feat(Thinkpad): Added bottles to thinkpad

flake.lock

@@ -80,11 +80,11 @@
         "tg_owt": "tg_owt"
       },
       "locked": {
-        "lastModified": 1790620039,
+        "lastModified": 1792306878,
-        "narHash": "sha256-vFY8jKgUupRGrcO9ZfVyVNwOLxRa7dqitXYwDUQqUaU=",
+        "narHash": "sha256-x9gB1qSAWKDKiX3uW0Z5asE2XzxkCfdVk5B/Og+fDlo=",
         "owner": "ayugram-port",
         "repo": "ayugram-desktop",
-        "rev": "3015ae5439dd2c14f15c76c3d451610456fa140d",
+        "rev": "5aafef7f62261f9dacb4e95aed950a4cc379273e",
         "type": "github"
       },
       "original": {
@@ -268,6 +268,28 @@
         "type": "gitlab"
       }
     },
+    "helix-steel": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "rust-overlay": "rust-overlay"
+      },
+      "locked": {
+        "lastModified": 1792336814,
+        "narHash": "sha256-FU4WIMHhIyvEMxHeN8+Qgb3VHsU6DP74ylsyZACLzM8=",
+        "owner": "mattwparas",
+        "repo": "helix",
+        "rev": "16a26934f39152b5cd81bf2f6944e18e680314d0",
+        "type": "github"
+      },
+      "original": {
+        "owner": "mattwparas",
+        "ref": "steel-event-system",
+        "repo": "helix",
+        "type": "github"
+      }
+    },
     "home-manager": {
       "inputs": {
         "nixpkgs": [
@@ -275,11 +297,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1791569574,
+        "lastModified": 1792495086,
-        "narHash": "sha256-5sViLmjhTCtBTvhjSXXvd5LDrAFMydFFKZQisjE8Vds=",
+        "narHash": "sha256-TyoYH983Nsc++1scw0SoOEKshPSJWJDxK7tTmuZ974M=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "6b88c12cc6d234de4888f5d21076fb11199d0844",
+        "rev": "ec80131710bffcdf3b8498cf41f3a0579833b023",
         "type": "github"
       },
       "original": {
@@ -440,11 +462,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1791378645,
+        "lastModified": 1792508453,
-        "narHash": "sha256-9Eix+ZUcI9IUklrtJAD9l/nTcS/Byz7fi94Y3InxS2Y=",
+        "narHash": "sha256-y+V5RFJcjnV1+ZzImkfiSJ97iDIflanjP2OR9lemvTs=",
         "owner": "hyprwm",
         "repo": "hyprland-plugins",
-        "rev": "428bfcd1c9ee34965400bb359349f518140c9920",
+        "rev": "d2427d4d15b36df40468f5a58bbd67cdba19835d",
         "type": "github"
       },
       "original": {
@@ -672,11 +694,11 @@
     },
     "nixpkgs-stable": {
       "locked": {
-        "lastModified": 1791426274,
+        "lastModified": 1792503283,
-        "narHash": "sha256-MWhktfFtFE8Jl7bf9Pkp7TR5MSdYCjCswSo0Gkb4ywc=",
+        "narHash": "sha256-vhe2jyvRCgufWPqDuDq1S3t3ypE+ka46IFutV02xKso=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "7c8764b7c7b09b34f632464276218ef9090eaa11",
+        "rev": "cd4ea8d57de16f4810bc5f14207bac45fbf19f67",
         "type": "github"
       },
       "original": {
@@ -688,11 +710,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1790463110,
+        "lastModified": 1792094642,
-        "narHash": "sha256-hKlVl12B1dF0Q5vd9dY3lIJM5mFGWYSlXwSLAqHZ1+s=",
+        "narHash": "sha256-zp8ToDMnqZcu4o4IH9pdwXFXGp7yLm/M0dEnNWnyd7I=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "e158d9ed9b51c98974c5e66e1ba1c9e0255fecaa",
+        "rev": "fe13242281a67641c0102cdb1087f0ebe586c7df",
         "type": "github"
       },
       "original": {
@@ -720,11 +742,11 @@
     },
     "nixpkgs_4": {
       "locked": {
-        "lastModified": 1791456040,
