emacs: add Dired sort menu

Picks up the new Sync view (recent-scrobbles feed + coverage timeline)
in scrobble-scrubber-app.

.claude/settings.local.json

@@ -4,7 +4,10 @@
       "Bash(rg:*)",
       "Bash(wmctrl:*)",
       "Bash(grep:*)",
-      "Bash(hyprctl:*)"
+      "Bash(hyprctl:*)",
+      "Bash(set_multiplexer_title 'dotfiles - Claude desktop icon fix')",
+      "Bash(nix eval *)",
+      "Read(//nix/store/xmgdj0242sc04hybgd3x6w0a7cw7kkwl-system-path/share/applications/**)"
     ],
     "deny": []
   }

.github/workflows/cachix.yml

@@ -1,15 +1,23 @@
-name: Build and Push Cachix (imalison-taffybar)
+name: Build and Push Cachix
 
 on:
   push:
     branches: [master]
     paths:
       - "dotfiles/config/taffybar/**"
+      - "dotfiles/config/hypr/**"
+      - "dotfiles/lib/bin/hypr_*"
+      - "dotfiles/lib/bin/hypr*"
+      - "nixos/**"
       - ".github/workflows/cachix.yml"
   pull_request:
     branches: [master]
     paths:
       - "dotfiles/config/taffybar/**"
+      - "dotfiles/config/hypr/**"
+      - "dotfiles/lib/bin/hypr_*"
+      - "dotfiles/lib/bin/hypr*"
+      - "nixos/**"
       - ".github/workflows/cachix.yml"
   workflow_dispatch: {}
 
@@ -34,6 +42,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          submodules: recursive
 
       - name: Free disk space
         run: |
@@ -87,3 +96,12 @@ jobs:
             --no-link \
             --print-build-logs \
             ./dotfiles/config/taffybar#defaultPackage.x86_64-linux
+
+      - name: Build Hyprland stuff
+        run: |
+          set -euxo pipefail
+          nix build \
+            --no-link \
+            --print-build-logs \
+            ./nixos#hyprland-stuff \
+            --override-input railbird-secrets path:./nixos/ci/railbird-secrets-stub

.gitignore

@@ -49,5 +49,33 @@ gotools
 
 # Local tool state
 /.playwright-cli/
+/nixos/.playwright-cli/
 /nixos/action-cache-dir/
 /dotfiles/config/taffybar/dbus-menu/
+
+# On nix-darwin, ~/.claude resolves into dotfiles/claude (HM out-of-store
+# symlink), so the claude-history repo and live Claude Code state are nested
+# inside this worktree there. Keep everything but the managed config out of
+# the dotfiles repo so chat history can never be committed here.
+/dotfiles/claude/*
+!/dotfiles/claude/CLAUDE.md
+!/dotfiles/claude/settings.json
+!/dotfiles/claude/settings.local.json
+!/dotfiles/claude/settings.local.json.example
+!/dotfiles/claude/agents/
+!/dotfiles/claude/agents/codex-delegator.md
+# Expose the shared agent skills library to Claude Code, which only reads
+# ~/.claude/skills. This is a symlink to ../agents/skills (the canonical
+# store, also surfaced at ~/.agents/skills); without the allowlist the
+# /dotfiles/claude/* rule above keeps it out of the flake source.
+!/dotfiles/claude/skills
+
+# Same story for Codex: ~/.codex resolves into dotfiles/codex on nix-darwin,
+# so the codex-history repo and live Codex state nest inside this worktree.
+# Allowlist only HM-managed configuration and custom agents.
+/dotfiles/codex/*
+!/dotfiles/codex/AGENTS.md
+!/dotfiles/codex/agents/
+!/dotfiles/codex/agents/claude-delegator.toml
+!/dotfiles/codex/config.toml
+!/dotfiles/codex/skills

README.org

@@ -31,9 +31,9 @@ published GitHub Pages site is still generated from that document.
 - Container and deployment configuration for personal org-agenda-api instances.
 
 This is not intended to be a generic starter dotfiles repo. Many modules assume
-my users, hostnames, hardware, SSH keys, secrets layout, and local checkout path
-=(~/dotfiles=). It is still useful as a reference for how the pieces fit
-together.
+my users, hostnames, hardware, SSH keys, secrets layout, and shared checkout
+path =/srv/dotfiles= on NixOS machines. It is still useful as a reference for
+how the pieces fit together.
 
 * Layout
 
@@ -65,7 +65,7 @@ The broad feature set is assembled by [[file:nixos/configuration.nix][nixos/conf
 Common workflow:
 
 #+begin_src sh
-cd ~/dotfiles/nixos
+cd /etc/nixos
 just switch
 #+end_src
 
@@ -77,7 +77,7 @@ directly.
 Useful variants:
 
 #+begin_src sh
-cd ~/dotfiles/nixos
+cd /etc/nixos
 just switch-remote
 just switch-local-taffybar
 just remote-switch <host>
@@ -86,8 +86,8 @@ just remote-switch <host>
 Build/check examples:
 
 #+begin_src sh
-nix flake check ~/dotfiles/nixos
-nix build ~/dotfiles/nixos#nixosConfigurations.strixi-minaj.config.system.build.toplevel
+nix flake check /etc/nixos
+nix build /etc/nixos#nixosConfigurations.strixi-minaj.config.system.build.toplevel
 #+end_src
 
 The flake also exposes package/check outputs for Hyprland plugins and a
@@ -102,7 +102,7 @@ nix-darwin, nix-homebrew, Home Manager, agenix, and the shared package list in
 Common workflow:
 
 #+begin_src sh
-cd ~/dotfiles/nix-darwin
+cd /srv/dotfiles/nix-darwin
 just switch
 #+end_src
 
@@ -177,7 +177,7 @@ behind nginx with ACME certificates and Podman.
 To enter the deployment shell:
 
 #+begin_src sh
-nix develop ~/dotfiles/nixos#org-agenda-api
+nix develop /etc/nixos#org-agenda-api
 #+end_src
 
 * Secrets
@@ -201,7 +201,9 @@ Some third-party or upstream projects are tracked as submodules:
 Clone with submodules when bootstrapping a new checkout:
 
 #+begin_src sh
-git clone --recurse-submodules git@github.com:IvanMalison/dotfiles.git ~/dotfiles
+git clone --recurse-submodules git@github.com:IvanMalison/dotfiles.git /tmp/dotfiles
+cd /tmp/dotfiles
+just setup-shared-dotfiles
 #+end_src
 
 This repo also contains project-local git worktrees under =.worktrees/= during

docs/shared-dotfiles.md

@@ -0,0 +1,33 @@
+# Shared Dotfiles Worktree
+
+This repo is intended to live at `/srv/dotfiles` on shared NixOS machines.
+Home Manager links user dotfiles to that shared checkout instead of to
+`$HOME/dotfiles`, so the links work consistently for every managed user.
+
+Set it up from any existing checkout:
+
+```sh
+just setup-shared-dotfiles
+```
+
+The setup command:
+
+- copies the current checkout to `/srv/dotfiles` when needed
+- makes the checkout readable by everyone
+- makes it writable by the `wheel` group
+- sets directory setgid/default ACLs so new files stay group-writable
+- configures Git for group sharing
+- creates `/etc/nixos -> /srv/dotfiles/nixos` when `/etc/nixos` is absent or already a symlink
+
+Use a different target or group when needed:
+
+```sh
+just setup-shared-dotfiles --target /srv/dotfiles --group wheel
+```
+
+If a machine has a real `/etc/nixos` directory and you want to replace it with
+the shared checkout symlink:
+
+```sh
+just setup-shared-dotfiles --force-etc-nixos
+```

docs/tiling-wm-experience.md

@@ -8,6 +8,65 @@ This document describes the tiling window manager experience I am targeting.
 - Important: expected for parity, but a rough first version is acceptable.
 - Nice: useful polish or compatibility.
 
+Priority describes the target experience, not implementation order. A first
+usable implementation may ship a smaller daily-driver subset as long as it does
+not choose designs that block required behavior later.
+
+## Implementation Phases
+
+Phase 1 should establish the core daily-driver loop:
+
+- Global numbered workspaces across monitors.
+- Dynamic equal-width columns and tabbed/fullscreen-style layout.
+- Directional window focus, directional movement, and directional monitor
+  focus.
+- Direct numbered workspace move/follow bindings.
+- Focus-follows-mouse and mouse-follows-focus.
+- Basic rofi launcher, terminal, close, reload, and session-exit bindings.
+- Basic status-bar workspace and focused-window state.
+
+Phase 2 should restore high-frequency workflow parity:
+
+- Per-monitor workspace history and history cycling.
+- Scratchpads.
+- Minimization.
+- Go-to-window, bring-window, and replace-window pickers.
+- Browser raise-or-spawn and class-aware gather workflows.
+- Status-bar window lists, class/title/icon metadata, and special-workspace
+  filtering.
+
+Phase 3 should add visual discovery and polish:
+
+- Visual window overview.
+- Visual workspace expose.
+- Overview go/bring/replace actions.
+- Smart gaps, smart borders, dimming, wallpaper, lock, screenshot, clipboard,
+  DDC/input switching, and other session utilities.
+
+## Terms and Semantics
+
+- First-class operation means the action has a direct command or binding. It
+  does not require opening a picker, manually moving focus, or chaining multiple
+  unrelated commands.
+- Preserving useful focus means the operation leaves keyboard focus in a
+  predictable place. Non-following moves keep focus on the source monitor or
+  source workspace. Following moves focus the moved window on its destination.
+- Directional focus uses visible window geometry when windows have distinct
+  rectangles. In tabbed or fullscreen-style layouts where geometry overlaps,
+  directional focus may use a stable logical order instead, but repeated
+  directional actions must cycle predictably through the windows.
+- Near-fullscreen scratchpads are centered floating windows large enough to
+  dominate the current monitor without taking compositor fullscreen state.
+- Robust scratchpad behavior means toggling a named scratchpad finds or
+  launches the intended app even when the app starts slowly, changes class or
+  title after launch, is minimized, or is currently on another workspace.
+- Approximate window position means enough geometry or ordering information for
+  status-bar window strips and expose-like previews. Pixel-perfect compositor
+  geometry is useful but not required.
+- Normal workspaces are the bounded user-facing workspaces. Special,
+  scratchpad, minimized, hidden, internal, and out-of-range workspaces are not
+  normal workspaces.
+
 ## Modifier Terminology
 
 - `Super` names the physical modifier key often labeled Windows, Command, GUI,
@@ -96,18 +155,10 @@ Required behavior:
 - Directional monitor focus is available.
 - Directional window movement between monitors is available.
 - Moving the focused window to an empty workspace on the monitor in a direction
-  remains required behavior, but it should not require an extra `Hyper`
-  modifier beyond `Shift`.
-- `Super+w/a/s/d` focuses windows directionally.
-- `Super+Shift+w/a/s/d` swaps or moves the focused window directionally.
-- `Super+Ctrl+w/a/s/d` moves the focused window to the monitor in that
-  direction while preserving useful focus.
-- `Super+Ctrl+Shift+w/a/s/d` moves the focused window to an empty workspace on
-  the monitor in that direction.
-- `Hyper+w/a/s/d` focuses monitors directionally.
-- `Hyper+Shift+w/a/s/d` swaps or moves windows between monitors directionally.
-- Directional focus in tabbed/fullscreen mode should cycle predictably through
-  windows even though their screen geometry overlaps.
+  is available.
+- Directional bindings are defined in the Binding Appendix. Required
+  directional actions must not depend on `Hyper+Ctrl`, because `Ctrl` may
+  already be part of the fallback `Hyper` chord.
 
 Important behavior:
 
@@ -195,6 +246,8 @@ Important behavior:
   minimized picker.
 - Window switchers hide internal windows.
 - Go/bring actions unminimize selected windows when needed.
+- Selecting a minimized window or hidden scratchpad from the visual window
+  overview recovers it onto the current workspace before focusing it.
 
 ## Scratchpads
 
@@ -207,9 +260,19 @@ Required behavior:
 - A named scratchpad exists for spotify.
 - A named scratchpad exists for transmission.
 - A named scratchpad exists for volume.
+- A named scratchpad exists for x.com.
 - Scratchpads appear near-fullscreen and centered by default.
+- Floating scratchpad behavior is a state of a window, not a property of its
+  application class. Floating any window at scratchpad geometry enters that
+  state; tiling it leaves that state.
+- Invoking a scratchpad replaces only another window currently in floating
+  scratchpad mode. Other floating windows are left alone.
+- Regular scratchpad targets can be tiled into the normal workspace when
+  desired, while retaining their shortcut association.
+- Summoning a scratchpad target with its shortcut always restores floating
+  scratchpad mode, even if the window was previously tiled.
 - Toggling a scratchpad deactivates fullscreen/tabbed state first.
-- Scratchpads are hidden from normal workspace and window listings.
+- Floating scratchpads are hidden from normal workspace and window listings.
 
 Important behavior:
 
@@ -329,8 +392,7 @@ Required behavior:
 - `Super+b` opens the bring-window picker.
 - `Super+Shift+b` opens the replace-window picker.
 - `Super+Shift+e` moves the focused window to the next empty workspace and
-  follows it. This is the target replacement for the older `Super+Shift+h`
-  binding.
+  follows it.
 - `Hyper+e` focuses the next empty workspace.
 - `Hyper+1` toggles inactive-window opacity reduction for the focused window.
 - `Hyper+5` swaps the current workspace with a selected workspace.
@@ -366,10 +428,10 @@ Required behavior:
 - `Super+Shift+w/a/s/d` swaps or moves the focused window directionally.
 - `Super+Ctrl+w/a/s/d` moves the focused window to the monitor in that
   direction while preserving useful focus.
+- `Super+Ctrl+Shift+w/a/s/d` moves the focused window to an empty workspace on
+  the monitor in that direction.
 - `Hyper+w/a/s/d` focuses monitors directionally.
 - `Hyper+Shift+w/a/s/d` swaps or moves windows between monitors directionally.
-- Moving the focused window to an empty workspace on the monitor in a direction
-  remains required behavior, but it should not require a `Hyper+Ctrl` binding.
 - `Super+z` focuses the next monitor.
 - `Super+Shift+z` moves the focused window to the next monitor.
 
@@ -387,13 +449,15 @@ Required behavior:
 
 Required behavior:
 
-- `Super+Alt+c` toggles the codex scratchpad.
+- `Super+Alt+c` toggles the primary AI scratchpad.
+- `Super+Alt+Shift+c` toggles the backup AI scratchpad.
 - `Super+Alt+e` toggles the element scratchpad.
 - `Super+Alt+h` toggles the htop scratchpad.
 - `Super+Alt+k` toggles the slack scratchpad.
 - `Super+Alt+s` toggles the spotify scratchpad.
 - `Super+Alt+t` toggles the transmission scratchpad.
 - `Super+Alt+v` toggles the volume scratchpad.
+- `Super+Alt+x` toggles the x.com scratchpad.
 
 Important behavior:
 
@@ -412,6 +476,8 @@ Required behavior:
 - `Hyper+p` opens the password picker with `rofi-pass`.
 - `Hyper+h` opens the screenshot tool with the compositor/session-appropriate
   screenshot command.
+- `Hyper+n` opens a Codex Desktop project picker and starts a new thread in
+  the selected saved project root.
 - `Hyper+c` opens the Codex launcher with `rofi_tmcodex.sh`.
 - `Hyper+Shift+c` opens the Codex launcher with `tmcodex resume`.
 - `Hyper+k` opens the process killer with `rofi_kill_process.sh`.
@@ -435,3 +501,8 @@ Important behavior:
   compositor-appropriate implementation.
 - Session-destructive operations use shifted or otherwise harder-to-hit
   variants.
+
+## Migration Notes
+
+- `Super+Shift+e` is the target replacement for the older `Super+Shift+h`
+  move-to-next-empty-workspace-and-follow binding.

dotfiles/agents/AGENTS.md

@@ -1,23 +1,46 @@
 # Agentic Session Preferences
 
-## Multiplexer session titling
-- If the `TMUX` or `ZELLIJ` environment variable is set, treat this chat as the controller for the current tmux or zellij session.
-- Use `set_multiplexer_title '<project> - <task>'` to update the title. The command detects tmux vs. zellij internally, prefers tmux when both are present, and no-ops outside a multiplexer.
-- Maintain a session/window/pane title that describes the durable purpose of the overall exchange.
-- Prefer automatic titling: infer a concise <task> from the current user request and the existing chat context without asking.
-- Choose holistic titles over granular turn summaries. The title should answer "what has this chat been for?" rather than describe the latest command, substep, clarification, or follow-up message.
-- Preserve the existing <task> when the new user turn is a continuation, status check, refinement, or implementation detail within the same broader objective.
-- Title format: "<project> - <task>".
-  - <project> is the basename of the current project directory.
-    - Prefer git repo root basename if available; otherwise use basename of the current working directory.
-  - <task> is a short, user-friendly description of what we are doing.
-- Ask for a short descriptive <task> only when the task is ambiguous or you are not confident in an inferred title.
-- When the broader objective changes substantially, update the <task> automatically if clear; otherwise ask for an updated <task>.
-- When a title is provided or updated, immediately run `set_multiplexer_title '<project> - <task>'`; do not call raw tmux or zellij rename commands unless debugging the helper itself.
-- For Claude Code sessions, a UserPromptSubmit hook may initialize titles automatically from the first substantive prompt, but it should not keep overwriting an established same-project title with the latest prompt.
+## Delegating coding work to subagents
+- When the primary model is Fable, strongly prefer delegating coding tasks to subagents (via the Agent tool). Fable should usually act as the orchestrator: planning, delegating, reviewing, and integrating. It may still work directly when delegation would add disproportionate overhead or the task cannot be usefully separated.
+- For other primary models, subagent delegation is optional rather than required. Use judgment: delegate when work is meaningfully parallelizable, independently scoped, or benefits from a separate implementation/review pass; work directly when that is simpler and more efficient.
+- The primary agent remains responsible for reviewing and integrating delegated work.
+- Whenever you pick a model tier for an agent, record a one-line justification for that choice (in your reasoning/CoT or a brief note in the delegating message) so the decision is auditable. Tie the justification to what the agent must actually decide at execution time, not just the topic's importance — a task specified tightly enough that the taste is already discharged doesn't need the stronger tier. If you can't articulate why the cheaper tier is insufficient, default to it.
+- These guidelines apply to writing, editing, and refactoring code. Non-coding work (reading, searching, planning, running commands, answering questions) does not need to be delegated.
 
-## Pane usage
-- Do not create extra panes or windows unless the user asks.
+## Model and effort selection
+
+Treat model selection and effort level as separate decisions. The following scores are subjective routing scores from 1 to 10; for cost, 10 means most expensive.
+
+| Model | Intelligence / judgment | Design sense | Cost | Primary role |
+| --- | ---: | ---: | ---: | --- |
+| Fable | 10 | 10 | 10 | Design planning, ambiguity, architecture, intuition, and the hardest work |
+| GPT-5.6 Sol | 9.5 | 8.5 | 4 | Default engineering model and best intelligence-to-cost choice |
+| Opus | 8.8 | 9.5 | 7 | Specialized design critique, UX writing, aesthetic review, and alternative perspectives |
+
+- Do not select models below GPT-5.6 Sol at medium effort. Terra, Sonnet, Luna, GPT Mini, and Haiku should not be used, including for subagents.
+- Default to Sol at high effort for most implementation, debugging, investigation, review, research, and agentic work.
+- Use Sol at extra-high effort for unusually difficult but reasonably well-specified engineering, including complex debugging, algorithms, migrations, concurrency, multi-system changes, and high-stakes correctness review.
+- Sol at medium effort is the minimum permitted configuration. Use it for bounded mechanical work, exploration, summaries, verification, and simple coordination.
+- Prefer Fable for most design planning, product architecture, UI/UX direction, API design, and work where ambiguity, intuition, or taste materially affects the result.
+- Use Fable at medium effort for ordinary design planning and at high effort for truly meaty, ambiguous, high-stakes, or long-horizon work.
+- Use Opus selectively as a specialist rather than the default design planner. Good uses include independent design critique, visual refinement, UX writing, naming, prose, and alternative aesthetic perspectives.
+- Do not automatically use low or max effort. Medium is the floor, high is the general default, and extra high is reserved for tasks where deeper reasoning is likely to affect correctness.
+- Difficulty alone does not require Fable. Prefer Sol at extra-high effort when execution is difficult but the desired outcome is clear; prefer Fable when determining the right outcome requires judgment or taste.
+
+## Cross-model delegation
+- Use cross-model delegation only when the user requests it or model diversity or an independent check would be useful; it is never mandatory.
+- Codex should use the `claude_delegator` agent only for the specialized Opus cases below. Claude should prefer the `codex-delegator` agent when delegating to Sol. Use `$cross-agent-delegation` or its `ask-claude` and `ask-codex` wrappers when direct invocation is simpler.
+- Permit at most one cross-model handoff and never recursively delegate. Keep the child read-only and advisory by default, with only one writer per worktree.
+- The parent agent owns review, verification, and integration of the child's output.
+- A Sol agent must never spawn, invoke, or delegate to Fable, including through cross-model wrappers or indirect subagent chains. If a task warrants Fable, select Fable as the primary model before beginning rather than allowing Sol to escalate itself.
+- Sol may delegate to other Sol agents at medium effort or higher. It may use Opus only for specialized design critique, UX writing, aesthetic review, or an independent design perspective.
+- Fable may delegate bounded execution, exploration, and verification work downward to Sol.
+
+## Sharing dev-server / preview links
+- When sharing a local server or preview URL, always prefer this machine's Tailscale address over `127.0.0.1`/`localhost`/LAN IPs, so the link opens from any device on the tailnet.
+- Get the address with `tailscale ip -4` (the `100.x.y.z` IP) or the MagicDNS hostname from `tailscale status`. Prefer the `100.x` IP when a server's `allowedHosts` might reject a hostname.
+- Start the server bound to all interfaces (e.g. vite's `--host 0.0.0.0` / a `dev:lan` script), not just localhost, or the Tailscale link won't connect. Verify reachability (`curl` the `100.x` URL) before handing it over.
+- Always start each dev/preview server on a new random high port (and pin it with `--strictPort` so it fails loudly instead of drifting). Never reuse a fixed port and never kill, restart, or otherwise shut down an already-running server — assume other sessions/users depend on it. Leave existing servers alone and just stand up your own.
 
 ## Git worktrees
 - Default to creating git worktrees under a project-local `.worktrees/` directory at the repository root.
@@ -25,8 +48,14 @@
 - Create `.worktrees/` if needed before running `git worktree add`.
 - Only use a non-`.worktrees/` location when the user explicitly asks for a different path.
 
+## GitHub pull requests
+- Default to creating pull requests as ready for review, not drafts.
+- Do not add a `[codex]` prefix or any other agent/tool prefix to pull request titles.
+- Create a draft pull request only when the user explicitly asks for a draft or when the remote platform requires draft status.
+- If using a helper, skill, or CLI wrapper that defaults to draft PRs, override that default before creating the PR.
+
 ## NixOS workflow
-- This system is managed with a Nix flake at `~/dotfiles/nixos`.
+- This system is managed with a Nix flake at `/srv/dotfiles/nixos`.
 - Use `just switch` from that directory for rebuilds instead of plain `nixos-rebuild`.
 - Host configs live under `machines/`; choose the appropriate host when needed.
 
@@ -60,23 +89,6 @@
 
 This is an org-mode repository containing personal task management, calendars, habits, and project tracking files. It serves as the central hub for Ivan's personal organization.
 
-## Available Tools
-
-### Chrome DevTools MCP
-A browser automation MCP is available for interacting with web pages. Use it to:
-- Navigate to websites and fill out forms
-- Take screenshots and snapshots of pages
-- Click elements, type text, and interact with web UIs
-- Read page content and extract information
-- Automate multi-step web workflows (booking, purchasing, form submission, etc.)
-
-### Google Workspace CLI (`gws`)
-The local `gws` CLI is available for Google Workspace operations. Use it to:
-- Search, read, and send Gmail messages
-- Manage Gmail labels and filters
-- Download attachments and inspect message payloads
-- Access Drive, Calendar, Docs, Sheets, and other Google Workspace APIs
-
 ## Credentials via `pass`
 
 Many credentials and personal details are stored in `pass` (the standard unix password manager). There are hundreds of entries covering a wide range of things, so always search before asking the user for information. Use `pass find <keyword>` to search and `pass show <entry>` to retrieve values.
@@ -97,8 +109,6 @@ Examples of what's stored:
 ## Guidelines
 
 - When filling out forms or making purchases, pull personal info from this file and credentials from `pass` rather than asking the user to provide them.
-- For web tasks, prefer using the Chrome DevTools MCP to automate interactions directly.
-- For email tasks, prefer using `gws gmail` over navigating to Gmail in the browser.
 - If a task requires a credential not found in `pass`, ask the user rather than guessing.
 - This repo's org files (gtd.org, calendar.org, habits.org, projects.org) contain task and scheduling data. The org-agenda-api skill/service can also be used to query agenda data programmatically.
 
@@ -124,3 +134,4 @@ Examples of what's stored:
   - `./project-guides/taffybar.md`
   - `./project-guides/railbird.md`
   - `./project-guides/org-emacs-packages.md`
+  - `./project-guides/subtr-actor-rocket-sense-rlru.md`

dotfiles/agents/project-guides/subtr-actor-rocket-sense-rlru.md

@@ -0,0 +1,51 @@
+# Subtr Actor / Rocket Sense / rlru constellation
+
+## Scope
+- Use this guide for requests involving Rocket League replay parsing, replay analytics, upload flows, or the `rlrml` projects around `subtr-actor`, `rocket-sense`, and `rlru`.
+- Primary anchors are `subtr-actor` for replay-domain logic, `rocket-sense` for the hosted analytics service, and `rlru` for local replay discovery/upload and PsyNet integration.
+
+## Related packages/projects (trigger list)
+- If any of these names are mentioned, open this guide for context.
+- `subtr-actor`: Rocket League replay processing core and source-of-truth replay domain model.
+- `rocket-sense`: replay analytics backend and React/Vite web app built on `subtr-actor`.
+- `rlru`: Rust-first Rocket League replay uploader and desktop client workspace.
+- `psynet`: Psyonix PsyNet client crate inside the `rlru` workspace.
+
+## Package inventory
+- `subtr-actor` repo packages:
+  - Rust crates: `subtr-actor`, `subtr-actor-tools`, `subtr-actor-bakkesmod`, `rl-replay-subtr-actor`.
+  - Python package/crate: `subtr-actor-py` / `subtr_actor`.
+  - npm packages: `@rlrml/subtr-actor`, `@rlrml/player`, `@rlrml/stats-player`.
+- `rocket-sense` repo packages:
+  - Rust crates: `rocket-sense-server`, `rocket-sense-db`, `rocket-sense-storage`.
+  - Web app package: `rocket-sense-web`.
+  - Vendored packages may appear under `vendor/subtr-actor`; prefer the standalone `subtr-actor` checkout for source-of-truth domain changes unless the user specifically asks about the vendored copy.
+- `rlru` repo packages:
+  - Rust crates: `rlru`, `psynet`, `rlru-dioxus`.
+  - Apps/binaries: `rlru` CLI and `rlru-dioxus` desktop client.
+
+## Symlink targets
+- `./project-links/subtr-actor` -> primary `subtr-actor` repo.
+- `./project-links/rocket-sense` -> primary `rocket-sense` repo.
+- `./project-links/rlru` -> primary `rlru` repo.
+
+## Discovery hints
+- Start from `~/Projects`.
+- Common local paths are:
+  - `~/Projects/subtr-actor`
+  - `~/Projects/rocket-sense`
+  - `~/Projects/rlru`
+- `rocket-sense` may vendor `subtr-actor` under `vendor/subtr-actor`; prefer the standalone `subtr-actor` checkout for source-of-truth replay-domain changes unless the user specifically asks about the vendored copy.
+
+## Read-first docs
+- `./project-links/subtr-actor/AGENTS.md`
+- `./project-links/subtr-actor/README.md`
+- `./project-links/rocket-sense/AGENTS.md`
+- `./project-links/rocket-sense/README.md`
+- `./project-links/rlru/README.md`
+
+## Notes
+- Treat `subtr-actor` as the source of truth for replay parsing, frame/state extraction, stats calculators, feature matrices, and JS/WASM replay-player data contracts.
+- Treat `rocket-sense` as the service/UI layer for replay hosting, metadata, processing state, auth, storage, OpenAPI, and deployed analytics workflows.
+- Treat `rlru` as the local uploader/client layer for replay discovery, account/auth state, upload destinations, Dioxus desktop UX, and the reusable `psynet` client.
+- For cross-repo work, check each repo's own `AGENTS.md`, `README.md`, and `justfile` before choosing commands.

dotfiles/agents/skills/cross-agent-delegation/SKILL.md

@@ -0,0 +1,19 @@
+---
+name: cross-agent-delegation
+description: Safely delegate between Codex and Claude through read-only CLI wrappers. Use when the user explicitly asks Codex or Claude to delegate to the other, or when a workflow explicitly calls for an independent cross-model second opinion.
+---
+
+# Cross-Agent Delegation
+
+Use the minimum permitted native driver agent when available. Invoke the wrapper directly when that is simpler:
+
+- Pipe a self-contained prompt to `ask-claude` or `ask-codex` on stdin.
+- Reserve `--base64 '<payload>'` for native driver agents as injection-safe transport. A driver must encode the complete task itself and never embed raw delegated task text in shell source.
+- Treat the returned plain text as advisory output; the wrappers are read-only and ephemeral.
+- Review and verify the output in the parent agent before using it.
+- Never include credentials, secrets, or unnecessary personal data in the prompt.
+- Permit at most one cross-model handoff. Never ask the child to invoke either CLI or delegate again.
+- A Sol caller may target Opus for specialized design work but must never target Fable. Choose Fable as the primary model before the task begins when Fable is warranted.
+- Keep one writer per worktree. Have the parent make any resulting edits.
+
+Environment variables documented in the scripts may override their conservative model, effort, timeout, turn, and budget defaults.

dotfiles/agents/skills/cross-agent-delegation/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Cross-agent delegation"
+  short_description: "Safely consult the other coding agent"
+  default_prompt: "Use $cross-agent-delegation to get an independent cross-model second opinion."

