prototype copyparty reverse proxy config

This reverts commit 7bc0d0772c.

.sops.yaml

@@ -7,6 +7,7 @@ keys:
   - &admin age1m0pk94ysjlw3lmf6pyuv5l5pepvdjss8w0vxjv90dq6ndp02tdgsdwdvue
   # Generated on the machine it names.
   - &neogaia age14a04vphzjq74epfrz9a09wjw8lzchtru84awzuq2n45d8f42ychqjs89qe
+  - &pikachu age1wf5s0n0tgt6ld2ysgu9dc67mj8ylwecgl4utzg7hqwy3kut9zyms7aglmh
 
 creation_rules:
   # Material belonging to one machine.
@@ -18,9 +19,16 @@ creation_rules:
           - *admin
           - *neogaia
 
+  - path_regex: secrets/pikachu\.yaml$
+    key_groups:
+      - age:
+          - *admin
+          - *pikachu
+
   # Material common to every machine, so it is stored once rather than per host.
   - path_regex: secrets/shared\.yaml$
     key_groups:
       - age:
           - *admin
           - *neogaia
+          - *pikachu

AGENTS.md

@@ -18,6 +18,17 @@ The domain model (Host, Module, Skeleton, Auto-loader, Enable convention, overla
 
 ## Gotchas
 
+- Guest modules are host-agnostic wiring, while host files own deployment-specific service configuration such as served volumes and host paths.
+  For example, `guests/copyparty.nix` should expose options and translate them into guest mounts/service settings, while `hosts/pikachu/default.nix` chooses `/inbox`, `/media`, and their backing paths.
+- `sops.secrets.<name>.owner` must name a user known on the decrypting host.
+  For guest-only service users, do not set the owner to the guest uid unless the host also declares that user.
+  Use a host-visible owner plus a shared group mode when an identity-mapped guest service can read through its group.
+- Actual Budget's NixOS service runs `actual-server` with `WorkingDirectory = services.actual.settings.dataDir`, and the `actual-server` CLI wrapper sets `ACTUAL_CONFIG_PATH=./config.json` when that current directory contains `config.json`, overriding the NixOS module's generated config path before the server loads configuration.
+  When migrating old community-script state to the normal upstream `/data` shape, move or rewrite a copied `/data/config.json` so it cannot shadow the declarative module settings.
+- Subagent completion delivery is non-blocking through immediate spawn, milestone notifications, retained terminal entries, and `subagent_list` or `subagent_result` retrieval.
+  `subagent_wait` intentionally blocks the parent tool call until its condition or timeout, so do not use it merely to keep background work alive during an interactive workflow.
+- Nixvim's flake input following the root nixpkgs source does not make its Home Manager module reuse the host's `pkgs` instance.
+  Keep `programs.nixvim.nixpkgs.useGlobalPackages = true` so Nixvim uses the shared package set without warning that its source default was affected.
 - This host has no `python` or `python3` command on its ordinary `PATH`.
   For ad hoc Python, use Nix explicitly, such as `nix shell nixpkgs#python3 -c python3 <script>`.
 - ADR bodies are immutable records of decisions as they were made, while frontmatter is mutable.
@@ -34,8 +45,8 @@ The domain model (Host, Module, Skeleton, Auto-loader, Enable convention, overla
   It is deployed on `neogaia` and verified: a commit in a repository outside this checkout is authored `alexion <contact@alexion.dev>` with no override.
   Verify it that way rather than from this checkout, whose `.git/config` carries the same identity and would mask a broken module.
   `~/.gitconfig` (a second global file that outranks the flake-managed `~/.config/git/config`) currently holds only a `tea` credential helper and no `user.*`, so it does not shadow the identity, but it is undeclared and will not survive a reimage.
-- The primary build/verify seam for any Host is `nix flake check`, which builds `checks.x86_64-linux.<host>` (the system toplevel).
-  Cheap targeted checks use `nix eval .#nixosConfigurations.<host>.config...`.
+- The primary build/verify seam is `nix flake check`, which builds project-level checks plus `checks.x86_64-linux.<host>` system toplevels.
+  Cheap targeted host checks use `nix eval .#nixosConfigurations.<host>.config...`.
 - chaotic-nyx must **not** follow our `nixpkgs`, and its packages are built against chaotic's own pinned nixpkgs (its overlay defaults to `onTopOf = "flake-nixpkgs"`, the cache-friendly path).
   That is what lets the `nyx-cache.chaotic.cx` binary cache hit instead of compiling the CachyOS kernel from source.
   The tradeoff is that chaotic packages do not see our `unstable`/`stable` overlays.
@@ -72,13 +83,21 @@ The domain model (Host, Module, Skeleton, Auto-loader, Enable convention, overla
 - `home.sessionVariables` do **not** reach the Hyprland session, since UWSM does not source `hm-session-vars.sh`.
   The cursor is therefore set through Hyprland's own `env = KEY,VALUE` in `modules/desktop/hyprland/hyprland.nix`, sourced from `config.stylix.cursor`.
   Bibata ships XCursor format only (no `hyprcursor/` dir), rendered through Hyprland's XCursor fallback, so `XCURSOR_*` and `HYPRCURSOR_*` naming the same theme are both safe.
-- `neogaia`, the repo's only host, is a wifi laptop with a btrfs root and no ZFS pools, so it cannot honestly carry `modules.network`, `modules.zfs`, or a networked/pool-mounted guest.
+- `neogaia` is a wifi laptop with a btrfs root and no ZFS pools, so it cannot honestly carry `modules.network`, `modules.zfs`, or a networked/pool-mounted guest.
   Enabling networkd takes over its DNS, its CachyOS `zfs-kernel` build is marked broken, and it has no bridge or pool to attach to.
   Verify these against it ad hoc through `nixosConfigurations.neogaia.extendModules` (forcing a ZFS-capable `boot.kernelPackages` for the zfs case) plus `nix eval` of the derived values, never by committing the enablement.
-  A committed guest therefore leaves `vlan`, `mounts`, and `secrets` unset, and the standing enablement waits for the first wired server host with real storage.
+  Committed networked and pool-mounted guests belong on a wired storage host such as `pikachu`, not on `neogaia`.
 - Herdr key names for shifted punctuation are not interchangeable with the physical base key plus `shift`.
   The tab rename binding must use the produced literal, such as `prefix+<`, rather than `prefix+shift+comma`.
 - Flake-managed Pi extension, prompt, and skill directories may still be written directly for throwaway development or local experiments.
   The risk is that a later Home Manager activation can overwrite or hide those unmanaged files, so finished work must be promoted into the dotfiles module before it counts as deployed.
 - Pi's tool discovery checks `~/.pi/agent/bin` before `PATH`, and downloaded generic Linux binaries there can be unusable on NixOS with the stub-ld error.
-  A copied or patched Pi launcher that only prepends Nix `fd`/`rg` to `PATH` may still break `@` autocomplete unless the local tool path is removed or Pi validates the local binary before using it.
+  This flake patches Pi to validate local tool binaries before selecting them, so it falls back to usable `fd`/`rg` from `PATH` instead.
+  Stale unpatched launchers are the remaining failure mode for broken `@` autocomplete.
+- Nix flake evaluation ignores untracked files in this checkout.
+  Keep a new auto-loaded module staged or committed until it is removed, otherwise `nix flake check` and `nixos-rebuild --flake` evaluate without it and report its options as missing.
+- The current Steam desktop client is an XWayland application.
+  Its CEF windows do not support Ozone and Steam composites them into an SDL surface with X11 extensions, so SDL Wayland selectors do not make the visible client native Wayland.
+  Keep fractional scaling sharp with Hyprland's `xwayland.force_zero_scaling` and Steam's own `STEAM_FORCE_DESKTOPUI_SCALING` instead.
+- AdGuard's LAN wildcard rewrite for `*.alexion.dev` points names at the reverse-proxy guest, including non-HTTP ports.
+  Keep `git.alexion.dev:2022` working by proxying that TCP stream through the reverse-proxy guest to Gitea.

base.nix

@@ -59,7 +59,10 @@ in
     users.users.${user.name} = {
       isNormalUser = true;
       description = user.description;
-      extraGroups = [ "wheel" ];
+      extraGroups = [
+        "wheel"
+        "storage"
+      ];
     };
 
     # The shared write group.

flake.lock

@@ -562,11 +562,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1785600727,
-        "narHash": "sha256-7Bbj3C+1jyf+YXvUiovCa5t/aCk7BodNf4kV4aZ1Hpw=",
+        "lastModified": 1785695024,
+        "narHash": "sha256-DLLk6X5zu3cRT50p18uHVdwjGVtiS0t/661M34q02zU=",
         "ref": "refs/heads/main",
-        "rev": "346413cd7de5e7d03baea09eb935409cfe6eeaa9",
-        "revCount": 49,
+        "rev": "9b2a6bcd583d7d6bf7e5377c3632f601692df209",
+        "revCount": 54,
         "type": "git",
         "url": "https://git.alexion.dev/alexion/skills"
       },

flake.nix

@@ -76,7 +76,7 @@
     { self, nixpkgs, ... }@inputs:
     let
       inherit (nixpkgs) lib;
-      my = import ./lib.nix { inherit lib inputs self; };
+      my = import ./lib { inherit lib inputs self; };
     in
     {
       # Helper functions for discovering and building hosts.
@@ -98,9 +98,111 @@
           ];
         };
 
-      # `nix flake check` builds each host's toplevel.
-      checks.x86_64-linux = lib.mapAttrs (
-        _name: host: host.config.system.build.toplevel
-      ) self.nixosConfigurations;
+      # `nix flake check` builds host toplevels and project-level checks.
+      checks.x86_64-linux =
+        let
+          pkgs = nixpkgs.legacyPackages.x86_64-linux;
+          serviceIdentities = import ./lib/service-identities.nix { inherit lib; };
+          serviceIdentityTestsPass = lib.all (result: result) (lib.attrValues serviceIdentities.tests);
+        in
+        (lib.mapAttrs (
+          name: host:
+          if host.config.warnings == [] then
+            host.config.system.build.toplevel
+          else
+            throw "Host ${name} has evaluation warnings:\n${lib.concatStringsSep "\n" host.config.warnings}"
+        ) self.nixosConfigurations)
+        // {
+          service-identities = pkgs.runCommand "service-identities-check" { } ''
+            ${lib.optionalString (!serviceIdentityTestsPass) "exit 1"}
+            touch $out
+          '';
+
+          reverse-proxy-basic-route =
+            let
+              testConfig =
+                (lib.nixosSystem {
+                  system = "x86_64-linux";
+                  specialArgs.my = self.lib;
+                  modules = [
+                    ./modules/reverse-proxy.nix
+                    {
+                      modules.reverse-proxy = {
+                        enable = true;
+                        routes."budget.alexion.dev" = {
+                          path = "/";
+                          backend = "http://10.23.20.42:5006";
+                        };
+                      };
+                    }
+                  ];
+                }).config;
+              vhost = testConfig.services.nginx.virtualHosts."budget.alexion.dev";
+            in
+            pkgs.runCommand "reverse-proxy-basic-route-check" { } ''
+              ${
+                lib.optionalString (
+                  !(vhost.forceSSL && vhost.enableACME && vhost.locations."/".proxyPass == "http://10.23.20.42:5006")
+                ) "exit 1"
+              }
+              touch $out
+            '';
+
+          reverse-proxy-actualbudget-guest-route =
+            let
+              testConfig =
+                (self.nixosConfigurations.pikachu.extendModules {
+                  modules = [
+                    {
+                      guests.actualbudget.reverseProxy = {
+                        enable = true;
+                        host = "budget.alexion.dev";
+                        backend = "http://10.23.20.42:5006";
+                      };
+                    }
+                  ];
+                }).config;
+              route = testConfig.modules.reverse-proxy.routes.actualbudget;
+            in
+            pkgs.runCommand "reverse-proxy-actualbudget-guest-route-check" { } ''
+              ${
+                lib.optionalString (
+                  !(route.host == "budget.alexion.dev" && route.backend == "http://10.23.20.42:5006")
+                ) "exit 1"
+              }
+              touch $out
+            '';
+
+          reverse-proxy-secondary-path-requires-root =
+            let
+              testConfig =
+                (lib.nixosSystem {
+                  system = "x86_64-linux";
+                  specialArgs.my = self.lib;
+                  modules = [
+                    ./modules/reverse-proxy.nix
+                    {
+                      modules.reverse-proxy = {
+                        enable = true;
+                        routes.raichu-files = {
+                          host = "files.alexion.dev";
+                          path = "/raichu";
+                          backend = "http://10.23.20.10:3923";
+                        };
+                      };
+                    }
+                  ];
+                }).config;
+              hasFailedRootAssertion = lib.any (
+                assertion:
+                assertion.assertion == false
+                && assertion.message == "modules.reverse-proxy.routes for files.alexion.dev must include a primary / route."
+              ) testConfig.assertions;
+            in
+            pkgs.runCommand "reverse-proxy-secondary-path-requires-root-check" { } ''
+              ${lib.optionalString (!hasFailedRootAssertion) "exit 1"}
+              touch $out
+            '';
+        };
     };
 }

guests/actualbudget.nix

@@ -0,0 +1,50 @@
+{
+  config,
+  lib,
+  my,
+  ...
+}:
+let
+  cfg = config.guests.actualbudget;
+  dataDir = "/data";
+in
+{
+  imports = [
+    (my.guest {
+      name = "actualbudget";
+      interior = {
+        modules.services.actualbudget = {
+          enable = true;
+          inherit dataDir;
+        };
+      };
+    })
+  ];
+
+  options.guests.actualbudget = {
+    dataPath = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = null;
+      example = "/srv/actualbudget";
+      description = "Host path bind-mounted as Actual Budget's data directory.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = cfg.dataPath != null;
+        message = "guests.actualbudget.dataPath must point at the host directory that stores Actual Budget data.";
+      }
+    ];
+
+    guests.actualbudget = {
+      mounts.${dataDir}.hostPath = cfg.dataPath;
+      limits = {
+        memory = lib.mkDefault "2G";
+        cpu = lib.mkDefault "200%";
+        tasksMax = lib.mkDefault 512;
+      };
+    };
+  };
+}

guests/copyparty.nix

@@ -0,0 +1,136 @@
+{
+  config,
+  lib,
+  my,
+  ...
+}:
+let
+  cfg = config.guests.copyparty;
+  serviceUid = my.serviceUid "copyparty";
+
+  volumeType = lib.types.submodule {
+    options = {
+      hostPath = lib.mkOption {
+        type = lib.types.str;
+        description = "Host path bind-mounted into the Copyparty guest for this volume.";
+      };
+
+      path = lib.mkOption {
+        type = lib.types.str;
+        description = "Guest path served by this Copyparty volume.";
+      };
+
+      access = lib.mkOption {
+        type = lib.types.attrsOf (lib.types.listOf lib.types.str);
+        default = { };
+        description = "Copyparty access map from permission string to account names.";
+      };
+
+      flags = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        default = [ ];
+        description = "Copyparty volume flags.";
+      };
+    };
+  };
+in
+{
+  imports = [
+    (my.guest {
+      name = "copyparty";
+      interior = {
+        modules.services.copyparty = {
+          enable = true;
+          inherit (cfg) accountName stateDir;
+          passwordFile = "/run/secrets/${cfg.passwordSecret}";
+          reverseProxy = {
+            enable = cfg.reverseProxy.enable;
+            inherit (cfg.reverseProxy) trustedSources;
+          };
+          volumes = lib.mapAttrs (_urlPath: volume: {
+            inherit (volume) path access flags;
+          }) cfg.volumes;
+        };
+      };
+    })
+  ];
+
+  options.guests.copyparty = {
+    accountName = lib.mkOption {
+      type = lib.types.str;
+      default = "alexion";
+      description = "Copyparty account name configured for password authentication.";
+    };
+
+    passwordSecret = lib.mkOption {
+      type = lib.types.str;
+      default = "services/copyparty/users/alexion/password";
+      description = "SOPS secret name containing the Copyparty account password.";
+    };
+
+    stateDir = lib.mkOption {
+      type = lib.types.str;
+      default = "/var/lib/copyparty";
+      description = "Guest path where Copyparty stores service state.";
+    };
+
+    statePath = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = null;
+      example = "/srv/copyparty";
+      description = "Host path bind-mounted as Copyparty's state directory.";
+    };
+
+    reverseProxy.trustedSources = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+      description = "IP ranges that may supply Copyparty's forwarded client IP header.";
+    };
+
+    volumes = lib.mkOption {
+      type = lib.types.attrsOf volumeType;
+      default = { };
+      description = "Copyparty volumes keyed by their URL path.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = cfg.statePath != null;
+        message = "guests.copyparty.statePath must point at the host directory that stores Copyparty state.";
+      }
+      {
+        assertion = cfg.volumes != { };
+        message = "guests.copyparty.volumes must declare the host's served Copyparty volumes.";
+      }
+    ];
+
+    guests.copyparty = {
+      secrets = [ cfg.passwordSecret ];
+      mounts =
+        {
+          ${cfg.stateDir} = {
+            hostPath = cfg.statePath;
+            create = {
+              owner = serviceUid;
+              group = "storage";
+              mode = "0770";
+            };
+          };
+        }
+        // lib.mapAttrs' (_urlPath: volume: lib.nameValuePair volume.path { inherit (volume) hostPath; }) cfg.volumes;
+      limits = {
+        memory = lib.mkDefault "2G";
+        cpu = lib.mkDefault "200%";
+        tasksMax = lib.mkDefault 512;
+      };
+    };
+
+    sops.secrets.${cfg.passwordSecret} = {
+      owner = "root";
+      group = "storage";
+      mode = "0440";
+    };
+  };
+}

guests/reverse-proxy.nix

@@ -0,0 +1,61 @@
+{
+  config,
+  lib,
+  my,
+  ...
+}:
+let
+  giteaSshBackend = "10.23.20.45:2022";
+  legacyBackend = "http://10.23.20.32";
+  legacyHosts = [
+    "games.alexion.dev"
+    "git.alexion.dev"
+    "music.alexion.dev"
+    "photos.alexion.dev"
+    "plex.alexion.dev"
+    "servers.alexion.dev"
+    "todo.alexion.dev"
+    "wings.alexion.dev"
+  ];
+  legacyRoutes = lib.listToAttrs (
+    map (host: {
+      name = "legacy-${lib.replaceStrings [ "." ] [ "-" ] host}";
+      value = {
+        inherit host;
+        backend = legacyBackend;
+      };
+    }) legacyHosts
+  );
+in
+{
+  imports = [
+    (my.guest {
+      name = "reverse-proxy";
+      interior = {
+        modules.reverse-proxy = {
+          enable = true;
+          routes = config.modules.reverse-proxy.routes // legacyRoutes;
+        };
+
+        networking.firewall.allowedTCPPorts = [ 2022 ];
+
+        services.nginx.streamConfig = ''
+          server {
+            listen 2022;
+            proxy_pass ${giteaSshBackend};
+          }
+        '';
+      };
+    })
+  ];
+
+  config = lib.mkIf config.guests.reverse-proxy.enable {
+    guests.reverse-proxy = {
+      limits = {
+        memory = lib.mkDefault "1G";
+        cpu = lib.mkDefault "100%";
+        tasksMax = lib.mkDefault 256;
+      };
+    };
+  };
+}

hosts/neogaia/default.nix

@@ -1,5 +1,4 @@
 {
-  config,
   inputs,
   pkgs,
   ...
@@ -39,9 +38,6 @@
   modules.ssh.hostKeys.sopsFile = ../../secrets/neogaia.yaml;
   modules.ssh.userKey.sopsFile = ../../secrets/neogaia.yaml;
 
-  # A machine the operator works from, so it admits the workstation keys alone.
-  modules.ssh.authorizedKeys = config.modules.ssh.workstationKeys;
-
   modules.toolkit.enable = true;
 
