Home/Nixinator: Update opencode permissions

AGENTS.md

@@ -0,0 +1,128 @@
+# AGENTS.md
+
+## Common Commands
+
+```bash
+# Enter the dev shell (provides helper utilities)
+nix develop
+
+# Preferred shorthand (nh must be enabled in config)
+nh os switch   # rebuild and switch
+nh os boot     # new boot entry without switching
+
+# Direct nixos-rebuild (fallback)
+sudo nixos-rebuild switch --flake .#nixinator
+sudo nixos-rebuild switch --flake .#nixtop
+sudo nixos-rebuild switch --flake .#servenix
+sudo nixos-rebuild switch --flake .#thinknix
+sudo darwin-rebuild switch --flake .#darwinix
+
+# Validate flake without building
+nix flake check
+
+# Dev shell helpers (run inside `nix develop`)
+list-system-packages   # show installed system packages
+list-user-packages     # show installed user packages
+store-optimise         # nix store --optimise
+store-verify           # nix store --verify --repair
+```
+
+## MCP Tools
+
+The **nixos** MCP server is available and should be used for any Nix-related lookups instead of `nix search` or manual web searches. It queries live APIs (search.nixos.org, NixHub, FlakeHub) and is more current than training data.
+
+```
+# Common intents
+nix {"action":"info","query":"<pkg>","channel":"unstable"}      # package info
+nix {"action":"search","query":"<term>","type":"options"}       # NixOS options
+nix {"action":"search","source":"home-manager","query":"<term>"} # HM options
+nix {"action":"cache","query":"<pkg>"}                          # binary cache status
+nix_versions {"package":"<attr>","version":"<ver>"}             # commit that shipped a version
+```
+
+## Architecture
+
+This is a multi-host NixOS/nix-darwin flake. Home-manager runs **as a NixOS module** — not standalone. A single `nixos-rebuild switch` rebuilds system and user config together. The HM config can access the system config via the `nixosConfig` special arg.
+
+### Hosts
+
+| Host | Type | Notes |
+|------|------|-------|
+| `nixinator` | Desktop (x86_64) | Primary machine; disko, lanzaboote, impermanence |
+| `nixtop` | Laptop (x86_64) | Intel GPU, NetworkManager |
+| `servenix` | Server (x86_64) | Headless; runs OCI container services |
+| `thinknix` | Headless (x86_64) | Generic headless config |
+| `darwinix` | macOS (aarch64) | Darwin-specific configuration |
+
+### Config Layering (resolved in this order)
+
+1. **Global defaults** — `system/default.nix` / `home/christoph/default.nix`
+2. **Host overrides** — `system/<hostname>/default.nix` / `home/christoph/<hostname>/default.nix`
+3. **Hardware** — `system/<hostname>/hardware-configuration.nix` (auto-generated, **do not hand-edit**)
+
+The builder (`lib/nixos.nix`: `mkNixosConfigWithHomeManagerModule`) wires these together.
+
+### Special Args
+
+Injected into **all system and HM modules**:
+`inputs` `system` `hostname` `mylib` `username` `publicKeys` `headless`
+
+Use `headless` (boolean) to gate anything graphical. Use `mylib.<fn>` instead of reimplementing helpers.
+
+### Module System
+
+Two parallel hierarchies, identical pattern:
+
+| Scope | Path | Option prefix |
+|-------|------|---------------|
+| System | `system/systemmodules/<name>/` | `systemmodules.<name>.*` |
+| Home-manager | `home/homemodules/<name>/` | `homemodules.<name>.*` |
+
+**System modules** — `system/systemmodules/<name>/`
+- `options.nix` — declares `systemmodules.<name>.*` options
+- `default.nix` — imports `./options.nix`, implements `lib.mkIf <name>.enable { ... }`
+
+**Home-manager modules** — `home/homemodules/<name>/`
+- `options.nix` — declares `homemodules.<name>.*` options
+- `default.nix` — same pattern under `homemodules.*`
+
+When adding a new module, copy from `0_template/` in either hierarchy. Modules under `1_deprecated/` are kept for reference only — not imported anywhere.
+
+HM modules are placed in `home-manager.sharedModules` (not `users.<user>.imports`) — this enables proper nixd completions.
+
+### Custom Library (`lib/`)
+
+Always available as `mylib`. Key files:
+- `nixos.nix` — host config builders, `mkNixosConfigWithHomeManagerModule`, `mkDarwinConfigWithHomeManagerModule`
+- `modules.nix` — `mkBoolOption`, `mkElse`, `attrName`, `attrValue`, `contains`
+- `networking.nix` — `mkSystemdNetwork`, `mkStaticSystemdNetwork`
+- `generators.nix` — `toLuaObject`, `toLuaKeymap` (used by Neovim module)
+- `containers.nix` — OCI container helpers for services
+- `color.nix` — theming
+
+Always use `mylib.<fn>` (available as a special arg) rather than reimplementing these utilities.
+
+### Services
+
+Server services are OCI containers (podman/docker) defined in `system/services/`. Each file defines one or more containers. These are only enabled on `servenix`. Use the template at `system/services/0_TEMPLATE.nix`.
+
+### Secrets
+
+Managed via **sops-nix**. Age keys stored in `flake.nix` under `publicKeys.christoph`. Encrypted `.yaml`/`.json` files live alongside the module that uses them, referenced as `sops.secrets.<name>`.
+
+### Overlays and Custom Derivations
+
+- `overlays/default.nix` — package overrides (e.g., patched JetBrains CLion version)
+- `derivations/default.nix` — custom packages: `monolisa`, `msty`, `unityhub`, `tidal-dl-ng`, `tiddl`
+- `derivations/1_deprecated/` — kept for reference, not imported
+
+### Sub-projects
+
+`config/flake.nix` is a separate, reusable development-project template — **not part of the main NixOS flake**. It uses `flake-utils` for multi-system shells.
+
+## Constraints
+
+- No CI, no tests, no linting — this is a configuration repo
+- `nix flake check` is the only validation available
+- `documentation.enable = false` by default (slow); toggle it if you need man pages
+- Hardware config files are auto-generated — never edit them by hand

