fix: shift renovate schedules to 5-7 PM Saturday to align with cron

CronJob runs at 0/6/12/18h. Old 2-4 PM window never had a run
inside it, so Renovate never created PRs. Shift to 5-7 PM so the
18:00 run lands in the window. nixpkgs-qt staggered to 7-9 PM.

.gitea/workflows/ci.yml

@@ -50,6 +50,7 @@ jobs:
             custom-rclone-torbox-setup
             custom-beads
             custom-gastown
+            custom-perles
             qt-pinned-jellyfin-media-player
             qt-pinned-stremio
             nix-deck-kernel

flake.lock

@@ -7,11 +7,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1772587450,
-        "narHash": "sha256-yJ38xi6nRnEZIV5CEgV8xZK1dky0dVMavfFg4J7gkqw=",
+        "lastModified": 1773070962,
+        "narHash": "sha256-kHZXx+kygpVholOBsuQocCtksHo5ZWYskP64qK2Kjh0=",
         "owner": "steveyegge",
         "repo": "beads",
-        "rev": "7f41edd9c4350e5c68ebec6f9571e27833f27133",
+        "rev": "9604d30b7c746f9f04f6dea5f82996f71bb66073",
         "type": "github"
       },
       "original": {
@@ -88,11 +88,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1772724442,
-        "narHash": "sha256-+H/T745sVDJAztpf3k6zz89YNrpCYsGghbO7O3O/IHw=",
+        "lastModified": 1773088127,
+        "narHash": "sha256-gJFayiBYrF0Q99AOQH29uq0Mli8KRfwReYeAh5H5evY=",
         "owner": "steveyegge",
         "repo": "gastown",
-        "rev": "112ff2c4bd145de796d20f35d35e583832a72ce1",
+        "rev": "8da798be0663af74be7960844b90038e51769203",
         "type": "github"
       },
       "original": {

flake.nix

@@ -113,6 +113,19 @@
       (ufinal: uprev: {
         claude-code = uprev.callPackage ./packages/claude-code {};
       })
+      # Pin dolt to v1.82.4 (gastown requires >= 1.82.4)
+      (ufinal: uprev: {
+        dolt = uprev.dolt.overrideAttrs (old: rec {
+          version = "1.82.4";
+          src = uprev.fetchFromGitHub {
+            owner = "dolthub";
+            repo = "dolt";
+            tag = "v${version}";
+            hash = "sha256-mavL3y+Kv25hzFlDFXk7W/jeKVKlCBjlc67GkL3Jcwk=";
+          };
+          vendorHash = "sha256-K1KzsqptZxO5OraWKIXeqKuVSzb6E/Mjy3c5PQ7Rs9k=";
+        });
+      })
     ];
 
     nixosModules = [
@@ -283,6 +296,11 @@
           src = inputs.gastown;
           version = "unstable-${gastownRev}";
         };
+        "custom-perles" = pkgs.callPackage ./packages/perles {
+          inherit (pkgs.unstable) buildGoModule;
+          src = inputs.perles;
+          version = "unstable-${builtins.substring 0 8 (inputs.perles.rev or "unknown")}";
+        };
       } // (if system == "x86_64-linux" then {
         # nix-deck kernel from Jovian-NixOS (Steam Deck) - expensive to build
         "nix-deck-kernel" = self.nixosConfigurations.nix-deck.config.boot.kernelPackages.kernel;

home/roles/development/beads-search-query-optimization.patch

@@ -1,44 +0,0 @@
-diff --git a/internal/storage/dolt/queries.go b/internal/storage/dolt/queries.go
-index 7d8214ee..8acdaae2 100644
---- a/internal/storage/dolt/queries.go
-+++ b/internal/storage/dolt/queries.go
-@@ -212,8 +212,21 @@ func (s *DoltStore) SearchIssues(ctx context.Context, query string, filter types
- 	}
- 
- 	// nolint:gosec // G201: whereSQL contains column comparisons with ?, limitSQL is a safe integer
-+	// Performance fix: SELECT all columns directly instead of id-only + WHERE IN (all_ids)
-+	// See: hq-ihwsj - bd list uses inefficient WHERE IN (all_ids) query pattern
- 	querySQL := fmt.Sprintf(`
--		SELECT id FROM issues
-+		SELECT id, content_hash, title, description, design, acceptance_criteria, notes,
-+		       status, priority, issue_type, assignee, estimated_minutes,
-+		       created_at, created_by, owner, updated_at, closed_at, external_ref,
-+		       compaction_level, compacted_at, compacted_at_commit, original_size, source_repo, close_reason,
-+		       deleted_at, deleted_by, delete_reason, original_type,
-+		       sender, ephemeral, pinned, is_template, crystallizes,
-+		       await_type, await_id, timeout_ns, waiters,
-+		       hook_bead, role_bead, agent_state, last_activity, role_type, rig, mol_type,
-+		       event_kind, actor, target, payload,
-+		       due_at, defer_until,
-+		       quality_score, work_type, source_system
-+		FROM issues
- 		%s
- 		ORDER BY priority ASC, created_at DESC
- 		%s
-@@ -225,7 +238,15 @@ func (s *DoltStore) SearchIssues(ctx context.Context, query string, filter types
- 	}
- 	defer rows.Close()
- 
--	return s.scanIssueIDs(ctx, rows)
-+	var issues []*types.Issue
-+	for rows.Next() {
-+		issue, err := scanIssueRow(rows)
-+		if err != nil {
-+			return nil, err
-+		}
-+		issues = append(issues, issue)
-+	}
-+	return issues, rows.Err()
- }
- 
- // GetReadyWork returns issues that are ready to work on (not blocked)