dotfiles/agents/skills/cross-agent-delegation/scripts/ask-claude

@@ -0,0 +1,151 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+input_mode=stdin
+base64_payload=
+case "$#" in
+  0) ;;
+  2)
+    if [ "$1" != "--base64" ]; then
+      echo "ask-claude: expected a prompt on stdin or --base64 <payload>" >&2
+      exit 2
+    fi
+    input_mode=base64
+    base64_payload=$2
+    ;;
+  *)
+    echo "ask-claude: expected a prompt on stdin or --base64 <payload>" >&2
+    exit 2
+    ;;
+esac
+
+if [ "$input_mode" = base64 ]; then
+  if [ -z "$base64_payload" ] || [[ ! "$base64_payload" =~ ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$ ]]; then
+    echo "ask-claude: invalid RFC4648 base64 payload or padding" >&2
+    exit 2
+  fi
+fi
+
+if [ "${CROSS_AGENT_DEPTH:-0}" != "0" ]; then
+  echo "ask-claude: recursive cross-agent delegation is not allowed" >&2
+  exit 2
+fi
+
+for required_command in claude timeout mktemp jq cat chmod rm; do
+  if ! command -v "$required_command" >/dev/null 2>&1; then
+    echo "ask-claude: required command not found: $required_command" >&2
+    exit 127
+  fi
+done
+
+if [ "$input_mode" = base64 ] && ! command -v base64 >/dev/null 2>&1; then
+  echo "ask-claude: required command not found: base64" >&2
+  exit 127
+fi
+
+export CROSS_AGENT_DEPTH=1
+
+timeout_value=${CROSS_AGENT_TIMEOUT:-10m}
+model=${CROSS_AGENT_CLAUDE_MODEL:-opus}
+effort=${CROSS_AGENT_CLAUDE_EFFORT:-medium}
+max_turns=${CROSS_AGENT_CLAUDE_MAX_TURNS:-4}
+max_budget_usd=${CROSS_AGENT_CLAUDE_MAX_BUDGET_USD:-0.25}
+
+case "$model" in
+  opus|claude-opus-*) ;;
+  *)
+    echo "ask-claude: cross-model delegation is restricted to Opus, not Fable or lower-tier models" >&2
+    exit 2
+    ;;
+esac
+
+case "$effort" in
+  medium|high|xhigh|max) ;;
+  *)
+    echo "ask-claude: effort must be medium or higher" >&2
+    exit 2
+    ;;
+esac
+
+umask 077
+tmp_dir=$(mktemp -d "${TMPDIR:-/tmp}/ask-claude.XXXXXX")
+cleanup() {
+  rm -rf -- "$tmp_dir"
+}
+trap cleanup EXIT
+trap 'exit 129' HUP
+trap 'exit 130' INT
+trap 'exit 143' TERM
+
+prompt_file="$tmp_dir/prompt"
+result_file="$tmp_dir/result.json"
+if [ "$input_mode" = base64 ]; then
+  if base64 --decode </dev/null >/dev/null 2>&1; then
+    base64_decode=(base64 --decode)
+  elif base64 -D </dev/null >/dev/null 2>&1; then
+    base64_decode=(base64 -D)
+  else
+    echo "ask-claude: base64 command supports neither --decode nor -D" >&2
+    exit 1
+  fi
+
+  if ! printf '%s' "$base64_payload" | "${base64_decode[@]}" >"$prompt_file"; then
+    echo "ask-claude: failed to decode base64 payload" >&2
+    exit 2
+  fi
+else
+  cat >"$prompt_file"
+fi
+chmod 600 "$prompt_file"
+
+if [ ! -s "$prompt_file" ]; then
+  echo "ask-claude: prompt on stdin must not be empty" >&2
+  exit 2
+fi
+
+guard_instruction='Act only as a read-only advisory child. Do not invoke Codex or Claude, directly or indirectly. Do not spawn, delegate to, or communicate with any other agent. Do not edit, create, delete, move, or rename files. Return only your analysis or recommendation to the parent.'
+
+set +e
+timeout --foreground "$timeout_value" \
+  claude -p \
+  --model "$model" \
+  --effort "$effort" \
+  --max-turns "$max_turns" \
+  --max-budget-usd "$max_budget_usd" \
+  --output-format json \
+  --permission-mode dontAsk \
+  --tools Read,Grep,Glob \
+  --allowedTools Read,Grep,Glob \
+  --no-session-persistence \
+  --no-chrome \
+  --append-system-prompt "$guard_instruction" \
+  <"$prompt_file" >"$result_file"
+status=$?
+set -e
+
+if [ "$status" -ne 0 ]; then
+  if [ "$status" -eq 124 ]; then
+    echo "ask-claude: timed out after $timeout_value" >&2
+  else
+    echo "ask-claude: claude exited with status $status" >&2
+  fi
+  exit "$status"
+fi
+
+if ! jq -e . "$result_file" >/dev/null 2>&1; then
+  echo "ask-claude: claude returned invalid JSON" >&2
+  exit 1
+fi
+
+if jq -e '(.is_error? // false) == true' "$result_file" >/dev/null; then
+  echo "ask-claude: claude reported an error" >&2
+  jq -r '.result? // empty' "$result_file" >&2
+  exit 1
+fi
+
+if ! jq -e '.result? | type == "string"' "$result_file" >/dev/null; then
+  echo "ask-claude: claude response does not contain a string result" >&2
+  exit 1
+fi
+
+jq -r '.result' "$result_file"

dotfiles/agents/skills/cross-agent-delegation/scripts/ask-codex

@@ -0,0 +1,139 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+input_mode=stdin
+base64_payload=
+case "$#" in
+  0) ;;
+  2)
+    if [ "$1" != "--base64" ]; then
+      echo "ask-codex: expected a prompt on stdin or --base64 <payload>" >&2
+      exit 2
+    fi
+    input_mode=base64
+    base64_payload=$2
+    ;;
+  *)
+    echo "ask-codex: expected a prompt on stdin or --base64 <payload>" >&2
+    exit 2
+    ;;
+esac
+
+if [ "$input_mode" = base64 ]; then
+  if [ -z "$base64_payload" ] || [[ ! "$base64_payload" =~ ^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$ ]]; then
+    echo "ask-codex: invalid RFC4648 base64 payload or padding" >&2
+    exit 2
+  fi
+fi
+
+if [ "${CROSS_AGENT_DEPTH:-0}" != "0" ]; then
+  echo "ask-codex: recursive cross-agent delegation is not allowed" >&2
+  exit 2
+fi
+
+for required_command in codex timeout mktemp cat chmod rm; do
+  if ! command -v "$required_command" >/dev/null 2>&1; then
+    echo "ask-codex: required command not found: $required_command" >&2
+    exit 127
+  fi
+done
+
+if [ "$input_mode" = base64 ] && ! command -v base64 >/dev/null 2>&1; then
+  echo "ask-codex: required command not found: base64" >&2
+  exit 127
+fi
+
+export CROSS_AGENT_DEPTH=1
+
+timeout_value=${CROSS_AGENT_TIMEOUT:-10m}
+model=${CROSS_AGENT_CODEX_MODEL:-gpt-5.6-sol}
+reasoning_effort=${CROSS_AGENT_CODEX_REASONING_EFFORT:-medium}
+
+case "$model" in
+  gpt-5.6-sol) ;;
+  *)
+    echo "ask-codex: cross-model delegation is restricted to GPT-5.6 Sol" >&2
+    exit 2
+    ;;
+esac
+
+case "$reasoning_effort" in
+  medium|high|xhigh|max) ;;
+  *)
+    echo "ask-codex: reasoning effort must be medium or higher" >&2
+    exit 2
+    ;;
+esac
+
+umask 077
+tmp_dir=$(mktemp -d "${TMPDIR:-/tmp}/ask-codex.XXXXXX")
+cleanup() {
+  rm -rf -- "$tmp_dir"
+}
+trap cleanup EXIT
+trap 'exit 129' HUP
+trap 'exit 130' INT
+trap 'exit 143' TERM
+
+prompt_file="$tmp_dir/prompt"
+result_file="$tmp_dir/final-message"
+if [ "$input_mode" = base64 ]; then
+  if base64 --decode </dev/null >/dev/null 2>&1; then
+    base64_decode=(base64 --decode)
+  elif base64 -D </dev/null >/dev/null 2>&1; then
+    base64_decode=(base64 -D)
+  else
+    echo "ask-codex: base64 command supports neither --decode nor -D" >&2
+    exit 1
+  fi
+
+  if ! printf '%s' "$base64_payload" | "${base64_decode[@]}" >"$prompt_file"; then
+    echo "ask-codex: failed to decode base64 payload" >&2
+    exit 2
+  fi
+else
+  cat >"$prompt_file"
+fi
+chmod 600 "$prompt_file"
+
+if [ ! -s "$prompt_file" ]; then
+  echo "ask-codex: prompt on stdin must not be empty" >&2
+  exit 2
+fi
+
+guard_instruction='Act only as a read-only advisory child. Do not invoke Codex or Claude, directly or indirectly. Do not spawn, delegate to, or communicate with any other agent. Do not edit, create, delete, move, or rename files. Return only your analysis or recommendation to the parent.'
+
+set +e
+timeout --foreground "$timeout_value" \
+  codex exec \
+  --ephemeral \
+  --ignore-user-config \
+  --disable multi_agent \
+  --skip-git-repo-check \
+  -C "$PWD" \
+  -s read-only \
+  -m "$model" \
+  -c "approval_policy='never'" \
+  -c "model_reasoning_effort='$reasoning_effort'" \
+  -c "developer_instructions=$guard_instruction" \
+  -o "$result_file" \
+  - \
+  <"$prompt_file" >/dev/null
+status=$?
+set -e
+
+if [ "$status" -ne 0 ]; then
+  if [ "$status" -eq 124 ]; then
+    echo "ask-codex: timed out after $timeout_value" >&2
+  else
+    echo "ask-codex: codex exited with status $status" >&2
+  fi
+  exit "$status"
+fi
+
+if [ ! -s "$result_file" ]; then
+  echo "ask-codex: codex did not produce a final message" >&2
+  exit 1
+fi
+
+cat "$result_file"

dotfiles/agents/skills/disk-space-assessment/SKILL.md

@@ -0,0 +1,145 @@
+---
+name: disk-space-assessment
+description: Measure and explain disk usage without deleting data, producing reusable compressed ncdu snapshots and an evidence-backed cleanup handoff. Use when disk is low, a filesystem is unexpectedly large, builds fail from space pressure, the user asks what is consuming space, or deeper iterative disk analysis is needed before cleanup.
+---
+
+# Disk Space Assessment
+
+Build a reproducible picture of disk usage. Stop at findings and proposed actions; use `disk-space-cleanup` when the user authorizes remediation.
+
+Read `references/ignore-paths.md` before scanning. Read `references/direnv-gc-roots.md` for Nix development-root attribution. Read `references/observed-heavy-hitters.md` when triaging this machine or interpreting familiar paths.
+
+## Required Artifact Contract
+
+Always create a reusable, timestamped `ncdu` export for every filesystem or major root assessed. Never make an interactive `ncdu` session, transient `/tmp` export, or `du` output the only record of an assessment.
+
+Always scan `/` with privilege. An unprivileged root scan is incomplete by design because it cannot measure private service state. Also scan each separately mounted pressured filesystem because `safe_ncdu -x` does not cross mount boundaries:
+
+```bash
+/run/wrappers/bin/sudo -n env HOME=/home/imalison safe_ncdu /
+safe_ncdu /home
+safe_ncdu /nix/store
+```
+
+`safe_ncdu` writes these durable artifacts under `~/.cache/ncdu/`:
+
+- `safe-ncdu-<root>-<timestamp>.json.zst`: compressed importable ncdu data
+- `<snapshot>.excludes`: exact exclusions used
+- `<snapshot>.meta`: scan root, timestamps, hostname, ncdu version, status, and artifact paths
+- `latest-<root>.json.zst` plus matching sidecar symlinks
+
+Keep timestamped files intact for iterative analysis. Report their absolute paths in the handoff. If a scan cannot finish, retain and report the failed manifest, mark the coverage gap, and use bounded probes as supplemental evidence.
+
+## Workflow
+
+1. Record filesystem pressure and topology.
+2. Run a privileged `/` scan and choose additional roots for separately mounted filesystems.
+3. Create reusable `safe_ncdu` snapshots before any cleanup.
+4. Analyze snapshots repeatedly with `top` and `open`; do not rescan for every question.
+5. Attribute special stores such as Nix separately.
+6. Produce findings, confidence, cleanup candidates, and artifact paths.
+
+## 1. Establish the Baseline
+
+```bash
+df -h /
+df -h /home
+df -h /nix
+findmnt -rn -o TARGET,FSTYPE,SOURCE,OPTIONS
+```
+
+Record used/free space and whether `/home`, `/nix`, or other large paths are separate mounts. Note active builds or services that may cause measurements to move during the assessment.
+
+## 2. Select Scan Roots
+
+Require one-filesystem coverage:
+
+- Always scan `/` with `/run/wrappers/bin/sudo -n env HOME=/home/imalison`; never substitute an unprivileged root scan. On NixOS, use the setuid wrapper explicitly because a non-setuid `sudo` store binary may appear earlier on `PATH`.
+- Scan separately mounted `/home` and `/nix/store` independently.
+- Add a focused root such as `~/Projects` when the first snapshot identifies it as dominant.
+- Treat a failed privileged root scan as an explicit coverage gap; do not silently fall back to an unprivileged scan.
+
+Inspect exclusions before a long scan:
+
+```bash
+safe_ncdu excludes /
+```
+
+Update `references/ignore-paths.md` and the implementation of `safe_ncdu` together when a newly discovered remote, recursive, or special mount needs a permanent exclusion.
+
+## 3. Create the Snapshots
+
+Run scans early enough that cleanup does not destroy the evidence:
+
+```bash
+/run/wrappers/bin/sudo -n env HOME=/home/imalison safe_ncdu /
+safe_ncdu /home
+safe_ncdu /nix/store
+```
+
+If `safe_ncdu` is unavailable, source or run `/srv/dotfiles/dotfiles/lib/functions/safe_ncdu`. If `ncdu` itself is missing, use Nix temporarily rather than substituting a non-reusable interactive scan.
+
+Do not store the privileged scan in root's home. Set `HOME=/home/imalison` so all artifacts remain together and are available to later sessions. Restore ownership to `imalison:users` if `sudo` creates root-owned snapshot artifacts.
+
+## 4. Analyze Iteratively
+
+Query the same export at multiple depths:
+
+```bash
+safe_ncdu top ~/.cache/ncdu/latest-root.json.zst 30
+safe_ncdu top ~/.cache/ncdu/latest-root.json.zst 30 /home/imalison
+safe_ncdu top ~/.cache/ncdu/latest-home.json.zst 30 /imalison/Projects
+safe_ncdu open ~/.cache/ncdu/latest-root.json.zst
+```
+
+Use `du` only for bounded confirmation, live-change checks, or paths missing from the snapshot:
+
+```bash
+timeout 30s du -xh --max-depth=1 "$HOME/.cache" 2>/dev/null | sort -h
+timeout 30s du -xh --max-depth=1 "$HOME/.local/share" 2>/dev/null | sort -h
+```
+
+Distinguish physical allocation from logical/apparent size, especially for sparse files, hardlinked Nix store data, copy-on-write storage, and container layers. Do not sum overlapping Nix closure sizes as reclaim estimates.
+
+## 5. Attribute Nix Store Usage
+
+When `/nix/store` is large, first quantify whether garbage collection can help:
+
+```bash
+nix_store_audit --top 30
+nix-store --gc --print-dead
+nix-store --gc --print-roots
+```
+
+Use `/srv/dotfiles/dotfiles/lib/functions/find_store_path_gc_roots` and `nix why-depends` to explain why a large path is retained. Inspect `.direnv/flake-profile-*`, `result*` symlinks, system generations, and current/booted system closures. Prefer `nix_store_audit` over an initial `du -sh /nix/store`, which is slow and does not explain retention.
+
+Always create a reusable `.direnv` GC-root audit artifact when direnv roots exist:
+
+```bash
+python /srv/dotfiles/dotfiles/agents/skills/disk-space-assessment/scripts/direnv_gc_roots_audit.py --top 30
+```
+
+This separates collectively direnv-only paths from paths retained by non-direnv roots and estimates each project's marginal uniquely retained footprint. Read `references/direnv-gc-roots.md` before interpreting or acting on the result.
+
+For very large `/nix/store` exports, use `safe_ncdu open` for read-only navigation and the Nix audit tools for noninteractive attribution. `safe_ncdu top` refuses snapshots over 128 MiB compressed by default because its jq parser may exhaust memory. Do not estimate physical store usage by summing raw ncdu JSON `dsize` fields; use `du -sx --block-size=1 /nix/store` when a hardlink-aware physical total is necessary.
+
+## Assessment Handoff
+
+Return:
+
+- Baseline filesystem usage and scan time.
+- Absolute paths to every snapshot, `.excludes`, and `.meta` artifact.
+- Coverage and privilege limitations.
+- Largest consumers with evidence from snapshot queries or store attribution.
+- Ranked cleanup candidates, expected reclaim range, risk, and whether data is rebuildable.
+- Volatile paths or active processes that cleanup must preserve.
+
+Do not delete, prune, garbage-collect, truncate, or mutate data in this skill.
+
+## Learning Loop
+
+After each assessment:
+
+1. Add new permanent scan exclusions to `references/ignore-paths.md` and `safe_ncdu`.
+2. Add stable machine-specific diagnostic knowledge to `references/observed-heavy-hitters.md`.
+3. Remove stale observations instead of accumulating an unbounded chronological log.

dotfiles/agents/skills/disk-space-assessment/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Disk Space Assessment"
+  short_description: "Build reusable evidence about disk usage"
+  default_prompt: "Use $disk-space-assessment to measure disk usage and create reusable ncdu snapshots."

dotfiles/agents/skills/disk-space-assessment/references/direnv-gc-roots.md

@@ -0,0 +1,50 @@
+# Auditing `.direnv` Nix GC Roots
+
+Audit direnv roots as a retention graph, not as a list of symlink sizes.
+
+## Required Audit
+
+Run:
+
+```bash
+python /srv/dotfiles/dotfiles/agents/skills/disk-space-assessment/scripts/direnv_gc_roots_audit.py --top 30
+```
+
+The script writes a timestamped JSON artifact under `~/.cache/ncdu/` and updates `latest-direnv-gc-roots.json`. Preserve the timestamped artifact with the related ncdu snapshots.
+
+## Interpret the Measures
+
+- **Raw roots**: every `.direnv` entry reported by `nix-store --gc --print-roots`; several may point to the same store target.
+- **Unique targets**: deduplicated store paths directly referenced by those roots.
+- **Project closure**: union of the transitive closures of one project's direnv targets.
+- **Collectively direnv-only**: direnv closure paths absent from the union of every observed non-direnv root closure. Removing all direnv roots could make these collectible.
+- **Outside non-direnv roots**: one project's closure after subtracting non-direnv-retained paths. This remains an upper bound because other direnv projects may share it.
+- **Marginal unique**: paths retained by exactly one direnv project and no non-direnv root. This is the best logical NAR-size estimate of what removing only that project's `.direnv` could make collectible.
+- **Shared direnv-only**: paths absent from non-direnv roots but retained by two or more direnv projects. Inspect the recorded retaining-project set to identify cleanup campaigns that must move together.
+
+Rank projects by marginal unique size, then inspect age, worktree state, active shells/builds, and project importance. Large closure size with near-zero marginal unique size indicates heavy sharing and little immediate benefit from removing that project alone. Use `top_shared_direnv_only_paths` in the JSON artifact to explain the gap between collectively direnv-only size and the sum of marginal project sizes.
+
+## Validate Candidates
+
+For a candidate project:
+
+```bash
+find <project>/.direnv -maxdepth 1 -type l -printf '%TY-%Tm-%Td %TH:%TM %p -> %l\n' | sort
+git -C <project> status --short
+git worktree list --porcelain
+ps aux | rg '<project>|direnv|nix develop|nix-shell'
+```
+
+Resolve a surprising retained store path with:
+
+```bash
+/srv/dotfiles/dotfiles/lib/functions/find_store_path_gc_roots /nix/store/<path>
+nix why-depends <profile-or-shell-target> /nix/store/<path>
+```
+
+## Limitations
+
+- NAR sizes are logical database sizes, not guaranteed physical bytes reclaimed.
+- The graph is a point-in-time view; shells and agents can add or replace roots during the run.
+- Nix paths may also be retained by roots created immediately after enumeration.
+- Run the audit immediately before and after any cleanup campaign and use actual `df` change as the final measure.

dotfiles/agents/skills/disk-space-assessment/references/ignore-paths.md

@@ -0,0 +1,21 @@
+# Ignore Paths for Disk Assessment
+
+Exclude these paths from `ncdu`/`du` scans because they are remote, recursive, separately mounted, or noisy.
+
+## Known Ignores
+
+- `$HOME/keybase`
+- `$HOME/.cache/keybase`
+- `$HOME/.local/share/keybase`
+- `$HOME/.config/keybase`
+- `/keybase`
+- `/var/lib/railbird`
+- `/run/user/*/doc` (FUSE portal mount; observed as `/run/user/1004/doc`)
+
+Discover candidates with:
+
+```bash
+findmnt -rn -o TARGET,FSTYPE,SOURCE | rg '(keybase|fuse|rclone|s3|railbird)'
+```
+
+When adding an ignore, update `/srv/dotfiles/dotfiles/lib/functions/safe_ncdu` in the same change so recorded snapshots actually use it.

dotfiles/agents/skills/disk-space-assessment/references/observed-heavy-hitters.md

@@ -0,0 +1,30 @@
+# Observed Disk-Usage Patterns
+
+Use these as hypotheses, not substitutes for a current snapshot.
+
+## Home and Project Trees
+
+- Rust `target/` directories under top-level projects, `.worktrees/*`, and `.claude/worktrees/*` have repeatedly consumed 25–100+ GiB in aggregate.
+- `~/.cache/uv`, `~/.cache/pypoetry`, browser caches, Spotify, and Gradle caches have each reached multi-GiB sizes.
+- `~/.local/share/picom/debug.log` has exceeded 15 GiB after verbose debugging or crashes.
+- Trash and active build outputs are high-yield candidates but require lifecycle and process checks.
+
+## Service State
+
+- `/var/lib/private/gitea-runner` has exceeded 50 GiB and is invisible to an unprivileged root scan.
+- `/var` has also been dominated by Docker, containers, Rancher, private state, and journals.
+- Root accounting must include large sparse or allocated files such as `/swapfile` and ext4 reserved blocks; these may differ from ordinary directory totals.
+
+## Nix Store
+
+- A large store may be almost entirely live. In a 2026-07-10 audit, the Nix DB held 413.0 GiB logical NAR size with zero dead paths.
+- The current system has directly pinned large ComfyUI model weights plus CUDA, GHC, Android, and Rust families.
+- Hundreds of `.direnv` GC-root entries have retained more than 100 GiB outside the current-system closure. `railbird-mobile`, Railbird backend, taffybar, rocket-sense, and keepbook dev shells have been notable roots.
+- `result*` symlinks, NixOS generations, and repo-local profiles can pin large closures.
+- Closure sizes overlap. Compute unions or uniquely collectible sets; never sum per-profile closure sizes as a reclaim estimate.
+- Physical `/nix/store` usage can be materially lower than logical NAR size after `nix-store --optimise` hardlinks duplicate files.
+
+## Volatility
+
+- Concurrent agent builds can move free space by tens of GiB during an assessment.
+- Severe pressure may surface as SQLite I/O errors, missing compiler diagnostics, or opaque build-script failures rather than an explicit `ENOSPC` message.

dotfiles/agents/skills/disk-space-assessment/scripts/direnv_gc_roots_audit.py

@@ -0,0 +1,216 @@
+#!/usr/bin/env python3
+
+import argparse
+import collections
+import datetime as dt
+import json
+import os
+import socket
+import sqlite3
+import subprocess
+from pathlib import Path
+
+
+DB_PATH = Path("/nix/var/nix/db/db.sqlite")
+
+
+def run(*args: str) -> str:
+    return subprocess.run(args, check=True, text=True, capture_output=True).stdout
+
+
+def chunks(values: list[str], size: int = 100):
+    for index in range(0, len(values), size):
+        yield values[index : index + size]
+
+
+def closure(targets: set[str]) -> set[str]:
+    result: set[str] = set()
+    existing = sorted(target for target in targets if Path(target).exists())
+    for batch in chunks(existing):
+        result.update(line for line in run("nix-store", "-qR", *batch).splitlines() if line)
+    return result
+
+
+def sizes(paths: set[str]) -> dict[str, int]:
+    if not paths:
+        return {}
+    connection = sqlite3.connect(f"file:{DB_PATH}?mode=ro", uri=True)
+    try:
+        result: dict[str, int] = {}
+        ordered = sorted(paths)
+        for batch in chunks(ordered, 900):
+            placeholders = ",".join("?" for _ in batch)
+            query = f"select path, narSize from ValidPaths where path in ({placeholders})"
+            result.update({path: int(size or 0) for path, size in connection.execute(query, batch)})
+        return result
+    finally:
+        connection.close()
+
+
+def human_size(value: int) -> str:
+    amount = float(value)
+    for unit in ("B", "KiB", "MiB", "GiB", "TiB"):
+        if amount < 1024 or unit == "TiB":
+            return f"{amount:.2f} {unit}"
+        amount /= 1024
+    raise AssertionError("unreachable")
+
+
+def parse_roots() -> list[tuple[str, str]]:
+    entries: list[tuple[str, str]] = []
+    for line in run("nix-store", "--gc", "--print-roots").splitlines():
+        if " -> " not in line:
+            continue
+        source, target = line.split(" -> ", 1)
+        source = source.strip('"')
+        target = target.strip('"')
+        if target.startswith("/nix/store/"):
+            entries.append((source, target))
+    return entries
+
+
+def project_for_root(source: str) -> str | None:
+    marker = "/.direnv/"
+    if marker not in source:
+        return None
+    return source.split(marker, 1)[0]
+
+
+def top_paths(paths: set[str], path_sizes: dict[str, int], limit: int) -> list[dict]:
+    ranked = sorted(paths, key=lambda path: path_sizes.get(path, 0), reverse=True)[:limit]
+    return [{"path": path, "nar_size_bytes": path_sizes.get(path, 0)} for path in ranked]
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description="Audit Nix paths retained by .direnv GC roots.")
+    parser.add_argument("--top", type=int, default=30, help="Projects and store paths to show.")
+    parser.add_argument("--output", help="JSON artifact path; defaults under ~/.cache/ncdu.")
+    args = parser.parse_args()
+    if args.top < 1:
+        parser.error("--top must be positive")
+    if not DB_PATH.is_file():
+        parser.error(f"Nix database not found: {DB_PATH}")
+
+    generated_at = dt.datetime.now().astimezone()
+    roots = parse_roots()
+    grouped: dict[str, list[tuple[str, str]]] = collections.defaultdict(list)
+    non_direnv_targets: set[str] = set()
+    for source, target in roots:
+        project = project_for_root(source)
+        if project is None:
+            non_direnv_targets.add(target)
+        else:
+            grouped[project].append((source, target))
+
+    project_closures = {
+        project: closure({target for _source, target in entries})
+        for project, entries in sorted(grouped.items())
+    }
+    non_direnv_closure = closure(non_direnv_targets)
+    all_direnv_closure = set().union(*project_closures.values()) if project_closures else set()
+    direnv_only = all_direnv_closure - non_direnv_closure
+
+    membership: collections.Counter[str] = collections.Counter()
+    for project_paths in project_closures.values():
+        membership.update(project_paths)
+
+    all_relevant = all_direnv_closure | non_direnv_closure
+    path_sizes = sizes(all_relevant)
+    total = lambda paths: sum(path_sizes.get(path, 0) for path in paths)
+
+    projects = []
+    for project, entries in grouped.items():
+        project_paths = project_closures[project]
+        outside_non_direnv = project_paths - non_direnv_closure
+        marginal = {path for path in outside_non_direnv if membership[path] == 1}
+        direnv_path = Path(project) / ".direnv"
+        mtime = None
+        age_days = None
+        if direnv_path.exists():
+            timestamp = direnv_path.stat().st_mtime
+            mtime = dt.datetime.fromtimestamp(timestamp).astimezone().isoformat()
+            age_days = (generated_at.timestamp() - timestamp) / 86400
+        projects.append(
+            {
+                "project": project,
+                "direnv_mtime": mtime,
+                "direnv_age_days": age_days,
+                "raw_root_count": len(entries),
+                "unique_target_count": len({target for _source, target in entries}),
+                "closure_path_count": len(project_paths),
+                "closure_nar_bytes": total(project_paths),
+                "outside_non_direnv_nar_bytes": total(outside_non_direnv),
+                "marginal_unique_nar_bytes": total(marginal),
+                "shared_with_other_direnv_nar_bytes": total(outside_non_direnv - marginal),
+                "roots": [{"source": source, "target": target} for source, target in entries],
+                "top_marginal_paths": top_paths(marginal, path_sizes, args.top),
+            }
+        )
+    projects.sort(key=lambda item: (item["marginal_unique_nar_bytes"], item["closure_nar_bytes"]), reverse=True)
+
+    shared_direnv_only = {path for path in direnv_only if membership[path] > 1}
+    shared_ranked = sorted(shared_direnv_only, key=lambda path: path_sizes.get(path, 0), reverse=True)[: args.top]
+    top_shared = [
+        {
+            "path": path,
+            "nar_size_bytes": path_sizes.get(path, 0),
+            "retained_by_projects": sorted(
+                project for project, project_paths in project_closures.items() if path in project_paths
+            ),
+        }
+        for path in shared_ranked
+    ]
+    marginal_total = sum(item["marginal_unique_nar_bytes"] for item in projects)
+
+    artifact = {
+        "format_version": 1,
+        "generated_at": generated_at.isoformat(),
+        "hostname": socket.gethostname(),
+        "measurement": "logical NAR size from the Nix database",
+        "raw_gc_root_count": len(roots),
+        "raw_direnv_root_count": sum(len(entries) for entries in grouped.values()),
+        "unique_direnv_target_count": len({target for entries in grouped.values() for _source, target in entries}),
+        "direnv_project_count": len(grouped),
+        "all_direnv_closure_nar_bytes": total(all_direnv_closure),
+        "collectively_direnv_only_nar_bytes": total(direnv_only),
+        "collectively_direnv_only_path_count": len(direnv_only),
+        "marginal_unique_total_nar_bytes": marginal_total,
+        "shared_direnv_only_nar_bytes": total(shared_direnv_only),
+        "top_collectively_direnv_only_paths": top_paths(direnv_only, path_sizes, args.top),
+        "top_shared_direnv_only_paths": top_shared,
+        "projects": projects,
+    }
+
+    out_dir = Path.home() / ".cache" / "ncdu"
+    out_dir.mkdir(parents=True, exist_ok=True)
+    output = Path(args.output).expanduser() if args.output else out_dir / f"direnv-gc-roots-{generated_at:%Y%m%d-%H%M%S}.json"
+    output = output.resolve()
+    output.parent.mkdir(parents=True, exist_ok=True)
+    temporary = output.with_suffix(output.suffix + ".tmp")
+    temporary.write_text(json.dumps(artifact, indent=2) + "\n")
+    os.replace(temporary, output)
+    latest = out_dir / "latest-direnv-gc-roots.json"
+    latest.unlink(missing_ok=True)
+    latest.symlink_to(output)
+
+    print(f"Direnv GC-root artifact: {output}")
+    print(f"Raw direnv roots: {artifact['raw_direnv_root_count']}")
+    print(f"Unique direnv targets: {artifact['unique_direnv_target_count']}")
+    print(f"Projects: {artifact['direnv_project_count']}")
+    print(f"All direnv closures: {human_size(artifact['all_direnv_closure_nar_bytes'])}")
+    print(f"Collectively direnv-only: {human_size(artifact['collectively_direnv_only_nar_bytes'])}")
+    print(f"Sum of project marginal unique: {human_size(artifact['marginal_unique_total_nar_bytes'])}")
+    print(f"Shared by multiple direnv projects only: {human_size(artifact['shared_direnv_only_nar_bytes'])}")
+    print()
+    print(f"{'MARGINAL':>11}  {'CLOSURE':>11}  {'AGE(d)':>8}  PROJECT")
+    for item in projects[: args.top]:
+        age = "?" if item["direnv_age_days"] is None else f"{item['direnv_age_days']:.1f}"
+        print(
+            f"{human_size(item['marginal_unique_nar_bytes']):>11}  "
+            f"{human_size(item['closure_nar_bytes']):>11}  {age:>8}  {item['project']}"
+        )
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

dotfiles/agents/skills/disk-space-cleanup/SKILL.md

@@ -1,67 +1,75 @@
 ---
 name: disk-space-cleanup
-description: Investigate and safely reclaim disk space on this machine, especially on NixOS systems with heavy Nix, Rust/Haskell, Docker, and Podman usage. Use when disk is low, builds fail with no-space errors, /nix/store appears unexpectedly large, or the user asks for easy cleanup wins without deleting important data.
+description: Safely reclaim disk space through reviewed, automated cleanup actions on this machine, especially for Nix, Rust build artifacts, containers, caches, and service state. Use when an assessment has identified cleanup candidates, the user asks to free space or automate remediation, or low-space recovery requires measured deletion of rebuildable data.
 ---
 
 # Disk Space Cleanup
 
-Reclaim disk space with a safety-first workflow: investigate first, run obvious low-risk cleanup wins, then do targeted analysis for larger opportunities.
+Act on evidence from `disk-space-assessment`. Automate guarded remediation, measure each action, and preserve user data and active work.
 
-Bundled helpers:
+Bundled resources:
 
-- `scripts/rust_target_dirs.py`: inventory and guarded deletion for explicit Rust `target/` directories
-- `references/rust-target-roots.txt`: machine-specific roots for Rust artifact scans
-- `references/ignore-paths.md`: machine-specific excludes for `du`/`ncdu`
+- `scripts/rust_target_dirs.py`: inventory and guarded deletion of explicit Cargo `target/` directories
+- `references/rust-target-roots.txt`: machine-specific Rust scan roots
+- `references/cleanup-patterns.md`: validated machine-specific remediation patterns
 
-## Execution Default
+## Required Input and Handoff
 
-- Start with non-destructive investigation and quick sizing.
-- Prioritize easy wins first (`nix-collect-garbage`, container prune, Cargo artifacts).
-- Propose destructive actions with expected impact before running them.
-- Run destructive actions only after confirmation, unless the user explicitly requests immediate execution of obvious wins.
-- Capture new reusable findings by updating this skill before finishing.
+Prefer a recent assessment containing baseline `df` output, reusable `ncdu` artifact paths, ranked candidates, and active-process caveats. If no reusable snapshot exists, use `disk-space-assessment` first. Even in an emergency, create a timestamped `safe_ncdu` snapshot of the affected filesystem or focused heavy root before deleting data whenever the scan can complete safely.
+
+Record before/after free space for every cleanup round. After material cleanup, create a new reusable snapshot through `disk-space-assessment` so the result can be compared without losing the pre-cleanup evidence.
+
+## Execution Policy
+
+- Present proposed actions with expected impact and risk before high-impact deletion.
+- Run destructive actions only after confirmation unless the user explicitly requests immediate cleanup of obvious rebuildable artifacts.
+- Prefer ownership-aware cleanup commands over raw recursive deletion.
+- Check for active builds, services, mounts, and open files before deleting their state.
+- Execute one category at a time and remeasure; stop when the user's space target is met.
+- Never treat overlapping Nix closure sizes as additive reclaim estimates.
+
+For Rust artifacts, helper-validated explicit directories literally named `target` are rebuildable. When the user asks to clean Rust targets, inventory them, validate with the helper, delete with `--yes`, and report reclaimed space without repeatedly asking for confirmation.
 
 ## Workflow
 
-1. Establish current pressure and biggest filesystems
-2. Run easy cleanup wins
-3. Inventory Rust build artifacts and clean the right kind of target
-4. Investigate remaining heavy directories with `ncdu`/`du`
-5. Investigate `/nix/store` roots when large toolchains still persist
-6. Summarize reclaimed space and next candidate actions
-7. Record new machine-specific ignore paths, Rust roots, or cleanup patterns in this skill
+1. Read the assessment and record current free space.
+2. Rank candidates by reclaim, reversibility, user impact, and confidence.
+3. Check active use and run dry-run modes where available.
+4. Execute the smallest sufficient cleanup round.
+5. Remeasure free space and verify affected services or builds.
+6. Produce a post-cleanup reusable snapshot after material changes.
+7. Report actions, actual reclaim, residual candidates, and artifact paths.
 
-## Step 1: Baseline
-
-Run a quick baseline before deleting anything:
+## Baseline and Activity Checks
 
 ```bash
 df -h /
 df -h /home
 df -h /nix
+ps aux | rg '(cargo|rustc|nix|docker|podman|gitea-runner)' || true
 ```
 
-Optionally add a quick home-level size snapshot:
-
-```bash
-du -xh --max-depth=1 "$HOME" 2>/dev/null | sort -h
-```
-
-## Step 2: Easy Wins
-
-Use these first when the user wants fast, low-effort reclaiming:
+Use `lsof`, service status, repository state, and worktree age when a candidate could be active. A directory that looks stale by mtime may still belong to a running build or concurrent agent.
+
+## Low-Risk Automated Wins
+
+Use dry-run or non-interactive privilege checks first:
 
 ```bash
+nix-collect-garbage -d
 sudo -n nix-collect-garbage -d
 sudo -n docker system prune -a
 sudo -n podman system prune -a
 ```
 
 Notes:
-- Add `--volumes` only when the user approves deleting unused volumes.
-- Re-check free space after each command to show impact.
-- Prefer `sudo -n` first so cleanup runs fail fast instead of hanging on password prompts.
-- If root is still tight after these, run app cache cleaners before proposing raw `rm -rf`:
+
+- Plain `nix-collect-garbage -d` may work through the daemon when `sudo` is unavailable.
+- Add container `--volumes` only with explicit approval to delete unused volumes.
+- Recheck `df` after each command.
+- Fail fast on unavailable privilege; do not hang on a password prompt.
+
+Use application-aware cache cleaners when the assessment identifies those caches:
 
 ```bash
 uv cache clean
@@ -70,187 +78,68 @@ yarn cache clean
 npm cache clean --force
 ```
 
-## Step 3: Rust Build Artifact Cleanup
+Expect dependency redownloads. Close applications before clearing their profile caches.
 
