···536536 echo "retiolum has no global address after 60s; API server stays on localhost" >&2
537537 exit 0
538538 ''}"
539539+ # Bundled skills are copied out of the Nix store with shutil.copytree,
540540+ # which keeps the store's r-x/r-- modes, so skill_manage could not patch
541541+ # them ("Permission denied: skills/productivity/maps/.tmp_…"). Seed them
542542+ # here instead of at gateway start, then make them writable; the gateway's
543543+ # own sync then finds nothing to copy (its hash is content-only, so the
544544+ # chmod does not mark them user-modified). `opt-in` only drops the
545545+ # .no-bundled-skills marker, which this host never sets.
546546+ "${pkgs.writeShellScript "hermes-skills-writable" ''
547547+ set -eu
548548+ hermes skills opt-in --sync
549549+ ${pkgs.findutils}/bin/find ${config.services.hermes-agent.stateDir}/.hermes/skills \
550550+ ! -perm -u+w -exec ${pkgs.coreutils}/bin/chmod u+w {} +
551551+ ''}"
539552 ];
540553541554 # The packet filter drops INPUT by default here (configs/default.nix sets