home/roles/development/default.nix

@@ -5,87 +5,25 @@ with lib;
 let
   cfg = config.home.roles.development;
 
-  # Build beads from flake input
+  # Build beads and gastown from flake inputs using shared package definitions
   beadsRev = builtins.substring 0 8 (globalInputs.beads.rev or "unknown");
-
-  beadsPackage = pkgs.unstable.buildGoModule {
-    pname = "beads";
-    version = "0.52.0-${beadsRev}";
+  beadsPackage = pkgs.callPackage ../../../packages/beads {
     src = globalInputs.beads;
-    subPackages = [ "cmd/bd" ];
-    doCheck = false;
-    vendorHash = "sha256-OL6QGf4xSMpEbmU+41pFdO0Rrs3H162T3pdiW9UfWR0=";
-    nativeBuildInputs = [ pkgs.git pkgs.pkg-config ];
-    buildInputs = [ pkgs.icu ];
-    meta = with lib; {
-      description = "beads (bd) - An issue tracker designed for AI-supervised coding workflows";
-      homepage = "https://github.com/steveyegge/beads";
-      license = licenses.mit;
-      mainProgram = "bd";
-    };
+    version = "0.52.0-${beadsRev}";
   };
 
-  # Gastown - multi-agent workspace manager
-  # Source is tracked via flake input for renovate updates
   gastownRev = builtins.substring 0 8 (globalInputs.gastown.rev or "unknown");
-  gastownPackage = pkgs.buildGoModule {
-    pname = "gastown";
-    version = "unstable-${gastownRev}";
+  gastownPackage = pkgs.callPackage ../../../packages/gastown {
     src = globalInputs.gastown;
-    vendorHash = "sha256-/+ODyndArUF0nJY9r8G5JKhzQckBHFb48A7EBZmoIr0=";
-    subPackages = [ "cmd/gt" ];
-    doCheck = false;
-
-    # Must match ldflags from gastown Makefile - BuiltProperly=1 is required
-    # or gt will error with "This binary was built with 'go build' directly"
-    ldflags = [
-      "-X github.com/steveyegge/gastown/internal/cmd.Version=${gastownRev}"
-      "-X github.com/steveyegge/gastown/internal/cmd.Commit=${gastownRev}"
-      "-X github.com/steveyegge/gastown/internal/cmd.BuildTime=nix-build"
-      "-X github.com/steveyegge/gastown/internal/cmd.BuiltProperly=1"
-    ];
-
-    # Bug fixes not yet merged upstream
-    # Each patch is stored in a separate file for clarity and maintainability
-    patches = [
-      # Fix validateRecipient bug: normalize addresses before comparison
-      ./gastown-fix-validate-recipient.patch
-      # Fix agentBeadToAddress to use title field for hq- prefixed beads
-      ./gastown-fix-agent-bead-address-title.patch
-      # town-root-detection fix merged upstream (detectRole removed)
-      # Statusline optimization: skip expensive beads queries for detached sessions
-      # Reduces Dolt CPU from ~70% to ~20% by caching and early-exit
-      ./gastown-statusline-optimization.patch
-    ];
-
-    meta = with lib; {
-      description = "Gas Town - multi-agent workspace manager by Steve Yegge";
-      homepage = "https://github.com/steveyegge/gastown";
-      license = licenses.mit;
-      mainProgram = "gt";
-    };
+    version = "unstable-${gastownRev}";
   };
 