   # The walking-skeleton guest, enabled like any module: proves the guest path
@@ -68,9 +64,12 @@
   modules.agents.herdr.enable = true;
   modules.agents.tools.gitea-axi.enable = true;
   modules.agents.pi.enable = true;
+  modules.agents.pi.subagents.maxConcurrent = 8;
+  modules.agents.pi.subagents.recentTerminalTtlMs = 15 * 60 * 1000;
 
   modules.desktop.enable = true;
   modules.desktop.obsidian.enable = true;
+  modules.desktop.steam.enable = true;
 
   time.timeZone = "America/New_York";
   i18n.defaultLocale = "en_GB.UTF-8";

hosts/pikachu/default.nix

@@ -0,0 +1,138 @@
+{ pkgs, ... }:
+# pikachu — AZW ME Pro server.
+# Disk layout is in ./disk.nix.
+# `fileSystems` for the root disk are derived from it.
+{
+  imports = [
+    ./hardware-configuration.nix
+    ./disk.nix
+  ];
+
+  system.stateVersion = "26.05";
+
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  hardware.cpu.intel.updateMicrocode = true;
+  hardware.enableRedistributableFirmware = true;
+
+  zramSwap.enable = true;
+
+  systemd.network = {
+    enable = true;
+    netdevs = {
+      "40-br-vlan20".netdevConfig = {
+        Name = "br-vlan20";
+        Kind = "bridge";
+      };
+      "40-vlan20" = {
+        netdevConfig = {
+          Name = "vlan20";
+          Kind = "vlan";
+        };
+        vlanConfig.Id = 20;
+      };
+    };
+
+    networks = {
+      "10-uplink" = {
+        matchConfig = {
+          Name = "enp2s0";
+          MACAddress = "78:55:36:07:af:49";
+        };
+        networkConfig.DHCP = "yes";
+        vlan = [ "vlan20" ];
+        linkConfig.RequiredForOnline = "routable";
+      };
+      "40-vlan20" = {
+        matchConfig.Name = "vlan20";
+        networkConfig.Bridge = "br-vlan20";
+        linkConfig.RequiredForOnline = "no";
+      };
+      "40-br-vlan20" = {
+        matchConfig.Name = "br-vlan20";
+        linkConfig.RequiredForOnline = "no";
+      };
+    };
+  };
+  networking.useDHCP = false;
+
+  modules.network.vlans = [ 20 ];
+
+  boot.zfs.forceImportRoot = false;
+
+  modules.zfs = {
+    enable = true;
+    hostId = "2346edbd";
+    pools.pikachu = { };
+  };
+
+  modules.ssh.enable = true;
+  modules.ssh.hostKeys.sopsFile = ../../secrets/pikachu.yaml;
+  modules.ssh.userKey.sopsFile = ../../secrets/pikachu.yaml;
+
+  modules.git.enable = true;
+  modules.toolkit.enable = true;
+
+  guests.actualbudget = {
+    enable = true;
+    vlan = 20;
+    mac = "BC:24:11:C1:CD:28";
+    dataPath = "/pikachu/data/actualbudget";
+    reverseProxy = {
+      enable = true;
+      host = "budget.alexion.dev";
+      backend = "http://10.23.20.42:5006";
+    };
+  };
+
+  guests.reverse-proxy = {
+    enable = true;
+    vlan = 20;
+    mac = "02:98:64:5a:07:4f";
+  };
+
+  guests.copyparty = {
+    enable = true;
+    vlan = 20;
+    mac = "02:23:20:39:23:01";
+    statePath = "/pikachu/data/copyparty";
+    reverseProxy = {
+      enable = true;
+      host = "files.alexion.dev";
+      backend = "http://10.23.20.126:3923";
+      trustedSources = [ "10.23.20.109/32" ];
+    };
+    volumes = {
+      "/inbox" = {
+        hostPath = "/pikachu/__inbox";
+        path = "/srv/inbox";
+        access.A = [ "alexion" ];
+        flags = [
+          "d2d"
+          "d2t"
+          "dthumb"
+        ];
+      };
+      "/media" = {
+        hostPath = "/pikachu/media";
+        path = "/srv/media";
+        access.A = [ "alexion" ];
+        flags = [
+          "d2d"
+          "d2t"
+          "dthumb"
+        ];
+      };
+    };
+  };
+
+  environment.systemPackages = with pkgs; [
+    pciutils
+    smartmontools
+    usbutils
+  ];
+
+  time.timeZone = "America/New_York";
+  i18n.defaultLocale = "en_GB.UTF-8";
+}

hosts/pikachu/disk.nix

@@ -0,0 +1,32 @@
+{ ... }:
+# pikachu's install layout for disko: one NVMe boot disk with an EFI system partition and ext4 root.
+# The existing 8 TB ZFS mirror is imported by name and is never declared here.
+{
+  disko.devices.disk.main = {
+    type = "disk";
+    device = "/dev/nvme0n1";
+    content = {
+      type = "gpt";
+      partitions = {
+        ESP = {
+          size = "2G";
+          type = "EF00";
+          content = {
+            type = "filesystem";
+            format = "vfat";
+            mountpoint = "/boot";
+            mountOptions = [ "umask=0077" ];
+          };
+        };
+        root = {
+          size = "100%";
+          content = {
+            type = "filesystem";
+            format = "ext4";
+            mountpoint = "/";
+          };
+        };
+      };
+    };
+  };
+}

hosts/pikachu/hardware-configuration.nix

@@ -0,0 +1,18 @@
+{ lib, modulesPath, ... }:
+# Hardware detected from the Proxmox inventory for this machine.
+# disko derives the root disk filesystems, none declared here.
+{
+  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
+
+  boot.initrd.availableKernelModules = [
+    "ahci"
+    "nvme"
+    "sd_mod"
+    "xhci_pci"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}

hosts/pikachu/ssh_host_ed25519_key.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKljRf4pJO+pqEqjpPz08gOYq3g1PpxvE66xVw7uMEnA root@pikachu

hosts/pikachu/ssh_host_rsa_key.pub

@@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCy/riwm7dflA3mT+3a0/2CIoS2LbAsK/vn35kOoNeuzn0yhiF+imexP6tkB3S2t+H5ybRzkbbuNZcynFfeCqthFc8kvbdCnt8Diqoeg96fZ6ecvh5QE5yH9op8534EySetZ/exakFLnF+6EiWMuWUW3DFwsc2kcgDJObqSE8gTx/d7JK953MiTFmSJBFyg1RtQ3ZnMT+iCrvY2dyCLQai7VeF8koVKF2c0leAq2Hc75rb/L9md8MoJa64iPiz7hwTCin3xoFyaY/5hNVvyqFd5PivgR69gLdJkuVsUYO2mJzhur8cYmJD+pGjJ0U45hyE9TMrCFjeJHHuvSt3+2kph62wv95jLNk0WmMlwgyunISxENCSVVtNYdBMXhUh8VhEAW17QpVUg9EnPvxOdTKEjrvfOZYASWUa51JKbgBgexVgFbxdjDZR88DZa31AVBts/cx/59gXTUahFXMYLdZgssx+5uibZQWnvCyfUV9WLbfmK1lgL6hzReg1VkQ87iGr6skjtQYemJxRaFNA1+Q5f3kmG3KncuK/594a3qXYP4gC6A2blf8om1YZ4aXXh6f+GFKLjoEw1vvM2rJ+rjzfymwDX+pxVQ9L13OEtVZc9Ez76pOkbm1hqdbL0gY45+0cpxodhWV0wMQJBDXL1MHP8qcs+/vw0GxVK5l1SnWBGlw== root@pikachu

lib/default.nix

@@ -0,0 +1,94 @@
+{
+  lib,
+  inputs,
+  self,
+}:
+let
+  inherit (lib)
+    attrNames
+    filterAttrs
+    genAttrs
+    flatten
+    hasSuffix
+    mapAttrsToList
+    ;
+
+  serviceIdentityRegistry = import ./service-identities.nix { inherit lib; };
+  reverseProxyRoutes = import ./reverse-proxy-routes.nix { inherit lib; };
+
+  collectNixFiles =
+    dir:
+    flatten (
+      mapAttrsToList (
+        name: type:
+        let
+          path = dir + "/${name}";
+        in
+        if type == "directory" then
+          collectNixFiles path
+        else if type == "regular" && hasSuffix ".nix" name then
+          [ path ]
+        else
+          [ ]
+      ) (builtins.readDir dir)
+    );
+
+  specialArgs = {
+    inherit inputs;
+    my = self.lib;
+  };
+
+  bridgeName = id: "br-vlan${toString id}";
+
+  guests = import ./guests.nix {
+    inherit
+      lib
+      self
+      specialArgs
+      bridgeName
+      reverseProxyRoutes
+      ;
+  };
+
+  mkHost =
+    {
+      hostName,
+      system ? "x86_64-linux",
+    }:
+    inputs.nixpkgs.lib.nixosSystem {
+      inherit system specialArgs;
+      modules =
+        (collectNixFiles (self + "/modules"))
+        ++ (collectNixFiles (self + "/guests"))
+        ++ [
+          inputs.chaotic.nixosModules.default
+          inputs.disko.nixosModules.disko
+          inputs.sops-nix.nixosModules.sops
+          inputs.stylix.nixosModules.stylix
+          (self + "/system.nix")
+          (self + "/hosts/${hostName}")
+          { networking.hostName = hostName; }
+        ];
+    };
+
+  mkHosts =
+    hostsDir:
+    let
+      hostNames = attrNames (filterAttrs (_name: type: type == "directory") (builtins.readDir hostsDir));
+    in
+    genAttrs hostNames (hostName: mkHost { inherit hostName; });
+in
+{
+  inherit
+    collectNixFiles
+    mkHost
+    mkHosts
+    bridgeName
+    reverseProxyRoutes
+    ;
+
+  inherit (guests) deriveMac guest;
+
+  inherit (serviceIdentityRegistry) serviceUid;
+  serviceIdentities = serviceIdentityRegistry.identities;
+}

lib/guests.nix

@@ -1,52 +1,13 @@
 {
   lib,
-  inputs,
   self,
+  specialArgs,
+  bridgeName,
+  reverseProxyRoutes,
 }:
 let
-  inherit (lib)
-    attrNames
-    filterAttrs
-    genAttrs
-    flatten
-    hasSuffix
-    mapAttrsToList
-    ;
+  inherit (lib) escapeShellArg mapAttrsToList;
 
-  # Recursively collect every `.nix` file under `dir` as a flat list, for a
-  # module's `imports`.
-  collectNixFiles =
-    dir:
-    flatten (
-      mapAttrsToList (
-        name: type:
-        let
-          path = dir + "/${name}";
-        in
-        if type == "directory" then
-          collectNixFiles path
-        else if type == "regular" && hasSuffix ".nix" name then
-          [ path ]
-        else
-          [ ]
-      ) (builtins.readDir dir)
-    );
-
-  # The special arguments every configuration is evaluated with, host and guest
-  # interior alike.
-  specialArgs = {
-    inherit inputs;
-    my = self.lib;
-  };
-
-  # The name of a tagged VLAN's bridge, kept here as the one definition of a
-  # convention shared across the flake.
-  bridgeName = id: "br-vlan${toString id}";
-
-  # A guest with no operator-set MAC derives a stable one from its namespace path.
-  # The first octet 02 marks the address locally-administered and unicast.
-  # The rest is a slice of the path's hash.
-  # The same guest therefore always lands on the same address, which the operator can reserve at the router.
   deriveMac =
     name:
     let
@@ -55,34 +16,6 @@ let
     in
     lib.concatStringsSep ":" ([ "02" ] ++ map octet [ 0 1 2 3 4 ]);
 
-  # Build one host: every module and every guest is imported unconditionally
-  # (inert until its `enable` flag is set), alongside chaotic, the host base,
-  # and the host's own directory.
-  mkHost =
-    {
-      hostName,
-      system ? "x86_64-linux",
-    }:
-    inputs.nixpkgs.lib.nixosSystem {
-      inherit system specialArgs;
-      modules =
-        (collectNixFiles (self + "/modules"))
-        ++ (collectNixFiles (self + "/guests"))
-        ++ [
-          inputs.chaotic.nixosModules.default
-          inputs.disko.nixosModules.disko
-          inputs.sops-nix.nixosModules.sops
-          inputs.stylix.nixosModules.stylix
-          (self + "/system.nix")
-          (self + "/hosts/${hostName}")
-          { networking.hostName = hostName; }
-        ];
-    };
-
-  # Build a guest: a module-shaped definition whose body realizes its interior
-  # as a nested container standing on the guest-base, keyed by its namespace path.
-  # `name` is the dotted namespace under `guests.` and `interior` is an extra
-  # module merged into the container alongside the guest-base.
   guest =
     {
       name,
@@ -96,16 +29,11 @@ let
 
       networked = cfg.vlan != null;
 
-      # Host paths the operator maps into the guest, keyed by their in-guest path.
       userMounts = lib.mapAttrs (_guestPath: m: {
         inherit (m) hostPath;
         isReadOnly = m.readOnly;
       }) cfg.mounts;
 
-      # Each named secret bind-mounted read-only at the same `/run/secrets/<name>`
-      # path it holds on the host.
-      # No ownership is set here, since the container's one-to-one identity map
-      # carries the host file's owner through unchanged.
       secretMounts = lib.listToAttrs (
         map (
           name:
@@ -119,29 +47,32 @@ let
         ) cfg.secrets
       );
 
-      # An in-guest path claimed by both a mount and a secret, which the merge
-      # below would otherwise resolve silently in the secret's favour.
       mountCollisions = lib.attrNames (builtins.intersectAttrs userMounts secretMounts);
 
-      # The resource caps the operator places on the guest's unit, dropping any
-      # left unset so systemd keeps its uncapped default for those.
       limitConfig = lib.filterAttrs (_: v: v != null) {
         MemoryMax = cfg.limits.memory;
         CPUQuota = cfg.limits.cpu;
         TasksMax = cfg.limits.tasksMax;
       };
 
-      # A networked guest owns its bridged interface through its own networkd, the only stable MAC pin for a nested container.
-      # The interface is eth0, the name a nested container gives its bridged veth.
-      # It takes the placement MAC, and the static address or DHCP when that is unset.
+      createdMounts = lib.filterAttrs (_guestPath: m: m.create != null) cfg.mounts;
+      mountCreateScript = lib.concatStringsSep "\n" (
+        mapAttrsToList (
+          _guestPath: m:
+          let
+            create = m.create;
+          in
+          ''
+            ${config.system.path}/bin/install -d -o ${escapeShellArg (toString create.owner)} -g ${escapeShellArg create.group} -m ${escapeShellArg create.mode} ${escapeShellArg m.hostPath}
+          ''
+        ) createdMounts
+      );
+
       guestNet =
         { lib, ... }:
         {
           config = lib.mkIf networked {
             networking.useNetworkd = true;
-
-            # networkd default-enables resolved, which owns the guest's resolv.conf.
-            # The nested-container default of inheriting the host's file conflicts with that, so the guest keeps its own.
             networking.useHostResolvConf = false;
 
             systemd.network.networks."20-eth0" = {
@@ -200,6 +131,10 @@ let
             guest takes its address by DHCP, keeping IP management at the router.
           '';
         };
+        reverseProxy = reverseProxyRoutes.mkRouteOptions {
+          subject = "guest route";
+          enableDefault = false;
+        };
         mounts = lib.mkOption {
           type = lib.types.attrsOf (
             lib.types.submodule {
@@ -217,6 +152,39 @@ let
                     service must write to the pool data it owns.
                   '';
                 };
+                create = lib.mkOption {
+                  type = lib.types.nullOr (lib.types.submodule {
+                    options = {
+                      type = lib.mkOption {
+                        type = lib.types.enum [ "directory" ];
+                        default = "directory";
+                        description = "Host path type to create before the guest starts.";
+                      };
+                      owner = lib.mkOption {
+                        type = lib.types.oneOf [
+                          lib.types.str
+                          lib.types.ints.positive
+                        ];
+                        description = "Owner assigned to the created host path.";
+                      };
+                      group = lib.mkOption {
+                        type = lib.types.str;
+                        description = "Group assigned to the created host path.";
+                      };
+                      mode = lib.mkOption {
+                        type = lib.types.str;
+                        example = "0770";
+                        description = "Mode assigned to the created host path.";
+                      };
+                    };
+                  });
+                  default = null;
+                  description = ''
+                    Opt-in host path creation before the guest starts. Existing
+                    paths are left enabled unless this is set, so served storage
+                    roots can still be required to exist explicitly.
+                  '';
+                };
               };
             }
           );
@@ -308,10 +276,12 @@ let
       };
 
       config = lib.mkIf cfg.enable {
-        # Declared here so the host is the one that decrypts each named secret.
-        # The guest carries no age key and decrypts nothing of its own.
         sops.secrets = lib.genAttrs cfg.secrets (_: { });
 
+        modules.reverse-proxy.routes.${machineName} = lib.mkIf cfg.reverseProxy.enable (
+          reverseProxyRoutes.routeFields cfg.reverseProxy
+        );
+
         assertions = [
           {
             assertion = mountCollisions == [ ];
@@ -333,13 +303,12 @@ let
           }
         ];
 
-        # The operator's resource caps land on the guest's own unit, which a
-        # networked guest also orders after the bridge its veth enslaves to at
-        # start, since the container backend orders the unit after the network
-        # is up but not after that specific bridge existing.
         systemd.services."container@${machineName}" = lib.mkIf (cfg.backend == "container") (
           lib.mkMerge [
-            { serviceConfig = limitConfig; }
+            {
+              serviceConfig = limitConfig;
+              preStart = lib.mkIf (createdMounts != { }) mountCreateScript;
+            }
             (lib.mkIf networked (
               let
                 bridgeDevice = "sys-subsystem-net-devices-${lib.replaceStrings [ "-" ] [ "\\x2d" ] (bridgeName cfg.vlan)}.device";
@@ -354,27 +323,9 @@ let
 
         containers.${machineName} = lib.mkIf (cfg.backend == "container") {
           autoStart = cfg.autoStart;
-
-          # The guest gets its own network namespace, so its services — its own
-          # sshd included — never contend with the host's.
           privateNetwork = lib.mkDefault true;
-
-          # A networked guest's veth is enslaved to the VLAN's bridge, making it
-          # a first-class L2 citizen on that segment.
           hostBridge = lib.mkIf networked (bridgeName cfg.vlan);
-
-          # The container shares the host's uid and gid space one to one.
-          # A guest process writing as the shared storage group then lands on a bind-mounted pool as that same group, with no permission juggling.
-          # A private-user mapping would shift the ids and reintroduce those errors, so it stays off.
           privateUsers = lib.mkDefault "no";
-
-          # A nesting guest runs Podman or other OCI containers in its interior.
-          # The network-administration capability lets that runtime build its
-          # bridges and firewall rules.
-          # The tun and fuse device nodes are what it reaches for to network
-          # those containers and back their overlay storage.
-          # The remaining prerequisite, a delegated cgroup subtree for the
-          # runtime to manage, the container backend already grants every guest.
           additionalCapabilities = lib.optionals cfg.nesting [ "CAP_NET_ADMIN" ];
           allowedDevices = lib.optionals cfg.nesting [
             {
@@ -401,21 +352,7 @@ let
         };
       };
     };
-
-  # Discover every host (a subdirectory of `hostsDir`) and build each one.
-  mkHosts =
-    hostsDir:
-    let
-      hostNames = attrNames (filterAttrs (_name: type: type == "directory") (builtins.readDir hostsDir));
-    in
-    genAttrs hostNames (hostName: mkHost { inherit hostName; });
 in
 {
-  inherit
-    collectNixFiles
-    mkHost
-    mkHosts
-    guest
-    bridgeName
-    ;
+  inherit deriveMac guest;
 }

lib/reverse-proxy-routes.nix

@@ -0,0 +1,77 @@
+{ lib }:
+let
+  mkRouteOptions =
+    {
+      name ? null,
+      subject ? "route",
+      enableDefault ? true,
+    }:
+    {
+      enable = lib.mkOption {
+        type = lib.types.bool;
+        default = enableDefault;
+        description = "Whether this reverse-proxy ${subject} is active.";
+      };
+
+      host = lib.mkOption (
+        {
+          type = lib.types.str;
+          description = "Primary hostname served by this reverse-proxy ${subject}.";
+        }
+        // lib.optionalAttrs (name != null) {
+          default = name;
+          defaultText = lib.literalMD "the route attribute name";
+        }
+      );
+
+      aliases = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        default = [ ];
+        description = "Additional hostnames served by this reverse-proxy ${subject}.";
+      };
+
+      path = lib.mkOption {
+        type = lib.types.str;
+        default = "/";
+        description = "URL path prefix proxied by this reverse-proxy ${subject}.";
+      };
+
+      backend = lib.mkOption {
+        type = lib.types.str;
+        description = "Full HTTP backend URL that receives proxied traffic.";
+      };
+
+      tls = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = "Whether to serve this reverse-proxy ${subject} with ACME-backed TLS.";
+      };
+
+      websockets = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = "Whether to enable websocket proxy headers for this reverse-proxy ${subject}.";
+      };
+    };
+
+  routeFields = route: {
+    inherit (route)
+      host
+      aliases
+      path
+      backend
+      tls
+      websockets
+      ;
+  };
+in
+{
+  inherit mkRouteOptions routeFields;
+
+  routeType = lib.types.submodule (
+    { name, ... }:
+    {
+      options = mkRouteOptions { inherit name; };
+    }
+  );
+}

lib/service-identities.nix

@@ -0,0 +1,59 @@
+{ lib }:
+let
+  defaultIdentities = {
+    actualbudget = 20001;
+    copyparty = 20002;
+  };
+
+  duplicateUidMessage = duplicates: ''
+    Duplicate stable service UID allocation(s): ${lib.concatStringsSep ", " (
+      map (entry: "${toString entry.uid} is assigned to ${lib.concatStringsSep ", " entry.names}") duplicates
+    )}
+  '';
+
+  mk = identities:
+    let
+      names = lib.attrNames identities;
+      namesByUid = lib.foldl' (
+        acc: name:
+        let
+          uid = toString identities.${name};
+        in
+        acc // {
+          ${uid} = (acc.${uid} or [ ]) ++ [ name ];
+        }
+      ) { } names;
+      duplicates = lib.mapAttrsToList (uid: namesForUid: {
+        uid = lib.toInt uid;
+        names = namesForUid;
+      }) (lib.filterAttrs (_uid: namesForUid: builtins.length namesForUid > 1) namesByUid);
+      checkedIdentities =
+        assert lib.assertMsg (duplicates == [ ]) (duplicateUidMessage duplicates);
+        identities;
+    in
+    rec {
+      inherit checkedIdentities;
+
+      serviceUid = name:
+        if builtins.hasAttr name checkedIdentities then
+          checkedIdentities.${name}
+        else
+          throw "Unknown stable service identity `${name}`. Known identities: ${lib.concatStringsSep ", " (lib.attrNames checkedIdentities)}";
+    };
+
+  default = mk defaultIdentities;
+
+  tests = {
+    actualbudgetUid = default.serviceUid "actualbudget" == 20001;
+    copypartyUid = default.serviceUid "copyparty" == 20002;
+    missingLookupFails = !(builtins.tryEval (default.serviceUid "missing-service")).success;
+    duplicateUidFails = !(builtins.tryEval (mk {
+      first = 20003;
+      second = 20003;
+    }).checkedIdentities).success;
+  };
+in
+default // {
+  identities = default.checkedIdentities;
+  inherit tests;
+}

