Adds Rust/Go replacements for the day-to-day utilities and shadows four of
them with aliases. Only read-only commands are shadowed (cat, du, df, ps), so a
wrong flag costs a retype rather than data; rm, grep, find and sed keep their
originals and the replacements are reached by their own names.
The aliases land in .zshrc, so they apply to interactive zsh only -- scripts,
`sudo <cmd>` and anything exec'd by another program still get the real binary.
New on every host: dust, dysk, procs, trash-cli, doggo, xh, ouch, jnv, hexyl,
fq and tealdeer. dysk is used rather than duf, which is unmaintained upstream.
git gains difftastic behind a `git dft` alias. diff.external is deliberately
left unset so delta remains the renderer for git diff/show and for anything
parsing them.
The work box gains kubecolor, aliased over kubectl; it wraps the real kubectl
and drops colour when stdout is not a terminal, so pipes are unchanged.
home/README.md documents the alias map, the flag incompatibilities (including
the two that fail silently: dust -s is --apparent-size, and procs reads a bare
`aux` as a search keyword) and the rationale for what was left alone.
The CDI generator aborted with "failed to initialize NVML: Driver Not
Loaded", taking docker.service with it (requiredBy) and failing the
switch.
Two causes. The nixpkgs NVIDIA module only adds nvidia/nvidia_modeset/
nvidia_drm to boot.kernelModules when services.xserver.enable is set,
which is false on this Wayland-only host, so load them explicitly.
nvidia_uvm stays out: the module's modprobe softdep loads it once the GPU
device exists.
The generator also runs during activation, when a module rebuilt against a
new kernel cannot be loaded until reboot -- a guaranteed failure after
every kernel bump. Guard it with ConditionPathExists on
/proc/driver/nvidia/version so it skips rather than fails; the toolkit's
udev rule restarts it when the device appears, so the specs are generated
on the next boot.
The stock GPU has been replaced with a Quadro P400 (Pascal, GP108). Add
hosts/MacPro31/nvidia.nix:
- Driver branch 580 (nvidiaPackages.legacy_580), not the nixpkgs default
production branch (595.x). 580 is the last branch supporting
Maxwell/Pascal/Volta and is an LTS branch until Aug 2028; a newer one
does not drive this card.
- modesetting.enable for Wayland (nvidia-drm.modeset=1), open = false
(the open kernel modules need Turing or later), and sway
--unsupported-gpu, which wlroots requires with the proprietary driver.
- Docker with GPU access via CDI (hardware.nvidia-container-toolkit),
rather than the deprecated virtualisation.docker.enableNvidia runtime
wrapper. Containers run with --device=nvidia.com/gpu=all and must ship
a CUDA 12.x or older runtime: CUDA 13 dropped sm_61.
The driver packages are unfree, so allowlist them in unfreePackages; they
are not cached and the kernel module builds on the host.
Also declare features.cpu.microarchLevel = 1 for this machine: the
Harpertown Xeons have SSE4.1 but no SSE4.2/POPCNT, which switches off
Claude Code through the fleet-wide gate.
Claude Code runs on Node, whose V8 build requires SSE4.2 and POPCNT
(x86-64-v2). On an older x86_64 CPU it does not run, so it must not be
installed there in the first place.
Nix cannot detect the CPU (pure evaluation, hosts often built elsewhere),
so add features.cpu.microarchLevel: the psABI level a host declares about
itself, defaulting to 2. features.claudeCode.enable derives from it, and
home/claude.nix reads that through home-manager's osConfig and installs
nothing -- CLI, CLAUDE.md, output style or memory symlink -- when it is
off. Hosts without the option (Darwin, the standalone homeConfigurations)
keep the tool enabled.
An assertion fails evaluation if a host force-enables the flag below the
required level, so the mistake surfaces in nix flake check rather than as
an illegal-instruction crash on the machine.
The style asked for terseness in tonal terms only, so a dry register wrapped in
headers, tables and a full status recap each turn passed its self-check while
being exactly the verbose output the style exists to prevent.
Add explicit limits: a default length ceiling, headers only for four or more
items, report the delta rather than the accumulated state, and state a caveat
once. Replace the self-check with one that tests length and form rather than
tone.
The repo documents its own build and test commands, but assumes Windows and
PowerShell. This captures only the deltas that make them run on this machine:
dotnet from nixpkgs, artifactory credentials sourced per command because shell
state does not persist between tool calls, and a curl check that distinguishes
an auth failure from a code failure, since a rejected token surfaces as a
NuGet error that reads like a network fault.