-  # Perles - TUI for beads issue tracking (no upstream flake.nix yet)
-  # Source is tracked via flake input for renovate updates
+  # Build perles from flake input using shared package definition
   perlesRev = builtins.substring 0 8 (globalInputs.perles.rev or "unknown");
-  perlesPackage = pkgs.unstable.buildGoModule {
-    pname = "perles";
-    version = "unstable-${perlesRev}";
+  perlesPackage = pkgs.callPackage ../../../packages/perles {
+    inherit (pkgs.unstable) buildGoModule;
     src = globalInputs.perles;
-    vendorHash = "sha256-A5LE9Cor/DRcJtVpiScSoqDYhJIKyaq0cbK+OGmr4XU=";
-    doCheck = false;
-
-    ldflags = [
-      "-X main.version=${perlesRev}"
-    ];
-
-    meta = with lib; {
-      description = "Perles - Terminal UI for beads issue tracking";
-      homepage = "https://github.com/zjrosen/perles";
-      license = licenses.mit;
-      mainProgram = "perles";
-    };
+    version = "unstable-${perlesRev}";
   };
 
   # Fetch the claude-plugins repository (for humanlayer commands/agents)
@@ -132,7 +70,7 @@ in
       pkgs.unstable.claude-code
       pkgs.unstable.claude-code-router
       pkgs.unstable.codex
-      pkgs.dolt
+      pkgs.unstable.dolt
       pkgs.sqlite
 
       # Custom packages
@@ -146,6 +84,9 @@ in
       rm -f ~/.claude/commands/humanlayer:* 2>/dev/null || true
       rm -f ~/.claude/agents/humanlayer:* 2>/dev/null || true
 
+      # Remove explicitly blocked commands that may have been installed previously
+      rm -f ~/.claude/commands/humanlayer:create_handoff.md 2>/dev/null || true
+
       # Create directories if they don't exist
       mkdir -p ~/.claude/commands
       mkdir -p ~/.claude/agents
@@ -154,6 +95,12 @@ in
       for file in ${claudePluginsRepo}/humanlayer/commands/*.md; do
         if [ -f "$file" ]; then
           filename=$(basename "$file" .md)
+
+          # Skip blocked commands
+          case "$filename" in
+            create_handoff) continue ;;
+          esac
+
           dest="$HOME/.claude/commands/humanlayer:''${filename}.md"
           rm -f "$dest" 2>/dev/null || true
 

home/roles/development/gastown-fix-agent-bead-address-title.patch

@@ -1,15 +0,0 @@
-diff --git a/internal/mail/router.go b/internal/mail/router.go
---- a/internal/mail/router.go
-+++ b/internal/mail/router.go
-@@ -315,7 +315,10 @@ func agentBeadToAddress(bead *agentBead) string {
- 		}
-
- 		// For other hq- agents, fall back to description parsing
--		return parseAgentAddressFromDescription(bead.Description)
-+		if bead.Title != "" && strings.Contains(bead.Title, "/") {
-+			return bead.Title
-+		}
-+		return parseAgentAddressFromDescription(bead.Description)
- 	}
-
- 	// Handle gt- prefixed IDs (legacy format)

home/roles/development/gastown-fix-agent-bead-rig-prefix.patch

@@ -1,35 +0,0 @@
-diff --git a/internal/mail/router.go b/internal/mail/router.go
---- a/internal/mail/router.go
-+++ b/internal/mail/router.go
-@@ -330,8 +330,29 @@ func agentBeadToAddress(bead *agentBead) string {
- 	}
- 
- 	// Handle gt- prefixed IDs (legacy format)
--	if !strings.HasPrefix(id, "gt-") {
--		return "" // Not a valid agent bead ID
-+	// Handle rig-specific prefixes: <prefix>-<rig>-<role>-<name>
-+	// Examples: j-java-crew-americano -> java/crew/americano
-+	idParts := strings.Split(id, "-")
-+	if len(idParts) >= 3 {
-+		for i, part := range idParts {
-+			if part == "crew" || part == "polecat" || part == "polecats" {
-+				if i >= 1 && i < len(idParts)-1 {
-+					rig := idParts[i-1]
-+					name := strings.Join(idParts[i+1:], "-")
-+					return rig + "/" + part + "/" + name
-+				}
-+			}
-+			if part == "witness" || part == "refinery" {
-+				if i >= 1 {
-+					return idParts[i-1] + "/" + part
-+				}
-+			}
-+		}
-+	}
-+
-+	// Handle gt- prefixed IDs (legacy format)
-+	if !strings.HasPrefix(id, "gt-") {
-+		return "" // Not a valid agent bead ID
- 	}
- 
- 	// Strip prefix