-Do not start with a blind `find ~ -name target` or with hard-coded roots that may miss worktrees. Inventory explicit `target/` directories first using the bundled helper and the machine-specific root list in `references/rust-target-roots.txt`.
+## Rust Build Artifacts
 
-Inventory the biggest candidates:
+Inventory across configured project and worktree roots:
 
 ```bash
-python /home/imalison/dotfiles/dotfiles/agents/skills/disk-space-cleanup/scripts/rust_target_dirs.py list --min-size 500M --limit 30
+python /srv/dotfiles/dotfiles/agents/skills/disk-space-cleanup/scripts/rust_target_dirs.py list --min-size 500M --limit 30
+python /srv/dotfiles/dotfiles/agents/skills/disk-space-cleanup/scripts/rust_target_dirs.py list --min-size 1G --older-than 14 --output tsv
 ```
 
-Focus on stale targets only:
-
-```bash
-python /home/imalison/dotfiles/dotfiles/agents/skills/disk-space-cleanup/scripts/rust_target_dirs.py list --min-size 1G --older-than 14 --output tsv
-```
-
-Use `cargo-sweep` when the repo is still active and you want age/toolchain-aware cleanup inside a workspace:
+For active workspaces, prefer age/toolchain-aware cleanup:
 
 ```bash
 nix run nixpkgs#cargo-sweep -- sweep -d -r -t 30 <workspace-root>
 nix run nixpkgs#cargo-sweep -- sweep -r -t 30 <workspace-root>
-nix run nixpkgs#cargo-sweep -- sweep -d -r -i <workspace-root>
-nix run nixpkgs#cargo-sweep -- sweep -r -i <workspace-root>
 ```
 
-Use direct `target/` deletion when inventory shows a discrete stale directory, especially for inactive repos or project-local worktrees. The helper only deletes explicit paths named `target` that are beneath configured roots and a Cargo project:
+For inactive repos and stale worktrees, use guarded direct deletion:
 
 ```bash
-python /home/imalison/dotfiles/dotfiles/agents/skills/disk-space-cleanup/scripts/rust_target_dirs.py delete /abs/path/to/target
-python /home/imalison/dotfiles/dotfiles/agents/skills/disk-space-cleanup/scripts/rust_target_dirs.py delete /abs/path/to/target --yes
+python /srv/dotfiles/dotfiles/agents/skills/disk-space-cleanup/scripts/rust_target_dirs.py delete /abs/path/to/target
+python /srv/dotfiles/dotfiles/agents/skills/disk-space-cleanup/scripts/rust_target_dirs.py delete /abs/path/to/target --yes
 ```
 
-Recommended sequence:
+The helper rejects symlinks, paths outside configured roots, non-`target` names, and directories without a Cargo project above them. Re-run inventory after each round. Preserve any target involved in an active Cargo/Rust process.
 
-1. Run `rust_target_dirs.py list` to see the largest `target/` directories across `~/Projects`, `~/org`, `~/dotfiles`, and other configured roots.
-2. For active repos, prefer `cargo-sweep` from the workspace root.
-3. For inactive repos, abandoned branches, and `.worktrees/*/target`, prefer guarded direct deletion of the explicit `target/` directory.
-4. Re-run the list command after each deletion round to show reclaimed space.
+If `python` is unavailable, run the helper with `nix run nixpkgs#python3 -- ...`. If a stale `~/.cargo/bin/cargo-sweep` shadows the NixOS binary, inspect `type -a cargo-sweep` before use.
 
-Machine-specific note:
+## Nix Remediation
 
-- Project-local `.worktrees/*/target` directories are common cleanup wins on this machine and are easy to miss with the old hard-coded workflow.
-- `cargo-sweep` is installed through the NixOS `code.nix` package set, but stale manually-installed binaries under `~/.cargo/bin` can shadow `/run/current-system/sw/bin/cargo-sweep`. If `cargo sweep` fails with a missing loader or `No such file or directory`, run `type -a cargo-sweep` and remove the stale `~/.cargo/bin/cargo-sweep` entry.
-- `nixos/imalison.nix` defines a daily user timer, `cargo-sweep-rust-targets.timer`, that runs `cargo-sweep sweep -r --hidden --maxsize 15GB` across `/home/imalison/Projects`, `/home/imalison/org`, and `/home/imalison/dotfiles`.
+Do not delete `/nix/store` paths directly. Act on retaining roots identified by the assessment:
 
-## Step 4: Investigation with `ncdu` and `du`
+- Remove stale project `.direnv` directories or `flake-profile-*` roots only after verifying the project/worktree is inactive.
+- Remove stale `result*` symlinks when the referenced build output no longer needs to remain rooted.
+- Remove obsolete system generations through Nix tooling.
+- Run garbage collection after roots are removed and measure actual free-space change.
+- Run `nix-store --optimise` when duplicate physical files are a demonstrated opportunity; it can be I/O intensive.
 
-Avoid mounted or remote filesystems when profiling space. Load ignore patterns from `references/ignore-paths.md`.
+Use `nix_store_audit --top 30` before and after a root-removal campaign. Treat its uniquely collectible estimates as planning evidence, not a promise of exact filesystem reclaim.
 
-Use one-filesystem scans to avoid crossing mounts:
+## Service and Cache Remediation
 
-```bash
-ncdu -x "$HOME"
-sudo ncdu -x /
-```
+Read `references/cleanup-patterns.md` before touching private service state, runner caches, logs, or ambiguous project artifacts. Preserve configuration, registration, credentials, SSH material, and active workspaces.
 
-When excluding known noisy mountpoints:
+Prefer service-aware sequences: stop the service, clean only validated cache/work paths, recreate required directories with correct ownership, restart, and verify health.
 
-```bash
-ncdu -x --exclude "$HOME/keybase" "$HOME"
-sudo ncdu -x --exclude /keybase --exclude /var/lib/railbird /
-```
-
-If `ncdu` is missing, use:
-
-```bash
-nix run nixpkgs#ncdu -- -x "$HOME"
-```
-
-For reusable, mount-safe snapshots on this machine, prefer the local wrapper:
-
-```bash
-safe_ncdu /
-sudo -n env HOME=/home/imalison safe_ncdu /
-safe_ncdu /nix/store
-safe_ncdu top ~/.cache/ncdu/latest-root.json.zst 30 /home/imalison
-safe_ncdu open ~/.cache/ncdu/latest-root.json.zst
-```
-
-`safe_ncdu` writes compressed ncdu exports under `~/.cache/ncdu`, records the exclude list beside the export, excludes mounted descendants of the scan root, and supports follow-up `top` queries without rescanning.
-
-For quick, non-blocking triage on very large trees, prefer bounded probes:
-
-```bash
-timeout 30s du -xh --max-depth=1 "$HOME/.cache" 2>/dev/null | sort -h
-timeout 30s du -xh --max-depth=1 "$HOME/.local/share" 2>/dev/null | sort -h
-```
-
-Machine-specific heavy hitters seen in practice:
-
-- `~/.cache/uv` can exceed 20G and is reclaimable with `uv cache clean`.
-- `~/.cache/pypoetry` can exceed 7G across artifacts, repository cache, and virtualenvs; inspect first, then use Poetry cache commands or targeted virtualenv removal.
-- `~/.cache/google-chrome` can exceed 8G across multiple Chrome profiles; close Chrome before clearing profile cache directories.
-- `~/.cache/spotify` can exceed 10G; treat as optional app-cache cleanup.
-- `~/.gradle` can exceed 8G, mostly under `caches/`; prefer Gradle-aware cleanup and expect dependency redownloads.
-- `~/.local/share/picom/debug.log` can grow past 15G when verbose picom debugging is enabled or crashes leave a stale log behind; if `picom` is not running, deleting or truncating the log is a high-yield low-risk win.
-- `~/.local/share/Trash` can exceed several GB; empty only with user approval.
-- `/var/lib/private/gitea-runner` can exceed 50G and is not visible to an unprivileged `ncdu /` scan; use `sudo -n env HOME=/home/imalison safe_ncdu /` when `/var` looks undercounted.
-  - Validated cleanup pattern: stop `gitea-runner-nix.service`, remove cache/work directories under `/var/lib/private/gitea-runner` (`.cache`, `.gradle`, `action-cache-dir`, `workspace`, stale nested `gitea-runner`, and nested `nix/.cache`/`nix/.local`), recreate `action-cache-dir`, `workspace`, and `.cache` owned by `gitea-runner:gitea-runner`, then restart the service.
-  - Preserve registration/config-like files such as `/var/lib/private/gitea-runner/nix/.runner`, `/var/lib/private/gitea-runner/nix/.labels`, `/var/lib/private/gitea-runner/.docker/config.json`, and SSH/Kube material.
-- `~/Projects/*/target` directories can dominate home usage. Recent example candidates included stale `target/` directories under `scrobble-scrubber`, `http-client-vcr`, `http-client`, `subtr-actor`, `http-types`, `subtr-actor-py`, `sdk`, and `async-h1`.
-
-## Step 5: `/nix/store` Deep Dive
-
-When `/nix/store` is still large after GC, inspect root causes instead of deleting random paths.
-
-Useful commands:
-
-```bash
-nix path-info -Sh /nix/store/* 2>/dev/null | sort -h | tail -n 50
-nix-store --gc --print-roots
-```
-
-Avoid `du -sh /nix/store` as a first diagnostic; it can be very slow on large stores.
-
-For repeated GHC/Rust toolchain copies:
-
-```bash
-nix path-info -Sh /nix/store/* 2>/dev/null | rg '(ghc|rustc|rust-std|cargo)'
-nix-store --gc --print-roots | rg '(ghc|rust)'
-```
-
-Resolve why a path is retained:
-
-```bash
-/home/imalison/dotfiles/dotfiles/lib/functions/find_store_path_gc_roots /nix/store/<store-path>
-nix why-depends <consumer-store-path> <dependency-store-path>
-```
-
-Common retention pattern on this machine:
-
-- Many `.direnv/flake-profile-*` symlinks under `~/Projects` and worktrees keep `nix-shell-env`/`ghc-shell-*` roots alive.
-- Old taffybar constellation repos under `~/Projects` can pin large Haskell closures through `.direnv` and `result` symlinks. Deleting `gtk-sni-tray`, `status-notifier-item`, `dbus-menu`, `dbus-hslogger`, and `gtk-strut` and then rerunning `nix-collect-garbage -d` reclaimed about 11G of store data in one validated run.
-- `find_store_path_gc_roots` is especially useful for proving GHC retention: many large `ghc-9.10.3-with-packages` paths are unique per project, while the base `ghc-9.10.3` and docs paths are shared.
-- NixOS system generations and a repo-root `nixos/result` symlink can pin multiple Android Studio and Android SDK versions. Check `/nix/var/nix/profiles/system-*-link`, `/run/current-system`, `/run/booted-system`, and `~/dotfiles/nixos/result` before assuming Android paths are pinned by project shells.
-- `~/Projects/railbird-mobile/.direnv/flake-profile-*` can pin large Android SDK system images. Removing stale direnv profiles there is a more targeted first step than deleting Android store paths directly.
-- For a repeatable `/nix/store` `ncdu` snapshot without driving the TUI, export and inspect it:
-
-```bash
-ncdu -0 -x -c -o /tmp/nix-store.ncdu.json.zst /nix/store
-zstdcat /tmp/nix-store.ncdu.json.zst | jq 'def sumd: if type=="array" then ((.[0].dsize // 0) + ([.[1:][] | sumd] | add // 0)) elif type=="object" then (.dsize // 0) else 0 end; .[3] | sumd'
-```
-
-- `nix-store --gc --print-dead` plus the Nix SQLite database is a fast way to estimate immediate GC wins before deleting anything:
-
-```bash
-nix-store --gc --print-dead > /tmp/nix-dead-paths.txt
-printf '%s\n' '.mode list' '.separator |' 'create temp table dead(path text);' \
-  '.import /tmp/nix-dead-paths.txt dead' \
-  'select count(*), sum(narSize) from ValidPaths join dead using(path);' \
-  | nix shell nixpkgs#sqlite --command sqlite3 /nix/var/nix/db/db.sqlite
-```
-
-- Quantify before acting:
-
-```bash
-find ~/Projects -type l -path '*/.direnv/flake-profile-*' | wc -l
-find ~/Projects -type d -name .direnv | wc -l
-nix-store --gc --print-roots | rg '/\\.direnv/flake-profile-' | awk -F' -> ' '{print $1 \"|\" $2}' \
-  | while IFS='|' read -r root target; do \
-      nix-store -qR \"$target\" | rg '^/nix/store/.+-ghc-[0-9]'; \
-    done | sort | uniq -c | sort -nr | head
-```
-
-- If counts are high and the projects are inactive, propose targeted `.direnv` cleanup for user confirmation.
+- 2026-07-10 `railbird-sf` incident: K3s reported `DiskPressure` even with tens of GiB free because its container `imagefs` shares `/`, kubelet image GC used the default 85% high-water mark, and the K3s config overrode only `nodefs` eviction thresholds. `crictl imagefsinfo` showed only ~677M of images, so image GC could not reclaim its requested ~149G and repeatedly evicted application pods. Set matching `imagefs.available` values alongside `nodefs.available` in `eviction-hard`, `eviction-soft`, and `eviction-soft-grace-period`; verify via K3s eviction-manager logs rather than trusting `df` alone.
 
 ## Safety Rules
 
-- Do not delete user files directly unless explicitly requested.
-- Prefer cleanup tools that understand ownership/metadata (`nix`, `docker`, `podman`, `cargo-sweep`) over `rm -rf`.
-- For Rust build artifacts, deleting an explicit directory literally named `target` is acceptable when it is discovered by the bundled helper; Cargo will rebuild it.
-- Present a concise “proposed actions” list before high-impact deletes.
-- If uncertain whether data is needed, stop at investigation and ask.
+- Do not delete user documents, source code, credentials, volumes, or unknown data without explicit approval.
+- Never delete a path solely because its name resembles a cache or build directory.
+- Do not clean targets used by running builds or concurrent agents.
+- Preserve dirty worktrees and registration/configuration files.
+- Stop when evidence is insufficient and return to `disk-space-assessment`.
 
-## Learning Loop (Required)
+## Learning Loop
 
-Treat this skill as a living playbook.
+After each cleanup:
 
-After each disk cleanup task:
-
-1. Add newly discovered mountpoints or directories to ignore in `references/ignore-paths.md`.
-2. Add newly discovered Rust repo roots in `references/rust-target-roots.txt`.
-3. Add validated command patterns or caveats discovered during the run to this `SKILL.md`.
-4. Keep instructions practical and machine-specific; remove stale guidance.
+1. Add stable, validated remediation knowledge to `references/cleanup-patterns.md`.
+2. Add new Rust repository roots to `references/rust-target-roots.txt`.
+3. Update assessment-side diagnostic patterns separately; do not turn this skill into a usage-history log.
+4. Remove stale guidance and keep automation guarded and reproducible.

dotfiles/agents/skills/disk-space-cleanup/agents/openai.yaml

@@ -1,3 +1,4 @@
 interface:
   display_name: "Disk Space Cleanup"
-  short_description: "Find safe disk-space wins on NixOS hosts"
+  short_description: "Automate safe, measured disk-space cleanup"
+  default_prompt: "Use $disk-space-cleanup to act on assessed disk-space candidates and verify reclaimed space."

dotfiles/agents/skills/disk-space-cleanup/references/cleanup-patterns.md

@@ -0,0 +1,46 @@
+# Validated Cleanup Patterns
+
+Use only after a current assessment confirms the path is significant.
+
+## Rust and Worktrees
+
+- Stale Cargo-backed targets in top-level projects, `.worktrees/*/target`, and `.claude/worktrees/*/target` have repeatedly reclaimed 25–100+ GiB.
+- Preserve targets used by active builds. Concurrent agents may recreate deleted outputs immediately.
+- `hypr-workspace-history/target` has been a removable Rust-style cache without a nearby `Cargo.toml`, so the guarded helper rejects it; inspect manually.
+- Preserve `~/Projects/Hyprland/src/layout/target`, which is source code rather than build output.
+- Clean registered git worktrees only after preserving dirty ones. Stale nixpkgs worktree `result` symlinks may pin Nix closures.
+
+## Nix Roots and Store Optimization
+
+- Removing conservatively stale `.direnv` roots followed by `nix-store --gc` has reclaimed about 15 GiB in a validated run.
+- With `auto-optimise-store = false`, `nix-store --optimise` once reclaimed about 60 GiB by hardlinking duplicate store files. Measure current conditions before assuming similar impact.
+- Old taffybar constellation repos and `railbird-mobile` direnv profiles have pinned large Haskell or Android closures.
+- NixOS generations and `/srv/dotfiles/nixos/result` can pin Android Studio and SDK versions.
+- A stale rustup toolchain can break `cargo-sweep --installed`; remove it only after confirming the toolchain is unusable and unwanted.
+
+## Gitea Runner
+
+For `/var/lib/private/gitea-runner`, a validated sequence is:
+
+1. Stop `gitea-runner-nix.service`.
+2. Remove only assessed cache/work directories such as `.cache`, `.gradle`, `action-cache-dir`, `workspace`, stale nested `gitea-runner`, and nested `nix/.cache` or `nix/.local`.
+3. Recreate `action-cache-dir`, `workspace`, and `.cache` owned by `gitea-runner:gitea-runner`.
+4. Restart the service and verify it.
+
+Preserve `.runner`, `.labels`, `.docker/config.json`, SSH material, Kubernetes material, and other registration/configuration state.
+
+## Logs and App Caches
+
+- Delete or truncate `~/.local/share/picom/debug.log` only after confirming picom is not actively writing it and correcting the verbose logging cause.
+- Empty Trash only with explicit approval.
+- Close Chrome, Spotify, Gradle daemons, and similar applications before targeted cache cleanup.
+
+## nix-homebrew Tap Recovery
+
+- On macOS, `darwin-rebuild switch` can report that an existing Homebrew tap directory is in the way when legacy `homebrew-cask` or `homebrew-core` checkouts predate nix-homebrew management.
+- For a root-owned cask tap, restore user ownership and run `brew untap --force homebrew/cask`.
+- Homebrew refuses to untap core. Move the legacy core checkout out of the expected tap path, then rerun the switch so nix-homebrew recreates both managed tap links. Verify the subsequent Homebrew bundle and Darwin activation complete.
+
+## Severe Pressure
+
+When only megabytes remain, run the smallest safe cleanup first. Build tools and SQLite may fail opaquely before reporting `ENOSPC`. Avoid commands that need substantial temporary disk space until a safe margin has been restored.

dotfiles/agents/skills/disk-space-cleanup/references/ignore-paths.md

@@ -1,31 +0,0 @@
-# Ignore Paths for Disk Investigation
-
-Use this file to track mountpoints or directories that should be excluded from `ncdu`/`du` scans because they are remote, special-purpose, or noisy.
-
-## Known Ignores
-
-- `$HOME/keybase`
-- `$HOME/.cache/keybase`
-- `$HOME/.local/share/keybase`
-- `$HOME/.config/keybase`
-- `/keybase`
-- `/var/lib/railbird`
-- `/run/user/*/doc` (FUSE portal mount; machine-specific example observed: `/run/user/1004/doc`)
-
-## Discovery Commands
-
-List mounted filesystems and spot special mounts:
-
-```bash
-findmnt -rn -o TARGET,FSTYPE,SOURCE
-```
-
-Target likely remote/special mounts:
-
-```bash
-findmnt -rn -o TARGET,FSTYPE,SOURCE | rg '(keybase|fuse|rclone|s3|railbird)'
-```
-
-## Maintenance Rule
-
-When a disk cleanup run encounters a mount or path that should be ignored in future runs, add it here immediately with a short note.

dotfiles/agents/skills/disk-space-cleanup/references/rust-target-roots.txt

@@ -3,4 +3,5 @@
 
 /home/imalison/Projects
 /home/imalison/org
-/home/imalison/dotfiles
+/home/imalison/.codex/worktrees
+/srv/dotfiles

dotfiles/agents/skills/email-unsubscribe-check/SKILL.md

@@ -57,7 +57,7 @@ Two approaches depending on the sender:
 
 **For emails with unsubscribe links:**
 - Read the email via `gws gmail` to find the unsubscribe URL (usually at bottom of email body)
-- Navigate to the URL with Chrome DevTools MCP
+- Navigate to the URL in the browser via the Chrome extension
 - Take a snapshot, find the confirmation button/checkbox
 - Click through to complete the unsubscribe
 - Verify the confirmation page

dotfiles/agents/skills/org-agenda-api-production/SKILL.md

@@ -7,7 +7,7 @@ description: Use when investigating production org-agenda-api state, testing end
 
 ## Overview
 
-Access the production org-agenda-api instance at https://colonelpanic-org-agenda.fly.dev/ for debugging, testing, or verification.
+Access the production org-agenda-api instance at https://org-agenda-api.rocket-sense.duckdns.org/ for debugging, testing, or verification.
 
 ## Credentials
 
@@ -20,10 +20,10 @@ Username is currently `imalison`.
 
 ## Quick Access with just
 
-This repo includes a `justfile` under `~/dotfiles/org-agenda-api` with pre-configured commands:
+This repo includes a `justfile` under `/srv/dotfiles/org-agenda-api` with pre-configured commands:
 
 ```bash
-cd ~/dotfiles/org-agenda-api
+cd /srv/dotfiles/org-agenda-api
 just health
 just get-all-todos
 just get-todays-agenda

dotfiles/agents/skills/org-agenda-api/SKILL.md

@@ -11,16 +11,16 @@ HTTP API for org-mode agenda data. Use this skill when you need to query or modi
 
 Get credentials from pass:
 ```bash
-pass show colonelpanic-org-agenda.fly.dev
+pass show org-agenda-api-imalison
 ```
 
-Returns: password on first line, then `user:` and `url:` fields.
+Returns: password on first line. The username is currently `imalison`.
 
 **Note:** The `url` field in pass may be outdated. Use the base URL below.
 
 ## Base URL
 
-`https://colonelpanic-org-agenda.fly.dev`
+`https://org-agenda-api.rocket-sense.duckdns.org`
 
 All requests use Basic Auth with the credentials from pass.
 

dotfiles/agents/skills/password-reset/SKILL.md

@@ -1,19 +1,19 @@
 ---
 name: password-reset
-description: Use when the user wants to reset or rotate a website or service password end-to-end, including finding the right `pass` entry, generating a new password with `xkcdpassgen`, retrieving reset emails through `gws gmail` or a local mail CLI, completing the reset in the browser with Chrome DevTools MCP, and updating the password store safely without losing entry metadata.
+description: Use when the user wants to reset or rotate a website or service password end-to-end, including finding the right `pass` entry, generating a new password with `xkcdpassgen`, retrieving reset emails through `gws gmail` or a local mail CLI, completing the reset in the browser via the Chrome extension, and updating the password store safely without losing entry metadata.
 ---
 
 # Password Reset
 
 ## Overview
 
-Handle password resets end-to-end. Prefer `gws gmail` for reset-email retrieval, Chrome DevTools MCP for website interaction, and the local `xkcdpassgen` helper for password generation.
+Handle password resets end-to-end. Prefer `gws gmail` for reset-email retrieval, the Chrome browser extension for website interaction, and the local `xkcdpassgen` helper for password generation.
 
 ## Tool Priorities
 
 - Prefer `gws gmail` over opening Gmail in the browser.
 - If `gws` is unavailable, use an installed Gmail CLI or IMAP-based mail tool if one exists locally. Inspect the environment first instead of guessing command names.
-- Prefer Chrome DevTools MCP for all browser interaction.
+- Prefer the Chrome browser extension for all browser interaction.
 - Use `pass find` and `pass show` before asking the user for credentials or account details.
 
 ## Password Generation
@@ -73,14 +73,14 @@ If the site rejects the password because of policy constraints, keep the canonic
 2. Run `pass find <service>` and inspect likely matches with `pass show`.
 3. Capture existing metadata before generating a new password.
 4. Generate the candidate password into a temporary `pass` entry with `xkcdpassgen`.
-5. Start the reset flow in Chrome DevTools MCP:
+5. Start the reset flow in the browser via the Chrome extension:
    - navigate to the login or account page
    - use the site's "forgot password" flow, or
    - sign in and navigate to security settings if the user asked for a rotation rather than a reset
 6. Use `gws gmail` to retrieve the reset email when needed:
    - search recent mail by sender domain, subject, or reset-related keywords
    - open the message and extract the reset link
-   - navigate to that link in Chrome DevTools MCP
+   - navigate to that link in the browser via the Chrome extension
 7. Fill the new password from the temporary `pass` entry and complete the form.
 8. Verify success:
    - confirmation page, or
@@ -99,14 +99,14 @@ If `gws` is unavailable, use an installed Gmail CLI or local mail helper only as
 
 ## Browser Guidance
 
-Use Chrome DevTools MCP to complete the reset flow directly:
+Use the Chrome browser extension to complete the reset flow directly:
 
 - navigate to the reset or security page
 - take snapshots to identify the relevant inputs and buttons
 - click, fill, and submit through the site UI
 - verify the success state before updating the canonical `pass` entry
 
-Prefer MCP interaction over describing steps for the user to perform manually.
+Prefer driving the browser directly over describing steps for the user to perform manually.
 
 ## Credentials And Account Data
 

dotfiles/agents/skills/taffybar-nixos-flake-chain/SKILL.md

@@ -46,7 +46,7 @@ cd ~/.config/taffybar/taffybar && nix flake update <pkg>
 cd ~/.config/taffybar && nix flake update <pkg> taffybar
 
 # Top:
-cd ~/dotfiles/nixos && nix flake update imalison-taffybar
+cd /srv/dotfiles/nixos && nix flake update imalison-taffybar
 ```
 
 Not every change requires touching all three layers. Think about which flake.lock files actually contain stale references:
@@ -58,7 +58,7 @@ Not every change requires touching all three layers. Think about which flake.loc
 ## Rebuilding
 
 ```bash
-cd ~/dotfiles/nixos && just switch
+cd /srv/dotfiles/nixos && just switch
 ```
 
 If taffybar seems stale after a rebuild, check whether the flake.lock at each layer actually points at the expected revision — a missed cascade step is the usual cause.

dotfiles/claude/.gitignore

@@ -1,6 +0,0 @@
-*
-!.gitignore
-!CLAUDE.md
-!settings.json
-!settings.local.json
-!settings.local.json.example

dotfiles/claude/CLAUDE.md

@@ -1 +0,0 @@
-../agents/AGENTS.md

dotfiles/claude/CLAUDE.md

@@ -0,0 +1 @@
+@~/.agents/AGENTS.md

dotfiles/claude/agents/codex-delegator.md

@@ -0,0 +1,16 @@
+---
+name: codex-delegator
+description: Ask Codex for one independent read-only opinion
+tools: Bash
+model: opus
+effort: medium
+maxTurns: 3
+---
+
+UTF-8 base64-encode the complete task yourself without using a tool. Verify that the payload contains only `A-Z`, `a-z`, `0-9`, `+`, `/`, and valid terminal `=` padding. Then make exactly one Bash tool call:
+
+```bash
+ask-codex --base64 '<payload>'
+```
+
+Never place raw task text in shell source. Return the command's stdout verbatim. Do not investigate, reason about the task, edit files, call any other command, or call or delegate to any other agent.

dotfiles/claude/settings.json

@@ -17,5 +17,7 @@
   },
   "effortLevel": "high",
   "skipDangerousModePermissionPrompt": true,
-  "remoteControlAtStartup": true
+  "remoteControlAtStartup": true,
+  "inputNeededNotifEnabled": true,
+  "agentPushNotifEnabled": true
 }

dotfiles/claude/settings.local.json

@@ -15,13 +15,6 @@
           "set -euo pipefail; export GITEA_BASE_URL='https://dev.railbird.ai'; export GITEA_ACCESS_TOKEN=\"$(pass show claude-mcp/gitea-access-token | head -1)\"; exec docker run -i --rm -e GITEA_ACCESS_TOKEN -e GITEA_BASE_URL docker.gitea.com/gitea-mcp-server"
         ]
       },
-      "chrome-devtools": {
-        "command": "npx",
-        "args": [
-          "chrome-devtools-mcp@latest",
-          "--auto-connect"
-        ]
-      },
       "imap-email": {
         "command": "bash",
         "args": [
@@ -32,7 +25,6 @@
     }
   },
   "enabledMcpjsonServers": [
-    "chrome-devtools",
     "imap-email"
   ],
   "enableAllProjectMcpServers": true

dotfiles/claude/settings.local.json.example

@@ -21,13 +21,6 @@
           "docker.gitea.com/gitea-mcp-server"
         ]
       },
-      "chrome-devtools": {
-        "command": "npx",
-        "args": [
-          "chrome-devtools-mcp@latest",
-          "--auto-connect"
-        ]
-      },
       "imap-email": {
         "command": "npx",
         "args": ["-y", "imap-email-mcp"],
@@ -36,7 +29,6 @@
     }
   },
   "enabledMcpjsonServers": [
-    "chrome-devtools",
     "imap-email"
   ],
   "enableAllProjectMcpServers": true

dotfiles/claude/skills

@@ -0,0 +1 @@
+../agents/skills

dotfiles/codex/.gitignore

@@ -1,8 +0,0 @@
-*
-!.gitignore
-!AGENTS.md
-!config.toml
-!skills
-
-# Legacy generated/local Codex state under this repo stays ignored. Active
-# host-local Codex fragments now live under ~/.codex.

dotfiles/codex/agents/claude-delegator.toml

@@ -0,0 +1,7 @@
+name = "claude_delegator"
+description = "Ask Opus for specialized independent design critique"
+model = "gpt-5.6-sol"
+model_reasoning_effort = "medium"
+developer_instructions = """
+UTF-8 base64-encode the complete task yourself without using a tool. Verify that the payload contains only `A-Z`, `a-z`, `0-9`, `+`, `/`, and valid terminal `=` padding. Then make exactly one shell tool call: `ask-claude --base64 '<payload>'`. Never place raw task text in shell source. Return the command's stdout verbatim. Do not investigate or reason about the task yourself, edit files, run any other command, or call, spawn, communicate with, or delegate to any other agent.
+"""

dotfiles/codex/config.toml

@@ -1,4 +1,4 @@
-model = "gpt-5.5"
+model = "gpt-5.6-sol"
 model_reasoning_effort = "high"
 service_tier = "fast"
 personality = "pragmatic"
@@ -8,13 +8,9 @@ suppress_unstable_features_warning = true
 # this file, ~/.codex/config.local.toml, and Codex-owned sections preserved in
 # ~/.codex/config.local-state.toml.
 
