}.config.system.build.toplevel";
+      }
+    ) hostSpecs;
+
+    units = lib.mapAttrs (_id: unit: {
+      inherit (unit) id relativePath;
+      directory = "modules/${lib.concatStringsSep "/" unit.relativePath}";
+      includes = unit.meta.includes;
+      fragments = builtins.attrNames (lib.filterAttrs (_: value: value != null) unit.fragments);
+    }) dotfilesLib.registry.units;
+  };
 in
 {
   flake = {
     inherit (configurations) darwinConfigurations nixosConfigurations;
-    lib = dotfilesLib;
+    lib = dotfilesLib // {
+      inherit validationMetadata;
+    };
   };
 
   perSystem =
@@ -37,10 +68,9 @@ in
     let
       nixosChecks =
         lib.mapAttrs' (name: nixos: lib.nameValuePair "nixos-${name}" nixos.config.system.build.toplevel)
-          (
+          (lib.filterAttrs (name: _: hostSpecs.${name}.system == system) configurations.nixosConfigurations);
-            lib.filterAttrs (
+      darwinChecks = lib.mapAttrs' (name: darwin: lib.nameValuePair "darwin-${name}" darwin.system) (
-              _: nixos: nixos.pkgs.stdenv.hostPlatform.system == system
+        lib.filterAttrs (name: _: hostSpecs.${name}.system == system) configurations.darwinConfigurations
-            ) configurations.nixosConfigurations
       );
     in
     {
@@ -49,6 +79,7 @@ in
           inherit inputs lib pkgs;
         };
       }
-      // nixosChecks;
+      // nixosChecks
+      // darwinChecks;
     };
 }

flake/validation.nix

@@ -0,0 +1,51 @@
+_: {
+  perSystem =
+    { pkgs, config, ... }:
+    let
+      script = pkgs.writeText "dotfiles-check.py" (builtins.readFile ../scripts/dotfiles-check.py);
+      dotfilesCheck = pkgs.writeShellApplication {
+        name = "dotfiles-check";
+        runtimeInputs = [
+          pkgs.git
+          pkgs.nix
+          pkgs.python3
+        ];
+        text = ''
+          exec python3 ${script} "$@"
+        '';
+      };
+    in
+    {
+      apps = {
+        check = {
+          type = "app";
+          program = "${dotfilesCheck}/bin/dotfiles-check";
+        };
+        nix-fast-build = {
+          type = "app";
+          program = "${pkgs.nix-fast-build}/bin/nix-fast-build";
+        };
+      };
+
+      packages = {
+        dotfiles-check = dotfilesCheck;
+        inherit (pkgs) nix-fast-build;
+      };
+
+      devShells.validation = config.pre-commit.devShell;
+
+      checks = {
+        validation-tool =
+          pkgs.runCommand "dotfiles-check-self-test"
+            {
+              nativeBuildInputs = [ dotfilesCheck ];
+            }
+            ''
+              dotfiles-check self-test
+              touch "$out"
+            '';
+
+        dotnix-shell = config.devShells.dotnix;
+      };
+    };
+}

hosts/default.nix

@@ -1,4 +1,57 @@
 {
+  nix-example = {
+    system = "x86_64-linux";
+    stateVersion = "26.05";
+    user = "moons";
+    path = ./nix-example;
+
+    profiles = [
+      "base"
+      "interface.cli"
+      "platform.vm"
+      "workload.development"
+      "workload.remote-access"
+    ];
+  };
+
+  ops = {
+    system = "x86_64-linux";
+    stateVersion = "26.05";
+    user = "moons";
+    path = ./ops;
+
+    profiles = [
+      "base"
+      "interface.cli"
+      "platform.vm"
+      "workload.remote-access"
+    ];
+  };
+
+  internal-app-01 = {
+    system = "x86_64-linux";
+    stateVersion = "26.05";
+    user = "moons";
+    path = ./internal-app-01;
+
+    profiles = [
+      "base"
+      "interface.cli"
+      "platform.vm"
+      "workload.server"
+    ];
+  };
+
+  installer = {
+    system = "x86_64-linux";
+    stateVersion = "26.05";
+    user = "moons";
+    path = ./installer;
+    homeManager = false;
+
+    profiles = [ "base" ];
+  };
+
   x1g9 = {
     system = "x86_64-linux";
     stateVersion = "26.05";
@@ -8,7 +61,7 @@
     profiles = [
       "base"
       "interface.cli"
-      "interface.gnome"
+      "interface.labwc"
       "interface.niri"
       "platform.thinkpad-x1"
       "security.fingerprint"
@@ -26,7 +79,7 @@
     profiles = [
       "base"
       "interface.cli"
-      "interface.gnome"
+      "interface.labwc"
       "interface.niri"
       "networking.tailscale-client"
       "platform.thinkpad-x1"
@@ -35,6 +88,30 @@
       "security.secure-boot"
       "security.tpm-storage"
       "workload.development"
+      "workload.game"
+      "workload.personal"
+    ];
+  };
+
+  galleria = {
+    system = "x86_64-linux";
+    stateVersion = "26.05";
+    user = "moons";
+    path = ./galleria;
+
+    profiles = [
+      "base"
+      "interface.cli"
+      "interface.labwc"
+      "interface.niri"
+      "interface.wallpaperengine"
+      "platform.intel-nvidia-desktop"
+      "security.secrets"
+      "security.secure-boot"
+      "security.tpm-storage"
+      "security.fingerprint"
+      "workload.development"
+      "workload.game"
       "workload.personal"
     ];
   };
@@ -52,6 +129,7 @@
       "security.fingerprint"
       # "security.secrets"
       "workload.development"
+      "workload.game"
       "workload.personal"
     ];
   };

hosts/galleria/disko.nix

@@ -0,0 +1,91 @@
+_:
+let
+  espPart = "/dev/disk/by-partuuid/008b04ef-9c06-4049-bffb-3906f5c3a9c1";
+  nixosPart = "/dev/disk/by-partuuid/04295552-cbb8-4511-ac1e-1171ec20f8d1";
+
+  btrfsMountOptions = [
+    "compress=zstd"
+    "noatime"
+    "ssd"
+    "space_cache=v2"
+  ];
+in
+{
+  disko.enableConfig = true;
+
+  # These are deliberately partition paths, not the whole Windows disk. Disko
+  # must never own or destroy the disk's GPT or any Windows partition.
+  disko.devices.disk = {
+    esp = {
+      type = "disk";
+      device = espPart;
+      destroy = false;
+
+      content = {
+        type = "filesystem";
+        format = "vfat";
+        mountpoint = "/boot";
+        mountOptions = [ "umask=0077" ];
+      };
+    };
+
+    nixos = {
+      type = "disk";
+      device = nixosPart;
+      destroy = false;
+
+      content = {
+        type = "luks";
+        name = "cryptroot";
+        askPassword = true;
+        settings.allowDiscards = true;
+
+        extraFormatArgs = [
+          "--type"
+          "luks2"
+          "--pbkdf"
+          "argon2id"
+          "--label"
+          "NixOS-LUKS"
+        ];
+
+        content = {
+          type = "btrfs";
+          extraArgs = [
+            "-f"
+            "-L"
+            "NixOS"
+          ];
+
+          subvolumes = {
+            "@root" = {
+              mountpoint = "/";
+              mountOptions = btrfsMountOptions;
+            };
+
+            "@home" = {
+              mountpoint = "/home";
+              mountOptions = btrfsMountOptions;
+            };
+
+            "@nix" = {
+              mountpoint = "/nix";
+              mountOptions = btrfsMountOptions;
+            };
+
+            "@log" = {
+              mountpoint = "/var/log";
+              mountOptions = btrfsMountOptions;
+            };
+
+            "@swap" = {
+              mountpoint = "/.swapvol";
+              mountOptions = [ "noatime" ];
+              swap.swapfile.size = "32G";
+            };
+          };
+        };
+      };
+    };
+  };
+}

hosts/galleria/hardware-configuration.nix

@@ -0,0 +1,30 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  config,
+  lib,
+  modulesPath,
+  ...
+}:
+
+{
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "ahci"
+    "nvme"
+    "usbhid"
+    "usb_storage"
+    "sd_mod"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/galleria/home.nix

@@ -0,0 +1,46 @@
+{
+  lib,
+  config,
+  ...
+}:
+{
+  services.kanshi = {
+    enable = true;
+
+    settings = [
+      {
+        profile = {
+          name = "galleria";
+
+          outputs = [
+            {
+              criteria = "HDMI-A-1";
+              status = "enable";
+              position = "0,0";
+              scale = 1.5;
+            }
+            {
+              criteria = "DP-1";
+              status = "enable";
+              position = "2560,0";
+            }
+            {
+              criteria = "DP-2";
+              status = "enable";
+              position = "5120,0";
+              scale = 1.5;
+            }
+          ];
+        };
+      }
+    ];
+  };
+
+  home.file.".wallpapers" = {
+    source = lib.mkForce (
+      config.lib.file.mkOutOfStoreSymlink "${config.home.homeDirectory}/Pictures/wallpapers"
+    );
+
+    recursive = lib.mkForce false;
+  };
+}

hosts/galleria/nixos.nix

@@ -0,0 +1,14 @@
+{ inputs, pkgs, ... }:
+{
+  imports = [
+    ./hardware-configuration.nix
+    ./disko.nix
+  ];
+
+  boot.initrd.luks.devices.cryptroot.device =
+    "/dev/disk/by-partuuid/04295552-cbb8-4511-ac1e-1171ec20f8d1";
+
+  environment.systemPackages = with inputs.browser-previews.packages.${pkgs.system}; [
+    google-chrome-beta
+  ];
+}

hosts/installer/nixos.nix

@@ -0,0 +1,194 @@
+{
+  pkgs,
+  lib,
+  modulesPath,
+  ...
+}:
+{
+  imports = [ "${modulesPath}/installer/cd-dvd/installation-cd-minimal.nix" ];
+
+  boot.zfs.forceImportRoot = false;
+
+  networking = {
+    hostName = "nixos-installer";
+
+    networkmanager = {
+      enable = true;
+      wifi.powersave = false;
+    };
+  };
+
+  services.openssh = {
+    enable = true;
+    settings = {
+      PermitRootLogin = "prohibit-password";
+      PasswordAuthentication = false;
+      KbdInteractiveAuthentication = false;
+      PubkeyAuthentication = "yes";
+    };
+  };
+
+  users.users.root.openssh.authorizedKeys.keys = [
+    "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIKhxDkucmeCor6CKoXAua7DgDSzuXrZOtpdkyzQxz5+aAAAABHNzaDo= moons@moons14.com"
+    "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIN6hZJyng/5LgFKPjR6uZAd/00UkO0vN0uQOoIvfSELdAAAABHNzaDo= moons@moons14.com"
+  ];
+
+  environment.systemPackages = with pkgs; [
+    git
+    disko
+    sops
+    age
+    ssh-to-age
+    age-plugin-yubikey
+    yubikey-manager
+    pcsc-tools
+    mkpasswd
+    rsync
+    vim
+    wget
+    curl
+    jq
+    parted
+    cryptsetup
+    btrfs-progs
+    efibootmgr
+    pciutils
+    sbctl
+    tpm2-tools
+    util-linux
+  ];
+
+  services.pcscd.enable = true;
+
+  environment.etc."installer-help.txt".text = ''
+
+    ╔══════════════════════════════════════════════════════════════╗
+    ║                    NixOS Installer ISO                       ║
+    ╠══════════════════════════════════════════════════════════════╣
+    ║                                                              ║
+    ║  SSH Access:                                                 ║
+    ║    ssh root@<ip-address>                                     ║
+    ║                                                              ║
+    ║  Network Setup:                                              ║
+    ║    Wired:   Auto-configured via DHCP                         ║
+    ║    WiFi:    nmcli device wifi connect <SSID> --ask           ║
+    ║                                                              ║
+    ║  Installation Workflow:                                      ║
+    ║                                                              ║
+    ║  1. Clone dotfiles:                                          ║
+    ║     git clone git@github.com:moons-14/dotfiles.git ~/dotfiles║
+    ║                                                              ║
+    ║  2. Generate SSH host key for new host:                      ║
+    ║     ssh-keygen -t ed25519 -f /tmp/ssh_host_ed25519_key -N "" ║
+    ║                                                              ║
+    ║  3. Get age public key from SSH host key:                    ║
+    ║     ssh-to-age -i /tmp/ssh_host_ed25519_key.pub              ║
+    ║                                                              ║
+    ║  4. Add age key to .sops.yaml:                               ║
+    ║     cd ~/dotfiles                                            ║
+    ║     # Edit .sops.yaml and add the age key                    ║
+    ║     # Add new host entry to creation_rules                   ║
+    ║                                                              ║
+    ║  5. Re-encrypt secrets:                                      ║
+    ║     sops updatekeys secrets/common/system.yaml               ║
+    ║     sops updatekeys secrets/hosts/<host>/*.yaml              ║
+    ║                                                              ║
+    ║  6. Create disko.nix for new host:                           ║
+    ║     # Check disk devices                                     ║
+    ║     lsblk -f                                                 ║
+    ║                                                              ║
+    ║     # Create hosts/<host>/disko.nix                          ║
+    ║     # Example: LUKS + btrfs                                  ║
+    ║     # See hosts/x1g13/disko.nix for reference                ║
+    ║                                                              ║
+    ║  7. Partition disk with disko:                               ║
+    ║     nix run github:nix-community/disko -- \                  ║
+    ║       --mode disko hosts/<host>/disko.nix                    ║
+    ║                                                              ║
+    ║  8. Copy host key to installed system:                       ║
+    ║     mkdir -p /mnt/etc/ssh                                    ║
+    ║     cp /tmp/ssh_host_ed25519_key* /mnt/etc/ssh/              ║
+    ║     chmod 600 /mnt/etc/ssh/ssh_host_ed25519_key              ║
+    ║                                                              ║
+    ║  9. Install NixOS:                                           ║
+    ║     nixos-install --flake ~/dotfiles#<host>                  ║
+    ║                                                              ║
+    ║  Disko Configuration Examples:                               ║
+    ║                                                              ║
+    ║  Simple (no encryption):                                     ║
+    ║    disko.devices.disk.main = {                               ║
+    ║      type = "disk";                                          ║
+    ║      device = "/dev/sda";                                    ║
+    ║      content = {                                             ║
+    ║        type = "gpt";                                         ║
+    ║        partitions = {                                        ║
+    ║          ESP = { size = "512M"; type = "EF00";              ║
+    ║            content = { type = "filesystem";                  ║
+    ║              format = "vfat"; mountpoint = "/boot"; }; };   ║
+    ║          root = { size = "100%";                             ║
+    ║            content = { type = "filesystem";                  ║
+    ║              format = "ext4"; mountpoint = "/"; }; };       ║
+    ║        };                                                    ║
+    ║      };                                                      ║
+    ║    };                                                        ║
+    ║                                                              ║
+    ║  LUKS + btrfs (see hosts/x1g13/disko.nix):                  ║
+    ║    - Use partuuid for device path                            ║
+    ║    - Set askPassword = true for LUKS                         ║
+    ║    - Configure btrfs subvolumes                              ║
+    ║                                                              ║
+    ╚══════════════════════════════════════════════════════════════╝
+
+  '';
+
+  systemd.services.installer-banner = {
+    description = "Display installer help on console";
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = {
+      Type = "oneshot";
+      ExecStart = "${pkgs.coreutils}/bin/cat /etc/installer-help.txt";
+      StandardOutput = "tty";
+      TTYPath = "/dev/tty1";
+    };
+  };
+
+  systemd.services.display-ip = {
+    description = "Display IP address on console";
+    wantedBy = [ "multi-user.target" ];
+    after = [ "network-online.target" ];
+    wants = [ "network-online.target" ];
+    serviceConfig = {
+      Type = "oneshot";
+      ExecStart = pkgs.writeShellScript "display-ip" ''
+        sleep 2
+        echo ""
+        echo "=== Network Interfaces ==="
+        ${pkgs.iproute2}/bin/ip -4 addr show | ${pkgs.gnugrep}/bin/grep inet
+        echo ""
+        echo "=== SSH Access ==="
+        for ip in $(${pkgs.iproute2}/bin/ip -4 addr show | ${pkgs.gnugrep}/bin/grep -oP 'inet \K[\d.]+' | ${pkgs.gnugrep}/bin/grep -v '127.0.0.1'); do
+          echo "  ssh root@$ip"
+        done
+        echo ""
+      '';
+      StandardOutput = "tty";
+      TTYPath = "/dev/tty1";
+    };
+  };
+
+  nix = {
+    settings = {
+      experimental-features = [
+        "nix-command"
+        "flakes"
+      ];
+      trusted-users = [ "root" ];
+    };
+
+    extraOptions = ''
+      experimental-features = nix-command flakes
+    '';
+  };
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}

