Interactive non-login Bash shells now apply the current session
variables file before bashrcExtra and initExtra. New terminals pick up
values changed by home-manager switch.
Login shells skip the refresh because .profile already applied it.
Non-interactive shells skip it because sshd can read .bashrc for remote
commands, where startup output can corrupt protocols such as scp and
rsync.
Apply programs.bash.sessionVariables after generic values to preserve
its precedence. Expansions run on every interactive non-login shell, so
warn when direct self-references can change repeatedly. Declarative
search paths remain stable across repeated sourcing.
A profileExtra assignment that collides with a Home Manager-managed
variable is now overwritten in non-login shells. Move such overrides to
initExtra, which runs after the refresh.
targets.genericLinux no longer needs its separate initExtra source.
Move the once-per-session guard to the final extra-code section. Plain
and search variables can then refresh without rerunning arbitrary code.
Keep the extra body top-level so shell parse behavior stays unchanged.
Use an exported generation token for Zsh. Changes to generic or
Zsh-specific values reapply both layers, while unchanged nested shells
keep Zsh precedence and do not repeat self-references.
Plain values are re-evaluated each time the file is applied. Command
substitutions run again, and some self-references can change repeatedly.
Removing a variable still requires a new session.
Closes#3999Closes#4559
Warn when session-variable definitions may change if applied more than
once. Apply the check to home and Zsh session variables without changing
their generated output.
Detect direct references after caller-specific rendering while excluding
stable whole-value expansions. Attribute each warning to the surviving
per-attribute definitions, including their module priorities and wrappers.
This gives users advance notice before later work allows the session
configuration to be applied in new shells. Recommend search-variable
options for path-like values and complete assignments for other values.
Tests cover detector boundaries, Zsh escaping, source attribution, and
both module call sites.
Switches `home.sessionPath` and `home.sessionSearchVariables` from
concatenation to the merge helper added in the previous commit. The
first merge preserves configured-first search order while removing
duplicate entries. Later merge blocks preserve inherited positions.
Entries that expand to an empty string are ignored. Statically empty
entries also produce an evaluation warning so an accidental
current-directory entry does not disappear silently.
Fish gets a native merge helper because babelfish rejects the POSIX
helper's quoted pattern removal, and Fish stores names ending in PATH as
lists. Candidate assignments and merge calls are translated together so
references to earlier search variables observe the same values as the
POSIX file. The native helper also preserves newline-bearing values
through Fish command substitutions.
A shared behavioral fixture sources both generated files for first and
later merges. It covers expansion and escaping, cross-variable
references, unset and empty values, duplicates, separator-bearing
entries, empty fields, Fish list shape, helper cleanup, and leading,
embedded, and trailing newlines.
Removes `prependToVar`, which has no consumers left and produced the
self-referential form this replaces. It was public through
`lib.hm.shell`, so the release notes include migration guidance.
nixpkgs#558216 switched the worktrunk package to the installAgentSkills
hook, moving the bundled skills from $out/skills/ to
$out/share/skills/worktrunk/.
Assisted-by: Claude-Code:GLM-5.3
Co-authored-by: Austin Horstman <khaneliman12@gmail.com>
Add programs.astroid.settings for native JSON configuration and
generate the configuration file from it.
The extraConfig and externalEditor options become deprecated aliases
into settings. Home Manager no longer writes its bundled template;
Astroid's built-in defaults match it except editor.markdown_processor.
Astroid accounts still supply account settings, the notmuch path, and
the GPG path as per-key defaults. Empty settings write no file.
externalEditor now merges at ordinary priority instead of replacing
the editor keys, and priorities on extraConfig sections apply to the
section as a unit. The release notes describe both changes.
Add programs.notmuch.settings for native INI configuration with list
values, and generate the configuration file from it.
The new.ignore, new.tags, maildir.synchronizeFlags, search.excludeTags,
and extraConfig options become deprecated aliases into settings.
Settings carry no static defaults: new.tags, new.ignore, and
maildir.synchronize_flags fall back to notmuch's identical defaults.
State versions before 26.11 keep search.exclude_tags = deleted;spam and
write database.path even without email accounts. Enabled email
accounts supply database.path, and notmuch-enabled accounts the user
identity. Null values and empty sections are omitted so a derived
value can be removed.
extraConfig no longer overwrites modeled values unconditionally: forced
definitions win and ordinary collisions fail. The release notes
describe the migration.