flake.lock

@@ -20,11 +20,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1788016784,
-        "narHash": "sha256-RO90Fk+Rn2Yy+I8oL4ePTLLKLgOAr8hrTx7tlpwdLaA=",
+        "lastModified": 1788444081,
+        "narHash": "sha256-I8i97p9WBQaZQyyBaHFMt8e01VfgfFZSaO+vAUd0u0A=",
         "owner": "hyprwm",
         "repo": "aquamarine",
-        "rev": "783bfd9ae441d1d0519b979ac68b73ddd6e81df0",
+        "rev": "36b66db4ddd708ad19f5db850af6a478d8a19b2a",
         "type": "github"
       },
       "original": {
@@ -109,11 +109,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1788165233,
-        "narHash": "sha256-iABT8jOczQ8gvSo2TgyCQNDtXjh7MSx3myiAAzaYTa8=",
+        "lastModified": 1789175900,
+        "narHash": "sha256-kvERUjjzkawZwg27P8+DVNULBUl6tb/RaXrFpSJnHX4=",
         "owner": "aaddrick",
         "repo": "claude-desktop-debian",
-        "rev": "249a33390a58278a7ace07145d50aa3336bdab99",
+        "rev": "4c2bfbf9577f873df99757bed171c76633ab22a6",
         "type": "github"
       },
       "original": {
@@ -130,11 +130,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1788777912,
-        "narHash": "sha256-lgCRzVW8Uz9zUsWi1NjuXYOyhuXZ/1x/hDV69Sb3QFI=",
+        "lastModified": 1789285506,
+        "narHash": "sha256-f7R2NvLwKBAzhwg5hxu+NJhTAn4+i4VuZxe3VIa+aCA=",
         "owner": "ilysenko",
         "repo": "codex-desktop-linux",
-        "rev": "758b4ce74301c387c6006698921384d4ca1dc47d",
+        "rev": "f445a448d2f95766e5e0b9563618964a5250704f",
         "type": "github"
       },
       "original": {
@@ -163,11 +163,11 @@
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1768818222,
-        "narHash": "sha256-460jc0+CZfyaO8+w8JNtlClB2n4ui1RbHfPTLkpwhU8=",
+        "lastModified": 1788342953,
+        "narHash": "sha256-EWkNM4JzBhZ/Yn1PG6lP4/QJuFAFeHYlY5gVxXu940Y=",
         "owner": "numtide",
         "repo": "devshell",
-        "rev": "255a2b1725a20d060f566e4755dbf571bbbb5f76",
+        "rev": "a67c0f87b63bcbdbdcb56785bec0205a2e3d6026",
         "type": "github"
       },
       "original": {
@@ -337,11 +337,11 @@
         "nixpkgs-lib": "nixpkgs-lib"
       },
       "locked": {
-        "lastModified": 1787559586,
-        "narHash": "sha256-onL0VLf9vPllmT0H/OlURIU5r5t5WIEl7t4tVNKT0Nw=",
+        "lastModified": 1788450739,
+        "narHash": "sha256-glZLQlzIn1fXH6PazR2iUmTo7kzzyYSshrWhLS9TqCU=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "9d0d87172c374f89da73c1cfe6d81ae62feac1f1",
+        "rev": "31729ca8cbdb4fa927b34e5f4353e6a83f39e993",
         "type": "github"
       },
       "original": {
@@ -355,11 +355,11 @@
         "nixpkgs-lib": "nixpkgs-lib_2"
       },
       "locked": {
-        "lastModified": 1787559586,
-        "narHash": "sha256-onL0VLf9vPllmT0H/OlURIU5r5t5WIEl7t4tVNKT0Nw=",
+        "lastModified": 1788450739,
+        "narHash": "sha256-glZLQlzIn1fXH6PazR2iUmTo7kzzyYSshrWhLS9TqCU=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "9d0d87172c374f89da73c1cfe6d81ae62feac1f1",
+        "rev": "31729ca8cbdb4fa927b34e5f4353e6a83f39e993",
         "type": "github"
       },
       "original": {
@@ -376,11 +376,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1787559586,
-        "narHash": "sha256-onL0VLf9vPllmT0H/OlURIU5r5t5WIEl7t4tVNKT0Nw=",
+        "lastModified": 1788450739,
+        "narHash": "sha256-glZLQlzIn1fXH6PazR2iUmTo7kzzyYSshrWhLS9TqCU=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "9d0d87172c374f89da73c1cfe6d81ae62feac1f1",
+        "rev": "31729ca8cbdb4fa927b34e5f4353e6a83f39e993",
         "type": "github"
       },
       "original": {
@@ -513,11 +513,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1787424939,
-        "narHash": "sha256-O2tBn84NNuHrnqNVxx/XqsXwfYvS1YwBh+7CBnbCYsk=",
+        "lastModified": 1788267358,
+        "narHash": "sha256-nt+lUqYVpc9Y6JeMd2WmXzCDojasdadKo0mWcluvY2Y=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "809414f0cdadf82cf11b06c2b29ba9b3168b3297",
+        "rev": "27555e2624241fb116b49095df4caaee85a25691",
         "type": "github"
       },
       "original": {
@@ -572,11 +572,11 @@
         "nixpkgs": "nixpkgs_3"
       },
       "locked": {
-        "lastModified": 1788044418,
-        "narHash": "sha256-cmOd3iGoE140M2GidgQMQbyxHZ4dT7C0QZq2+CrXQyA=",
+        "lastModified": 1789127271,
+        "narHash": "sha256-vL/Fpo7Zxa7wvO8V5FAToUBvP+K3XsMB1wUglTtd/J0=",
         "owner": "nixos",
         "repo": "nixos-hardware",
-        "rev": "dc3f0cfde2050172abf6c3cdb684f735c15a57c5",
+        "rev": "24cfdc1f9344b90a1eee329a3906e2f39f4d0f1e",
         "type": "github"
       },
       "original": {
@@ -592,11 +592,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1788146656,
-        "narHash": "sha256-XmJmvk9rytTb7dCotO/aqR+YysB8HOqnprlOdv+LAF4=",
+        "lastModified": 1789320570,
+        "narHash": "sha256-1Js4AJiWLV7U1SF3ok0J2tKbBEJYE5YpElGU+7fMbfo=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "82c265faf4e3161d6015db07c9b0f1ee36a9029b",
+        "rev": "87b3c74df02a2b2e691a24f3c82774f48a70c1bd",
         "type": "github"
       },
       "original": {
@@ -701,11 +701,11 @@
         "xdph": "xdph"
       },
       "locked": {