modules/agents/pi/extensions/compact-status.ts

@@ -0,0 +1,254 @@
+import { execFileSync } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { basename, join } from "node:path";
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import { truncateToWidth, visibleWidth } from "@earendil-works/pi-tui";
+
+type QuotaState =
+  | { status: "idle" | "loading" }
+  | { status: "ok"; detail: string; refreshedAt: number; weeklyRemaining?: number; shortRemaining?: number }
+  | { status: "missing" | "error"; detail: string; refreshedAt?: number };
+
+const CODEX_USAGE_ENDPOINTS = [
+  "https://chatgpt.com/backend-api/wham/usage",
+  "https://chatgpt.com/backend-api/codex/usage",
+];
+const QUOTA_REFRESH_MS = 5 * 60 * 1000;
+const REQUEST_TIMEOUT_MS = 10_000;
+
+let quotaState: QuotaState = { status: "idle" };
+let quotaRefreshPromise: Promise<void> | null = null;
+
+function shortCwd(cwd: string): string {
+  const home = process.env.HOME;
+  if (home && cwd.startsWith(`${home}/`)) return `~/${basename(cwd)}`;
+  return basename(cwd) || cwd;
+}
+
+function gitBranch(cwd: string): string | null {
+  try {
+    const out = execFileSync("git", ["--no-optional-locks", "symbolic-ref", "--quiet", "--short", "HEAD"], {
+      cwd,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+    }).trim();
+    return out || null;
+  } catch {
+    return null;
+  }
+}
+
+function authPath(): string {
+  return join(process.env.PI_CODING_AGENT_DIR ?? join(homedir(), ".pi", "agent"), "auth.json");
+}
+
+function readCodexCredentials(): { access: string; accountId?: string } | null {
+  const file = authPath();
+  if (!existsSync(file)) return null;
+  try {
+    const auth = JSON.parse(readFileSync(file, "utf8"));
+    const credential = auth?.["openai-codex"];
+    if (credential?.type !== "oauth" || typeof credential.access !== "string") return null;
+    if (typeof credential.expires === "number" && credential.expires <= Date.now() + 30_000) return null;
+    return {
+      access: credential.access,
+      accountId: typeof credential.accountId === "string" ? credential.accountId : undefined,
+    };
+  } catch {
+    return null;
+  }
+}
+
+function numberValue(value: unknown): number | undefined {
+  if (typeof value === "number" && Number.isFinite(value)) return value;
+  if (typeof value === "string" && value.trim() !== "") {
+    const parsed = Number(value);
+    if (Number.isFinite(parsed)) return parsed;
+  }
+  return undefined;
+}
+
+function objectValue(value: unknown): Record<string, unknown> | undefined {
+  return value && typeof value === "object" && !Array.isArray(value) ? (value as Record<string, unknown>) : undefined;
+}
+
+function windowSeconds(raw: Record<string, unknown>): number | undefined {
+  const seconds = numberValue(raw.limit_window_seconds ?? raw.windowSeconds);
+  if (seconds !== undefined) return seconds;
+  const mins = numberValue(raw.windowDurationMins ?? raw.window_duration_mins);
+  return mins === undefined ? undefined : mins * 60;
+}
+
+function usedPercent(raw: Record<string, unknown>): number | undefined {
+  const value = numberValue(raw.used_percent ?? raw.usedPercent);
+  if (value === undefined) return undefined;
+  return Math.max(0, Math.min(100, value));
+}
+
+function collectWindows(raw: unknown, out: Array<{ seconds?: number; used: number; key: string }> = [], key = "root") {
+  if (Array.isArray(raw)) {
+    raw.forEach((item, index) => collectWindows(item, out, `${key}.${index}`));
+    return out;
+  }
+  const obj = objectValue(raw);
+  if (!obj) return out;
+  const used = usedPercent(obj);
+  if (used !== undefined) out.push({ seconds: windowSeconds(obj), used, key });
+  for (const [childKey, value] of Object.entries(obj)) {
+    if (value && typeof value === "object") collectWindows(value, out, `${key}.${childKey}`);
+  }
+  return out;
+}
+
+function pickQuotaWindows(raw: unknown): { weeklyRemaining?: number; shortRemaining?: number } | null {
+  const windows = collectWindows(raw);
+  if (windows.length === 0) return null;
+  const weekly = windows.find((window) => window.seconds !== undefined && Math.abs(window.seconds - 604_800) <= 60 * 60)
+    ?? windows.find((window) => /week|weekly|secondary/i.test(window.key));
+  const short = windows.find((window) => window.seconds !== undefined && Math.abs(window.seconds - 18_000) <= 60 * 30)
+    ?? windows.find((window) => /five|session|primary|short/i.test(window.key));
+  return {
+    weeklyRemaining: weekly ? Math.max(0, Math.min(100, 100 - weekly.used)) : undefined,
+    shortRemaining: short ? Math.max(0, Math.min(100, 100 - short.used)) : undefined,
+  };
+}
+
+function safeFg(theme: any, color: string, text: string): string {
+  try {
+    return theme.fg(color, text);
+  } catch {
+    return theme.fg("accent", text);
+  }
+}
+
+function contextColor(percent: number): string {
+  if (percent >= 90) return "error";
+  if (percent >= 70) return "warning";
+  return "success";
+}
+
+function quotaColor(percent: number): string {
+  if (percent >= 80) return "error";
+  if (percent >= 50) return "warning";
+  return "border";
+}
+
+function bar(theme: any, width: number, percent: number | null, glyph: string, colorForPercent: (percent: number) => string): string {
+  const barWidth = Math.max(12, width);
+  if (percent === null) return theme.fg("muted", glyph.repeat(barWidth));
+  const clamped = Math.max(0, Math.min(100, percent));
+  const filled = Math.max(0, Math.min(barWidth, Math.round((clamped / 100) * barWidth)));
+  const empty = Math.max(0, barWidth - filled);
+  return safeFg(theme, colorForPercent(clamped), glyph.repeat(filled)) + theme.fg("dim", glyph.repeat(empty));
+}
+
+async function fetchCodexQuota(force = false): Promise<void> {
+  const fresh = quotaState.status === "ok" && Date.now() - quotaState.refreshedAt < QUOTA_REFRESH_MS;
+  if (!force && fresh) return;
+  if (quotaRefreshPromise) return quotaRefreshPromise;
+
+  quotaState = { status: "loading" };
+  quotaRefreshPromise = (async () => {
+    const credentials = readCodexCredentials();
+    if (!credentials) {
+      quotaState = { status: "missing", detail: "OpenAI Codex OAuth credentials were not found or are expired" };
+      return;
+    }
+
+    let lastError = "quota unavailable";
+    for (const endpoint of CODEX_USAGE_ENDPOINTS) {
+      const controller = new AbortController();
+      const timeout = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);
+      try {
+        const headers: Record<string, string> = { Authorization: `Bearer ${credentials.access}` };
+        if (credentials.accountId) headers["ChatGPT-Account-Id"] = credentials.accountId;
+        const response = await fetch(endpoint, { headers, signal: controller.signal });
+        if (!response.ok) {
+          lastError = `${response.status} ${response.statusText}`;
+          continue;
+        }
+        const windows = pickQuotaWindows(await response.json());
+        if (!windows || (windows.weeklyRemaining === undefined && windows.shortRemaining === undefined)) {
+          lastError = "response had no recognized quota windows";
+          continue;
+        }
+        const details = [];
+        if (windows.weeklyRemaining !== undefined) details.push(`weekly ${Math.round(windows.weeklyRemaining)}%`);
+        if (windows.shortRemaining !== undefined) details.push(`short ${Math.round(windows.shortRemaining)}%`);
+        quotaState = {
+          status: "ok",
+          detail: `Codex quota remaining: ${details.join(", ")}`,
+          weeklyRemaining: windows.weeklyRemaining,
+          shortRemaining: windows.shortRemaining,
+          refreshedAt: Date.now(),
+        };
+        return;
+      } catch (error) {
+        lastError = error instanceof Error ? error.message : String(error);
+      } finally {
+        clearTimeout(timeout);
+      }
+    }
+    quotaState = { status: "error", detail: `Codex quota failed: ${lastError}`, refreshedAt: Date.now() };
+  })().finally(() => {
+    quotaRefreshPromise = null;
+  });
+  return quotaRefreshPromise;
+}
+
+function statusLines(ctx: any, theme: any, width: number): string[] {
+  const cwd = ctx.sessionManager?.getCwd?.() ?? ctx.cwd ?? process.cwd();
+  const branch = gitBranch(cwd);
+  const where = branch ? `󰉋 ${shortCwd(cwd)} 󰘬 ${branch}` : `󰉋 ${shortCwd(cwd)}`;
+  const model = ctx.model?.id ?? process.env.PI_MODEL ?? "no-model";
+  const thinking = ctx.thinkingLevel ?? process.env.PI_REASONING_LEVEL ?? "off";
+  const left = theme.fg("accent", where);
+  const right = theme.fg("dim", `${model} • ${thinking}`);
+  const pad = " ".repeat(Math.max(1, width - visibleWidth(left) - visibleWidth(right)));
+  const contextPercentRaw = ctx.getContextUsage?.()?.percent;
+  const contextPercent = typeof contextPercentRaw === "number" && Number.isFinite(contextPercentRaw) ? contextPercentRaw : null;
+  const quotaConsumed = quotaState.status === "ok" && quotaState.weeklyRemaining !== undefined
+    ? 100 - quotaState.weeklyRemaining
+    : null;
+  return [
+    truncateToWidth(left + pad + right, width),
+    bar(theme, width, contextPercent, "▃", contextColor),
+    bar(theme, width, quotaConsumed, "▔", quotaColor),
+  ];
+}
+
+function setCompactStatusUi(ctx: any) {
+  if (!ctx.hasUI) return;
+  ctx.ui.setWidget("compact-status", (_tui: any, theme: any) => ({
+    invalidate() {},
+    render(width: number) {
+      return statusLines(ctx, theme, width);
+    },
+  }));
+  ctx.ui.setFooter(() => ({ invalidate() {}, render: () => [] }));
+}
+
+export default function compactStatus(pi: ExtensionAPI) {
+  function refreshUi(ctx: any) {
+    setCompactStatusUi(ctx);
+  }
+
+  pi.on("session_start", (_event, ctx) => {
+    refreshUi(ctx);
+    void fetchCodexQuota(false).then(() => refreshUi(ctx));
+  });
+  pi.on("model_select", (_event, ctx) => refreshUi(ctx));
+  pi.on("agent_settled", (_event, ctx) => refreshUi(ctx));
+
+  pi.registerCommand("codex-quota", {
+    description: "Refresh and show ChatGPT Codex quota",
+    handler: async (_args, ctx) => {
+      refreshUi(ctx);
+      await fetchCodexQuota(true);
+      refreshUi(ctx);
+      const level = quotaState.status === "ok" ? "info" : quotaState.status === "missing" ? "warning" : "error";
+      ctx.ui.notify(quotaState.status === "idle" || quotaState.status === "loading" ? "Codex quota refresh in progress" : quotaState.detail, level);
+    },
+  });
+}

modules/agents/pi/extensions/subagents/config.test.ts

@@ -115,9 +115,10 @@ test("named spawn resolves overrides, frontmatter, config, and defaults", () =>
   const config = loadConfig(cwd, true, diag, agentDir);
   const agents = loadAgents(cwd, true, diag, agentDir);
 
-  const resolved = resolveSpawn({ agent: "review", prompt: "check this", thinking: "low" }, config, agents);
+  const resolved = resolveSpawn({ agent: "review", prompt: "check this", label: "Review migration", thinking: "low" }, config, agents);
 
   assert.equal(resolved.prompt, "check this");
+  assert.equal(resolved.label, "Review migration");
   assert.equal(resolved.context, "independent");
   assert.equal(resolved.model, "inherit");
   assert.equal(resolved.thinking, "low");

modules/agents/pi/extensions/subagents/index.ts

@@ -4,6 +4,7 @@ import { loadAgents } from "./agents.ts";
 import { loadConfig, resolveSpawn, type Diagnostics } from "./config.ts";
 import { SubprocessRpcRunner } from "./runner.ts";
 import { Supervisor } from "./supervisor.ts";
+import { milestoneNotification } from "./status.ts";
 import type { SpawnRequest, SubagentStatus } from "./types.ts";
 import { widget } from "./ui.ts";
 
@@ -23,7 +24,11 @@ export default function subagents(pi: ExtensionAPI) {
     supervisor = new Supervisor(new SubprocessRpcRunner(), cwd, {
       maxConcurrent: config.maxConcurrent,
       recentTerminalTtlMs: config.recentTerminalTtlMs,
-      onMilestone: (status, event) => pi.appendEntry("subagent_milestone", { event, status }),
+      onMilestone: (status, event) => {
+        pi.appendEntry("subagent_milestone", { event, status });
+        const notification = milestoneNotification(status, event);
+        if (notification) ctx.ui?.notify?.(notification.message, notification.level);
+      },
       onChange: (statuses) => {
         lastStatuses = statuses;
         updateUi(ctx, config.ui.enabled);
@@ -51,6 +56,7 @@ export default function subagents(pi: ExtensionAPI) {
     description: "Start one ad hoc independent subagent and return immediately with its child id",
     parameters: Type.Object({
       prompt: Type.String({ description: "Prompt for the delegated subagent" }),
+      label: Type.Optional(Type.String({ description: "Human-readable label for this work item" })),
       agent: Type.Optional(Type.String({ description: "Named agent definition to use" })),
       context: Type.Optional(Type.Union([Type.Literal("independent"), Type.Literal("fork")])),
       model: Type.Optional(Type.String({ description: "Optional model selector for the child" })),
@@ -59,7 +65,7 @@ export default function subagents(pi: ExtensionAPI) {
     }),
     async execute(_toolCallId, params, _signal, _onUpdate, ctx) {
       const accepted = getSupervisor(ctx).spawn(resolve(ctx, params as SpawnRequest));
-      ctx.ui?.notify?.(`Started subagent ${accepted.id}`, "info");
+      ctx.ui?.notify?.(`Started subagent ${accepted.label}`, "info");
       return textResult(accepted);
     },
   });
@@ -72,6 +78,7 @@ export default function subagents(pi: ExtensionAPI) {
       subagents: Type.Array(
         Type.Object({
           prompt: Type.String({ description: "Prompt for the delegated subagent" }),
+          label: Type.Optional(Type.String({ description: "Human-readable label for this work item" })),
           agent: Type.Optional(Type.String({ description: "Named agent definition to use" })),
           context: Type.Optional(Type.Union([Type.Literal("independent"), Type.Literal("fork")])),
           model: Type.Optional(Type.String({ description: "Optional model selector for the child" })),
@@ -99,7 +106,7 @@ export default function subagents(pi: ExtensionAPI) {
   pi.registerTool({
     name: "subagent_list",
     label: "List subagents",
-    description: "List active and recent subagents for this parent session",
+    description: "List active and terminal subagents for this parent session until terminal entries are cleared",
     parameters: Type.Object({}),
     async execute(_toolCallId, _params, _signal, _onUpdate, ctx) {
       return textResult(getSupervisor(ctx).list());
@@ -160,11 +167,25 @@ export default function subagents(pi: ExtensionAPI) {
     },
   });
 
+  pi.registerTool({
+    name: "subagent_clear",
+    label: "Clear terminal subagents",
+    description: "Remove terminal subagents from the current-session visible work set. Omitting ids clears all terminal children",
+    parameters: Type.Object({
+      ids: Type.Optional(Type.Array(Type.String({ description: "Subagent id returned by subagent_spawn or subagent_batch" }))),
+    }),
+    async execute(_toolCallId, params, _signal, _onUpdate, ctx) {
+      const input = params as { ids?: unknown };
+      const ids = Array.isArray(input.ids) ? input.ids.map(String) : undefined;
+      return textResult({ cleared: getSupervisor(ctx).clearTerminal(ids) });
+    },
+  });
+
   pi.registerCommand("subagent-spawn", {
     description: "Start an ad hoc independent subagent",
     handler: async (args, ctx) => {
       const accepted = getSupervisor(ctx).spawn(resolve(ctx, parseSpawnArgs(args)));
-      ctx.ui.notify(`Started subagent ${accepted.id}`, "info");
+      ctx.ui.notify(`Started subagent ${accepted.label}`, "info");
     },
   });
 
@@ -187,6 +208,14 @@ export default function subagents(pi: ExtensionAPI) {
     },
   });
 
+  pi.registerCommand("subagent-clear", {
+    description: "Clear terminal subagent records. Pass ids to clear selected terminal records only",
+    handler: async (args, ctx) => {
+      const ids = args.trim().split(/\s+/u).filter(Boolean);
+      ctx.ui.notify(JSON.stringify({ cleared: getSupervisor(ctx).clearTerminal(ids.length > 0 ? ids : undefined) }, null, 2), "info");
+    },
+  });
+
   pi.registerCommand("subagent-status", {
     description: "Show a subagent status by id",
     handler: async (args, ctx) => {
@@ -250,6 +279,7 @@ function parseSpawnArgs(args: string): SpawnRequest {
     const flag = parts.shift();
     const value = parts.shift();
     if (flag === "--agent") request.agent = value;
+    else if (flag === "--label") request.label = value;
     else if (flag === "--context" && (value === "independent" || value === "fork")) request.context = value;
     else if (flag === "--tools") request.tools = value;
     else if (flag === "--model") request.model = value;

modules/agents/pi/extensions/subagents/runner.test.ts

@@ -0,0 +1,118 @@
+import assert from "node:assert/strict";
+import childProcess from "node:child_process";
+import { EventEmitter } from "node:events";
+import { fileURLToPath } from "node:url";
+import test from "node:test";
+import type { RunnerEvents } from "./types.ts";
+
+class FakeStream extends EventEmitter {
+  setEncoding(_encoding: BufferEncoding): void {}
+
+  write(_chunk: string, callback?: (error?: Error | null) => void): boolean {
+    callback?.();
+    return true;
+  }
+
+  end(): void {}
+}
+
+function events(): RunnerEvents {
+  return {
+    accepted: () => {},
+    running: () => {},
+    settling: () => {},
+    completed: () => {},
+    failed: () => {},
+  };
+}
+
+test("child RPC process forwards structured activity before collecting the final result", async (t) => {
+  const running: unknown[] = [];
+  const completed: Array<{ result: string; stopReason?: string }> = [];
+  const fakeChild = new EventEmitter() as EventEmitter & {
+    stdout: FakeStream;
+    stderr: FakeStream;
+    stdin: FakeStream;
+    killed: boolean;
+    pid?: number;
+    kill(signal?: NodeJS.Signals): boolean;
+  };
+  fakeChild.stdout = new FakeStream();
+  fakeChild.stderr = new FakeStream();
+  fakeChild.stdin = new FakeStream();
+  fakeChild.killed = false;
+  fakeChild.kill = () => {
+    fakeChild.killed = true;
+    return true;
+  };
+  t.mock.method(fakeChild.stdin, "write", (chunk, callback?: (error?: Error | null) => void) => {
+    const request = JSON.parse(String(chunk)) as { id: string; type: string };
+    callback?.();
+    if (request.type === "get_last_assistant_text") {
+      queueMicrotask(() => {
+        fakeChild.stdout.emit("data", `${JSON.stringify({ id: request.id, type: "response", success: true, data: { text: "final answer" } })}\n`);
+      });
+    }
+    return true;
+  });
+  t.mock.method(childProcess, "spawn", () => fakeChild as unknown as childProcess.ChildProcessWithoutNullStreams);
+
+  const { SubprocessRpcRunner } = await import("./runner.ts");
+  const runner = new SubprocessRpcRunner();
+  await runner.start("child-1", { prompt: "work", label: "Review migration" }, "/tmp", {
+    ...events(),
+    running: (event) => running.push(event),
+    completed: (result, stopReason) => completed.push({ result, stopReason }),
+  });
+
+  const firstActivity = { type: "message_start", role: "assistant", message: { id: "msg-1" } };
+  const secondActivity = { type: "tool_execution_start", tool: "read", input: { path: "runner.ts" } };
+  const settledActivity = { type: "agent_settled" };
+  fakeChild.stdout.emit("data", `${JSON.stringify(firstActivity)}\n${JSON.stringify(secondActivity)}\n${JSON.stringify(settledActivity)}\n`);
+  await new Promise((resolve) => setImmediate(resolve));
+
+  assert.deepEqual(running, [firstActivity, secondActivity, settledActivity]);
+  assert.deepEqual(completed, [{ result: "final answer", stopReason: "agent_settled" }]);
+});
+
+test("child RPC process disables discovery while explicitly loading subagents extension", async (t) => {
+  const calls: Array<{ command: string; args: string[] }> = [];
+  const fakeChild = new EventEmitter() as EventEmitter & {
+    stdout: FakeStream;
+    stderr: FakeStream;
+    stdin: FakeStream;
+    killed: boolean;
+    pid?: number;
+    kill(signal?: NodeJS.Signals): boolean;
+  };
+  fakeChild.stdout = new FakeStream();
+  fakeChild.stderr = new FakeStream();
+  fakeChild.stdin = new FakeStream();
+  fakeChild.killed = false;
+  fakeChild.kill = () => {
+    fakeChild.killed = true;
+    return true;
+  };
+  const spawn = t.mock.method(childProcess, "spawn", (command, args) => {
+    calls.push({ command: String(command), args: Array.isArray(args) ? args.map(String) : [] });
+    return fakeChild as unknown as childProcess.ChildProcessWithoutNullStreams;
+  });
+
+  const { SubprocessRpcRunner } = await import("./runner.ts");
+  const runner = new SubprocessRpcRunner();
+  await runner.start("child-1", { prompt: "work", label: "Review migration" }, "/tmp", events());
+
+  assert.equal(spawn.mock.callCount(), 1);
+  const args = calls[0].args;
+  const noExtensionsIndex = args.indexOf("--no-extensions");
+  const extensionIndex = args.indexOf("--extension");
+
+  const nameIndex = args.indexOf("--name");
+
+  assert.notEqual(noExtensionsIndex, -1, "child args keep automatic extension discovery disabled");
+  assert.notEqual(nameIndex, -1, "child args include a process name");
+  assert.equal(args[nameIndex + 1], "subagent Review migration");
+  assert.notEqual(extensionIndex, -1, "child args explicitly load the subagents extension entry");
+  assert.equal(args[extensionIndex + 1], fileURLToPath(new URL("./index.ts", import.meta.url)));
+  assert.ok(noExtensionsIndex < extensionIndex);
+});

modules/agents/pi/extensions/subagents/runner.ts

@@ -1,4 +1,5 @@
 import { spawn, type ChildProcessWithoutNullStreams } from "node:child_process";
+import { fileURLToPath } from "node:url";
 import type { ChildHandle, ChildRunner, RunnerEvents, SpawnRequest } from "./types.ts";
 
 interface PendingResponse {
@@ -88,16 +89,17 @@ class RpcChildHandle implements ChildHandle {
     }
 
     if (payload.type === "agent_started") {
-      this.events.running("agent_started");
+      this.events.running(payload as Record<string, unknown>);
       return;
     }
 
     if (payload.type === "agent_settled") {
+      this.events.running(payload as Record<string, unknown>);
       this.finish().catch((error) => this.fail(error instanceof Error ? error.message : String(error)));
       return;
     }
 
-    if (payload.type) this.events.running(payload.type);
+    if (payload.type) this.events.running(payload as Record<string, unknown>);
   }
 
   private async finish() {
@@ -156,7 +158,7 @@ class RpcChildHandle implements ChildHandle {
 
 export class SubprocessRpcRunner implements ChildRunner {
   async start(id: string, request: SpawnRequest, cwd: string, events: RunnerEvents): Promise<ChildHandle> {
-    const args = [process.argv[1], "--mode", "rpc", "--no-extensions", "--name", `subagent ${id}`, ...contextArgs(request), ...toolArgs(request), ...modelArgs(request)];
+    const args = [process.argv[1], "--mode", "rpc", "--no-extensions", "--extension", subagentsExtensionPath(), "--name", `subagent ${request.label ?? id}`, ...contextArgs(request), ...toolArgs(request), ...modelArgs(request)];
     const child = spawn(process.execPath, args, {
       cwd,
       env: childEnvironment(),
@@ -174,6 +176,10 @@ function delay(ms: number): Promise<void> {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
 