home/roles/development/gastown-fix-copydir-symlinks.patch

@@ -1,25 +0,0 @@
-diff --git a/internal/git/git.go b/internal/git/git.go
---- a/internal/git/git.go
-+++ b/internal/git/git.go
-@@ -73,7 +73,19 @@ func copyDir(src, dest string) error {
- 		srcPath := filepath.Join(src, entry.Name())
- 		destPath := filepath.Join(dest, entry.Name())
- 
--		if entry.IsDir() {
-+		// Handle symlinks (recreate them, do not follow)
-+		if entry.Type()&os.ModeSymlink != 0 {
-+			linkTarget, err := os.Readlink(srcPath)
-+			if err != nil {
-+				return err
-+			}
-+			if err := os.Symlink(linkTarget, destPath); err != nil {
-+				return err
-+			}
-+			continue
-+		}
-+
-+		if entry.IsDir() {
- 			if err := copyDir(srcPath, destPath); err != nil {
- 				return err
- 			}
-

home/roles/development/gastown-fix-role-home-paths.patch

@@ -1,18 +0,0 @@
-diff --git a/internal/cmd/role.go b/internal/cmd/role.go
---- a/internal/cmd/role.go
-+++ b/internal/cmd/role.go
-@@ -326,11 +326,11 @@ func getRoleHome(role Role, rig, polecat, townRoot string) string {
- 		if rig == "" || polecat == "" {
- 			return ""
- 		}
--		return filepath.Join(townRoot, rig, "polecats", polecat, "rig")
-+		return filepath.Join(townRoot, rig, "polecats", polecat)
- 	case RoleCrew:
- 		if rig == "" || polecat == "" {
- 			return ""
- 		}
--		return filepath.Join(townRoot, rig, "crew", polecat, "rig")
-+		return filepath.Join(townRoot, rig, "crew", polecat)
- 	default:
- 		return ""
- 	}

home/roles/development/gastown-fix-town-root-detection.patch

@@ -1,18 +0,0 @@
-diff --git a/internal/cmd/prime.go b/internal/cmd/prime.go
---- a/internal/cmd/prime.go
-+++ b/internal/cmd/prime.go
-@@ -276,11 +276,12 @@ func detectRole(cwd, townRoot string) RoleInfo {
- 
- 	// Check for mayor role
- 	// At town root, or in mayor/ or mayor/rig/
- 	if relPath == "." || relPath == "" {
--		ctx.Role = RoleMayor
--		return ctx
-+		return ctx // RoleUnknown - town root is shared space
- 	}
-+
-+	// Check for mayor role: mayor/ or mayor/rig/
- 	if len(parts) >= 1 && parts[0] == "mayor" {
- 		ctx.Role = RoleMayor
- 		return ctx
- 	}

home/roles/development/gastown-fix-validate-recipient.patch

@@ -1,13 +0,0 @@
-diff --git a/internal/mail/router.go b/internal/mail/router.go
-index b864c069..4b6a045b 100644
---- a/internal/mail/router.go
-+++ b/internal/mail/router.go
-@@ -646,7 +646,7 @@ func (r *Router) validateRecipient(identity string) error {
- 	}
- 
- 	for _, agent := range agents {
--		if agentBeadToAddress(agent) == identity {
-+		if AddressToIdentity(agentBeadToAddress(agent)) == AddressToIdentity(identity) {
- 			return nil // Found matching agent
- 		}
- 	}