-        "lastModified": 1788187241,
-        "narHash": "sha256-LtXqt/xbyR/FyKtuLTXJN5pxJoMAHzI/uWTw/ZxUxwA=",
+        "lastModified": 1789313241,
+        "narHash": "sha256-b59oP/YeH0kug0tBpPThWjOzIvcMB646rE9HySEyz24=",
         "owner": "hyprwm",
         "repo": "Hyprland",
-        "rev": "3b2dadd987fd9da19006a4969036777f44c98f61",
+        "rev": "1b85c7aa1b5c41d906880f0f495bcd0749a23175",
         "type": "github"
       },
       "original": {
@@ -777,11 +777,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1788037253,
-        "narHash": "sha256-QSGOM0IFpp45DwmtIwcih8+kKuSgAoQal9QkVVSRNew=",
+        "lastModified": 1788563182,
+        "narHash": "sha256-e2Q7i5T+iQY0o/uxFNnXxWpXZ1e5f6VV4eHdKk7l6kc=",
         "owner": "hyprwm",
         "repo": "hyprland-plugins",
-        "rev": "67c3a4c019f223c27b5bdc6bb656ce891a60861a",
+        "rev": "722f15a77768eab13f01f5e5dce024bd2f61f270",
         "type": "github"
       },
       "original": {
@@ -980,11 +980,11 @@
         "nixpkgs": "nixpkgs_5"
       },
       "locked": {
-        "lastModified": 1787965620,
-        "narHash": "sha256-CIDEB9jOZwDB6AM0bsKeTe0AEm12XJqDVLHOIg86be0=",
+        "lastModified": 1789070605,
+        "narHash": "sha256-QIo1r169N/jP71+YUXci6+fdD1WqKLE/FfWE8SLAqRI=",
         "owner": "JPyke3",
         "repo": "hytale-launcher-nix",
-        "rev": "606cb7cdc218b8ddab2c478aca3e12fd0555375c",
+        "rev": "9c26eaaef7e7b362dafa106e0de9567618e1698e",
         "type": "github"
       },
       "original": {
@@ -1088,11 +1088,11 @@
         "xwayland-satellite-unstable": "xwayland-satellite-unstable"
       },
       "locked": {
-        "lastModified": 1788119116,
-        "narHash": "sha256-LvuLRFljwbOpaQ+X6sWAD/penYTCqHEVf6AxQcBHDlo=",
+        "lastModified": 1789315465,
+        "narHash": "sha256-tCEkCbcSkAIreekMHErF3SnnawmRq8Qjnl18RKq5eVQ=",
         "owner": "epireyn",
         "repo": "niri-flake",
-        "rev": "8c4cf2a8d3e42ca2db41b884eef333e674ecc09f",
+        "rev": "cacbfbfbcf11df02583aa5d60a8e004d3e5b9fd7",
         "type": "github"
       },
       "original": {
@@ -1121,11 +1121,11 @@
     "niri-unstable": {
       "flake": false,
       "locked": {
-        "lastModified": 1787337984,
-        "narHash": "sha256-BNZUEVR2H96hCKENNKoLSSTFT8W4smp7v94hJc4Ehfc=",
+        "lastModified": 1789308908,
+        "narHash": "sha256-rKf+kiqygvn1DjpNRlHVkbXnABLGpd/N6Gg+t2POEQM=",
         "owner": "niri-wm",
         "repo": "niri",
-        "rev": "dd75865f547f0eac0e9b6c4d86d2cd00c0744252",
+        "rev": "66d04a7d72e25a6c74307bab33a91924d124755d",
         "type": "github"
       },
       "original": {
@@ -1201,11 +1201,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1788064340,
-        "narHash": "sha256-QehJP4PYmGoibbmFKYUA19wvdESywXNC+9DHxcuos48=",
+        "lastModified": 1789271913,
+        "narHash": "sha256-9cNioGJJ/2wH/153TefIRv33H98+Y5q2sGOdMWBtdN4=",
         "owner": "fufexan",
         "repo": "nix-gaming",
-        "rev": "51de0cca39be715df8e02218421cc7f91388228e",
+        "rev": "04d8ba4c959ed2e1735ed1a2bc2bea8184065d1e",
         "type": "github"
       },
       "original": {
@@ -1253,11 +1253,11 @@
     },
     "nixpkgs-lib": {
       "locked": {
-        "lastModified": 1785031560,
-        "narHash": "sha256-OmshNvn2vupOFpYinLUu+1Dnpu4n7Q5N3ggGVNHpkUI=",
+        "lastModified": 1788057806,
+        "narHash": "sha256-DTQSMxzDWmT0zhguthvegnVkn7CFqGCv4IHCzk5ZUpM=",
         "owner": "nix-community",
         "repo": "nixpkgs.lib",
-        "rev": "0e79af5e3d4dcfcd676ab5ba3f95d2e3352e078c",
+        "rev": "596e2e3940e09b2abbeb03f75fa1828c57fcd72c",
         "type": "github"
       },
       "original": {
@@ -1268,11 +1268,11 @@
     },
     "nixpkgs-lib_2": {
       "locked": {
-        "lastModified": 1785031560,
-        "narHash": "sha256-OmshNvn2vupOFpYinLUu+1Dnpu4n7Q5N3ggGVNHpkUI=",
+        "lastModified": 1788057806,
+        "narHash": "sha256-DTQSMxzDWmT0zhguthvegnVkn7CFqGCv4IHCzk5ZUpM=",
         "owner": "nix-community",
         "repo": "nixpkgs.lib",
-        "rev": "0e79af5e3d4dcfcd676ab5ba3f95d2e3352e078c",
+        "rev": "596e2e3940e09b2abbeb03f75fa1828c57fcd72c",
         "type": "github"
       },
       "original": {
@@ -1283,11 +1283,11 @@
     },
     "nixpkgs-stable": {
       "locked": {
-        "lastModified": 1787962033,
-        "narHash": "sha256-u6z9VTZA4Kf3RkHQo9sQI7NI4Ei/uiU9vrMqOiwWP1Y=",
+        "lastModified": 1789114715,
+        "narHash": "sha256-ugpsyk3NM2s87vXfUiIIiibbJ4Pp0JPS5p/3mfs+q+c=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "c5c4a43b0e8056328ec4529f735cabdb8f1942bb",
+        "rev": "21a67dc470149f337cecafbe965d8d252a390518",
         "type": "github"
       },
       "original": {
@@ -1376,11 +1376,11 @@
     },
     "nixpkgs_4": {
       "locked": {
-        "lastModified": 1787736819,
-        "narHash": "sha256-cV5xEJJK3BvhU8rEd4mC9UsmDi5qscv/kzGPhBRC5WA=",
+        "lastModified": 1788404924,
+        "narHash": "sha256-lhEhY8X5EgkQ/eg6IFz4cc8jRuSYSvnxx1al7d1dvZ0=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "9fbb54b33e91ee4ca368e35a78e0613c720600b3",
+        "rev": "0968519e14f7aa7d3e9b389682bd74d2b51c8ce8",