+        "lastModified": 1792502884,
-        "narHash": "sha256-H83yz/do+hjOO0uujHyH8RgtIQP2v7Mw+cLwcZK/xKc=",
+        "narHash": "sha256-IoNisKcGbUjdd45qCqywGMCYmZ5EnkxezvLII0FWwNA=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "e7439b6b14ad3cc35d05608ebca9bce01a25f5f8",
+        "rev": "02c087f3fe673c9e317f206a627cb6b910336dbe",
         "type": "github"
       },
       "original": {
@@ -736,11 +758,11 @@
     },
     "nixpkgs_5": {
       "locked": {
-        "lastModified": 1790769526,
+        "lastModified": 1791487292,
-        "narHash": "sha256-5AIVFLRcx8YAwbFTVPTs7YhwJH7JyHfAQsvXmpovcXI=",
+        "narHash": "sha256-tqM7xDEsaeK1p6VvRygeZ9LkQRpUUkbRT02BHv6hnTM=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "c9fe7d12cd78d1adcd12dd15e24432dde5b155a0",
+        "rev": "8edc0c72e3a38faf5434e40d1f19431125fe4b30",
         "type": "github"
       },
       "original": {
@@ -784,11 +806,11 @@
     },
     "nixpkgs_8": {
       "locked": {
-        "lastModified": 1791456040,
+        "lastModified": 1792502884,
-        "narHash": "sha256-H83yz/do+hjOO0uujHyH8RgtIQP2v7Mw+cLwcZK/xKc=",
+        "narHash": "sha256-IoNisKcGbUjdd45qCqywGMCYmZ5EnkxezvLII0FWwNA=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "e7439b6b14ad3cc35d05608ebca9bce01a25f5f8",
+        "rev": "02c087f3fe673c9e317f206a627cb6b910336dbe",
         "type": "github"
       },
       "original": {
@@ -849,6 +871,7 @@
       "inputs": {
         "ags": "ags",
         "ayugram-desktop": "ayugram-desktop",
+        "helix-steel": "helix-steel",
         "home-manager": "home-manager",
         "hyprland": "hyprland",
         "hyprland-plugins": "hyprland-plugins",
@@ -866,11 +889,11 @@
     "russia-blocked-geoip": {
       "flake": false,
       "locked": {
-        "lastModified": 1791541118,
+        "lastModified": 1792592746,
-        "narHash": "sha256-nFzXcNfeaujgzCkwTVxk+FJO5fpnGjN0iFjoO+rSHpI=",
+        "narHash": "sha256-hDb67lqlxWt3iBsRvxWdE7G4Eg+JEyNRQo7OTqzaDRI=",
         "owner": "runetfreedom",
         "repo": "russia-blocked-geoip",
-        "rev": "8a0bb95551940aa0f88e1699687160d19ac1ea51",
+        "rev": "8898c3b0d779b8aa05b933b97022d7458af2df8d",
         "type": "github"
       },
       "original": {
@@ -881,6 +904,27 @@
       }
     },
     "rust-overlay": {
+      "inputs": {
+        "nixpkgs": [
+          "helix-steel",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1775358767,
+        "narHash": "sha256-f2eC+WIfhjevCPQILuV08i/kmKZzYZpUvkom/33VxCA=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "20fd44bc663daa53a2575e01293e24e681d62244",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
+      }
+    },
+    "rust-overlay_2": {
       "inputs": {
         "nixpkgs": [
           "yazi",
@@ -906,11 +950,11 @@
         "nixpkgs": "nixpkgs_5"
       },
       "locked": {
-        "lastModified": 1791103873,
+        "lastModified": 1792056300,
-        "narHash": "sha256-nFxM+pKoZ8LJAEnUXARyCaOAloWgaW9kZQOSjWzKcTE=",
+        "narHash": "sha256-YU1LjDe1o2Ymg5zEiCHbmMXLkDCtxHQRiVqZ3nC5GGk=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "dcd241ba97088c22569d1573286e1b9daad340c0",
+        "rev": "44931708c62937c2b1bf7953902989fa5bb9ee1b",
         "type": "github"
       },
       "original": {
@@ -937,11 +981,11 @@
         "tinted-zed": "tinted-zed"
