From f1fc7fa84087035fa796915d33b2a8a48ccddc0f Mon Sep 17 00:00:00 2001 From: Tobias Ostner Date: Wed, 29 Jul 2026 13:07:00 +0200 Subject: [PATCH 01/10] Configure Pi subagents and planning skill --- flake.lock | 8 ++++---- module/home-manager.nix | 4 +++- 2 files changed, 7 insertions(+), 5 deletions(-) diff --git a/flake.lock b/flake.lock index 8f7a316..afae3e3 100644 --- a/flake.lock +++ b/flake.lock @@ -3,11 +3,11 @@ "agent-skills": { "flake": false, "locked": { - "lastModified": 1785234559, - "narHash": "sha256-9aejq9o5rNQkMZve8GHKkV1lz6v2kmotDgacBb25bes=", + "lastModified": 1785322008, + "narHash": "sha256-1NmnD25Q9wgDa1IsSKE8Ky7S9J9wt0KSKDsVZekLbQY=", "ref": "main", - "rev": "d35f1642a58b3725957361a789ad30c02deed5be", - "revCount": 4, + "rev": "5960c925868f3eb5d1721d75c6bf31457228bab0", + "revCount": 6, "type": "git", "url": "https://codeberg.org/oibot/agent-skills.git" }, diff --git a/module/home-manager.nix b/module/home-manager.nix index e8658ca..00ee6d6 100644 --- a/module/home-manager.nix +++ b/module/home-manager.nix @@ -107,6 +107,7 @@ pi.coding-agent = { enable = true; skills = [ + (inputs.agent-skills + "/create-plan") (inputs.agent-skills + "/create-skill") ]; environment = { @@ -119,7 +120,8 @@ packages = [ "npm:pi-web-access@0.15.0" - "npm:pi-mcp-adapter@2.10.0" + "npm:pi-mcp-adapter@2.15.0" + "npm:pi-subagents@0.37.2" ]; }; }; From 648dfc5c183377077dc538ce8d8802ae3fb4b345 Mon Sep 17 00:00:00 2001 From: Tobias Ostner Date: Thu, 30 Jul 2026 13:15:44 +0700 Subject: [PATCH 02/10] Configure Pi guardrails for SSH commands --- module/home-manager.nix | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/module/home-manager.nix b/module/home-manager.nix index 00ee6d6..4a04156 100644 --- a/module/home-manager.nix +++ b/module/home-manager.nix @@ -10,6 +10,22 @@ firecrawlApiKey = "$FIRECRAWL_API_KEY"; firecrawlFreshScrape = true; }; + home.file.".pi/agent/extensions/guardrails.json".text = builtins.toJSON { + features = { + policies = false; + permissionGate = true; + }; + permissionGate = { + requireConfirmation = true; + patterns = [ + { + pattern = "(^|[;&|])\\s*(ssh|scp|sftp)(\\s|$)"; + description = "SSH connection or file transfer"; + regex = true; + } + ]; + }; + }; sops = { age.keyFile = "${config.home.homeDirectory}/Library/Application Support/sops/age/keys.txt"; @@ -122,6 +138,7 @@ "npm:pi-web-access@0.15.0" "npm:pi-mcp-adapter@2.15.0" "npm:pi-subagents@0.37.2" + "npm:@aliou/pi-guardrails@0.16.0" ]; }; }; From b790008098fb6cdf2880996df63c3974fc03f094 Mon Sep 17 00:00:00 2001 From: Tobias Ostner Date: Thu, 30 Jul 2026 13:35:31 +0700 Subject: [PATCH 03/10] Exclude Herdr from Pi guardrails --- module/home-manager.nix | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/module/home-manager.nix b/module/home-manager.nix index 4a04156..476129f 100644 --- a/module/home-manager.nix +++ b/module/home-manager.nix @@ -138,7 +138,10 @@ "npm:pi-web-access@0.15.0" "npm:pi-mcp-adapter@2.15.0" "npm:pi-subagents@0.37.2" - "npm:@aliou/pi-guardrails@0.16.0" + { + source = "npm:@aliou/pi-guardrails@0.16.0"; + extensions = [ "-extensions/herdr/index.ts" ]; + } ]; }; }; From 36ea7633a4511b52e52cfb27d2de0512a224df23 Mon Sep 17 00:00:00 2001 From: Tobias Ostner Date: Fri, 31 Jul 2026 20:07:25 +0700 Subject: [PATCH 04/10] Mark Pi guardrails config schema version --- module/home-manager.