         "type": "github"
       },
       "original": {
@@ -1392,11 +1392,11 @@
     },
     "nixpkgs_5": {
       "locked": {
-        "lastModified": 1787736819,
-        "narHash": "sha256-cV5xEJJK3BvhU8rEd4mC9UsmDi5qscv/kzGPhBRC5WA=",
+        "lastModified": 1789006805,
+        "narHash": "sha256-xB8mKMOx1IA9vTDNLmJZ6n4wCMq/cuWBBOzGCRnqxrU=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "9fbb54b33e91ee4ca368e35a78e0613c720600b3",
+        "rev": "8ce4ef6cb6f871616146b9fe26d2a5ae594e94fe",
         "type": "github"
       },
       "original": {
@@ -1440,11 +1440,11 @@
     },
     "nixpkgs_8": {
       "locked": {
-        "lastModified": 1788039129,
-        "narHash": "sha256-pa4Q0qErvCvzCaaUph7Sm37RhR4xvPrYI8Lgz6k85+A=",
+        "lastModified": 1789149629,
+        "narHash": "sha256-H6GwaZzZf+4npqv0tph94w9tZddSjFjmQrVsW0z78uk=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "d2f67949798825fe853f7c5d0492b8bf016d3f88",
+        "rev": "eaad089433ca2bb662274377d33df3d0e51ef28b",
         "type": "github"
       },
       "original": {
@@ -1456,11 +1456,11 @@
     },
     "nixpkgs_9": {
       "locked": {
-        "lastModified": 1787631388,
-        "narHash": "sha256-vMiXptXarfSdJb1Gkc+FYVOAibuBRj7qxGa8z68q1Uw=",
+        "lastModified": 1789073787,
+        "narHash": "sha256-xfX/toC2QV707s06GbP4II/TxYF0fNQj7s5/LClNDKc=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "ac6b2166e7a9375683b8e98f860f273222337b16",
+        "rev": "aff8a0b28396750446e5537a96461bc4facdb287",
         "type": "github"
       },
       "original": {
@@ -1477,11 +1477,11 @@
         "systems": "systems_5"
       },
       "locked": {
-        "lastModified": 1788190018,
-        "narHash": "sha256-59BAfH0txPAZrPBF4QJqwvUWppD+ICrcjA1LZAmPnrQ=",
+        "lastModified": 1789311313,
+        "narHash": "sha256-79l448oCbWZAuqewBd7hWby4+PLjI1Bnyrb/py8C2HA=",
         "owner": "nix-community",
         "repo": "nixvim",
-        "rev": "41844750e55f17b1385d5b09ca7ade5f11f49506",
+        "rev": "31e5c6a0937e2554aa5279719ff794655bfb0365",
         "type": "github"
       },
       "original": {
@@ -1521,11 +1521,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1788194662,
-        "narHash": "sha256-sKyIwEuzXbGDIxS/ZNBwIqLKDaPMHWD7p82kl19Xf3Q=",
+        "lastModified": 1789323837,
+        "narHash": "sha256-FCXzuwbIN6qyEGPn/Be+FkCPE683SHOCJ3mRlKipqvE=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "b532e223e8c3372fbd2a5c4df1cffc3fb7cdf1d4",
+        "rev": "02e124fc8de26c30e3116c67792ed309ad68c83f",
         "type": "github"
       },
       "original": {
@@ -1591,11 +1591,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1787424939,
-        "narHash": "sha256-O2tBn84NNuHrnqNVxx/XqsXwfYvS1YwBh+7CBnbCYsk=",
+        "lastModified": 1788267358,
+        "narHash": "sha256-nt+lUqYVpc9Y6JeMd2WmXzCDojasdadKo0mWcluvY2Y=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "809414f0cdadf82cf11b06c2b29ba9b3168b3297",
+        "rev": "27555e2624241fb116b49095df4caaee85a25691",
         "type": "github"
       },
       "original": {
@@ -1680,11 +1680,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1786629091,
-        "narHash": "sha256-gkig4nPi1CWc4Z50GBsjE4ygSE7hMpl/TwID2an2Cck=",
+        "lastModified": 1788914643,
+        "narHash": "sha256-4GuMPW90JSxXWDPUB9M+1m7fYbe3H0apOd86/zBQ2Kw=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "a8627b21b9107c5711c96b84f32a9a4b3d45295f",
+        "rev": "13616fff713a9f94055c66f15687ebdc17a335df",
         "type": "github"
       },
       "original": {
@@ -1856,11 +1856,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1780405768,
-        "narHash": "sha256-WhPHaupeq5yWP53anFH6vr/ZMQQtAYGtpgUhzqWx9Ws=",
+        "lastModified": 1789070158,
+        "narHash": "sha256-JN2RfhhOnitwWCKWfcpDq+elOpAA9PBX4AhxQsNU+UA=",
         "owner": "adriankarlen",
         "repo": "textfox",
-        "rev": "d6895da75f10fa17f1b637759aec3d84818b20e2",
+        "rev": "60a2700bc884f1c6de1d9100def058f2650acbd9",
         "type": "github"
       },
       "original": {
@@ -1983,11 +1983,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1786988229,
-        "narHash": "sha256-frEFLVRj8xXvBBDs44IRiqHo6R2PxsRpluygL7abjjI=",
+        "lastModified": 1788025068,
+        "narHash": "sha256-TBqronrrc/F2Ry/E37d/1TLldDLJDFNSwvJjgk+cXzU=",
         "owner": "hyprwm",
         "repo": "xdg-desktop-portal-hyprland",
-        "rev": "59d429bf45aed4e2209043c0c36565ad8e2859a5",
+        "rev": "ba31964ee42b56bcb0d3b78a64ead5d8a1c3c6f6",
         "type": "github"
       },
       "original": {
@@ -2016,11 +2016,11 @@
     "xwayland-satellite-unstable": {
       "flake": false,
       "locked": {
-        "lastModified": 1788035239,
-        "narHash": "sha256-ML+LVzuzFZPlCPzM/YEfDA2P9bEJJB8XlVKKYJbUPeU=",
+        "lastModified": 1788991189,
+        "narHash": "sha256-0TxfMgqW0/BLD4M942c5DCKYrtPvzsPJwvdcco4LQUM=",
         "owner": "Supreeeme",
         "repo": "xwayland-satellite",
-        "rev": "6d0de1cedde9dc02abb8877d1b04b90a8c22c3d0",
+        "rev": "add2795134593faafce60e404a0a75df68e9ee0c",
         "type": "github"
       },
       "original": {