hosts/internal-app-01/hardware-configuration.nix

@@ -0,0 +1,36 @@
+# Do not modify this file! It was generated by `nixos-generate-config` and may
+# be overwritten by future invocations.
+{ lib, modulesPath, ... }:
+{
+  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
+
+  boot.initrd.availableKernelModules = [
+    "ata_piix"
+    "uhci_hcd"
+    "virtio_pci"
+    "virtio_scsi"
+    "sd_mod"
+    "sr_mod"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/1b12ab98-2537-4207-a3f4-bb8ba7b53b00";
+    fsType = "ext4";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/8365-C778";
+    fsType = "vfat";
+    options = [
+      "fmask=0077"
+      "dmask=0077"
+    ];
+  };
+
+  swapDevices = [ ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}

hosts/internal-app-01/nixos.nix

@@ -0,0 +1,3 @@
+{
+  imports = [ ./hardware-configuration.nix ];
+}

hosts/nix-example/hardware-configuration.nix

@@ -0,0 +1,36 @@
+# Do not modify this file! It was generated by `nixos-generate-config` and may
+# be overwritten by future invocations.
+{ lib, modulesPath, ... }:
+{
+  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
+
+  boot.initrd.availableKernelModules = [
+    "ata_piix"
+    "uhci_hcd"
+    "virtio_pci"
+    "virtio_scsi"
+    "sd_mod"
+    "sr_mod"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/8f0eaec6-5dc9-4821-aa8d-fb6809b5a5bf";
+    fsType = "ext4";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/201C-961B";
+    fsType = "vfat";
+    options = [
+      "fmask=0077"
+      "dmask=0077"
+    ];
+  };
+
+  swapDevices = [ ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}

hosts/nix-example/nixos.nix

@@ -0,0 +1,3 @@
+{
+  imports = [ ./hardware-configuration.nix ];
+}

hosts/ops/hardware-configuration.nix

@@ -0,0 +1,36 @@
+# Do not modify this file! It was generated by `nixos-generate-config` and may
+# be overwritten by future invocations.
+{ lib, modulesPath, ... }:
+{
+  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
+
+  boot.initrd.availableKernelModules = [
+    "ata_piix"
+    "uhci_hcd"
+    "virtio_pci"
+    "virtio_scsi"
+    "sd_mod"
+    "sr_mod"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/69fa2193-1e4f-438a-8898-5de8a3f36e5b";
+    fsType = "ext4";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/D09B-4277";
+    fsType = "vfat";
+    options = [
+      "fmask=0077"
+      "dmask=0077"
+    ];
+  };
+
+  swapDevices = [ ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}

hosts/ops/nixos.nix

@@ -0,0 +1,51 @@
+{
+  imports = [ ./hardware-configuration.nix ];
+
+  networking = {
+    useDHCP = false;
+
+    interfaces = {
+      ens18 = {
+        useDHCP = false;
+        ipv4.addresses = [
+          {
+            address = "10.50.128.20";
+            prefixLength = 24;
+          }
+        ];
+      };
+
+      ens19 = {
+        useDHCP = false;
+        ipv4.addresses = [
+          {
+            address = "10.50.7.101";
+            prefixLength = 24;
+          }
+        ];
+      };
+
+      ens20 = {
+        useDHCP = false;
+        ipv4.routes = [
+          {
+            address = "10.50.64.0";
+            prefixLength = 24;
+            via = "10.50.82.1";
+          }
+        ];
+        ipv4.addresses = [
+          {
+            address = "10.50.82.10";
+            prefixLength = 24;
+          }
+        ];
+      };
+    };
+
+    defaultGateway = {
+      address = "10.50.128.1";
+      interface = "ens18";
+    };
+  };
+}

hosts/x1g13/home.nix

@@ -1,9 +1,22 @@
 {
-  programs.niri.settings.outputs."eDP-1" = {
+  services.kanshi = {
-    scale = 1.2;
+    enable = true;
-    position = {
+
-      x = 0;
+    settings = [
-      y = 0;
+      {
+        profile = {
+          name = "x1g13";
+
+          outputs = [
+            {
+              criteria = "eDP-1";
+              status = "enable";
+              position = "0,0";
+              scale = 1.5;
+            }
+          ];
         };
+      }
+    ];
   };
 }

libs/hosts.nix

@@ -74,7 +74,10 @@ let
     let
       homePath = hostFile spec "home.nix";
       homeModules = [
-        (registry.mkModule { class = "home"; })
+        (registry.mkModule {
+          class = "home";
+          systemClass = "nixos";
+        })
         (registry.mkSelectionModule selected)
         { home.stateVersion = spec.stateVersion; }
       ]
@@ -96,7 +99,10 @@ let
     let
       homePath = hostFile spec "home.nix";
       homeModules = [
-        (registry.mkModule { class = "home"; })
+        (registry.mkModule {
+          class = "home";
+          systemClass = "darwin";
+        })
         (registry.mkSelectionModule selected)
         { home.stateVersion = spec.stateVersion; }
       ]

libs/registry.nix

@@ -4,7 +4,7 @@
   modulesRoot,
 }:
 let
-  reservedFiles = {
+  rootFragmentFiles = {
     common = "common.nix";
     nixos = "nixos.nix";
     darwin = "darwin.nix";
@@ -12,6 +12,14 @@ let
     meta = "meta.nix";
   };
 
+  homeFragmentFiles = {
+    homeCommon = "common.nix";
+    homeNixos = "nixos.nix";
+    homeDarwin = "darwin.nix";
+  };
+
+  fragmentFileNames = rootFragmentFiles // lib.mapAttrs (_: name: "home/${name}") homeFragmentFiles;
+
   isFile = kind: kind == "regular" || kind == "symlink";
 
   ensure =
@@ -103,13 +111,17 @@ let
       );
 
   makeUnit =
-    relativePath: entries:
+    relativePath: entries: homeEntries:
     let
       directory = pathFor relativePath;
       id = lib.concatStringsSep "." relativePath;
-      fragments = lib.mapAttrs (
+      rootFragments = lib.mapAttrs (
         _class: fileName: if entryIsFile entries fileName then directory + "/${fileName}" else null
-      ) reservedFiles;
+      ) rootFragmentFiles;
+      homeFragments = lib.mapAttrs (
+        _class: fileName: if entryIsFile homeEntries fileName then directory + "/home/${fileName}" else null
+      ) homeFragmentFiles;
+      fragments = rootFragments // homeFragments;
       baseUnit = {
         inherit
           id
@@ -138,11 +150,22 @@ let
     let
       directory = pathFor relativePath;
       entries = builtins.readDir directory;
-      hasReservedFile = lib.any (fileName: entryIsFile entries fileName) (
+      homeEntries =
-        builtins.attrValues reservedFiles
+        if relativePath != [ ] && (entries.home or null) == "directory" then
+          builtins.readDir (directory + "/home")
+        else
+          { };
+      hasRootFragment = lib.any (fileName: entryIsFile entries fileName) (
+        builtins.attrValues rootFragmentFiles
       );
-      childDirectories = lib.filter (name: entries.${name} == "directory") (builtins.attrNames entries);
+      hasHomeFragment = lib.any (fileName: entryIsFile homeEntries fileName) (
-      current = lib.optional hasReservedFile (makeUnit relativePath entries);
+        builtins.attrValues homeFragmentFiles
+      );
+      hasFragment = hasRootFragment || hasHomeFragment;
+      childDirectories = lib.filter (
+        name: entries.${name} == "directory" && !(name == "home" && hasHomeFragment)
+      ) (builtins.attrNames entries);
+      current = lib.optional hasFragment (makeUnit relativePath entries homeEntries);
       children = lib.concatMap (name: walk (relativePath ++ [ name ])) childDirectories;
     in
     current ++ children;
@@ -208,12 +231,44 @@ let
       "common"
       "darwin"
     ];
-    home = [ "home" ];
+    home = {
+      nixos = [
+        "home"
+        "homeCommon"
+        "homeNixos"
+      ];
+      darwin = [
+        "home"
+        "homeCommon"
+        "homeDarwin"
+      ];
     };
+  };
+
+  fragmentClassesFor =
+    {
+      class,
+      systemClass,
+    }:
+    ensure (builtins.hasAttr class fragmentClasses) "unsupported module class '${class}'" (
+      if class == "home" then
+        ensure
+          (builtins.elem systemClass [
+            "nixos"
+            "darwin"
+          ])
+          "the home module class requires systemClass to be 'nixos' or 'darwin'"
+          fragmentClasses.home.${systemClass}
+      else
+        ensure (
+          systemClass == null
+        ) "systemClass is only supported for the home module class" fragmentClasses.${class}
+    );
 
   applyFragment =
     {
       config,
+      fragmentName,
       fragmentPath,
       options,
       specialArgs,
@@ -244,8 +299,7 @@ let
       );
       resultValue = if builtins.isFunction fragment then fragment fragmentArgs else fragment;
       result =
-        ensure (builtins.isAttrs resultValue)
+        ensure (builtins.isAttrs resultValue) "${unit.id}: ${fragmentName} must return an attribute set"
-          "${unit.id}: ${builtins.baseNameOf fragmentPath} must return an attribute set"
           resultValue;
       forbiddenKeys = lib.filter (name: builtins.hasAttr name result) [
         "imports"
@@ -254,14 +308,20 @@ let
       ];
     in
     ensure (forbiddenKeys == [ ])
-      "${unit.id}: ${builtins.baseNameOf fragmentPath} is a configuration fragment and cannot define top-level ${lib.concatStringsSep ", " forbiddenKeys}"
+      "${unit.id}: ${fragmentName} is a configuration fragment and cannot define top-level ${lib.concatStringsSep ", " forbiddenKeys}"
       result;
 
   externalImports = class: lib.concatMap (unit: unit.meta.imports.${class}) discoveredUnits;
 
   mkModule =
-    { class }:
+    {
-    ensure (builtins.hasAttr class fragmentClasses) "unsupported module class '${class}'" (
+      class,
+      systemClass ? null,
+    }:
+    let
+      selectedFragmentClasses = fragmentClassesFor { inherit class systemClass; };
+    in
+    builtins.seq selectedFragmentClasses (
       builtins.seq dependencyValidation (
         {
           config,
@@ -277,6 +337,7 @@ let
               map (
                 fragmentClass:
                 let
+                  fragmentName = fragmentFileNames.${fragmentClass};
                   fragmentPath = unit.fragments.${fragmentClass};
                 in
                 if fragmentPath == null then
@@ -285,13 +346,14 @@ let
                   lib.mkIf (enabled config unit) (applyFragment {
                     inherit
                       config
+                      fragmentName
                       fragmentPath
                       options
                       specialArgs
                       unit
                       ;
                   })
-              ) fragmentClasses.${class}
+              ) selectedFragmentClasses
             )
           ) discoveredUnits;
         in

modules/applications/1password/common.nix

@@ -0,0 +1,4 @@
+_: {
+  programs._1password-gui.enable = true;
+  programs._1password.enable = true;
+}

modules/applications/1password/darwin.nix

@@ -1,8 +0,0 @@
-{
-  # The macOS app must live in /Applications for its background integrations,
-  # including the SSH agent, to work correctly.
-  homebrew = {
-    enable = true;
-    casks = [ "1password" ];
-  };
-}

modules/applications/1password/home.nix

@@ -1,7 +0,0 @@
-{ pkgs, ... }:
-{
-  home.packages = [
-    pkgs._1password-cli
-  ]
-  ++ pkgs.lib.optionals pkgs.stdenv.hostPlatform.isLinux [ pkgs._1password-gui ];
-}

modules/applications/1password/nixos.nix

@@ -1,11 +1,8 @@
 { primaryUser, lib, ... }:
 {
-  programs._1password.enable = true;
+  programs._1password-gui.polkitPolicyOwners = [ primaryUser ];
-  programs._1password-gui = {
-    enable = true;
-    polkitPolicyOwners = [ primaryUser ];
-  };
 