-[mcp_servers.chrome-devtools]
-command = "npx"
-args = ["-y", "chrome-devtools-mcp@latest", "--auto-connect"]
-
 [mcp_servers.observability]
-command = "npx"
-args = ["-y", "@google-cloud/observability-mcp"]
+command = "/usr/bin/env"
+args = ["PATH=/etc/profiles/per-user/imalison/bin:/run/current-system/sw/bin:/usr/local/bin:/opt/homebrew/bin:/usr/bin:/bin", "npx", "-y", "@google-cloud/observability-mcp"]
 
 [mcp_servers.openaiDeveloperDocs]
 url = "https://developers.openai.com/mcp"

dotfiles/config/autorandr/jay-lenovo-with-benq/config

@@ -0,0 +1,37 @@
+output HDMI-A-0
+off
+output DisplayPort-1-1
+off
+output DisplayPort-1-2
+off
+output DisplayPort-1-3
+off
+output DisplayPort-1-4
+off
+output DisplayPort-0
+crtc 1
+mode 2560x1440
+pos 0x0
+rate 144.00
+x-prop-colorspace Default
+x-prop-max_bpc 16
+x-prop-non_desktop 0
+x-prop-scaling_mode None
+x-prop-tearfree auto
+x-prop-underscan off
+x-prop-underscan_hborder 0
+x-prop-underscan_vborder 0
+output eDP
+crtc 0
+mode 2560x1600
+pos 2560x0
+primary
+rate 165.00
+x-prop-colorspace Default
+x-prop-max_bpc 16
+x-prop-non_desktop 0
+x-prop-scaling_mode None
+x-prop-tearfree auto
+x-prop-underscan off
+x-prop-underscan_hborder 0
+x-prop-underscan_vborder 0

dotfiles/config/autorandr/jay-lenovo-with-benq/setup

@@ -0,0 +1,2 @@
+DisplayPort-0 00ffffffffffff0009d1767f45540000281d0103803c22782a9325ad4f44a9260d5054a56b80d1fcd1e8d1c0b300a9c08180810081c0f8e300a0a0a032500820980455502100001a000000ff0033414b30313335343031390a20000000fd0028901ede3c000a202020202020000000fc0042656e5120455832373830510a0174020350f1515d5e5f60613f40101f22212004131203012309070783010000e200cf6d030c001000383c20006001020367d85dc401788003681a000001012890e6e305c301e40f180000e60605016262216fc200a0a0a055503020350055502100001e565e00a0a0a029502f20350055502100001a0000000000000000000000bf
+eDP 00ffffffffffff0009e59b0a000000001c1e0104b5221578037ce5a4554c9f260f5054000000010101010101010101010101010101016b6e00a0a04084603020360058d71000001a000000fd0c3ca51f1f4e010a202020202020000000fe00424f452043510a202020202020000000fe004e4531363051444d2d4e59310a02d502031d00e3058000e60605016a6a246d1a000002033ca500046a246a240000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff7013790000030114a52f0185ff099f002f001f003f0683000200050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003e90

dotfiles/config/hypr/hypridle.conf

@@ -5,6 +5,6 @@ general {
 
 listener {
     timeout = 300
-    on-timeout = /home/imalison/dotfiles/dotfiles/lib/bin/hypr-screensaver start
-    on-resume = /home/imalison/dotfiles/dotfiles/lib/bin/hypr-screensaver stop
+    on-timeout = hypr-screensaver start
+    on-resume = hypr-screensaver stop
 }

dotfiles/config/hypr/hyprland.lua

@@ -19,16 +19,61 @@ package.path = table.concat({
   package.path,
 }, ";")
 
-local modules = {
-  "hyprland.state",
-  "hyprland.scratchpads",
-  "hyprland.core",
-  "hyprland.layouts",
-  "hyprland.windows",
-  "hyprland.settings",
-  "hyprland.binds",
-  "hyprland.events",
+local function shell_quote(value)
+  return "'" .. tostring(value):gsub("'", "'\\''") .. "'"
+end
+
+local function module_load_phase(name)
+  if name == "state" then
+    return 0
+  elseif name == "binds" then
+    return 20
+  elseif name == "events" then
+    return 30
+  end
+
+  return 10
+end
+
+local function discover_modules()
+  local modules_dir = base_dir .. "/hyprland"
+  local handle = assert(io.popen("find " .. shell_quote(modules_dir) .. " -maxdepth 1 -type f -name '*.lua' -print"))
+  local discovered = {}
+
+  for path in handle:lines() do
+    local name = path:match("/([^/]+)%.lua$")
+    if name then
+      discovered[#discovered + 1] = {
+        name = name,
+        module = "hyprland." .. name,
+        phase = module_load_phase(name),
       }
+    end
+  end
+
+  handle:close()
+
+  table.sort(discovered, function(left, right)
+    if left.phase ~= right.phase then
+      return left.phase < right.phase
+    end
+
+    return left.name < right.name
+  end)
+
+  local modules = {}
+  for _, item in ipairs(discovered) do
+    modules[#modules + 1] = item.module
+  end
+
+  if modules[1] ~= "hyprland.state" then
+    error("hyprland/state.lua is required")
+  end
+
+  return modules
+end
+
+local modules = discover_modules()
 
 for _, module in ipairs(modules) do
   package.loaded[module] = nil

dotfiles/config/hypr/hyprland/binds.lua

@@ -49,8 +49,8 @@ function M.setup(ctx)
     bind("XF86AudioRaiseVolume", exec("set_volume --unmute --change-volume +5"), desc("Raise volume", { repeating = true }))
     bind("XF86AudioLowerVolume", exec("set_volume --unmute --change-volume -5"), desc("Lower volume", { repeating = true }))
     bind("XF86AudioMute", exec("set_volume --toggle-mute"), desc("Toggle mute"))
-    bind(hyper .. " + O", exec("/home/imalison/dotfiles/dotfiles/lib/functions/rofi_paswitch"), desc("Open PulseAudio output switcher"))
-    bind(hyper .. " + SHIFT + O", exec("/home/imalison/dotfiles/dotfiles/lib/bin/kef-optical"), desc("Switch KEF speakers to optical input"))
+    bind(hyper .. " + O", exec("rofi_paswitch"), desc("Open PulseAudio output switcher"))
+    bind(hyper .. " + SHIFT + O", exec("kef-optical"), desc("Switch KEF speakers to optical input"))
   end
 
   local function setup_display_wallpaper_and_capture_bindings()
@@ -58,16 +58,19 @@ function M.setup(ctx)
     bind("XF86MonBrightnessDown", exec("brightness.sh down"), desc("Lower display brightness", { repeating = true }))
     bind("Print", exec("flameshot gui"), desc("Take screenshot"))
     bind(hyper .. " + H", exec("flameshot gui"), desc("Take screenshot"))
-    bind(hyper .. " + backslash", exec("/home/imalison/dotfiles/dotfiles/lib/functions/mpg341cx_input toggle"), desc("Toggle monitor input"))
+    bind(hyper .. " + backslash", exec("mpg341cx_input toggle"), desc("Toggle monitor input"))
     bind(hyper .. " + comma", exec("rofi_wallpaper.sh"), desc("Open wallpaper menu"))
-    bind(hyper .. " + SHIFT + comma", exec("/home/imalison/dotfiles/dotfiles/lib/bin/neowall-wallpaper toggle"), desc("Toggle neowall wallpaper"))
+    bind(hyper .. " + SHIFT + comma", exec("neowall-wallpaper toggle"), desc("Toggle neowall wallpaper"))
   end
 
   local function setup_rofi_and_tool_bindings()
     bind(main_mod .. " + X", exec("rofi_command.sh"), desc("Open command menu"))
     bind(hyper .. " + V", exec([[cliphist list | rofi -dmenu -p "Clipboard" | cliphist decode | wl-copy]]), desc("Open clipboard history"))
     bind(hyper .. " + P", exec("rofi-pass"), desc("Open password menu"))
-    bind(hyper .. " + C", exec("rofi_tmcodex.sh"), desc("Open Codex session menu"))
+    bind(hyper .. " + N", exec("rofi_codex_desktop_project.sh"), desc("Start Codex Desktop thread from project"))
+    bind(hyper .. " + T", exec("mova_capture.sh"), desc("Quick-capture task/note into mova (Enter: Today/NEXT, Alt+i: Inbox)"))
+    bind(hyper .. " + SHIFT + T", exec("mova_capture.sh --pick"), desc("Quick-capture into mova, picking a capture template"))
+    bind(hyper .. " + C", exec("rofi_ai_scratchpad.sh"), desc("Choose AI scratchpad (Codex/Claude)"))
     bind(hyper .. " + SHIFT + C", exec("rofi_tmcodex.sh resume"), desc("Resume Codex session"))
     bind(hyper .. " + L", exec("hypr_rofi_layout"), desc("Open Hyprland layout menu"))
     bind(hyper .. " + K", exec("rofi_kill_process.sh"), desc("Open process kill menu"))
@@ -87,9 +90,72 @@ function M.setup(ctx)
   end
 
   local function setup_window_overview_bindings()
+    local function hyprtasking_loaded()
+      return hl.plugin and hl.plugin.hyprtasking and hl.plugin.hyprtasking.toggle
+    end
+
+    local function hyprtasking_active()
+      return hyprtasking_loaded()
+        and hl.plugin.hyprtasking.is_active
+        and hl.plugin.hyprtasking.is_active()
+    end
+
+    -- Workspace the overview was opened from, so Escape can cancel back to it
+    -- (hyprtasking:move switches the active workspace live as you navigate).
+    local hyprtasking_origin_workspace = nil
+
+    local function toggle_hyprtasking()
+      if hyprtasking_loaded() then
+        if not hyprtasking_active() then
+          hyprtasking_origin_workspace = hl.get_active_workspace()
+        end
+        hl.plugin.hyprtasking.toggle("cursor")
+      else
+        hl.notification.create({
+          text = "hyprtasking is not loaded",
+          duration = 1800,
+          icon = notification_icons.warning,
+          color = "rgba(edb443ff)",
+          font_size = 13,
+        })
+      end
+    end
+
+    -- Directional keyboard navigation; only acts while the overview is open so
+    -- the arrow keys keep their normal meaning otherwise. The active-border
+    -- highlight follows the selection.
+    local function hyprtasking_move(direction)
+      return function()
+        if hyprtasking_active() and hl.plugin.hyprtasking.move then
+          hl.plugin.hyprtasking.move(direction)
+        end
+      end
+    end
+
+    -- Confirm: close the overview, staying on the highlighted workspace.
+    local function hyprtasking_confirm()
+      if hyprtasking_active() then
+        hl.plugin.hyprtasking.toggle("cursor")
+      end
+    end
+
+    -- Cancel: restore the origin workspace, then close.
+    local function hyprtasking_cancel()
+      if not hyprtasking_active() then
+        return
+      end
+      if hyprtasking_origin_workspace and hyprtasking_origin_workspace.id then
+        dispatch(hl.dsp.focus({
+          workspace = tostring(hyprtasking_origin_workspace.id),
+          on_current_monitor = true,
+        }))
+      end
+      hl.plugin.hyprtasking.toggle("cursor")
+    end
+
     bind(main_mod .. " + SHIFT + C", hl.dsp.window.close(), desc("Close active window"))
     bind(main_mod .. " + SHIFT + Q", hl.dsp.exit(), desc("Exit Hyprland"))
-    bind(main_mod .. " + Tab", hyprexpo("toggle"), desc("Toggle hyprexpo workspace overview", overview_bind_opts))
+    bind(main_mod .. " + Tab", toggle_hyprtasking, desc("Toggle hyprtasking workspace overview", overview_bind_opts))
     bind(main_mod .. " + SHIFT + Tab", hyprwinview({
       action = "show",
       include_current_workspace = false,
@@ -97,8 +163,13 @@ function M.setup(ctx)
       default_action = "bring",
     }), desc("Show all-workspace window overview", overview_bind_opts))
     bind(main_mod .. " + SHIFT + slash", hyprwinview({ action = "toggle-filter" }), desc("Toggle window overview filter", overview_bind_opts))
-    bind("ALT + Tab", hyprexpo("toggle"), desc("Toggle hyprexpo workspace overview", overview_bind_opts))
-    bind("ALT + SHIFT + Tab", hyprexpo("on"), desc("Open hyprexpo workspace overview", overview_bind_opts))
+    bind("ALT + Tab", toggle_hyprtasking, desc("Toggle hyprtasking workspace overview", overview_bind_opts))
+    bind(main_mod .. " + Left", hyprtasking_move("left"), desc("Overview: select workspace left", overview_bind_opts))
+    bind(main_mod .. " + Down", hyprtasking_move("down"), desc("Overview: select workspace down", overview_bind_opts))
+    bind(main_mod .. " + Up", hyprtasking_move("up"), desc("Overview: select workspace up", overview_bind_opts))
+    bind(main_mod .. " + Right", hyprtasking_move("right"), desc("Overview: select workspace right", overview_bind_opts))
+    bind(main_mod .. " + Return", hyprtasking_confirm, desc("Overview: confirm selected workspace", overview_bind_opts))
+    bind("Escape", hyprtasking_cancel, desc("Overview: cancel back to origin workspace", { non_consuming = true }))
     bind(main_mod .. " + G", hyprwinview({
       action = "show",
       start_in_filter_mode = true,
@@ -117,18 +188,23 @@ function M.setup(ctx)
   end
 
   local function setup_window_focus_and_move_bindings()
-    bind(main_mod .. " + W", function()
-      focus_direction("up")
-    end, desc("Focus window above"))
-    bind(main_mod .. " + S", function()
-      focus_direction("down")
-    end, desc("Focus window below"))
-    bind(main_mod .. " + A", function()
-      focus_direction("left")
-    end, desc("Focus window to the left"))
-    bind(main_mod .. " + D", function()
-      focus_direction("right")
-    end, desc("Focus window to the right"))
+    -- While the hyprtasking overview is open, WASD navigates the workspace grid;
+    -- otherwise it keeps its normal directional window-focus behavior.
+    local function focus_or_overview_move(direction)
+      return function()
+        if hl.plugin and hl.plugin.hyprtasking and hl.plugin.hyprtasking.is_active
+          and hl.plugin.hyprtasking.is_active() and hl.plugin.hyprtasking.move then
+          hl.plugin.hyprtasking.move(direction)
+        else
+          focus_direction(direction)
+        end
+      end
+    end
+
+    bind(main_mod .. " + W", focus_or_overview_move("up"), desc("Focus window above / overview up"))
+    bind(main_mod .. " + S", focus_or_overview_move("down"), desc("Focus window below / overview down"))
+    bind(main_mod .. " + A", focus_or_overview_move("left"), desc("Focus window left / overview left"))
+    bind(main_mod .. " + D", focus_or_overview_move("right"), desc("Focus window right / overview right"))
 
     bind(main_mod .. " + SHIFT + W", function()
       swap_direction("up")
@@ -227,7 +303,9 @@ function M.setup(ctx)
     bind(main_mod .. " + CTRL + Space", gather_workspace_into_tabbed_group, desc("Gather workspace into tabbed group"))
     bind(main_mod .. " + bracketright", monocle_next, desc("Focus next monocle window"))
     bind(main_mod .. " + bracketleft", monocle_prev, desc("Focus previous monocle window"))
-    bind(main_mod .. " + T", hl.dsp.window.float({ action = "disable" }), desc("Tile active window"))
+    bind(main_mod .. " + F", toggle_active_window_real_fullscreen, desc("Toggle active window real fullscreen"))
+    bind(main_mod .. " + SHIFT + F", toggle_active_window_gaming_mode, desc("Toggle active window gaming fullscreen"))
+    bind(main_mod .. " + T", tile_or_float_active_window, desc("Tile or float active window"))
     bind(main_mod .. " + O", toggle_pinned_active_window, desc("Toggle pinned active window"))
     bind(main_mod .. " + M", minimize_active_window, desc("Minimize active window"))
     bind(main_mod .. " + SHIFT + M", restore_last_minimized, desc("Restore last minimized window"))
@@ -249,9 +327,11 @@ function M.setup(ctx)
 
   local function setup_scratchpad_bindings()
     bind(main_mod .. " + SHIFT + X", hl.dsp.workspace.toggle_special("NSP"), desc("Toggle NSP special workspace"))
-    bind(mod_alt .. " + C", function()
-      toggle_scratchpad("codex")
-    end, desc("Toggle Codex scratchpad"))
+    bind(mod_alt .. " + C", toggle_active_ai_scratchpad, desc("Toggle AI scratchpad (Codex/Claude)"))
+    bind(mod_alt .. " + SHIFT + C", toggle_backup_ai_scratchpad, desc("Toggle backup AI scratchpad (Codex/Claude)"))
+    bind(mod_alt .. " + D", function()
+      toggle_scratchpad("discord")
+    end, desc("Toggle Discord scratchpad"))
     bind(mod_alt .. " + E", function()
       toggle_scratchpad("element")
     end, desc("Toggle Element scratchpad"))
@@ -273,6 +353,9 @@ function M.setup(ctx)
     bind(mod_alt .. " + V", function()
       toggle_scratchpad("volume")
     end, desc("Toggle volume scratchpad"))
+    bind(mod_alt .. " + X", function()
+      toggle_scratchpad("x_com")
+    end, desc("Toggle X scratchpad"))
     bind(mod_alt .. " + grave", function()
       toggle_scratchpad("dropdown")
     end, desc("Toggle dropdown scratchpad"))
@@ -312,6 +395,7 @@ function M.setup(ctx)
   local function setup_mouse_bindings()
     bind(main_mod .. " + mouse:272", float_and_drag_active_window, desc("Float and drag active window"))
     bind(main_mod .. " + mouse:273", float_and_resize_active_window, desc("Float and resize active window"))
+    bind(hyper .. " + mouse:272", float_and_resize_active_window, desc("Float and resize active window"))
   end
 
   local function setup_internal_window_manager_bindings()

dotfiles/config/hypr/hyprland/core.lua

@@ -171,15 +171,18 @@ function M.setup(ctx)
     end
   end
 
+  -- True when the running hyprNStack build knows the auto_stacks option
+  -- (old builds crash-parse "setstackcount auto", so callers must gate on this).
+  local function nstack_supports_auto_stacks()
+    return hl.get_config("plugin.nstack.layout.auto_stacks") ~= nil
+  end
+
   local function apply_nstack_config()
     if verify_config or not enable_nstack or not configure_nstack_plugin_from_lua then
       return
     end
 
-    hl.config({
-      plugin = {
-        nstack = {
-          layout = {
+    local layout = {
       orientation = "left",
       new_on_top = false,
       new_near_focused = true,
@@ -191,14 +194,23 @@ function M.setup(ctx)
       center_single_master = false,
       mfact = 0.0,
       single_mfact = 1.0,
-          },
+    }
+
+    if nstack_supports_auto_stacks() then
+      layout.auto_stacks = true
+    end
+
+    hl.config({
+      plugin = {
+        nstack = {
+          layout = layout,
         },
       },
     })
   end
 
   local function apply_hyprexpo_config()
-    if verify_config or not enable_hyprexpo then
+    if verify_config or not enable_hyprexpo or enable_hyprtasking then
       return
     end
 
@@ -216,10 +228,18 @@ function M.setup(ctx)
           keynav_wrap_h = 1,
           keynav_wrap_v = 1,
           keynav_reading_order = 0,
+          live_preview_follow_focus = 0,
           border_width = 2,
           border_color_current = "rgb(66ccff)",
           border_color_focus = "rgb(edb443)",
           border_color_hover = "rgb(aabbcc)",
+          window_icon_enable = 1,
+          window_icon_position = "bottom-right",
+          window_icon_size = 32,
+          window_icon_offset_x = 8,
+          window_icon_offset_y = 8,
+          window_icon_bg_enable = 1,
+          window_icon_bg_color = 0x88000000,
           tile_rounding = 5,
           tile_rounding_power = 2.0,
           label_enable = 1,
@@ -581,6 +601,7 @@ function M.setup(ctx)
   ctx.hyprexpo = hyprexpo
   ctx.hyprwinview = hyprwinview
   ctx.workspacehistory = workspacehistory
+  ctx.nstack_supports_auto_stacks = nstack_supports_auto_stacks
   ctx.apply_nstack_config = apply_nstack_config
   ctx.apply_hyprexpo_config = apply_hyprexpo_config
   ctx.apply_hyprwinview_config = apply_hyprwinview_config

dotfiles/config/hypr/hyprland/events.lua

@@ -26,7 +26,7 @@ function M.setup(ctx)
     }
     fullscreen_states[address] = current
 
-    if window.floating or current_layout == monocle_layout then
+    if window.floating or current_layout == monocle_layout or is_game_like_window(window) then
       return
     end
 
@@ -40,7 +40,8 @@ function M.setup(ctx)
     apply_nstack_config()
     apply_hyprexpo_config()
     apply_hyprwinview_config()
-    apply_hyprwobbly_config()
+    apply_dynamic_cursors_config()
+    apply_hyprtasking_config()
     apply_hyprglass_config()
     apply_visual_performance_mode()
     apply_rules()
@@ -59,7 +60,8 @@ function M.setup(ctx)
   hl.on("config.reloaded", apply_nstack_config)
   hl.on("config.reloaded", apply_hyprexpo_config)
   hl.on("config.reloaded", apply_hyprwinview_config)
-  hl.on("config.reloaded", apply_hyprwobbly_config)
+  hl.on("config.reloaded", apply_dynamic_cursors_config)
+  hl.on("config.reloaded", apply_hyprtasking_config)
   hl.on("config.reloaded", apply_hyprglass_config)
   hl.on("config.reloaded", apply_visual_performance_mode)
   hl.on("config.reloaded", apply_rules)
@@ -83,7 +85,6 @@ function M.setup(ctx)
   hl.on("window.move_to_workspace", update_monocle_notice)
   hl.on("window.fullscreen", reconcile_fullscreen_state)
   hl.on("window.update_rules", reconcile_fullscreen_state)
-
   hl.on("window.open", adopt_matching_scratchpad_window)
   hl.on("window.class", adopt_matching_scratchpad_window)
   hl.on("window.title", adopt_matching_scratchpad_window)

dotfiles/config/hypr/hyprland/layouts.lua

@@ -2,18 +2,63 @@ local M = {}
 
 function M.setup(ctx)
   local _ENV = ctx
+  local configure_quadrants_master
+  local focus_workspace
+  local move_window_to_workspace
+
   local function is_nstack_layout(layout)
     return layout == columns_layout or layout == grid_layout
   end
 
   local function hyprland_layout(layout)
-    if layout == grid_layout then
+    if layout == quadrants_layout then
+      return large_main_layout
+    elseif layout == grid_layout then
       return columns_layout
     end
     return layout
   end
 
+  configure_quadrants_master = function()
+    if quadrants_arranging or current_layout ~= quadrants_layout then
+      return
+    end
+
+    local workspace = active_workspace()
+    if not is_normal_workspace(workspace) then
+      return
+    end
+
+    local windows = tiled_windows(workspace)
+    if #windows == 0 then
+      return
+    end
+
+    sort_windows_by_visual_position(windows)
+
+    quadrants_arranging = true
+    dispatch(hl.dsp.focus({ window = window_selector(windows[1]) }))
+    dispatch(hl.dsp.layout("orientationleft"))
+    dispatch(hl.dsp.layout("mfact exact 0.5"))
+
+    for _ = 1, #windows do
+      dispatch(hl.dsp.layout("removemaster"))
+    end
+
+    if #windows >= 3 then
+      dispatch(hl.dsp.layout("addmaster"))
+    end
+
+    quadrants_arranging = false
+    focus_workspace(workspace.id)
+  end
+
   local function update_nstack_count()
+    if current_layout == quadrants_layout then
+      configure_quadrants_master()
+      return
+    end
+
     if not enable_nstack or not is_nstack_layout(current_layout) then
       return
     end
@@ -24,6 +69,13 @@ function M.setup(ctx)
       return
     end
 
+    if current_layout == columns_layout and nstack_supports_auto_stacks() then
+      -- The plugin sizes stacks to the window count on every recalculation,
+      -- which also covers paths that fire no window events (e.g. float -> tile).
+      dispatch(hl.dsp.layout("setstackcount auto"))
+      return
+    end
+
     local stack_count = count
     if current_layout == grid_layout then
       stack_count = math.ceil(math.sqrt(count))
@@ -98,7 +150,10 @@ function M.setup(ctx)
     hl.config({ general = { layout = hyprland_layout(layout) } })
     write_layout_state()
 
-    if is_nstack_layout(layout) then
+    if layout == quadrants_layout then
+      dismiss_monocle_notice()
+      schedule_nstack_count_update()
+    elseif is_nstack_layout(layout) then
       dismiss_monocle_notice()
       schedule_nstack_count_update()
     else
@@ -127,7 +182,10 @@ function M.setup(ctx)
     hl.config({ general = { layout = hyprland_layout(current_layout) } })
     write_layout_state()
 
-    if is_nstack_layout(current_layout) then
+    if current_layout == quadrants_layout then
+      dismiss_monocle_notice()
+      schedule_nstack_count_update()
+    elseif is_nstack_layout(current_layout) then
       dismiss_monocle_notice()
       schedule_nstack_count_update()
     else
@@ -210,11 +268,11 @@ function M.setup(ctx)
     dispatch(hl.dsp.window.swap({ direction = direction }))
   end
 
-  local function focus_workspace(workspace_id)
+  focus_workspace = function(workspace_id)
     dispatch(hl.dsp.focus({ workspace = tostring(workspace_id), on_current_monitor = true }))
   end
 
-  local function move_window_to_workspace(workspace_id, follow, window)
+  move_window_to_workspace = function(workspace_id, follow, window)
     local target_window = window or hl.get_active_window()
     local target_selector = window_selector(target_window)
     dispatch(hl.dsp.window.move({ workspace = tostring(workspace_id), follow = false, window = target_selector }))
@@ -261,6 +319,50 @@ function M.setup(ctx)
     return false
   end
 
+  local function window_contains_point(window, x, y)
+    local at = window and window.at
+    local size = window and window.size
+    if not at or not size then
+      return false
+    end
+
+    local left = tonumber(at.x or at[1])
+    local top = tonumber(at.y or at[2])
+    local width = tonumber(size.x or size[1])
+    local height = tonumber(size.y or size[2])
+    if not left or not top or not width or not height then
+      return false
+    end
+
+    return x >= left and x < left + width and y >= top and y < top + height
+  end
+
+  -- With follow_mouse=1, a bare focus dispatch does not survive the next
+  -- pointer motion unless the cursor already sits inside the target window,
+  -- so warp the cursor into the window when needed.
+  local function focus_window_with_cursor(window)
+    local selector = window_selector(window)
+    if not selector then
+      return false
+    end
+
+    local live = type(hl.get_window) == "function" and hl.get_window(selector) or window
+    if not live then
+      return false
+    end
+
+    dispatch(hl.dsp.focus({ window = selector }))
+
+    local cursor = hl.get_cursor_pos and hl.get_cursor_pos()
+    if cursor and window_contains_point(live, cursor.x, cursor.y) then
+      return true
+    end
+
+    local center_x, center_y = window_center(live)
+    dispatch(hl.dsp.cursor.move({ x = math.floor(center_x), y = math.floor(center_y) }))
+    return true
+  end
+
   local function find_tabbed_group_anchor(state)
     local active = hl.get_active_window()
     if active and active.group and active.group.size and active.group.size > 1 then
@@ -271,8 +373,16 @@ function M.setup(ctx)
       return nil
     end
 
+    local workspace = active_workspace()
     for _, window in ipairs(hl.get_windows()) do
-      if window and window.address == state.anchor and window.group and window.group.size and window.group.size > 1 then
+      if
+        window
+        and window.address == state.anchor
+        and same_workspace(window.workspace, workspace)
+        and window.group
+        and window.group.size
+        and window.group.size > 1
+      then
         return window
       end
     end
@@ -327,6 +437,7 @@ function M.setup(ctx)
   local function restore_workspace_tabbed_group()
     local key = workspace_key()
     local state = tabbed_workspace_groups[key]
+    local entry_focused = hl.get_active_window()
     local anchor = find_tabbed_group_anchor(state)
     local anchor_selector = window_selector(anchor)
     local target_workspace_id = anchor and anchor.workspace and anchor.workspace.id
@@ -343,7 +454,9 @@ function M.setup(ctx)
     tabbed_workspace_groups[key] = nil
     set_layout(columns_layout)
     restore_tabbed_group_window_order(state, target_workspace_id)
-    dispatch(hl.dsp.focus({ window = anchor_selector }))
+    if not focus_window_with_cursor(entry_focused) then
+      focus_window_with_cursor(anchor)
+    end
     schedule_nstack_count_update()
   end
 
@@ -418,6 +531,9 @@ function M.setup(ctx)
       dispatch(hl.dsp.focus({ window = anchor_selector }))
       dispatch(hl.dsp.group.toggle({ window = anchor_selector }))
       notify_tabbed_group("Unable to group tiled windows")
+      if not focus_window_with_cursor(focused) then
+        focus_window_with_cursor(anchor)
+      end
       return
     elseif grouped_count < #candidates then
       notify_tabbed_group("Grouped " .. tostring(grouped_count) .. " of " .. tostring(#candidates) .. " tiled windows")
@@ -428,7 +544,9 @@ function M.setup(ctx)
       order = original_order,
       windows = candidate_addresses,
     }
-    dispatch(hl.dsp.focus({ window = anchor_selector }))
+    if not focus_window_with_cursor(focused) then
+      focus_window_with_cursor(anchor)
+    end
   end
 
   local function force_columns_layout()
@@ -556,6 +674,7 @@ function M.setup(ctx)
 
   ctx.is_nstack_layout = is_nstack_layout
   ctx.hyprland_layout = hyprland_layout
+  ctx.configure_quadrants_master = configure_quadrants_master
   ctx.update_nstack_count = update_nstack_count
   ctx.schedule_nstack_count_update = schedule_nstack_count_update
   ctx.dismiss_monocle_notice = dismiss_monocle_notice

dotfiles/config/hypr/hyprland/scratchpads.lua

@@ -8,6 +8,7 @@ function M.setup(ctx)
   dropdown_animation_frames = 18
   dropdown_animation_frame_ms = 16
   scratchpad_pending = {}
+  scratchpad_mode_tag = "scratchpad"
   monitor_reserved_cache_path = (os.getenv("XDG_RUNTIME_DIR") or "/tmp") .. "/hyprland-monitor-reserved.tsv"
   scratchpad_fallback_reserved_top = 60
 
@@ -16,10 +17,18 @@ function M.setup(ctx)
       command = "codex_desktop_scratchpad",
       class = "codex-desktop",
     },
+    claude = {
+      command = "claude-desktop",
+      classes = { "com.anthropic.Claude", "claude-desktop" },
+    },
     htop = {
       command = "alacritty --class htop-scratch --title htop -e htop",
       class = "htop-scratch",
     },
+    discord = {
+      command = "discord",
+      class = "discord",
+    },
     volume = {
       command = "pavucontrol",
       class = "org.pulseaudio.pavucontrol",
@@ -41,6 +50,11 @@ function M.setup(ctx)
       command = "google-chrome-stable --profile-directory=Default --app=https://messages.google.com/web/conversations",
       class = "chrome-messages.google.com",
     },
+    x_com = {
+      command = "x-com-pwa",
+      classes = { "x-com-pwa", "chrome-x.com" },
+      title = "X",
+    },
     transmission = {
       command = "transmission-gtk",
       class = "transmission-gtk",
@@ -49,6 +63,7 @@ function M.setup(ctx)
       command = "ghostty --config-file=/home/imalison/.config/ghostty/dropdown",
       class = "com.mitchellh.ghostty.dropdown",
       dropdown = true,
+      allow_tiling = false,
     },
   }
 
@@ -82,15 +97,27 @@ function M.setup(ctx)
       and lower_contains(window.title, def.title)
   end
 
-  local function is_scratchpad_window(window)
-    for _, def in pairs(scratchpads) do
-      if scratchpad_window_matches(window, def) then
+  local function tiled_scratchpad_is_normal_window(window, def)
+    return def.allow_tiling ~= false and window and window.floating == false
+  end
+
+  local function window_has_scratchpad_tag(window)
+    for _, tag in ipairs((window and window.tags) or {}) do
+      if tag == scratchpad_mode_tag then
         return true
       end
     end
     return false
   end
 
+  local function window_is_floating_scratchpad(window)
+    return window and window.floating == true and window_has_scratchpad_tag(window)
+  end
+
+  local function is_scratchpad_window(window)
+    return window_is_floating_scratchpad(window)
+  end
+
   local function matching_scratchpad_name(window)
     for name, def in pairs(scratchpads) do
       if scratchpad_window_matches(window, def) then
@@ -101,7 +128,32 @@ function M.setup(ctx)
   end
 
   local function scratchpad_workspace(name)
-    return "special:scratch-" .. name
+    return "name:scratch-hidden-" .. name
+  end
+
+  local function mark_window_as_floating_scratchpad(window, name)
+    local selector = window_selector(window)
+    if not selector then
+      return
+    end
+
+    dispatch(hl.dsp.window.float({ action = "enable", window = selector }))
+    dispatch(hl.dsp.window.tag({ tag = "+" .. scratchpad_mode_tag, window = selector }))
+    if name then
+      dispatch(hl.dsp.window.tag({ tag = "+scratchpad-" .. name, window = selector }))
+    end
+  end
+
+  local function clear_floating_scratchpad_state(window)
+    local selector = window_selector(window)
+    if not selector then
+      return
+    end
+
+    dispatch(hl.dsp.window.tag({ tag = "-" .. scratchpad_mode_tag, window = selector }))
+    for name in pairs(scratchpads) do
+      dispatch(hl.dsp.window.tag({ tag = "-scratchpad-" .. name, window = selector }))
+    end
   end
 
   local function as_number(value, default)
@@ -238,6 +290,24 @@ function M.setup(ctx)
     return windows
   end
 
+  local function default_scratchpad_geometry(target_monitor)
+    local monitor = target_monitor or hl.get_active_monitor()
+    if not monitor then
+      return
+    end
+
+    local workarea = monitor_workarea(monitor)
+    local width = math.floor(workarea.width * scratchpad_size_ratio)
+    local height = math.floor(workarea.height * scratchpad_size_ratio)
+
+    return {
+      width = width,
+      height = height,
+      x = workarea.x + math.floor((workarea.width - width) / 2),
+      y = workarea.y + math.floor((workarea.height - height) / 2),
+    }
+  end
+
   local function scratchpad_geometry(name, target_monitor, position)
     local def = scratchpads[name]
     local monitor = target_monitor or hl.get_active_monitor()
@@ -261,10 +331,7 @@ function M.setup(ctx)
         y = position
       end
     else
-      width = math.floor(workarea.width * scratchpad_size_ratio)
-      height = math.floor(workarea.height * scratchpad_size_ratio)
-      x = workarea.x + math.floor((workarea.width - width) / 2)
-      y = workarea.y + math.floor((workarea.height - height) / 2)
+      return default_scratchpad_geometry(monitor)
     end
 
     return {
@@ -275,6 +342,23 @@ function M.setup(ctx)
     }
   end
 
+  local function should_apply_scratchpad_geometry(name, window, opts)
+    local def = scratchpads[name]
+    if not def then
+      return false
+    end
+
+    return (opts and opts.force_geometry) or def.dropdown or not tiled_scratchpad_is_normal_window(window, def)
+  end
+
+  local function refreshed_window(window)
+    if not window or not window.address or type(hl.get_window) ~= "function" then
+      return window
+    end
+
+    return hl.get_window(window_selector(window)) or window
+  end
+
   local function apply_scratchpad_geometry(name, window, target_monitor, position)
     local def = scratchpads[name]
     if not def or not window then
@@ -287,9 +371,7 @@ function M.setup(ctx)
     end
     local selector = window_selector(window)
 
-    dispatch(hl.dsp.window.float({ action = "enable", window = selector }))
-    dispatch(hl.dsp.window.tag({ tag = "+scratchpad", window = selector }))
-    dispatch(hl.dsp.window.tag({ tag = "+scratchpad-" .. name, window = selector }))
+    mark_window_as_floating_scratchpad(window, name)
     dispatch(hl.dsp.window.resize({ x = geometry.width, y = geometry.height, relative = false, window = selector }))
     dispatch(hl.dsp.window.move({ x = geometry.x, y = geometry.y, relative = false, window = selector }))
     if def.dropdown then
@@ -298,9 +380,12 @@ function M.setup(ctx)
     end
   end
 
-  local function schedule_scratchpad_geometry(name, window, target_monitor, position, timeout)
+  local function schedule_scratchpad_geometry(name, window, target_monitor, position, timeout, opts)
     hl.timer(function()
-      apply_scratchpad_geometry(name, window, target_monitor, position)
+      local current_window = refreshed_window(window)
+      if should_apply_scratchpad_geometry(name, current_window, opts) then
+        apply_scratchpad_geometry(name, current_window, target_monitor, position)
+      end
     end, { timeout = timeout or 50, type = "oneshot" })
   end
 
@@ -329,16 +414,27 @@ function M.setup(ctx)
 
   local function hide_scratchpad_window(name, window)
     remove_minimized_window(window)
-    move_window_to_workspace(scratchpad_workspace(name), false, window)
+    name = name or matching_scratchpad_name(window)
+    move_window_to_workspace(name and scratchpad_workspace(name) or "special:NSP", false, window)
   end
 
-  local function show_scratchpad_window(name, window, workspace, target_monitor)
+  local function scratchpad_show_workspace(workspace)
     workspace = workspace or active_workspace()
+    if is_normal_workspace(workspace) then
+      return workspace
+    end
+
+    return hl.get_workspace(tostring(active_workspace_id()))
+  end
+
+  local function show_scratchpad_window(name, window, workspace, target_monitor, opts)
+    workspace = scratchpad_show_workspace(workspace)
     if not workspace then
       return
     end
 
     remove_minimized_window(window)
+    mark_window_as_floating_scratchpad(window, name)
     if scratchpads[name] and scratchpads[name].dropdown then
       apply_scratchpad_geometry(name, window, target_monitor or hl.get_active_monitor(), "above")
     end
@@ -347,7 +443,9 @@ function M.setup(ctx)
     if scratchpads[name] and scratchpads[name].dropdown then
       animate_dropdown_scratchpad_down(name, window, target_monitor or hl.get_active_monitor())
     else
-      schedule_scratchpad_geometry(name, window, target_monitor or hl.get_active_monitor())
+      schedule_scratchpad_geometry(name, window, target_monitor or hl.get_active_monitor(), nil, nil, {
+        force_geometry = true,
+      })
     end
   end
 
