- Auto-joins rooms when invited
- Detects IMDb and TMDB links, requests media via Jellyseerr
- Resolves IMDb IDs through Radarr/Sonarr
- Checks if media already exists and replies with direct flax.lassul.us link
- Webhook listener for Radarr/Sonarr download notifications
- Tracks requests and notifies rooms when downloads complete
- Uses LoadCredential for secrets (matrix token, API keys)

- Daemon: only tracks workspace/directory, emits events, persists tabs
- Remove on_create/on_enter/on_leave hooks, tmux management, restore flag
- Firefox extension: saves tabs to ~/workspaces/<name>.json via daemon
- Firefox extension: anchor window keeps Firefox alive, hidden in scratchpad
- Daemon registers sway for_window rule before Firefox starts
- Firefox service: Restart=always, starts after workspace-manager
- Native host: passes tab save/load through daemon (single writer)
- Workspace menu: simplified to restore tabs, close, edit, delete
- Remove workspace-on-new.sh (no longer needed)
- NixOS module: only directory option remains

Adapted to upstream rename in NixOS/nixpkgs#475836.

- Add workspace-menu (mod4+space): save layout, restore, close, edit, delete
- Add workspace-on-new: prompt to restore or start fresh on new workspace
- Pass restore flag through daemon -> native host -> Firefox extension
- Skip prompt for workspaces that already have windows
- Move NixOS module from 3modules/ to tools/ as wrapperModule
- Declare flake.wrapperModules option for multi-module merging

- swayidle was calling plain 'systemctl suspend' instead of suspend-then-hibernate
- add explicit SuspendMode/SuspendState to sleep.conf

- Add amdgpu.dcdebugmask=0x10 to prevent GPU hang when gaming with external display
- Add configurationLimit=10 to prevent /boot from filling up

muchsync writes tags directly to the xapian database, bypassing
notmuch's synchronize_flags. This means read/unread status from
mutt never gets reflected in Maildir filenames, so Dovecot (IMAP)
still shows messages as unread.

Add a systemd path unit that watches the notmuch xapian directory
and renames files to add/remove the S (Seen) flag based on the
notmuch unread tag.

- User systemd with linger, uvicorn --reload from bare repo worktree
- Vendor files (diff2html) fetched and symlinked at startup
- kannix-ctl wrapper script in user packages

- Add kannix flake input (local git repo)
- 2configs/kannix.nix: kannix service on port 4243, nginx at kannix.lassul.us
- Git integration enabled (repos + worktrees in /var/lib/kannix/)
- SSH keys for kannix user
- Backup updated: /var/lib/kannix instead of /var/lib/kanvibe

Disable the AWS harvester in jitsi-videobridge since it is not needed
for self-hosted setups.

Add ULA prefix fd42:7d6a::/64 on int0 with IPv6 Router Advertisement
so clients get IPv6 via SLAAC. Enable IPv6 forwarding and NAT66
masquerade for the ULA prefix. This fixes Jitsi (and other IPv6-only
services) not working from the internal network.

Uses self-contained pactl/ffmpeg commands so completions work without
record being in PATH (e.g. when completing through `s record <TAB>`).

Add virtual.All mailbox (all messages across all folders) so attachments
can be opened reliably (virtual.Unread loses messages when marked read).
Bump imapMemoryLimit to 1GB for virtual mailbox sync.
Also increase snappymail PHP/nginx timeouts.

Move virtual mailbox config from nix store (read-only) to
/var/vmail/virtual-config via systemd.tmpfiles, fixing ACL plugin
errors. Exclude notmuch and fts-flatcurve from virtual search.

Adds a deploy wrapper around `clan machines update` that:
- Syncs the password store (pull/push) around deploys
- Extracts the bulk age key into a secure tmpdir for fast decryption
- Cleans up key material on exit

Co-Authored-By: Claude (claude-opus-4-6) <noreply@anthropic.com>

Add usage.kdl (https://usage.jdx.dev/spec/) files for all 32 tools
describing their CLI interface. Each tool exposes its spec as a string
via passthru.usage (builtins.readFile ./usage.kdl).

The s wrapper now includes a zsh completion function that:
- Instantly completes package names (baked in at build time)
- Lazily fetches per-tool usage specs via nix eval on first use
- Caches specs keyed by flake narHash for invalidation