Also records the two Docker Desktop leftovers that break the component test
environment, and the unleash registration a component test canary needs.
gcx stores its OAuth access and refresh tokens in the system keychain
unconditionally -- its config file keeps only opaque `keychain:gcx:v2:...`
handles -- and exposes no plaintext fallback. With nothing owning
org.freedesktop.secrets on this headless WSL box, `gcx login` authenticates
against Grafana and then dies writing its config: "The name is not activatable".
Add services.headlessSecretService: gnome-keyring as a systemd --user service,
unlocking the login keyring at start. home-manager's own services.gnome-keyring
does not fit here on two counts -- it is WantedBy graphical-session-pre.target,
which never activates without a desktop session, and it passes no --unlock, so
writes would block on a GUI prompter that does not exist.
Only the secrets component is started. The ssh component is deliberately off: it
would claim SSH_AUTH_SOCK and displace services.ssh-agent, breaking SSH auth and
signed commits.
The unlock password defaults to a random one generated on first activation under
$XDG_DATA_HOME. The passwordFile option is the seam for supplying it from an
agenix secret instead, once that lands.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
gcx is the Grafana Cloud CLI (dashboards, datasources, SLOs, synthetic
monitoring, alerts), used against the Citrix Grafana stack.
Pull it from nixpkgs-unstable via the existing overlay rather than the pinned
channel: 26.05 ships 0.2.14, which predates the stacks/contexts configuration
model and the agento11y commands, so the current tooling and docs do not apply
to it.
treefmt runs prettier over markdown in this repository and the CI
formatting check failed on the two preceding commits. Prettier prefers
underscores for emphasis and requires blank lines around fenced code
blocks.
No wording changes.
The previous commit required a ticket scope on every commit in every
repository. This repository has no Jira project, so the rule as written
would either block a commit or invite a fabricated WSP number.
Record the exception: in personal repositories the scope is the area of
the change (claude, deps, hosts) and conventional form still applies.
The ticket requirement is scoped to the Jira-backed work repositories
that enforce it in CI.
The git conventions memory said to match the repository's existing log
style. Several repositories (multicluster, core-services-cloud) have
histories dominated by bare "WSP-1234: summary" subjects, so matching
them produced commits that were not in conventional form. A related
failure was scope decay within a session: the first commit was correct
and later ones degraded to bare "test:" or "refactor:" subjects. Both
required commit history to be rebased by hand.
- Make "<type>(<TICKET-ID>): <summary>" mandatory on every commit and
explicitly override repository log style. Style matching now applies
to branch names only.
- Describe how to establish the real ticket ID (named in the request,
extracted from the branch, or taken from existing commits on the
branch) and require asking rather than guessing when none is
available. Replace the literal WSP-1234 examples with <TICKET-ID> so
the placeholder cannot be committed verbatim.
- Record scope decay across a session as a named failure mode.
- Cover merge commits, preferring rebase and requiring an explicit
message when a merge commit is unavoidable.
- Add a pre-push verification grep that must return no output.
- Note that a clean git log does not prove a subject was correct when
written, because rebasing replaces it; compare author and committer
dates instead.
Update the MEMORY.md index entry to match.
commitizen 4.13.9 ships per-Python-minor golden files for its CLI
regression tests. The py_3_13 golden was captured against an early 3.13
whose argparse did not quote invalid choices. CPython later backported
quoting into the 3.13.x line, and nixos-26.05 now ships 3.13.14, so the
golden no longer matches argparse's output:
-cz: error: ... invalid choice: 'x' (choose from init, commit, ...)
+cz: error: ... invalid choice: 'x' (choose from 'init', 'commit', ...)
This fails commitizen's checkPhase and breaks the home-manager closure.
The package itself is unaffected. Deselect just that test via an overlay
until nixpkgs updates the fixture (or the 3.13.x revert lands upstream).
VS Code on macOS resolves the shell environment at startup by running an
interactive login shell with stdout piped and no controlling terminal.
The order-200 auto-tmux block treated that probe as a normal interactive
shell and ran `exec tmux new-session`, which fails without a tty ("open
terminal failed: not a terminal") and exits non-zero. VS Code then reports
"Unable to resolve your shell environment: Unexpected exit code from
spawned shell (code 1)".
Gate the exec on a real terminal (-t 1) and skip it when
VSCODE_RESOLVING_ENVIRONMENT is set. Real terminals still land in tmux;
the integrated terminal was already exempt via TERM_PROGRAM.
Emma Thorpe
lyrathorpe
renovate-bot