@@ -356,13 +454,18 @@ function M.setup(ctx)
     return workspace and window and same_workspace(window.workspace, workspace)
   end
 
-  -- Active scratchpads are scratchpad windows visible on the active workspace.
-  -- Invoking a different scratchpad replaces that active set.
+  -- Scratchpad exclusivity belongs to a window's current presentation state,
+  -- not its class. Invoking a named shortcut replaces any other window that is
+  -- visibly in floating scratchpad mode, including an otherwise ordinary app.
   local function active_scratchpad_windows(except_name)
     local windows = {}
     for _, window in ipairs(hl.get_windows()) do
       local name = matching_scratchpad_name(window)
-      if name and name ~= except_name and scratchpad_is_visible(window) then
+      if
+        (except_name == nil or name ~= except_name)
+        and scratchpad_is_visible(window)
+        and window_is_floating_scratchpad(window)
+      then
         windows[#windows + 1] = {
           name = name,
           window = window,
@@ -404,8 +507,10 @@ function M.setup(ctx)
         if scratchpad_pending[name] then
           local pending = scratchpad_pending[name]
           scratchpad_pending[name] = nil
-          show_scratchpad_window(name, window, pending.workspace or active_workspace(), pending.monitor or hl.get_active_monitor())
-        elseif scratchpad_is_visible(window) then
+          show_scratchpad_window(name, window, pending.workspace or active_workspace(), pending.monitor or hl.get_active_monitor(), {
+            force_geometry = true,
+          })
+        elseif scratchpad_is_visible(window) and window_is_floating_scratchpad(window) then
           schedule_scratchpad_geometry(name, window, hl.get_active_monitor())
         end
       end
@@ -424,10 +529,12 @@ function M.setup(ctx)
 
     local windows = matching_scratchpad_windows(name)
     if #windows == 0 then
+      local workspace = scratchpad_show_workspace()
+      local target_monitor = hl.get_active_monitor()
       hide_active_scratchpads(name)
       scratchpad_pending[name] = {
-        monitor = hl.get_active_monitor(),
-        workspace = active_workspace(),
+        monitor = target_monitor,
+        workspace = workspace,
       }
       hl.exec_cmd(def.command)
       return
@@ -446,21 +553,80 @@ function M.setup(ctx)
         hide_scratchpad_window(name, window)
       end
     else
-      hide_active_scratchpads(name)
-      local workspace = active_workspace()
+      local workspace = scratchpad_show_workspace()
       local target_monitor = hl.get_active_monitor()
+      hide_active_scratchpads(name)
       for _, window in ipairs(windows) do
         show_scratchpad_window(name, window, workspace, target_monitor)
       end
     end
   end
 
+  -- Which AI scratchpad SUPER+ALT+C targets. Selected at runtime (no reload)
+  -- by rofi_ai_scratchpad.sh, which writes the chosen name to this file.
+  local ai_scratchpad_default = "codex"
+
+  local function ai_scratchpad_state_path()
+    local base = os.getenv("XDG_STATE_HOME") or ((os.getenv("HOME") or "") .. "/.local/state")
+    return base .. "/hypr/ai-scratchpad"
+  end
+
+  local function active_ai_scratchpad()
+    local file = io.open(ai_scratchpad_state_path(), "r")
+    if not file then
+      return ai_scratchpad_default
+    end
+
+    local value = file:read("*l")
+    file:close()
+    value = value and value:gsub("%s+", "")
+    if scratchpads[value] then
+      return value
+    end
+    return ai_scratchpad_default
+  end
+
+  local function toggle_active_ai_scratchpad()
+    toggle_scratchpad(active_ai_scratchpad())
+  end
+
+  local function backup_ai_scratchpad()
+    if active_ai_scratchpad() == "codex" then
+      return "claude"
+    end
+    return "codex"
+  end
+
+  local function toggle_backup_ai_scratchpad()
+    toggle_scratchpad(backup_ai_scratchpad())
+  end
+
+  -- Used by rofi_ai_scratchpad.sh after a selection: bring the chosen
+  -- scratchpad into view if it isn't already, without hiding it when it is.
+  local function show_active_ai_scratchpad()
+    local name = active_ai_scratchpad()
+    for _, window in ipairs(matching_scratchpad_windows(name)) do
+      if scratchpad_is_visible(window) then
+        return
+      end
+    end
+    toggle_scratchpad(name)
+  end
+
+  _G.im_hyprland_toggle_ai_scratchpad = toggle_active_ai_scratchpad
+  _G.im_hyprland_show_ai_scratchpad = show_active_ai_scratchpad
+
   ctx.lower_contains = lower_contains
   ctx.lower_contains_any = lower_contains_any
   ctx.scratchpad_window_matches = scratchpad_window_matches
+  ctx.tiled_scratchpad_is_normal_window = tiled_scratchpad_is_normal_window
+  ctx.window_has_scratchpad_tag = window_has_scratchpad_tag
+  ctx.window_is_floating_scratchpad = window_is_floating_scratchpad
   ctx.is_scratchpad_window = is_scratchpad_window
   ctx.matching_scratchpad_name = matching_scratchpad_name
   ctx.scratchpad_workspace = scratchpad_workspace
+  ctx.mark_window_as_floating_scratchpad = mark_window_as_floating_scratchpad
+  ctx.clear_floating_scratchpad_state = clear_floating_scratchpad_state
   ctx.as_number = as_number
   ctx.logical_monitor_dimension = logical_monitor_dimension
   ctx.split_tsv = split_tsv
@@ -470,12 +636,16 @@ function M.setup(ctx)
   ctx.refresh_monitor_reserved_cache = refresh_monitor_reserved_cache
   ctx.monitor_workarea = monitor_workarea
   ctx.scratchpad_geometry = scratchpad_geometry
+  ctx.should_apply_scratchpad_geometry = should_apply_scratchpad_geometry
+  ctx.refreshed_window = refreshed_window
   ctx.matching_scratchpad_windows = matching_scratchpad_windows
+  ctx.default_scratchpad_geometry = default_scratchpad_geometry
   ctx.apply_scratchpad_geometry = apply_scratchpad_geometry
   ctx.schedule_scratchpad_geometry = schedule_scratchpad_geometry
   ctx.dropdown_spring_progress = dropdown_spring_progress
   ctx.animate_dropdown_scratchpad_down = animate_dropdown_scratchpad_down
   ctx.hide_scratchpad_window = hide_scratchpad_window
+  ctx.scratchpad_show_workspace = scratchpad_show_workspace
   ctx.show_scratchpad_window = show_scratchpad_window
   ctx.scratchpad_is_visible = scratchpad_is_visible
   ctx.active_scratchpad_windows = active_scratchpad_windows
@@ -485,6 +655,11 @@ function M.setup(ctx)
   ctx.refresh_shell_workarea_and_scratchpads = refresh_shell_workarea_and_scratchpads
   ctx.adopt_matching_scratchpad_window = adopt_matching_scratchpad_window
   ctx.toggle_scratchpad = toggle_scratchpad
+  ctx.active_ai_scratchpad = active_ai_scratchpad
+  ctx.backup_ai_scratchpad = backup_ai_scratchpad
+  ctx.toggle_active_ai_scratchpad = toggle_active_ai_scratchpad
+  ctx.toggle_backup_ai_scratchpad = toggle_backup_ai_scratchpad
+  ctx.show_active_ai_scratchpad = show_active_ai_scratchpad
 end
 
 return M

dotfiles/config/hypr/hyprland/settings.lua

@@ -2,6 +2,7 @@ local M = {}
 
 function M.setup(ctx)
   local _ENV = ctx
+  local file_chooser_class_rule = "^(xdg-desktop-portal-gtk|org\\.freedesktop\\.impl\\.portal\\.desktop\\.gtk)$"
   local file_chooser_title_rule = "^(Open File|Open Files|Save File|Save Files|Save As|Select File|Select Files|Choose File|Choose Files|File Upload|Upload File|Upload Files|Select Folder|Choose Folder|Open Folder|Save Folder)$"
 
   local function lower_string(value)
@@ -41,9 +42,20 @@ function M.setup(ctx)
       or title:find("file picker", 1, true) ~= nil
   end
 
+  local function class_indicates_file_chooser(class)
+    class = lower_string(class)
+    return class == "xdg-desktop-portal-gtk"
+      or class == "org.freedesktop.impl.portal.desktop.gtk"
+  end
+
   local function is_file_chooser_window(window)
     return window
-      and (title_indicates_file_chooser(window.title) or title_indicates_file_chooser(window.initial_title))
+      and (
+        title_indicates_file_chooser(window.title)
+        or title_indicates_file_chooser(window.initial_title)
+        or class_indicates_file_chooser(window.class)
+        or class_indicates_file_chooser(window.initial_class)
+      )
   end
 
   local function raise_file_chooser_window(window)
@@ -72,24 +84,27 @@ function M.setup(ctx)
   if enable_nstack and not verify_config then
     hl.plugin.load("/run/current-system/sw/lib/libhyprNStack.so")
   end
-  if enable_hyprexpo and not verify_config then
-    hl.plugin.load("/run/current-system/sw/lib/libhyprexpo.so")
-  end
   if enable_hyprwinview and not verify_config then
     hl.plugin.load("/run/current-system/sw/lib/libhyprwinview.so")
   end
+  if enable_hyprtasking and not verify_config then
+    hl.plugin.load("/run/current-system/sw/lib/libhyprtasking.so")
+  end
+  if enable_hyprexpo and not enable_hyprtasking and not verify_config then
+    hl.plugin.load("/run/current-system/sw/lib/libhyprexpo.so")
+  end
   if enable_workspace_history and not verify_config then
     hl.plugin.load("/run/current-system/sw/lib/libhypr-workspace-history.so")
   end
-  if enable_hyprwobbly and not verify_config then
-    hl.plugin.load("/run/current-system/sw/lib/libhyprwobbly.so")
+  if enable_dynamic_cursors and not verify_config then
+    hl.plugin.load("/run/current-system/sw/lib/libhypr-dynamic-cursors.so")
   end
   if enable_hyprglass and not verify_config then
     hl.plugin.load("/run/current-system/sw/lib/hyprglass.so")
   end
 
-  hl.env("XCURSOR_SIZE", "24")
-  hl.env("HYPRCURSOR_SIZE", "24")
+  hl.env("XCURSOR_SIZE", tostring(hyprland_cursor_size))
+  hl.env("HYPRCURSOR_SIZE", tostring(hyprland_cursor_size))
   hl.env("QT_QPA_PLATFORMTHEME", "qt5ct")
   hl.env("HYPR_MAX_WORKSPACE", "9")
 
@@ -110,8 +125,8 @@ function M.setup(ctx)
       persistent_warps = true,
     },
     general = {
-      gaps_in = 5,
-      gaps_out = 10,
+      gaps_in = hyprland_gaps_enabled and 5 or 0,
+      gaps_out = hyprland_gaps_enabled and 10 or 0,
       border_size = 2,
       col = {
         active_border = { colors = { "rgba(3b82f6ee)", "rgba(33ccffee)" }, angle = 45 },
@@ -166,6 +181,7 @@ function M.setup(ctx)
       force_default_wallpaper = 0,
       disable_hyprland_logo = true,
       exit_window_retains_fullscreen = true,
+      focus_on_activate = true,
     },
   })
 
@@ -250,26 +266,71 @@ function M.setup(ctx)
     })
   end
 
-  local function apply_hyprwobbly_config()
-    if verify_config or not enable_hyprwobbly then
+  local function apply_dynamic_cursors_config()
+    if verify_config or not enable_dynamic_cursors then
       return
     end
 
     hl.config({
       plugin = {
-        hyprwobbly = {
-          enabled = hypr_visual_performance_mode and 0 or 1,
-          mode = "always",
-          grid_width = 4,
-          grid_height = 4,
-          tiles_x = 12,
-          tiles_y = 12,
-          spring_k = 18.0,
-          friction = 8.0,
-          mass = 12.0,
-          move_factor = 0.65,
-          resize_factor = 0.45,
-          max_warp = 140.0,
+        dynamic_cursors = {
+          enabled = true,
+          mode = "tilt",
+          threshold = 2,
+          tilt = {
+            limit = 5000,
+            activation = "negative_quadratic",
+            window = 100,
+            full = 60,
+          },
+          shake = {
+            enabled = true,
+            threshold = 6.0,
+            base = 4.0,
+            speed = 4.0,
+            influence = 0.0,
+            limit = 0.0,
+            timeout = 2000,
+            effects = true,
+            ipc = false,
+          },
+          hyprcursor = {
+            nearest = 1,
+            enabled = true,
+            resolution = -1,
+            fallback = "clientside",
+          },
+        },
+      },
+    })
+  end
+
+  local function apply_hyprtasking_config()
+    if verify_config or not enable_hyprtasking then
+      return
+    end
+
+    hl.config({
+      plugin = {
+        hyprtasking = {
+          layout = "grid",
+          -- hyprtasking reads bg_color as 0xAARRGGBB and forces it opaque, so
+          -- the stock default (0x000000FF) renders as solid blue. Pin true black.
+          bg_color = 0xff000000,
+          gap_size = 10,
+          -- Active workspace tile is bordered with general:col.active_border,
+          -- inactive tiles with col.inactive_border; this is the selection
+          -- highlight and it follows hyprtasking:move. Keep it clearly visible.
+          border_size = 3,
+          exit_on_hovered = false,
+          close_overview_on_reload = false,
+          jump = {
+            enabled = true,
+          },
+          grid = {
+            rows = 3,
+            cols = 3,
+          },
         },
       },
     })
@@ -292,15 +353,6 @@ function M.setup(ctx)
       },
     })
 
-    if enable_hyprwobbly then
-      hl.config({
-        plugin = {
-          hyprwobbly = {
-            enabled = visual_effects_enabled and 1 or 0,
-          },
-        },
-      })
-    end
   end
 
   local function toggle_visual_performance_mode()
@@ -323,6 +375,18 @@ function M.setup(ctx)
     hl.workspace_rule({ workspace = "w[tv1]s[false]", gaps_out = 0, gaps_in = 0 })
     hl.workspace_rule({ workspace = "f[1]s[false]", gaps_out = 0, gaps_in = 0 })
 
+    hl.window_rule({
+      name = "tagged-gaming-window",
+      match = { tag = gaming_window_tag },
+      idle_inhibit = "fullscreen",
+      opaque = true,
+      no_blur = true,
+      no_shadow = true,
+      no_anim = true,
+      rounding = 0,
+      border_size = 0,
+    })
+
     hl.window_rule({ match = { class = "^()$", title = "^()$" }, float = true })
     hl.window_rule({ match = { title = "^(Picture-in-Picture)$" }, float = true })
     hl.window_rule({
@@ -349,8 +413,30 @@ function M.setup(ctx)
       focus_on_activate = true,
       stay_focused = true,
     })
+    hl.window_rule({
+      name = "portal-gtk-dialogs",
+      match = { class = file_chooser_class_rule },
+      float = true,
+      center = true,
+      focus_on_activate = true,
+      stay_focused = true,
+    })
     hl.window_rule({ match = { title = "^(Confirm)$" }, float = true })
 
+    -- The AI desktop apps fire xdg-activation requests while streaming
+    -- responses; with misc:focus_on_activate=true that steals focus from
+    -- whatever window the user is actually working in. focus_on_activate is
+    -- a dynamic rule (applies to already-mapped windows on reload);
+    -- suppress_event only applies at map time.
+    for index, class in ipairs({ "^(com\\.anthropic\\.Claude|claude-desktop)$", "^(codex-desktop)$" }) do
+      hl.window_rule({
+        name = "ai-app-no-activate-focus-" .. tostring(index),
+        match = { class = class },
+        focus_on_activate = false,
+        suppress_event = "activatefocus",
+      })
+    end
+
     for index, match in ipairs({
       { class = "^(flameshot)$" },
       { title = "^(flameshot)$" },
@@ -411,7 +497,8 @@ function M.setup(ctx)
 
   ctx.apply_rules = apply_rules
   ctx.apply_hyprglass_config = apply_hyprglass_config
-  ctx.apply_hyprwobbly_config = apply_hyprwobbly_config
+  ctx.apply_dynamic_cursors_config = apply_dynamic_cursors_config
+  ctx.apply_hyprtasking_config = apply_hyprtasking_config
   ctx.apply_visual_performance_mode = apply_visual_performance_mode
   ctx.is_file_chooser_window = is_file_chooser_window
   ctx.raise_file_chooser_window = raise_file_chooser_window

dotfiles/config/hypr/hyprland/state.lua

@@ -2,6 +2,7 @@ local shell_ui_command = "hypr_shell_ui"
 local columns_layout = "nStack"
 local large_main_layout = "master"
 local grid_layout = "grid"
+local quadrants_layout = "quadrants"
 local monocle_layout = "monocle"
 
 return {
@@ -33,29 +34,53 @@ return {
   columns_layout = columns_layout,
   large_main_layout = large_main_layout,
   grid_layout = grid_layout,
+  quadrants_layout = quadrants_layout,
   monocle_layout = monocle_layout,
-  layout_cycle = { columns_layout, large_main_layout, grid_layout },
+  layout_cycle = { columns_layout, large_main_layout, quadrants_layout, grid_layout },
   layout_names = {
     [columns_layout] = "Columns",
     [large_main_layout] = "Large main",
+    [quadrants_layout] = "Quadrants",
     [grid_layout] = "Grid",
     [monocle_layout] = "Monocle",
   },
   minimized_workspace = "special:minimized",
   inactive_opacity_override_tag = "no-inactive-opacity",
+  gaming_window_tag = "gaming",
+  gaming_window_disabled_tag = "no-gaming",
+  gaming_window_class_patterns = {},
+  gaming_window_title_patterns = {},
+  gaming_window_excluded_class_patterns = {
+    "^[Hh]eroic$",
+    "^[Ss]team$",
+  },
+  gaming_window_excluded_title_patterns = {
+    "^Heroic Games Launcher$",
+    "^Steam$",
+  },
   tabbed_group_restore_workspace_prefix = "special:tabbed-monocle-restore-",
   current_layout = columns_layout,
   enable_nstack = true,
-  enable_hyprexpo = true,
+  -- Disabled 2026-06-11: live-preview backend SEGVs Hyprland (shouldRenderWindow
+  -- hook fires on every popup commit). Re-enable once fixed upstream.
+  enable_hyprexpo = false,
   enable_hyprwinview = true,
+  enable_hyprtasking = true,
   enable_workspace_history = true,
-  enable_hyprwobbly = true,
+  -- Disabled 2026-06-28: causes the cursor to intermittently disappear
+  -- (confirmed by unloading the plugin live — cursor stopped vanishing).
+  -- It replaces cursor rendering via lockSoftwareAll for its tilt/shake
+  -- effects. Re-enable only after verifying upstream fixed this.
+  enable_dynamic_cursors = false,
   enable_hyprglass = false,
+  hyprland_gaps_enabled = os.getenv("IMALISON_HYPRLAND_GAPS") ~= "0",
+  hyprland_cursor_size = tonumber(os.getenv("IMALISON_HYPRLAND_CURSOR_SIZE")) or 24,
   hypr_visual_performance_mode = false,
   configure_nstack_plugin_from_lua = false,
   workspace_layouts = {},
   minimized_windows = {},
   tabbed_workspace_groups = {},
+  quadrants_arranging = false,
   window_picker_mode = nil,
   window_picker_candidates = {},
   stack_update_timer = nil,

dotfiles/config/hypr/hyprland/windows.lua

@@ -122,6 +122,45 @@ function M.setup(ctx)
     dispatch(hl.dsp.window.resize())
   end
 
+  local function float_active_window_to_default_scratchpad_geometry()
+    local window = hl.get_active_window()
+    local selector = window_selector(window)
+    if not selector then
+      return
+    end
+
+    local geometry = default_scratchpad_geometry(hl.get_active_monitor())
+    if not geometry then
+      return
+    end
+
+    dispatch(hl.dsp.window.fullscreen_state({
+      internal = 0,
+      client = 0,
+      action = "set",
+      window = selector,
+    }))
+    mark_window_as_floating_scratchpad(window, matching_scratchpad_name(window))
+    dispatch(hl.dsp.window.resize({ x = geometry.width, y = geometry.height, relative = false, window = selector }))
+    dispatch(hl.dsp.window.move({ x = geometry.x, y = geometry.y, relative = false, window = selector }))
+  end
+
+  local function tile_or_float_active_window()
+    local window = hl.get_active_window()
+    local selector = window_selector(window)
+    if not selector then
+      return
+    end
+
+    if window.floating then
+      clear_floating_scratchpad_state(window)
+      dispatch(hl.dsp.window.float({ action = "disable", window = selector }))
+      return
+    end
+
+    float_active_window_to_default_scratchpad_geometry()
+  end
+
   local function toggle_pinned_active_window()
     local window = hl.get_active_window()
     local selector = window_selector(window)
@@ -365,6 +404,108 @@ function M.setup(ctx)
     return false
   end
 
+  local function value_matches_any_pattern(value, patterns)
+    value = tostring(value or "")
+    if value == "" then
+      return false
+    end
+
+    for _, pattern in ipairs(patterns or {}) do
+      if value:find(pattern) then
+        return true
+      end
+    end
+    return false
+  end
+
+  local function is_game_like_window(window)
+    if not window then
+      return false
+    end
+
+    if window_has_tag(window, gaming_window_disabled_tag) then
+      return false
+    end
+    if
+      value_matches_any_pattern(window.class, gaming_window_excluded_class_patterns)
+      or value_matches_any_pattern(window.initial_class, gaming_window_excluded_class_patterns)
+      or value_matches_any_pattern(window.title, gaming_window_excluded_title_patterns)
+      or value_matches_any_pattern(window.initial_title, gaming_window_excluded_title_patterns)
+    then
+      return false
+    end
+
+    return tostring(window.content_type or window.content or "") == "game"
+      or window_has_tag(window, gaming_window_tag)
+      or value_matches_any_pattern(window.class, gaming_window_class_patterns)
+      or value_matches_any_pattern(window.initial_class, gaming_window_class_patterns)
+      or value_matches_any_pattern(window.title, gaming_window_title_patterns)
+      or value_matches_any_pattern(window.initial_title, gaming_window_title_patterns)
+  end
+
+  local function set_window_gaming_mode(window, enabled, opts)
+    local selector = window_selector(window)
+    if not selector then
+      return
+    end
+
+    if enabled then
+      dispatch(hl.dsp.window.tag({ tag = "-" .. gaming_window_disabled_tag, window = selector }))
+      dispatch(hl.dsp.window.tag({ tag = "+" .. gaming_window_tag, window = selector }))
+      dispatch(hl.dsp.window.fullscreen_state({
+        internal = 2,
+        client = 2,
+        action = "set",
+        window = selector,
+      }))
+    else
+      dispatch(hl.dsp.window.tag({ tag = "-" .. gaming_window_tag, window = selector }))
+      dispatch(hl.dsp.window.tag({ tag = "+" .. gaming_window_disabled_tag, window = selector }))
+      dispatch(hl.dsp.window.fullscreen_state({
+        internal = 0,
+        client = 0,
+        action = "set",
+        window = selector,
+      }))
+    end
+
+    if not (opts and opts.quiet) then
+      hl.notification.create({
+        text = "Gaming fullscreen: " .. (enabled and "on" or "off"),
+        duration = 1600,
+        icon = enabled and notification_icons.ok or notification_icons.info,
+        color = enabled and "rgba(33ccffee)" or "rgba(edb443ff)",
+        font_size = 13,
+      })
+    end
+  end
+
+  local function toggle_active_window_gaming_mode()
+    local window = hl.get_active_window()
+    if not window then
+      return
+    end
+
+    set_window_gaming_mode(window, not window_has_tag(window, gaming_window_tag))
+  end
+
+  local function toggle_active_window_real_fullscreen()
+    local window = hl.get_active_window()
+    if not window then
+      return
+    end
+
+    local fullscreen = tonumber(window.fullscreen) or 0
+    local fullscreen_client = tonumber(window.fullscreen_client) or 0
+    local enabling = fullscreen ~= 2 or fullscreen_client ~= 2
+    dispatch(hl.dsp.window.fullscreen_state({
+      internal = enabling and 2 or 0,
+      client = enabling and 2 or 0,
+      action = "set",
+      window = window_selector(window),
+    }))
+  end
+
   local function toggle_inactive_opacity_for_active_window()
     local window = hl.get_active_window()
     local selector = window_selector(window)
@@ -481,6 +622,8 @@ function M.setup(ctx)
   ctx.float_active_window_preserving_tiled_geometry = float_active_window_preserving_tiled_geometry
   ctx.float_and_drag_active_window = float_and_drag_active_window
   ctx.float_and_resize_active_window = float_and_resize_active_window
+  ctx.float_active_window_to_default_scratchpad_geometry = float_active_window_to_default_scratchpad_geometry
+  ctx.tile_or_float_active_window = tile_or_float_active_window
   ctx.toggle_pinned_active_window = toggle_pinned_active_window
   ctx.current_minimized_windows = current_minimized_windows
   ctx.restore_minimized_window = restore_minimized_window
@@ -490,6 +633,12 @@ function M.setup(ctx)
   ctx.gather_focused_class = gather_focused_class
   ctx.focus_next_class = focus_next_class
   ctx.show_active_window_info = show_active_window_info
+  ctx.window_has_tag = window_has_tag
+  ctx.value_matches_any_pattern = value_matches_any_pattern
+  ctx.is_game_like_window = is_game_like_window
+  ctx.set_window_gaming_mode = set_window_gaming_mode
+  ctx.toggle_active_window_gaming_mode = toggle_active_window_gaming_mode
+  ctx.toggle_active_window_real_fullscreen = toggle_active_window_real_fullscreen
   ctx.toggle_inactive_opacity_for_active_window = toggle_inactive_opacity_for_active_window
   ctx.raise_or_spawn = raise_or_spawn
   ctx.minimize_active_window = minimize_active_window

dotfiles/config/river-xmonad/Main.hs

@@ -147,6 +147,7 @@ spawnBindings =
   , key (super .|. alt) xK_s (toggleScratchpad "spotify")
   , key (super .|. alt) xK_t (toggleScratchpad "transmission")
   , key (super .|. alt) xK_v (toggleScratchpad "volume")
+  , key (super .|. alt) xK_x (toggleScratchpad "x-com")
   , key (super .|. alt) xK_c (spawnAction "google-chrome-stable")
   , key super xK_e (spawnAction "emacsclient --eval '(emacs-everywhere)'")
   , key (super .|. ctrl) xK_e (shiftFocusedToNextEmptyWorkspace False)
@@ -165,7 +166,7 @@ spawnBindings =
   , key (hyper .|. shift) xK_k (spawnAction "rofi_kill_all.sh")
   , key hyper xK_r (spawnAction "rofi_systemd_mono")
   , key hyper xK_9 (spawnAction "start_synergy.sh")
-  , key hyper xK_backslash (spawnAction "$HOME/dotfiles/dotfiles/lib/functions/mpg341cx_input toggle")
+  , key hyper xK_backslash (spawnAction "mpg341cx_input toggle")
   , key hyper xK_i (spawnAction "rofi_select_input.hs")
   , key hyper xK_o (spawnAction "rofi_paswitch")
   , key hyper xK_comma (spawnAction "rofi_wallpaper.sh")
@@ -297,6 +298,8 @@ scratchpadDefinitions =
       anyMatcher [titleContains "Transmission", appIdContains "transmission"]
   , ScratchpadDefinition "volume" "pavucontrol" $
       anyMatcher [appIdMatches "Pavucontrol", appIdContains "pavucontrol"]
+  , ScratchpadDefinition "x-com" "x-com-pwa" $
+      anyMatcher [appIdMatches "x-com-pwa", appIdContains "chrome-x.com"]
   ]
 
 anyMatcher :: [RiverWMWindowState -> Bool] -> RiverWMWindowState -> Bool

dotfiles/config/rofi/apple-frost.rasi

@@ -15,8 +15,11 @@ configuration {
     backdrop:        #0b102026;
     panel:           #00000000;
     control:         #ffffffe0;
+    candidate-soft:  #0b102018;
+    candidate-frost: #ffffff12;
     candidate:       #18203372;
-    candidate-active:#2430489c;
+    candidate-active:#0a84ffd9;
+    candidate-line:  #ffffff16;
     text:            #111827ff;
     text-muted:      #667085ff;
     text-on-dark:    #f8fafcff;
@@ -53,6 +56,7 @@ mainbox {
 inputbar {
     background-color: @control;
     text-color: @text;
+    height: 50px;
     children: [ prompt, entry ];
     border: 1px;
     border-color: @hairline;
@@ -80,11 +84,10 @@ entry {
 listview {
     background-color: @bg;
     columns: 1;
-    lines: 10;
+    lines: 17;
     spacing: 0px;
-    border: 1px;
-    border-color: @border;
-    border-radius: 14px;
+    border: 0px;
+    border-radius: 0px 0px 14px 14px;
     cycle: false;
     dynamic: true;
     layout: vertical;
@@ -96,12 +99,24 @@ element {
     text-color: @text-on-dark;
     orientation: horizontal;
     border: 0px 0px 1px 0px;
-    border-color: @hairline;
+    border-color: @candidate-line;
     border-radius: 0px;
-    padding: 11px 11px;
+    /*
+     * Rofi percentages are monitor-relative. Derive padding from:
+     * 78% - 176px mainbox padding - 50px inputbar - 10px spacing - 2px border.
+     */
+    padding: calc( ( 78% - 238px ) / 34 - 12px ) 11px calc( ( 78% - 238px ) / 34 - 13px ) 11px;
     spacing: 10px;
 }
 
+element normal {
+    background-color: @candidate-soft;
+}
+
+element alternate {
+    background-color: @candidate-soft;
+}
+
 element-icon {
     background-color: @bg;
     text-color: inherit;
@@ -117,9 +132,10 @@ element-text {
 }
 
 element selected {
-    background-color: @candidate;
+    background-color: @candidate-active;
     text-color: @text-on-dark;
-    border-color: @border;
+    border: 0px 0px 1px 4px;
+    border-color: @accent-soft;
 }
 
 element selected element-text {

dotfiles/config/taffybar/AGENTS.md

@@ -23,7 +23,7 @@
 - Do not create extra panes or windows unless the user asks.
 
