chore: update keepbook input

libDir pointed to ${config.dotfiles-worktree}/dotfiles/lib, which gets
evaluated at build time — so running `just switch` from inside a worktree
would bake that worktree path into /etc/zshenv permanently. If the worktree
is later removed, every zsh startup errors with "no matches found".

zshLibDir was already defined via builtins.path (a stable nix store copy)
but unused. Switch all fpath/autoload/PATH references to it and drop libDir.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

dotfiles/agents/AGENTS.md

@@ -11,6 +11,12 @@
 - Create `.worktrees/` if needed before running `git worktree add`.
 - Only use a non-`.worktrees/` location when the user explicitly asks for a different path.
 
+## GitHub pull requests
+- Default to creating pull requests as ready for review, not drafts.
+- Do not add a `[codex]` prefix or any other agent/tool prefix to pull request titles.
+- Create a draft pull request only when the user explicitly asks for a draft or when the remote platform requires draft status.
+- If using a helper, skill, or CLI wrapper that defaults to draft PRs, override that default before creating the PR.
+
 ## NixOS workflow
 - This system is managed with a Nix flake at `/srv/dotfiles/nixos`.
 - Use `just switch` from that directory for rebuilds instead of plain `nixos-rebuild`.

dotfiles/agents/skills/disk-space-cleanup/SKILL.md

@@ -19,6 +19,7 @@ Bundled helpers:
 - Prioritize easy wins first (`nix-collect-garbage`, container prune, Cargo artifacts).
 - Propose destructive actions with expected impact before running them.
 - Run destructive actions only after confirmation, unless the user explicitly requests immediate execution of obvious wins.
+- For Rust build artifacts, do not repeatedly ask for confirmation before deleting explicit directories literally named `target` after `rust_target_dirs.py delete` validates them. Cargo targets are rebuildable artifacts; when the user asks to clean Rust target directories, validate with the helper, delete with `--yes`, and report the reclaimed space.
 - Capture new reusable findings by updating this skill before finishing.
 
 ## Workflow
@@ -178,6 +179,7 @@ Machine-specific heavy hitters seen in practice:
 - 2026-05-26 cleanup: when `cargo test` is actively running in `~/Projects/subtr-actor`, leave `subtr-actor/target` alone and delete only inactive Cargo-backed targets. Deleting `keepbook`, `rlru`, `rocket-sense`, `rumno`, and stale `subtr-actor/.worktrees/*/target` reclaimed about 24.5G by helper sizing.
 - 2026-05-26 cleanup: `~/Projects/nixpkgs/.worktrees/*/result` symlinks pinned several GiB of Nix closures, and clean registered nixpkgs worktrees were about 460M each. Removing stale `result` symlinks, running GC, and removing clean worktrees while preserving dirty ones moved `/` from 100% used to about 90% used.
 - 2026-05-27 cleanup: under `~/Projects`, `hypr-workspace-history/target` can be a Rust-style build cache even though the guarded helper rejects it because no `Cargo.toml` is present; inspect and remove that explicit cache manually if present. Preserve `~/Projects/Hyprland/src/layout/target`, which is source code, not a build artifact.
+- 2026-06-18 cleanup: deleting helper-validated Rust targets under `.worktrees/*/target` and `.claude/worktrees/*/target`, plus stale `~/Projects/lastfm-edit/target`, removed 24 target directories totaling 67.1G by helper sizing and moved `/` from 99% used to 90% used. Remaining large targets were top-level project caches under `keepbook`, `rlru`, `subtr-actor`, `rocket-sense`, `rocket-sense-pr-73-ci`, `rocket-sense-subtr-viewer`, `rocket-sense-controlled-plays`, and `boxcars`.
 
 ## Step 5: `/nix/store` Deep Dive
 
@@ -248,7 +250,7 @@ nix-store --gc --print-roots | rg '/\\.direnv/flake-profile-' | awk -F' -> ' '{p
 
 - Do not delete user files directly unless explicitly requested.
 - Prefer cleanup tools that understand ownership/metadata (`nix`, `docker`, `podman`, `cargo-sweep`) over `rm -rf`.
-- For Rust build artifacts, deleting an explicit directory literally named `target` is acceptable when it is discovered by the bundled helper; Cargo will rebuild it.
+- For Rust build artifacts, deleting an explicit directory literally named `target` is acceptable when it is discovered and validated by the bundled helper; Cargo will rebuild it. Do not double-check with the user after helper validation when the active request is Rust target cleanup.
 - Present a concise “proposed actions” list before high-impact deletes.
 - If uncertain whether data is needed, stop at investigation and ask.
 

nixos/environment.nix

@@ -11,7 +11,6 @@
     if envDotfilesWorktree != ""
     then envDotfilesWorktree
     else "/srv/dotfiles";
-  libDir = "${config.dotfiles-worktree}/dotfiles/lib";
   zshLibDir = builtins.path {
     path = ../dotfiles/lib;
     name = "dotfiles-zsh-lib";
@@ -77,9 +76,9 @@ in
           # handled once by oh-my-zsh below, with this check intentionally skipped.
           ZSH_DISABLE_COMPFIX=true
 