home/roles/development/gastown-statusline-optimization.patch

@@ -1,135 +0,0 @@
-diff --git a/internal/cmd/statusline.go b/internal/cmd/statusline.go
-index 2edf1be8..00253eea 100644
---- a/internal/cmd/statusline.go
-+++ b/internal/cmd/statusline.go
-@@ -6,6 +6,7 @@ import (
- 	"path/filepath"
- 	"sort"
- 	"strings"
-+	"time"
- 
- 	"github.com/spf13/cobra"
- 	"github.com/steveyegge/gastown/internal/beads"
-@@ -14,6 +15,37 @@ import (
- 	"github.com/steveyegge/gastown/internal/tmux"
- 	"github.com/steveyegge/gastown/internal/workspace"
- )
-+// statusLineCacheTTL is how long cached status output remains valid.
-+const statusLineCacheTTL = 10 * time.Second
-+
-+// statusLineCachePath returns the cache file path for a session.
-+func statusLineCachePath(session string) string {
-+	return filepath.Join(os.TempDir(), fmt.Sprintf("gt-status-%s", session))
-+}
-+
-+// getStatusLineCache returns cached status if fresh, empty string otherwise.
-+func getStatusLineCache(session string) string {
-+	path := statusLineCachePath(session)
-+	info, err := os.Stat(path)
-+	if err != nil {
-+		return ""
-+	}
-+	if time.Since(info.ModTime()) > statusLineCacheTTL {
-+		return ""
-+	}
-+	data, err := os.ReadFile(path)
-+	if err != nil {
-+		return ""
-+	}
-+	return string(data)
-+}
-+
-+// setStatusLineCache writes status to cache file.
-+func setStatusLineCache(session, status string) {
-+	path := statusLineCachePath(session)
-+	_ = os.WriteFile(path, []byte(status), 0644)
-+}
-+
- 
- var (
- 	statusLineSession string
-@@ -34,6 +66,19 @@ func init() {
- func runStatusLine(cmd *cobra.Command, args []string) error {
- 	t := tmux.NewTmux()
- 
-+	// Optimization: skip expensive beads queries for detached sessions
-+	if statusLineSession != "" {
-+		if !t.IsSessionAttached(statusLineSession) {
-+			fmt.Print("○ |")
-+			return nil
-+		}
-+		// Check cache for attached sessions too
-+		if cached := getStatusLineCache(statusLineSession); cached != "" {
-+			fmt.Print(cached)
-+			return nil
-+		}
-+	}
-+
- 	// Get session environment
- 	var rigName, polecat, crew, issue, role string
- 
-@@ -150,7 +195,11 @@ func runWorkerStatusLine(t *tmux.Tmux, session, rigName, polecat, crew, issue st
- 
- 	// Output
- 	if len(parts) > 0 {
--		fmt.Print(strings.Join(parts, " | ") + " |")
-+		output := strings.Join(parts, " | ") + " |"
-+		if statusLineSession != "" {
-+			setStatusLineCache(statusLineSession, output)
-+		}
-+		fmt.Print(output)
- 	}
- 
- 	return nil
-@@ -389,7 +438,11 @@ func runMayorStatusLine(t *tmux.Tmux) error {
- 		}
- 	}
- 
--	fmt.Print(strings.Join(parts, " | ") + " |")
-+	output := strings.Join(parts, " | ") + " |"
-+	if statusLineSession != "" {
-+		setStatusLineCache(statusLineSession, output)
-+	}
-+	fmt.Print(output)
- 	return nil
- }
- 
-@@ -458,7 +511,11 @@ func runDeaconStatusLine(t *tmux.Tmux) error {
- 		}
- 	}
- 
--	fmt.Print(strings.Join(parts, " | ") + " |")
-+	output := strings.Join(parts, " | ") + " |"
-+	if statusLineSession != "" {
-+		setStatusLineCache(statusLineSession, output)
-+	}
-+	fmt.Print(output)
- 	return nil
- }
- 
-@@ -526,7 +583,11 @@ func runWitnessStatusLine(t *tmux.Tmux, rigName string) error {
- 		}
- 	}
- 
--	fmt.Print(strings.Join(parts, " | ") + " |")
-+	output := strings.Join(parts, " | ") + " |"
-+	if statusLineSession != "" {
-+		setStatusLineCache(statusLineSession, output)
-+	}
-+	fmt.Print(output)
- 	return nil
- }
- 
-@@ -617,7 +678,11 @@ func runRefineryStatusLine(t *tmux.Tmux, rigName string) error {
- 		}
- 	}
- 
--	fmt.Print(strings.Join(parts, " | ") + " |")
-+	output := strings.Join(parts, " | ") + " |"
-+	if statusLineSession != "" {
-+		setStatusLineCache(statusLineSession, output)
-+	}
-+	fmt.Print(output)
- 	return nil
- }
- 

machines/nix-book/configuration.nix

@@ -42,6 +42,20 @@
       enable = true;
       waydroid = true;
     };
+    wireguard = {
+      enable = true;
+      autostart = true;
+      interfaceName = "ogleNet";
+      address = [ "192.168.4.2/32" ];
+      privateKeyFile = "/etc/wireguard/oglehome-private-key";
+      dns = [ "192.168.4.1" ];
+      peers = [{
+        publicKey = "AWkmtaz0poyyKJGnRcabO5ecd6ESh1lKu+XRb3ObxBc=";
+        endpoint = "pi.johnogle.info:6666";
+        allowedIPs = [ "0.0.0.0/0" ];
+        persistentKeepalive = 25;
+      }];
+    };
   };
 