home/christoph/nixinator/default.nix

@@ -142,10 +142,37 @@
       mcp = {
         enable = true;
         servers = {
+          context7 = {
+            command = "npx";
+            args = ["-y" "@upstash/context7-mcp"];
+            env = {
+              CONTEXT7_API_KEY.file = nixosConfig.sops.secrets.context7-api-key.path;
+            };
+          };
+          # deepwiki = {
+          #   # https://mcpservers.org/servers/devin/deepwiki
+          #   url = "https://mcp.deepwiki.com/mcp";
+          # };
+          # github = {
+          #   # https://mcpservers.org/servers/github-mcp-server
+          #   url = "https://api.githubcopilot.com/mcp/";
+          #   headers = {
+          #     Authorization = "Bearer ${input:github_mcp_pat}";
+          #   };
+          # };
           nixos = {
             command = "uvx";
             args = ["mcp-nixos"];
           };
+          obsidian = {
+            command = "uvx";
+            args = ["mcp-obsidian"];
+            env = {
+              OBSIDIAN_API_KEY.file = nixosConfig.sops.secrets.obsidian-rest-api-key.path;
+              OBSIDIAN_HOST = "127.0.0.1";
+              OBSIDIAN_PORT = "27124";
+            };
+          };
           svelte = {
             # claude mcp add -t stdio -s [scope] svelte -- npx -y @sveltejs/mcp
             command = "npx";
@@ -157,6 +184,10 @@
             command = "npx";
             args = ["-y" "shadcn@latest" "mcp"];
           };
+          zotero = {
+            command = "uvx";
+            args = ["zotero-mcp-server"];
+          };
         };
       };
 
@@ -250,19 +281,37 @@
             "*" = "ask";
             "bash" = {
               "*" = "ask";
-              "ls *" = "allow";
-              "find *" = "ask"; # Don't want find -exec
-              "file *" = "allow";
-              "wc *" = "allow";
-              "grep *" = "allow";
-              "rg *" = "allow";
-              "test *" = "allow";
-              "echo *" = "allow";
-              "which *" = "allow";
-              "pwd *" = "allow";
-              "dirname *" = "allow";
+              "awk *" = "ask"; # Can modify files
               "basename *" = "allow";
+              "cmp *" = "allow";
+              "cut *" = "allow";
+              "df *" = "allow";
+              "dirname *" = "allow";
+              "du *" = "allow";
+              "echo *" = "allow";
+              "fd *" = "ask"; # Can execute commands
+              "file *" = "allow";
+              "find *" = "ask"; # Can execute commands
+              "grep *" = "allow";
+              "head *" = "allow";
+              "ls *" = "allow";
+              "nl *" = "allow";
+              "od *" = "allow";
+              "pwd *" = "allow";
               "readlink *" = "allow";
+              "rg *" = "ask"; # Can execute commands
+              "sed *" = "ask"; # Can modify files
+              "sha256sum *" = "allow";
+              "sha512sum *" = "allow";
+              "sort *" = "ask"; # Can modify files
+              "stat *" = "allow";
+              "tail *" = "allow";
+              "test *" = "allow";
+              "tr *" = "allow";
+              "uniq *" = "ask"; # Can modify files
+              "wc *" = "allow";
+              "which *" = "allow";
+              "xargs *" = "ask"; # Can modify files
 
               "cat *.env" = "deny";
               "cat *.env.*" = "deny";
@@ -277,11 +326,19 @@
               "nix why-depends *" = "allow";
               "nix derivation show *" = "allow";
               "nix store ping *" = "allow";
-              "nix stire diff-closures *" = "allow";
+              "nix store diff-closures *" = "allow";
 
-              "git status *" = "allow";
-              "git log *" = "allow";
+              "git branch *" = "ask";
+              "git check-ignore *" = "allow";
               "git diff *" = "allow";
+              "git log *" = "allow";
+              "git ls-files *" = "allow";
+              "git ls-tree *" = "allow";
+              "git remote *" = "ask";
+              "git rev-list *" = "allow";
+              "git rev-parse *" = "allow";
+              "git stash *" = "ask";
+              "git status *" = "allow";
             };
             "external_directory" = {
               "/nix/store/**" = "allow";
@@ -305,8 +362,8 @@
             "question" = "allow";
           };
           plugin = [
-            "opencode-claude-auth@latest" # https://github.com/griffinmartin/opencode-claude-auth
-            "@tarquinen/opencode-dcp@latest" # better compacting
+            # "opencode-claude-auth@latest" # https://github.com/griffinmartin/opencode-claude-auth
+            # "@tarquinen/opencode-dcp@latest" # better compacting
             # "opencode-lmstudio@0.3.1"
             # "@slkiser/opencode-quota"
           ];
@@ -412,15 +469,11 @@
         kdePackages.kdenlive
         # davinci-resolve
         krita
-        # makemkv # TODO: Broken on 2026-08-31
+        makemkv
         lrcget
         # msty
-        # jellyfin-media-player # CVE, can't install
         jellyfin-desktop
         jellyfin-mpv-shim
-        # tidal-hifi
-        # tidal-dl-ng # TODO: Borked
-        # spotdl
         tiddl
         picard
         handbrake

home/homemodules/neovim/default.nix

@@ -124,6 +124,7 @@ in {
                 matplotlib
                 requests
                 pygments
+                pyyaml
               ]))
 