+function subagentsExtensionPath(): string {
+  return fileURLToPath(new URL("./index.ts", import.meta.url));
+}
+
 function contextArgs(request: SpawnRequest): string[] {
   if (request.context !== "fork" || !request.parentSessionFile) return [];
   return ["--fork", request.parentSessionFile];

modules/agents/pi/extensions/subagents/status.ts

@@ -1,4 +1,5 @@
-import type { ChildRecord, SpawnAccepted, SubagentResult, SubagentStatus } from "./types.ts";
+import { SUBAGENT_STATES, SUBAGENT_TERMINAL_STATES } from "./types.ts";
+import type { ChildRecord, SpawnAccepted, SubagentResult, SubagentState, SubagentStatus } from "./types.ts";
 
 export function toAccepted(status: SubagentStatus): SpawnAccepted {
   return {
@@ -12,14 +13,20 @@ export function toAccepted(status: SubagentStatus): SpawnAccepted {
 }
 
 export function cloneStatus(status: SubagentStatus): SubagentStatus {
-  return { ...status, elapsedMs: elapsedMs(status) };
+  return {
+    ...status,
+    currentActivity: status.currentActivity ? { ...status.currentActivity } : undefined,
+    activityHistory: status.activityHistory.map((event) => ({ ...event })),
+    elapsedMs: elapsedMs(status),
+  };
 }
 
 export function cloneResult(record: ChildRecord): SubagentResult {
   const status = cloneStatus(record.status);
-  const terminal = ["completed", "failed", "cancelled", "timed_out", "orphaned"].includes(status.state);
+  const terminal = isTerminalState(status.state);
   return {
     id: status.id,
+    label: status.label,
     state: status.state,
     running: !terminal,
     resultAvailable: status.resultAvailable,
@@ -30,6 +37,19 @@ export function cloneResult(record: ChildRecord): SubagentResult {
   };
 }
 
+export function isTerminalState(state: SubagentState): boolean {
+  return (SUBAGENT_TERMINAL_STATES as readonly string[]).includes(state);
+}
+
+export function milestoneNotification(status: SubagentStatus, event: string): { message: string; level: "info" | "error" } | undefined {
+  if (!isSubagentState(event) || !isTerminalState(event)) return undefined;
+  return { message: `Subagent ${status.label} ${event}`, level: event === "completed" ? "info" : "error" };
+}
+
+export function isSubagentState(value: string): value is SubagentState {
+  return (SUBAGENT_STATES as readonly string[]).includes(value);
+}
+
 export function elapsedMs(status: Pick<SubagentStatus, "startedAt" | "completedAt">): number {
   const start = Date.parse(status.startedAt);
   const end = status.completedAt ? Date.parse(status.completedAt) : Date.now();

modules/agents/pi/extensions/subagents/supervisor.test.ts

@@ -1,7 +1,9 @@
 import assert from "node:assert/strict";
 import test from "node:test";
+import { milestoneNotification } from "./status.ts";
 import { Supervisor } from "./supervisor.ts";
 import type { ChildHandle, ChildRunner, RunnerEvents, SpawnRequest } from "./types.ts";
+import { widget } from "./ui.ts";
 
 class FakeHandle implements ChildHandle {
   cancelCalls = 0;
@@ -71,6 +73,89 @@ test("runtime timeout reaches timed_out", async () => {
   assert.equal(runner.starts[0].handle.cancelCalls, 1);
 });
 
+test("activity exposes ordered transcript events while status and list keep only summaries", async () => {
+  const runner = new FakeRunner();
+  const supervisor = new Supervisor(runner, "/tmp");
+  const accepted = await spawnStarted(supervisor);
+
+  runner.starts[0].events.running({ type: "message_started", role: "assistant" });
+  runner.starts[0].events.running({
+    type: "message_delta",
+    role: "assistant",
+    assistantMessageEvent: { type: "content_delta", delta: "private transcript body" },
+  });
+  runner.starts[0].events.running({ type: "tool_started", tool: "read", input: { path: "secret-notes.md" } });
+  runner.starts[0].events.running({ type: "tool_completed", tool: "read", output: "secret file contents" });
+
+  type ActivityStatus = ReturnType<Supervisor["status"]> & {
+    activityHistory: Array<{ type: string; summary: string }>;
+    currentActivity: { summary: string };
+  };
+  const activity = supervisor.activity(accepted.id);
+  const status = supervisor.status(accepted.id) as ActivityStatus;
+  const listed = supervisor.list().find((item) => item.id === accepted.id) as ActivityStatus | undefined;
+
+  assert.deepEqual(
+    activity.map((event) => event.type),
+    ["queued", "starting", "prompt accepted", "message_started", "message_delta", "tool_started", "tool_completed"],
+  );
+  assert.deepEqual(activity[4], {
+    type: "message_delta",
+    summary: "assistant message content_delta",
+    at: activity[4].at,
+    role: "assistant",
+    tool: undefined,
+    phase: "content_delta",
+    text: "private transcript body",
+    input: undefined,
+    output: undefined,
+    error: undefined,
+    payload: {
+      type: "message_delta",
+      role: "assistant",
+      assistantMessageEvent: { type: "content_delta", delta: "private transcript body" },
+    },
+  });
+  assert.deepEqual(activity[5], {
+    type: "tool_started",
+    summary: "read secret-notes.md",
+    at: activity[5].at,
+    role: undefined,
+    tool: "read",
+    phase: "started",
+    text: undefined,
+    input: { path: "secret-notes.md" },
+    output: undefined,
+    error: undefined,
+    payload: { type: "tool_started", tool: "read", input: { path: "secret-notes.md" } },
+  });
+  assert.equal(activity[6].output, "secret file contents");
+
+  assert.ok(Array.isArray(status.activityHistory), "status should expose structured activityHistory");
+  assert.deepEqual(status.activityHistory.map((event) => event.type), activity.map((event) => event.type));
+  assert.deepEqual(status.activityHistory.map((event) => event.summary), activity.map((event) => event.summary));
+  assert.equal(status.currentActivity.summary, "read");
+  assert.equal(listed?.currentActivity.summary, "read");
+  assert.doesNotMatch(JSON.stringify(status), /private transcript body|secret file contents/u);
+  assert.doesNotMatch(JSON.stringify(listed), /private transcript body|secret file contents/u);
+});
+
+test("status activity history keeps only the 100 most recent summaries", async () => {
+  const runner = new FakeRunner();
+  const supervisor = new Supervisor(runner, "/tmp");
+  const accepted = await spawnStarted(supervisor);
+
+  for (let index = 0; index < 150; index += 1) {
+    runner.starts[0].events.running(`tick ${index}`);
+  }
+
+  const history = supervisor.status(accepted.id).activityHistory;
+
+  assert.equal(history.length, 100);
+  assert.equal(history[0].summary, "tick 50");
+  assert.equal(history[99].summary, "tick 149");
+});
+
 test("process failure reaches failed with diagnostics", async () => {
   const runner = new FakeRunner();
   const supervisor = new Supervisor(runner, "/tmp");
@@ -110,6 +195,77 @@ test("completed children ignore later cancel", async () => {
   assert.equal(runner.starts[0].handle.cancelCalls, 0);
 });
 
+test("explicit labels are reused across accepted status list and result surfaces", async () => {
+  const runner = new FakeRunner();
+  const supervisor = new Supervisor(runner, "/tmp");
+  const label = "Review risky migration";
+
+  const accepted = supervisor.spawn({ prompt: "inspect the migration plan", label } as SpawnRequest & { label: string });
+  await sleep(0);
+  runner.starts[0].events.completed("done", "agent_settled");
+
+  assert.deepEqual(
+    {
+      accepted: accepted.label,
+      status: supervisor.status(accepted.id).label,
+      list: supervisor.list().find((status) => status.id === accepted.id)?.label,
+      result: (supervisor.result(accepted.id) as { label?: string }).label,
+    },
+    {
+      accepted: label,
+      status: label,
+      list: label,
+      result: label,
+    },
+  );
+});
+
+test("ad hoc fallback labels are prompt-derived and reused by widget and result surfaces", async () => {
+  const runner = new FakeRunner();
+  const supervisor = new Supervisor(runner, "/tmp");
+  const prompt = "  Audit\n\tguest enablement plan  ";
+  const label = "Audit guest enablement plan";
+
+  const accepted = supervisor.spawn({ prompt });
+  await sleep(0);
+  runner.starts[0].events.completed("done", "agent_settled");
+  const statuses = supervisor.list();
+  const inspectorLines = widget(statuses, true)().render(240);
+
+  assert.deepEqual(
+    {
+      accepted: accepted.label,
+      childRequest: runner.starts[0].request.label,
+      status: supervisor.status(accepted.id).label,
+      list: statuses.find((status) => status.id === accepted.id)?.label,
+      result: supervisor.result(accepted.id).label,
+    },
+    {
+      accepted: label,
+      childRequest: label,
+      status: label,
+      list: label,
+      result: label,
+    },
+  );
+  assert.ok(inspectorLines.some((line) => line.includes(`completed 0s ${label} result: available`)), inspectorLines.join("\n"));
+  assert.doesNotMatch(accepted.label, /^ad-hoc sg-/u);
+});
+
+test("milestone notifications use the stored label", async () => {
+  const runner = new FakeRunner();
+  const supervisor = new Supervisor(runner, "/tmp");
+  const accepted = supervisor.spawn({ prompt: "work", label: "Review migration" });
+  await sleep(0);
+  runner.starts[0].events.completed("done", "agent_settled");
+
+  assert.deepEqual(milestoneNotification(supervisor.status(accepted.id), "completed"), {
+    message: "Subagent Review migration completed",
+    level: "info",
+  });
+  assert.equal(milestoneNotification(supervisor.status(accepted.id), "running"), undefined);
+});
+
 test("shutdown clears recent terminal expiry timer", async () => {
   const runner = new FakeRunner();
   let changes = 0;
@@ -128,17 +284,22 @@ test("shutdown clears recent terminal expiry timer", async () => {
   assert.equal(changes, afterShutdown);
 });
 
-test("batch spawn returns accepted ids and per-entry failures", async () => {
+test("batch spawn returns explicit labels on accepted child requests and statuses while preserving failures", async () => {
   const runner = new FakeRunner();
   const supervisor = new Supervisor(runner, "/tmp");
 
-  const result = supervisor.spawnBatch([{ prompt: "one" }, { prompt: "" }, { prompt: "two" }]);
+  const result = supervisor.spawnBatch([
+    { prompt: "one", label: "Review docs" },
+    { prompt: "" },
+    { prompt: "two", label: "Check tests" },
+  ]);
   await sleep(0);
 
-  assert.equal(result.accepted.length, 2);
+  assert.deepEqual(result.accepted.map((accepted) => accepted.label), ["Review docs", "Check tests"]);
   assert.equal(result.failed.length, 1);
   assert.equal(result.failed[0].index, 1);
-  assert.equal(runner.starts.length, 2);
+  assert.deepEqual(runner.starts.map((start) => start.request.label), ["Review docs", "Check tests"]);
+  assert.deepEqual(result.accepted.map((accepted) => supervisor.status(accepted.id).label), ["Review docs", "Check tests"]);
 });
 
 test("maxConcurrent preserves queued records", async () => {
@@ -158,58 +319,60 @@ test("maxConcurrent preserves queued records", async () => {
   assert.equal(runner.starts.length, 2);
 });
 
-test("recent terminal statuses expire from list by ttl", async () => {
+test("clearTerminal returns only removed terminal ids", async () => {
+  const runner = new FakeRunner();
+  const supervisor = new Supervisor(runner, "/tmp");
+  const first = await spawnStarted(supervisor, "one");
+  const second = await spawnStarted(supervisor, "two");
+  const running = await spawnStarted(supervisor, "three");
+
+  runner.starts[0].events.completed("one done", "agent_settled");
+  runner.starts[1].events.completed("two done", "agent_settled");
+
+  assert.deepEqual(supervisor.clearTerminal(), [first.id, second.id]);
+  assert.throws(() => supervisor.status(first.id), /unknown subagent id/);
+  assert.throws(() => supervisor.status(second.id), /unknown subagent id/);
+  assert.equal(supervisor.status(running.id).state, "running");
+});
+
+test("terminal records expire after ttl while active children remain", async () => {
   const runner = new FakeRunner();
   const supervisor = new Supervisor(runner, "/tmp", { recentTerminalTtlMs: 5 });
-  const accepted = await spawnStarted(supervisor);
+  const completed = await spawnStarted(supervisor, "one");
+  const failed = await spawnStarted(supervisor, "two");
+  const running = await spawnStarted(supervisor, "three");
 
-  runner.starts[0].events.completed("done", "agent_settled");
-  assert.equal(supervisor.list().some((status) => status.id === accepted.id), true);
+  runner.starts[0].events.completed("one done", "agent_settled");
+  runner.starts[1].events.failed("two failed");
 
-  await sleep(10);
+  assert.equal(supervisor.result(completed.id).result, "one done");
+  assert.equal(supervisor.result(failed.id).error, "two failed");
+  assert.equal(supervisor.status(running.id).state, "running");
 
-  assert.equal(supervisor.list().some((status) => status.id === accepted.id), false);
-  assert.equal(supervisor.result(accepted.id).result, "done");
+  await sleep(20);
+
+  const listedIds = supervisor.list().map((status) => status.id);
+  assert.equal(listedIds.includes(completed.id), false);
+  assert.equal(listedIds.includes(failed.id), false);
+  assert.equal(listedIds.includes(running.id), true);
+  assert.throws(() => supervisor.status(completed.id), /unknown subagent id/);
+  assert.throws(() => supervisor.status(failed.id), /unknown subagent id/);
+  assert.throws(() => supervisor.result(completed.id), /unknown subagent id/);
+  assert.throws(() => supervisor.result(failed.id), /unknown subagent id/);
+  assert.equal(supervisor.status(running.id).state, "running");
 });
 
-test("recent terminal ttl does not hide active statuses", async () => {
-  const runner = new FakeRunner();
-  const supervisor = new Supervisor(runner, "/tmp", { recentTerminalTtlMs: 0 });
-  const accepted = await spawnStarted(supervisor);
-
-  assert.equal(supervisor.list().some((status) => status.id === accepted.id), true);
-});
-
-test("zero recent terminal ttl hides terminal statuses immediately", async () => {
+test("zero recent terminal ttl does not hide terminal statuses", async () => {
   const runner = new FakeRunner();
   const supervisor = new Supervisor(runner, "/tmp", { recentTerminalTtlMs: 0 });
   const accepted = await spawnStarted(supervisor);
 
   runner.starts[0].events.completed("done", "agent_settled");
 
-  assert.equal(supervisor.list().some((status) => status.id === accepted.id), false);
+  assert.equal(supervisor.list().some((status) => status.id === accepted.id), true);
   assert.equal(supervisor.result(accepted.id).result, "done");
 });
 
-test("recent terminal ttl emits a change when an entry expires", async () => {
-  const runner = new FakeRunner();
-  let changes = 0;
-  const supervisor = new Supervisor(runner, "/tmp", {
-    recentTerminalTtlMs: 5,
-    onChange: () => {
-      changes += 1;
-    },
-  });
-  await spawnStarted(supervisor);
-  const beforeComplete = changes;
-
-  runner.starts[0].events.completed("done", "agent_settled");
-  await sleep(15);
-
-  assert.ok(changes > beforeComplete + 1);
-  assert.equal(supervisor.list().length, 0);
-});
-
 test("wait blocks until multiple subagents are terminal", async () => {
   const runner = new FakeRunner();
   const supervisor = new Supervisor(runner, "/tmp");

modules/agents/pi/extensions/subagents/supervisor.ts

@@ -3,6 +3,7 @@ import type {
   ChildRecord,
   ChildRunner,
   ContextMode,
+  RunnerActivity,
   RunnerEvents,
   SpawnAccepted,
   SpawnRequest,
@@ -11,7 +12,7 @@ import type {
   SubagentWaitMode,
   SubagentWaitResult,
 } from "./types.ts";
-import { cloneResult, cloneStatus, toAccepted } from "./status.ts";
+import { cloneResult, cloneStatus, isTerminalState, toAccepted } from "./status.ts";
 
 interface RunningChild {
   record: ChildRecord;
@@ -19,6 +20,7 @@ interface RunningChild {
   handle?: ChildHandle;
   startTimer?: ReturnType<typeof setTimeout>;
   runTimer?: ReturnType<typeof setTimeout>;
+  expiryTimer?: ReturnType<typeof setTimeout>;
 }
 
 interface SupervisorOptions {
@@ -43,12 +45,13 @@ const DEFAULT_TIMEOUTS = {
   runMs: 0,
 };
 
+const MAX_ACTIVITY_HISTORY = 100;
+
 export class Supervisor {
   private nextChild = 0;
   private readonly children = new Map<string, RunningChild>();
   private readonly queue: RunningChild[] = [];
   private readonly waiters = new Set<() => void>();
-  private recentTerminalTimer?: ReturnType<typeof setTimeout>;
 
   constructor(
     private readonly runner: ChildRunner,
@@ -78,9 +81,7 @@ export class Supervisor {
     const active = statuses.filter((status) => !isTerminal(status.state));
     const terminal = statuses
       .filter((status) => isTerminal(status.state))
-      .filter((status) => this.isRecentTerminal(status))
-      .sort((a, b) => Date.parse(b.completedAt ?? b.startedAt) - Date.parse(a.completedAt ?? a.startedAt))
-      .slice(0, this.options.recentTerminalLimit ?? 10);
+      .sort((a, b) => Date.parse(b.completedAt ?? b.startedAt) - Date.parse(a.completedAt ?? a.startedAt));
     return [...active, ...terminal];
   }
 
@@ -92,6 +93,21 @@ export class Supervisor {
     return cloneResult(this.require(id).record);
   }
 
+  clearTerminal(ids?: string[]): string[] {
+    const selectedIds = ids ? [...new Set(ids.map((id) => id.trim()).filter(Boolean))] : undefined;
+    if (selectedIds) for (const id of selectedIds) this.require(id);
+    const cleared: string[] = [];
+    for (const [id, child] of this.children) {
+      if (selectedIds && !selectedIds.includes(id)) continue;
+      if (!isTerminal(child.record.status.state)) continue;
+      this.clearTimer(child, "expiryTimer");
+      cleared.push(id);
+      this.children.delete(id);
+    }
+    if (cleared.length > 0) this.emitChange();
+    return cleared;
+  }
+
   async wait(
     ids: string[],
     options: { timeoutMs?: number; signal?: AbortSignal; mode?: SubagentWaitMode } = {},
@@ -137,7 +153,6 @@ export class Supervisor {
   }
 
   async shutdown(): Promise<void> {
-    this.clearRecentTerminalTimer();
     await Promise.allSettled(
       [...this.children.values()].map(async (child) => {
         if (!isTerminal(child.record.status.state)) {
@@ -146,7 +161,7 @@ export class Supervisor {
         }
       }),
     );
-    this.clearRecentTerminalTimer();
+    for (const child of this.children.values()) this.clearTimer(child, "expiryTimer");
   }
 
   private createChild(request: SpawnRequest): SpawnAccepted {
@@ -157,7 +172,7 @@ export class Supervisor {
     const now = new Date().toISOString();
     const status: SubagentStatus = {
       id,
-      label: request.agent ?? `ad-hoc ${id}`,
+      label: deriveLabel(request, id),
       agent: request.agent,
       adHoc: !request.agent,
       context: this.resolveContext(request.context),
@@ -170,9 +185,11 @@ export class Supervisor {
       elapsedMs: 0,
       lastEvent: "queued",
       lastEventAt: now,
+      currentActivity: { type: "queued", summary: "queued", at: now },
+      activityHistory: [{ type: "queued", summary: "queued", at: now }],
       resultAvailable: false,
     };
-    const child: RunningChild = { record: { status }, request: { ...request, prompt, context: status.context, tools: status.tools } };
+    const child: RunningChild = { record: { status, activityEvents: [{ type: "queued", summary: "queued", at: now }] }, request: { ...request, prompt, label: status.label, context: status.context, tools: status.tools } };
     this.children.set(id, child);
     this.emitMilestone(child, "accepted");
     this.queue.push(child);
@@ -233,9 +250,13 @@ export class Supervisor {
         record.status.completedAt = now;
         record.status.lastEvent = "completed";
         record.status.lastEventAt = now;
+        this.recordActivity(record, "completed", now);
         record.status.stopReason = stopReason;
         record.status.resultAvailable = true;
-        if (child) this.emitMilestone(child, "completed");
+        if (child) {
+          this.armTerminalExpiry(child);
+          this.emitMilestone(child, "completed");
+        }
         this.pumpQueue();
       },
       failed: (error) => this.fail(record, error),
@@ -251,9 +272,13 @@ export class Supervisor {
     record.status.completedAt = now;
     record.status.lastEvent = "failed";
     record.status.lastEventAt = now;
+    this.recordActivity(record, "failed", now);
     record.status.error = error;
     record.status.stopReason = "failed";
-    if (child) this.emitMilestone(child, "failed");
+    if (child) {
+      this.armTerminalExpiry(child);
+      this.emitMilestone(child, "failed");
+    }
     this.pumpQueue();
   }
 
@@ -265,7 +290,9 @@ export class Supervisor {
     child.record.status.completedAt = now;
     child.record.status.lastEvent = state;
     child.record.status.lastEventAt = now;
+    this.recordActivity(child.record, state, now);
     child.record.status.stopReason = reason;
+    this.armTerminalExpiry(child);
     this.emitMilestone(child, state);
   }
 
@@ -292,12 +319,26 @@ export class Supervisor {
     this.pumpQueue();
   }
 
+  private armTerminalExpiry(child: RunningChild) {
+    const ttl = this.options.recentTerminalTtlMs;
+    if (ttl === undefined || ttl <= 0) return;
+    this.clearTimer(child, "expiryTimer");
+    child.expiryTimer = setTimeout(() => {
+      child.expiryTimer = undefined;
+      const id = child.record.status.id;
+      if (this.children.get(id) !== child || !isTerminal(child.record.status.state)) return;
+      this.children.delete(id);
+      this.emitChange();
+    }, ttl);
+    child.expiryTimer.unref?.();
+  }
+
   private clearTimers(child: RunningChild) {
     this.clearTimer(child, "startTimer");
     this.clearTimer(child, "runTimer");
   }
 
-  private clearTimer(child: RunningChild, key: "startTimer" | "runTimer") {
+  private clearTimer(child: RunningChild, key: "startTimer" | "runTimer" | "expiryTimer") {
     const timer = child[key];
     if (!timer) return;
     clearTimeout(timer);
@@ -308,15 +349,33 @@ export class Supervisor {
     return [...this.children.values()].find((child) => child.record === record);
   }
 
-  private setState(status: SubagentStatus, state: SubagentStatus["state"], event: string) {
+  activity(id: string) {
+    return this.require(id).record.activityEvents.map((event) => ({ ...event }));
+  }
+
+  private setState(status: SubagentStatus, state: SubagentStatus["state"], event: RunnerActivity) {
     if (isTerminal(status.state)) return;
+    const record = this.require(status.id).record;
     const now = new Date().toISOString();
+    const activity = this.recordActivity(record, event, now);
     status.state = state;
-    status.lastEvent = event;
+    status.lastEvent = activity.type;
     status.lastEventAt = now;
     this.emitChange();
   }
 