       },
       "locked": {
-        "lastModified": 1790880877,
+        "lastModified": 1791574276,
-        "narHash": "sha256-j42XqSKOAtuqtfHiElyHre2YS/h3Y3q1DjFnKODN1/k=",
+        "narHash": "sha256-UMnLnZ3JlA7UTBNNNx1rNsXYoPP/cirXLCKGiQ/yDx8=",
         "owner": "danth",
         "repo": "stylix",
-        "rev": "7c065d1ed05381fceb2403b963c5ad150f32fe39",
+        "rev": "2856c4c6a845b9bec98828ef197abe176e4806bb",
         "type": "github"
       },
       "original": {
@@ -1004,11 +1048,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1789877109,
+        "lastModified": 1791698670,
-        "narHash": "sha256-gFYDctvZQdqpKkSYf/QJZwRkQM2YPQ3wHfUxHIP8cDM=",
+        "narHash": "sha256-D4GTULEDsGmk4ue01cetWZ6E/emb3FrUys612rg7a5E=",
         "owner": "ndfined-crp",
         "repo": "tg_owt",
-        "rev": "25a781fb72647a14adee9f764761c5c8b773c6b0",
+        "rev": "29330d167ede474885e8aa87b037769cb1cabfc9",
         "type": "github"
       },
       "original": {
@@ -1126,14 +1170,14 @@
       "inputs": {
         "flake-utils": "flake-utils",
         "nixpkgs": "nixpkgs_7",
-        "rust-overlay": "rust-overlay"
+        "rust-overlay": "rust-overlay_2"
       },
       "locked": {
-        "lastModified": 1791533868,
+        "lastModified": 1792507858,
-        "narHash": "sha256-KcNMm4C+07B4ukgs23tQYUi8DDGljSdQBZl3+Ibt0Pk=",
+        "narHash": "sha256-EEfOrxveuFcXigE5frf6U5rzw1JdzRZ9IcSZzysnHGA=",
         "owner": "sxyazi",
         "repo": "yazi",
-        "rev": "1091972581e0d23ed575be967e9a6ef75a17474b",
+        "rev": "7c45837d553b6cb8032bd7fec2106fdb628e4017",
         "type": "github"
       },
       "original": {
@@ -1145,11 +1189,11 @@
     "yazi-plugins": {
       "flake": false,
       "locked": {
-        "lastModified": 1790956605,
+        "lastModified": 1792088615,
-        "narHash": "sha256-/BNGoWziHIZ9i+RoTWGq/q3ZowNCyHGBOWiz8v2/vOE=",
+        "narHash": "sha256-3ddGRQSzxyurNcyYJA+9LTLXTCjBFGATTqdkuGKixzA=",
         "owner": "yazi-rs",
         "repo": "plugins",
-        "rev": "6229767f7fef39a2a78f5cee9122cc4dfb43f327",
+        "rev": "9166202cc1694c98bac3a639874d6f4c0eaa2dab",
         "type": "github"
       },
       "original": {
@@ -1164,11 +1208,11 @@
         "zapret-flowseal": "zapret-flowseal"
       },
       "locked": {
-        "lastModified": 1790422884,
+        "lastModified": 1792489877,
-        "narHash": "sha256-va22R1zFF7JmibmFwezLYfRup8PfVO3pV7toQH+cbL0=",
+        "narHash": "sha256-4/g+qlw4G+2ACSww4vaRsJVLihREjf0eBwofDmeuTns=",
         "owner": "kartavkun",
         "repo": "zapret-discord-youtube",
-        "rev": "b82f45c363506588afbb45fefe41fe4670ae1480",
+        "rev": "69b88b5e51242ddacd87109f31e028e1bef553f6",
         "type": "github"
       },
       "original": {
@@ -1180,11 +1224,11 @@
     "zapret-flowseal": {
       "flake": false,
       "locked": {
-        "lastModified": 1790845315,
+        "lastModified": 1792471264,
-        "narHash": "sha256-zhyCW0LFkWkByHu2Vfgita8Bh3lIexUemGyz9elekUQ=",
+        "narHash": "sha256-5qKg2BvW4XcjY+Az9ocvwACcfsfBpG4I3Xh6SCPksIM=",
         "owner": "Flowseal",
         "repo": "zapret-discord-youtube",
-        "rev": "eb16c1419057e36b8a36fbe7c959483450e6ac8b",
+        "rev": "176f56dc3f11ce5915c26abcdde903f93d835b64",
         "type": "github"
       },
       "original": {