+  # 1Password SSH Agentと競合するagentを無効化
   programs.ssh.startAgent = lib.mkForce false;
   programs.gnupg.agent.enableSSHSupport = lib.mkForce false;
   services.gnome.gcr-ssh-agent.enable = lib.mkForce false;

modules/applications/activitywatch/darwin.nix

@@ -0,0 +1,8 @@
+{
+  homebrew.casks = [ "activitywatch" ];
+
+  launchd.agents.activitywatch = {
+    command = "/usr/bin/open -gja ActivityWatch";
+    serviceConfig.RunAtLoad = true;
+  };
+}

modules/applications/activitywatch/home/nixos.nix

@@ -0,0 +1,11 @@
+{ pkgs, ... }:
+{
+  services.activitywatch = {
+    enable = true;
+
+    watchers.aw-awatcher = {
+      package = pkgs.awatcher;
+      executable = "awatcher";
+    };
+  };
+}

modules/applications/activitywatch/meta.nix

@@ -0,0 +1,3 @@
+{
+  description = "ActivityWatch automated time tracker";
+}

modules/applications/atuin/home.nix

@@ -0,0 +1,9 @@
+{
+  programs.atuin = {
+    enable = true;
+
+    enableZshIntegration = true;
+    enableBashIntegration = true;
+    enableFishIntegration = true;
+  };
+}

modules/applications/baobab/home.nix

@@ -0,0 +1,4 @@
+{ pkgs, ... }:
+{
+  home.packages = [ pkgs.baobab ];
+}

modules/applications/celluloid/home/nixos.nix

@@ -0,0 +1,31 @@
+{ pkgs, ... }:
+{
+  home.packages = [ pkgs.celluloid ];
+
+  xdg.mimeApps = {
+    enable = true;
+    defaultApplicationPackages = [ pkgs.celluloid ];
+    defaultApplications = builtins.listToAttrs (
+      map
+        (mime: {
+          name = mime;
+          value = [ "io.github.celluloid_player.Celluloid.desktop" ];
+        })
+        [
+          "video/3gpp"
+          "video/3gpp2"
+          "video/mp2t"
+          "video/mp4"
+          "video/mpeg"
+          "video/ogg"
+          "video/quicktime"
+          "video/webm"
+          "video/x-flv"
+          "video/x-m4v"
+          "video/x-matroska"
+          "video/x-msvideo"
+          "video/x-ms-wmv"
+        ]
+    );
+  };
+}

modules/applications/chrome/home.nix

@@ -1,4 +0,0 @@
-{ lib, pkgs, ... }:
-lib.mkIf pkgs.stdenv.hostPlatform.isLinux {
-  home.packages = [ pkgs.google-chrome ];
-}

modules/applications/chrome/home/nixos.nix

@@ -0,0 +1,19 @@
+_: {
+  programs.google-chrome = {
+    enable = true;
+
+    commandLineArgs = [
+      "--enable-features=MiddleClickAutoscroll"
+    ];
+  };
+
+  xdg.mimeApps = {
+    enable = true;
+
+    defaultApplications = {
+      "text/html" = "google-chrome.desktop";
+      "x-scheme-handler/http" = "google-chrome.desktop";
+      "x-scheme-handler/https" = "google-chrome.desktop";
+    };
+  };
+}

modules/applications/chrome/nixos.nix

@@ -1,25 +0,0 @@
-{ pkgs, ... }:
-let
-  chromeLauncher = pkgs.makeDesktopItem {
-    name = "google-chrome";
-    desktopName = "Google Chrome";
-    genericName = "Web Browser";
-    exec = "${pkgs.google-chrome}/bin/google-chrome-stable --enable-features=TouchpadOverscrollHistoryNavigation %U";
-    icon = "google-chrome";
-    terminal = false;
-    categories = [
-      "Network"
-      "WebBrowser"
-    ];
-    startupNotify = true;
-  };
-in
-{
-  environment.systemPackages = [ chromeLauncher ];
-
-  xdg.mime.defaultApplications = {
-    "text/html" = "google-chrome.desktop";
-    "x-scheme-handler/http" = "google-chrome.desktop";
-    "x-scheme-handler/https" = "google-chrome.desktop";
-  };
-}

modules/applications/codex-desktop/nixos.nix

@@ -1,37 +1,18 @@
 {
   inputs,
-  lib,
   pkgs,
   ...
 }:
-let
-  codexCliPackage = inputs.llm-agents.packages.${pkgs.stdenv.hostPlatform.system}.codex;
-  codexDesktopPackage =
-    inputs.codex-desktop-linux.packages.${pkgs.stdenv.hostPlatform.system}.codex-desktop-computer-use-ui;
-  launcher = pkgs.makeDesktopItem {
-    name = "codex";
-    desktopName = "Codex";
-    genericName = "ChatGPT Desktop";
-    comment = "Run Codex Desktop";
-    exec = "env CODEX_CLI_PATH=${lib.getExe' codexCliPackage "codex"} BAMF_DESKTOP_FILE_HINT=codex.desktop CHROME_DESKTOP=codex.desktop ${lib.getExe' codexDesktopPackage "codex-desktop"} %u";
-    icon = "codex-desktop";
-    terminal = false;
-    categories = [ "Development" ];
-    startupNotify = true;
-    startupWMClass = "codex-desktop";
-    actions.new-window = {
-      name = "New Window";
-      exec = "env CODEX_CLI_PATH=${lib.getExe' codexCliPackage "codex"} BAMF_DESKTOP_FILE_HINT=codex.desktop CHROME_DESKTOP=codex.desktop CODEX_MULTI_LAUNCH=1 ${lib.getExe' codexDesktopPackage "codex-desktop"} --new-instance";
-    };
-  };
-in
 {
   programs.codexDesktopLinux = {
     enable = true;
-    package = codexDesktopPackage;
+    cliPackage = inputs.llm-agents.packages.${pkgs.stdenv.hostPlatform.system}.codex;
-    cliPackage = codexCliPackage;
+    remoteControl.enable = true;
-    computerUseUi.enable = true;
+    remoteMobileControl.enable = true;
+    computerUseUi.enable = false;
+    linuxFeatures = [
+      "appshots"
+      "open-target-discovery"
+    ];
   };
-
-  environment.systemPackages = [ launcher ];
 }

modules/applications/direnv/home.nix

@@ -2,5 +2,9 @@
   programs.direnv = {
     enable = true;
     nix-direnv.enable = true;
+
+    config.global = {
+      warn_timeout = "10s";
+    };
   };
 }

modules/applications/discord/home.nix

@@ -1,4 +1,95 @@
-{ lib, pkgs, ... }:
+_: {
-lib.mkIf pkgs.stdenv.hostPlatform.isLinux {
+  programs.vesktop = {
-  programs.vesktop.enable = true;
+    enable = true;
+
+    settings = {
+      discordBranch = "stable";
+
+      hardwareAcceleration = true;
+      hardwareVideoAcceleration = true;
+
+      tray = true;
+      minimizeToTray = true;
+
+      # Discord Rich Presence
+      arRPC = true;
+
+      openLinksWithElectron = false;
+
+      spellCheckLanguages = [
+        "ja-JP"
+        "en-US"
+      ];
+    };
+
+    vencord = {
+      useSystem = false;
+
+      settings = {
+        autoUpdate = true;
+        autoUpdateNotification = false;
+
+        useQuickCss = false;
+
+        cloud.settingsSync = false;
+
+        notifications = {
+          position = "bottom-right";
+          useNative = "not-focused";
+          timeout = 5000;
+          logLimit = 50;
+        };
+
+        plugins = {
+          # プライバシー・安全性
+          NoTrack.enabled = true;
+          ClearURLs.enabled = true;
+
+          # 設定・セッション
+          BetterSettings.enabled = true;
+          BetterSessions.enabled = true;
+
+          # 画像・添付ファイル
+          FixImagesQuality.enabled = true;
+          ImageZoom.enabled = true;
+          ViewIcons.enabled = true;
+          CopyFileContents.enabled = true;
+
+          # メッセージ操作
+          QuickReply.enabled = true;
+          SendTimestamps.enabled = true;
+          FullSearchContext.enabled = true;
+          MessageLinkEmbeds.enabled = true;
+          Unindent.enabled = true;
+          ValidReply.enabled = true;
+
+          # 通知・誤操作対策
+          ReadAllNotificationsButton.enabled = true;
+          NoReplyMention.enabled = true;
+          NotificationVolume.enabled = true;
+
+          # UI・パフォーマンス
+          NoTypingAnimation.enabled = true;
+          FavoriteEmojiFirst.enabled = true;
+          KeepCurrentChannel.enabled = true;
+
+          # サーバー・権限確認
+          PermissionsViewer.enabled = true;
+          MemberCount.enabled = true;
+
+          # ボイス・アクティビティ
+          CallTimer.enabled = true;
+          GameActivityToggle.enabled = true;
+
+          # Vesktop向け
+          WebKeybinds.enabled = true;
+          WebScreenShareFixes.enabled = true;
+
+          # Message history
+          MessageLogger.enabled = true;
+          ShowHiddenChannels.enabled = true;
+        };
+      };
+    };
+  };
 }

modules/applications/docker/home.nix

@@ -1,17 +0,0 @@
-{ pkgs, ... }:
-let
-  oxker = pkgs.oxker.overrideAttrs (oldAttrs: {
-    checkFlags =
-      (oldAttrs.checkFlags or [ ])
-      ++ pkgs.lib.optionals pkgs.stdenv.hostPlatform.isDarwin [
-        "--skip=ui::draw_blocks::help::tests::test_draw_blocks_help_custom_keymap_one_two_definition"
-        "--skip=ui::draw_blocks::help::tests::test_draw_blocks_help_custom_keymap_two_definition"
-      ];
-  });
-in
-{
-  home.packages = [
-    pkgs.docker-client
-    oxker
-  ];
-}

modules/applications/docker/home/common.nix

@@ -0,0 +1,6 @@
+{ pkgs, ... }:
+{
+  home.packages = [
+    pkgs.docker-client
+  ];
+}

modules/applications/docker/home/nixos.nix

@@ -0,0 +1,6 @@
+{ pkgs, ... }:
+{
+  home.packages = [
+    pkgs.oxker
+  ];
+}

modules/applications/drawio/home.nix

@@ -1,4 +1,4 @@
-{ lib, pkgs, ... }:
+{ pkgs, ... }:
-lib.mkIf pkgs.stdenv.hostPlatform.isLinux {
+{
   home.packages = [ pkgs.drawio ];
 }

modules/applications/easyeffects/home/nixos.nix

@@ -0,0 +1,4 @@
+{ pkgs, ... }:
+{
+  home.packages = [ pkgs.easyeffects ];
+}

modules/applications/fcitx5/config

@@ -1,69 +0,0 @@
-[Hotkey]
-# トリガーキーを押すたびに切り替える
-EnumerateWithTriggerKeys=False
-# 一時的に第1入力メソッドに切り替える
-AltTriggerKeys=
-# 切り替え時は第1入力メソッドをスキップする
-EnumerateSkipFirst=False
-# Time limit in milliseconds for triggering modifier key shortcuts
-ModifierOnlyKeyTimeout=250
-
-[Hotkey/TriggerKeys]
-1=Zenkaku_Hankaku
-
-[Hotkey/ActivateKeys]
-0=Henkan
-
-[Hotkey/DeactivateKeys]
-0=Muhenkan
-
-[Hotkey/PrevPage]
-0=Up
-
-[Hotkey/NextPage]
-0=Down
-
-[Hotkey/PrevCandidate]
-0=Shift+Tab
-
-[Hotkey/NextCandidate]
-0=Tab
-
-[Hotkey/TogglePreedit]
-0=Control+Alt+P
-
-[Behavior]
-# デフォルトで有効にする
-ActiveByDefault=False
-# フォーカス時に状態をリセット
-resetStateWhenFocusIn=No
-# 入力状態を共有する
-ShareInputState=No
-# アプリケーションにプリエディットを表示する
-PreeditEnabledByDefault=True
-# 入力メソッドを切り替える際に入力メソッドの情報を表示する
-ShowInputMethodInformation=True
-# フォーカスを変更する際に入力メソッドの情報を表示する
-showInputMethodInformationWhenFocusIn=False
-# 入力メソッドの情報をコンパクトに表示する
-CompactInputMethodInformation=True
-# 第1入力メソッドの情報を表示する
-ShowFirstInputMethodInformation=True
-# デフォルトのページサイズ
-DefaultPageSize=5
-# XKB オプションより優先する
-OverrideXkbOption=False
-# カスタム XKB オプション
-CustomXkbOption=
-# Force Enabled Addons
-EnabledAddons=
-# Force Disabled Addons
-DisabledAddons=
-# Preload input method to be used by default
-PreloadInputMethod=True
-# パスワード欄に入力メソッドを許可する
-AllowInputMethodForPassword=False
-# パスワード入力時にプリエディットテキストを表示する
-ShowPreeditForPassword=False
-# ユーザーデータを保存する間隔（分）
-AutoSavePeriod=30

modules/applications/fcitx5/home.nix

@@ -1,6 +0,0 @@
-{
-  home.file.".config/fcitx5/config" = {
-    recursive = true;
-    source = ./config;
-  };
-}

modules/applications/fcitx5/home/nixos.nix

@@ -0,0 +1,82 @@
+{ inputs, pkgs, ... }:
+{
+
+  services.hazkey = {
+    enable = true;
+    server.package =
+      inputs.nix-hazkey.packages.${pkgs.stdenv.hostPlatform.system}.hazkey-server.override
+        { enableVulkan = true; };
+  };
+
+  i18n.inputMethod = {
+    enable = true;
+    type = "fcitx5";
+
+    fcitx5 = {
+      waylandFrontend = true;
+
+      addons = with pkgs; [
+        fcitx5-gtk
+        kdePackages.fcitx5-qt
+        qt6Packages.fcitx5-configtool
+      ];
+
+      settings = {
+        inputMethod = {
+          GroupOrder."0" = "Default";
+
+          "Groups/0" = {
+            Name = "Default";
+            "Default Layout" = "jp";
+            DefaultIM = "hazkey";
+          };
+
+          "Groups/0/Items/0" = {
+            Name = "keyboard-jp";
+          };
+
+          "Groups/0/Items/1" = {
+            Name = "hazkey";
+          };
+        };
+
+        globalOptions = {
+          Hotkey = {
+            EnumerateWithTriggerKeys = false;
+            EnumerateSkipFirst = false;
+            ModifierOnlyKeyTimeout = 250;
+          };
+
+          "Hotkey/TriggerKeys"."1" = "Zenkaku_Hankaku";
+          "Hotkey/ActivateKeys"."0" = "Henkan";
+          "Hotkey/DeactivateKeys"."0" = "Muhenkan";
+          "Hotkey/PrevPage"."0" = "Up";
+          "Hotkey/NextPage"."0" = "Down";
+          "Hotkey/PrevCandidate"."0" = "Shift+Tab";
+          "Hotkey/NextCandidate"."0" = "Tab";
+          "Hotkey/TogglePreedit"."0" = "Control+Alt+P";
+
+          Behavior = {
+            ActiveByDefault = false;
+            resetStateWhenFocusIn = "No";
+            ShareInputState = "No";
+            PreeditEnabledByDefault = true;
+            ShowInputMethodInformation = true;
+            showInputMethodInformationWhenFocusIn = false;
+            CompactInputMethodInformation = true;
+            ShowFirstInputMethodInformation = true;
+            DefaultPageSize = 5;
+            OverrideXkbOption = false;
+            CustomXkbOption = "";
+            EnabledAddons = "";
+            DisabledAddons = "";
+            PreloadInputMethod = true;
+            AllowInputMethodForPassword = false;
+            ShowPreeditForPassword = false;
+            AutoSavePeriod = 30;
+          };
+        };
+      };
+    };
+  };
+}