-          fpath=("$HOME/.lib/completions" "${libDir}/completions" $fpath)
-          fpath+="${libDir}/functions"
-          for file in "${libDir}/functions/"*
+          fpath=("$HOME/.lib/completions" "${zshLibDir}/completions" $fpath)
+          fpath+="${zshLibDir}/functions"
+          for file in "${zshLibDir}/functions/"*
           do
               autoload "''${file##*/}"
           done
@@ -184,7 +183,7 @@ in
           export STARSHIP_INSIDE_EMACS="yes"
         '';
         extraInit = ''
-          export PATH="$HOME/.cargo/bin:${libDir}/bin:${libDir}/functions:$PATH";
+          export PATH="$HOME/.cargo/bin:${zshLibDir}/bin:${zshLibDir}/functions:$PATH";
         '';
       };
     };

nixos/flake.lock

@@ -183,16 +183,15 @@
         ]
       },
       "locked": {
-        "lastModified": 1781231404,
-        "narHash": "sha256-RgbXa8W975nSV2zyQdcXjuQepahhlAF0cW6jwecU9x4=",
-        "owner": "colonelpanic8",
+        "lastModified": 1781761316,
+        "narHash": "sha256-hH+5JNKVugNkXEG0fLiGkvOySCmPERUcm+njP1+RLJw=",
+        "owner": "ilysenko",
         "repo": "codex-desktop-linux",
-        "rev": "8b8c5f05774ec9a48664dcf657f9fb7761174f8c",
+        "rev": "9125911c8347c35177dfc76e2f5bce2b8b2e41d4",
         "type": "github"
       },
       "original": {
-        "owner": "colonelpanic8",
-        "ref": "colonelpanic/linux-build-info-no-shadow",
+        "owner": "ilysenko",
         "repo": "codex-desktop-linux",
         "type": "github"
       }
@@ -1409,11 +1408,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1781484243,
-        "narHash": "sha256-8MORYJdWu16cvjbdpUkql1CKU+49UYEBimhAeNHrba4=",
+        "lastModified": 1781822941,
+        "narHash": "sha256-9biXcoMW/Gdh7HBbXBpH2tt33xh8Zvhsm9wuHVEcpXE=",
         "owner": "colonelpanic8",
         "repo": "keepbook",
-        "rev": "6a3381159a60761ac65ab0a1ebfd82762feae1b7",
+        "rev": "815a26ff7efad93fd6fa5395af177c7c5d86068f",
         "type": "github"
       },
       "original": {
@@ -1965,11 +1964,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1781557452,
-        "narHash": "sha256-SsVClSsfiSWNyf343bcCW/NZOgAgsSiYS8W2fmRXmmY=",
+        "lastModified": 1781817218,
+        "narHash": "sha256-McPiyjrbjctccv9weXYSwBxdP4cRF7heNBgFQ8VYP4c=",
         "owner": "rlrml",
         "repo": "rlru",
-        "rev": "d815411d795110ab6e5beff33f59099322b94d00",
+        "rev": "01956ebab8adcd895c2dc72b7d1ea18139d5ab60",
         "type": "github"
       },
       "original": {

nixos/flake.nix

@@ -275,7 +275,7 @@
     };
 
     codex-desktop-linux = {
-      url = "github:colonelpanic8/codex-desktop-linux?ref=colonelpanic/linux-build-info-no-shadow";
+      url = "github:ilysenko/codex-desktop-linux";
       inputs = {
         nixpkgs.follows = "nixpkgs";
         flake-utils.follows = "flake-utils";

nixos/machines/railbird-sf.nix

@@ -107,6 +107,67 @@
   services.nginx.virtualHosts."rocket-sense.duckdns.org" = {
     enableACME = true;
     forceSSL = true;
+    locations."= /privacy" = {
+      alias = pkgs.writeText "rocket-sense-privacy.html" ''
+        <!doctype html>
+        <html lang="en">
+          <head>
+            <meta charset="utf-8">
+            <meta name="viewport" content="width=device-width, initial-scale=1">
+            <title>Rocket Sense Privacy Policy</title>
+            <style>
+              body {
+                color: #171717;
+                font-family: system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
+                line-height: 1.55;
+                margin: 0;
+                padding: 48px 24px;
+              }
+              main {
+                max-width: 760px;
+                margin: 0 auto;
+              }
+              h1, h2 {
+                line-height: 1.2;
+              }
+              h1 {
+                font-size: 2rem;
+              }
+              h2 {
+                font-size: 1.2rem;
+                margin-top: 2rem;
+              }
+            </style>
+          </head>
+          <body>
+            <main>
+              <h1>Rocket Sense Privacy Policy</h1>
+              <p>Last updated: June 18, 2026</p>
+
+              <p>Rocket Sense is a Rocket League replay analysis service operated by Ivan Malison. This policy explains what information the service uses when you sign in and upload or view replay data.</p>
+
+              <h2>Information We Collect</h2>
+              <p>When you sign in with Epic Games, Rocket Sense receives the Epic account identifiers and profile fields that you approve during the Epic login flow, such as account ID and display name. When you use the service, Rocket Sense may store replay files, replay metadata, player identifiers, derived gameplay statistics, and basic account/session records needed to operate the site.</p>
+
+              <h2>How We Use Information</h2>
+              <p>Rocket Sense uses this information to authenticate users, associate uploads with accounts, process replay files, display replay-derived statistics, maintain site reliability, and prevent abuse.</p>
+
+              <h2>Sharing</h2>
+              <p>Rocket Sense does not sell personal information. Information may be processed by infrastructure providers used to host and operate the service, and may be disclosed if required by law or necessary to protect the service and its users.</p>
+
+              <h2>Retention</h2>
+              <p>Rocket Sense keeps account, replay, and derived analysis data for as long as needed to provide the service, debug issues, maintain security, or comply with legal obligations.</p>
+
+              <h2>Contact</h2>
+              <p>For privacy questions or deletion requests, contact Ivan Malison at IvanMalison@gmail.com.</p>
+            </main>
+          </body>
+        </html>
+      '';
+      extraConfig = ''
+        default_type text/html;
+      '';
+    };
     locations."/" = {
       proxyPass = "http://127.0.0.1:30080";
       proxyWebsockets = true;