- use session keyring (@s) instead of user keyring (@u) for caching
- use keyctl padd instead of keyctl add to avoid PIN in /proc/*/cmdline
- make keyctl timeout failures non-fatal
- reject empty PIN input
- "Clear cache" falls through to re-prompt instead of aborting
- integrate with pass wrapper via maybe_set_tpm_pin
- apply same keyring and security fixes to tools.pinentry-rofi

Add -i flag for case-insensitive matching so typing 'o' filters to OK.
Remove -only-match and hidden inputbar which broke keyboard selection.

Switch from --netfilter to --iptables mode so Jool only processes
container traffic. --netfilter mode intercepts all packets to
64:ff9b::/96, breaking upstream NAT64 (e.g., Android hotspot tethering).

Show OK/Cancel/Clear cache options instead of confusing menu.
Add -only-match to prevent typing from breaking selection.

Uses NixOS services.radicle module with clan vars for key management.
Configures SOCKS proxy for .onion seed connectivity.

- Cache PIN in kernel keyring (keyctl) for 5 minutes with sliding window
- Show menu to use cached PIN or clear cache when cache exists
- Escape <, >, & in SSH args for pango markup (fixes empty prompt with
commands containing redirections like 2>/dev/null)

Add a rofi-based pinentry for TPM SSH authentication that displays
the SSH command being authenticated (destination, flags, arguments).

- Patch ssh-tpm-agent to pass client PID via SSH_CLIENT_PID env var
using SO_PEERCRED on the Unix socket
- New pinentry-rofi tool reads /proc/<pid>/cmdline to show SSH args
- Update tpm2.nix to use the patched agent and new pinentry

Run packages from superconfig with a short command.
Uses ~/src/superconfig if available, falls back to built-in flake reference.

Adds yt-dlp-master package built from git master which includes PR #15726
that removes the problematic android_sdkless player client.

Also changes ytdl-format from best to bestvideo+bestaudio to get separate
video/audio streams for quality menu support.

https://github.com/yt-dlp/yt-dlp/issues/15712

- Import kitty.nix in wayland.nix
- Change sway terminal keybinding to open kitty

Allows kitty graphics protocol to work inside tmux sessions.

Uses forked yt-x with support for full path extensions (-x flag).
Passes our custom mpv (with quality-menu, sponsorblock, etc.) via
extension file in nix store.

PR upstream: https://github.com/Benexl/yt-x/pull/130

- Font configuration (IosevkaTerm Nerd Font)
- Remote control enabled for runtime theme switching
- Light and dark theme colors in /etc/themes/
- Integrates with switch-theme for dynamic color changes

This reverts commit 1f1a5b3b98c12b8f8b3cfa67f63d8d6be5cde9f1.

this broke nix shell and nix=shell --command zsh

Use folder-hooks to set alternates per-mailbox so identities don't overlap.
This prevents mutt from thinking you're replying to yourself when both
sender and recipient are in your various email domains.

Switch from pass to rbw for retrieving the c-base mail account password.

Allows HedgeDoc editors to maintain focus when clicked, fixing the issue where text input was interrupted after 1 second due to Tridactyl blocking autofocus attempts.

Using the stable system path instead of a hardcoded store path means
BROWSER automatically points to the current system's firefox after rebuild.