 ## NixOS workflow
-- This system is managed with a Nix flake at `~/dotfiles/nixos`.
+- This system is managed with a Nix flake at `/etc/nixos` (`/srv/dotfiles/nixos`).
 - Use `just switch` from that directory for rebuilds instead of plain `nixos-rebuild`.
 - Host configs live under `machines/`; choose the appropriate host when needed.
 

dotfiles/config/taffybar/TaffybarConfig/AIUsage.hs

@@ -0,0 +1,116 @@
+{-# LANGUAGE OverloadedStrings #-}
+
+-- | A usage widget that follows the Hyprland AI scratchpad selection.
+--
+-- The Hyprland config (scratchpads.lua) lets SUPER+ALT+C toggle whichever AI
+-- app is currently selected via rofi_ai_scratchpad.sh, which records the
+-- choice in $XDG_STATE_HOME/hypr/ai-scratchpad. This widget reads the same
+-- state file and shows the matching provider's usage section (OpenAI for
+-- "codex", Anthropic for "claude"), switching live when the file changes.
+module TaffybarConfig.AIUsage
+  ( aiUsageWidget,
+  )
+where
+
+import Control.Exception (IOException, try)
+import Control.Monad (void)
+import Control.Monad.IO.Class (liftIO)
+import Data.Text (Text)
+import qualified Data.Text as T
+import qualified GI.Gtk as Gtk
+import qualified System.FSNotify as FSNotify
+import System.Directory (createDirectoryIfMissing, getHomeDirectory)
+import System.Environment (lookupEnv)
+import System.FilePath (takeFileName, (</>))
+import System.Taffybar.Context (TaffyIO)
+import System.Taffybar.Util (postGUIASync)
+import System.Taffybar.Widget.AnthropicUsage
+  ( AnthropicUsageDisplayMode (AnthropicUsageDisplayRemaining),
+    AnthropicUsageStackConfig (..),
+    anthropicUsageSectionNewWith,
+    defaultAnthropicUsageStackConfig,
+  )
+import System.Taffybar.Widget.OpenAIUsage
+  ( OpenAIUsageDisplayMode (OpenAIUsageDisplayRemaining),
+    OpenAIUsageStackConfig (..),
+    defaultOpenAIUsageStackConfig,
+    openAIUsageSectionNewWith,
+  )
+import TaffybarConfig.WidgetUtil (decorateWithClassAndBox, usageLogoWidget)
+
+codexChild, claudeChild :: Text
+codexChild = "codex"
+claudeChild = "claude"
+
+aiScratchpadStateDir :: IO FilePath
+aiScratchpadStateDir = do
+  stateHome <- lookupEnv "XDG_STATE_HOME"
+  base <- case stateHome of
+    Just dir | not (null dir) -> pure dir
+    _ -> (</> ".local/state") <$> getHomeDirectory
+  pure (base </> "hypr")
+
+aiScratchpadStateFile :: FilePath
+aiScratchpadStateFile = "ai-scratchpad"
+
+-- | Read the currently selected AI scratchpad, defaulting to codex like the
+-- Hyprland side does.
+readActiveAIScratchpad :: IO Text
+readActiveAIScratchpad = do
+  dir <- aiScratchpadStateDir
+  result <- try (readFile (dir </> aiScratchpadStateFile)) :: IO (Either IOException String)
+  pure $ case result of
+    Right contents
+      | T.strip (T.pack contents) == claudeChild -> claudeChild
+    _ -> codexChild
+
+openAIUsageSection :: TaffyIO Gtk.Widget
+openAIUsageSection = do
+  iconWidget <- liftIO $ usageLogoWidget "openai-symbol.svg" "OpenAI usage"
+  openAIUsageSectionNewWith
+    iconWidget
+    defaultOpenAIUsageStackConfig
+      { openAIUsageStackDefaultDisplayMode = OpenAIUsageDisplayRemaining
+      }
+
+anthropicUsageSection :: TaffyIO Gtk.Widget
+anthropicUsageSection = do
+  iconWidget <- liftIO $ usageLogoWidget "claude-symbol.svg" "Claude usage"
+  anthropicUsageSectionNewWith
+    iconWidget
+    defaultAnthropicUsageStackConfig
+      { anthropicUsageStackDefaultDisplayMode = AnthropicUsageDisplayRemaining
+      }
+
+-- | Show usage for whichever AI app the Hyprland AI scratchpad currently
+-- targets, switching live when the selection changes.
+aiUsageWidget :: TaffyIO Gtk.Widget
+aiUsageWidget = do
+  openAIWidget <- openAIUsageSection
+  anthropicWidget <- anthropicUsageSection
+  stackWidget <- liftIO $ do
+    stack <- Gtk.stackNew
+    Gtk.stackAddNamed stack openAIWidget codexChild
+    Gtk.stackAddNamed stack anthropicWidget claudeChild
+    readActiveAIScratchpad >>= Gtk.stackSetVisibleChildName stack
+
+    let syncVisibleChild =
+          readActiveAIScratchpad
+            >>= \name -> postGUIASync (Gtk.stackSetVisibleChildName stack name)
+
+    void $ Gtk.onWidgetRealize stack $ do
+      stateDir <- aiScratchpadStateDir
+      createDirectoryIfMissing True stateDir
+      manager <- FSNotify.startManager
+      void $
+        FSNotify.watchDir
+          manager
+          stateDir
+          ((== aiScratchpadStateFile) . takeFileName . FSNotify.eventPath)
+          (const syncVisibleChild)
+      syncVisibleChild
+      void $ Gtk.onWidgetUnrealize stack $ FSNotify.stopManager manager
+
+    Gtk.widgetShowAll stack
+    Gtk.toWidget stack
+  decorateWithClassAndBox "ai-usage" stackWidget

dotfiles/config/taffybar/TaffybarConfig/ChromeFavicons.hs

@@ -10,8 +10,8 @@ module TaffybarConfig.ChromeFavicons
   )
 where
 
-import Control.Exception (IOException, try)
-import Control.Monad (unless, when)
+import Control.Exception (IOException, SomeException, try)
+import Control.Monad (unless, void)
 import Control.Monad.IO.Class (liftIO)
 import Data.Char (isAlphaNum)
 import Data.Int (Int32)
@@ -24,6 +24,7 @@ import System.Directory
   ( createDirectoryIfMissing,
     doesFileExist,
     getFileSize,
+    removeFile,
     renameFile,
   )
 import System.Environment.XDG.BaseDir (getUserCacheDir)
@@ -204,10 +205,11 @@ loadCachedFavicon size url = do
   path <- ensureCachedFavicon url
   case path of
     Just faviconPath ->
-      try @IOException (Gdk.pixbufNewFromFileAtScale faviconPath size size True) >>= \case
-        Right (Just pixbuf) -> pure (Just pixbuf)
-        Right Nothing -> pure Nothing
-        Left _ -> pure Nothing
+      loadPixbuf faviconPath size >>= \case
+        Just pixbuf -> pure (Just pixbuf)
+        Nothing -> do
+          removeCachedFavicon faviconPath
+          pure Nothing
     Nothing -> pure Nothing
 
 ensureCachedFavicon :: Text -> IO (Maybe FilePath)
@@ -254,7 +256,9 @@ faviconExtension url =
 downloadFavicon :: Text -> FilePath -> IO ()
 downloadFavicon url path = do
   let tmp = path <> ".tmp"
-  (code, _, _) <-
+  removeCachedFavicon tmp
+  result <-
+    try @IOException $
       readProcessWithExitCode
         "curl"
         [ "-fsSL",
@@ -267,8 +271,13 @@ downloadFavicon url path = do
           T.unpack url
         ]
         ""
-  when (code == ExitSuccess) $
-    renameFile tmp path
+  case result of
+    Right (ExitSuccess, _, _) -> do
+      mPixbuf <- loadPixbuf tmp 1
+      case mPixbuf of
+        Just _ -> renameFile tmp path
+        Nothing -> removeCachedFavicon tmp
+    _ -> removeCachedFavicon tmp
 
 nonEmptyFileExists :: FilePath -> IO Bool
 nonEmptyFileExists path = do
@@ -318,3 +327,13 @@ composeChromeFavicon cfg size favicon chromeIcon = do
 scalePixbuf :: Int32 -> Gdk.Pixbuf -> IO Gdk.Pixbuf
 scalePixbuf size pixbuf =
   fromMaybe pixbuf <$> Gdk.pixbufScaleSimple pixbuf size size GdkPixbuf.InterpTypeBilinear
+
+loadPixbuf :: FilePath -> Int32 -> IO (Maybe Gdk.Pixbuf)
+loadPixbuf path size =
+  try @SomeException (Gdk.pixbufNewFromFileAtScale path size size True) >>= \case
+    Right pixbuf -> pure pixbuf
+    Left _ -> pure Nothing
+
+removeCachedFavicon :: FilePath -> IO ()
+removeCachedFavicon path =
+  void $ try @IOException (removeFile path)

dotfiles/config/taffybar/TaffybarConfig/Config.hs

@@ -3,7 +3,7 @@ module TaffybarConfig.Config
   )
 where
 
-import TaffybarConfig.Host (compactBarHosts, smallBarHosts)
+import TaffybarConfig.Host (compactBarHosts, smallBarHosts, tinyBarHosts)
 import TaffybarConfig.Widgets (clockWidget, endWidgetsForHost, startWidgetsForHostAndBackend)
 import System.Taffybar.Context (Backend)
 import System.Taffybar.SimpleConfig
@@ -18,6 +18,9 @@ mkSimpleTaffyConfig hostName backend cssFiles =
       barPosition = Top,
       widgetSpacing = 0,
       barPadding =
+        if hostName `elem` tinyBarHosts
+          then 0
+          else
             if hostName `elem` smallBarHosts
               then 1
               else
@@ -25,11 +28,14 @@ mkSimpleTaffyConfig hostName backend cssFiles =
                   then 2
                   else 4,
       barHeight =
+        if hostName `elem` tinyBarHosts
+          then ScreenRatio $ 1 / 90
+          else
             if hostName `elem` smallBarHosts
-          then ScreenRatio $ 1 / 48
+              then ScreenRatio $ 1 / 72
               else
                 if hostName `elem` compactBarHosts
-              then ScreenRatio $ 1 / 40
-              else ScreenRatio $ 1 / 33,
+                  then ScreenRatio $ 1 / 60
+                  else ScreenRatio $ 2 / 99,
       cssPaths = cssFiles
     }

dotfiles/config/taffybar/TaffybarConfig/Host.hs

@@ -3,6 +3,7 @@ module TaffybarConfig.Host
     cssFilesForHost,
     laptopHosts,
     smallBarHosts,
+    tinyBarHosts,
   )
 where
 
@@ -16,7 +17,8 @@ defaultCssFiles = ["taffybar.css"]
 
 cssFilesByHostname :: [(String, [FilePath])]
 cssFilesByHostname =
-  [ ("ryzen-shine", ["ryzen-shine.css"]),
+  [ ("jay-lenovo", ["jay-lenovo.css"]),
+    ("ryzen-shine", ["ryzen-shine.css"]),
     ("strixi-minaj", ["strixi-minaj.css"])
   ]
 
@@ -28,6 +30,10 @@ smallBarHosts :: [String]
 smallBarHosts =
   ["strixi-minaj"]
 
+tinyBarHosts :: [String]
+tinyBarHosts =
+  ["jay-lenovo"]
+
 laptopHosts :: [String]
 laptopHosts =
   [ "adell",

dotfiles/config/taffybar/TaffybarConfig/Widgets.hs

@@ -33,12 +33,6 @@ import qualified System.Taffybar.Widget.Audio as Audio
 import System.Taffybar.Widget.CPUMonitor (cpuMonitorNew)
 import System.Taffybar.Widget.Generic.Graph (GraphConfig (..), GraphDirection (..), GraphStyle (..), defaultGraphConfig)
 import qualified System.Taffybar.Widget.NetworkManager as NetworkManager
-import System.Taffybar.Widget.OpenAIUsage
-  ( OpenAIUsageDisplayMode (OpenAIUsageDisplayRemaining),
-    OpenAIUsageStackConfig (..),
-    defaultOpenAIUsageStackConfig,
-    openAIUsageSectionNewWith,
-  )
 import System.Taffybar.Widget.SNIMenu (withNmAppletMenu)
 import System.Taffybar.Widget.SNITray
   ( CollapsibleSNITrayParams (..),
@@ -60,6 +54,7 @@ import System.Taffybar.Widget.Util
   )
 import qualified System.Taffybar.Widget.Wlsunset as Wlsunset
 import qualified System.Taffybar.Widget.Workspaces as Workspaces
+import TaffybarConfig.AIUsage (aiUsageWidget)
 import TaffybarConfig.Host (laptopHosts)
 import TaffybarConfig.WidgetUtil
   ( decorateWithClassAndBox,
@@ -355,9 +350,9 @@ omniMenuWidget =
               OmniMenuSection
                 "System"
                 [ omniMenuItem "Lock" "system-lock-screen" "loginctl lock-session",
-                  omniMenuItem "Toggle screensaver" "video-display" "/home/imalison/dotfiles/dotfiles/lib/bin/hypr-screensaver toggle",
+                  omniMenuItem "Toggle screensaver" "video-display" "hypr-screensaver toggle",
                   omniMenuItem "Reload WM" "view-refresh" "sh -lc 'hyprctl reload || xmonad --restart || river-xmonad-restart'",
-                  omniMenuItem "Restart taffybar" "view-refresh-symbolic" "/home/imalison/dotfiles/dotfiles/config/taffybar/scripts/taffybar-restart",
+                  omniMenuItem "Restart taffybar" "view-refresh-symbolic" "/srv/dotfiles/dotfiles/config/taffybar/scripts/taffybar-restart",
                   omniMenuItem "Logout" "system-log-out" "sh -lc 'hyprctl dispatch exit || riverctl exit'",
                   omniMenuItem "Suspend" "media-playback-pause" "systemctl suspend",
                   omniMenuItem "Reboot" "system-reboot" "systemctl reboot",
@@ -375,16 +370,6 @@ usageSectionWidget klass iconFile tooltip stackBuilder =
       section <- buildIconLabelBox iconWidget stack
       widgetSetClassGI section "usage-section"
 
-openAIUsageWidget :: TaffyIO Gtk.Widget
-openAIUsageWidget = do
-  iconWidget <- liftIO $ usageLogoWidget "openai-symbol.svg" "OpenAI usage"
-  decorateWithClassAndBoxM "openai-usage" $
-    openAIUsageSectionNewWith
-      iconWidget
-      defaultOpenAIUsageStackConfig
-        { openAIUsageStackDefaultDisplayMode = OpenAIUsageDisplayRemaining
-        }
-
 sniPriorityVisibilityThresholdDefault :: Int
 sniPriorityVisibilityThresholdDefault = 0
 
@@ -445,7 +430,7 @@ endWidgetsForHost hostName =
   let baseEndWidgets =
         [ sniTrayWidget,
           audioWidget,
-          openAIUsageWidget,
+          aiUsageWidget,
           cpuWidget,
           ramSwapWidget,
           diskUsageWidget,
@@ -458,7 +443,7 @@ endWidgetsForHost hostName =
           sniTrayWidget,
           asusDiskUsageWidget,
           audioBacklightWidget,
-          openAIUsageWidget,
+          aiUsageWidget,
           cpuWidget,
           ramSwapWidget,
           sunLockWidget,

dotfiles/config/taffybar/TaffybarConfig/Workspaces.hs

@@ -191,6 +191,5 @@ workspaceWindowIconGetter :: Workspaces.WindowIconPixbufGetter
 workspaceWindowIconGetter =
   chromeFaviconIconGetter chromeFaviconConfig
     <|||> workspaceManualIconGetter
-    <|||> Workspaces.getWindowIconPixbufFromChrome
     <|||> Workspaces.defaultGetWindowIconPixbuf
     <|||> workspaceFallbackIcon

dotfiles/config/taffybar/flake.lock

@@ -136,17 +136,17 @@
         "xmonad-contrib": "xmonad-contrib"
       },
       "locked": {
-        "lastModified": 1778673962,
-        "narHash": "sha256-GmHRMdrUIQpMf6k5gRjP9Mvx2WO0FvIEF1SPlxEpnas=",
-        "owner": "taffybar",
-        "repo": "taffybar",
-        "rev": "08125b267c03232c560fce6259264cc9283d582e",
-        "type": "github"
+        "lastModified": 1783808147,
+        "narHash": "sha256-BFfbNqeja2tChyOP+2Fmh1QtDqTHJWM+RiOsOEUoAfE=",
+        "ref": "refs/heads/master",
+        "rev": "edb35b03f9c3f6370a2749d1a2203dcaccf00a2b",
+        "revCount": 2371,
+        "type": "git",
+        "url": "file:./dotfiles/config/taffybar/taffybar"
       },
       "original": {
-        "owner": "taffybar",
-        "repo": "taffybar",
-        "type": "github"
+        "type": "git",
+        "url": "file:./dotfiles/config/taffybar/taffybar"
       }
     },
     "weeder-nix": {

dotfiles/config/taffybar/flake.nix

@@ -1,10 +1,13 @@
 {
   inputs = {
     taffybar = {
-      # Keep the default source usable in CI. Local iteration uses
-      # IMALISON_TAFFYBAR_LIVE_CHECKOUT below via `just switch-local-taffybar`.
-      url = "github:taffybar/taffybar";
-      inputs.weeder-nix.inputs.pre-commit-hooks.inputs.nixpkgs.follows = "nixpkgs";
+      # Use the vendored checkout so normal NixOS rebuilds consume the same
+      # taffybar tree used for local development.
+      url = "git+file:./dotfiles/config/taffybar/taffybar";
+      inputs.weeder-nix = {
+        url = "github:NorfairKing/weeder-nix";
+        inputs.pre-commit-hooks.inputs.nixpkgs.follows = "nixpkgs";
+      };
     };
     # Follow the vendored taffybar flake's pins so the config shell and the
     # library shell mostly share their nixpkgs/Haskell dependency graph.
@@ -35,14 +38,7 @@
           config.allowBroken = true;
         };
 
-        # Default to the flake input so normal NixOS rebuilds stay pinned and
-        # reproducible. switch-local-taffybar opts into the live checkout via
-        # IMALISON_TAFFYBAR_LIVE_CHECKOUT when iterating on the vendored stack.
-        liveTaffybarCheckout = builtins.getEnv "IMALISON_TAFFYBAR_LIVE_CHECKOUT";
-        taffybarSourceRoot =
-          if liveTaffybarCheckout != ""
-          then /. + liveTaffybarCheckout
-          else taffybar.outPath;
+        taffybarSourceRoot = taffybar.outPath;
 
         cleanedTaffybarSource = pkgs.lib.cleanSourceWith {
           src = taffybarSourceRoot;
@@ -129,6 +125,16 @@
             (oa: {
               doHaddock = false;
               doCheck = false;
+              # Debug build: keep symbols (.symtab) and emit DWARF so SIGSEGV
+              # coredumps symbolize to real function + source lines instead of
+              # stripped hex. This library is statically linked into the
+              # imalison-taffybar executable, so its symbols flow through to the
+              # final binary. Revert (drop dontStrip + -g3) once the recurring
+              # GC/heap-corruption crash is root-caused.
+              dontStrip = true;
+              configureFlags = (oa.configureFlags or []) ++ [
+                "--ghc-option=-g3"
+              ];
               # Needed for gi-gtk-layer-shell and gi-wireplumber introspection data.
               librarySystemDepends = (oa.librarySystemDepends or []) ++ [
                 pkgs.gtk-layer-shell
@@ -170,10 +176,16 @@
               pkgs.libxtst.out
             ])
             (oa: {
+              # Debug build: keep the executable's .symtab (so statically
+              # linked RTS + taffybar symbols resolve in coredumps) and emit
+              # DWARF line info. See the taffybar override above; revert both
+              # once the recurring GC/heap-corruption SIGSEGV is root-caused.
+              dontStrip = true;
               configureFlags = (oa.configureFlags or []) ++ [
                 "--ghc-option=-optl-fuse-ld=bfd"
                 "--ld-option=-fuse-ld=bfd"
                 "--with-ld=ld.bfd"
+                "--ghc-option=-g3"
               ];
             });
         };

dotfiles/config/taffybar/imalison-taffybar.cabal

@@ -13,7 +13,8 @@ cabal-version:       >=1.10
 executable taffybar
   hs-source-dirs:      .
   main-is:             taffybar.hs
-  other-modules:       TaffybarConfig.Config
+  other-modules:       TaffybarConfig.AIUsage
+                     , TaffybarConfig.Config
                      , TaffybarConfig.ChromeFavicons
                      , TaffybarConfig.Host
                      , TaffybarConfig.Widgets
@@ -27,6 +28,7 @@ executable taffybar
                      , containers
                      , directory
                      , filepath
+                     , fsnotify
                      , gi-gdk3
                      , gi-gtk3
                      , gi-gdkpixbuf

dotfiles/config/taffybar/jay-lenovo.css

@@ -0,0 +1,68 @@
+@import url("taffybar.css");
+
+/* Host-specific density tweak for jay-lenovo. */
+.taffy-box {
+	font-size: 8.5pt;
+	border-radius: 7px;
+}
+
+.outer-pad,
+.workspaces .outer-pad {
+	border-radius: 7px;
+	margin: 2px 3px;
+}
+
+.inner-pad,
+.workspaces .inner-pad {
+	border-radius: 6px;
+	padding-top: 0px;
+	padding-bottom: 0px;
+}
+
+.inner-pad {
+	padding-left: 8px;
+	padding-right: 8px;
+}
+
+.workspaces .inner-pad {
+	padding-left: 8px;
+	padding-right: 2px;
+}
+
+.workspaces .contents {
+	border-radius: 6px;
+	padding: 0px 2px;
+}
+
+.workspace-label {
+	font-size: 8pt;
+}
+
+.workspaces .overlay-box .workspace-label {
+	padding: 0px 3px 3px 9px;
+}
+
+.visible .contents,
+.workspaces .window-icon-container,
+.workspaces .window-icon-container.active {
+	padding-top: 0px;
+	padding-bottom: 0px;
+}
+
+.auto-size-image,
+.sni-tray {
+	padding-top: 0px;
+	padding-bottom: 0px;
+}
+
+.icon-label > .icon,
+.usage-section.icon-label > .icon,
+.ram-swap .icon-label > .icon {
+	padding-right: 6px;
+	min-width: 18px;
+}
+
+.sun-lock .wlsunset,
+.sun-lock .screen-lock {
+	padding: 0px 3px;
+}

dotfiles/config/taffybar/sni-priorities.yaml

@@ -21,7 +21,7 @@ priorities:
   priority: 0
 - key: item-id:flameshot
   priority: 0
-- key: item-id:keepbook-sync-daemon
+- key: item-id:keepbook-dioxus
   priority: 0
 - key: item-id:udiskie
   priority: 0
@@ -41,6 +41,8 @@ priorities:
   priority: -1
 - key: item-id:tailscale
   priority: -1
+- key: process:git-sync-rs
+  priority: -1
 - key: process:tailscale
   priority: -1
 - key: item-id:spotify-client

dotfiles/config/xmonad/flake.lock

@@ -126,12 +126,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1769740369,
-        "narHash": "sha256-xKPyJoMoXfXpDM5DFDZDsi9PHArf2k5BJjvReYXoFpM=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "6308c3b21396534d8aaeac46179c14c439a89b8a",
-        "type": "github"
+        "lastModified": 1783816212,
+        "narHash": "sha256-M2X3JTJp7ktX73uVDEAm0Rws2A/xljf4Cu1ojd/o8pU=",
+        "rev": "3b32825de172d0bc85664f495edb096b10862524",
+        "type": "tarball",
+        "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.11pre1033157.3b32825de172/nixexprs.tar.xz"
       },
       "original": {
         "id": "nixpkgs",
@@ -222,11 +221,11 @@
     },
     "unstable": {
       "locked": {
-        "lastModified": 1769461804,
-        "narHash": "sha256-msG8SU5WsBUfVVa/9RPLaymvi5bI8edTavbIq3vRlhI=",
+        "lastModified": 1783776592,
+        "narHash": "sha256-UgCQzxeWI75XM8G+hPrPh+MKzEPjG3SpAj7dtqSbksA=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "bfc1b8a4574108ceef22f02bafcf6611380c100d",
+        "rev": "e7a3ca8092b61ff85b6a45bf863ea2b2d6a661b3",
         "type": "github"
       },
       "original": {
@@ -246,11 +245,11 @@
         "unstable": "unstable"
       },
       "locked": {
-        "lastModified": 1767819257,
-        "narHash": "sha256-U7MIHr0B10wDSNgUvq4QTK22HZ4pl2oIYkdOKEMnxC4=",
+        "lastModified": 1782608065,
+        "narHash": "sha256-z6xC2YfE+bnxSeEhYBrEtogGjSuPVQKXxY8UpG1nN2Y=",
         "owner": "xmonad",
         "repo": "xmonad",
-        "rev": "bb33042d408c15d8727011b1ed4aa22b2716d73d",
+        "rev": "a9a8b5c1b91b63b0836f5810634c9b28ec0af788",
         "type": "github"
       },
       "original": {
@@ -271,11 +270,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1755152326,
-        "narHash": "sha256-47gGXt1TxzfQx/6X895t/T8Ozj+7fmQdU1i4cwyxcSg=",
+        "lastModified": 1771531632,
+        "narHash": "sha256-ZM8V9Dp4HSxaQKuB7kckU7PaAgMwsYbfHnKnPqr0Rbw=",
         "owner": "IvanMalison",
         "repo": "xmonad-contrib",
-        "rev": "1a8da46855ca83e11cfb31cbbaed980ed7a8dfcc",
+        "rev": "b71f9e4c9dfdbb71c1b55f30edb0da524b0ed251",
         "type": "github"
       },
       "original": {

dotfiles/config/xmonad/xmonad.hs

@@ -237,12 +237,18 @@ chromeSelectorBase = isChromeClass <$> className
 
 chromeSelector = chromeSelectorBase
 codexSelector = className =? "codex-desktop"
+discordSelector = className =? "Discord" <||> className =? "discord"
 elementSelector = className =? "Element"
 emacsSelector = className =? "Emacs"
 slackSelector = className =? "Slack"
 spotifySelector = className =? "Spotify"
 transmissionSelector = fmap (isPrefixOf "Transmission") title
 volumeSelector = className =? "Pavucontrol"
+xComSelector =
+  className =? "x-com-pwa"
+    <||> fmap ("chrome-x.com" `isInfixOf`) className
+    <||> (chromeSelectorBase <&&> title =? "X")
+    <||> fmap ("x.com" `isInfixOf`) title
 
 virtualClasses =
   [ (chromeSelector, "Chrome")
@@ -252,6 +258,7 @@ virtualClasses =
 -- Commands
 
 codexCommand = "codex_desktop_scratchpad"
+discordCommand = "discord"
 elementCommand = "element-desktop"
 emacsCommand = "emacsclient -c"
 htopCommand = "ghostty --title=htop -e htop"
@@ -259,6 +266,7 @@ slackCommand = "slack"
 spotifyCommand = "spotify"
 transmissionCommand = "transmission-gtk"
 volumeCommand = "pavucontrol"
+xComCommand = "x-com-pwa"
 
 -- Startup hook
 
@@ -802,12 +810,14 @@ nearFullFloat = customFloating $ W.RationalRect l t w h
 
 scratchpads =
   [ NS "codex" codexCommand codexSelector nearFullFloat
+  , NS "discord" discordCommand discordSelector nearFullFloat
   , NS "element" elementCommand elementSelector nearFullFloat
   , NS "htop" htopCommand (title =? "htop") nearFullFloat
   , NS "slack" slackCommand slackSelector nearFullFloat
   , NS "spotify" spotifyCommand spotifySelector nearFullFloat
   , NS "transmission" transmissionCommand transmissionSelector nearFullFloat
   , NS "volume" volumeCommand volumeSelector nearFullFloat
+  , NS "x-com" xComCommand xComSelector nearFullFloat
   ]
 
 
@@ -818,21 +828,9 @@ myScratchPadEventHook
   =  dynamicPropertyChange "WM_CLASS" myScratchPadManageHook
   <> dynamicPropertyChange "WM_NAME" myScratchPadManageHook
 
-runScratchPadManageHookOnCurrent =
-  join (withFocusedD (Endo id) $ runQuery myScratchPadManageHook) >>= windows . appEndo
-
-scratchPadIsDisplayed name = join $ withFocusedD False query
-  where
-    query = maybe (const $ return False) (runQuery . NS.query) scratchpadInfo
-    scratchpadInfo = find ((name ==) . NS.name) scratchpads
-
-manageIfScratchPadIsDisplayed name =
-  scratchPadIsDisplayed name >>= (`when` runScratchPadManageHookOnCurrent)
-
 -- TODO: This doesnt work well with minimized windows
 doScratchpad name = do
   maybeUnminimizeAfter $ deactivateFullAnd $ namedScratchpadAction scratchpads name
-  manageIfScratchPadIsDisplayed name
 
 -- Raise or spawn
 
@@ -1008,12 +1006,14 @@ addKeys conf@XConfig { modMask = modm } =
 
     -- ScratchPads
     [ ((modalt, xK_c), doScratchpad "codex")
+    , ((modalt, xK_d), doScratchpad "discord")
     , ((modalt, xK_e), doScratchpad "element")
     , ((modalt, xK_h), doScratchpad "htop")
     , ((modalt, xK_k), doScratchpad "slack")
     , ((modalt, xK_s), doScratchpad "spotify")
     , ((modalt, xK_t), doScratchpad "transmission")
     , ((modalt, xK_v), doScratchpad "volume")
+    , ((modalt, xK_x), doScratchpad "x-com")
 
     -- Specific program spawning
 
@@ -1071,6 +1071,7 @@ addKeys conf@XConfig { modMask = modm } =
     , ((hyper, xK_p), spawn "rofi-pass")
     , ((0, xK_Print), spawn "flameshot gui")
     , ((hyper, xK_h), spawn "flameshot gui")
+    , ((hyper, xK_n), spawn "rofi_codex_desktop_project.sh")
     , ((hyper, xK_c), spawn "rofi_tmcodex.sh")
     , ((hyper .|. shiftMask, xK_c), spawn "rofi_tmcodex.sh resume")
     , ((hyper .|. shiftMask, xK_l), spawn "dm-tool lock")
@@ -1080,11 +1081,11 @@ addKeys conf@XConfig { modMask = modm } =
     , ((hyper, xK_r), spawn "rofi_systemd_mono")
     , ((hyper, xK_9), spawn "start_synergy.sh")
     , ((hyper, xK_slash), spawn "toggle_taffybar")
-    , ((hyper, xK_backslash), spawn "$HOME/dotfiles/dotfiles/lib/functions/mpg341cx_input toggle")
+    , ((hyper, xK_backslash), spawn "mpg341cx_input toggle")
     , ((hyper, xK_space), spawn "skippy-xd")
     , ((hyper, xK_i), spawn "rofi_select_input.hs")
     , ((hyper, xK_o), spawn "rofi_paswitch")
-    , ((hyper .|. shiftMask, xK_o), spawn "$HOME/dotfiles/dotfiles/lib/bin/kef-optical")
+    , ((hyper .|. shiftMask, xK_o), spawn "kef-optical")
     , ((hyper, xK_comma), spawn "rofi_wallpaper.sh")
     , ((hyper, xK_y), spawn "rofi_agentic_skill")
     , ((modm, xK_e), spawn "emacsclient --eval '(emacs-everywhere)'")

dotfiles/config/zellij/config.kdl

@@ -13,7 +13,7 @@ keybinds {
     tmux {
         // Ctrl-b C: start a Codex pane from the current zellij tab.
         bind "C" {
-            Run "codex" "--dangerously-bypass-approvals-and-sandbox" {
+            Run "codex" "--dangerously-bypass-approvals-and-sandbox" "--cd" "." {
                 name "codex"
             }
             SwitchToMode "Normal"

dotfiles/emacs.d/README.org

@@ -1383,8 +1383,12 @@ Paradox is a package.el extension. I have no use for it now that I use straight.
 #+END_SRC
 ** load-dir
 #+BEGIN_SRC emacs-lisp
+(elpaca `(load-dir :host github :repo "emacs-straight/load-dir"
+                   :branch "master"
+                   :protocol https
+                   :wait t))
 (use-package load-dir
-  :ensure (:host github :repo "emacs-straight/load-dir")
+  :ensure nil
   :demand t
   :config
   (progn
@@ -1462,7 +1466,8 @@ The file server file for this emacs instance no longer exists.")
 #+END_SRC
 ** discover-my-major
 #+BEGIN_SRC emacs-lisp
-(use-package discover-my-major)
+(use-package discover-my-major
+  :disabled t)
 #+END_SRC
 ** refine
 #+BEGIN_SRC emacs-lisp
@@ -3404,6 +3409,16 @@ emr (emacs refactor) provides support for refactoring in many programming langua
         (setq lsp-ui-doc-position 'bottom)))))
 #+END_SRC
 * Utility
+** dired-sort-menu
+Add a menu and dialogue for changing Dired's sort order.
+#+begin_src emacs-lisp
+(use-package dired-sort-menu
+  :ensure (dired-sort-menu
+           :host github
+           :repo "emacsmirror/dired-sort-menu")
+  :after dired
+  :demand t)
+#+end_src
 ** eat
 #+begin_src emacs-lisp
 (use-package eat
@@ -4037,6 +4052,7 @@ This is useful with server mode when editing gmail messages. I think that it is
 ** android-mode
 #+BEGIN_SRC emacs-lisp
 (use-package android-mode
+  :ensure (:protocol https)
   :defer t
   :config
   (progn
@@ -4110,7 +4126,8 @@ Ensure all themes that I use are installed:
                   forest-blue-theme flatland-theme afternoon-theme
                   cyberpunk-theme dracula-theme))
 
-(mapcar #'elpaca-try packages-appearance)
+(dolist (package packages-appearance)
+  (eval `(use-package ,package :defer t) t))
 
 (use-package doom-themes
   :defer t)
@@ -4282,8 +4299,22 @@ load-theme hook (See the heading below).
 #+BEGIN_SRC emacs-lisp
 (defvar imalison:appearance-setup-done nil)
 
+(defun imalison:ensure-theme-load-path (theme)
+  (when (boundp 'elpaca-builds-directory)
+    (when-let ((theme-dir
+                (seq-find
+                 (lambda (dir)
+                   (file-exists-p
+                    (expand-file-name (format "%s-theme.el" theme) dir)))
+                 (directory-files
+                  elpaca-builds-directory
+                  t
+                  directory-files-no-dot-files-regexp))))
+      (add-to-list 'custom-theme-load-path theme-dir))))
+
 (defun imalison:appearance-setup-hook (&rest args)
   (unless imalison:appearance-setup-done
+    (imalison:ensure-theme-load-path imalison:dark-theme)
     (unless (member imalison:dark-theme custom-enabled-themes)
       (load-theme imalison:dark-theme t))
     (apply 'imalison:appearance args)

dotfiles/emacs.d/init.el

@@ -135,13 +135,18 @@
 ;; Some split packages fall through the active menus in this config. Give
 ;; Elpaca an explicit source so startup doesn't get stuck on recipe lookup or
 ;; stale branch-mapped clones.
-(elpaca `(queue :host github :repo "emacs-straight/queue"))
+(elpaca `(queue :host github :repo "emacs-straight/queue"
+                :branch "master"
+                :protocol https))
 (elpaca `(with-editor :host github :repo "magit/with-editor"
-                      :branch "main"))
+                      :branch "main"
+                      :protocol https))
 (elpaca `(git-commit :host github :repo "magit/magit"
-                     :files ("lisp/git-commit.el" "lisp/git-commit-pkg.el")))
+                     :files ("lisp/git-commit.el" "lisp/git-commit-pkg.el")
+                     :protocol https))
 (elpaca `(magit-section :host github :repo "magit/magit"
-                        :files ("lisp/magit-section.el" "lisp/magit-section-pkg.el")))
+                        :files ("lisp/magit-section.el" "lisp/magit-section-pkg.el")
+                        :protocol https))
 
 (use-package gh
   :defer t

dotfiles/gitconfig

@@ -102,10 +102,10 @@
 	required = true
 [credential "https://github.com"]
 	helper = 
-	helper = !/usr/bin/env gh auth git-credential
+	helper = !/nix/store/fxvyz1dx5wp87qgbd6dfkmqqb4fypm3b-gh-2.93.0/bin/.gh-wrapped auth git-credential
 [credential "https://gist.github.com"]
 	helper = 
-	helper = !/usr/bin/env gh auth git-credential
+	helper = !/nix/store/fxvyz1dx5wp87qgbd6dfkmqqb4fypm3b-gh-2.93.0/bin/.gh-wrapped auth git-credential
 [includeIf "gitdir:~/Projects/org-agenda-api/"]
 	path = ~/.gitconfig.org-agenda-api
 [includeIf "gitdir:~/Projects/dotfiles/org-agenda-api/"]
@@ -116,3 +116,6 @@
 	directory = /tmp/tmp.zfvv44RquC/runtime/data/org
 	directory = /tmp/tmp.zFdvVnKk4B/runtime/data/org
 	directory = /tmp/tmp.PQTdI3UzS3/runtime/data/org
+	directory = /srv/dotfiles/dotfiles/config/taffybar/taffybar
+	directory = /srv/dotfiles
+	directory = /srv/dotfiles/.worktrees/taffybar-week-old

dotfiles/gitignore

@@ -80,3 +80,5 @@ cabal.project.local
 /untracked
 
 railbird-infra-*.json
+
+**/.claude/settings.local.json

dotfiles/hammerspoon/init.lua

@@ -348,7 +348,7 @@ local function toggleMonitorInput()
     end
   end, {
     "-lc",
-    "export PATH=\"$HOME/.nix-profile/bin:/run/current-system/sw/bin:/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin:$PATH\"; \"$HOME/dotfiles/dotfiles/lib/functions/mpg341cx_input\" toggle",
+    "export PATH=\"$HOME/.nix-profile/bin:/run/current-system/sw/bin:/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin:$PATH\"; \"${DOTFILES_WORKTREE:-$HOME/dotfiles}/dotfiles/lib/functions/mpg341cx_input\" toggle",
   }):start()
 end
 

dotfiles/lib/bin/ask-claude

@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+target=${AGENTS_HOME:-$HOME/.agents}/skills/cross-agent-delegation/scripts/ask-claude
+
+if [ ! -x "$target" ]; then
+  echo "ask-claude: canonical script is not executable: $target" >&2
+  exit 127
+fi
+
+exec "$target" "$@"

dotfiles/lib/bin/ask-codex

@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+target=${AGENTS_HOME:-$HOME/.agents}/skills/cross-agent-delegation/scripts/ask-codex
+
+if [ ! -x "$target" ]; then
+  echo "ask-codex: canonical script is not executable: $target" >&2
+  exit 127
+fi
+
+exec "$target" "$@"

dotfiles/lib/bin/brightness.hs

@@ -135,7 +135,7 @@ sendNotification brightness = do
                    rawSystem "sh" ["-c", "command -v rumno >/dev/null 2>&1"]
     if rumnoExists
         then do
-            _ <- readProcess "rumno" ["notify", "-t", timeoutSeconds, "-b", show brightness] ""
+            _ <- readProcess "rumno" ["-t", timeoutSeconds, "-b", show brightness] ""
             return ()
         else putStrLn (show brightness)
 

dotfiles/lib/bin/brightness.sh

@@ -87,7 +87,7 @@ RUMNO_TIMEOUT="${RUMNO_TIMEOUT:-2.5}"
 