+  private recordActivity(record: ChildRecord, event: RunnerActivity, at: string) {
+    const activity = normalizeActivity(event, at);
+    record.activityEvents.push(activity);
+    const summary = summarizeActivity(activity);
+    record.status.currentActivity = summary;
+    record.status.activityHistory.push(summary);
+    if (record.status.activityHistory.length > MAX_ACTIVITY_HISTORY) {
+      record.status.activityHistory.splice(0, record.status.activityHistory.length - MAX_ACTIVITY_HISTORY);
+    }
+    return activity;
+  }
+
   private require(id: string): RunningChild {
     const child = this.children.get(id);
     if (!child) throw new Error(`unknown subagent id: ${id}`);
@@ -345,39 +404,6 @@ export class Supervisor {
   private emitChange() {
     this.options.onChange?.(this.list());
     for (const waiter of this.waiters) waiter();
-    this.scheduleRecentTerminalExpiry();
-  }
-
-  private scheduleRecentTerminalExpiry() {
-    this.clearRecentTerminalTimer();
-    const ttl = this.options.recentTerminalTtlMs;
-    if (ttl === undefined || ttl <= 0) return;
-    const now = Date.now();
-    const nextExpiryMs = [...this.children.values()]
-      .map((child) => child.record.status)
-      .filter((status) => isTerminal(status.state))
-      .map((status) => Date.parse(status.completedAt ?? status.startedAt))
-      .filter((completed) => Number.isFinite(completed))
-      .map((completed) => completed + ttl - now)
-      .filter((remaining) => remaining > 0)
-      .sort((a, b) => a - b)[0];
-    if (nextExpiryMs === undefined) return;
-    this.recentTerminalTimer = setTimeout(() => this.emitChange(), nextExpiryMs + 1);
-  }
-
-  private clearRecentTerminalTimer() {
-    if (!this.recentTerminalTimer) return;
-    clearTimeout(this.recentTerminalTimer);
-    this.recentTerminalTimer = undefined;
-  }
-
-  private isRecentTerminal(status: SubagentStatus): boolean {
-    const ttl = this.options.recentTerminalTtlMs;
-    if (ttl === undefined) return true;
-    if (ttl <= 0) return false;
-    const completed = Date.parse(status.completedAt ?? status.startedAt);
-    if (!Number.isFinite(completed)) return true;
-    return Date.now() - completed <= ttl;
   }
 
   private waitReady(ids: string[], mode: SubagentWaitMode): boolean {
@@ -418,6 +444,115 @@ export class Supervisor {
   }
 }
 
-function isTerminal(state: SubagentStatus["state"]): boolean {
-  return ["completed", "failed", "cancelled", "timed_out", "orphaned"].includes(state);
+function deriveLabel(request: SpawnRequest, id: string): string {
+  const explicit = normalizeLabel(request.label);
+  if (explicit) return explicit;
+  const agent = normalizeLabel(request.agent);
+  if (agent) return agent;
+  return promptLabel(request.prompt) ?? `ad-hoc ${id}`;
+}
+
+function promptLabel(prompt: string): string | undefined {
+  const normalized = normalizeLabel(prompt);
+  if (!normalized) return undefined;
+  return truncateLabel(normalized);
+}
+
+function normalizeLabel(value: unknown): string | undefined {
+  if (typeof value !== "string") return undefined;
+  const normalized = value.replace(/\s+/gu, " ").trim();
+  return normalized || undefined;
+}
+
+function truncateLabel(label: string): string {
+  const maxLength = 80;
+  if (label.length <= maxLength) return label;
+  return `${label.slice(0, maxLength - 1).trimEnd()}…`;
+}
+
+function isTerminal(state: SubagentStatus["state"]): boolean {
+  return isTerminalState(state);
+}
+
+function normalizeActivity(event: RunnerActivity, at: string) {
+  if (typeof event === "string") return { type: event, summary: event, at };
+  const type = typeof event.type === "string" ? event.type : "activity";
+  const role = typeof event.role === "string" ? event.role : undefined;
+  const tool = toolFromActivity(event);
+  const phase = typeof event.phase === "string" ? event.phase : phaseFromType(type, event);
+  const text = textFromActivity(event);
+  const input = inputFromActivity(event);
+  const output = "output" in event ? event.output : "result" in event ? event.result : "partialResult" in event ? event.partialResult : undefined;
+  const error = typeof event.error === "string" ? event.error : undefined;
+  return { type, summary: summaryFor({ type, role, tool, phase, input, output, error }), at, role, tool, phase, text, input, output, error, payload: { ...event } };
+}
+
+function summarizeActivity(activity: ReturnType<typeof normalizeActivity>) {
+  const { type, summary, at, role, tool, phase } = activity;
+  return { type, summary, at, role, tool, phase };
+}
+
+function toolFromActivity(event: Record<string, unknown>): string | undefined {
+  for (const key of ["tool", "toolName", "name"]) {
+    const value = event[key];
+    if (typeof value === "string") return value;
+  }
+  return undefined;
+}
+
+function phaseFromType(type: string, event: Record<string, unknown>): string | undefined {
+  const assistantEvent = event.assistantMessageEvent;
+  if (assistantEvent && typeof assistantEvent === "object" && !Array.isArray(assistantEvent)) {
+    const assistantType = (assistantEvent as { type?: unknown }).type;
+    if (typeof assistantType === "string") return assistantType;
+  }
+  if (type.endsWith("_start")) return "started";
+  if (type.endsWith("_started")) return "started";
+  if (type.endsWith("_update")) return "update";
+  if (type.endsWith("_delta")) return "delta";
+  if (type.endsWith("_end")) return "completed";
+  if (type.endsWith("_completed")) return "completed";
+  if (type.endsWith("_failed")) return "failed";
+  return undefined;
+}
+
+function textFromActivity(event: Record<string, unknown>): string | undefined {
+  for (const key of ["text", "body", "content", "delta"]) {
+    const value = event[key];
+    if (typeof value === "string") return value;
+  }
+  const assistantEvent = event.assistantMessageEvent;
+  if (assistantEvent && typeof assistantEvent === "object" && !Array.isArray(assistantEvent)) {
+    for (const key of ["delta", "content"]) {
+      const value = (assistantEvent as Record<string, unknown>)[key];
+      if (typeof value === "string") return value;
+    }
+  }
+  return undefined;
+}
+
+function inputFromActivity(event: Record<string, unknown>): unknown {
+  if ("input" in event) return event.input;
+  if ("args" in event) return event.args;
+  return undefined;
+}
+
+function summaryFor(activity: { type: string; role?: string; tool?: string; phase?: string; input?: unknown; output?: unknown; error?: string }): string {
+  if (activity.error) return `${activity.tool ?? activity.type} failed: ${activity.error}`;
+  if (activity.tool) return `${activity.tool}${inputHint(activity.input)}`;
+  if (activity.type.startsWith("message")) return `${activity.role ?? "assistant"} message${activity.phase ? ` ${activity.phase}` : ""}`;
+  return activity.type;
+}
+
+function inputHint(input: unknown): string {
+  if (!input || typeof input !== "object" || Array.isArray(input)) return "";
+  const path = (input as { path?: unknown }).path;
+  if (typeof path === "string" && path.trim()) return ` ${path.trim()}`;
+  const command = (input as { command?: unknown }).command;
+  if (typeof command === "string" && command.trim()) return ` ${truncateActivityHint(command.trim())}`;
+  return "";
+}
+
+function truncateActivityHint(value: string): string {
+  return value.length <= 80 ? value : `${value.slice(0, 79).trimEnd()}…`;
 }

modules/agents/pi/extensions/subagents/types.ts

@@ -1,15 +1,9 @@
 export type ContextMode = "independent" | "fork";
 
-export type SubagentState =
-  | "queued"
-  | "starting"
-  | "running"
-  | "settling"
-  | "completed"
-  | "failed"
-  | "cancelled"
-  | "timed_out"
-  | "orphaned";
+export const SUBAGENT_STATES = ["queued", "starting", "running", "settling", "completed", "failed", "cancelled", "timed_out", "orphaned"] as const;
+export const SUBAGENT_TERMINAL_STATES = ["completed", "failed", "cancelled", "timed_out", "orphaned"] as const;
+
+export type SubagentState = (typeof SUBAGENT_STATES)[number];
 
 export interface ToolProfile {
   activeTools: string[] | null;
@@ -17,6 +11,7 @@ export interface ToolProfile {
 
 export interface SpawnRequest {
   prompt: string;
+  label?: string;
   context?: ContextMode;
   agent?: string;
   model?: string;
@@ -36,6 +31,27 @@ export interface SpawnAccepted {
   hint: string;
 }
 
+export interface SubagentActivitySummary {
+  type: string;
+  summary: string;
+  at: string;
+  role?: string;
+  tool?: string;
+  phase?: string;
+}
+
+export interface SubagentActivityEvent extends SubagentActivitySummary {
+  text?: string;
+  input?: unknown;
+  output?: unknown;
+  error?: string;
+  payload?: Record<string, unknown>;
+}
+
+export interface SubagentCurrentActivity extends SubagentActivitySummary {}
+
+export type RunnerActivity = string | Record<string, unknown>;
+
 export interface SubagentStatus {
   id: string;
   label: string;
@@ -52,6 +68,8 @@ export interface SubagentStatus {
   elapsedMs: number;
   lastEvent?: string;
   lastEventAt?: string;
+  currentActivity?: SubagentCurrentActivity;
+  activityHistory: SubagentActivitySummary[];
   stopReason?: string;
   resultAvailable: boolean;
   childSession?: string;
@@ -60,6 +78,7 @@ export interface SubagentStatus {
 
 export interface SubagentResult {
   id: string;
+  label: string;
   state: SubagentState;
   running: boolean;
   resultAvailable: boolean;
@@ -83,12 +102,13 @@ export interface SubagentWaitResult {
 
 export interface ChildRecord {
   status: SubagentStatus;
+  activityEvents: SubagentActivityEvent[];
   result?: string;
 }
 
 export interface RunnerEvents {
   accepted(childSession?: string): void;
-  running(event: string): void;
+  running(event: RunnerActivity): void;
   settling(): void;
   completed(result: string, stopReason?: string): void;
   failed(error: string): void;

modules/agents/pi/extensions/subagents/ui.test.ts

@@ -0,0 +1,89 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import type { SubagentState, SubagentStatus } from "./types.ts";
+import { renderInspector, renderSummary, widget } from "./ui.ts";
+
+function status(overrides: Partial<SubagentStatus> & { id: string; label: string; state: SubagentState }): SubagentStatus {
+  return {
+    adHoc: true,
+    context: "independent",
+    cwd: "/tmp",
+    elapsedMs: 0,
+    activityHistory: [],
+    resultAvailable: false,
+    startedAt: "2026-08-01T00:00:00.000Z",
+    tools: "inherit",
+    ...overrides,
+  };
+}
+
+test("compact monitor aggregates visible children by actionable lifecycle group", () => {
+  assert.deepEqual(renderSummary([]), []);
+
+  assert.deepEqual(
+    renderSummary([
+      status({ id: "queued", label: "Queued", state: "queued" }),
+      status({ id: "starting", label: "Starting", state: "starting" }),
+      status({ id: "running", label: "Running", state: "running" }),
+      status({ id: "settling", label: "Settling", state: "settling" }),
+      status({ id: "completed", label: "Completed", state: "completed", resultAvailable: true }),
+      status({ id: "failed", label: "Failed", state: "failed", error: "boom" }),
+      status({ id: "timed-out", label: "Timed out", state: "timed_out" }),
+      status({ id: "cancelled", label: "Cancelled", state: "cancelled" }),
+    ]),
+    ["subagents: queued 1 · running 2 · settling 1 · completed 1 · failed 1 · timed out 1 · cancelled 1"],
+  );
+});
+
+test("expanded monitor shows concise current activity summaries instead of raw event types", () => {
+  const rendered = widget([
+    status({
+      id: "sg-reading",
+      label: "Audit guest enablement plan",
+      state: "running",
+      elapsedMs: 12_000,
+      lastEvent: "message_update",
+      currentActivity: {
+        type: "message_update",
+        summary: "read secret-notes.md",
+        at: "2026-08-01T00:00:12.000Z",
+      },
+    }),
+  ], true)().render(240);
+
+  assert.deepEqual(rendered, ["▶ running   12s Audit guest enablement plan last: read secret-notes.md"]);
+  assert.doesNotMatch(rendered.join("\n"), /message_update|private transcript body/u);
+});
+
+test("expanded monitor renders one truncated row per child with state, elapsed time, and activity marker", () => {
+  const lines = renderInspector([
+    status({
+      id: "sg-running",
+      label: "Audit unusually verbose guest enablement migration plan",
+      state: "running",
+      elapsedMs: 65_000,
+      lastEvent: "message_update",
+    }),
+    status({
+      id: "sg-completed",
+      label: "Summarize review",
+      state: "completed",
+      elapsedMs: 3_600_000,
+      lastEvent: "completed",
+      resultAvailable: true,
+    }),
+    status({ id: "sg-failed", label: "Run risky test", state: "failed", elapsedMs: 2_000, error: "exit 1" }),
+  ]);
+
+  assert.equal(lines.length, 3);
+  assert.match(lines[0], /^▶ running +1m05s +Audit unusually verbose guest enablement migration plan +last: message_update$/u);
+  assert.equal(lines[1], "✓ completed 1h00m00s Summarize review result: available");
+  assert.equal(lines[2], "✗ failed    2s Run risky test error: exit 1");
+
+  const rendered = widget([
+    status({ id: "sg-running", label: "Audit unusually verbose guest enablement migration plan", state: "running", elapsedMs: 65_000, lastEvent: "message_update" }),
+  ], true)().render(32);
+
+  assert.deepEqual(rendered, ["▶ running   1m05s Audit unusual…"]);
+  assert.ok(rendered.every((line) => line.length <= 32));
+});

modules/agents/pi/extensions/subagents/ui.ts

@@ -1,28 +1,81 @@
-import type { SubagentStatus } from "./types.ts";
+import type { SubagentState, SubagentStatus } from "./types.ts";
+
+const COMPACT_GROUPS: Array<{ label: string; states: SubagentState[] }> = [
+  { label: "queued", states: ["queued"] },
+  { label: "running", states: ["starting", "running"] },
+  { label: "settling", states: ["settling"] },
+  { label: "completed", states: ["completed"] },
+  { label: "failed", states: ["failed"] },
+  { label: "timed out", states: ["timed_out"] },
+  { label: "cancelled", states: ["cancelled"] },
+  { label: "orphaned", states: ["orphaned"] },
+];
+
+const STATE_PRESENTATION: Record<SubagentState, { icon: string; label: string }> = {
+  queued: { icon: "…", label: "queued" },
+  starting: { icon: "◌", label: "starting" },
+  running: { icon: "▶", label: "running" },
+  settling: { icon: "◒", label: "settling" },
+  completed: { icon: "✓", label: "completed" },
+  failed: { icon: "✗", label: "failed" },
+  cancelled: { icon: "■", label: "cancelled" },
+  timed_out: { icon: "⏱", label: "timed out" },
+  orphaned: { icon: "?", label: "orphaned" },
+};
 
 export function renderSummary(statuses: SubagentStatus[]): string[] {
-  const running = statuses.filter((status) => ["starting", "running", "settling"].includes(status.state)).length;
-  const queued = statuses.filter((status) => status.state === "queued").length;
-  const terminal = statuses.filter((status) => ["completed", "failed", "cancelled", "timed_out", "orphaned"].includes(status.state)).length;
-  if (running === 0 && queued === 0 && terminal === 0) return [];
-  return [`subagents: ${running} running · ${queued} queued · ${terminal} recent`];
+  const groups = COMPACT_GROUPS.map((group) => ({
+    label: group.label,
+    count: statuses.filter((status) => group.states.includes(status.state)).length,
+  })).filter((group) => group.count > 0);
+
+  if (groups.length === 0) return [];
+  return [`subagents: ${groups.map((group) => `${group.label} ${group.count}`).join(" · ")}`];
 }
 
 export function renderInspector(statuses: SubagentStatus[]): string[] {
-  const lines = renderSummary(statuses);
-  for (const status of statuses) {
-    lines.push(
-      `${status.id} ${status.label} ${status.context} ${status.state} ${Math.round(status.elapsedMs / 1000)}s ${status.model ?? "inherit"} ${status.tools} ${status.lastEvent ?? "none"} result:${status.resultAvailable ? "yes" : "no"}`,
-    );
-  }
-  return lines;
+  return statuses.map((status) => renderStatusRow(status));
 }
 
 export function widget(statuses: SubagentStatus[], expanded: boolean) {
   return () => ({
     invalidate() {},
     render(width: number) {
-      return (expanded ? renderInspector(statuses) : renderSummary(statuses)).map((line) => (line.length > width ? line.slice(0, Math.max(0, width - 1)) : line));
+      return (expanded ? renderInspector(statuses) : renderSummary(statuses)).map((line) => truncateLine(line, width));
     },
   });
 }
+
+function renderStatusRow(status: SubagentStatus): string {
+  const presentation = STATE_PRESENTATION[status.state];
+  const marker = statusMarker(status);
+  return `${presentation.icon} ${presentation.label.padEnd(9)} ${formatDuration(status.elapsedMs)} ${status.label}${marker ? ` ${marker}` : ""}`;
+}
+
+function statusMarker(status: SubagentStatus): string | undefined {
+  if (status.error) return `error: ${status.error}`;
+  if (status.resultAvailable) return "result: available";
+  if (status.currentActivity) return `last: ${status.currentActivity.summary}`;
+  if (status.lastEvent) return `last: ${status.lastEvent}`;
+  if (status.state === "queued") return "waiting";
+  if (status.state === "settling") return "settling";
+  return undefined;
+}
+
+function formatDuration(elapsedMs: number): string {
+  const totalSeconds = Math.max(0, Math.round(elapsedMs / 1000));
+  const hours = Math.floor(totalSeconds / 3600);
+  const minutes = Math.floor((totalSeconds % 3600) / 60);
+  const seconds = totalSeconds % 60;
+
+  if (hours > 0) return `${hours}h${String(minutes).padStart(2, "0")}m${String(seconds).padStart(2, "0")}s`;
+  if (minutes > 0) return `${minutes}m${String(seconds).padStart(2, "0")}s`;
+  return `${seconds}s`;
+}
+
+function truncateLine(line: string, width: number): string {
+  if (width <= 0) return "";
+  if (line.length <= width) return line;
+  if (width === 1) return "…";
+  return `${line.slice(0, width - 1)}…`;
+}

modules/agents/pi/patches/pi-flex-spacer.patch

@@ -0,0 +1,171 @@
+diff --git a/packages/tui/src/tui.ts b/packages/tui/src/tui.ts
+--- a/packages/tui/src/tui.ts	2026-08-02 00:16:00.000000000 -0400
++++ b/packages/tui/src/tui.ts	2026-08-02 00:16:00.000000000 -0400
+@@ -310,7 +310,7 @@ export class TUI extends Container {
+ 	private cursorRow = 0; // Logical cursor row (end of rendered content)
+ 	private hardwareCursorRow = 0; // Actual terminal cursor row (may differ due to IME positioning)
+ 	private showHardwareCursor = process.env.PI_HARDWARE_CURSOR === "1";
+-	private clearOnShrink = process.env.PI_CLEAR_ON_SHRINK === "1"; // Clear empty rows when content shrinks (default: off)
++	private clearOnShrink = process.env.PI_CLEAR_ON_SHRINK !== "0"; // Clear empty rows when content shrinks (default: on)
+ 	private maxLinesRendered = 0; // Track terminal's working area (max lines ever rendered)
+ 	private previousViewportTop = 0; // Track previous viewport top for resize-aware cursor moves
+ 	private fullRedrawCount = 0;
+
+diff --git a/packages/coding-agent/src/core/settings-manager.ts b/packages/coding-agent/src/core/settings-manager.ts
+--- a/packages/coding-agent/src/core/settings-manager.ts	2026-08-02 00:34:00.000000000 -0400
++++ b/packages/coding-agent/src/core/settings-manager.ts	2026-08-02 00:34:00.000000000 -0400
+@@ -1093,11 +1093,11 @@ export class SettingsManager {
+ 	}
+ 
+ 	getClearOnShrink(): boolean {
+-		// Settings takes precedence, then env var, then default false
++		// Settings takes precedence, then env var, then default true
+ 		if (this.settings.terminal?.clearOnShrink !== undefined) {
+ 			return this.settings.terminal.clearOnShrink;
+ 		}
+-		return process.env.PI_CLEAR_ON_SHRINK === "1";
++		return process.env.PI_CLEAR_ON_SHRINK !== "0";
+ 	}
+ 
+ 	setClearOnShrink(enabled: boolean): void {
+
+diff --git a/packages/coding-agent/src/modes/interactive/interactive-mode.ts b/packages/coding-agent/src/modes/interactive/interactive-mode.ts
+--- a/packages/coding-agent/src/modes/interactive/interactive-mode.ts	2026-08-01 18:41:36.963495957 -0400
++++ b/packages/coding-agent/src/modes/interactive/interactive-mode.ts	2026-08-01 18:43:04.876341236 -0400
+@@ -210,6 +210,47 @@
+ 	return code !== undefined && DEAD_TERMINAL_ERROR_CODES.has(code);
+ }
+ 
++class FlexSpacerBottomLayout implements Component {
++	private readonly ui: TUI;
++	private readonly flowChildren: Component[];
++	private readonly pinnedChildren: Component[];
++
++	constructor(ui: TUI, flowChildren: Component[], pinnedChildren: Component[]) {
++		this.ui = ui;
++		this.flowChildren = flowChildren;
++		this.pinnedChildren = pinnedChildren;
++	}
++
++	invalidate(): void {
++		for (const child of [...this.flowChildren, ...this.pinnedChildren]) {
++			child.invalidate();
++		}
++	}
++
++	private renderGroup(children: Component[], width: number): string[] {
++		const lines: string[] = [];
++		for (const child of children) {
++			for (const line of child.render(width)) {
++				lines.push(line);
++			}
++		}
++		return lines;
++	}
++
++	render(width: number): string[] {
++		const flowLines = this.renderGroup(this.flowChildren, width);
++		const pinnedLines = this.renderGroup(this.pinnedChildren, width);
++		const terminalRows = this.ui.terminal.rows;
++		const spacerRows = Math.max(0, terminalRows - flowLines.length - pinnedLines.length);
++
++		return [
++			...flowLines,
++			...Array.from({ length: spacerRows }, () => ""),
++			...pinnedLines,
++		];
++	}
++}
++
+ const ANTHROPIC_SUBSCRIPTION_AUTH_WARNING =
+ 	"Anthropic subscription auth is active. Third-party harness usage draws from extra usage and is billed per token, not your Claude plan limits. Manage extra usage at https://claude.ai/settings/usage. Disable this warning in /settings.";
+ 
+@@ -335,6 +376,7 @@
+ 	private fdPath: string | undefined;
+ 	private editorContainer: Container;
+ 	private footer: FooterComponent;
++	private footerContainer: Container;
+ 	private footerDataProvider: FooterDataProvider;
+ 	// Stored so the same manager can be injected into custom editors, selectors, and extension UI.
+ 	private keybindings: KeybindingsManager;
+@@ -477,7 +519,9 @@
+ 		this.editorContainer = new Container();
+ 		this.editorContainer.addChild(this.editor as Component);
+ 		this.footerDataProvider = new FooterDataProvider(this.sessionManager.getCwd());
++		this.footerContainer = new Container();
+ 		this.footer = new FooterComponent(this.session, this.footerDataProvider);
++		this.footerContainer.addChild(this.footer);
+ 		this.footer.setAutoCompactEnabled(this.session.autoCompactionEnabled);
+ 
+ 		// Load hide thinking block setting
+@@ -704,19 +748,25 @@
+ 			console.log(theme.fg("dim", `Model scope: ${modelList}${cycleHint}`));
+ 		}
+ 
+-		// Add header container as first child. Populate it after applying theme settings.
+-		// Keep loaded resources before chat so restored session messages never precede them.
+-		this.ui.addChild(this.headerContainer);
+-		this.ui.addChild(this.loadedResourcesContainer);
+-
+-		this.ui.addChild(this.chatContainer);
+-		this.ui.addChild(this.pendingMessagesContainer);
+-		this.ui.addChild(this.statusContainer);
+ 		this.renderWidgets(); // Initialize with default spacer
+-		this.ui.addChild(this.widgetContainerAbove);
+-		this.ui.addChild(this.editorContainer);
+-		this.ui.addChild(this.widgetContainerBelow);
+-		this.ui.addChild(this.footer);
++		this.ui.addChild(
++			new FlexSpacerBottomLayout(
++				this.ui,
++				[
++					this.headerContainer,
++					this.loadedResourcesContainer,
++					this.chatContainer,
++				],
++				[
++					this.pendingMessagesContainer,
++					this.statusContainer,
++					this.widgetContainerAbove,
++					this.editorContainer,
++					this.widgetContainerBelow,
++					this.footerContainer,
++				],
++			),
++		);
+ 		this.ui.setFocus(this.editor);
+ 
+ 		this.setupKeyHandlers();
+@@ -2033,25 +2083,25 @@
+ 			| ((tui: TUI, thm: Theme, footerData: ReadonlyFooterDataProvider) => Component & { dispose?(): void })
+ 			| undefined,
+ 	): void {
+-		// Dispose existing custom footer
++		// Dispose existing custom footer
+ 		if (this.customFooter?.dispose) {
+ 			this.customFooter.dispose();
+ 		}
+ 
+-		// Remove current footer from UI
++		// Remove current footer from its pinned layout slot.
+ 		if (this.customFooter) {
+-			this.ui.removeChild(this.customFooter);
++			this.footerContainer.removeChild(this.customFooter);
+ 		} else {
+-			this.ui.removeChild(this.footer);
++			this.footerContainer.removeChild(this.footer);
+ 		}
+ 
+ 		if (factory) {
+ 			// Create and add custom footer, passing the data provider
+ 			this.customFooter = factory(this.ui, theme, this.footerDataProvider);
+-			this.ui.addChild(this.customFooter);
++			this.footerContainer.addChild(this.customFooter);
+ 		} else {
+ 			// Restore built-in footer
+ 			this.customFooter = undefined;
+-			this.ui.addChild(this.footer);
++			this.footerContainer.addChild(this.footer);
+ 		}
+ 
+ 		this.ui.requestRender();