flake.nix

@@ -52,6 +52,11 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
+    helix-steel = {
+      url = "github:mattwparas/helix/steel-event-system";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
     russia-blocked-geoip = {
       url = "github:runetfreedom/russia-blocked-geoip/release";
       flake = false;

host/ThinkPad/configuration.nix

@@ -12,6 +12,7 @@
       ./modules/thinkpad.nix
       ./modules/fingerprint.nix
       ./secrets/secrets.nix
+      ./modules/bottles.nix
 
     (import ../modules/common.nix {
       inherit lib;
@@ -33,7 +34,6 @@
 
   host.laptop = true;
 
-  programs.gamemode.enable = true;
   hardware.bluetooth.enable = true;
   services.printing.enable = true;
 }

host/ThinkPad/modules/bottles.nix

@@ -0,0 +1,5 @@
+{pkgs-stable, ...}: {
+  environment.systemPackages = with pkgs-stable; [
+    bottles
+  ];
+}

host/ThinkPad/modules/fingerprint.nix

@@ -152,6 +152,79 @@
     done
   '';
 
+  systemctl = lib.getExe' pkgs.systemd "systemctl";
+  busctl = lib.getExe' pkgs.systemd "busctl";
+  timeout = lib.getExe' pkgs.coreutils "timeout";
+  sleep = lib.getExe' pkgs.coreutils "sleep";
+  fprintdList = lib.getExe' pkgs.fprintd "fprintd-list";
+
+  # python-validity initializes the sensor before it registers with
+  # open-fprintd, so a successful ListEnrolledFingers call means the sensor is
+  # usable.  This is used as ExecStartPost and by greetd ordering.
+  waitForFprint = pkgs.writeShellScript "wait-for-fprint" ''
+    for ((i = 0; i < 120; i++)); do
+
+      devices="$(${timeout} 1 ${busctl} --system call \
+        net.reactivated.Fprint \
+        /net/reactivated/Fprint/Manager \
+        net.reactivated.Fprint.Manager GetDevices 2>/dev/null || true)"
+
+      if [[ "$devices" =~ ^ao\ [1-9] ]]; then
+        echo "wait-for-fprint: sensor initialized: $devices"
+        exit 0
+      fi
+
+      ${sleep} 0.5
+    done
+
+    echo "wait-for-fprint: sensor initialization timeout" >&2
+    exit 1
+  '';
+
+  # The xHCI controller is reset during resume, which invalidates
+  # python-validity's USB handle.  Restart it from a systemd-sleep hook: the
+  # hook runs before logind emits PrepareForSleep(false), so hyprlock's
+  # built-in fingerprint auth sees a working sensor as soon as it resumes.
+  fprintResumeHook = pkgs.writeShellScript "fprint-resume" ''
+    if [ "$1" != "post" ]; then
+      exit 0
+    fi
+
+    # Stop the old instance first so its stale D-Bus target cannot be selected
+    # by the readiness checks below.  Start without blocking because
+    # python-validity's ExecStartPost waits for fprintd, but open-fprintd is
+    # still suspended until Resume is called below.
+    ${timeout} 10 ${systemctl} stop python3-validity.service || true
+    ${systemctl} start --no-block python3-validity.service || true
+
+    # Clear open-fprintd's suspended flag.  This also unblocks the new
+    # python-validity instance's ExecStartPost.
+    ${timeout} 10 ${busctl} call net.reactivated.Fprint /net/reactivated/Fprint/Manager \
+      net.reactivated.Fprint.Manager Resume || true
+
+    # Wait for the new backend to register.
+    for ((i = 0; i < 30; i++)); do
+      if ${timeout} 0.5 ${fprintdList} root >/dev/null 2>&1; then
+        break
+      fi
+      ${sleep} 0.1
+    done
+
+    # The target now exists, so Resume reinitializes the sensor.  Wait for it
+    # to become responsive before logind starts hyprlock's fingerprint auth.
+    ${timeout} 10 ${busctl} call net.reactivated.Fprint /net/reactivated/Fprint/Manager \
+      net.reactivated.Fprint.Manager Resume || true
+
+    for ((i = 0; i < 30; i++)); do
+      if ${timeout} 0.5 ${fprintdList} root >/dev/null 2>&1; then
+        exit 0
+      fi
+      ${sleep} 0.1
+    done
+
+    echo "fprint-resume: fingerprint backend did not become ready" >&2
+  '';
+
   sleepTargets = [
     "suspend.target"
     "hibernate.target"
@@ -175,9 +248,16 @@ in {
     polkit-1.fprintAuth = true;
     sudo.fprintAuth = true;
     login.fprintAuth = true;
-    hyprlock.fprintAuth = true;
+
+    # hyprlock still needs a PAM service for password authentication, but it
+    # must not run pam_fprintd: its own D-Bus fingerprint implementation is
+    # used instead.  Two implementations would fight over the device, and the
+    # PAM one breaks when the sensor is reset across suspend.
+    hyprlock = {};
   };
 