             (rWrapper.override {

home/homemodules/packages/default.nix

@@ -44,7 +44,7 @@ in {
           nix-search-tv # Search nixpkgs, nur, nixos options and homemanager options
           nix-tree # Browse the nix store sorted by size (gdu for closures)
 
-          # TODO: Broken on 2026-08-31 (also re-enable services after fixing!)
+          # TODO: Still broken on 2026-09-09
           # inputs.nps.packages.${pkgs.stdenv.hostPlatform.system}.default # Search nixpkgs
 
           # Video/Image/Audio utils
@@ -161,7 +161,7 @@ in {
           vlc
           audacity
           # ferdium
-          # feishin # electron :(
+          feishin # electron :(
           playerctl # Media player control
           czkawka-full # file deduplicator
           binaryninja-free # reverse engineering
@@ -169,7 +169,9 @@ in {
           # opencode-desktop
           lmstudio # TODO: Ollama
           claude-desktop
+          opencode-desktop
           upscayl
+          calibre
 
           # Office
           kdePackages.wacomtablet # For xournalpp/krita
@@ -184,7 +186,7 @@ in {
           # helvum # unmaintained
           crosspipe
           # nautilus # This is the worst file manager I've ever used
-          # font-manager # Previews fonts, but doesn't set them # TODO: Broken on 2026-08-31
+          font-manager # Previews fonts, but doesn't set them
           gparted
           resources
           # celluloid

home/homemodules/yazi/default.nix

@@ -65,9 +65,10 @@ in {
       '';
 
       # https://yazi-rs.github.io/docs/configuration/yazi
-      # "$n": The n-th selected file (1...n)
-      # "$@": All selected files
-      # "$0": The hovered file
+      # %sN: The N-th selected file (1...n)
+      # %s: All selected files
+      # %h: The hovered file (shell keybindings)
+      # File placeholders are shell-escaped by Yazi; do not quote them.
       settings = {
         mgr = {
           show_hidden = false;
@@ -80,41 +81,43 @@ in {
         opener = {
           play = [
             {
-              run = ''mpv "$@"'';
+              run = ''mpv %s'';
               orphan = true;
               desc = "Play selection with mpv";
             }
             {
-              run = ''vlc "$@"'';
+              run = ''vlc %s'';
               orphan = true;
               desc = "Play selection with vlc";
             }
           ];
           edit = [
             {
-              run = ''$EDITOR "$@"'';
+              run = ''$EDITOR %s'';
               block = true;
               desc = "Edit selection";
             }
           ];
           open = [
             {
-              run = ''xdg-open "$@"'';
-              desc = "Open selection with xdg-open";
+              run = ''xdg-open %s1'';
+              orphan = true;
+              desc = "Open first selected file with xdg-open";
             }
             {
-              run = ''imv "$@"'';
+              run = ''imv %s'';
+              orphan = true;
               desc = "Open selection with imv";
             }
             {
-              # TODO: For some reason, junction does not exit after choosing an application...
-              run = ''junction "$@"'';
+              run = ''junction %s'';
+              orphan = true;
               desc = "Open selection with junction";
             }
           ];
           extract = [
             {
-              run = ''ouch decompress -y "$@"'';
+              run = ''ouch decompress -y %s'';
               desc = "Extract selection";
             }
           ];
@@ -219,7 +222,7 @@ in {
               "<C-p>"
               "d"
             ];
-            run = ''shell -- ripdrag -a -n "$@"'';
+            run = ''shell --orphan -- ripdrag -a -n %s'';
             desc = "Drag & drop selection";
           }
           {
@@ -243,7 +246,7 @@ in {
               "<C-p>"
               "w"
             ];
-            run = ''wl-copy < "$0"'';
+            run = ''shell -- wl-copy < %h'';
             desc = "Copy hovered file contents using wl-copy";
           }
 
@@ -255,7 +258,7 @@ in {
           {
             on = "y";
             run = [
-              ''shell -- for path in "$@"; do echo "file://$path"; done | wl-copy -t text/uri-list''
+              ''shell -- for path in %s; do echo "file://$path"; done | wl-copy -t text/uri-list''
               "yank"
             ];
             desc = "Copy files to system clipboard on yank";

overlays/default.nix

@@ -29,36 +29,36 @@
     # Remove this after jetbrains.jdk builds again (nixpkgs issue 425328)
     # jetbrains.rider = pkgs-stable.jetbrains.rider;
 