modules/applications/fcitx5/meta.nix

@@ -0,0 +1,6 @@
+{ inputs, ... }:
+{
+  description = "Fcitx 5 input method framework with Hazkey Japanese input";
+
+  imports.home = [ inputs.nix-hazkey.homeModules.hazkey ];
+}

modules/applications/fcitx5/nixos.nix

@@ -1,34 +0,0 @@
-{ pkgs, ... }:
-{
-  i18n.inputMethod = {
-    enable = true;
-    type = "fcitx5";
-
-    fcitx5 = {
-      waylandFrontend = true;
-      addons = with pkgs; [
-        fcitx5-mozc-ut
-        fcitx5-gtk
-        kdePackages.fcitx5-qt
-        qt6Packages.fcitx5-configtool
-      ];
-
-      settings.inputMethod = {
-        GroupOrder."0" = "Default";
-        "Groups/0" = {
-          Name = "Default";
-          "Default Layout" = "jp";
-          DefaultIM = "mozc";
-        };
-        "Groups/0/Items/0" = {
-          Name = "keyboard-jp";
-          Layout = "";
-        };
-        "Groups/0/Items/1" = {
-          Name = "mozc";
-          Layout = "";
-        };
-      };
-    };
-  };
-}

modules/applications/finder/darwin.nix

@@ -0,0 +1,15 @@
+{
+  system.defaults.finder = {
+    AppleShowAllExtensions = true;
+    AppleShowAllFiles = false;
+    ShowPathbar = true;
+    ShowStatusBar = true;
+    _FXShowPosixPathInTitle = true;
+    _FXSortFoldersFirst = true;
+    FXDefaultSearchScope = "SCcf";
+    FXPreferredViewStyle = "Nlsv";
+    NewWindowTarget = "Home";
+    FXEnableExtensionChangeWarning = true;
+    FXRemoveOldTrashItems = true;
+  };
+}

modules/applications/gamemode/nixos.nix

@@ -0,0 +1,17 @@
+{
+  programs.gamemode = {
+    enable = true;
+    enableRenice = true;
+
+    settings = {
+      general = {
+        softrealtime = "auto";
+        renice = 10;
+      };
+      custom = {
+        start = "notify-send -a 'Gamemode' 'Optimizations activated'";
+        end = "notify-send -a 'Gamemode' 'Optimizations deactivated'";
+      };
+    };
+  };
+}

modules/applications/gamescope/nixos.nix

@@ -0,0 +1,6 @@
+{
+  programs.gamescope = {
+    enable = true;
+    capSysNice = true;
+  };
+}

modules/applications/ghostty/home/common.nix

@@ -1,25 +1,12 @@
-{
+_: {
-  inputs,
-  pkgs,
-  ...
-}:
-let
-  package =
-    if pkgs.stdenv.hostPlatform.isLinux then
-      inputs.ghostty.packages.${pkgs.stdenv.hostPlatform.system}.ghostty-releasefast
-    else
-      null;
-in
-{
   programs.ghostty = {
     enable = true;
-    inherit package;
-    systemd.enable = pkgs.stdenv.hostPlatform.isLinux;
 
     settings = {
       theme = "dracula";
       background-blur-radius = 20;
       background-opacity = 0.9;
+      background-opacity-cells = true;
       font-family = "BlexMono Nerd Font Mono";
       mouse-hide-while-typing = true;
       window-decoration = "auto";
@@ -30,11 +17,14 @@ in
         "ctrl+shift+t=new_tab"
         "ctrl+alt+left_bracket=previous_tab"
         "ctrl+alt+right_bracket=next_tab"
-        "ctrl+alt+q=close_window"
+        "alt+q=close_window"
+        "global:alt+space=toggle_quick_terminal"
+        "global:alt+t=new_window"
         "ctrl+shift+semicolon=increase_font_size:1"
         "ctrl+shift+minus=decrease_font_size:1"
       ];
 
+      quick-terminal-screen = "mouse";
       quick-terminal-position = "top";
       quick-terminal-size = "98%,100%";
       quick-terminal-autohide = false;

modules/applications/ghostty/home/darwin.nix

@@ -0,0 +1,17 @@
+_: {
+  # Global Ghostty keybindings are handled by the running app. Start it hidden
+  # at login so Option+T and Option+Space work before opening a terminal.
+  launchd.agents.ghostty-global-keybindings = {
+    enable = true;
+    config = {
+      ProgramArguments = [
+        "/usr/bin/open"
+        "-gja"
+        "Ghostty"
+      ];
+      RunAtLoad = true;
+    };
+  };
+
+  programs.ghostty.package = null;
+}

modules/applications/ghostty/home/nixos.nix

@@ -0,0 +1,6 @@
+{ inputs, system, ... }: {
+  programs.ghostty = {
+    systemd.enable = true;
+    package = inputs.ghostty.packages.${system}.default;
+  };
+}

modules/applications/gnome-disk-utility/home/nixos.nix

@@ -0,0 +1,4 @@
+{ pkgs, ... }:
+{
+  home.packages = [ pkgs.gnome-disk-utility ];
+}

modules/applications/gnome-text-editor/home/nixos.nix

@@ -0,0 +1,24 @@
+{ pkgs, ... }:
+{
+  home.packages = [ pkgs.gnome-text-editor ];
+
+  dconf.settings."org/gnome/TextEditor" = {
+    style-variant = "follow";
+    wrap-text = true;
+    spellcheck = true;
+    restore-session = true;
+    show-line-numbers = false;
+    show-right-margin = false;
+    show-map = false;
+    highlight-current-line = false;
+    auto-indent = false;
+    discover-settings = false;
+    enable-snippets = false;
+    keybindings = "default";
+  };
+
+  xdg.mimeApps = {
+    enable = true;
+    defaultApplicationPackages = [ pkgs.gnome-text-editor ];
+  };
+}

modules/applications/gnome/home.nix

@@ -1,56 +0,0 @@
-{ pkgs, lib, ... }:
-lib.mkIf pkgs.stdenv.hostPlatform.isLinux {
-  dconf.settings = {
-    "org/gnome/desktop/sound" = {
-      event-sounds = false;
-      input-feedback-sounds = false;
-    };
-    "org/gnome/desktop/wm/keybindings" = {
-      close = [ "<Super>q" ];
-      show-desktop = [ ];
-    };
-    "org/gnome/settings-daemon/plugins/media-keys" = {
-      home = [ ];
-      screensaver = [ "<Super>l" ];
-      custom-keybindings = [
-        "/org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom0/"
-        "/org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom1/"
-        "/org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom2/"
-        "/org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom3/"
-        "/org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom4/"
-      ];
-    };
-    "org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom0" = {
-      name = "Open Terminal";
-      command = "ghostty";
-      binding = "<Super>t";
-    };
-    "org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom1" = {
-      name = "Run Application";
-      command = "vicinae toggle";
-      binding = "<Super>d";
-    };
-    "org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom2" = {
-      name = "Open File Manager";
-      command = "nautilus --new-window";
-      binding = "<Super>e";
-    };
-    "org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom3" = {
-      name = "Clipboard History";
-      command = "vicinae vicinae://extensions/vicinae/clipboard/history";
-      binding = "<Super>v";
-    };
-    "org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom4" = {
-      name = "Log Out";
-      command = "gnome-session-quit --logout --no-prompt";
-      binding = "<Super><Shift>e";
-    };
-    "org/gnome/shell".favorite-apps = [
-      "google-chrome.desktop"
-      "code.desktop"
-      "com.mitchellh.ghostty.desktop"
-      "slack.desktop"
-      "vesktop.desktop"
-    ];
-  };
-}

modules/applications/gnome/nixos.nix

@@ -1,10 +0,0 @@
-{ pkgs, lib, ... }:
-{
-  services.desktopManager.gnome.enable = true;
-  services.displayManager.gdm.enable = lib.mkForce false;
-
-  environment.systemPackages = [
-    pkgs.gnome-tweaks
-    pkgs.gnome-extension-manager
-  ];
-}

modules/applications/grok/home.nix

@@ -1,9 +1,6 @@
 { inputs, pkgs, ... }:
-let
-  grok = inputs.llm-agents.packages.${pkgs.stdenv.hostPlatform.system}.grok.overrideAttrs (_: {
-    versionCheckProgram = "${placeholder "out"}/libexec/grok/grok-launcher";
-  });
-in
 {
-  home.packages = [ grok ];
+  home.packages = [
+    inputs.llm-agents.packages.${pkgs.stdenv.hostPlatform.system}.grok
+  ];
 }

modules/applications/gtk/home.nix

@@ -15,4 +15,8 @@
       name = "Papirus-Dark";
     };
   };
+
+  dconf.settings."org/gnome/desktop/wm/preferences" = {
+    button-layout = ":minimize,maximize,close";
+  };
 }

modules/applications/gtk/nixos.nix

@@ -2,4 +2,5 @@
   programs.dconf.enable = true;
   programs.seahorse.enable = true;
   services.gnome.gnome-keyring.enable = true;
+  security.pam.services.ly.enableGnomeKeyring = true;
 }

modules/applications/handy/darwin.nix

@@ -0,0 +1,8 @@
+{
+  homebrew.casks = [ "handy" ];
+
+  launchd.agents.handy = {
+    command = "/usr/bin/open -gja Handy --args --start-hidden";
+    serviceConfig.RunAtLoad = true;
+  };
+}

modules/applications/handy/home/nixos.nix

@@ -0,0 +1,74 @@
+{
+  config,
+  inputs,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  handy = inputs.handy.packages.${pkgs.stdenv.hostPlatform.system}.handy;
+  settingsFile = "${config.xdg.configHome}/com.pais.handy/settings_store.json";
+in
+{
+  home.packages = [
+    handy
+    pkgs.wtype
+  ];
+
+  # Handy has no disabled-shortcut setting. Empty bindings are rejected before
+  # registration, leaving niri and labwc as the sole owners of Ctrl+Space.
+  home.activation.disableHandyGlobalShortcuts = {
+    after = [ "writeBoundary" ];
+    before = [ ];
+    data = ''
+      settingsFile=${lib.escapeShellArg settingsFile}
+      mkdir -p "$(dirname "$settingsFile")"
+
+      if [ -f "$settingsFile" ]; then
+        ${lib.getExe pkgs.jq} \
+          '.settings.bindings.transcribe.current_binding = ""
+          | .settings.bindings.transcribe_with_post_process.current_binding = ""' \
+          "$settingsFile" > "$settingsFile.tmp"
+      else
+        ${lib.getExe pkgs.jq} -n '
+          {
+            settings: {
+              bindings: {
+                transcribe: {
+                  id: "transcribe",
+                  name: "Transcribe",
+                  description: "Converts your speech into text.",
+                  default_binding: "ctrl+space",
+                  current_binding: ""
+                },
+                transcribe_with_post_process: {
+                  id: "transcribe_with_post_process",
+                  name: "Transcribe with Post-Processing",
+                  description: "Converts your speech into text and applies AI post-processing.",
+                  default_binding: "ctrl+shift+space",
+                  current_binding: ""
+                }
+              }
+            }
+          }
+        ' > "$settingsFile.tmp"
+      fi
+
+      mv "$settingsFile.tmp" "$settingsFile"
+    '';
+  };
+
+  systemd.user.services.handy = {
+    Unit = {
+      Description = "Handy speech-to-text";
+      After = [ "graphical-session.target" ];
+      PartOf = [ "graphical-session.target" ];
+    };
+    Service = {
+      ExecStart = "${lib.getExe handy} --start-hidden";
+      Restart = "on-failure";
+      RestartSec = 5;
+    };
+    Install.WantedBy = [ "graphical-session.target" ];
+  };
+}

