Bumps the azos-core submodule and updates docs/imports to match: AGENTS.md
now documents the suite-grouping convention (no bare top-level modules),
and claude-memory/claude-skills no longer need their own entries in
home-manager/home.nix since they're folded into the base suite.
- homey-alert: add a global PreToolUse hook that transparently times every
Bash command Claude runs and fires a notification once a command crosses
the configured threshold (default 5 min), without needing the skill to
be invoked manually. Also makes homey-alert always fire a local
notify-send alongside the ntfy push, since the ntfy server isn't always
reachable.
- nextcloud: fix sleep crash-loop under the restricted systemd PATH
(bin/sleep -> coreutils store path).
- azos-core bump (adds ncdu to the base suite).
pam_u2f is set up as a sufficient factor ahead of password for sudo and
login (which greetd/tuigreet substacks), so touching the key logs in
without typing a password while leaving password as fallback.
Fingerprint was investigated too but lauretta's reader is an unsupported
match-on-chip sensor, documented in the feature instead of wired up.
Also flip kubectl, qutebrowser-config, and snx-rs to disabled by default
since they're unused.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
A failed pass/gpg fetch (e.g. YubiKey not plugged in yet) used to pass
process output straight to string-trim, which signals instead of
returning nil on empty output, aborting the sentinel before
elfeed-feeds or elfeed-protocol-enable ran. That left elfeed-feeds nil
for the rest of the session with no visible error beyond a *Messages*
line, and every later elfeed-update silently had nothing to fetch.
Wrap the fetch in azos/elfeed-protocol-init-feeds so a failed attempt
can be retried interactively instead of requiring a full reload of the
elfeed-protocol feature.
lieer was declared (programs/services.lieer.enable) but had zero real
footprint — mu4e actually fetches via mbsync (mu4e-get-mail-command is
literally "mbsync -a") and sends via msmtp; lieer never had an auth/sync
state file anywhere. Drop it to stop the config suggesting a sync path
that isn't actually in use.
Add a systemd user timer that runs mbsync every 5 minutes. mbsync's
PassCmd shells out to `pass`, which needs the GPG smartcard; on a blind
timer a missing card would otherwise surface as a pinentry "please
insert card" prompt every run. The wrapper script gates the sync behind
`gpg --card-status`, which only queries the reader without invoking
pinentry either way, so a missing card is now a silent no-op instead of
a nag.
Bump azos-core for EDNC popup notifications.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The gpg-agent systemd Environment=INSIDE_EMACS=1 hack never worked:
gpg-agent calls gnupg_unsetenv("INSIDE_EMACS") on itself at startup by
design, expecting the variable per-connection from the client instead.
Move it to home.sessionVariables so git/gpg invocations themselves carry
it and forward it to gpg-agent via "OPTION putenv=...", which is what
actually routes a pinentry request to Emacs instead of failing on
curses with no tty.
Bump azos-core for the project-brain-aligned todo/workplate/work-history
skills and the global org-roam Read/Edit permission rules.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
gpg-agent may not have a cached passphrase yet when the top-level setq
runs at Emacs startup, so a cold agent makes 'pass' fail silently
(stderr redirected) and leaves lichess-token permanently empty for the
session. Retry the fetch right before each use instead of only once
at startup.
aner