+  environment.etc."systemd/system-sleep/50-fprint-resume".source = fprintResumeHook;
+
   systemd.services = {
     open-fprintd = {
       description = "Open FPrint daemon";
@@ -198,6 +278,7 @@ in {
       serviceConfig = {
         Type = "simple";
         ExecStart = "${python-validity}/bin/python-validity-service";
+        ExecStartPost = "-${waitForFprint}";
         Restart = "always";
         RestartSec = 2;
         RuntimeDirectory = "python-validity";
@@ -215,16 +296,16 @@ in {
         ExecStart = "${pkgs.open-fprintd}/lib/open-fprintd/suspend.py";
       };
     };
+  };
 
-    open-fprintd-resume = {
+  # The sleep hook above resumes open-fprintd before logind wakes the
-      description = "Resume open-fprintd backends";
+  # graphical session.  The stock open-fprintd-resume unit runs later and
-      wantedBy = sleepTargets;
+  # resets the sensor while hyprlock is already verifying, so it must not be
-      after = sleepTargets;
+  # enabled.  Order greetd (and therefore Hyprland/hyprlock) after the
-      serviceConfig = {
+  # fingerprint backend so the first lock screen can use the sensor.
-        Type = "oneshot";
+  systemd.services.greetd = {
-        ExecStart = "${pkgs.open-fprintd}/lib/open-fprintd/resume.py";
+    after = [ "python3-validity.service" ];
-      };
+    wants = [ "python3-validity.service" ];
-    };
   };
 
   environment.systemPackages = [

modules/user.nix

@@ -5,7 +5,8 @@
         ./user/sleepMode.nix
         ./user/ghostty.nix
         ./user/qt.nix
-        ./user/zed-idea.nix
+        ./user/helix.nix
+        #./user/zed-idea.nix
         ./user/walker.nix
         ./user/btop.nix
         ./user/zsh.nix