modules/applications/handy/meta.nix

@@ -0,0 +1,3 @@
+{
+  description = "Handy offline speech-to-text";
+}

modules/applications/labwc/home.nix

@@ -0,0 +1,228 @@
+{ lib, pkgs, ... }:
+let
+  systemctl = lib.getExe' pkgs.systemd "systemctl";
+
+  keybind = key: actionAttrs: {
+    "@key" = key;
+    action = actionAttrs;
+  };
+
+  action =
+    key: name:
+    keybind key {
+      "@name" = name;
+    };
+
+  execute =
+    key: command:
+    keybind key {
+      "@name" = "Execute";
+      "@command" = command;
+    };
+
+  snapToEdge =
+    key: direction:
+    keybind key {
+      "@name" = "SnapToEdge";
+      "@direction" = direction;
+      "@combine" = "yes";
+    };
+
+  confirmAction = key: message: name: {
+    "@key" = key;
+    action = {
+      "@name" = "If";
+      prompt."@message" = message;
+      "then".action."@name" = name;
+    };
+  };
+
+  menuExecute = label: command: {
+    inherit label;
+    action = {
+      name = "Execute";
+      inherit command;
+    };
+  };
+
+  showMenu = button: menu: {
+    "@button" = button;
+    "@action" = "Press";
+    action = {
+      "@name" = "ShowMenu";
+      "@menu" = menu;
+    };
+  };
+
+  menuAction = label: name: {
+    inherit label;
+    action.name = name;
+  };
+in
+{
+  wayland.windowManager.labwc = {
+    enable = true;
+    # NixOS owns the package so Home Manager only generates the user config.
+    package = null;
+
+    systemd = {
+      enable = true;
+
+      variables = [
+        "DISPLAY"
+        "WAYLAND_DISPLAY"
+        "XDG_CURRENT_DESKTOP"
+        "XDG_SESSION_TYPE"
+      ];
+    };
+
+    menu = [
+      {
+        menuId = "root-menu";
+        items = [
+          (menuExecute "ターミナル" "ghostty")
+          (menuExecute "Vicinae" "vicinae toggle")
+          (menuExecute "ファイル" "nautilus --new-window")
+
+          { separator = true; }
+
+          (menuAction "Reconfigure" "Reconfigure")
+          (menuAction "Exit" "Exit")
+        ];
+      }
+    ];
+
+    rc = {
+
+      keyboard = {
+        default = true;
+        numlock = "on";
+        keybind = [
+          # labwc window management
+          (action "W-q" "Close")
+          (action "W-f" "ToggleMaximize")
+          (action "W-c" "Iconify")
+          (execute "W-Tab" "window-overview")
+          (execute "W-S-Tab" "window-overview --reverse")
+          (action "W-Up" "Lower")
+          (action "W-Down" "Raise")
+          (action "W-Left" "NextWindow")
+          (action "W-Right" "PreviousWindow")
+          (snapToEdge "W-C-Left" "left")
+          (snapToEdge "W-C-Right" "right")
+          (snapToEdge "W-C-Up" "up")
+          (snapToEdge "W-C-Down" "down")
+          (confirmAction "W-S-e" "Exit labwc?" "Exit")
+          (execute "Print" "screenshot region")
+          (execute "C-Print" "screenshot output")
+          (execute "A-Print" "screenshot all")
+
+          # spawn applications (sync with niri modules/applications/niri/home.nix)
+          (execute "W-t" "ghostty")
+          (execute "W-d" "vicinae toggle")
+          (execute "W-s" "noctalia msg panel-toggle launcher")
+          (execute "W-e" "nautilus --new-window")
+          (execute "W-l" "loginctl lock-session")
+          (execute "W-v" "vicinae vicinae://launch/clipboard/history?toggle=true")
+          (execute "W-j" "nani-translate-primary")
+          (execute "W-S-j" "nani-translate-ocr")
+          (execute "W-C-j" "${lib.getExe' pkgs.xdg-utils "xdg-open"} naniapp://translate")
+          (execute "W-space" "ghostty +toggle-quick-terminal")
+          (execute "W-p" "wdisplays")
+          (execute "W-z" "wl-find-cursor -c 0xCCFF453A -s 160 -d 1200")
+          (execute "C-space" "handy --toggle-transcription")
+
+          # Function keys (sync with niri modules/applications/niri/home.nix)
+          (execute "XF86AudioRaiseVolume" "noctalia msg volume-up")
+          (execute "XF86AudioLowerVolume" "noctalia msg volume-down")
+          (execute "XF86AudioMute" "noctalia msg volume-mute")
+          (execute "XF86AudioMicMute" "noctalia msg mic-mute")
+          (execute "XF86MonBrightnessUp" "noctalia msg brightness-up")
+          (execute "XF86MonBrightnessDown" "noctalia msg brightness-down")
+          (execute "XF86Favorites" "noctalia msg caffeine-toggle")
+          (execute "XF86AudioPlay" "playerctl play-pause")
+          (execute "XF86AudioPause" "playerctl play-pause")
+          (execute "XF86AudioStop" "playerctl stop")
+          (execute "XF86AudioPrev" "playerctl previous")
+          (execute "XF86AudioNext" "playerctl next")
+          (execute "XF86Display" "wdisplays")
+        ];
+      };
+
+      core = {
+        decoration = "client";
+        gap = 10;
+        autoEnableOutputs = "yes";
+        reuseOutputMode = "yes";
+      };
+
+      theme = {
+        name = "Dracula";
+        cornerRadius = 8;
+        dropShadows = "yes";
+        dropShadowsOnTiled = "yes";
+      };
+
+      windowSwitcher = {
+        "@preview" = "yes";
+        "@outlines" = "yes";
+        osd = {
+          "@style" = "thumbnail";
+        };
+      };
+
+      focus = {
+        followMouse = "yes";
+        followMouseRequiresMovement = "yes";
+        raiseOnFocus = "no";
+      };
+
+      desktops = {
+        "@number" = 1;
+        "@popupTime" = 500;
+        "@prefix" = "Workspace";
+      };
+
+      mouse = {
+        default = true;
+
+        context = {
+          "@name" = "Desktop";
+
+          mousebind = [
+            (showMenu "Right" "root-menu")
+            (showMenu "Middle" "client-list-combined-menu")
+          ];
+        };
+      };
+
+      libinput.device = [
+        {
+          "@category" = "touchpad";
+          naturalScroll = "yes";
+          tap = "yes";
+          tapAndDrag = "yes";
+          dragLock = "yes";
+          clickMethod = "clickfinger";
+          scrollMethod = "twoFinger";
+          scrollFactor = "4.0";
+          disableWhileTyping = "yes";
+        }
+        {
+          "@category" = "non-touch";
+          pointerSpeed = "-0.1";
+          accelProfile = "flat";
+        }
+      ];
+    };
+
+    environment = [
+      "XKB_DEFAULT_LAYOUT=jp"
+      "XKB_DEFAULT_OPTIONS=ctrl:nocaps"
+    ];
+  };
+
+  xdg.configFile."labwc/shutdown".text = lib.mkAfter ''
+    ${systemctl} --user stop graphical-session.target
+  '';
+}

modules/applications/labwc/meta.nix

@@ -0,0 +1,9 @@
+{
+  description = "labwc Wayland stacking compositor";
+
+  includes = [
+    "systems.wayland"
+    "applications.screenshot"
+    "applications.wl-find-cursor"
+  ];
+}

modules/applications/labwc/nixos.nix

@@ -0,0 +1,62 @@
+{
+  inputs,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  unstable = inputs.nixpkgs-unstable.legacyPackages.${pkgs.stdenv.hostPlatform.system};
+  labwc = unstable.labwc.overrideAttrs (oldAttrs: {
+    patches = (oldAttrs.patches or [ ]) ++ [
+      ./patches/remove-ext-workspace-output-on-destroy.patch
+    ];
+  });
+in
+{
+  programs.labwc = {
+    enable = true;
+    package = labwc;
+  };
+
+  xdg.portal.config.labwc.default = [
+    "wlr"
+    "gtk"
+  ];
+
+  # xdg-desktop-portal-wlr implements screencasting for wlroots compositors.
+  # Keep it with Labwc: Niri uses xdg-desktop-portal-gnome instead.
+  xdg.portal.wlr = {
+    enable = true;
+    settings.screencast = {
+      chooser_type = "dmenu";
+      chooser_cmd = "${pkgs.fuzzel}/bin/fuzzel --dmenu";
+    };
+  };
+
+  # NixOS decides whether a graphical session manages graphical-session.target
+  # itself by checking XDG_CURRENT_DESKTOP against a hard-coded list. Labwc is
+  # currently absent from that list, so NixOS starts
+  # nixos-fake-graphical-session.target before Labwc is ready.
+  #
+  # This configuration uses Home Manager's Labwc systemd integration, which
+  # imports the Wayland environment and starts labwc-session.target correctly.
+  # Mark the Labwc session as systemd-aware before the display-manager wrapper
+  # performs its hard-coded check. Otherwise services such as Fcitx5 can start
+  # before WAYLAND_DISPLAY is available.
+  #
+  # Despite the services.xserver namespace, this session wrapper is also used
+  # for Wayland sessions by display managers such as Ly.
+  services.xserver.displayManager.sessionCommands = lib.mkAfter ''
+    case ":''${XDG_CURRENT_DESKTOP:-}:" in
+      *:labwc:*)
+        case ":$XDG_CURRENT_DESKTOP:" in
+          *:X-NIXOS-SYSTEMD-AWARE:*)
+            ;;
+          *)
+            export XDG_CURRENT_DESKTOP="$XDG_CURRENT_DESKTOP:X-NIXOS-SYSTEMD-AWARE"
+            ;;
+        esac
+        ;;
+    esac
+  '';
+}

modules/applications/labwc/patches/remove-ext-workspace-output-on-destroy.patch

@@ -0,0 +1,103 @@
+From: Codex <[email protected]>
+Subject: [PATCH] output: detach destroyed outputs from protocol handles
+
+The DRM backend destroys and recreates outputs when a session is paused and
+resumed. Remove the output from the ext-workspace group and the foreign
+toplevel handles before wlroots finishes it. Both protocols attach bind
+listeners to the output; leaving either listener behind makes
+wlr_output_finish() abort.
+
+---
+ src/foreign-toplevel/foreign.c     | 14 ++++++++++++++
+ src/output.c                        |  6 ++++++
+ include/foreign-toplevel/foreign.h  |  2 ++
+ 3 files changed, 22 insertions(+)
+
+diff --git a/src/output.c b/src/output.c
+index 2eab8ec..6f6e7ef 100644
+--- a/src/output.c
++++ b/src/output.c
+@@ -27,8 +27,9 @@
+ #include "common/macros.h"
+ #include "common/mem.h"
+ #include "common/scene-helpers.h"
+ #include "common/string-helpers.h"
+ #include "config/rcxml.h"
++#include "foreign-toplevel/foreign.h"
+ #include "labwc.h"
+ #include "layers.h"
+ #include "node.h"
+@@ -276,7 +277,15 @@ handle_output_destroy(struct wl_listener *listener, void *data)
+ 	struct output *output = wl_container_of(listener, output, destroy);
+ 	struct seat *seat = &server.seat;
+ 	regions_evacuate_output(output);
+ 	regions_destroy(seat, &output->regions);
++	wlr_ext_workspace_group_handle_v1_output_leave(
++		server.workspaces.ext_group, output->wlr_output);
++
++	struct view *view;
++	wl_list_for_each(view, &server.views, link) {
++		foreign_toplevel_remove_output(view->foreign_toplevel, output->wlr_output);
++	}
++
+ 	if (seat->overlay.active.output == output) {
+ 		overlay_finish(seat);
+ 	}
+@@ -297,7 +305,6 @@ handle_output_destroy(struct wl_listener *listener, void *data)
+ 		output->workspace_osd = NULL;
+ 	}
+ 
+-	struct view *view;
+ 	wl_list_for_each(view, &server.views, link) {
+ 		if (view->output == output) {
+ 			view_on_output_destroy(view);
+diff --git a/include/foreign-toplevel/foreign.h b/include/foreign-toplevel/foreign.h
+index 69a340a..d8ec9b4 100644
+--- a/include/foreign-toplevel/foreign.h
++++ b/include/foreign-toplevel/foreign.h
+@@ -3,11 +3,14 @@
+ #define LABWC_FOREIGN_TOPLEVEL_H
+ 
+ struct view;
++struct wlr_output;
+ struct foreign_toplevel;
+ 
+ struct foreign_toplevel *foreign_toplevel_create(struct view *view);
+ void foreign_toplevel_set_parent(struct foreign_toplevel *toplevel,
+ 	struct foreign_toplevel *parent);
++void foreign_toplevel_remove_output(struct foreign_toplevel *toplevel,
++	struct wlr_output *output);
+ void foreign_toplevel_destroy(struct foreign_toplevel *toplevel);
+ 
+ #endif /* LABWC_FOREIGN_TOPLEVEL_H */
+diff --git a/src/foreign-toplevel/foreign.c b/src/foreign-toplevel/foreign.c
+index 7f1ec8d..0f628a3 100644
+--- a/src/foreign-toplevel/foreign.c
++++ b/src/foreign-toplevel/foreign.c
+@@ -1,4 +1,5 @@
+ // SPDX-License-Identifier: GPL-2.0-only
+ #include "foreign-toplevel/foreign.h"
++#include <wlr/types/wlr_foreign_toplevel_management_v1.h>
+ #include <assert.h>
+ #include "common/mem.h"
+@@ -34,6 +34,18 @@ foreign_toplevel_set_parent(struct foreign_toplevel *toplevel, struct foreign_to
+ 		parent ? &parent->wlr_toplevel : NULL);
+ }
+ 
++void
++foreign_toplevel_remove_output(struct foreign_toplevel *toplevel,
++	struct wlr_output *output)
++{
++	if (!toplevel || !toplevel->wlr_toplevel.handle) {
++		return;
++	}
++
++	wlr_foreign_toplevel_handle_v1_output_leave(
++		toplevel->wlr_toplevel.handle, output);
++}
++
+ void
+ foreign_toplevel_destroy(struct foreign_toplevel *toplevel)
+ {
+-- 
+2.51.0