-    jetbrains =
-      prev.jetbrains
-      // {
-        clion = prev.jetbrains.clion.overrideAttrs (oldAttrs: rec {
-          version = "261.22158.47"; # March 6, 2026
-
-          src = prev.fetchurl {
-            url = "https://download-cdn.jetbrains.com/cpp/CLion-${version}.tar.gz";
-
-            # hash = "sha256-h6tnemVnV1YEsvIndwrq2sMsRZYuvTWMU5oqj/hkjdY="; # 261.21849.6
-            hash = "sha256-FUHNRioJvjwOWN+FkXEr3+NWR+QVxaZUOkJ0egQkcCQ="; # 261.22158.47
-          };
-
-          # autoPatchelfIgnoreMissingDeps = [
-          #   "libcrypto.so.1.1"
-          #   "libssl.so.1.1"
-          # ];
-
-          postFixup = ''
-            # Patch python3.12 shared libs that the upstream glob (python3.8) misses
-            find $out -path '*/python3.*/lib-dynload/*.so' -exec patchelf \
-              --replace-needed libssl.so.1.1 libssl.so \
-              --replace-needed libcrypto.so.1.1 libcrypto.so \
-              --replace-needed libcrypt.so.1 libcrypt.so \
-              {} +
-
-            ${oldAttrs.postFixup or ""}
-          '';
-        });
-      };
+    # jetbrains =
+    #   prev.jetbrains
+    #   // {
+    #     clion = prev.jetbrains.clion.overrideAttrs (oldAttrs: rec {
+    #       version = "261.22158.47"; # March 6, 2026
+    #
+    #       src = prev.fetchurl {
+    #         url = "https://download-cdn.jetbrains.com/cpp/CLion-${version}.tar.gz";
+    #
+    #         # hash = "sha256-h6tnemVnV1YEsvIndwrq2sMsRZYuvTWMU5oqj/hkjdY="; # 261.21849.6
+    #         hash = "sha256-FUHNRioJvjwOWN+FkXEr3+NWR+QVxaZUOkJ0egQkcCQ="; # 261.22158.47
+    #       };
+    #
+    #       # autoPatchelfIgnoreMissingDeps = [
+    #       #   "libcrypto.so.1.1"
+    #       #   "libssl.so.1.1"
+    #       # ];
+    #
+    #       postFixup = ''
+    #         # Patch python3.12 shared libs that the upstream glob (python3.8) misses
+    #         find $out -path '*/python3.*/lib-dynload/*.so' -exec patchelf \
+    #           --replace-needed libssl.so.1.1 libssl.so \
+    #           --replace-needed libcrypto.so.1.1 libcrypto.so \
+    #           --replace-needed libcrypt.so.1 libcrypt.so \
+    #           {} +
+    #
+    #         ${oldAttrs.postFixup or ""}
+    #       '';
+    #     });
+    #   };
 
     # Now in Nixpkgs
     # neovide = prev.neovide.overrideAttrs (finalAttrs: prevAttrs: {
@@ -94,4 +94,10 @@
   };
 in
   # Composes a list of overlays and returns a single overlay function that combines them.
-  nixpkgs.lib.composeManyExtensions [additions modifications]
+  nixpkgs.lib.composeManyExtensions [
+    additions
+    modifications
+
+    # This is already a complete overlay with final: prev:, so it must be composed directly
+    (import ./latexminted.nix)
+  ]

overlays/latexminted.nix

@@ -0,0 +1,67 @@
+# Workaround for a broken `minted` in nixpkgs.
+#
+# The TeX Live snapshot in nixpkgs (2026-03-01) predates minted 3.8.0
+# (2026-03-04) and still ships 3.7.0 together with a bundled `latexminted`
+# 0.6.0 that does not run. Two independent replacements are needed:
+#
+#   - the run container: minted.sty from the upstream 3.8.0 release, which
+#     requires `latexminted` >= 0.7.0;
+#   - the bin container: `pkgs.latexminted` (0.7.1), which works.
+#
+# The LaTeX package and the Python executable are versioned separately, hence
+# the two unrelated version numbers.
+#
+# Delete this file once nixpkgs ships minted >= 3.8.0.
+final: prev: let
+  version = "3.8.0";
+
+  # Byte-identical to the CTAN 3.8.0 release, but pinned and already unpacked
+  # (CTAN only ships minted.dtx, which would have to be run through docstrip).
+  src = prev.fetchFromGitHub {
+    owner = "gpoore";
+    repo = "minted";
+    rev = "631f7e8e93f37d4f6e7767ff45692d53e7c7360d"; # "[latex] minted v3.8.0"
+    hash = "sha256-xUWScWRR62ikRxxz/YEauWLirvhsQPCcyE1O6cpWZRw=";
+  };
+
+  minted = prev.texlive.pkgs.minted;
+
+  # texlive.withPackages reads pname/tlType/tlDeps/... off the containers, so
+  # reuse the original metadata instead of reconstructing it.
+  container = name: container: script:
+    prev.runCommand "minted-${version}${name}" {
+      inherit (container) meta;
+      passthru =
+        container.passthru
+        // {
+          inherit version;
+        };
+    }
+    script;
+in {
+  texlive =
+    prev.texlive
+    // {
+      pkgs =
+        prev.texlive.pkgs
+        // {
+          minted =
+            minted
+            // {
+              tex = container "-tex" minted.tex ''
+                install -Dm444 -t "$out"/tex/latex/minted \
+                  ${src}/latex/minted/minted.sty \
+                  ${src}/latex/minted/minted1.sty \
+                  ${src}/latex/minted/minted2.sty
+              '';
+
+              # A bare symlink is enough: texlive.withPackages resolves and wraps
+              # everything under bin/ itself.
+              out = container "" minted.out ''
+                mkdir -p "$out"/bin
+                ln -s ${prev.lib.getExe prev.latexminted} "$out"/bin/latexminted
+              '';
+            };
+        };
+    };
+}

system/default.nix

@@ -394,9 +394,9 @@ with mylib.networking; {
     };
 
     # Trims the journal if too large
-    journald.extraConfig = ''
-      SystemMaxUse=50M
-    '';
+    journald.settings.Journal = {
+      SystemMaxUse = "50M";
+    };
 
     acpid.enable = true;
     dbus.enable = true;

system/nixinator/default.nix

@@ -139,6 +139,8 @@
     sops-nix.secrets.${username} = [
       "makemkv-app-key"
       "restic-repo-key"
+      "context7-api-key"
+      "obsidian-rest-api-key"
     ];
   };
 

system/services/immich.nix

@@ -7,7 +7,7 @@
 }: let
   vectorchordVersion = "0.4.2";
   pgvectorsVersion = "0.2.0";
-  immichVersion = "3.0.1-cuda";
+  immichVersion = "3.2.0-cuda";
 in {
   virtualisation.oci-containers.containers = {
     immich-database = {

system/services/jellyfin.nix

@@ -5,7 +5,7 @@
   pkgs,
   ...
 }: let
-  jellyfinVersion = "10.11.2";
+  jellyfinVersion = "version-12.1ubu2604";
 in {
   virtualisation.oci-containers.containers = {
     jellyfin = {

system/systemmodules/impermanence/default.nix

@@ -122,6 +122,7 @@ in {
             # The shit some applications add to ~/ without asking
             # (mkUDir ".android" m755) # Unity
             (mkUDir ".claude" m755)
+            (mkUDir ".codex" m755)
             # (mkUDir ".comfy" m755)
             (mkUDir ".docker" m755)
             # (mkUDir ".gradle" m755) # Unity
@@ -157,12 +158,14 @@ in {
 