 # Show notification if rumno is available
 if command -v rumno &> /dev/null; then
-    rumno notify -t "$RUMNO_TIMEOUT" -b "$BRIGHTNESS"
+    rumno -t "$RUMNO_TIMEOUT" -b "$BRIGHTNESS"
 else
     echo "$BRIGHTNESS"
 fi

dotfiles/lib/bin/codex_desktop_scratchpad

@@ -17,6 +17,218 @@ pid_is_alive() {
     [ -e "/proc/$pid/exe" ]
 }
 
+pid_is_current_user() {
+    local pid="${1:-}"
+    local uid
+
+    uid="$(stat -c %u "/proc/$pid" 2>/dev/null || true)"
+    [ -n "$uid" ] && [ "$uid" = "$(id -u)" ]
+}
+
+pid_cmdline() {
+    local pid="$1"
+
+    tr '\0' ' ' < "/proc/$pid/cmdline" 2>/dev/null || true
+}
+
+pid_is_main_codex_desktop() {
+    local pid="$1"
+    local exe
+    local cmdline
+
+    pid_is_alive "$pid" || return 1
+    pid_is_current_user "$pid" || return 1
+    exe="$(readlink -f "/proc/$pid/exe" 2>/dev/null || true)"
+    [ -n "$exe" ] || return 1
+    [ "$(basename "$exe")" = "electron" ] || return 1
+    [ -x "$(dirname "$exe")/start.sh" ] || return 1
+
+    cmdline="$(pid_cmdline "$pid")"
+    case " $cmdline " in
+        *" --class=$app_id "*) ;;
+        *) return 1 ;;
+    esac
+    case " $cmdline " in
+        *" --app-id=$app_id "*) ;;
+        *) return 1 ;;
+    esac
+    case " $cmdline " in
+        *" --type="*) return 1 ;;
+    esac
+}
+
+find_running_app() {
+    local proc_exe
+    local pid
+    local exe
+
+    for proc_exe in /proc/[0-9]*/exe; do
+        [ -e "$proc_exe" ] || continue
+        pid="${proc_exe#/proc/}"
+        pid="${pid%/exe}"
+        if pid_is_main_codex_desktop "$pid"; then
+            exe="$(readlink -f "$proc_exe" 2>/dev/null || true)"
+            printf '%s\t%s\n' "$pid" "$(dirname "$exe")"
+            return 0
+        fi
+    done
+
+    return 1
+}
+
+find_recorded_running_app() {
+    local pid
+    local exe
+
+    [ -r "$pid_file" ] || return 1
+    pid="$(cat "$pid_file" 2>/dev/null || true)"
+    pid_is_main_codex_desktop "$pid" || return 1
+    exe="$(readlink -f "/proc/$pid/exe" 2>/dev/null || true)"
+    [ -n "$exe" ] || return 1
+    printf '%s\t%s\n' "$pid" "$(dirname "$exe")"
+}
+
+dbus_names_for_pid() {
+    local pid="$1"
+
+    command -v busctl >/dev/null 2>&1 || return 0
+    busctl --user list --no-legend 2>/dev/null \
+        | awk -v pid="$pid" '$2 == pid && ($1 ~ /^:/ || $1 ~ /^org[.]kde[.]StatusNotifierItem-/) { print $1 }'
+}
+
+dbus_property_object_path() {
+    local service="$1"
+    local path="$2"
+    local interface="$3"
+    local property="$4"
+
+    timeout 3 busctl --user call "$service" "$path" org.freedesktop.DBus.Properties Get ss "$interface" "$property" 2>/dev/null \
+        | awk '$1 == "v" && $2 == "o" { gsub(/"/, "", $3); print $3; exit }'
+}
+
+dbus_name_has_status_notifier_item() {
+    local service="$1"
+
+    timeout 1 busctl --user tree "$service" 2>/dev/null | grep -q '/StatusNotifierItem'
+}
+
+open_codex_menu_item_id() {
+    local layout
+
+    layout="$(cat)"
+    CODEX_DBUSMENU_LAYOUT="$layout" python3 - <<'PY'
+import os
+import re
+
+layout = os.environ.get("CODEX_DBUSMENU_LAYOUT", "")
+for record in layout.split("(ia{sv}av)")[1:]:
+    item_id = re.match(r"\s+([0-9]+)\s+", record)
+    if item_id and re.search(r'"label"\s+s\s+"Open Codex"(?:\s|$)', record):
+        print(item_id.group(1))
+        break
+PY
+}
+
+activate_codex_dbus_menu_item_for_service() {
+    local service="$1"
+    local menu_path
+    local layout
+    local item_id
+
+    command -v busctl >/dev/null 2>&1 || return 1
+    command -v timeout >/dev/null 2>&1 || return 1
+
+    menu_path="$(dbus_property_object_path "$service" /StatusNotifierItem org.kde.StatusNotifierItem Menu || true)"
+    [ -n "$menu_path" ] || menu_path=/com/canonical/dbusmenu
+
+    layout="$(timeout 3 busctl --user call "$service" "$menu_path" com.canonical.dbusmenu GetLayout iias 0 -- -1 0 2>/dev/null || true)"
+    [ -n "$layout" ] || return 1
+
+    item_id="$(printf '%s\n' "$layout" | open_codex_menu_item_id)"
+    [ -n "$item_id" ] || return 1
+
+    timeout 3 busctl --user call "$service" "$menu_path" com.canonical.dbusmenu Event isvu "$item_id" clicked v i 0 0 >/dev/null 2>&1
+}
+
+activate_codex_tray_menu_item() {
+    local pid="$1"
+    local service
+
+    while IFS= read -r service; do
+        [ -n "$service" ] || continue
+        dbus_name_has_status_notifier_item "$service" || continue
+        if activate_codex_dbus_menu_item_for_service "$service"; then
+            return 0
+        fi
+    done < <(dbus_names_for_pid "$pid" | awk '!seen[$0]++')
+
+    return 1
+}
+
+activate_status_notifier_item() {
+    local pid="$1"
+    local qdbus_cmd
+    local service
+    local path
+
+    qdbus_cmd="$(command -v qdbus || command -v qdbus6 || true)"
+    [ -n "$qdbus_cmd" ] || return 1
+
+    while IFS= read -r service; do
+        [ -n "$service" ] || continue
+        while IFS= read -r path; do
+            case "$path" in
+                */StatusNotifierItem)
+                    if "$qdbus_cmd" "$service" "$path" org.kde.StatusNotifierItem.Activate 0 0 >/dev/null 2>&1; then
+                        return 0
+                    fi
+                    ;;
+            esac
+        done < <("$qdbus_cmd" "$service" 2>/dev/null || true)
+    done < <("$qdbus_cmd" 2>/dev/null | grep -E "^org\\.kde\\.StatusNotifierItem-${pid}-" || true)
+
+    return 1
+}
+
+focus_hyprland_window() {
+    local pid="$1"
+    local address
+    local output
+
+    command -v hyprctl >/dev/null 2>&1 || return 1
+    address="$(
+        HYPR_FOCUS_PID="$pid" python3 - <<'PY'
+import json
+import os
+import subprocess
+import sys
+
+target_pid = int(os.environ["HYPR_FOCUS_PID"])
+try:
+    clients = json.loads(subprocess.check_output(["hyprctl", "clients", "-j"], text=True, stderr=subprocess.DEVNULL))
+except Exception:
+    raise SystemExit(1)
+
+for client in clients:
+    if client.get("pid") == target_pid and client.get("address") and client.get("mapped", True) and not client.get("hidden", False):
+        print(client["address"])
+        break
+else:
+    raise SystemExit(1)
+PY
+    )" || return 1
+    [ -n "$address" ] || return 1
+
+    output="$(hyprctl dispatch "hl.dsp.focus({ window = \"address:$address\" })" 2>&1)" || return 1
+    [ "$output" = "ok" ] || return 1
+}
+
+start_second_instance_handoff() {
+    (
+        exec codex-desktop "$@"
+    ) >/dev/null 2>&1 &
+}
+
 running_app_is_alive() {
     local pid
 
@@ -56,4 +268,17 @@ if send_launch_action "$@"; then
     exit 0
 fi
 
+if running_app="$(find_recorded_running_app || find_running_app)"; then
+    running_pid="${running_app%%	*}"
+    mkdir -p "$state_dir"
+    printf '%s\n' "$running_pid" > "$pid_file"
+    send_launch_action "$@" && exit 0
+    activate_codex_tray_menu_item "$running_pid" && exit 0
+    activate_status_notifier_item "$running_pid" && exit 0
+    focus_hyprland_window "$running_pid" && exit 0
+    start_second_instance_handoff "$@" && exit 0
+    notify-send "Codex is already running" "No warm-start socket, tray activation, or second-instance restore path was available." >/dev/null 2>&1 || true
+    exit 0
+fi
+
 exec codex-desktop "$@"

dotfiles/lib/bin/hypr_perf_snapshot

@@ -57,10 +57,6 @@ run_optional() {
       printf '\n### %s\n' "$option"
       hyprctl getoption "$option" 2>&1 || true
     done
-    if printf '%s\n' "$plugins" | grep -q 'Plugin hyprwobbly'; then
-      printf '\n### plugin:hyprwobbly:enabled\n'
-      hyprctl getoption plugin:hyprwobbly:enabled 2>&1 || true
-    fi
   else
     section "Hyprland"
     printf 'hyprctl not found\n'

dotfiles/lib/bin/hypr_plugin_dev_session

@@ -9,9 +9,8 @@ Launch a disposable nested Hyprland compositor for plugin development, then
 build/load a plugin only into that nested instance.
 
 Options:
-  --repo DIR             Plugin repo to build. Defaults to $PWD if it has a flake,
-                         otherwise /home/imalison/Projects/hyprwobbly when present.
-  --attr ATTR            Nix build attr. Default: .#hyprwobbly
+  --repo DIR             Plugin repo to build. Defaults to $PWD when it has a flake.
+  --attr ATTR            Nix build attr. Default: .#default
   --plugin PATH          Load an already-built plugin .so instead of building.
   --hyprland-bin PATH    Hyprland binary to run. Defaults to the plugin repo's
                          Hyprland flake input when building, otherwise PATH.
@@ -30,8 +29,8 @@ Options:
 
 Examples:
   hypr_plugin_dev_session
-  hypr_plugin_dev_session --repo ~/Projects/hyprwobbly --attr .#hyprwobbly
-  hypr_plugin_dev_session --plugin "$PWD/result/lib/libhyprwobbly.so"
+  hypr_plugin_dev_session --repo ~/Projects/my-plugin --attr .#default
+  hypr_plugin_dev_session --plugin "$PWD/result/lib/my-plugin.so"
   hypr_plugin_dev_session --user-config --no-load
 EOF
 }
@@ -43,7 +42,7 @@ die() {
 
 runtime_dir="${XDG_RUNTIME_DIR:-/run/user/$(id -u)}"
 repo=""
-attr=".#hyprwobbly"
+attr=".#default"
 plugin_path=""
 plugin_path_from_arg=0
 hyprland_bin=""
@@ -161,10 +160,8 @@ parent_wayland_display() {
 if [[ -z "$repo" ]]; then
   if [[ -f "$PWD/flake.nix" ]]; then
     repo="$PWD"
-  elif [[ -d /home/imalison/Projects/hyprwobbly ]]; then
-    repo="/home/imalison/Projects/hyprwobbly"
   else
-    repo="$PWD"
+    die "--repo is required when the current directory has no flake.nix"
   fi
 fi
 repo="$(realpath "$repo")"
@@ -194,12 +191,6 @@ find_built_plugin() {
   local result_dir="$repo/result"
   [[ -e "$result_dir" ]] || die "build result missing: $result_dir"
 
-  local preferred="$result_dir/lib/libhyprwobbly.so"
-  if [[ -f "$preferred" ]]; then
-    printf '%s\n' "$(realpath "$preferred")"
-    return
-  fi
-
   local count
   count="$(find -L "$result_dir" -type f -name '*.so' | wc -l)"
   [[ "$count" -gt 0 ]] || die "no .so files found under $result_dir"

dotfiles/lib/bin/hypr_rofi_action

@@ -7,6 +7,8 @@ from pathlib import Path
 
 
 PROMPT = "Hyprland action"
+HYPER_MODIFIERS = {"SUPER", "CTRL", "ALT"}
+MODIFIER_ORDER = ["SHIFT", "SUPER", "CTRL", "ALT"]
 
 
 def ensure_hyprland_instance():
@@ -51,6 +53,32 @@ def rofi_index(entries):
         return None
 
 
+def display_keys(keys):
+    parts = [part.strip() for part in keys.split("+")]
+    parts = [part for part in parts if part]
+    modifier_counts = {}
+    non_modifiers = []
+
+    for part in parts:
+        canonical = part.upper()
+        if canonical in MODIFIER_ORDER:
+            modifier_counts[canonical] = modifier_counts.get(canonical, 0) + 1
+        else:
+            non_modifiers.append(part)
+
+    modifiers = set(modifier_counts)
+    if not HYPER_MODIFIERS.issubset(modifiers):
+        return keys
+
+    remaining_modifiers = [
+        modifier
+        for modifier in MODIFIER_ORDER
+        if modifier not in HYPER_MODIFIERS and modifier in modifiers
+    ]
+    display_parts = ["Hyper", *remaining_modifiers, *non_modifiers]
+    return " + ".join(display_parts)
+
+
 def notify(message):
     if shutil.which("notify-send"):
         subprocess.run(["notify-send", "Hyprland action", message], check=False)
@@ -104,7 +132,7 @@ def main():
         return 1
 
     width = min(max(len(action["description"]) for action in actions), 48)
-    labels = [f"{action['description']:<{width}}  {action['keys']}" for action in actions]
+    labels = [f"{action['description']:<{width}}  {display_keys(action['keys'])}" for action in actions]
     index = rofi_index(labels)
     if index is None:
         return 0

dotfiles/lib/bin/hypr_rofi_layout

@@ -36,6 +36,7 @@ ensure_hyprland_instance
 layouts=(
   "nStack	Columns"
   "master	Large main"
+  "quadrants	Quadrants"
   "grid	Grid"
   "monocle	Monocle"
 )
@@ -64,7 +65,7 @@ for entry in "${layouts[@]}"; do
   label="${entry#*$'\t'}"
 
   if [[ "$label" == "$selection" ]]; then
-    hyprctl dispatch "_G.im_hyprland_set_layout(\"$layout\")" >/dev/null
+    hyprctl -q eval "_G.im_hyprland_set_layout(\"$layout\")"
     exit 0
   fi
 done

dotfiles/lib/bin/mova_capture.sh

@@ -0,0 +1,161 @@
+#!/usr/bin/env bash
+#
+# Quick-capture a task/note into mova (org-agenda-api) via rofi.
+#
+# Fire-and-forget: the note is written to a persistent on-disk queue and a
+# background systemd user service (mova-capture-drain) POSTs it to the API,
+# retrying across network outages / API downtime / reboots until it lands.
+# See mova_capture_drain (the worker) and nixos/mova-capture.nix (the units).
+#
+# Modes:
+#   mova_capture.sh                 Fast text box. Enter -> Today/NEXT
+#                                   (capture-n), Alt+i -> Inbox (capture-i).
+#   mova_capture.sh --pick          Pick any capture template from a rofi
+#                                   list (fetched live, cached for offline),
+#                                   then type the note.
+#   mova_capture.sh <template-key>  Skip the picker; capture straight to that
+#                                   template, e.g. `mova_capture.sh capture-z`.
+
+set -uo pipefail
+
+state_dir="${XDG_STATE_HOME:-$HOME/.local/state}/mova-capture"
+queue_dir="$state_dir/queue"
+cache_file="$state_dir/templates.json"
+mkdir -p "$queue_dir"
+
+url="${MOVA_API_URL:-https://org-agenda-api.rocket-sense.duckdns.org}"
+api_user="${MOVA_API_USER:-imalison}"
+pass_entry="${MOVA_API_PASS_ENTRY:-org-agenda-api-imalison}"
+
+notify() {
+  command -v notify-send >/dev/null 2>&1 && notify-send -a "mova capture" "$@" || true
+}
+
+# Read a single line of text from a rofi text box. Empty dmenu input makes rofi
+# a plain input field: Enter returns the typed text; custom keybindings return
+# it with exit 10/11/... The caller inspects $? via the global `input_code`.
+input_code=0
+read_text() {
+  local prompt="$1"
+  shift
+  local text
+  text="$(printf '' | rofi -dmenu -p "$prompt" -lines 0 "$@")"
+  input_code=$?
+  # Collapse newlines and trim surrounding whitespace.
+  text="${text//$'\n'/ }"
+  text="${text#"${text%%[![:space:]]*}"}"
+  text="${text%"${text##*[![:space:]]}"}"
+  printf '%s' "$text"
+}
+
+enqueue() {
+  local template="$1" label="$2" title="$3"
+  local id tmp final
+  id="$(date +%s%N)-$$-${RANDOM}"
+  tmp="$queue_dir/.$id.json.tmp"
+  final="$queue_dir/$id.json"
+
+  if ! jq -n \
+      --arg template "$template" \
+      --arg title "$title" \
+      --arg label "$label" \
+      --arg created "$(date -Is)" \
+      '{template: $template, values: {Title: $title}, label: $label, created: $created}' \
+      >"$tmp"; then
+    notify "Capture FAILED to queue" "$title"
+    rm -f "$tmp"
+    return 1
+  fi
+  mv "$tmp" "$final"
+
+  # Kick the drain now for immediacy; the .path unit would fire it anyway, and
+  # the .timer retries anything that does not land. Fall back to a direct run
+  # if systemd is unavailable (e.g. non-NixOS host).
+  if ! systemctl --user start mova-capture-drain.service 2>/dev/null; then
+    if command -v mova_capture_drain >/dev/null 2>&1; then
+      setsid mova_capture_drain >/dev/null 2>&1 &
+    fi
+  fi
+
+  notify "Queued → $label" "$title"
+}
+
+# Echo the template map ({key:{name:...}}) as JSON. Prefers a live fetch (and
+# refreshes the cache), falls back to the cache, then to a minimal built-in set
+# so the picker still works fully offline.
+fetch_templates() {
+  local pw json
+  pw="$(pass show "$pass_entry" 2>/dev/null | head -1)"
+  if [[ -n "$pw" ]]; then
+    json="$(curl -sS -m 8 -u "$api_user:$pw" "$url/capture-templates" 2>/dev/null)"
+    if [[ -n "$json" ]] && printf '%s' "$json" | jq -e 'type == "object"' >/dev/null 2>&1; then
+      printf '%s' "$json" >"$cache_file"
+      printf '%s' "$json"
+      return 0
+    fi
+  fi
+  if [[ -r "$cache_file" ]]; then
+    cat "$cache_file"
+    return 0
+  fi
+  printf '%s' '{"capture-n":{"name":"Next (Scheduled Today)"},"capture-i":{"name":"Inbox"},"default":{"name":"GTD Todo"}}'
+}
+
+# Resolve a template's display name from the cache without touching the network.
+name_for_key() {
+  local key="$1"
+  [[ -r "$cache_file" ]] || return 0
+  jq -r --arg k "$key" '.[$k].name // empty' "$cache_file" 2>/dev/null || true
+}
+
+mode="default"
+forced_template=""
+case "${1-}" in
+  "") mode="default" ;;
+  --pick | -p | pick) mode="pick" ;;
+  -h | --help)
+    sed -n '3,25p' "$0"
+    exit 0
+    ;;
+  *)
+    mode="forced"
+    forced_template="$1"
+    ;;
+esac
+
+case "$mode" in
+  default)
+    text="$(read_text "Capture" \
+      -mesg '<b>Enter</b> Today · NEXT      <b>Alt+i</b> Inbox' \
+      -kb-custom-1 "Alt+i")"
+    [[ $input_code -eq 1 ]] && exit 0
+    [[ -n "$text" ]] || exit 0
+    case $input_code in
+      0) enqueue "capture-n" "Today · NEXT" "$text" ;;
+      10) enqueue "capture-i" "Inbox" "$text" ;;
+    esac
+    ;;
+
+  pick)
+    templates="$(fetch_templates)"
+    selection="$(printf '%s' "$templates" \
+      | jq -r 'to_entries[] | "\(.value.name)\t\(.key)"' \
+      | rofi -dmenu -i -p "Template")"
+    [[ -n "$selection" ]] || exit 0
+    template="${selection##*$'\t'}"
+    label="${selection%%$'\t'*}"
+    text="$(read_text "$label")"
+    [[ $input_code -eq 1 ]] && exit 0
+    [[ -n "$text" ]] || exit 0
+    enqueue "$template" "$label" "$text"
+    ;;
+
+  forced)
+    label="$(name_for_key "$forced_template")"
+    [[ -n "$label" ]] || label="$forced_template"
+    text="$(read_text "$label")"
+    [[ $input_code -eq 1 ]] && exit 0
+    [[ -n "$text" ]] || exit 0
+    enqueue "$forced_template" "$label" "$text"
+    ;;
+esac

dotfiles/lib/bin/mova_capture_drain

@@ -0,0 +1,89 @@
+#!/usr/bin/env bash
+#
+# Drain the mova quick-capture queue into org-agenda-api.
+#
+# Reads job files written by mova_capture.sh and POSTs each to /capture.
+#   - success        -> job deleted, success notification
+#   - network / 5xx  -> job kept, retried on the next drain (persistent)
+#   - 4xx (rejected) -> job moved to failed/ so it cannot loop forever
+#
+# Designed to be run by a systemd user service triggered on enqueue (.path),
+# on a retry timer (.timer), and directly by the front-end for immediacy.
+# Credentials come from `pass` at runtime; if gpg-agent is locked the drain
+# exits quietly and leaves the queue for a later run.
+
+set -uo pipefail
+
+state_dir="${XDG_STATE_HOME:-$HOME/.local/state}/mova-capture"
+queue_dir="$state_dir/queue"
+failed_dir="$state_dir/failed"
+
+url="${MOVA_API_URL:-https://org-agenda-api.rocket-sense.duckdns.org}"
+api_user="${MOVA_API_USER:-imalison}"
+pass_entry="${MOVA_API_PASS_ENTRY:-org-agenda-api-imalison}"
+
+mkdir -p "$queue_dir"
+
+notify() {
+  command -v notify-send >/dev/null 2>&1 && notify-send -a "mova capture" "$@" || true
+}
+
+shopt -s nullglob
+jobs=("$queue_dir"/*.json)
+((${#jobs[@]})) || exit 0
+
+# Serialize drains so a manual kick and the timer/path trigger can't double-POST
+# the same job. Non-blocking: if another drain holds the lock, let it finish.
+lockfile="$state_dir/drain.lock"
+exec 9>"$lockfile"
+flock -n 9 || exit 0
+
+# Re-check after acquiring the lock; a concurrent drain may have emptied it.
+jobs=("$queue_dir"/*.json)
+((${#jobs[@]})) || exit 0
+
+password="$(pass show "$pass_entry" 2>/dev/null | head -1)"
+if [[ -z "$password" ]]; then
+  # gpg-agent likely locked or pass unavailable; keep the queue for later.
+  exit 0
+fi
+
+for job in "${jobs[@]}"; do
+  payload="$(jq -c '{template: .template, values: .values}' "$job" 2>/dev/null)"
+  if [[ -z "$payload" || "$payload" == "null" ]]; then
+    mkdir -p "$failed_dir"
+    mv "$job" "$failed_dir/"
+    notify "Capture unreadable — moved to failed/" "$(basename "$job")"
+    continue
+  fi
+  title="$(jq -r '.values.Title // ""' "$job" 2>/dev/null)"
+  label="$(jq -r '.label // .template' "$job" 2>/dev/null)"
+
+  response="$(curl -sS -m 30 -u "$api_user:$password" \
+    -X POST "$url/capture" \
+    -H 'Content-Type: application/json' \
+    -d "$payload" \
+    -w $'\n%{http_code}' 2>/dev/null)"
+  if [[ $? -ne 0 || -z "$response" ]]; then
+    # Network error / DNS / timeout: keep the job and retry next drain.
+    continue
+  fi
+
+  http_code="${response##*$'\n'}"
+  body="${response%$'\n'*}"
+  status="$(printf '%s' "$body" | jq -r '.status // ""' 2>/dev/null)"
+
+  if [[ "$http_code" == 2* && "$status" == "created" ]]; then
+    rm -f "$job"
+    notify "Captured → $label" "$title"
+  elif [[ "$http_code" == 4* ]]; then
+    # Client error (bad template, auth): it won't fix itself on retry.
+    mkdir -p "$failed_dir"
+    mv "$job" "$failed_dir/"
+    message="$(printf '%s' "$body" | jq -r '.message // empty' 2>/dev/null)"
+    notify "Capture rejected ($http_code) → $label" "${title}${message:+ — $message}"
+  else
+    # 5xx or unexpected body: keep and retry.
+    continue
+  fi
+done

dotfiles/lib/bin/restart_snis.sh

@@ -11,7 +11,7 @@ tray_services=(
   flameshot.service
   kanshi-sni.service
   kdeconnect-indicator.service
-  keepbook-sync-daemon.service
+  keepbook-dioxus.service
   network-manager-applet.service
   notifications-tray-icon-gitea.service
   notifications-tray-icon-github.service

dotfiles/lib/bin/rocket-league-bakkesmod

@@ -0,0 +1,241 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+app_name="${HEROIC_ROCKET_LEAGUE_APP_NAME:-Sugar}"
+heroic_config_dir="${HEROIC_CONFIG_DIR:-$HOME/.config/heroic}"
+game_config="${HEROIC_ROCKET_LEAGUE_CONFIG:-$heroic_config_dir/GamesConfig/$app_name.json}"
+installed_json="${HEROIC_LEGENDARY_INSTALLED_JSON:-$heroic_config_dir/legendaryConfig/legendary/installed.json}"
+download_url="${BAKKESMOD_SETUP_URL:-https://github.com/bakkesmodorg/BakkesModInjectorCpp/releases/latest/download/BakkesModSetup.zip}"
+cache_dir="${XDG_CACHE_HOME:-$HOME/.cache}/rocket-league-bakkesmod"
+
+die() {
+  printf 'rocket-league-bakkesmod: %s\n' "$*" >&2
+  exit 1
+}
+
+need_command() {
+  command -v "$1" >/dev/null 2>&1 || die "missing required command: $1"
+}
+
+jq_value() {
+  local filter="$1"
+  local file="$2"
+  jq -er "$filter // empty" "$file" 2>/dev/null || true
+}
+
+heroic_value() {
+  local filter="$1"
+  jq_value ".$app_name.$filter" "$game_config"
+}
+
+installed_value() {
+  jq_value ".$app_name.$1" "$installed_json"
+}
+
+require_heroic_metadata() {
+  [ -f "$game_config" ] || die "missing Heroic game config: $game_config"
+  [ -f "$installed_json" ] || die "missing Legendary installed metadata: $installed_json"
+}
+
+rocket_league_dir() {
+  local value
+  value="${ROCKET_LEAGUE_DIR:-}"
+  if [ -z "$value" ]; then
+    value="$(installed_value install_path)"
+  fi
+  if [ -z "$value" ]; then
+    value="$HOME/Games/Heroic/rocketleague"
+  fi
+  printf '%s\n' "$value"
+}
+
+rocket_league_prefix() {
+  local value
+  value="${ROCKET_LEAGUE_PREFIX:-}"
+  if [ -z "$value" ]; then
+    value="$(heroic_value winePrefix)"
+  fi
+  [ -n "$value" ] || die "could not determine Heroic wine prefix from $game_config"
+  printf '%s\n' "$value"
+}
+
+rocket_league_proton() {
+  local value
+  value="${ROCKET_LEAGUE_PROTON:-}"
+  if [ -z "$value" ]; then
+    value="$(heroic_value 'wineVersion.bin')"
+  fi
+  [ -n "$value" ] || die "could not determine Heroic Proton binary from $game_config"
+  printf '%s\n' "$value"
+}
+
+ensure_paths() {
+  need_command jq
+  require_heroic_metadata
+
+  rl_dir="$(rocket_league_dir)"
+  rl_prefix="$(rocket_league_prefix)"
+  proton_bin="$(rocket_league_proton)"
+
+  [ -d "$rl_dir" ] || die "Rocket League install directory does not exist: $rl_dir"
+  [ -d "$rl_prefix" ] || die "Rocket League prefix does not exist: $rl_prefix"
+  [ -x "$proton_bin" ] || die "Proton binary is not executable: $proton_bin"
+}
+
+proton_run() {
+  export STEAM_COMPAT_DATA_PATH="$rl_prefix"
+  export STEAM_COMPAT_CLIENT_INSTALL_PATH="${STEAM_COMPAT_CLIENT_INSTALL_PATH:-$HOME/.steam/root}"
+  export WINEESYNC="${WINEESYNC:-1}"
+  export WINEFSYNC="${WINEFSYNC:-1}"
+
+  if command -v steam-run >/dev/null 2>&1; then
+    steam-run "$proton_bin" run "$@"
+  else
+    NIXPKGS_ALLOW_UNFREE=1 nix run --impure nixpkgs#steam-run -- "$proton_bin" run "$@"
+  fi
+}
+
+bakkesmod_exe() {
+  local candidates=(
+    "$rl_prefix/pfx/drive_c/Program Files/BakkesMod/BakkesMod.exe"
+    "$rl_prefix/drive_c/Program Files/BakkesMod/BakkesMod.exe"
+    "$rl_prefix/pfx/drive_c/users/$USER/AppData/Roaming/bakkesmod/bakkesmod/BakkesMod.exe"
+    "$rl_prefix/drive_c/users/$USER/AppData/Roaming/bakkesmod/bakkesmod/BakkesMod.exe"
+  )
+
+  local candidate
+  for candidate in "${candidates[@]}"; do
+    if [ -f "$candidate" ]; then
+      printf '%s\n' "$candidate"
+      return 0
+    fi
+  done
+
+  find "$rl_prefix" -iname BakkesMod.exe -print -quit 2>/dev/null
+}
+
+write_bat_launcher() {
+  local bat_path="$rl_dir/run_with_bakkesmod.bat"
+  local bakkes_dir="C:\\Program Files\\BakkesMod"
+
+  cat >"$bat_path" <<EOF
+@echo off
+set RL_PATH=%cd%\\Binaries\\Win64
+
+echo Launching BakkesMod...
+C:
+cd "$bakkes_dir"
+start BakkesMod.exe
+
+echo Launching Rocket League without Easy Anti-Cheat: %RL_PATH%
+Z:
+cd %RL_PATH%
+Launcher.exe -noeac %*
+EOF
+
+  printf '%s\n' "$bat_path"
+}
+
+download_setup() {
+  need_command wget
+  need_command unzip
+
+  local zip setup
+  mkdir -p "$cache_dir"
+  rm -rf "$cache_dir/setup"
+  zip="$cache_dir/BakkesModSetup.zip"
+  wget -q --no-server-response -O "$zip" "$download_url"
+  unzip -oq "$zip" -d "$cache_dir/setup"
+  setup="$(find "$cache_dir/setup" -iname 'BakkesModSetup.exe' -o -iname 'BakkesMod.exe' | head -1)"
+  [ -n "$setup" ] || die "download did not contain BakkesModSetup.exe or BakkesMod.exe"
+  printf '%s\n' "$setup"
+}
+
+status() {
+  ensure_paths
+
+  printf 'Rocket League dir: %s\n' "$rl_dir"
+  printf 'Heroic prefix:      %s\n' "$rl_prefix"
+  printf 'Proton:             %s\n' "$proton_bin"
+  printf 'No-EAC launcher:    %s\n' "$rl_dir/run_with_bakkesmod.bat"
+
+  local bakkes
+  bakkes="$(bakkesmod_exe)"
+  if [ -n "$bakkes" ]; then
+    printf 'BakkesMod exe:      %s\n' "$bakkes"
+  else
+    printf 'BakkesMod exe:      not installed in this prefix\n'
+  fi
+}
+
+setup() {
+  ensure_paths
+  write_bat_launcher >/dev/null
+  status
+}
+
+install() {
+  ensure_paths
+  write_bat_launcher >/dev/null
+
+  local silent=false
+  if [ "${1:-}" = "--silent" ]; then
+    silent=true
+    shift
+  fi
+
+  local setup_exe
+  setup_exe="$(download_setup)"
+  printf 'Running BakkesMod installer in Rocket League prefix...\n'
+  if $silent; then
+    if ! proton_run "$setup_exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART "$@"; then
+      die "installer failed; use Heroic > Rocket League > Settings > Wine > Run EXE in Prefix and select: $setup_exe"
+    fi
+  else
+    if ! proton_run "$setup_exe" "$@"; then
+      die "installer failed; use Heroic > Rocket League > Settings > Wine > Run EXE in Prefix and select: $setup_exe"
+    fi
+  fi
+}
+
+run() {
+  ensure_paths
+  local bat_path
+  bat_path="$(write_bat_launcher)"
+
+  local bakkes
+  bakkes="$(bakkesmod_exe)"
+  [ -n "$bakkes" ] || die "BakkesMod is not installed in the Rocket League prefix; run: rocket-league-bakkesmod install"
+
+  (
+    cd "$rl_dir"
+    proton_run "$bat_path" "$@"
+  )
+}
+
+usage() {
+  cat <<'EOF'
+Usage: rocket-league-bakkesmod <command> [rocket-league-args...]
+
+Commands:
+  status   Show detected Heroic Rocket League, Proton, and BakkesMod paths.
+  setup    Write the Heroic-compatible no-EAC BakkesMod .bat launcher.
+  install  Download and run the BakkesMod installer inside the Rocket League prefix.
+           Use install --silent for unattended Inno Setup installation.
+  run      Start BakkesMod, then launch Rocket League with -noeac for offline/local play.
+EOF
+}
+
+command_name="${1:-status}"
+if [ "$#" -gt 0 ]; then
+  shift
+fi
+
+case "$command_name" in
+  status) status "$@" ;;
+  setup) setup "$@" ;;
+  install) install "$@" ;;
+  run) run "$@" ;;
+  help|--help|-h) usage ;;
+  *) usage >&2; exit 2 ;;
+esac