modules/applications/linux-wallpaperengine/home/controller.sh

@@ -0,0 +1,167 @@
+# shellcheck shell=bash
+
+set -o errexit -o nounset -o pipefail
+
+playlist_file="$1"
+default_id="$2"
+configuration_id="$3"
+shift 3
+
+state_dir="${XDG_RUNTIME_DIR:?}/linux-wallpaperengine"
+state_file="$state_dir/current"
+
+usage() {
+  printf '%s\n' \
+    'Usage: wallpaperengine-wallpaper COMMAND [ID]' \
+    '' \
+    'Commands:' \
+    '  select ID Select a declaratively configured ID for this session' \
+    '  next      Select the next configured ID' \
+    '  previous  Select the previous configured ID' \
+    '  list      List configured IDs and mark the selected one' \
+    '  current   Print the selected ID' \
+    '  restart   Restart the selected wallpaper' \
+    '  stop      Stop Wallpaper Engine for this session'
+}
+
+load_playlist() {
+  mapfile -t wallpaper_ids < <(awk '/^[0-9]+$/ && !seen[$0]++' "$playlist_file")
+  if [ "${#wallpaper_ids[@]}" -eq 0 ]; then
+    echo "wallpaperengine-wallpaper: no wallpaper IDs are configured in settings.nix" >&2
+    exit 1
+  fi
+}
+
+contains_id() {
+  local candidate="$1"
+  local id
+
+  for id in "${wallpaper_ids[@]}"; do
+    [ "$id" = "$candidate" ] && return 0
+  done
+  return 1
+}
+
+current_id() {
+  local saved_configuration=""
+  local saved_id=""
+  local -a saved_state=()
+
+  if [ -s "$state_file" ]; then
+    mapfile -t saved_state <"$state_file"
+    saved_configuration="${saved_state[0]:-}"
+    saved_id="${saved_state[1]:-}"
+  fi
+
+  if [ "$saved_configuration" = "$configuration_id" ] && contains_id "$saved_id"; then
+    printf '%s\n' "$saved_id"
+  else
+    printf '%s\n' "$default_id"
+  fi
+}
+
+select_id() {
+  local id="$1"
+
+  if ! contains_id "$id"; then
+    echo "wallpaperengine-wallpaper: ID is not declared in settings.nix: $id" >&2
+    exit 2
+  fi
+
+  mkdir -p "$state_dir"
+  printf '%s\n%s\n' "$configuration_id" "$id" >"$state_file"
+  systemctl --user restart linux-wallpaperengine.service
+}
+
+cycle() {
+  local step="$1"
+  local current
+  local index=0
+  local next_index
+
+  current=$(current_id)
+  for i in "${!wallpaper_ids[@]}"; do
+    if [ "${wallpaper_ids[$i]}" = "$current" ]; then
+      index="$i"
+      break
+    fi
+  done
+
+  next_index=$(((index + step + ${#wallpaper_ids[@]}) % ${#wallpaper_ids[@]}))
+  select_id "${wallpaper_ids[$next_index]}"
+}
+
+load_playlist
+
+command="${1:-}"
+if [ -z "$command" ]; then
+  usage
+  exit 2
+fi
+shift
+
+case "$command" in
+select)
+  [ "$#" -eq 1 ] || {
+    usage >&2
+    exit 2
+  }
+  select_id "$1"
+  ;;
+next)
+  [ "$#" -eq 0 ] || {
+    usage >&2
+    exit 2
+  }
+  cycle 1
+  ;;
+previous)
+  [ "$#" -eq 0 ] || {
+    usage >&2
+    exit 2
+  }
+  cycle -1
+  ;;
+list)
+  [ "$#" -eq 0 ] || {
+    usage >&2
+    exit 2
+  }
+  current=$(current_id)
+  for id in "${wallpaper_ids[@]}"; do
+    if [ "$id" = "$current" ]; then
+      printf '* %s\n' "$id"
+    else
+      printf '  %s\n' "$id"
+    fi
+  done
+  ;;
+current)
+  [ "$#" -eq 0 ] || {
+    usage >&2
+    exit 2
+  }
+  current_id
+  ;;
+restart)
+  [ "$#" -eq 0 ] || {
+    usage >&2
+    exit 2
+  }
+  systemctl --user restart linux-wallpaperengine.service
+  ;;
+stop)
+  [ "$#" -eq 0 ] || {
+    usage >&2
+    exit 2
+  }
+  systemctl --user stop linux-wallpaperengine.service
+  ;;
+help | -h | --help)
+  usage
+  ;;
+*)
+  usage >&2
+  exit 2
+  ;;
+esac

modules/applications/linux-wallpaperengine/home/launcher.sh

@@ -0,0 +1,57 @@
+# shellcheck shell=bash
+
+set -o errexit -o nounset -o pipefail
+
+playlist_file="$1"
+default_id="$2"
+configuration_id="$3"
+assets_dir="$4"
+workshop_dir="$5"
+scaling="$6"
+shift 6
+
+state_file="${XDG_RUNTIME_DIR:?}/linux-wallpaperengine/current"
+wallpaper_id="$default_id"
+saved_configuration=""
+saved_id=""
+saved_state=()
+outputs=()
+
+if [ -s "$state_file" ]; then
+  mapfile -t saved_state <"$state_file"
+  saved_configuration="${saved_state[0]:-}"
+  saved_id="${saved_state[1]:-}"
+
+  if [ "$saved_configuration" = "$configuration_id" ] &&
+    awk -v id="$saved_id" '$0 == id { found = 1 } END { exit !found }' "$playlist_file"; then
+    wallpaper_id="$saved_id"
+  fi
+fi
+
+wallpaper_path="$workshop_dir/$wallpaper_id"
+if [ ! -d "$wallpaper_path" ]; then
+  echo "linux-wallpaperengine: missing declared wallpaper: $wallpaper_path" >&2
+  exit 1
+fi
+
+if [ ! -d "$assets_dir" ]; then
+  echo "linux-wallpaperengine: missing Wallpaper Engine assets: $assets_dir" >&2
+  exit 1
+fi
+
+mapfile -t outputs < <(wlr-randr --json | jq -r '.[] | select(.enabled == true) | .name')
+if [ "${#outputs[@]}" -eq 0 ]; then
+  echo "linux-wallpaperengine: no enabled Wayland outputs were detected" >&2
+  exit 1
+fi
+
+engine_args=("$@" --assets-dir "$assets_dir")
+for output in "${outputs[@]}"; do
+  engine_args+=(
+    --screen-root "$output"
+    --bg "$wallpaper_path"
+    --scaling "$scaling"
+  )
+done
+
+exec linux-wallpaperengine "${engine_args[@]}"

modules/applications/linux-wallpaperengine/home/nixos.nix

@@ -0,0 +1,229 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  settings = import ../settings.nix;
+  inherit (settings)
+    assetsDirectory
+    fps
+    mute
+    scaling
+    selectedWallpaperId
+    switchIntervalSeconds
+    wallpaperIds
+    workshopDirectory
+    ;
+
+  resolveHomePath =
+    path:
+    if lib.hasPrefix "~/" path then
+      "${config.home.homeDirectory}/${lib.removePrefix "~/" path}"
+    else if lib.hasPrefix "/" path then
+      path
+    else
+      "${config.home.homeDirectory}/${path}";
+
+  hasWallpapers = wallpaperIds != [ ];
+  defaultWallpaperId =
+    if selectedWallpaperId != null then
+      selectedWallpaperId
+    else if hasWallpapers then
+      lib.head wallpaperIds
+    else
+      "";
+  configurationId = builtins.hashString "sha256" (builtins.toJSON settings);
+  resolvedAssetsDirectory = resolveHomePath assetsDirectory;
+  resolvedWorkshopDirectory = resolveHomePath workshopDirectory;
+  playlist = pkgs.writeText "linux-wallpaperengine-playlist" (
+    lib.concatMapStringsSep "\n" (id: id) wallpaperIds + "\n"
+  );
+  engineArguments = lib.optional mute "--silent" ++ [
+    "--fps"
+    (toString fps)
+  ];
+
+  controller = pkgs.writeShellApplication {
+    name = "wallpaperengine-wallpaper";
+    runtimeInputs = [
+      pkgs.coreutils
+      pkgs.gawk
+      pkgs.systemd
+    ];
+    text = ''
+      exec ${lib.getExe pkgs.bash} ${./controller.sh} \
+        ${lib.escapeShellArg playlist} \
+        ${lib.escapeShellArg defaultWallpaperId} \
+        ${lib.escapeShellArg configurationId} \
+        "$@"
+    '';
+  };
+
+  mkVicinaeScript =
+    {
+      name,
+      title,
+      description,
+      command,
+      mode ? "compact",
+      message ? null,
+    }:
+    {
+      name = "vicinae/scripts/wallpaper-engine/${name}";
+      value = {
+        executable = true;
+        text = ''
+          #!${lib.getExe pkgs.bash}
+          # @vicinae.schemaVersion 1
+          # @vicinae.title ${title}
+          # @vicinae.description ${description}
+          # @vicinae.mode ${mode}
+          # @vicinae.icon 🖼️
+
+          ${lib.getExe controller} ${lib.escapeShellArg command}
+          ${lib.optionalString (message != null) "printf '%s\\n' ${lib.escapeShellArg message}"}
+        '';
+      };
+    };
+
+  launcher = pkgs.writeShellApplication {
+    name = "linux-wallpaperengine-launcher";
+    runtimeInputs = [
+      pkgs.coreutils
+      pkgs.gawk
+      pkgs.jq
+      pkgs.linux-wallpaperengine
+      pkgs.wlr-randr
+    ];
+    text = ''
+      exec ${lib.getExe pkgs.bash} ${./launcher.sh} \
+        ${lib.escapeShellArg playlist} \
+        ${lib.escapeShellArg defaultWallpaperId} \
+        ${lib.escapeShellArg configurationId} \
+        ${lib.escapeShellArg resolvedAssetsDirectory} \
+        ${lib.escapeShellArg resolvedWorkshopDirectory} \
+        ${lib.escapeShellArg scaling} \
+        ${lib.escapeShellArgs engineArguments}
+    '';
+  };
+in
+assert lib.assertMsg (lib.all (
+  id: builtins.isString id && builtins.match "[0-9]+" id != null
+) wallpaperIds) "linux-wallpaperengine: wallpaperIds must contain only numeric strings";
+assert lib.assertMsg (
+  lib.unique wallpaperIds == wallpaperIds
+) "linux-wallpaperengine: wallpaperIds must not contain duplicates";
+assert lib.assertMsg (
+  selectedWallpaperId == null || builtins.elem selectedWallpaperId wallpaperIds
+) "linux-wallpaperengine: selectedWallpaperId must be null or a member of wallpaperIds";
+assert lib.assertMsg (
+  switchIntervalSeconds == null || (builtins.isInt switchIntervalSeconds && switchIntervalSeconds > 0)
+) "linux-wallpaperengine: switchIntervalSeconds must be null or a positive integer";
+assert lib.assertMsg (
+  builtins.isInt fps && fps > 0
+) "linux-wallpaperengine: fps must be a positive integer";
+assert lib.assertMsg (
+  builtins.isString assetsDirectory && assetsDirectory != ""
+) "linux-wallpaperengine: assetsDirectory must be a non-empty string";
+assert lib.assertMsg (
+  builtins.isString workshopDirectory && workshopDirectory != ""
+) "linux-wallpaperengine: workshopDirectory must be a non-empty string";
+assert lib.assertMsg (builtins.elem scaling [
+  "default"
+  "fill"
+  "fit"
+  "stretch"
+]) "linux-wallpaperengine: scaling must be default, fill, fit, or stretch";
+{
+  home.packages = [
+    controller
+    pkgs.linux-wallpaperengine
+  ];
+
+  xdg.dataFile = builtins.listToAttrs [
+    (mkVicinaeScript {
+      name = "reload";
+      title = "Reload Wallpaper Engine";
+      description = "Restart the active Wallpaper Engine background";
+      command = "restart";
+      message = "Wallpaper Engine reloaded";
+    })
+    (mkVicinaeScript {
+      name = "next";
+      title = "Next Wallpaper Engine Wallpaper";
+      description = "Switch to the next configured Wallpaper Engine background";
+      command = "next";
+      message = "Switched to the next Wallpaper Engine wallpaper";
+    })
+    (mkVicinaeScript {
+      name = "previous";
+      title = "Previous Wallpaper Engine Wallpaper";
+      description = "Switch to the previous configured Wallpaper Engine background";
+      command = "previous";
+      message = "Switched to the previous Wallpaper Engine wallpaper";
+    })
+    (mkVicinaeScript {
+      name = "list";
+      title = "List Wallpaper Engine Wallpapers";
+      description = "Show the configured Wallpaper Engine backgrounds";
+      command = "list";
+      mode = "fullOutput";
+    })
+    (mkVicinaeScript {
+      name = "current";
+      title = "Current Wallpaper Engine Wallpaper";
+      description = "Show the active Wallpaper Engine background";
+      command = "current";
+    })
+    (mkVicinaeScript {
+      name = "stop";
+      title = "Stop Wallpaper Engine";
+      description = "Stop Wallpaper Engine for this session";
+      command = "stop";
+      message = "Wallpaper Engine stopped";
+    })
+  ];
+
+  systemd.user.services = lib.optionalAttrs hasWallpapers {
+    linux-wallpaperengine = {
+      Unit = {
+        Description = "Linux Wallpaper Engine";
+        After = [ "graphical-session.target" ];
+        PartOf = [ "graphical-session.target" ];
+      };
+      Service = {
+        ExecStart = lib.getExe launcher;
+        Restart = "on-abnormal";
+      };
+      Install.WantedBy = [ "graphical-session.target" ];
+    };
+
+    linux-wallpaperengine-switch = {
+      Unit.Description = "Switch Linux Wallpaper Engine wallpaper";
+      Service = {
+        Type = "oneshot";
+        ExecStart = "${lib.getExe controller} next";
+      };
+    };
+  };
+
+  systemd.user.timers =
+    lib.optionalAttrs
+      (hasWallpapers && builtins.length wallpaperIds > 1 && switchIntervalSeconds != null)
+      {
+        linux-wallpaperengine-switch = {
+          Unit = {
+            Description = "Periodically switch Linux Wallpaper Engine wallpaper";
+            PartOf = [ "graphical-session.target" ];
+          };
+          Timer = {
+            OnActiveSec = "${toString switchIntervalSeconds}s";
+            OnUnitActiveSec = "${toString switchIntervalSeconds}s";
+            Unit = "linux-wallpaperengine-switch.service";
+          };
+          Install.WantedBy = [ "graphical-session.target" ];
+        };
+      };
+}

modules/applications/linux-wallpaperengine/meta.nix

@@ -0,0 +1,3 @@
+{
+  description = "Wallpaper Engine backgrounds for Linux";
+}

modules/applications/linux-wallpaperengine/settings.nix

@@ -0,0 +1,23 @@
+{
+  assetsDirectory = "~/.local/share/Steam/steamapps/common/wallpaper_engine/assets";
+  workshopDirectory = "~/.local/share/Steam/steamapps/workshop/content/431960";
+
+  wallpaperIds = [
+    "2833810156"
+    "2834355367"
+    "2836628501"
+    "2845095254"
+    "2859848175"
+    "2861661119"
+    "2982896307"
+  ];
+
+  # null selects the first ID above.
+  selectedWallpaperId = null;
+  # Set a number such as 300 to rotate through multiple IDs.
+  switchIntervalSeconds = 300;
+
+  fps = 30;
+  mute = true;
+  scaling = "fill";
+}