   # Bootloader.
@@ -61,13 +75,6 @@
   # Enable networking
   networking.networkmanager.enable = true;
 
-  # WireGuard setup
-  networking.wg-quick.interfaces = {
-    ogleNet = {
-      configFile = "/root/Oglehome-VPN-johno-nixbook.conf";
-    };
-  };
-
   hardware.graphics = {
     enable = true;
     extraPackages = with pkgs; [

packages/beads/default.nix

@@ -14,7 +14,7 @@ buildGoModule {
   inherit version src;
   subPackages = [ "cmd/bd" ];
   doCheck = false;
-  vendorHash = "sha256-OL6QGf4xSMpEbmU+41pFdO0Rrs3H162T3pdiW9UfWR0=";
+  vendorHash = "sha256-XAhe4yuLzP9vQ3IFhWAO5fN/3OOfokcRxfeGKaRYEws=";
   nativeBuildInputs = [ git pkg-config ];
   buildInputs = [ icu ];
   meta = with lib; {

packages/claude-code/default.nix

@@ -6,24 +6,24 @@
 }:
 
 let
-  version = "2.1.69";
+  version = "2.1.75";
 
   srcs = {
     aarch64-darwin = {
       url = "https://storage.googleapis.com/claude-code-dist-86c565f3-f756-42ad-8dfa-d59b1c096819/claude-code-releases/${version}/darwin-arm64/claude";
-      sha256 = "a86e14f44b167c1e8dbf764f76755b92ecf52c097d732a3461fe65b5fb60be05";
+      sha256 = "8c541a5e924eda2070eaf1702a48047af671c4dff6a11a5e762076614a082675";
     };
     x86_64-darwin = {
       url = "https://storage.googleapis.com/claude-code-dist-86c565f3-f756-42ad-8dfa-d59b1c096819/claude-code-releases/${version}/darwin-x64/claude";
-      sha256 = "e5987b4dd502a6542bf86c3c0bcd1d533b774616fc7d49566ce0b2040e6c1374";
+      sha256 = "82c90b91a0a18f60191f817b9b42304d8b17dbed75795b715c41f4fdfe4c782d";
     };
     x86_64-linux = {
       url = "https://storage.googleapis.com/claude-code-dist-86c565f3-f756-42ad-8dfa-d59b1c096819/claude-code-releases/${version}/linux-x64/claude";
-      sha256 = "b3bdbd5a3cbf8caafe353022170df77fefa80b00003074d4d27e7da8c59e629a";
+      sha256 = "328b0a429c05a04f911157d886be5123cf1824a19ba8ca1f9d594c004eac32c9";
     };
     aarch64-linux = {
       url = "https://storage.googleapis.com/claude-code-dist-86c565f3-f756-42ad-8dfa-d59b1c096819/claude-code-releases/${version}/linux-arm64/claude";
-      sha256 = "ecc7bbf10513ff122327866eb97212945b73afd7f81e30700375cdf10f50b2a3";
+      sha256 = "ec8f4f7f7bb50611dae70c109a76ee1da6a3ab45511c65f117df215848ecc905";
     };
   };
 

packages/gastown/default.nix

@@ -9,7 +9,7 @@
 buildGoModule {
   pname = "gastown";
   inherit version src;
-  vendorHash = "sha256-/+ODyndArUF0nJY9r8G5JKhzQckBHFb48A7EBZmoIr0=";
+  vendorHash = "sha256-8SdvSASP+bJjMooqEQvkCzG+J6CbsK+HCQulrPnJZ1Y=";
   subPackages = [ "cmd/gt" ];
   doCheck = false;
 
@@ -22,13 +22,6 @@ buildGoModule {
     "-X github.com/steveyegge/gastown/internal/cmd.BuiltProperly=1"
   ];
 
-  # Bug fixes not yet merged upstream
-  patches = [
-    ./gastown-fix-validate-recipient.patch
-    ./gastown-fix-agent-bead-address-title.patch
-    ./gastown-statusline-optimization.patch
-  ];
-
   meta = with lib; {
     description = "Gas Town - multi-agent workspace manager by Steve Yegge";
     homepage = "https://github.com/steveyegge/gastown";

packages/gastown/gastown-fix-agent-bead-address-title.patch

@@ -1,15 +0,0 @@
-diff --git a/internal/mail/router.go b/internal/mail/router.go
---- a/internal/mail/router.go
-+++ b/internal/mail/router.go
-@@ -315,7 +315,10 @@ func agentBeadToAddress(bead *agentBead) string {
- 		}
-
- 		// For other hq- agents, fall back to description parsing
--		return parseAgentAddressFromDescription(bead.Description)
-+		if bead.Title != "" && strings.Contains(bead.Title, "/") {
-+			return bead.Title
-+		}
-+		return parseAgentAddressFromDescription(bead.Description)
- 	}
-
- 	// Handle gt- prefixed IDs (legacy format)