modules/agents/pi/patches/pi-tool-lookup-validation.patch

@@ -0,0 +1,22 @@
+diff --git a/packages/coding-agent/src/utils/tools-manager.ts b/packages/coding-agent/src/utils/tools-manager.ts
+--- a/packages/coding-agent/src/utils/tools-manager.ts	2026-08-01 18:41:36.970496010 -0400
++++ b/packages/coding-agent/src/utils/tools-manager.ts	2026-08-01 18:41:37.028186009 -0400
+@@ -74,8 +74,7 @@
+ function commandExists(cmd: string): boolean {
+ 	try {
+ 		const result = spawnSync(cmd, ["--version"], { stdio: "pipe" });
+-		// Check for ENOENT error (command not found)
+-		return result.error === undefined || result.error === null;
++		return (result.error === undefined || result.error === null) && result.status === 0;
+ 	} catch {
+ 		return false;
+ 	}
+@@ -88,7 +87,7 @@
+ 
+ 	// Check our tools directory first
+ 	const localPath = join(TOOLS_DIR, config.binaryName + (platform() === "win32" ? ".exe" : ""));
+-	if (existsSync(localPath)) {
++	if (existsSync(localPath) && commandExists(localPath)) {
+ 		return localPath;
+ 	}
+ 

modules/agents/pi/pi.nix

@@ -11,6 +11,46 @@ let
   cfg = config.modules.agents.pi;
   user = config.user.name;
   piDir = "${config.users.users.${user}.home}/.pi/agent";
+  reservedToolProfiles = [
+    "none"
+    "read-only"
+    "read-only-with-safe-bash"
+    "full-tools"
+  ];
+  subagentsConfig =
+    lib.optionalAttrs (cfg.subagents.defaultContext != null) {
+      defaultContext = cfg.subagents.defaultContext;
+    }
+    // lib.optionalAttrs (cfg.subagents.defaultTools != null) {
+      defaultTools = cfg.subagents.defaultTools;
+    }
+    // lib.optionalAttrs (cfg.subagents.maxConcurrent != null) {
+      maxConcurrent = cfg.subagents.maxConcurrent;
+    }
+    // lib.optionalAttrs (cfg.subagents.recentTerminalTtlMs != null) {
+      recentTerminalTtlMs = cfg.subagents.recentTerminalTtlMs;
+    }
+    // lib.optionalAttrs (
+      cfg.subagents.ui.enabled != null || cfg.subagents.ui.defaultExpanded != null
+    ) {
+      ui =
+        lib.optionalAttrs (cfg.subagents.ui.enabled != null) {
+          enabled = cfg.subagents.ui.enabled;
+        }
+        // lib.optionalAttrs (cfg.subagents.ui.defaultExpanded != null) {
+          defaultExpanded = cfg.subagents.ui.defaultExpanded;
+        };
+    }
+    // lib.optionalAttrs (cfg.subagents.toolProfiles != { }) {
+      toolProfiles = cfg.subagents.toolProfiles;
+    };
+  subagentsJson = (pkgs.formats.json { }).generate "pi-subagents.json" subagentsConfig;
+  patchedPi = pkgs.pi-coding-agent.overrideAttrs (old: {
+    patches = (old.patches or [ ]) ++ [
+      ./patches/pi-flex-spacer.patch
+      ./patches/pi-tool-lookup-validation.patch
+    ];
+  });
   herdrPiIntegration = pkgs.stdenvNoCC.mkDerivation {
     name = "herdr-pi-integration";
     nativeBuildInputs = [ pkgs.herdr ];
@@ -33,13 +73,116 @@ let
   };
 in
 {
-  options.modules.agents.pi.enable = lib.mkEnableOption ''
-    Pi, a terminal coding agent, configured via home-manager'';
+  options.modules.agents.pi = {
+    enable = lib.mkEnableOption ''
+      Pi, a terminal coding agent, configured via home-manager'';
+
+    subagents = {
+      defaultContext = lib.mkOption {
+        type = lib.types.nullOr (lib.types.enum [
+          "independent"
+          "fork"
+        ]);
+        default = null;
+        description = ''
+          Default context mode for subagents.
+          Left null, the extension keeps its in-code default.
+        '';
+      };
+
+      defaultTools = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+        default = null;
+        example = "read-only-with-safe-bash";
+        description = ''
+          Default tool profile for subagents.
+          Left null, the extension keeps its in-code default.
+        '';
+      };
+
+      maxConcurrent = lib.mkOption {
+        type = lib.types.nullOr lib.types.ints.positive;
+        default = null;
+        example = 4;
+        description = ''
+          Maximum number of child processes allowed to run concurrently.
+          Left null, the extension keeps its in-code default.
+        '';
+      };
+
+      recentTerminalTtlMs = lib.mkOption {
+        type = lib.types.nullOr lib.types.ints.unsigned;
+        default = null;
+        example = 600000;
+        description = ''
+          Milliseconds to retain terminal subagents in the recent work set.
+          Zero disables time-based retention.
+          Left null, the extension keeps its in-code default.
+        '';
+      };
+
+      ui = {
+        enabled = lib.mkOption {
+          type = lib.types.nullOr lib.types.bool;
+          default = null;
+          description = ''
+            Whether the extension renders its built-in subagent monitor.
+            Left null, the extension keeps its in-code default.
+          '';
+        };
+
+        defaultExpanded = lib.mkOption {
+          type = lib.types.nullOr lib.types.bool;
+          default = null;
+          description = ''
+            Whether the built-in subagent monitor starts expanded.
+            Left null, the extension keeps its in-code default.
+          '';
+        };
+      };
+
+      toolProfiles = lib.mkOption {
+        type = lib.types.attrsOf (
+          lib.types.submodule {
+            options.activeTools = lib.mkOption {
+              type = lib.types.listOf lib.types.str;
+              description = "Pi tools made available to a child using this profile.";
+            };
+          }
+        );
+        default = { };
+        example = {
+          review = {
+            activeTools = [
+              "read"
+              "grep"
+              "find"
+              "ls"
+            ];
+          };
+        };
+        description = ''
+          Custom named tool profiles for subagents.
+          The extension's reserved built-in profile names cannot be redefined.
+        '';
+      };
+    };
+  };
 
   config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = lib.intersectLists reservedToolProfiles (
+          builtins.attrNames cfg.subagents.toolProfiles
+        ) == [ ];
+        message = "modules.agents.pi.subagents.toolProfiles may not redefine the reserved profiles: ${lib.concatStringsSep ", " reservedToolProfiles}.";
+      }
+    ];
+
     home-manager.users.${user} = {
       programs.pi-coding-agent = {
         enable = true;
+        package = patchedPi;
 
         settings = {
           defaultProvider = "openai-codex";
@@ -51,21 +194,29 @@ in
         };
       };
 
-      home.file = {
-        # The first declarative rollout replaces the interactive settings file.
-        # Login state stays in auth.json, which this module does not manage.
-        "${piDir}/settings.json".force = true;
+      home.file =
+        {
+          # The first declarative rollout replaces the interactive settings file.
+          # Login state stays in auth.json, which this module does not manage.
+          "${piDir}/settings.json".force = true;
 
-        "${piDir}/extensions" = {
-          source = piExtensions;
-          recursive = true;
-        };
+          "${piDir}/extensions" = {
+            source = piExtensions;
+            recursive = true;
+          };
 
-        "${piDir}/prompts" = {
-          source = ./prompts;
-          recursive = true;
+          "${piDir}/prompts" = {
+            source = ./prompts;
+            recursive = true;
+          };
+        }
+        // lib.optionalAttrs (subagentsConfig != { }) {
+          # Declaring any global override makes Nix the owner of the runtime file.
+          "${piDir}/subagents.json" = {
+            source = subagentsJson;
+            force = true;
+          };
         };
-      };
     };
   };
 }

modules/agents/skills.nix

@@ -12,7 +12,7 @@ let
   # The skills installed globally, as derivations from the skills flake.
   # grill interviews the operator relentlessly to resolve a plan before building.
   # design-skill drafts and audits Agent Skills for structural predictability.
-  # wayfinder, research, prototype, and slice guide work from exploration through implementation tickets.
+  # wayfinder, research, prototype, slice, and subagents guide work from exploration through implementation tickets and delegation.
   # implement, test-driven-development, and review guide execution and validation once tickets are ready.
   skills = with inputs.skills.packages.${pkgs.stdenv.hostPlatform.system}; [
     grill
@@ -21,6 +21,7 @@ let
     research
     prototype
     slice
+    subagents
     implement
     test-driven-development
     review

modules/desktop/hyprland/hyprland.nix

@@ -112,6 +112,10 @@ in
           blur.enabled = cfg.blur;
         };
 
+        # XWayland clients render at the panel's native resolution instead of
+        # being raster-scaled by the compositor at the fractional monitor scale.
+        xwayland.force_zero_scaling = true;
+
         animations = {
           enabled = true;
           bezier = [ "ease, 0.25, 0.1, 0.25, 1.0" ];

modules/desktop/steam.nix

@@ -0,0 +1,24 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+# Steam game launcher and runtime integration.
+let
+  cfg = config.modules.desktop.steam;
+in
+{
+  options.modules.desktop.steam.enable = lib.mkEnableOption "Steam game launcher";
+
+  config = lib.mkIf cfg.enable {
+    programs.steam = {
+      enable = true;
+      package = pkgs.steam.override {
+        extraEnv.STEAM_FORCE_DESKTOPUI_SCALING = "1.5";
+      };
+    };
+
+    hardware.steam-hardware.enable = true;
+  };
+}

modules/desktop/theming.nix

@@ -32,6 +32,9 @@ in
 
       image = wallpaper;
 
+      # Regreet is not enabled, so its styling target stays off.
+      targets.regreet.enable = false;
+
       cursor = {
         package = pkgs.bibata-cursors;
         # Solid white with a dark outline, so it stays easy to spot against the

modules/desktop/waybar.nix

@@ -83,6 +83,7 @@ in
             "class<chromium.*>" = g "f268";
             "class<[Cc]ode>" = g "f121";
             "class<obsidian>" = g "f02d";
+            "class<[Ss]team>" = g "f1b6";
           };
         };
 

modules/fish/fish.nix

@@ -52,9 +52,9 @@ in
         ];
 
         shellAliases = {
-          ls = "eza -al --color=always --group-directories-first --icons=always";
+          ls = "eza -alg --color=always --group-directories-first --icons=always";
           la = "eza -a --color=always --group-directories-first --icons=always";
-          ll = "eza -l --color=always --group-directories-first --icons=always";
+          ll = "eza -lg --color=always --group-directories-first --icons=always";
           lt = "eza -aT -I '.git' --color=always --group-directories-first --icons=always";
           "l." = "eza -a | grep -e '^\\.'";
         };

modules/nvim/nvim.nix

@@ -19,6 +19,7 @@ in
     home-manager.users.${user} = hm: {
       programs.nixvim = {
         enable = true;
+        nixpkgs.useGlobalPackages = true;
 
         extraPackages = with pkgs; [
           git # neogit and gitsigns shell out to git

modules/reverse-proxy.nix

@@ -0,0 +1,82 @@
+{ config, lib, my, ... }:
+let
+  cfg = config.modules.reverse-proxy;
+  inherit (my) reverseProxyRoutes;
+
+  enabledRoutes = lib.filterAttrs (_: route: route.enable) cfg.routes;
+  routesByHost = lib.groupBy (route: route.host) (lib.attrValues enabledRoutes);
+
+  rootRoutesByHost = lib.mapAttrs (
+    host: routes:
+    let
+      roots = builtins.filter (route: route.path == "/") routes;
+    in
+    if roots == [ ] then null else builtins.head roots
+  ) routesByHost;
+
+  hasDuplicatePaths = routes:
+    let
+      paths = map (route: route.path) routes;
+    in
+    lib.length paths != lib.length (lib.unique paths);
+
+  mkLocation = route: {
+    proxyPass = route.backend;
+    proxyWebsockets = route.websockets;
+  };
+
+  mkVirtualHost = host: routes:
+    let
+      rootRoute = rootRoutesByHost.${host};
+    in
+    lib.mkIf (rootRoute != null) {
+      forceSSL = rootRoute.tls;
+      enableACME = rootRoute.tls;
+      serverAliases = rootRoute.aliases;
+      locations = lib.listToAttrs (
+        map (route: lib.nameValuePair route.path (mkLocation route)) routes
+      );
+    };
+in
+{
+  options.modules.reverse-proxy = {
+    enable = lib.mkEnableOption "the Nginx reverse proxy route realizer";
+
+    routes = lib.mkOption {
+      type = lib.types.attrsOf reverseProxyRoutes.routeType;
+      default = { };
+      description = "Reverse-proxy route declarations keyed by stable route name.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions =
+      lib.mapAttrsToList (host: rootRoute: {
+        assertion = rootRoute != null;
+        message = "modules.reverse-proxy.routes for ${host} must include a primary / route.";
+      }) rootRoutesByHost
+      ++ lib.mapAttrsToList (host: routes: {
+        assertion = !hasDuplicatePaths routes;
+        message = "modules.reverse-proxy.routes for ${host} must not declare the same path more than once.";
+      }) routesByHost;
+
+    networking.firewall.allowedTCPPorts = [
+      80
+      443
+    ];
+
+    security.acme = {
+      acceptTerms = true;
+      defaults.email = "contact@alexion.dev";
+    };
+
+    services.nginx = {
+      enable = true;
+      recommendedGzipSettings = true;
+      recommendedOptimisation = true;
+      recommendedProxySettings = true;
+      recommendedTlsSettings = true;
+      virtualHosts = lib.mapAttrs mkVirtualHost routesByHost;
+    };
+  };
+}

modules/services/actualbudget.nix

@@ -0,0 +1,63 @@
+{
+  config,
+  lib,
+  my,
+  ...
+}:
+let
+  cfg = config.modules.services.actualbudget;
+in
+{
+  options.modules.services.actualbudget = {
+    enable = lib.mkEnableOption "Actual Budget";
+
+    port = lib.mkOption {
+      type = lib.types.port;
+      default = 5006;
+      description = "Port Actual Budget listens on.";
+    };
+
+    dataDir = lib.mkOption {
+      type = lib.types.str;
+      default = "/data";
+      description = "Directory where Actual Budget stores server and user files.";
+    };
+
+    user = lib.mkOption {
+      type = lib.types.str;
+      default = "actual";
+      description = "User account that runs Actual Budget.";
+    };
+
+    uid = lib.mkOption {
+      type = lib.types.ints.positive;
+      default = my.serviceUid "actualbudget";
+      description = "Stable uid for the Actual Budget service user.";
+    };
+
+    group = lib.mkOption {
+      type = lib.types.str;
+      default = "storage";
+      description = "Group account that owns Actual Budget's writable state.";
+    };
+
+  };
+
+  config = lib.mkIf cfg.enable {
+    users.users.${cfg.user} = {
+      isSystemUser = true;
+      uid = cfg.uid;
+      group = cfg.group;
+    };
+
+    services.actual = {
+      enable = true;
+      openFirewall = true;
+      user = cfg.user;
+      group = cfg.group;
+      settings = {
+        inherit (cfg) port dataDir;
+      };
+    };
+  };
+}

modules/services/copyparty.nix

@@ -0,0 +1,201 @@
+{
+  config,
+  lib,
+  my,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.modules.services.copyparty;
+
+  volumeType = lib.types.submodule {
+    options = {
+      path = lib.mkOption {
+        type = lib.types.str;
+        description = "Filesystem path served by this volume.";
+      };
+
+      access = lib.mkOption {
+        type = lib.types.attrsOf (lib.types.listOf lib.types.str);
+        default = { };
+        example = {
+          A = [ "alexion" ];
+        };
+        description = "Copyparty access map from permission string to account names.";
+      };
+
+      flags = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        default = [ ];
+        example = [ "dthumb" ];
+        description = "Copyparty volume flags.";
+      };
+    };
+  };
+
+  renderAccess = permission: accounts: "    ${permission}: ${lib.concatStringsSep ", " accounts}";
+
+  renderFlags = flags: lib.concatMapStringsSep "\n" (flag: "    ${flag}") flags;
+
+  renderVolume = urlPath: volume: ''
+    [${urlPath}]
+      ${volume.path}
+      accs:
+    ${lib.concatStringsSep "\n" (lib.mapAttrsToList renderAccess volume.access)}
+    ${lib.optionalString (volume.flags != [ ]) ''
+      flags:
+    ${renderFlags volume.flags}
+    ''}
+  '';
+
+  renderTrustedSource = source: "  xff-src: ${source}";
+
+  renderedReverseProxy = lib.optionalString cfg.reverseProxy.enable ''
+      rproxy: 1
+      xff-hdr: x-forwarded-for
+    ${lib.concatStringsSep "\n" (map renderTrustedSource cfg.reverseProxy.trustedSources)}
+  '';
+
+  renderedVolumes = lib.concatStringsSep "\n" (lib.mapAttrsToList renderVolume cfg.volumes);
+
+  configScript = pkgs.writeShellScript "copyparty-config" ''
+    set -eu
+
+    umask 077
+    password="$(${pkgs.coreutils}/bin/tr -d '\n' < "$CREDENTIALS_DIRECTORY/password")"
+
+    cat > /run/copyparty/copyparty.conf <<EOF
+    [global]
+      p: ${toString cfg.port}
+      usernames
+      http-only
+      no-crt
+      no-thumb
+      no-snap
+      no-rescan
+      ses-db: ${cfg.stateDir}/sessions.db
+      chpw-db: ${cfg.stateDir}/chpw.json
+      shr-db: ${cfg.stateDir}/shares.db
+    ${renderedReverseProxy}
+    [accounts]
+      ${cfg.accountName}: $password
+
+    ${renderedVolumes}
+    EOF
+  '';
+in
+{
+  options.modules.services.copyparty = {
+    enable = lib.mkEnableOption "Copyparty";
+
+    package = lib.mkPackageOption pkgs "copyparty-min" { };
+
+    port = lib.mkOption {
+      type = lib.types.port;
+      default = 3923;
+      description = "Port Copyparty listens on.";
+    };
+
+    user = lib.mkOption {
+      type = lib.types.str;
+      default = "copyparty";
+      description = "User account that runs Copyparty.";
+    };
+
+    uid = lib.mkOption {
+      type = lib.types.ints.positive;
+      default = my.serviceUid "copyparty";
+      description = "Stable uid for the Copyparty service user.";
+    };
+
+    group = lib.mkOption {
+      type = lib.types.str;
+      default = "storage";
+      description = "Group account that owns Copyparty's writable state and served files.";
+    };
+
+    accountName = lib.mkOption {
+      type = lib.types.str;
+      default = "alexion";
+      description = "Copyparty account name configured for password authentication.";
+    };
+
+    passwordFile = lib.mkOption {
+      type = lib.types.path;
+      description = "Runtime file containing the Copyparty account password.";
+    };
+
+    stateDir = lib.mkOption {
+      type = lib.types.str;
+      default = "/var/lib/copyparty";
+      description = "Directory where Copyparty stores service state.";
+    };
+
+    volumes = lib.mkOption {
+      type = lib.types.attrsOf volumeType;
+      default = { };
+      description = "Copyparty volumes keyed by their URL path.";
+    };
+
+    reverseProxy = {
+      enable = lib.mkEnableOption "reverse-proxy trust settings for Copyparty";
+
+      trustedSources = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        default = [ ];
+        description = "IP ranges that may supply Copyparty's forwarded client IP header.";
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = cfg.volumes != { };
+        message = "modules.services.copyparty.volumes must declare at least one served volume.";
+      }
+      {
+        assertion = !cfg.reverseProxy.enable || cfg.reverseProxy.trustedSources != [ ];
+        message = "modules.services.copyparty.reverseProxy.trustedSources must name at least one trusted proxy source when reverse-proxy support is enabled.";
+      }
+    ];
+
+    users.users.${cfg.user} = {
+      isSystemUser = true;
+      uid = cfg.uid;
+      group = cfg.group;
+      home = cfg.stateDir;
+    };
+
+    systemd.services.copyparty = {
+      description = "Copyparty file server";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        ReloadSignal = "SIGUSR1";
+        Type = "simple";
+        User = cfg.user;
+        Group = cfg.group;
+        WorkingDirectory = cfg.stateDir;
+        Environment = [
+          "HOME=${cfg.stateDir}"
+          "XDG_CONFIG_HOME=${cfg.stateDir}"
+        ];
+        StateDirectory = "copyparty";
+        RuntimeDirectory = "copyparty";
+        RuntimeDirectoryMode = "0700";
+        LoadCredential = [ "password:${cfg.passwordFile}" ];
+        ExecStartPre = configScript;
+        ExecStart = "${lib.getExe cfg.package} -c /run/copyparty/copyparty.conf";
+        Restart = "on-failure";
+        NoNewPrivileges = true;
+        PrivateTmp = true;
+        ProtectSystem = "strict";
+        ProtectHome = true;
+        ReadWritePaths = [ cfg.stateDir ] ++ map (volume: volume.path) (lib.attrValues cfg.volumes);
+      };
+    };
+
+    networking.firewall.allowedTCPPorts = [ cfg.port ];
+  };
+}

modules/ssh.nix

@@ -8,119 +8,298 @@ let
   cfg = config.modules.ssh;
   user = config.user.name;
 