Mbsync, lieer, and mujmap now write settings.new.ignore directly, so
they do not trigger deprecation warnings.
Add programs.borgmatic.backups.<name>.settings for native borgmatic
YAML and generate each backup file from it.
The location, storage, retention, and consistency options and the
section extraConfig options become deprecated aliases into settings.
Warnings name the affected backup. Legacy configurations without
overlapping keys produce the same YAML, and Home Manager symlink
exclusions still append to exclude_from.
Drop the assertions that rejected backups setting both or neither of
sourceDirectories and patterns, so native source patterns and
database-only backups work.
Consistency checks without a frequency were written as
`frequency: null`, which borgmatic rejects during configuration
validation. Omit null check fields so borgmatic applies its own
default.
python3Packages.requests_oauthlib was removed and python3Packages.gpgme
is an alias; the packages are requests-oauthlib and gpg. The example
also extended old.propagatedBuildInputs, which the package does not
set because it lists its Python dependencies in dependencies, so it
failed to evaluate. Extend old.dependencies instead.
The example took typescript-language-server and typescript from
pkgs.nodePackages, which nixpkgs removed, and passed --tsserver-path,
which typescript-language-server 5.3.0 rejects as an unknown option,
so the server exited at startup. Run the top-level
typescript-language-server with --stdio only; the nixpkgs package
already falls back to the tsserver from typescript_5.
The pinentry description told users to add pkgs.gcr to
services.dbus.packages, but nixpkgs removed it. Suggest pkgs.gcr_3,
which NixOS uses for pinentry-gnome3.
mcp-config.json is generated in the world-readable Nix store, and the
example put an API key in an HTTP header. Remove the key from the
example and document env.<NAME>.file, which Home Manager reads at server
startup for local servers.
config.json is generated in the world-readable Nix store, but the
description did not warn against registry credentials or proxy
passwords. Point at Docker credential stores instead, note that docker
login still reports an error when it adds a registry to the read-only
file, and mention the helper's own store command. Also close the
unterminated link to the config.json reference.
Values in mcpServers are serialized into a generated plugin in the
world-readable Nix store, and the example put database credentials in a
DSN and an environment variable. Remove the credentials from the example
and point local servers at the file-backed programs.mcp.servers
environment values.
The settings example set a Nostr private key, and the generated
config.json is a world-readable Nix store path. Drop the key from the
example and explain the exposure.
The settings example showed a literal api_key, which ends up in
aiac.toml in the world-readable Nix store. aiac expands environment
variables in api_key, so show an environment variable reference
instead.
When the matching imapAuth or smtpAuth is oauthbearer or xoauth2, a
non-null client_secret is URL-encoded into the source or outgoing URL
in accounts.conf, which is a world-readable Nix store file. Say so in
the option description.
The access or refresh token does not need to be in that file. The
module sets source-cred-cmd and outgoing-cred-cmd from passwordCommand,
and aerc uses the command's output as the access token, or as the
refresh token when token_endpoint is set. Say that too.
The settings example set a Discord login token, and the generated
abaddon.ini is a world-readable Nix store path. Drop the token from the
example and say so in the description. Abaddon also rewrites
abaddon.ini when it exits, replacing the file Home Manager links, and a
token set from its Discord menu is saved there, so suggest leaving the
option empty when logging in from Abaddon.
The publicKeys trust description linked to a GNU Privacy Handbook page
that returns 404. Link the Trust Values chapter of the GnuPG manual,
which lists the same levels.
The wezterm documentation moved from wezfurlong.org/wezterm to
wezterm.org, and the old configuration pages return 404. Update the
settings, extraConfig, and colorSchemes links.
The settings description linked to vinegarhq.org/Configuration/, which
returns 404. Link the config package in the vinegar repository, which
defines the configuration keys.
The settings description linked to the config page of the old
documentation site, which returns 404. The current site documents the
config.json keys on its configuration schema page, so link that.
The settings and profiles descriptions linked to
wojciech-zurek/FlashSpace, which returns 404. The project lives at
wojciech-kulik/FlashSpace, the nixpkgs homepage, so link that
repository.
The settings description linked docs/config.md in the zk repository,
which returns 404 because the configuration docs moved into
docs/config/. Link the configuration file page on the zk documentation
site.