packages/gastown/gastown-fix-validate-recipient.patch

@@ -1,13 +0,0 @@
-diff --git a/internal/mail/router.go b/internal/mail/router.go
-index b864c069..4b6a045b 100644
---- a/internal/mail/router.go
-+++ b/internal/mail/router.go
-@@ -646,7 +646,7 @@ func (r *Router) validateRecipient(identity string) error {
- 	}
- 
- 	for _, agent := range agents {
--		if agentBeadToAddress(agent) == identity {
-+		if AddressToIdentity(agentBeadToAddress(agent)) == AddressToIdentity(identity) {
- 			return nil // Found matching agent
- 		}
- 	}

packages/gastown/gastown-statusline-optimization.patch

@@ -1,135 +0,0 @@
-diff --git a/internal/cmd/statusline.go b/internal/cmd/statusline.go
-index 2edf1be8..00253eea 100644
---- a/internal/cmd/statusline.go
-+++ b/internal/cmd/statusline.go
-@@ -6,6 +6,7 @@ import (
- 	"path/filepath"
- 	"sort"
- 	"strings"
-+	"time"
- 
- 	"github.com/spf13/cobra"
- 	"github.com/steveyegge/gastown/internal/beads"
-@@ -14,6 +15,37 @@ import (
- 	"github.com/steveyegge/gastown/internal/tmux"
- 	"github.com/steveyegge/gastown/internal/workspace"
- )
-+// statusLineCacheTTL is how long cached status output remains valid.
-+const statusLineCacheTTL = 10 * time.Second
-+
-+// statusLineCachePath returns the cache file path for a session.
-+func statusLineCachePath(session string) string {
-+	return filepath.Join(os.TempDir(), fmt.Sprintf("gt-status-%s", session))
-+}
-+
-+// getStatusLineCache returns cached status if fresh, empty string otherwise.
-+func getStatusLineCache(session string) string {
-+	path := statusLineCachePath(session)
-+	info, err := os.Stat(path)
-+	if err != nil {
-+		return ""
-+	}
-+	if time.Since(info.ModTime()) > statusLineCacheTTL {
-+		return ""
-+	}
-+	data, err := os.ReadFile(path)
-+	if err != nil {
-+		return ""
-+	}
-+	return string(data)
-+}
-+
-+// setStatusLineCache writes status to cache file.
-+func setStatusLineCache(session, status string) {
-+	path := statusLineCachePath(session)
-+	_ = os.WriteFile(path, []byte(status), 0644)
-+}
-+
- 
- var (
- 	statusLineSession string
-@@ -34,6 +66,19 @@ func init() {
- func runStatusLine(cmd *cobra.Command, args []string) error {
- 	t := tmux.NewTmux()
- 
-+	// Optimization: skip expensive beads queries for detached sessions
-+	if statusLineSession != "" {
-+		if !t.IsSessionAttached(statusLineSession) {
-+			fmt.Print("○ |")
-+			return nil
-+		}
-+		// Check cache for attached sessions too
-+		if cached := getStatusLineCache(statusLineSession); cached != "" {
-+			fmt.Print(cached)
-+			return nil
-+		}
-+	}
-+
- 	// Get session environment
- 	var rigName, polecat, crew, issue, role string
- 
-@@ -150,7 +195,11 @@ func runWorkerStatusLine(t *tmux.Tmux, session, rigName, polecat, crew, issue st
- 
- 	// Output
- 	if len(parts) > 0 {
--		fmt.Print(strings.Join(parts, " | ") + " |")
-+		output := strings.Join(parts, " | ") + " |"
-+		if statusLineSession != "" {
-+			setStatusLineCache(statusLineSession, output)
-+		}
-+		fmt.Print(output)
- 	}
- 
- 	return nil
-@@ -389,7 +438,11 @@ func runMayorStatusLine(t *tmux.Tmux) error {
- 		}
- 	}
- 
--	fmt.Print(strings.Join(parts, " | ") + " |")
-+	output := strings.Join(parts, " | ") + " |"
-+	if statusLineSession != "" {
-+		setStatusLineCache(statusLineSession, output)
-+	}
-+	fmt.Print(output)
- 	return nil
- }
- 
-@@ -458,7 +511,11 @@ func runDeaconStatusLine(t *tmux.Tmux) error {
- 		}
- 	}
- 
--	fmt.Print(strings.Join(parts, " | ") + " |")
-+	output := strings.Join(parts, " | ") + " |"
-+	if statusLineSession != "" {
-+		setStatusLineCache(statusLineSession, output)
-+	}
-+	fmt.Print(output)
- 	return nil
- }
- 
-@@ -526,7 +583,11 @@ func runWitnessStatusLine(t *tmux.Tmux, rigName string) error {
- 		}
- 	}
- 
--	fmt.Print(strings.Join(parts, " | ") + " |")
-+	output := strings.Join(parts, " | ") + " |"
-+	if statusLineSession != "" {
-+		setStatusLineCache(statusLineSession, output)
-+	}
-+	fmt.Print(output)
- 	return nil
- }
- 
-@@ -617,7 +678,11 @@ func runRefineryStatusLine(t *tmux.Tmux, rigName string) error {
- 		}
- 	}
- 
--	fmt.Print(strings.Join(parts, " | ") + " |")
-+	output := strings.Join(parts, " | ") + " |"
-+	if statusLineSession != "" {
-+		setStatusLineCache(statusLineSession, output)
-+	}
-+	fmt.Print(output)
- 	return nil
- }
- 