modules/user/helix.nix

@@ -0,0 +1,192 @@
+{ inputs, pkgs, lib, config, ... }: let
+  # glibc >= 2.44 defines bsearch() as a C23 const-generic macro, which clashes
+  # with the copy vendored by some tree-sitter grammars (tree-sitter-perl).
+  # Drop the vendored implementation, same as nixpkgs does for upstream helix.
+  patchedStdenv = pkgs.stdenv // {
+    mkDerivation = args: pkgs.stdenv.mkDerivation (args // {
+      postPatch = (args.postPatch or "") + ''
+        if [ -e src/bsearch.c ]; then
+          rm src/bsearch.c
+          substituteInPlace src/tsp_unicode.h \
+            --replace-fail '#include "bsearch.c"' ""
+        fi
+      '';
+    });
+  };
+
+  helixGrammars = pkgs.callPackage "${inputs.helix-steel}/grammars.nix" {
+    stdenv = patchedStdenv;
+  };
+
+  helixSteel =
+    (
+      pkgs.callPackage "${inputs.helix-steel}/default.nix" {
+        gitRev = inputs.helix-steel.rev;
+
+        # The upstream flake builds the grammars with its own callPackage,
+        # swap in the patched ones.
+        callPackage = path: args:
+          if toString path == toString "${inputs.helix-steel}/grammars.nix" then helixGrammars
+          else pkgs.callPackage path args;
+      }
+    )
+    .overrideAttrs (old: {
+      cargoBuildFlags = (old.cargoBuildFlags or []) ++ [
+        "--features"
+        "steel,git"
+      ];
+    });
+
+  comment-headers = pkgs.fetchurl {
+    url = "https://github.com/codingvivi/comment-dividers.hx/raw/refs/heads/main/comment_headers.scm";
+    name = "comment_headers.scm";
+    hash = "sha256-ohgn6DFJl0rdRJuri6Frs/uUlUsPxMvPHDuw4FS3qEE=";
+  };
+
+  patched-comment-headers = pkgs.runCommand "comment_headers.scm" { } ''
+    install -m 0644 ${comment-headers} "$out"
+
+    ${pkgs.python3}/bin/python3 - <<'PY'
+    from pathlib import Path
+    import os
+    import sys
+
+    p = Path(os.environ["out"])
+    s = p.read_text()
+
+    start_marker = "(define (get-block-delims)"
+    end_marker = "(define (delete_till_first_nonwhitespace!)"
+
+    try:
+        start = s.index(start_marker)
+        end = s.index(end_marker, start)
+    except ValueError as e:
+        sys.exit(f"failed to find function markers: {e}")
+
+    new_get_block_delims = """(define (get-block-delims)
+      (helix.static.open_above)
+      (helix.static.insert_string "test_string")
+      (helix.static.normal_mode)
+      (helix.static.extend_to_line_bounds)
+      (helix.static.trim_selections)
+      (helix.static.toggle_comments)
+      (let* ([commented-test-string (helix.static.current-highlighted-text!)]
+             [strings-without-whitespace (split-whitespace commented-test-string)])
+        (delete-line-noyank!)
+        (cond
+          [(and (> (length strings-without-whitespace) 1)
+                (equal? (last strings-without-whitespace) "test_string"))
+           (list (first strings-without-whitespace) "")]
+          [(> (length strings-without-whitespace) 2)
+           (list (first strings-without-whitespace) (last strings-without-whitespace))]
+          [else
+           (list "" "")])))
+
+    """
+
+    s = s[:start] + new_get_block_delims + s[end:]
+
+    old = "(make-line line-length fill-pattern #f padding-pattern)"
+    new = "(make-line line-length \"\" fill-pattern padding-pattern)"
+
+    if old not in s:
+        sys.exit("failed to find insert-divider make-line call")
+
+    s = s.replace(old, new)
+
+    p.write_text(s)
+    PY
+  '';
+in {
+  home.packages = with pkgs; [
+    steel
+    wakatime-cli
+  ];
+
+  # Wakapi is WakaTime-compatible, so the same plugin/client works.
+  sops.templates.".wakatime.cfg" = {
+    path = "${config.home.homeDirectory}/.wakatime.cfg";
+    mode = "0600";
+    content = ''
+      [settings]
+      api_url = https://coding.srcoder.moe/api
+      api_key = ${config.sops.placeholder."tokens/apis/wakapi"}
+    '';
+  };
+
+  home.activation.installWakatimeHx = lib.hm.dag.entryAfter [ "writeBoundary" ] ''
+    export PATH="${pkgs.steel}/bin:$PATH"
+    export STEEL_HOME="${config.xdg.dataHome}/steel"
+
+    if [ ! -f "$STEEL_HOME/cogs/wakatime/wakatime.scm" ]; then
+      forge pkg install --git https://github.com/Xerxes-2/wakatime.hx.git
+    fi
+  '';
+
+  programs.helix = {
+    enable = true;
+    package = helixSteel;
+    defaultEditor = true;
+
+    settings = {
+      # theme = "catppuccin-mocha";
+      editor = {
+        insert-final-newline = false;
+        indent-guides.render = true;
+
+        whitespace.render = {
+          space = "all";
+          tab = "all";
+          nbsp = "none";
+          nnbsp = "none";
+          newline = "none";
+        };
+
+        cursor-shape = {
+          normal = "block";
+          insert = "bar";
+          select = "underline";
+        };
+      };
+
+      keys.normal = {
+        space = {
+          C-c = {
+            h = ":comment-h1";
+            j = ":comment-h2";
+            k = ":comment-h3";
+            d = ":comment-divider";
+          };
+        };
+
+        S-down = ["extend_to_line_bounds" "delete_selection" "paste_after"];
+        S-up = ["extend_to_line_bounds" "delete_selection" "move_line_up" "paste_before"];
+      };
+    };
+  };
+
+  xdg.configFile = {
+    "helix/cogs/comment_headers.scm".source = patched-comment-headers;
+    "helix/helix.scm".text = ''
+      (require (prefix-in div. "cogs/comment_headers.scm"))
+
+      (provide comment-h1 comment-h2 comment-h3 comment-divider)
+
+      (define (comment-h1)
+        (div.insert-h1!))
+
+      (define (comment-h2)
+        (div.insert-h2!))
+
+      (define (comment-h3)
+        (div.insert-h3!))
+
+      (define (comment-divider)
+        (div.insert-divider! 80 "~"))
+    '';
+    "helix/init.scm".text = ''
+      ;; Steel init file
+      (require "wakatime/wakatime.scm")
+    '';
+  };
+}