+  inherit (lib)
+    concatLists
+    concatStringsSep
+    elem
+    filter
+    genAttrs
+    hasAttr
+    imap0
+    listToAttrs
+    mapAttrs
+    mapAttrsToList
+    mkIf
+    mkMerge
+    mkOption
+    nameValuePair
+    optional
+    optionalAttrs
+    types
+    unique
+    ;
+
   hostKeySecret = type: "ssh-host-${type}-key";
   userKeySecret = "ssh-user-ed25519-key";
 
+  targetType = types.submodule (
+    { name, ... }:
+    {
+      options = {
+        hostName = mkOption {
+          type = types.str;
+          default = name;
+          description = ''
+            The network address OpenSSH connects to for this target.
+          '';
+        };
+
+        user = mkOption {
+          type = types.str;
+          default = config.user.name;
+          description = ''
+            The remote login name OpenSSH uses for this target.
+          '';
+        };
+
+        port = mkOption {
+          type = types.port;
+          default = 22;
+          description = ''
+            The TCP port OpenSSH uses for this target.
+          '';
+        };
+
+        aliases = mkOption {
+          type = types.listOf types.str;
+          default = [ name ];
+          description = ''
+            Host patterns written into the generated OpenSSH client block.
+          '';
+        };
+
+        clientKey = mkOption {
+          type = types.nullOr types.str;
+          default = null;
+          description = ''
+            The public key this target offers when it connects outward.
+            Other machines admit this key according to the host groups below.
+          '';
+        };
+
+        hostKeys = mkOption {
+          type = types.listOf types.str;
+          default = [ ];
+          description = ''
+            The public keys this target presents when it accepts inbound SSH.
+            These keys generate system-wide known-host entries.
+          '';
+        };
+      };
+    }
+  );
+
+  keyWithoutComment = key: concatStringsSep " " (lib.take 2 (lib.splitString " " key));
+
+  targetNamesIn = names: filter (name: hasAttr name cfg.targets) names;
+
+  workstationNames = targetNamesIn cfg.hosts.workstations;
+  serverNames = targetNamesIn cfg.hosts.servers;
+
+  clientKeysFor = names: filter (key: key != null) (map (name: cfg.targets.${name}.clientKey) names);
+
+  currentHost = config.networking.hostName;
+  isServer = elem currentHost cfg.hosts.servers;
+  isWorkstation = elem currentHost cfg.hosts.workstations;
+
+  defaultAuthorizedKeys = lib.flatten (
+    clientKeysFor workstationNames
+    ++ optional isServer (clientKeysFor serverNames)
+  );
+
+  outboundTargetNames =
+    let
+      groupTargets =
+        if isServer then
+          [ "gitea" ] ++ cfg.hosts.servers
+        else if isWorkstation then
+          [ "gitea" ] ++ cfg.hosts.servers ++ cfg.hosts.workstations
+        else
+          [ "gitea" ];
+    in
+    filter (name: name != currentHost) (targetNamesIn groupTargets);
+
+  sshSettingsFor = name:
+    let
+      target = cfg.targets.${name};
+    in
+    {
+      header = "Host ${concatStringsSep " " target.aliases}";
+      HostName = target.hostName;
+      User = target.user;
+    }
+    // optionalAttrs (target.port != 22) { Port = target.port; };
+
+  knownHostNamesFor = target:
+    let
+      names = unique (target.aliases ++ [ target.hostName ]);
+      withPort = name: if target.port == 22 then name else "[${name}]:${toString target.port}";
+    in
+    map withPort names;
+
+  knownHosts = listToAttrs (
+    concatLists (
+      mapAttrsToList (
+        targetName: target:
+        imap0 (i: key:
+          nameValuePair "${targetName}-${toString i}" {
+            hostNames = knownHostNamesFor target;
+            publicKey = keyWithoutComment key;
+          }
+        ) target.hostKeys
+      ) cfg.targets
+    )
+  );
 in
 {
   options.modules.ssh = {
     enable = lib.mkEnableOption "the OpenSSH daemon, with host keys restored from secrets";
 
-    workstationKeys = lib.mkOption {
-      type = lib.types.listOf lib.types.str;
-      default = [
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGxQ4kWsBo2OGYIPOkFe0vNEcB3yoJwAu0y9wrdQzALE alexion@neogaia"
-      ];
-      description = ''
-        Client public keys of the machines the operator works from.
+    hosts = {
+      servers = mkOption {
+        type = types.listOf types.str;
+        default = [ "pikachu" ];
+        description = ''
+          Hosts that serve durable services.
+          They admit workstation keys and server keys, and they receive aliases for other servers and the forge.
+        '';
+      };
 
-        Every machine admits these, so any of them reaches the whole fleet.
+      workstations = mkOption {
+        type = types.listOf types.str;
+        default = [ "neogaia" ];
+        description = ''
+          Hosts the operator works from.
+          Their keys are admitted by every host, and they receive aliases for the whole fleet and the forge.
+        '';
+      };
+    };
+
+    targets = mkOption {
+      type = types.attrsOf targetType;
+      default = {
+        gitea = {
+          hostName = "git.alexion.dev";
+          port = 2022;
+          user = "gitea";
+          aliases = [
+            "gitea"
+            "git.alexion.dev"
+          ];
+        };
+
+        neogaia = {
+          hostName = "10.23.50.146";
+          clientKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGxQ4kWsBo2OGYIPOkFe0vNEcB3yoJwAu0y9wrdQzALE alexion@neogaia";
+          hostKeys = [
+            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJS+wp7K123+4BT6G4f954R6WyrbWveY7VlpoBUf6I5p neogaia"
+            "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCo2wWUKxyAS4J5TqbWf8glDhJvS5XmdRqFhMeJwG3pOB+4AccZ1T8LU7ZN+RjtRi3j2qXBJvIHuzhtQNtmT59TxocvfobYiqOgJpvVO5K6yD8ZoUJs6ziDkIduI9w9mdRIESoi+dBbVu8n24r61cKDVh+jWX+yjzkOcWcOzqDyQhhkjqblZ1WMAdujEMuEPvif1i2LCxStUaZqRGcx09m/ME2fYcaJrpuxxxvX2+CPJNicoo6Rx9i7ZjAoNuvH+jui4KT62DzlQtQtCl2CFUOM0gCPSa+MbNQ9elfHPvGzEcwOIMo2cuy9KURUkQu+sAgaG8S1PEniDDTecskHtuRdmPZawnQGpIhzo919Q6wUgjT8scK4mmSXRWmGmkMt0GNA2tfj5tDks6r5Q8XsYqtWs4rsOEvfmxVSdM771w+fqDBAil99Jsh0ksPK9+Bwgg8cMDzLLFDn8JA5y2G1HocMMom+u5DYKwPXEKnCILkasB8y24+O3PhSu1EuWw277w6EUEXvU03rCf0Ak/ULjxp9a00EGlloEwSmFI7Aub9XHDr87IdbGInEn+PMqyBYADiN+3h6nE2JO+nMa6i/CHdebmT+T7YJvuTKHD9sjFmQsYaghlq03DZrhHcm4hgUvE1dqGojHrhk/WgA3EWTWtK/+BP0Vy2jXaaz+qAx+EGnhQ== neogaia"
+          ];
+        };
+
+        pikachu = {
+          hostName = "10.23.10.102";
+          clientKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINNqJIC6VRXyvrNf3n9su9KdPCikC3CjK/QrCK2reHdB alexion@pikachu";
+          hostKeys = [
+            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKljRf4pJO+pqEqjpPz08gOYq3g1PpxvE66xVw7uMEnA root@pikachu"
+            "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCy/riwm7dflA3mT+3a0/2CIoS2LbAsK/vn35kOoNeuzn0yhiF+imexP6tkB3S2t+H5ybRzkbbuNZcynFfeCqthFc8kvbdCnt8Diqoeg96fZ6ecvh5QE5yH9op8534EySetZ/exakFLnF+6EiWMuWUW3DFwsc2kcgDJObqSE8gTx/d7JK953MiTFmSJBFyg1RtQ3ZnMT+iCrvY2dyCLQai7VeF8koVKF2c0leAq2Hc75rb/L9md8MoJa64iPiz7hwTCin3xoFyaY/5hNVvyqFd5PivgR69gLdJkuVsUYO2mJzhur8cYmJD+pGjJ0U45hyE9TMrCFjeJHHuvSt3+2kph62wv95jLNk0WmMlwgyunISxENCSVVtNYdBMXhUh8VhEAW17QpVUg9EnPvxOdTKEjrvfOZYASWUa51JKbgBgexVgFbxdjDZR88DZa31AVBts/cx/59gXTUahFXMYLdZgssx+5uibZQWnvCyfUV9WLbfmK1lgL6hzReg1VkQ87iGr6skjtQYemJxRaFNA1+Q5f3kmG3KncuK/594a3qXYP4gC6A2blf8om1YZ4aXXh6f+GFKLjoEw1vvM2rJ+rjzfymwDX+pxVQ9L13OEtVZc9Ez76pOkbm1hqdbL0gY45+0cpxodhWV0wMQJBDXL1MHP8qcs+/vw0GxVK5l1SnWBGlw== root@pikachu"
+          ];
+        };
+      };
+      description = ''
+        SSH targets known to the fleet.
+        The inventory holds connection details plus public keys used for authorization and host verification.
       '';
     };
 
-    serverKeys = lib.mkOption {
-      type = lib.types.listOf lib.types.str;
+    extraAuthorizedKeys = mkOption {
+      type = types.listOf types.str;
       default = [ ];
       description = ''
-        Client public keys of the machines that serve.
-
-        Only other servers admit these, so one that is compromised reaches no
-        machine the operator works from.
+        Additional client public keys admitted by this host.
       '';
     };
 
-    authorizedKeys = lib.mkOption {
-      type = lib.types.listOf lib.types.str;
-      default = cfg.workstationKeys;
-      defaultText = lib.literalExpression "config.modules.ssh.workstationKeys";
-      description = ''
-        Client public keys this machine admits for the primary user, drawn from
-        the lists above.
-
-        A machine the operator works from takes the workstation keys. One that
-        serves takes both, so servers reach each other. The default admits the
-        workstation keys, since a machine admitting none is unreachable.
-      '';
-    };
-
-    hostKeys.restore = lib.mkOption {
-      type = lib.types.bool;
-      default = true;
-      description = ''
-        Restore the host keys from secrets rather than letting the daemon
-        generate its own.
-
-        A machine with its own identity keeps its fingerprint across a reimage
-        by restoring committed keys. A guest carries no host identity, so it
-        turns this off and presents a self-generated key instead.
-      '';
-    };
-
-    hostKeys.sopsFile = lib.mkOption {
-      type = lib.types.nullOr lib.types.path;
+    authorizedKeys = mkOption {
+      type = types.nullOr (types.listOf types.str);
       default = null;
       description = ''
-        Encrypted file holding this host's SSH host private keys, one entry per
-        key type, named `ssh-host-<type>-key`. Required when `restore` is on.
-
-        These are the keys the daemon presents to identify itself to connecting
-        clients, not keys used to authenticate anyone to a remote server.
-        Restoring them from secrets rather than generating them keeps the host's
-        fingerprint across a reimage, so every client's `known_hosts` entry
-        stays valid.
+        Complete override for client public keys admitted by this host.
+        Leave null to derive access from `modules.ssh.hosts` and `modules.ssh.targets`.
       '';
     };
 
-    hostKeys.types = lib.mkOption {
-      type = lib.types.listOf lib.types.str;
+    extraSettings = mkOption {
+      type = types.attrsOf types.anything;
+      default = { };
+      description = ''
+        Additional OpenSSH client settings merged into the generated Home Manager configuration.
+      '';
+    };
+
+    hostKeys.restore = mkOption {
+      type = types.bool;
+      default = true;
+      description = ''
+        Restore the host keys from secrets rather than letting the daemon generate its own.
+        A machine with its own identity keeps its fingerprint across a reimage by restoring committed keys.
+        A guest carries no host identity, so it turns this off and presents a self-generated key instead.
+      '';
+    };
+
+    hostKeys.sopsFile = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      description = ''
+        Encrypted file holding this host's SSH host private keys, one entry per key type, named `ssh-host-<type>-key`.
+        Required when `restore` is on.
+      '';
+    };
+
+    hostKeys.types = mkOption {
+      type = types.listOf types.str;
       default = [
         "ed25519"
         "rsa"
       ];
       description = ''
-        Key types to restore, naming both the entries read from the encrypted
-        file and the algorithms the daemon offers. Dropping a type a client has
-        already pinned makes the host unrecognisable to it.
+        Key types to restore, naming both the entries read from the encrypted file and the algorithms the daemon offers.
       '';
     };
 
-    userKey.sopsFile = lib.mkOption {
-      type = lib.types.nullOr lib.types.path;
+    userKey.sopsFile = mkOption {
+      type = types.nullOr types.path;
       default = null;
       description = ''
-        Encrypted file holding this machine's SSH client private key, under the
-        entry `ssh-user-ed25519-key`. Left unset on a machine that authenticates
-        to no remote server, such as a guest.
-
-        This is the key the primary user offers to authenticate to a remote
-        server, not a key the daemon presents to identify this machine.
-        It belongs to this machine alone, so withdrawing its access does not
-        re-key any other.
+        Encrypted file holding this machine's SSH client private key, under the entry `ssh-user-ed25519-key`.
+        Left unset on a machine that authenticates to no remote server, such as a guest.
       '';
     };
   };
 
-  config = lib.mkIf cfg.enable (
-    lib.mkMerge [
+  config = mkIf cfg.enable (
+    mkMerge [
       {
         services.openssh.enable = true;
 
-        # The primary user is the only account reachable over SSH.
-        users.users.${user}.openssh.authorizedKeys.keys = cfg.authorizedKeys;
+        users.users.${user}.openssh.authorizedKeys.keys =
+          if cfg.authorizedKeys != null then
+            cfg.authorizedKeys
+          else
+            defaultAuthorizedKeys ++ cfg.extraAuthorizedKeys;
+
+        programs.ssh.knownHosts = knownHosts;
+
+        home-manager.users.${user}.programs.ssh = {
+          enable = true;
+          enableDefaultConfig = false;
+          settings =
+            mapAttrs (name: _: sshSettingsFor name) (genAttrs outboundTargetNames (name: name))
+            // cfg.extraSettings;
+        };
       }
 
-      # A machine with its own identity restores its host keys from secrets.
-      (lib.mkIf cfg.hostKeys.restore {
+      (mkIf cfg.hostKeys.restore {
         assertions = [
           {
             assertion = cfg.hostKeys.sopsFile != null;
@@ -128,42 +307,27 @@ in
           }
         ];
 
-        # The daemon reads its host keys once at startup, so a re-key has to
-        # restart it to take effect.
-        sops.secrets = lib.genAttrs (map hostKeySecret cfg.hostKeys.types) (_: {
+        sops.secrets = genAttrs (map hostKeySecret cfg.hostKeys.types) (_: {
           inherit (cfg.hostKeys) sopsFile;
           mode = "0400";
           restartUnits = [ "sshd.service" ];
         });
 
-        # An empty list is what stops the daemon generating keys of its own.
         services.openssh.hostKeys = [ ];
-        services.openssh.extraConfig = lib.concatMapStrings (
-          type: "HostKey ${config.sops.secrets.${hostKeySecret type}.path}\n"
-        ) cfg.hostKeys.types;
+        services.openssh.extraConfig = concatStringsSep "" (
+          map (type: "HostKey ${config.sops.secrets.${hostKeySecret type}.path}\n") cfg.hostKeys.types
+        );
       })
 
-      # The client key the primary user offers to remote servers, present only on
-      # a machine that has one.
-      (lib.mkIf (cfg.userKey.sopsFile != null) {
-        # The primary user is the only account that authenticates with this key,
-        # and the mode admits no other.
-        # The client rereads it per connection, so no unit restarts on a re-key.
+      (mkIf (cfg.userKey.sopsFile != null) {
         sops.secrets.${userKeySecret} = {
           inherit (cfg.userKey) sopsFile;
           mode = "0400";
           owner = user;
         };
 
-        # The client reads the decrypted key where it is written, so no copy of it
-        # lives in the user's home to drift from the secret.
-        # Declaring no defaults of home-manager's own leaves every other directive
-        # at the one OpenSSH itself ships.
-        home-manager.users.${user}.programs.ssh = {
-          enable = true;
-          enableDefaultConfig = false;
-          settings."*".IdentityFile = config.sops.secrets.${userKeySecret}.path;
-        };
+        home-manager.users.${user}.programs.ssh.settings."*".IdentityFile =
+          config.sops.secrets.${userKeySecret}.path;
       })
     ]
   );

prototypes/copyparty-rproxy-config/run.sh

@@ -0,0 +1,105 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+bold=$'\033[1m'
+reset=$'\033[0m'
+
+tmp=$(mktemp -d)
+trap 'rm -rf "$tmp"' EXIT
+mkdir -p "$tmp/state" "$tmp/root"
+
+printf '%sQuestion%s\n' "$bold" "$reset"
+printf 'Does the proposed copyparty reverse-proxy config parse and make a proxied HTTPS-origin login-shaped request pass the CORS gate?\n\n'
+
+printf '%sNix-generated config fragment%s\n' "$bold" "$reset"
+config_script=$(nix eval --raw '.#nixosConfigurations.pikachu.config.containers.copyparty.config.systemd.services.copyparty.serviceConfig.ExecStartPre')
+awk '/\[global\]/{show=1} /\[accounts\]/{show=0} show {print}' "$config_script" | grep -E 'rproxy|xff-hdr|xff-src' || true
+
+pkg=$(nix eval --raw '.#nixosConfigurations.pikachu.config.containers.copyparty.config.modules.services.copyparty.package.outPath')
+
+make_conf() {
+  local file=$1 port=$2 rproxy=$3
+  cat > "$file" <<EOF
+[global]
+  i: 127.0.0.1
+  p: $port
+  usernames
+  http-only
+  no-crt
+  no-thumb
+  no-snap
+  no-rescan
+  ses-db: $tmp/state/sessions-$port.db
+  chpw-db: $tmp/state/chpw-$port.json
+  shr-db: $tmp/state/shares-$port.db
+$rproxy
+
+[accounts]
+  alexion: prototype-password
+
+[/]
+  $tmp/root
+  accs:
+    A: alexion
+EOF
+}
+
+start_server() {
+  local conf=$1 log=$2
+  "$pkg/bin/copyparty" -c "$conf" >"$log" 2>&1 &
+  local pid=$!
+  for _ in {1..50}; do
+    if grep -q 'listening' "$log"; then
+      printf '%s' "$pid"
+      return 0
+    fi
+    sleep 0.1
+  done
+  cat "$log"
+  kill "$pid" 2>/dev/null || true
+  return 1
+}
+
+request() {
+  local label=$1 port=$2 host=$3 proto=${4:-}
+  local headers="$tmp/$label.headers"
+  local body="$tmp/$label.body"
+  local args=(
+    -sS
+    -D "$headers"
+    -o "$body"
+    -X POST
+    -H "Host: $host"
+    -H 'Origin: https://files.alexion.dev'
+    -H 'X-Forwarded-For: 10.23.20.20'
+  )
+  if [[ -n "$proto" ]]; then
+    args+=(-H "X-Forwarded-Proto: $proto")
+  fi
+  curl "${args[@]}" "http://127.0.0.1:$port/?pw=alexion:prototype-password" >/dev/null || true
+  printf '%-24s %s %s\n' "$label" "$(head -1 "$headers" | tr -d '\r')" "$(head -1 "$body")"
+}
+
+rproxy_config='  rproxy: 1
+  xff-hdr: x-forwarded-for
+  xff-src: 127.0.0.1/32'
+make_conf "$tmp/rproxy.conf" 39234 "$rproxy_config"
+pid=$(start_server "$tmp/rproxy.conf" "$tmp/rproxy.log")
+
+printf '\n%sCORS gate probes%s\n' "$bold" "$reset"
+request with-forwarded-https 39234 files.alexion.dev https
+request missing-forwarded-proto 39234 files.alexion.dev
+request wrong-forwarded-host 39234 '10.23.20.126:3923' https
+
+kill "$pid" 2>/dev/null || true
+wait "$pid" 2>/dev/null || true
+
+printf '\n%sRelevant server log%s\n' "$bold" "$reset"
+grep -E 'cors-reject|POST|http405|got proxied request|untrusted source|listening' "$tmp/rproxy.log" || true
+
+printf '\n%sNginx proxy headers%s\n' "$bold" "$reset"
+toplevel=$(nix build --print-out-paths '.#nixosConfigurations.pikachu.config.containers.reverse-proxy.config.system.build.toplevel' --no-link)
+nginx_conf=$(readlink -f "$toplevel/etc/nginx/nginx.conf")
+include_path=$(awk '/server_name files\.alexion\.dev;/{in_server=1} in_server && /include .*recommended-proxy_set_header/{print $2; exit}' "$nginx_conf" | tr -d ';')
+cat "$include_path"