             # Config
             # (mkUDir ".config/.android" m755) # Unity
+            (mkUDir ".config/ai.opencode.desktop" m755)
             # (mkUDir ".config/beekeeper-studio" m755)
             (mkUDir ".config/beets" m755)
             (mkUDir ".config/blender" m755)
             (mkUDir ".config/chromium" m755)
             (mkUDir ".config/Claude" m755) # Claude desktop
             (mkUDir ".config/Code" m755)
+            (mkUDir ".config/Codex" m755)
             (mkUDir ".config/Ferdium" m755)
             (mkUDir ".config/feishin" m755)
             (mkUDir ".config/fish/completions" m755)

system/systemmodules/mime/default.nix

@@ -21,7 +21,7 @@ in {
               ${mime.defaultTextEditor} = mime.textTypes;
               ${mime.defaultFileBrowser} = ["inode/directory"];
               ${mime.defaultWebBrowser} = mime.webTypes;
-              ${mime.defaultPdfViewer} = ["application/pdf"];
+              ${mime.defaultPdfViewer} = ["application/pdf" "application/epub+zip"];
               ${mime.defaultImageViewer} = mime.imageTypes;
 
               # If audio and video player are equal, we assign all types to the audio player,
@@ -75,6 +75,11 @@ in {
                 "chromium-browser.desktop"
                 "com.google.Chrome.desktop"
                 "firefox.desktop"
+                "org.onlyoffice.desktopeditors.desktop"
+                "calibre-ebook-edit.desktop"
+                "calibre-ebook-viewer.desktop"
+                "calibre-gui.desktop"
+                "calibre-lrfviewer.desktop"
               ];
               "text/plain" = [
                 "firefox.desktop"

system/systemmodules/sops-nix/secrets.yaml

@@ -11,6 +11,8 @@ jellyfin-password: ENC[AES256_GCM,data:ugfwgpkIiLY0O+m/UGnBB5AFPBkCcai+RQOkxiCSo
 #
 makemkv-app-key: ENC[AES256_GCM,data:/pTxr4q4ucJLx5VI8ySzOgd4g1s+6lcZNe4crxRmidTYrhJ0I6V3CIhm4wLC105W+Xka6HIZTqPn8SbqcMC4Dt3wSus=,iv:aYsGobD+Vl/VUNAHcAxQb7HEmLT8aXyKNOELgzvKDH4=,tag:xhnVb/ns6VZEnTuoUv9w5A==,type:str]
 restic-repo-key: ENC[AES256_GCM,data:lSFuhjbhdQq4cabAVFGQ4kuaJxb7EhXgBDlgoEQWJhs=,iv:7IhGDBYEwY1TwLvc/4DOkUBQ3eqSszZcKwnT7Lllfps=,tag:yJVlMi9X0W+Kh3zMkb0QuA==,type:str]
+context7-api-key: ENC[AES256_GCM,data:lZfrz5pBDybBkswgZM3jKLM9bdXOXeFUI9wFB8BJ5aLYqmf2oRHIJi/85w==,iv:MQYZKsTG++CYfpJret1WSv7+q2ZmONCDl4OwdRo+YUk=,tag:MrWBn3CKDUDZLLIFZWV0tA==,type:str]
+obsidian-rest-api-key: ENC[AES256_GCM,data:+CmQAX0AoSmCPMF9QL3NkWVArt7N0Ci9obHKpwQUPolcdsTnAsPMWu6GAWVvqs8Qmjz5Hk3gwM0YP2JdLEF0cw==,iv:U1SsPdiJIT7q+md1Q61Ro530s7vrl+XBgu+6/ffcrEQ=,tag:xrTRPve9DcumQjlr+aKsLg==,type:str]
 #
 #ENC[AES256_GCM,data:Raagjz1qPvXC,iv:OSWTKaIlmo1paU2ZZn20XMeZ2gdM52pHmVZ3m2ngCdI=,tag:bPCdvjOFjpxxkrwA7Mhl5Q==,type:comment]
 #
@@ -39,7 +41,7 @@ sops:
             FAbbvZZ/EdIk/njLEcayFN7B4ftTcD/f4XJZiyosilZnIkk76bMOHA==
             -----END AGE ENCRYPTED FILE-----
           recipient: age14ph8vrj657e7s35d60xehzuq46t9zd6pzcm6pw4jragzrvf6xs9s77usnm
-    lastmodified: "2026-07-02T19:27:51Z"
-    mac: ENC[AES256_GCM,data:IkpzDK4F1pEoGx1WyG8ksgMFuEa2h9KeF3m3PzM8KQkWo9iVt3jJn80jHEzWAm8riWIbo7fRkxyRetlSFTZf+MrByotgkWVVx6dMIVNYAOcg2IOK3s4NnX0L65MjbfWGQp/d27QzzEbd14WyklMWm2UO3ei82tF+UKYUEFJ2BWk=,iv:8LimsncylU+HhvVKNnjfyqZskZA72FQe92C4VrNWyQ0=,tag:L6CEno9m3ZncOskjZibq+Q==,type:str]
+    lastmodified: "2026-09-14T21:08:40Z"
+    mac: ENC[AES256_GCM,data:tfkmsJfWYV11ruw8fCUkJ2gWQAvQJ4Gmsz72LnmiCdlvzeo4x9iM268ZJnuaPRuv6BXLp2XGGA4CbqhfZbO6cRxAawVfbxY2IRSo1JWITIY8qxKLb07jDMpQu/JjJz7J5T556UEvOsW6HrK3d0xvNlJ4yQIuVCBjttKTdRu5g9Y=,iv:mV5i0xJGu6fnSNPLm9J3NDDgN+sB6iadue917UjR+oU=,tag:h/vaeQ02wK/qKANerWIywQ==,type:str]
     unencrypted_suffix: _unencrypted
-    version: 3.13.1
+    version: 3.13.3