packages/perles/default.nix

@@ -0,0 +1,25 @@
+# Perles - Terminal UI for beads issue tracking
+# Takes src as argument so it can be called from both overlay and flake packages
+{ lib
+, buildGoModule
+, src
+, version ? "unknown"
+}:
+
+buildGoModule {
+  pname = "perles";
+  inherit version src;
+  doCheck = false;
+  vendorHash = "sha256-A5LE9Cor/DRcJtVpiScSoqDYhJIKyaq0cbK+OGmr4XU=";
+
+  ldflags = [
+    "-X main.version=${version}"
+  ];
+
+  meta = with lib; {
+    description = "Perles - Terminal UI for beads issue tracking";
+    homepage = "https://github.com/zjrosen/perles";
+    license = licenses.mit;
+    mainProgram = "perles";
+  };
+}

renovate.json

@@ -13,7 +13,7 @@
   "lockFileMaintenance": {
     "enabled": true,
     "schedule": [
-      "after 2pm and before 4pm on Saturday"
+      "after 5pm and before 7pm on Saturday"
     ]
   },
   "dependencyDashboard": true,
@@ -39,7 +39,7 @@
         "/^nix-darwin$/"
       ],
       "schedule": [
-        "after 2pm and before 4pm on Saturday"
+        "after 5pm and before 7pm on Saturday"
       ]
     },
     {
@@ -53,7 +53,7 @@
         "/home-manager-unstable/"
       ],
       "schedule": [
-        "after 2pm and before 4pm on Saturday"
+        "after 5pm and before 7pm on Saturday"
       ]
     },
     {
@@ -65,7 +65,7 @@
         "/nixpkgs-qt/"
       ],
       "schedule": [
-        "after 4pm and before 6pm on Saturday"
+        "after 7pm and before 9pm on Saturday"
       ]
     },
     {

roles/default.nix

@@ -19,6 +19,7 @@ with lib;
     ./spotifyd
     ./users
     ./virtualisation
+    ./wireguard
   ];
 
   config = {

roles/wireguard/default.nix

@@ -0,0 +1,71 @@
+{ config, lib, ... }:
+
+with lib;
+
+let
+  cfg = config.roles.wireguard;
+in
+{
+  options.roles.wireguard = {
+    enable = mkEnableOption "Enable WireGuard VPN";
+    interfaceName = mkOption {
+      type = types.str;
+      default = "wg0";
+      description = "Name of the WireGuard interface";
+    };
+    address = mkOption {
+      type = types.listOf types.str;
+      description = "Address(es) for the WireGuard interface";
+    };
+    privateKeyFile = mkOption {
+      type = types.path;
+      description = "Path to a root-owned file containing the WireGuard private key";
+    };
+    dns = mkOption {
+      type = types.listOf types.str;
+      default = [];
+      description = "DNS servers to use when the tunnel is active";
+    };
+    peers = mkOption {
+      type = types.listOf (types.submodule {
+        options = {
+          publicKey = mkOption {
+            type = types.str;
+            description = "Public key of the peer";
+          };
+          endpoint = mkOption {
+            type = types.str;
+            description = "Endpoint address of the peer (host:port)";
+          };
+          allowedIPs = mkOption {
+            type = types.listOf types.str;
+            description = "List of allowed IP ranges for this peer";
+          };
+          persistentKeepalive = mkOption {
+            type = types.int;
+            default = 25;
+            description = "Persistent keepalive interval in seconds";
+          };
+        };
+      });
+      description = "WireGuard peers";
+    };
+    autostart = mkOption {
+      type = types.bool;
+      default = false;
+      description = "Whether to start the VPN automatically on boot";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    networking.wg-quick.interfaces.${cfg.interfaceName} = {
+      inherit (cfg) address dns autostart peers;
+      privateKeyFile = cfg.privateKeyFile;
+    };
+
+    systemd.services."wg-quick-${cfg.interfaceName}" = {
+      after = [ "network-online.target" ];
+      wants = [ "network-online.target" ];
+    };
+  };
+}