dotfiles/lib/bin/rofi_ai_scratchpad.sh

@@ -0,0 +1,39 @@
+#!/usr/bin/env zsh
+set -euo pipefail
+
+# Choose which AI app SUPER+ALT+C toggles as a scratchpad: Codex or Claude
+# Desktop. The choice is written to a state file that the Hyprland Lua config
+# reads at keypress time, so switching is dynamic and needs no reload.
+
+state_file="${XDG_STATE_HOME:-$HOME/.local/state}/hypr/ai-scratchpad"
+mkdir -p "${state_file:h}"
+
+names=(codex claude)
+labels=("Codex" "Claude Desktop")
+
+current=codex
+[[ -r "$state_file" ]] && current="$(<"$state_file")"
+
+menu=""
+for i in {1..${#names}}; do
+  marker="  "
+  [[ "${names[$i]}" == "$current" ]] && marker="● "
+  menu+="${marker}${labels[$i]}\n"
+done
+
+index="$(printf "$menu" | rofi -dmenu -i -p "AI scratchpad" -format i)" || exit 0
+[[ -n "$index" ]] || exit 0
+
+selected="${names[$((index + 1))]}"
+[[ -n "$selected" ]] || exit 0
+
+print -r -- "$selected" > "$state_file"
+
+# Bring the freshly selected scratchpad into view (no-op if already visible).
+if command -v hyprctl >/dev/null 2>&1; then
+  hyprctl -q eval "_G.im_hyprland_show_ai_scratchpad()" >/dev/null 2>&1 || true
+fi
+
+if command -v notify-send >/dev/null 2>&1; then
+  notify-send "AI scratchpad" "Super+Alt+C now toggles ${labels[$((index + 1))]}" || true
+fi

dotfiles/lib/bin/rofi_codex_desktop_project.sh

@@ -0,0 +1,81 @@
+#!/usr/bin/env zsh
+set -euo pipefail
+
+# Pick a saved Codex Desktop project root via rofi, then start a new desktop
+# thread in that project using the documented codex:// deep link.
+
+codex_home="${CODEX_HOME:-$HOME/.codex}"
+state_file="${CODEX_DESKTOP_STATE_FILE:-$codex_home/.codex-global-state.json}"
+prompt="${CODEX_DESKTOP_PROJECT_PROMPT:-Codex project}"
+
+notify() {
+  if command -v notify-send >/dev/null 2>&1; then
+    notify-send "Codex Desktop launcher" "$1"
+  else
+    printf '%s\n' "$1" >&2
+  fi
+}
+
+emit_candidates() {
+  if [[ ! -r "$state_file" ]]; then
+    notify "Cannot read Codex Desktop state: $state_file"
+    return 1
+  fi
+
+  jq -r '
+    def local_paths($key):
+      .[$key] // []
+      | .[]?
+      | select(type == "string" and startswith("/"));
+
+    local_paths("pinned-project-ids"),
+    local_paths("electron-saved-workspace-roots"),
+    local_paths("project-order")
+  ' "$state_file"
+}
+
+dedup() {
+  awk 'NF && !seen[$0]++'
+}
+
+existing_dirs() {
+  local dir
+  while IFS= read -r dir; do
+    [[ -d "$dir" ]] && printf '%s\n' "$dir"
+  done
+}
+
+if [[ "${1:-}" == "--print-candidates" ]]; then
+  emit_candidates | dedup | existing_dirs
+  exit 0
+fi
+
+selected_dir="$(
+  emit_candidates | dedup | existing_dirs | rofi -dmenu -i -p "$prompt" || true
+)"
+
+[[ -n "$selected_dir" ]] || exit 0
+
+case "$selected_dir" in
+  "~"|"~/"*)
+    selected_dir="$HOME${selected_dir:1}"
+    ;;
+esac
+
+if command -v realpath >/dev/null 2>&1; then
+  selected_dir="$(realpath -m -- "$selected_dir" 2>/dev/null || printf '%s' "$selected_dir")"
+fi
+
+if [[ ! -d "$selected_dir" ]]; then
+  notify "Directory not found: $selected_dir"
+  exit 1
+fi
+
+encoded_path="$(jq -rn --arg path "$selected_dir" '$path | @uri')"
+
+if ! command -v xdg-open >/dev/null 2>&1; then
+  notify "xdg-open is not available"
+  exit 1
+fi
+
+xdg-open "codex://threads/new?path=$encoded_path" >/dev/null 2>&1 &!

dotfiles/lib/bin/rofi_tmcodex.sh

@@ -10,6 +10,7 @@ state_dir="${XDG_STATE_HOME:-$HOME/.local/state}/rofi-tmcodex"
 history_file="$state_dir/dirs"
 codex_home="${CODEX_HOME:-$HOME/.codex}"
 terminal="${TMCODEX_TERMINAL:-${TERMINAL:-ghostty}}"
+dotfiles_root="${DOTFILES_WORKTREE:-/srv/dotfiles}"
 debug_log="$state_dir/debug.log"
 tmcodex_args=("$@")
 mkdir -p "$state_dir"
@@ -29,8 +30,8 @@ emit_candidates() {
   # 2) A few common roots. Keep these before slow/best-effort discovery so
   # rofi still has useful entries if a metadata scan breaks.
   for d in \
-    "$HOME/dotfiles" \
-    "$HOME/dotfiles/nixos" \
+    "$dotfiles_root" \
+    "$dotfiles_root/nixos" \
     "$HOME/Projects" \
     "$HOME/config" \
     "$HOME/org"
@@ -43,7 +44,7 @@ emit_candidates() {
 
   # 4) Shallow git repo discovery under a few likely roots.
   if command -v fd >/dev/null 2>&1; then
-    for root in "$HOME/Projects" "$HOME/dotfiles" "$HOME/config" "$HOME/org"; do
+    for root in "$HOME/Projects" "$dotfiles_root" "$HOME/config" "$HOME/org"; do
       [[ -d "$root" ]] || continue
       # Find ".git" directories; print their parent (repo root).
       # Keep it shallow for speed.

dotfiles/lib/bin/setup-shared-dotfiles

@@ -0,0 +1,123 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+usage() {
+  cat <<'EOF'
+Usage: setup-shared-dotfiles [--target /srv/dotfiles] [--group wheel] [--no-etc-nixos] [--force-etc-nixos]
+
+Copies this dotfiles checkout to an absent or empty shared machine-local
+worktree, then configures permissions so everyone can read it and sudoers can
+edit it without sudo. When the target already contains a git checkout, this
+repairs permissions/config only and does not overwrite local changes.
+
+Defaults:
+  target: /srv/dotfiles
+  group:  wheel
+
+The script also creates /etc/nixos -> <target>/nixos when /etc/nixos is absent
+or already a symlink. Use --force-etc-nixos to replace an existing /etc/nixos
+path with the symlink.
+EOF
+}
+
+target=/srv/dotfiles
+group=wheel
+manage_etc_nixos=1
+force_etc_nixos=0
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --target)
+      target="$2"
+      shift 2
+      ;;
+    --group)
+      group="$2"
+      shift 2
+      ;;
+    --no-etc-nixos)
+      manage_etc_nixos=0
+      shift
+      ;;
+    --force-etc-nixos)
+      force_etc_nixos=1
+      shift
+      ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    *)
+      echo "Unknown argument: $1" >&2
+      usage >&2
+      exit 2
+      ;;
+  esac
+done
+
+script_dir="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+source_root="$(git -C "$script_dir" rev-parse --show-toplevel)"
+target="$(realpath -m "$target")"
+
+if ! getent group "$group" >/dev/null; then
+  echo "Group '$group' does not exist" >&2
+  exit 1
+fi
+
+sudo install -d -m 2775 -o root -g "$group" "$(dirname "$target")"
+
+if [[ "$source_root" != "$target" ]]; then
+  target_has_content=0
+  if [[ -d "$target" ]] && find "$target" -mindepth 1 -maxdepth 1 -print -quit | grep -q .; then
+    target_has_content=1
+  fi
+
+  if [[ "$target_has_content" == 1 && ! -d "$target/.git" ]]; then
+    echo "Refusing to copy into non-empty non-git target: $target" >&2
+    exit 1
+  fi
+
+  if [[ "$target_has_content" == 0 ]]; then
+    sudo install -d -m 2775 -o root -g "$group" "$target"
+    sudo rsync -a --chown="root:$group" "$source_root/" "$target/"
+  else
+    echo "Existing git checkout found at $target; repairing permissions only."
+  fi
+fi
+
+sudo chown -R "root:$group" "$target"
+sudo find "$target" -type d -exec chmod 2775 {} +
+sudo find "$target" -type f -exec chmod u+rw,g+rw,o+r {} +
+
+if command -v setfacl >/dev/null; then
+  sudo setfacl -R -m "g::rwX,o::rX,m::rwX" "$target"
+  sudo setfacl -R -d -m "g::rwX,o::rX,m::rwX" "$target"
+fi
+
+sudo git -C "$target" config core.sharedRepository group
+if ! sudo git config --system --get-all safe.directory 2>/dev/null | grep -Fx -- "$target" >/dev/null; then
+  sudo git config --system --add safe.directory "$target" 2>/dev/null || true
+fi
+
+if [[ "$manage_etc_nixos" == 1 ]]; then
+  nixos_target="$target/nixos"
+  if [[ ! -d "$nixos_target" ]]; then
+    echo "Expected NixOS flake directory is missing: $nixos_target" >&2
+    exit 1
+  fi
+
+  if [[ -L /etc/nixos || ! -e /etc/nixos ]]; then
+    sudo rm -rf /etc/nixos
+    sudo ln -s "$nixos_target" /etc/nixos
+  elif [[ "$force_etc_nixos" == 1 ]]; then
+    backup="/etc/nixos.backup.$(date +%Y%m%d-%H%M%S)"
+    sudo mv /etc/nixos "$backup"
+    sudo ln -s "$nixos_target" /etc/nixos
+    echo "Moved previous /etc/nixos to $backup"
+  else
+    echo "Leaving existing /etc/nixos in place; pass --force-etc-nixos to replace it." >&2
+  fi
+fi
+
+echo "Shared dotfiles worktree ready: $target"
+echo "Nix/Home Manager should use dotfiles-worktree = \"$target\"."

dotfiles/lib/functions/nix_store_audit

@@ -0,0 +1,192 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+top=20
+
+usage() {
+  cat <<'EOF'
+Usage: nix_store_audit [--top N]
+
+Read-only audit of /nix/store size and retention. Reports:
+  - filesystem pressure, valid/dead paths, and system closure sizes
+  - largest individual store paths
+  - broad ecosystem totals (not additive)
+  - direnv closure footprint outside the current system
+  - largest direnv profile and result-link closures
+
+Sizes from the Nix database are logical NAR sizes, not filesystem block usage.
+EOF
+}
+
+while (($#)); do
+  case "$1" in
+    --top)
+      top="${2:?--top requires a positive integer}"
+      shift 2
+      ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    *)
+      printf 'Unknown argument: %s\n' "$1" >&2
+      usage >&2
+      exit 2
+      ;;
+  esac
+done
+
+if [[ ! "$top" =~ ^[1-9][0-9]*$ ]]; then
+  printf '%s\n' '--top must be a positive integer' >&2
+  exit 2
+fi
+
+for command_name in awk comm cut date df find mktemp nix nix-store sort wc xargs; do
+  if ! command -v "$command_name" >/dev/null 2>&1; then
+    printf 'Required command is missing: %s\n' "$command_name" >&2
+    exit 1
+  fi
+done
+
+db=/nix/var/nix/db/db.sqlite
+if [[ ! -r "$db" ]]; then
+  printf 'Cannot read the Nix database: %s\n' "$db" >&2
+  exit 1
+fi
+
+if command -v sqlite3 >/dev/null 2>&1; then
+  sqlite_bin=$(command -v sqlite3)
+else
+  sqlite_bin=$(find /nix/store -mindepth 3 -maxdepth 3 -type f -path '*/bin/sqlite3' -print -quit 2>/dev/null || true)
+fi
+
+if [[ -n "${sqlite_bin:-}" ]]; then
+  sql() {
+    "$sqlite_bin" -readonly "$db" "$@"
+  }
+else
+  printf 'sqlite3 is not installed or already present in /nix/store; using a temporary nix shell.\n' >&2
+  sql() {
+    nix shell nixpkgs#sqlite --command sqlite3 -readonly "$db" "$@"
+  }
+fi
+
+tmpdir=$(mktemp -d "${TMPDIR:-/tmp}/nix-store-audit.XXXXXX")
+trap 'rm -rf "$tmpdir"' EXIT
+
+roots="$tmpdir/roots.txt"
+current="$tmpdir/current.txt"
+booted="$tmpdir/booted.txt"
+dead="$tmpdir/dead.txt"
+direnv_targets="$tmpdir/direnv-targets.txt"
+direnv_closure="$tmpdir/direnv-closure.txt"
+direnv_outside="$tmpdir/direnv-outside-current.txt"
+booted_outside="$tmpdir/booted-outside-current.txt"
+ranked_roots="$tmpdir/ranked-roots.txt"
+ranked_root_pairs="$tmpdir/ranked-root-pairs.txt"
+ranked_targets="$tmpdir/ranked-targets.txt"
+ranked_target_sizes="$tmpdir/ranked-target-sizes.txt"
+
+nix-store --gc --print-roots 2>/dev/null > "$roots"
+nix-store --gc --print-dead 2>/dev/null | sort -u > "$dead"
+nix-store -qR /run/current-system 2>/dev/null | sort -u > "$current"
+nix-store -qR /run/booted-system 2>/dev/null | sort -u > "$booted"
+comm -23 "$booted" "$current" > "$booted_outside"
+
+awk -F' -> ' '
+  {
+    gsub(/^"|"$/, "", $1)
+    gsub(/^"|"$/, "", $2)
+    if ($1 ~ /\.direnv\//) print $2
+  }
+' "$roots" | sort -u > "$direnv_targets"
+
+if [[ -s "$direnv_targets" ]]; then
+  xargs -r nix-store -qR < "$direnv_targets" 2>/dev/null | sort -u > "$direnv_closure"
+else
+  : > "$direnv_closure"
+fi
+comm -23 "$direnv_closure" "$current" > "$direnv_outside"
+
+printf '# Nix store audit\n\n'
+printf 'Generated: %s\n\n' "$(date --iso-8601=seconds)"
+
+printf '## Pressure and roots\n\n'
+df -h / | awk 'NR == 1 || NR == 2'
+printf '\n'
+sql ".mode list" ".separator |" \
+  "create temp table dead(path text);" \
+  ".import $dead dead" \
+  "select count(*) || ' valid paths | ' || printf('%.1f GiB logical NAR size', sum(narSize)/1073741824.0) from ValidPaths;" \
+  "select count(*) || ' dead paths | ' || printf('%.2f GiB immediately GC-eligible', coalesce(sum(narSize), 0)/1073741824.0) from ValidPaths join dead using(path);"
+
+current_size=$(nix path-info -Sh /run/current-system 2>/dev/null | awk '{print $(NF-1) " " $NF}')
+booted_size=$(nix path-info -Sh /run/booted-system 2>/dev/null | awk '{print $(NF-1) " " $NF}')
+printf '%s current-system closure\n' "$current_size"
+printf '%s booted-system closure\n' "$booted_size"
+
+sql ".mode list" ".separator |" \
+  "create temp table x(path text);" \
+  ".import $booted_outside x" \
+  "select printf('%.2f GiB booted-only versus current', coalesce(sum(narSize), 0)/1073741824.0) from ValidPaths join x using(path);"
+
+awk -F' -> ' '
+  {
+    gsub(/^"|"$/, "", $1)
+    if ($1 ~ /^\/proc\//) kind="runtime /proc roots"
+    else if ($1 ~ /\.direnv\/flake-profile-/) kind="direnv profile roots"
+    else if ($1 ~ /\.direnv\//) kind="other direnv roots"
+    else if ($1 ~ /\/result[^/]*$/) kind="result links"
+    else if ($1 ~ /home-manager/) kind="home-manager roots"
+    else if ($1 ~ /^\/nix\/var\/nix\/profiles|^\/run\//) kind="system/profile roots"
+    else kind="other roots"
+    count[kind]++
+  }
+  END { for (kind in count) printf "%7d  %s\n", count[kind], kind }
+' "$roots" | sort -nr
+
+printf '\n## Largest individual store paths\n\n'
+sql "select printf('%7.2f GiB', narSize/1073741824.0) || '  ' || path from ValidPaths order by narSize desc limit $top;"
+
+printf '\n## Broad named-path totals\n\n'
+printf 'These categories are filename-based lower bounds and overlap; do not add them.\n\n'
+sql "select 'model weights', printf('%.1f GiB',sum(narSize)/1073741824.0), count(*) from ValidPaths where path like '%.safetensors' union all select 'Android', printf('%.1f GiB',sum(narSize)/1073741824.0), count(*) from ValidPaths where lower(path) like '%android%' union all select 'CUDA/cuDNN/cuBLAS', printf('%.1f GiB',sum(narSize)/1073741824.0), count(*) from ValidPaths where lower(path) like '%cuda%' or lower(path) like '%cudnn%' or lower(path) like '%cublas%' union all select 'GHC', printf('%.1f GiB',sum(narSize)/1073741824.0), count(*) from ValidPaths where lower(path) like '%-ghc-%' or lower(path) like '%-ghc-with%' union all select 'Rust toolchains', printf('%.1f GiB',sum(narSize)/1073741824.0), count(*) from ValidPaths where lower(path) like '%-rustc-%' or lower(path) like '%-rust-std-%' or lower(path) like '%-rust-stable-%' or lower(path) like '%-cargo-%' union all select 'source snapshots', printf('%.1f GiB',sum(narSize)/1073741824.0), count(*) from ValidPaths where path like '%-source';"
+
+printf '\n## Current system versus direnv-only footprint\n\n'
+printf '%s unique direnv root targets\n' "$(wc -l < "$direnv_targets")"
+sql ".mode list" ".separator |" \
+  "create temp table c(path text); create temp table d(path text);" \
+  ".import $current c" \
+  ".import $direnv_closure d" \
+  "select printf('%.2f GiB current-system closure by DB NAR size', coalesce(sum(narSize), 0)/1073741824.0) from ValidPaths join c using(path);" \
+  "select printf('%.2f GiB union of direnv-rooted closures', coalesce(sum(narSize), 0)/1073741824.0) from ValidPaths join d using(path);" \
+  "delete from d;" \
+  ".import $direnv_outside d" \
+  "select printf('%.2f GiB direnv closure outside current system (upper bound, other roots may retain paths)', coalesce(sum(narSize), 0)/1073741824.0) from ValidPaths join d using(path);" \
+  "select 'direnv-only Android', printf('%.1f GiB',sum(narSize)/1073741824.0) from ValidPaths join d using(path) where lower(path) like '%android%' union all select 'direnv-only CUDA family', printf('%.1f GiB',sum(narSize)/1073741824.0) from ValidPaths join d using(path) where lower(path) like '%cuda%' or lower(path) like '%cudnn%' or lower(path) like '%cublas%' union all select 'direnv-only GHC', printf('%.1f GiB',sum(narSize)/1073741824.0) from ValidPaths join d using(path) where lower(path) like '%-ghc-%' or lower(path) like '%-ghc-with%' union all select 'direnv-only Rust', printf('%.1f GiB',sum(narSize)/1073741824.0) from ValidPaths join d using(path) where lower(path) like '%-rustc-%' or lower(path) like '%-rust-std-%' or lower(path) like '%-rust-stable-%' or lower(path) like '%-cargo-%' union all select 'direnv-only sources', printf('%.1f GiB',sum(narSize)/1073741824.0) from ValidPaths join d using(path) where path like '%-source';"
+
+awk -F' -> ' '
+  {
+    gsub(/^"|"$/, "", $1)
+    gsub(/^"|"$/, "", $2)
+    if ($1 ~ /\.direnv\/flake-profile-/ || $1 ~ /\/result[^/]*$/) print $1 "|" $2
+  }
+' "$roots" | sort -u > "$ranked_root_pairs"
+
+cut -d'|' -f2 "$ranked_root_pairs" | sort -u > "$ranked_targets"
+if [[ -s "$ranked_targets" ]]; then
+  xargs -r nix path-info -Sh < "$ranked_targets" 2>/dev/null \
+    | awk '{print $1 "|" $(NF-1) $NF}' > "$ranked_target_sizes"
+else
+  : > "$ranked_target_sizes"
+fi
+
+awk -F'|' '
+  NR == FNR { size[$1]=$2; next }
+  $2 in size { print size[$2] "\t" $1 }
+' "$ranked_target_sizes" "$ranked_root_pairs" > "$ranked_roots"
+
+printf '\n## Largest direnv profile and result-link closures\n\n'
+printf 'These closure sizes heavily overlap; do not add them.\n\n'
+sort -hr "$ranked_roots" | head -n "$top" || true

dotfiles/lib/functions/pashowvolume

@@ -3,12 +3,12 @@
 function pashowvolume {
 	timeout="${RUMNO_TIMEOUT:-2.5}"
 	if paismuted; then
-		rumno notify -t "$timeout" -m
+		rumno -t "$timeout" -m true
 	else
 		actual=$(pavolume)
 		max=100
 		show=$(( actual < max ? actual : max ))
-		rumno notify -t "$timeout" -v "$show"
+		rumno -t "$timeout" -v "$show"
 	fi
 }
 

dotfiles/lib/functions/safe_ncdu

@@ -10,6 +10,7 @@ Usage:
 
 Creates a compressed ncdu export while avoiding mounted descendants of ROOT.
 Default ROOT is /. Default OUTPUT is ~/.cache/ncdu/safe-ncdu-<root>-<timestamp>.json.zst.
+Records matching .excludes and .meta sidecars for reproducible analysis.
 EOF
 }
 
@@ -90,9 +91,10 @@ function _safe_ncdu_scan {
         shift
     done
 
-    _safe_ncdu_require ncdu findmnt realpath awk sed date mkdir tee sort uniq || return 1
+    _safe_ncdu_require ncdu findmnt realpath awk sed date mkdir dirname tee sort uniq hostname || return 1
 
-    local root_real root_name out_dir latest excludes_file
+    local root_real root_name out_dir latest excludes_file meta_file
+    local started_at finished_at host ncdu_version scan_status exit_code
     root_real="$(realpath -m "$root")" || return 1
     root_name="$(_safe_ncdu_root_name "$root_real")"
     out_dir="$HOME/.cache/ncdu"
@@ -101,10 +103,29 @@ function _safe_ncdu_scan {
     if [[ -z "$output" ]]; then
         output="$out_dir/safe-ncdu-${root_name}-$(date +%Y%m%d-%H%M%S).json.zst"
     fi
+    output="$(realpath -m "$output")" || return 1
+    mkdir -p "$(dirname "$output")"
 
     excludes_file="${output}.excludes"
+    meta_file="${output}.meta"
     _safe_ncdu_excludes "$root_real" | sort -u | tee "$excludes_file" >/dev/null
 
+    started_at="$(date --iso-8601=seconds)"
+    host="$(hostname)"
+    ncdu_version="$(ncdu --version 2>&1 | head -n 1)"
+    {
+        echo "format_version=1"
+        echo "status=in_progress"
+        echo "root=$root_real"
+        echo "started_at=$started_at"
+        echo "finished_at="
+        echo "hostname=$host"
+        echo "ncdu_version=$ncdu_version"
+        echo "snapshot=$output"
+        echo "excludes=$excludes_file"
+        echo "exit_code="
+    } >| "$meta_file"
+
     local -a exclude_args
     local exclude
     exclude_args=()
@@ -115,12 +136,34 @@ function _safe_ncdu_scan {
     echo "safe_ncdu: scanning $root_real"
     echo "safe_ncdu: writing $output"
     echo "safe_ncdu: excludes recorded in $excludes_file"
-    ncdu -0 -x -c "${exclude_args[@]}" -o "$output" "$root_real" || return $?
+    echo "safe_ncdu: metadata recorded in $meta_file"
+    ncdu -0 -x -c "${exclude_args[@]}" -o "$output" "$root_real"
+    exit_code=$?
+    finished_at="$(date --iso-8601=seconds)"
+    if [[ $exit_code -eq 0 ]]; then
+        scan_status="complete"
+    else
+        scan_status="failed"
+    fi
+    {
+        echo "format_version=1"
+        echo "status=$scan_status"
+        echo "root=$root_real"
+        echo "started_at=$started_at"
+        echo "finished_at=$finished_at"
+        echo "hostname=$host"
+        echo "ncdu_version=$ncdu_version"
+        echo "snapshot=$output"
+        echo "excludes=$excludes_file"
+        echo "exit_code=$exit_code"
+    } >| "$meta_file"
+    [[ $exit_code -eq 0 ]] || return $exit_code
 
     latest="$out_dir/latest-${root_name}.json.zst"
     ln -sfn "$output" "$latest"
     echo "safe_ncdu: latest symlink $latest"
     ln -sfn "$excludes_file" "${latest}.excludes"
+    ln -sfn "$meta_file" "${latest}.meta"
 }
 
 function _safe_ncdu_open {
@@ -141,7 +184,14 @@ function _safe_ncdu_top {
         echo "safe_ncdu top: missing SNAPSHOT" >&2
         return 2
     fi
-    _safe_ncdu_require zstdcat jq awk || return 1
+    _safe_ncdu_require zstdcat jq awk stat || return 1
+    local compressed_size
+    compressed_size="$(stat -Lc '%s' "$snapshot")" || return 1
+    if [[ "$compressed_size" -gt 134217728 && "${SAFE_NCDU_ALLOW_LARGE_TOP:-0}" != 1 ]]; then
+        echo "safe_ncdu top: snapshot is larger than 128 MiB compressed; jq analysis may exhaust memory" >&2
+        echo "safe_ncdu top: use 'safe_ncdu open $snapshot' or a domain-specific audit instead" >&2
+        return 2
+    fi
     zstdcat "$snapshot" | jq -r --argjson limit "$limit" --arg path "$query_path" '
       def total:
         if type == "array" then

dotfiles/lib/functions/set_multiplexer_title

@@ -10,16 +10,50 @@ set_multiplexer_title() {
 
     title="$*"
 
+    tmux_socket=""
+    tmux_session_target=""
+    tmux_window_target=""
+    tmux_pane_target=""
+
     if [ -n "${TMUX:-}" ]; then
         multiplexer="tmux"
+        tmux_socket=${TMUX%%,*}
     elif [ -n "${ZELLIJ:-}" ]; then
         multiplexer="zellij"
+    else
+        tmux_socket="/tmp/tmux-$(id -u)/default"
+        if command -v tmux >/dev/null 2>&1 && [ -S "$tmux_socket" ]; then
+            # Newer Codex tool calls may be serviced by an app-server process
+            # that is not a child of the visible tmux pane, so TMUX is absent.
+            # Recover the likely pane by matching attached Codex panes in the
+            # current working directory and taking the newest matching client.
+            tmux_client=$(
+                tmux -S "$tmux_socket" list-clients -F '#{session_id}|#{window_id}|#{pane_id}|#{pane_pid}|#{pane_current_path}|#{pane_current_command}' 2>/dev/null |
+                    awk -F '|' -v cwd="$PWD" '$5 == cwd && ($6 == "codex" || $6 == "codex-raw") { line = $0 } END { print line }'
+            )
+            if [ -n "$tmux_client" ]; then
+                multiplexer="tmux"
+                tmux_session_target=${tmux_client%%|*}
+                rest=${tmux_client#*|}
+                tmux_window_target=${rest%%|*}
+                rest=${rest#*|}
+                tmux_pane_target=${rest%%|*}
             else
                 return 0
             fi
+        else
+            return 0
+        fi
+    fi
 
     state_dir="${HOME}/.agents/state"
-    state_file="$state_dir/${multiplexer}-title"
+    state_key="$multiplexer"
+    if [ -n "$tmux_pane_target" ]; then
+        state_key="${state_key}-${tmux_pane_target#%}"
+    elif [ -n "$tmux_socket" ]; then
+        state_key="${state_key}-$(printf '%s' "$tmux_socket" | tr '/.,:' '____')"
+    fi
+    state_file="$state_dir/${state_key}-title"
     mkdir -p "$state_dir"
 
     if [ -f "$state_file" ]; then
@@ -30,7 +64,14 @@ set_multiplexer_title() {
     fi
 
     if [ "$multiplexer" = "tmux" ]; then
+        if [ -n "$tmux_pane_target" ]; then
+            tmux -S "$tmux_socket" \
+                rename-session -t "$tmux_session_target" "$title" \; \
+                rename-window -t "$tmux_window_target" "$title" \; \
+                select-pane -t "$tmux_pane_target" -T "$title"
+        else
             tmux rename-session "$title" \; rename-window "$title" \; select-pane -T "$title"
+        fi
     else
         zellij action rename-session "$title" &&
             zellij action rename-tab "$title" &&

dotfiles/lib/functions/tmcodex

@@ -1,22 +1,93 @@
 #!/usr/bin/env sh
 
+function _tmcodex_expand_dir {
+    case "$1" in
+        "~")
+            printf '%s\n' "$HOME"
+            ;;
+        "~/"*)
+            printf '%s\n' "$HOME/${1#"~/"}"
+            ;;
+        *)
+            printf '%s\n' "$1"
+            ;;
+    esac
+}
+
+function _tmcodex_resolve_dir {
+    dir="$(_tmcodex_expand_dir "$1")"
+    if [ ! -d "$dir" ]; then
+        echo "tmcodex: directory not found: $1" >&2
+        return 1
+    fi
+
+    cd -- "$dir" && pwd -P
+}
+
+function _tmcodex_has_remote_arg {
+    while [ "$#" -gt 0 ]; do
+        case "$1" in
+            --remote|--remote=*)
+                return 0
+                ;;
+        esac
+        shift
+    done
+
+    return 1
+}
+
 function tmcodex {
+    launch_dir="$PWD"
+
+    case "${1:-}" in
+        -C|--cd)
+            if [ -z "${2:-}" ]; then
+                echo "tmcodex: $1 requires a directory" >&2
+                return 2
+            fi
+            launch_dir="$2"
+            shift 2
+            ;;
+        --cd=*)
+            launch_dir="${1#--cd=}"
+            shift
+            ;;
+        *)
+            expanded_first_arg="$(_tmcodex_expand_dir "${1:-}")"
+            if [ -n "${1:-}" ] && [ -d "$expanded_first_arg" ]; then
+                launch_dir="$1"
+                shift
+            fi
+            ;;
+    esac
+
+    launch_dir="$(_tmcodex_resolve_dir "$launch_dir")" || return
+
     # Record launch directories so rofi_tmcodex can offer good defaults.
     state_dir="${XDG_STATE_HOME:-$HOME/.local/state}/rofi-tmcodex"
     history_file="$state_dir/dirs"
     mkdir -p "$state_dir" 2>/dev/null || true
-    if [ -d "$PWD" ]; then
+    if [ -d "$launch_dir" ]; then
         tmp="$(mktemp 2>/dev/null || true)"
         if [ -n "$tmp" ]; then
-            { printf '%s\n' "$PWD"; cat "$history_file" 2>/dev/null || true; } \
+            { printf '%s\n' "$launch_dir"; cat "$history_file" 2>/dev/null || true; } \
                 | awk 'NF && !seen[$0]++' \
                 | head -n 200 >"$tmp" 2>/dev/null || true
             mv -f "$tmp" "$history_file" 2>/dev/null || true
         else
-            printf '%s\n' "$PWD" >>"$history_file" 2>/dev/null || true
+            printf '%s\n' "$launch_dir" >>"$history_file" 2>/dev/null || true
         fi
     fi
-    trw codex --dangerously-bypass-approvals-and-sandbox "$@"
+
+    (
+        cd -- "$launch_dir" || exit
+        if _tmcodex_has_remote_arg "$@"; then
+            trw codex --dangerously-bypass-approvals-and-sandbox --cd "$launch_dir" "$@"
+        else
+            trw codex --remote "${TMCODEX_REMOTE:-unix://}" --dangerously-bypass-approvals-and-sandbox --cd "$launch_dir" "$@"
+        fi
+    )
 }
 
 tmcodex "$@"

dotfiles/lib/functions/windows_toast

@@ -1,7 +1,7 @@
 #!/usr/bin/env sh
 
 function windows_toast {
-	powershell.exe -File ~/dotfiles/dotfiles/lib/bin/windows-toast.ps1 -Title "$@" 2>/dev/null
+	powershell.exe -File "${DOTFILES_WORKTREE:-/srv/dotfiles}/dotfiles/lib/bin/windows-toast.ps1" -Title "$@" 2>/dev/null
 }
 
 windows_toast "$@"

dotfiles/lib/functions/zcodex

@@ -17,7 +17,7 @@ function zcodex {
         fi
     fi
 
-    ZRW_NAME=codex zrw codex --dangerously-bypass-approvals-and-sandbox "$@"
+    ZRW_NAME=codex zrw codex --dangerously-bypass-approvals-and-sandbox --cd "$PWD" "$@"
 }
 
 zcodex "$@"