modules/applications/loupe/home/nixos.nix

@@ -0,0 +1,22 @@
+{ pkgs, ... }:
+{
+  home.packages = [ pkgs.loupe ];
+
+  xdg.mimeApps = {
+    enable = true;
+    defaultApplicationPackages = [ pkgs.loupe ];
+
+    defaultApplications = {
+      "image/avif" = [ "org.gnome.Loupe.desktop" ];
+      "image/bmp" = [ "org.gnome.Loupe.desktop" ];
+      "image/gif" = [ "org.gnome.Loupe.desktop" ];
+      "image/heic" = [ "org.gnome.Loupe.desktop" ];
+      "image/heif" = [ "org.gnome.Loupe.desktop" ];
+      "image/jpeg" = [ "org.gnome.Loupe.desktop" ];
+      "image/jxl" = [ "org.gnome.Loupe.desktop" ];
+      "image/png" = [ "org.gnome.Loupe.desktop" ];
+      "image/svg+xml" = [ "org.gnome.Loupe.desktop" ];
+      "image/webp" = [ "org.gnome.Loupe.desktop" ];
+    };
+  };
+}

modules/applications/mangohud/home/nixos.nix

@@ -0,0 +1,3 @@
+_: {
+  programs.mangohud.enable = true;
+}

modules/applications/minecraft/darwin.nix

@@ -0,0 +1,6 @@
+{
+  homebrew = {
+    enable = true;
+    casks = [ "prismlauncher" ];
+  };
+}

modules/applications/minecraft/home/common.nix

@@ -0,0 +1,44 @@
+{ pkgs, ... }: {
+  home.packages = [ pkgs.packwiz ];
+
+  programs.prismlauncher = {
+    enable = true;
+
+    package = null;
+
+    settings = {
+      UseSystemLocale = true;
+
+      # Minecraftのバージョンに応じてJavaを切り替える。
+      AutomaticJavaSwitch = true;
+
+      IgnoreJavaCompatibility = false;
+
+      # 軽量～中規模構成のグローバル既定値。
+      MinMemAlloc = 512;
+      MaxMemAlloc = 4096;
+      LowMemWarning = true;
+
+      # 通常はコンソールを隠し、異常時だけ表示する。
+      ShowConsole = false;
+      ShowConsoleOnError = true;
+      LogPrePostOutput = true;
+      ConsoleMaxLines = 100000;
+      ConsoleOverflowStop = true;
+
+      # Mod管理。
+      ModMetadataDisabled = false;
+      ModDependenciesDisabled = false;
+      SkipModpackUpdatePrompt = false;
+      ShowModIncompat = true;
+      DownloadGameFilesDuringInstanceCreation = true;
+
+      # プレイ時間。
+      RecordGameTime = true;
+      ShowGameTime = true;
+      ShowGlobalGameTime = true;
+
+      MetaRefreshOnLaunch = true;
+    };
+  };
+}

modules/applications/minecraft/home/darwin.nix

@@ -0,0 +1,5 @@
+_: {
+  programs.prismlauncher.settings = {
+    AutomaticJavaDownload = true;
+  };
+}

modules/applications/minecraft/home/nixos.nix

@@ -0,0 +1,8 @@
+{ pkgs, ... }:
+{
+  home.packages = [ pkgs.prismlauncher ];
+
+  programs.prismlauncher.settings = {
+    EnableFeralGamemode = true;
+  };
+}

modules/applications/moonlight/darwin.nix

@@ -1,6 +1,6 @@
 {
   homebrew = {
     enable = true;
-    casks = [ "vesktop" ];
+    casks = [ "moonlight" ];
   };
 }

modules/applications/moonlight/home/nixos.nix

@@ -0,0 +1,4 @@
+{ pkgs, ... }:
+{
+  home.packages = [ pkgs.moonlight-qt ];
+}

modules/applications/nani/darwin.nix

@@ -1,6 +1,6 @@
 {
   homebrew = {
     enable = true;
-    casks = [ "drawio" ];
+    casks = [ "nani" ];
   };
 }

modules/applications/nani/home/nixos.nix

@@ -0,0 +1,78 @@
+{ pkgs, ... }:
+let
+  tessdataBest = pkgs.runCommand "tessdata-best-jpn-eng-chi-sim" { } ''
+    mkdir -p "$out"
+    ln -s ${
+      pkgs.fetchurl {
+        url = "https://github.com/tesseract-ocr/tessdata_best/raw/main/jpn.traineddata";
+        hash = "sha256-Nr35rII/WRHmJMMNBVPokLirx8MaZbPvFNqUNljEC3k=";
+      }
+    } "$out/jpn.traineddata"
+    ln -s ${
+      pkgs.fetchurl {
+        url = "https://github.com/tesseract-ocr/tessdata_best/raw/main/eng.traineddata";
+        hash = "sha256-goCu0Hgv4nJXpo6hD+fvMkyg+Nhb0v0UXRwrVgvLZro=";
+      }
+    } "$out/eng.traineddata"
+    ln -s ${
+      pkgs.fetchurl {
+        url = "https://github.com/tesseract-ocr/tessdata_best/raw/main/chi_sim.traineddata";
+        hash = "sha256-T+8tEwbI6HYW1NPkxsZ/r11EvjNCKQz48vD246p+c1s=";
+      }
+    } "$out/chi_sim.traineddata"
+  '';
+
+  tesseract = pkgs.tesseract5.override {
+    tessdata = tessdataBest;
+  };
+
+  naniTranslatePrimary = pkgs.writeShellApplication {
+    name = "nani-translate-primary";
+
+    runtimeInputs = with pkgs; [
+      jq
+      wl-clipboard
+      xdg-utils
+    ];
+
+    text = ''
+      selected_text="$(wl-paste --primary --no-newline)" || exit 0
+      [ -n "$selected_text" ] || exit 0
+      encoded_text="$(printf '%s' "$selected_text" | jq -sRr @uri)"
+      exec xdg-open "naniapp://translate?source=$encoded_text"
+    '';
+  };
+
+  naniTranslateOcr = pkgs.writeShellApplication {
+    name = "nani-translate-ocr";
+
+    runtimeInputs = with pkgs; [
+      grim
+      jq
+      slurp
+      tesseract
+      xdg-utils
+    ];
+
+    text = ''
+      geometry="$(slurp)" || exit 0
+      captured_text="$(
+        grim -g "$geometry" - \
+          | tesseract stdin stdout -l jpn+eng+chi_sim --oem 1 --psm 6
+      )"
+      [ -n "$captured_text" ] || exit 0
+      encoded_text="$(printf '%s' "$captured_text" | jq -sRr @uri)"
+      exec xdg-open "naniapp://translate?source=$encoded_text"
+    '';
+  };
+in
+{
+  programs.naniTranslateLinux.enable = true;
+
+  xdg.mimeApps.defaultApplications."x-scheme-handler/naniapp" = "nani.desktop";
+
+  home.packages = [
+    naniTranslatePrimary
+    naniTranslateOcr
+  ];
+}

modules/applications/nani/meta.nix

@@ -0,0 +1,8 @@
+{ inputs, ... }:
+{
+  description = "Nani Translate application";
+
+  imports.home = [
+    inputs.nani-translate-linux.homeManagerModules.default
+  ];
+}

modules/applications/nautilus/home.nix

@@ -1,8 +0,0 @@
-{ pkgs, lib, ... }:
-lib.mkIf pkgs.stdenv.hostPlatform.isLinux {
-  home.packages = [
-    pkgs.nautilus
-    pkgs.gvfs
-    pkgs.sushi
-  ];
-}

modules/applications/nautilus/home/nixos.nix

@@ -0,0 +1,175 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  nautilusExtensionDir = "${pkgs.nautilus-python}/lib/nautilus/extensions-4";
+in
+{
+  home.packages = [
+    pkgs.nautilus
+    pkgs.nautilus-python
+    pkgs.sushi
+  ];
+
+  # Nautilus に nautilus-python のC拡張を認識させる。
+  # home.sessionVariables:
+  #   通常のログインセッションやシェルから起動したNautilus向け
+  #
+  # systemd.user.sessionVariables:
+  #   D-Bus/systemdユーザーサービス経由で起動したNautilus向け
+  home.sessionVariables.NAUTILUS_4_EXTENSION_DIR = nautilusExtensionDir;
+
+  systemd.user.sessionVariables.NAUTILUS_4_EXTENSION_DIR = nautilusExtensionDir;
+
+  xdg.dataFile."nautilus-python/extensions/open-in-editor.py".text = ''
+    import os
+    import subprocess
+
+    from gi.repository import GObject, Nautilus
+
+
+    class OpenInEditorExtension(
+        GObject.GObject,
+        Nautilus.MenuProvider,
+    ):
+        EDITORS = (
+            (
+                "vscode",
+                "VS Code で開く",
+                ["${lib.getExe pkgs.vscode}"],
+            ),
+            (
+                "zed",
+                "Zed で開く",
+                ["${lib.getExe pkgs.zed-editor}"],
+            ),
+            (
+                "neovim",
+                "Neovim で開く",
+                [
+                    "${lib.getExe pkgs.ghostty}",
+                    "-e",
+                    "${lib.getExe pkgs.neovim}",
+                ],
+            ),
+        )
+
+        @staticmethod
+        def get_local_paths(files):
+            paths = []
+
+            for file in files:
+                location = file.get_location()
+
+                if location is None:
+                    return []
+
+                path = location.get_path()
+
+                if path is None:
+                    return []
+
+                paths.append(path)
+
+            return paths
+
+        @staticmethod
+        def get_working_directory(paths):
+            path = paths[0]
+
+            return path if os.path.isdir(path) else os.path.dirname(path)
+
+        @staticmethod
+        def launch(_item, command):
+            subprocess.Popen(
+                command,
+                start_new_session=True,
+                close_fds=True,
+            )
+
+        def create_items(self, context, paths):
+            items = []
+
+            for editor_id, label, command in self.EDITORS:
+                item = Nautilus.MenuItem(
+                    # 選択項目用と背景用で異なるIDにする
+                    name=f"OpenInEditor::{context}::{editor_id}",
+                    label=label,
+                )
+
+                item.connect(
+                    "activate",
+                    self.launch,
+                    [*command, *paths],
+                )
+
+                items.append(item)
+
+            item = Nautilus.MenuItem(
+                name=f"OpenInEditor::{context}::ghostty",
+                label="Ghostty で開く",
+            )
+
+            item.connect(
+                "activate",
+                self.launch,
+                [
+                    "${lib.getExe pkgs.ghostty}",
+                    f"--working-directory={self.get_working_directory(paths)}",
+                ],
+            )
+
+            items.append(item)
+
+            return items
+
+        def get_file_items(self, files):
+            paths = self.get_local_paths(files)
+
+            if not paths:
+                return []
+
+            # 選択中のファイル・ディレクトリを渡す
+            return self.create_items("selection", paths)
+
+        def get_background_items(self, current_folder):
+            paths = self.get_local_paths([current_folder])
+
+            if not paths:
+                return []
+
+            # 何も選択せず背景を右クリックした場合だけ現在位置を渡す
+            return self.create_items("background", paths)
+  '';
+
+  dconf.settings = {
+    "org/gnome/nautilus/preferences" = {
+      always-use-location-entry = true;
+      default-folder-viewer = "list-view";
+    };
+
+    "org/gnome/nautilus/list-view".use-tree-view = true;
+
+    # Nautilus 50 migrates this setting from GTK 3 to GTK 4.
+    "org/gtk/settings/file-chooser".show-hidden = true;
+    "org/gtk/gtk4/settings/file-chooser".show-hidden = true;
+  };
+
+  gtk.gtk3.bookmarks = [
+    "file://${config.home.homeDirectory}/Desktop Desktop"
+    "file://${config.home.homeDirectory}/Pictures Pictures"
+    "file://${config.home.homeDirectory}/Downloads Downloads"
+    "file://${config.home.homeDirectory}/projects projects"
+  ];
+
+  home.activation.createProjectsDirectory = {
+    after = [ "writeBoundary" ];
+    before = [ ];
+    data = ''
+      $DRY_RUN_CMD mkdir -p "$HOME/projects"
+    '';
+  };
+}

modules/applications/nh/home.nix

@@ -1,5 +1,42 @@
 { config, pkgs, ... }:
 {
   home.packages = [ pkgs.nh ];
-  home.sessionVariables.NH_FLAKE = "${config.home.homeDirectory}/dotfiles";
+  home.sessionVariables = {
+    NH_FLAKE = "${config.home.homeDirectory}/dotfiles";
+    NH_SHOW_ACTIVATION_LOGS = "1";
+  };
+
+  programs.zsh.initContent = ''
+    export SUDO_PROMPT=$'\a[sudo] authenticate for %u: '
+
+    nh() {
+      local notify=false
+      local argument
+
+      case "$1:$2" in
+        os:switch | os:build) notify=true ;;
+      esac
+
+      for argument in "$@"; do
+        if [[ "$argument" == "--update" ]]; then
+          notify=true
+          break
+        fi
+      done
+
+      command nh "$@"
+      local status=$?
+
+      if [[ "$notify" == true ]]; then
+        printf '\a'
+        if ((status == 0)); then
+          print -P "%F{green}nh completed%f"
+        else
+          print -P "%F{red}nh failed (exit $status)%f"
+        fi
+      fi
+
+      return "$status"
+    }
+  '';
 }

modules/applications/niri/home/keybindings.nix

@@ -1,44 +1,91 @@
+# niri のデフォルトキーバインド。編集しないこと。
 {
   "Mod+Shift+Slash".action.show-hotkey-overlay = { };
 