secrets/pikachu.yaml

@@ -0,0 +1,27 @@
+ssh-host-ed25519-key: ENC[AES256_GCM,data:nxj7nMDzeqr0CitIjns9ugFh7Sur0pVpBr8SgWbxQMpIeNvBp+ugmnAxaUq2HRoYCo68uh/YKJZgMCBPSWrEyIhUX0rXmiZFmusrviJSXrYmy+n2XvLPjuv4vPbJEfjudRdXkHPazB3JJbeVRhGgK7y7smhNZlr8lwPGo0Ui0jVqWB4MPQRP6dLKVfV5shIusOqdhg7y2JSkZLYIjOBOJjknCxGmr5+vF2qwpDJQWEyzuJv2QJ48IlU7QyHF76//6xOchteL70/lyXI4gLiGl2fEczx3KKIXE+DNetKVAQxh4QHwzz9JK8qIJMYVry2qFdGGgF8eN7YEJYA60r1pL++1l8Uq++C1Bsc9jCO91ayQb+spXK0uM3G/ZJka7brRQbvcr54MJEyH6+0uBscXw/wMJ1EBX3Np6dumQhKuALnsAIXE89bKJg1wyPwaCy8uMZMcjQhvNkG0FPSBatHz2bB7bnNuNiXyT+scYyN0huE4Ccq7/H3bHWqbipV51YBH/XZKmjDiCwu3i0t5MHmp,iv:9P6Pa3hBe0/jbacjvzV3VGJJ4+OLRarEJEkLMOftqPw=,tag:zA6ewbj2ovP9+2WcAXa9qA==,type:str]
+ssh-host-rsa-key: ENC[AES256_GCM,data:C/xmdAeQlQou4wbP1EBqZ8G5/dRpmGYprj/z1g68WfCO7L+gzIgOryaEhBHugv3USAN8E3Ak4Ry+aUZCzDuIM2OeWdUm2AVT6r5o1RPYFtHSdsJUbKKB+9T3bR9GgFBRyRInSOjQhqR3lYuFLeA1xWhV8UG3Vv1tJwjLV1/JTUQf9j/NcYUr8tqjqD6hB8Fa5IEHPAUviX40R50o+EoiPIkB+qKbGru0Eg7p5K+/6d858nZc2lNgXIFnh72D0hXdWFs1BvcwGaY2WL3i7nJmOBUc3zM3/bYlU9EIscl04V6aUSXmF2sqI13Psa8lApV08MdAyUoFSHlYxlFxqe0IJ3nm0ofbJdwM6oDR6E8yQeU9vpirnYOPI6CWx6Y83LFWAVlhOZQKoLPBbiKImjM8oyoBGiIdqUrIXggoZ1u4F2/SwJtd9MwNr0+UDQWAQsYoAoBfI9LSUvEj52C2RiF28MDw2mEE8zmuHWM96KRUB7E8sGXHJrfBzDC5JuVdwmNCAOgck7ACJnHh8ZbKQYv8iGjbwVU/9z52BIUTLjJrdllSmIGWjVqOSVAUZVl7R3AK/xAaUuNNLaNzR4kk/+lQhPTuOLeFBfWbu3kryfeyJNyuHHtS21tgTcwc/bMYVq8LM8ttPn3b/BLQMl49qlBNmMk4TZ4hzBC5BMW6TgSHJRXZ7eajV8x+TM+aGu34xU0TiIy95XgTdi1ktQ0kAzB94iLTsMVhWpwoOguOlGLPGDKuDlym44T4cFRHySSHy0xlroPD1FPSvlSP7uY++55HsxX/88M8HNtCQ9h2P7jFRBYL+CpYbwgWNqtIWq8/daxCxScKZZ2/sAvFL5Ttqe//wYwNp6F3WbIxOk7yS/Ov+ADOt+RnxB2P11dkWNN7kHscGO7/sBNhDbzyEB8kHdfbEYKAl+OwUUsYqiGzdKF8E8aNa/0AAld3whrVgsUmIbFeoAkvJO6TkiZ3uuJAHdF9L8XfpWLEbu+geb6HG4+Bf5QOxxKVkSihMCimTI5vPGHuXj0/vwMihsMvhcaTmfSh2cZRAQhwIPQamEEeC+vqU2Igwcm57Cg81gMJYORLj+SaZSbCbrUxqElE/1OxUtF1KEh9njXjNK/grKnZbDDfRrhZwm3Nri1yxQxk/haHVoZttwXKo2vsWsYvpaHPJuUoQ0r/Wo8RffH2s04qauphLgWi2BUpfs+nNFBGRu6S92o/dktNQYgVeAGo7fYrM4xQX26fjQcOR7TD5bQIR2HcfHzyfH6A4c8MuInUeuf7kZFOoR1DdUFXYbvNcIgbmB/ScImkP3q18KaH+JRsVJbEEB7X4YOQ6lvHTtk0QVLv50V22BA9naFlpKGMWjq0oT5Gf40c6+opDlQWKrgwISwDvm9QJznvquj1EUlFJwVf0SJBHfeomFITZZMma2no2EIV0s/n9LvaU0b1Aim9EAqxUTgMrryLzE16dqSQKugbsn2jWMy7By3Xf8g0kstbyht5EOUZpThrwthEcGRN3xRHHke6ILckAVqEvl2wMuNMV8sd904pdYUL1wQAHKtg+fRbzu5cMY8itEs6YPsWob+HaD+n2tfHf4ByR1KBZ92nCyAWWjW6jrSDCzYCRsxvMSdsBJz9U4szSExC2qm9kQxGeedOl8/qECRZQQArBQZdavbwECGVUT3LRWQOu6bDyFgzoTzUlRxK05wr+Rpir/NmiGURGCZhmy+J2QnejlK0zOidORZAkzFcuGUPiUDGvJ99y43oSYAEYAI4UMKu42zimdVz50PbD2jpSJS6OmxUKfPfyy6CKC1lmYSB7PVGHzQ2aIw0RVMND9JNcntD5qgS2/g1CFhh9z9QyVtkOqiPICXTRXmVEQ5PW04tyzKBRkiSPoXxpC1zq77QPUAz0ZfeElqppdGyfejRiRl6m5JXJ9Pwl3/pgMEqGs0gpM/+TuT3rrYr6v602wPNq6/1XWpizReVPJZNzMrmxQwiIO285w1kvBlZ1VQnbAUiJR+pZuc9PiegSqEbfdkC8SQaGj+2M9tSDRzDGDE1y8pOLDi8Wczbn313JM+QwYDAXGccXxCEq0d3fVjb26u0ZNq2nn5zDy002aMWro+mrsLlWOf4MoAwvnyxgwEewrBEFIk1n14huFd1YpVomZuY3Y9XX1b1XoiTlhbmlP2HopobgQCD4Gt4zFb9RovNxBib+g4j2N94uoiuXOyBTT1B/HWHr6DnMxNvtHIyMOUPzR+6hwO9ntmdhPh+UZIB2b6FWZWLec55yBewzmvWn44dOdo7Z8Tp4d7vfSamyQDO49LA7Bd0CpDan7lbpw5rD4iejRCqZ/yJHTRyExSrZtcLQsScaorGCPlxHL4MUlRMynkyjPSUDRzqdJs+OnJDfUxJ566z8978rCppuYGRAGCqnoEHN9vcGsncMt9LuyUFlDaNKoOFZlMthvfQnUy47JnrP5u18Ph8qjn6A2Wh6MowsMvM67EBSlx8ZdHJC1iWqlHULW7FKPtcvKnDB/GToOqi2y9+EuMVWpoDJmTTyZFr9fmMlA0mL9tXWWG5h3G4LeLrT+LmRmk5tgL1TUJz5XDRQIQZRXxP+X7yt1bDh5PQK0vyupnWbs8KGDM+/pO8GwkwPnehBmJkkfkA6W2DIWzqRZHstdGmk1vtBqE6yAmwBOuXL+vm0vN86ulN+87LNR3OpCBRyorqundmw82vg/RdPNuA+Zxqg+VErsuTTdJmgZxN1rDU+8AiJPC8ZK7mH74lLYX2Ad86ZDriPcAi7wyYLc1qrSSHFCofb2FuM3/cJXcadSjZ//HxZh6qVOC5FW3b/YnFLZeqUgai6PO5rvzgyXusb2qHK60sEyS6pfw+ybOyZxWAc1TYqFXtOhUje8SW3R4cCG4zyCh5kUjZLiCNoNU2MIvVHjSfe9KAvTO2pcmuDIuVv9CKoko8tgoFqS80UDeP0pn99AmnTMXbhUR7eYjR9qAABF0IJJGUUIR1SbwiJrdEXil1qNcgciBI1epIXc1uBRXhcEnHI8VxVwYxF5wISjfuvp4cqJk03AkZVa4E2yydUATOCtk6fkaxVJIkitQaVgc0tqS4pX+9d35NF/njFHXksT/wMBfVJYmcgfIHJFK46igB/rwwC3PpOM+YNM8aJpLyZbbUB9CEWMtT9P5LqLWFoUaC2brIKG7vrfy2OSNOEWxiEDAzn7kY1+zpOb93J8FURpDNV+K4YUznPr1z2BxEGAKQXXx2PHQpAYYvdane5uWsZWMTsK5qQunX2UHPscr3T0A384pzXNdgnR6OrZfbcIpmvTAjxH9qzQLj49kJQ98czuutJWxgrp9J7abKeIdWGObTra5gA6bJ5kw9FZjW0xiyrOLAok/Vbmen8WCIVxToMJnXR91uuq58GxrcuZFke0NpCfEu3bpdPeKlb+sy0FREiFCpaDUNFFn5DqTNwOiW5KjGw/fG6dqC/NUhH5xdeod4dR1C4NEpYKzbWolUFf+rvFtGrRnQ0VQMXav+fpnBFiRA/ez/7oAzzwNv8Y7s3QpCUSUjsPRGWG/4pDlRSaz7rwkCfRxpkbOmPruYx3fcHigBnvIMLtKAPCx4jE7EsS6BoHNhgCMRyzkdl+MZFLKZ7JgFvgPdNcieFlptax2KaEwBIvhgQ4rimLRCv9cCM1qmmNIGB0UovqZ0Ye8tRG6LteFTgsfb3bNQ5sShaHQiuh2m9JGnI41q8CH2Gn6Mz/ftxn4yDWL/SlkjhtnRLoYvD5ro/Tf4q+exobXC0fbA1sLOnaX3atqHeQWK4Sk9L7zrDbwrJHzgmFD2PUPUhpfg9r1QMtJVkUckhQgyjrrIBfyZ4qqPmpYbH1w7cfE3C/rdprNZFKujYlA0ol8Ok1n0gyRFTeNZvd5EdrQ3D+hIKc0ID7/FmfzIccrI6x+wOE1ePQPzHay2mM8qRcjgTiQOTMaFRYjVy28ovqgixs/bylGvw5VNMGJTIqcu6fC54i3HOBhmnH1Ab/5a7PmwXUbAajw+mKddtrr0wQ7cXRncFnoJtld2AIOs7aD51C1Zkr1UqxliWObCsXJmaQoOpBScHdiKNp1mKQ1Oddu3mj0Su1e4gQR+YAwOyQ1zBU5WvNBbudUmRIsjXDS2Y6XaVN50neQ0DZ5V71259xPyawyVvrdiiUg7HOXgGFGcWbFU+p7MZaq0KE3aXgwCC+/mhFgaKgIVWir5pElNaXLUMDF+1jnblaKyHyAk0HPBgegAphVqWF3Hqp3b15jTSdWsmOugGcCO9hLk2OD99nZzuEVBLbDg0yGISPgzVNFg3+Pqcu8FqmGxLwAWNTRc0+ov7VL5Y4fJoD4QOPj19+nZyvXze/FOYo1Hp+U7PBZDIKVswcdauZG+Z2t2bEd0OxXj1NoazpycIVI/TmiTVyDsK+ijXztNnWXGG24WW1KZ3O5+MmDm7F7RDi1vCOfOOg3Y1yPVprOvltyn1uPo5Q/pPTD1FmAGpJkmdT3+dKkb9N5u6RNvRBEzFY8HCqcvKX1HulpJpz72,iv:vfjzz6U6ey9wGs6Ia3Vd5HaGBvpSq4akp4e3eLC/A3M=,tag:ar1+i09oOEusEuQnr44ASw==,type:str]
+ssh-user-ed25519-key: ENC[AES256_GCM,data:uHZADD2tq8vqlOAOWYniEnj1sl2IUqepf4YvrmRX/0nTksVnoethW6Yb2VNTgu5FsKCxvO65qMZ9KYupDkw/+SCZP2VH4TyhByQSr4SYxrEiNOJLdvmL2VnOWlNNZKaswgBePQR7TBG4mSIiTXCjEAcxeHAhBxLPnwiFxK/Zd6yQhq61x1N+ZtOj0q0QpADP3vioUohdkE5ODoEOUUoQJkYpjdJl2j4PhjCq7yHMEZpeMkqjZhVX5+i8blBu43BM4bKS2tBIJW2IvPV9sHOH8/tsR6p5q0pnpcJAOyOquBSo+eR0egY+liXjSv+Vo/ZDPapl7rKs2SoJ5huUGFbWjxbXY2+t2SYyiVA8lufrVUu94RCwOOJ8UyGYzAGGrChUImVDBsgk/GWwpOvWxcqydF8d6mDdxK9Iek9HtYsS+IKXLrF8GAI9OLB9jKgHVZgyQYSnC146cwCLt99TOFVocE1lfzwpFQTwKvxkep5jBEWiyqRaRUngti0JuF0ih1BWo+LKqxIqq9+V3I39xM8PfTjgHiifnxj4wuhS,iv:32zDKpNPYMiP6Rx7L9TAhxrMwcmphIGni+0jcESoLqg=,tag:YWGE62WQNm2Cer+eG+S5Xg==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyTTVLWHVaZ1NxbGEzcVBq
+            MmorSkhzQ2hSV01idWE4VXNyNkNvMmpkTHpzCnFDQ0l3a1o1OWhmdE9WTjlob3p4
+            Y3BzMlJmeks4ZllzbEY1MkVqRCtrNjgKLS0tIFVhQXpDRjRUSEViMUhPM0V2RGRt
+            NkRpV05YV2RaTGozTUNNM3U5dmJ3dWsKSzkXmVyPhwN58SjMYYL/YbPoHYtZ9goF
+            VYRLRnfU298/3R/1nLNqTlMk4MYQ6NaGf2jOYTyObGgJVccOHF6wig==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1m0pk94ysjlw3lmf6pyuv5l5pepvdjss8w0vxjv90dq6ndp02tdgsdwdvue
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGMDBPcHZ3YithYm5sM2Vh
+            NzJUVmpuT1FRdmw1bzI0a2p5NXFlZlRQN25NCmduQ1NKREVZT3Q5d0l4ZC9ZVUFU
+            all2UUZUMjZyaGxGMm5UOEQwcnNKS2sKLS0tIExPZmR5K05WZHRYRHZEeW1PRWhV
+            ZTZzTlhnYURJTDROTFpUTmFKc3ZkeXMKEWUCkVeHEt/Ay0lyAVjsqtLbu+pJOTJ5
+            dyjzy0/9Ui1IIXH36AImO5hiEZcrGePV2qPLLQc7ZLngC1jlJuEKJA==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1wf5s0n0tgt6ld2ysgu9dc67mj8ylwecgl4utzg7hqwy3kut9zyms7aglmh
+    lastmodified: "2026-08-03T01:26:32Z"
+    mac: ENC[AES256_GCM,data:w4i6+dwN/t/SvFTrP/YiapxOY6ecT7+cJ0v/5lYMe4m1vL2w4mJw9ZrxWifcCcTEfaa766Wc1NE+GxGrBZtlORExbtQCa4tg2GuIQCRqTEc5WSqhYrgMb4elWuYe+r3/SlAf1ldNxz+cmLVtbDpSs96bvkGsKdw/i+q9n2URJYE=,iv:MFWgMtIdpn1v0T6FPhTgBMxi+6kzf2ZAnOGaisRT0d0=,tag:qBX32/zUHSPagXU+u8G8tA==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.3

secrets/shared.yaml

@@ -1,25 +1,39 @@
 alexion-password: ENC[AES256_GCM,data:EGTsJvW4/zA+FfhUtZD4E6HIsI0JQ3LLL511XjI9hDl3NaHNe4g+wWy7P5DQnW29G5W4TaPZIetUcV7OO+1btuRxTuwbWVOulA==,iv:Ihf1kz5DFtvy1bUnfQGAU0/BQrwUvqKwqnK1JbKnWHU=,tag:K0N/6H/IWesNMxzXhQQO/w==,type:str]
+services:
+    copyparty:
+        users:
+            alexion:
+                password: ENC[AES256_GCM,data:SSyo2l6tCjgjxIuCEREIxU+inw2WHtJJR0/IEKUqefFfuAdA5Nf+lH/jfPw=,iv:9225w1Yur3KL3dBr1ct1aPvDdVJ94O8q9qAUiRrj8Nc=,tag:qZgx4XieVq4BcxkTZc0KGQ==,type:str]
 sops:
     age:
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVYzZuaERsRjMyaTAwL3Ri
-            b2RhaGZ1aHNOSzVMamVxWkdKb3VKTk9QMmk4CmV0R3hYN3hkMU1tVDJLNkFlT08y
-            SUdUeUZ4d2JwNmdyOWVJcmZNcEtCb1EKLS0tIHhDV1NZWWdDZUNMYjVqYUVlc0ty
-            Y1owUFZPMXBHbDhjVWxTUjZGRk1IUzQK7VENq6TjuOFlon+CJqUxbIJZ9qka78C/
-            LDsgaTD+7zCBPgASwPbF88pH6tdK7bvNLJnznlZdZBL12eOy25BmOQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvdGQ0ZnZ2UlVaTFVuRmJI
+            aVZNVjZVNGdiVGVhUTVXN3luU0V1eUZFb0ZRCkVrY3lKRE9GTUEzV0ZjUnk4UHdl
+            QnFMVDhMcGVUTWFQemxrSnNEMStpSEEKLS0tIFFIQndkZHp1NkRmRlB4RXlwdk5C
+            cTJVQW9iMWhaMlk1dUxBK1ZvQTRuV0kKm7/z24q4NcDFlVuxZViDFlJodjRzRqhY
+            7X9LqouIXcGhDgwq0hh+JXRfYCz9LDiUJtOLHR7Lu/oscCBCnk7N6Q==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1m0pk94ysjlw3lmf6pyuv5l5pepvdjss8w0vxjv90dq6ndp02tdgsdwdvue
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHY0ZXT3lRWS9DMFA1MHhl
-            MDZiWHhEMy9INGtpd1ZOdzh0OFRoUlZDa0hZCkJwTUV4c01YWlE1QjNDd3pRN3F0
-            SGJWWmFTT1NMQktNejVHY1RrRlZJNFEKLS0tIHlRZG9ZV3FrQktSN2tURVV1NmlW
-            UTBZbFlqMmFGZ0VPSlA1dmNMU2Q3TFUKtL2V8t9+Qw5vjXursvCVRatflX8JKXJr
-            VuA8oe0nKpk7wh4fCzcT7RoRKpJY0gPFjIzeTZGVfoAmZIUWMhzRuw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTOENXYmRRNmVQeUtvOVFy
+            eElWVUhnUnJDTk93aVJCVmpTcHd2aVpKSFhJCk9oUk5ObHNSZHNwSisrSE9JbjRI
+            WVllODlYek1VMDZpMmh3M2JRTU92ZEkKLS0tIFVVNG9RNnlzS0ZvMUM3bVN2Mldo
+            N0MvcXEraDcwUHVxbTJqWGdxTGhOVG8KIhIY9QGbt/eWy9bfST4tEkjLQLylaHRm
+            AwYIwU1Hw6HXR1TX3t0YciI3c8HcWISruY/tBR3xIHIdBlQR5OTaeA==
             -----END AGE ENCRYPTED FILE-----
           recipient: age14a04vphzjq74epfrz9a09wjw8lzchtru84awzuq2n45d8f42ychqjs89qe
-    lastmodified: "2026-07-20T03:22:00Z"
-    mac: ENC[AES256_GCM,data:ei7PKVAIjJ6fGkxqJFc5wdYapq1gElel3fTJ+yKhvWHU+39aKcllG66T3d9FitRztgyt69phykHdKvxDHRUwYeyl1YBzyf1ZpPU5mXJb+hkLtVB1Am7StcP+m7jFqKSmqtYhIT9OxUrH0MJ8qeoU9216otwkhhpPz2hr1s7KYFk=,iv:Pp03KmlinjJiiTZezr0LzzkcHb1a5XWgDpu38jhl9Rk=,tag:HAqFitge+KTCtDE24t8/ig==,type:str]
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4ODgyNjQ1RFMwOGpUaG5U
+            UDNjTENrYzY5UFVTNlRONlBhNmVUUXk2OVd3ClFQUUhFaUM4YmR6dVNlMXRwWUFY
+            ais3L0FyQ1ozWjFMMHhjWmU1NU5JdVUKLS0tIG1tS1NoZjhBb3JRak9XdEpOT3Vy
+            Uk5HdUd6NUsrZWx2Y1lrWGdHRXcxZEUK470gSumRCpgYvIWJcmylw0VTgyV3et/B
+            QkVLBz5x+ShVun27nN3oz8And0qXfwgXojhM3yWnBSUa9CFBsbTOJQ==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1wf5s0n0tgt6ld2ysgu9dc67mj8ylwecgl4utzg7hqwy3kut9zyms7aglmh
+    lastmodified: "2026-08-17T00:30:50Z"
+    mac: ENC[AES256_GCM,data:bNOsakxhrlO1quwLGA8inruHZ6tFpUo6cKMlV10jkJ75GOFzl5jzflGIuPfyncJCtIaZRBA2tS17TpGEEJozmbB2xQkeu67NmzOpEdoJzZWs/bY0FslbpGf8aGAd15BjOYNyMMNFavt0anRgEnsYXTDCflDCHLg1wvAvwtgRGYs=,iv:kfpzzWn3BHkSTQ8qpcD9lYn4wnZ/3nj/41SR25vUahE=,tag:8D1LSEBJIQcwYK9ETomwIw==,type:str]
     unencrypted_suffix: _unencrypted
-    version: 3.13.2
+    version: 3.13.3