modules/user/secrets.nix

@@ -4,5 +4,6 @@
     age.keyFile = "${config.home.homeDirectory}/.config/sops/age/keys.txt";
 
     secrets."tokens/apis/wallhaven" = {};
+    secrets."tokens/apis/wakapi" = {};
   };
 }

modules/user/sleepMode.nix

@@ -1,8 +1,50 @@
-{ pkgs, lib, ... }:
+{ config, pkgs, lib, ... }:
 let
   hyprLua = import ./hyprland/lua.nix { inherit lib; };
+
+  hyprlock = lib.getExe pkgs.hyprlock;
+  hyprctl = lib.getExe' config.wayland.windowManager.hyprland.package "hyprctl";
+  loginctl = lib.getExe' pkgs.systemd "loginctl";
+  pidof = lib.getExe' pkgs.procps "pidof";
+  fprintdList = lib.getExe' pkgs.fprintd "fprintd-list";
+  timeout = lib.getExe' pkgs.coreutils "timeout";
+  sleepCmd = lib.getExe' pkgs.coreutils "sleep";
+  sh = lib.getExe pkgs.bash;
+
+  hyprlockWait = pkgs.writeShellScript "hyprlock-wait-fprint" ''
+    for i in $(seq 1 60); do
+      if ${timeout} 1 ${fprintdList} kirill >/dev/null 2>&1; then
+        break
+      fi
+      ${sleepCmd} 1
+    done
+    exec ${hyprlock}
+  '';
 in {
-  wayland.windowManager.hyprland.settings.on = [ (hyprLua.onStart [ "hyprlock" ]) ];
+  wayland.windowManager.hyprland.settings.on = [ (hyprLua.onStart [ "${hyprlockWait}" ]) ];
+
+  # Hypridle listens to logind's PrepareForSleep signal: it locks the session
+  # before suspend and makes sure hyprlock is running (and the display is on)
+  # after resume.
+  services.hypridle = {
+    enable = true;
+    settings = {
+      general = {
+        lock_cmd = "${pidof} hyprlock >/dev/null || ${hyprlockWait}";
+        before_sleep_cmd = "${loginctl} lock-session";
+        after_sleep_cmd = "${pidof} hyprlock >/dev/null || ${hyprlockWait} & ${hyprctl} dispatch 'hl.dsp.dpms({action = \"on\"})'";
+      };
+
+      # Hypridle requires at least one listener, so keep a no-op timer that
+      # practically never fires. Screen locking is driven by sleep/resume only.
+      listener = [
+        {
+          timeout = 604800; # 7 days
+          on-timeout = "";
+        }
+      ];
+    };
+  };
 
   programs.hyprlock = let
     image = pkgs.fetchurl {
@@ -14,6 +56,17 @@ in {
     enable = true;
 
     settings = {
+      # Hyprlock's built-in fingerprint support watches logind's
+      # PrepareForSleep signal and re-arms itself after resume.  PAM-based
+      # fingerprint auth (security.pam.services.hyprlock.fprintAuth) does not
+      # survive the fingerprint device being reset during suspend.
+      auth.fingerprint = {
+        enabled = true;
+        ready_message = "Scan fingerprint to unlock";
+        present_message = "Scanning...";
+        retry_delay = 250;
+      };
+
       background = {
         path = lib.mkForce "${image}";
         blur_passes = 0;