+  "Mod+T" = {
+    hotkey-overlay.title = "Open a Terminal: alacritty";
+    action.spawn = "alacritty";
+  };
+  "Mod+D" = {
+    hotkey-overlay.title = "Run an Application: fuzzel";
+    action.spawn = "fuzzel";
+  };
+  "Super+Alt+L" = {
+    hotkey-overlay.title = "Lock the Screen: swaylock";
+    action.spawn = "swaylock";
+  };
+  "Super+Alt+S" = {
+    allow-when-locked = true;
+    hotkey-overlay.hidden = true;
+    action.spawn-sh = "pkill orca || exec orca";
+  };
+
   "XF86AudioRaiseVolume" = {
     allow-when-locked = true;
-    action.spawn = [
+    action.spawn-sh = "wpctl set-volume @DEFAULT_AUDIO_SINK@ 0.1+ -l 1.0";
-      "wpctl"
-      "set-volume"
-      "@DEFAULT_AUDIO_SINK@"
-      "0.1+"
-    ];
   };
   "XF86AudioLowerVolume" = {
     allow-when-locked = true;
-    action.spawn = [
+    action.spawn-sh = "wpctl set-volume @DEFAULT_AUDIO_SINK@ 0.1-";
-      "wpctl"
-      "set-volume"
-      "@DEFAULT_AUDIO_SINK@"
-      "0.1-"
-    ];
   };
   "XF86AudioMute" = {
     allow-when-locked = true;
-    action.spawn = [
+    action.spawn-sh = "wpctl set-mute @DEFAULT_AUDIO_SINK@ toggle";
-      "wpctl"
-      "set-mute"
-      "@DEFAULT_AUDIO_SINK@"
-      "toggle"
-    ];
   };
   "XF86AudioMicMute" = {
+    allow-when-locked = true;
+    action.spawn-sh = "wpctl set-mute @DEFAULT_AUDIO_SOURCE@ toggle";
+  };
+
+  "XF86AudioPlay" = {
+    allow-when-locked = true;
+    action.spawn-sh = "playerctl play-pause";
+  };
+  "XF86AudioPause" = {
+    allow-when-locked = true;
+    action.spawn-sh = "playerctl play-pause";
+  };
+  "XF86AudioStop" = {
+    allow-when-locked = true;
+    action.spawn-sh = "playerctl stop";
+  };
+  "XF86AudioPrev" = {
+    allow-when-locked = true;
+    action.spawn-sh = "playerctl previous";
+  };
+  "XF86AudioNext" = {
+    allow-when-locked = true;
+    action.spawn-sh = "playerctl next";
+  };
+
+  "XF86MonBrightnessUp" = {
     allow-when-locked = true;
     action.spawn = [
-      "wpctl"
+      "brightnessctl"
-      "set-mute"
+      "--class=backlight"
-      "@DEFAULT_AUDIO_SOURCE@"
+      "set"
-      "toggle"
+      "+10%"
+    ];
+  };
+  "XF86MonBrightnessDown" = {
+    allow-when-locked = true;
+    action.spawn = [
+      "brightnessctl"
+      "--class=backlight"
+      "set"
+      "10%-"
     ];
   };
 
-  "Mod+Q".action.close-window = { };
+  "Mod+O" = {
+    repeat = false;
+    action.toggle-overview = { };
+  };
+
+  "Mod+Q" = {
+    repeat = false;
+    action.close-window = { };
+  };
 
   "Mod+Left".action.focus-column-left = { };
   "Mod+Down".action.focus-window-down = { };
@@ -130,6 +177,7 @@
   "Mod+7".action.focus-workspace = 7;
   "Mod+8".action.focus-workspace = 8;
   "Mod+9".action.focus-workspace = 9;
+
   "Mod+Ctrl+1".action.move-column-to-workspace = 1;
   "Mod+Ctrl+2".action.move-column-to-workspace = 2;
   "Mod+Ctrl+3".action.move-column-to-workspace = 3;
@@ -140,21 +188,46 @@
   "Mod+Ctrl+8".action.move-column-to-workspace = 8;
   "Mod+Ctrl+9".action.move-column-to-workspace = 9;
 
+  "Mod+BracketLeft".action.consume-or-expel-window-left = { };
+  "Mod+BracketRight".action.consume-or-expel-window-right = { };
+
   "Mod+Comma".action.consume-window-into-column = { };
   "Mod+Period".action.expel-window-from-column = { };
+
   "Mod+R".action.switch-preset-column-width = { };
-  "Mod+Shift+R".action.reset-window-height = { };
+  "Mod+Shift+R".action.switch-preset-column-width-back = { };
+  "Mod+Ctrl+Shift+R".action.switch-preset-window-height = { };
+  "Mod+Ctrl+R".action.reset-window-height = { };
+
   "Mod+F".action.maximize-column = { };
   "Mod+Shift+F".action.fullscreen-window = { };
+  "Mod+M".action.maximize-window-to-edges = { };
+  "Mod+Ctrl+F".action.expand-column-to-available-width = { };
+
   "Mod+C".action.center-column = { };
+  "Mod+Ctrl+C".action.center-visible-columns = { };
+
   "Mod+Minus".action.set-column-width = "-10%";
   "Mod+Equal".action.set-column-width = "+10%";
   "Mod+Shift+Minus".action.set-window-height = "-10%";
   "Mod+Shift+Equal".action.set-window-height = "+10%";
 
+  "Mod+V".action.toggle-window-floating = { };
+  "Mod+Shift+V".action.switch-focus-between-floating-and-tiling = { };
+
+  "Mod+W".action.toggle-column-tabbed-display = { };
+
   "Print".action.screenshot = { };
   "Ctrl+Print".action.screenshot-screen = { };
   "Alt+Print".action.screenshot-window = { };
+
+  "Mod+Escape" = {
+    allow-inhibiting = false;
+    action.toggle-keyboard-shortcuts-inhibit = { };
+  };
+
   "Mod+Shift+E".action.quit = { };
+  "Ctrl+Alt+Delete".action.quit = { };
+
   "Mod+Shift+P".action.power-off-monitors = { };
 }

modules/applications/niri/home/nixos.nix

@@ -4,99 +4,9 @@ let
 in
 {
   programs.niri.settings = {
-    input = {
-      touchpad = {
-        natural-scroll = true;
-        scroll-factor = 4.0;
-        scroll-method = "two-finger";
-        click-method = "clickfinger";
-        drag = true;
-        drag-lock = true;
-      };
-
-      keyboard.xkb = {
-        layout = "jp";
-        options = "ctrl:nocaps";
-      };
-
-      mouse = {
-        accel-profile = "flat";
-        accel-speed = -0.1;
-      };
-
-      warp-mouse-to-focus.enable = true;
-      focus-follows-mouse = {
-        enable = true;
-        max-scroll-amount = "0%";
-      };
-    };
-
-    spawn-at-startup = [
-      { command = [ "noctalia" ]; }
-      {
-        command = [
-          "${pkgs.polkit_gnome}/libexec/polkit-gnome-authentication-agent-1"
-        ];
-      }
-    ];
-
-    cursor.size = 16;
-
-    layout = {
-      focus-ring = {
-        active.color = "#bd93f9";
-        inactive.color = "#6272a4";
-      };
-      border = {
-        active.color = "#ffc87f";
-        inactive.color = "#505050";
-        urgent.color = "#9b0000";
-      };
-      shadow.color = "#0007";
-      background-color = "transparent";
-    };
 
     binds = keybindings // {
-      "Mod+T" = {
+      # niri window or focus move
-        action.spawn = "ghostty";
-        hotkey-overlay.title = "Open a Terminal: ghostty";
-      };
-      "Mod+D" = {
-        action.spawn = [
-          "vicinae"
-          "toggle"
-        ];
-        hotkey-overlay.title = "Run an Application: vicinae";
-      };
-      "Mod+E" = {
-        action.spawn = [
-          "nautilus"
-          "--new-window"
-        ];
-        hotkey-overlay.title = "Open File Manager: nautilus";
-      };
-      "Mod+L" = {
-        action.spawn = [
-          (lib.getExe' pkgs.systemd "loginctl")
-          "lock-session"
-        ];
-        hotkey-overlay.title = "Lock the Screen";
-      };
-      "Mod+V" = {
-        action.spawn = [
-          "vicinae"
-          "vicinae://launch/clipboard/history?toggle=true"
-        ];
-        hotkey-overlay.title = "Clipboard History";
-      };
-      "Mod+Space" = {
-        action.spawn = [
-          "ghostty"
-          "+toggle-quick-terminal"
-        ];
-        hotkey-overlay.title = "Toggle Quick Terminal: ghostty";
-      };
-
       "Mod+Shift+Left" = {
         action.focus-monitor-left = [ ];
         hotkey-overlay.title = "Focus Monitor Left";
@@ -131,6 +41,129 @@ in
         hotkey-overlay.title = "Move Window to Monitor Down";
       };
 
+      "Mod+Tab" = {
+        repeat = false;
+        action.spawn = [
+          "window-overview"
+          "--hold"
+        ];
+        hotkey-overlay.title = "Window Overview: Next";
+      };
+      "Mod+Shift+Tab" = {
+        repeat = false;
+        action.spawn = [
+          "window-overview"
+          "--hold"
+          "--reverse"
+        ];
+        hotkey-overlay.title = "Window Overview: Previous";
+      };
+
+      "Print".action.spawn = [
+        "screenshot"
+        "region"
+      ];
+      "Ctrl+Print".action.spawn = [
+        "screenshot"
+        "output"
+      ];
+      "Alt+Print".action.spawn = [
+        "screenshot"
+        "all"
+      ];
+
+      # spawn applications (sync with labwc modules/applications/labwc/home.nix)
+      "Mod+T" = {
+        action.spawn = "ghostty";
+        hotkey-overlay.title = "Open a Terminal: ghostty";
+      };
+      "Mod+D" = {
+        action.spawn = [
+          "vicinae"
+          "toggle"
+        ];
+        hotkey-overlay.title = "Run an Application: vicinae";
+      };
+      "Mod+S" = {
+        action.spawn = [
+          "noctalia"
+          "msg"
+          "panel-toggle"
+          "launcher"
+        ];
+        hotkey-overlay.title = "Run an Application: Noctalia Launcher";
+      };
+      "Mod+E" = {
+        action.spawn = [
+          "nautilus"
+          "--new-window"
+        ];
+        hotkey-overlay.title = "Open File Manager: nautilus";
+      };
+      "Mod+L" = {
+        action.spawn = [
+          (lib.getExe' pkgs.systemd "loginctl")
+          "lock-session"
+        ];
+        hotkey-overlay.title = "Lock the Screen";
+      };
+      "Mod+V" = {
+        action.spawn = [
+          "vicinae"
+          "vicinae://launch/clipboard/history?toggle=true"
+        ];
+        hotkey-overlay.title = "Clipboard History";
+      };
+      "Mod+J" = {
+        repeat = false;
+        action.spawn = [ "nani-translate-primary" ];
+        hotkey-overlay.title = "Translate Primary Selection";
+      };
+      "Mod+Shift+J" = {
+        repeat = false;
+        action.spawn = [ "nani-translate-ocr" ];
+        hotkey-overlay.title = "OCR and Translate with Nani";
+      };
+      "Mod+Ctrl+J" = {
+        repeat = false;
+        action.spawn = [
+          (lib.getExe' pkgs.xdg-utils "xdg-open")
+          "naniapp://translate"
+        ];
+        hotkey-overlay.title = "Open Nani Translate";
+      };
+      "Mod+Space" = {
+        action.spawn = [
+          "ghostty"
+          "+toggle-quick-terminal"
+        ];
+        hotkey-overlay.title = "Toggle Quick Terminal: ghostty";
+      };
+      "Mod+P" = {
+        action.spawn = "wdisplays";
+        hotkey-overlay.title = "Display Settings: wdisplays";
+      };
+      "Mod+Z" = {
+        action.spawn = [
+          "wl-find-cursor"
+          "-c"
+          "0xCCFF453A"
+          "-s"
+          "160"
+          "-d"
+          "1200"
+        ];
+        hotkey-overlay.title = "Find Cursor";
+      };
+      "Ctrl+Space" = {
+        action.spawn = [
+          "handy"
+          "--toggle-transcription"
+        ];
+        hotkey-overlay.title = "Toggle Handy Transcription";
+      };
+
+      # Function keys (sync with labwc modules/applications/labwc/home.nix)
       "XF86AudioRaiseVolume".action.spawn = [
         "noctalia"
         "msg"
@@ -166,15 +199,84 @@ in
         "msg"
         "caffeine-toggle"
       ];
+      "XF86AudioPlay".action.spawn = [
+        "playerctl"
+        "play-pause"
+      ];
+      "XF86AudioPause".action.spawn = [
+        "playerctl"
+        "play-pause"
+      ];
+      "XF86AudioStop".action.spawn = [
+        "playerctl"
+        "stop"
+      ];
+      "XF86AudioPrev".action.spawn = [
+        "playerctl"
+        "previous"
+      ];
+      "XF86AudioNext".action.spawn = [
+        "playerctl"
+        "next"
+      ];
+      "XF86Display".action.spawn = [
+        "wdisplays"
+      ];
+    };
+
+    input = {
+      touchpad = {
+        natural-scroll = true;
+        scroll-factor = 4.0;
+        scroll-method = "two-finger";
+        click-method = "clickfinger";
+        drag = true;
+        drag-lock = true;
+        dwt = true;
+      };
+
+      keyboard = {
+        numlock = true;
+
+        xkb = {
+          layout = "jp";
+          options = "ctrl:nocaps";
+        };
+      };
+
+      mouse = {
+        accel-profile = "flat";
+        accel-speed = -0.1;
+      };
+      trackpoint = {
+        accel-profile = "flat";
+        accel-speed = -0.1;
+      };
+
+      warp-mouse-to-focus.enable = true;
+      focus-follows-mouse = {
+        enable = true;
+        max-scroll-amount = "0%";
+      };
+    };
+
+    cursor.size = 16;
+
+    layout = {
+      focus-ring = {
+        active.color = "#bd93f9";
+        inactive.color = "#6272a4";
+      };
+      background-color = "transparent";
     };
 
     window-rules = [
       {
         geometry-corner-radius = {
-          top-left = 20.0;
+          top-left = 8.0;
-          top-right = 20.0;
+          top-right = 8.0;
-          bottom-left = 20.0;
+          bottom-left = 8.0;
-          bottom-right = 20.0;
+          bottom-right = 8.0;
         };
         clip-to-geometry = true;
       }
@@ -184,6 +286,46 @@ in
         default-column-width.fixed = 1080;
         default-window-height.fixed = 920;
       }
+      {
+        # Zoom presents these two fixed-size primary windows. Explicitly keep
+        # them tiled, overriding Niri's automatic fixed-size-window floating.
+        matches = [
+          {
+            app-id = "^(?i:zoom)$";
+            title = "^(?i:zoom workplace)$";
+          }
+          {
+            app-id = "^(?i:zoom)$";
+            title = "^ミーティング$";
+          }
+        ];
+        open-floating = false;
+      }
+      {
+        # Zoom's screen-share controls are a toolbar, so open them where the
+        # client expects them rather than in the middle of the workspace.
+        matches = [
+          {
+            app-id = "^(?i:zoom)$";
+            title = "^as_toolbar$";
+          }
+        ];
+        open-floating = true;
+        default-floating-position = {
+          x = 0;
+          y = 8;
+          relative-to = "top";
+        };
+      }
+      {
+        # Keep all other Zoom auxiliary windows freely positionable.
+        matches = [ { app-id = "^(?i:zoom)$"; } ];
+        excludes = [
+          { title = "^(?i:zoom workplace)$"; }
+          { title = "^ミーティング$"; }
+        ];
+        open-floating = true;
+      }
     ];
 
     layer-rules = [