user/kirill/secrets.yaml

@@ -1,18 +1,19 @@
 tokens:
     apis:
-        wallhaven: ENC[AES256_GCM,data:pW9QiCB8yM2xSZQG96qCKOGOJbSFFrFxu8s1tHfmzWw=,iv:sezKkABxqVtd3mK8+WxEDPd+GtpyBcUJVLDlj/D68nU=,tag:HWE2QZf66dZGjK21WcxtiA==,type:str]
+        wallhaven: ENC[AES256_GCM,data:yO+thw4xgpMBuNx2LyxguDxAzoKSeDCyAAOcgtTxx74=,iv:j3LGKXnmykTamSuuIFbACT0kRDFazOhNEgWtVoxiWK4=,tag:jLaJrcUmDuxVj1D65NZhyg==,type:str]
+        wakapi: ENC[AES256_GCM,data:B4BOqy6TyZj4qPB9H7Ne+XaW701tX+ho8dMn0EGvqzdVOKq+,iv:/P6KZV9KgIBXslB3yZD5G3XER279iJ6/R2n+ZdTaBLs=,tag:r/SDXjofl8DdDlzP9Xo5mQ==,type:str]
 sops:
     age:
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUVVBNekFNbWNhSEx1d0c0
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1MXcwbkFxZ2R4V0ppOGo3
-            NHRNWW9iR3FSMnZIMkRKQy9pTTIzV2R6VG1BClJ4clI5SzRCTnJhZ25JSEJ3dkFF
+            UmFsTTJGekQ0NGVtTFpCRm50ekxJcEZUUW1FCkF5aStVckVNaVJndmptdnhtNjgx
-            QVE4VUt3YXBKZnRES3dXSjJxM2RJU0kKLS0tIExKci9iQWJ4VVdyU1dteVZXb21k
+            Z056TVF5ZVRuMWJZKzk1WlRZTXN3bjAKLS0tIEhHd1JyTkhIdjJuZVZtSFlTRXIy
-            S1VhaW5rQVkzUWMweHdNaThmblRYWWMKrhP0P4ftPNKfjss5JDa4SESSYXdop/U/
+            cTRWRkZXUmcrcHRXU2pyTzh1OGhaSkkKiqYLrPm1zS0PfrIeUnZHXvvHcY15PxDS
-            uIfI1RPTXbReF124NIIEvJ6AsiQKDDCjpgT0m/1i/U3yIF1UejPiQg==
+            01jUzubGavkuOXb0hJmr6oBkEkSMBW+GLewduqj0SxGF2yxTSkM0kQ==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1tx6jdr6535xxeygpwkkgvdwc24tulr420cm7gk56xzfp0slzeqks2nwpyg
-    lastmodified: "2026-10-17T13:36:46Z"
+    lastmodified: "2026-10-21T17:46:52Z"
-    mac: ENC[AES256_GCM,data:stlsKKQhQL6+utokuXvNZH1dlWfEeUa5nORN5eQnbNcXbo1MrFVz9wVDqVtpgZOc3/v8p4YaHXLhQl8/RpawAwQH03gvcZ5zt1aA+Z7K6yh9ONRSnwz2lUXwCbpaf0xYRIlzv7pSPBJdLfYSN3kaEwVKrItAsPxuHEI/WEh8M3Y=,iv:W1vLWvQ7b635MpbUC7m3ATBPa/MujvAji2/MN9kldq4=,tag:DlVg1LCVvjPOg4nRP3rjAA==,type:str]
+    mac: ENC[AES256_GCM,data:mLdD78pb0Qf30+l/igb+jXMHxNXTXJPNtsi3cGeEgYLKxnx02OVBuOnncMZvN351yh7h5if9pCqwCJeOISWU8uFZrQdJeDjdmIPlP1eqzBQ7fK4fhEeRzAcn4dTQ5tcmu3uXmWElKcBYhMFEPr3/etyfDcX5ZFwOra8wUqU8nq4=,iv:TydKNjO5stupovtCF/rHMtr1Da2IFafMZiLQxsln1uA=,tag:kXl5eELy9I5APJkAQ8tk3w==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.13.3