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/module/home-manager.nix b/module/home-manager.nix index 476129f..0a90e39 100644 --- a/module/home-manager.nix +++ b/module/home-manager.nix @@ -11,6 +11,7 @@ firecrawlFreshScrape = true; }; home.file.".pi/agent/extensions/guardrails.json".text = builtins.toJSON { + version = "0.13.0-20260619"; features = { policies = false; permissionGate = true; From 0a5c560f75aeb5ef457083487a253c11955f6690 Mon Sep 17 00:00:00 2001 From: Tobias Ostner Date: Fri, 31 Jul 2026 15:50:52 +0200 Subject: [PATCH 05/10] Configure IONOS MCP server --- config/mcp/mcp.json | 6 ++++++ module/home-manager.nix | 2 ++ secrets/secrets.yaml | 7 ++++--- 3 files changed, 12 insertions(+), 3 deletions(-) diff --git a/config/mcp/mcp.json b/config/mcp/mcp.json index 81ac60a..c1814c6 100644 --- a/config/mcp/mcp.json +++ b/config/mcp/mcp.json @@ -1,5 +1,11 @@ { "mcpServers": { + "ionos": { + "url": "https://mcp.ionos.com/mcp", + "auth": "bearer", + "bearerTokenEnv": "IONOS_PAT", + "lifecycle": "lazy" + }, "linear": { "url": "https://mcp.linear.app/mcp", "auth": "oauth", diff --git a/module/home-manager.nix b/module/home-manager.nix index 0a90e39..6a2ae41 100644 --- a/module/home-manager.nix +++ b/module/home-manager.nix @@ -33,6 +33,7 @@ defaultSopsFile = ../secrets/secrets.yaml; secrets.firecrawl_api_key = { }; + secrets.ionos_pat = { }; }; targets.darwin.defaults = { @@ -129,6 +130,7 @@ ]; environment = { FIRECRAWL_API_KEY.file = config.sops.secrets.firecrawl_api_key.path; + IONOS_PAT.file = config.sops.secrets.ionos_pat.path; }; settings = { defaultProvider = "openai-codex"; diff --git a/secrets/secrets.yaml b/secrets/secrets.yaml index 3d58266..cd1e035 100644 --- a/secrets/secrets.yaml +++ b/secrets/secrets.yaml @@ -1,4 +1,5 @@ firecrawl_api_key: ENC[AES256_GCM,data:T5o3SaZmteTq+c6Qw3pvYrW7+Yicio3EbfI3c+d1ZxbsHEU=,iv:bg+q7TZDdsyWI+nvDzX/LpMf2FTKEKBKgMXOhUMCAho=,tag:fmRHmgWfFfL4ckQcTKdshQ==,type:str] +ionos_pat: ENC[AES256_GCM,data:UizMtJgoMAoYC4LPkP6hgmYjR5y2QL1ngfgZNkt7R53L8QSm7Yah7pDCZw==,iv:KzekpU5Bhy9RqtWWUK6ZFmsasJy6IiuAujDFn7dCqpM=,tag:/IEmHjS4Hw7+YsO2P7aXjQ==,type:str] sops: age: - enc: | @@ -10,7 +11,7 @@ sops: ptUomL2W/we4iRbe1LnPHB1JqBuYZSEaXGgdFbGGf2iYw/jtEE5gTQ== -----END AGE ENCRYPTED FILE----- recipient: age106xkhmfrzqum2zkuxxfwjddesuwu6m99tqtt7s3pre4d4wejlp7qkhyfee - lastmodified: "2026-06-19T11:46:02Z" - mac: ENC[AES256_GCM,data:NqmNt+NagD6Fg0KiXkvSIZq/c73F78u7bZfsTFiKqezhcipfsex+71wriLTB3E3fEV9L0YseXWqbaXJjQnE26GoLaqHB232N9BUSw676tetb+5n59oi13FbaZl77OMsh7QZGQ1oSKWccmGm9UVo7T9YBgJHGys/ucqVTqaOAIlg=,iv:7PhfpF9TqgZPVSdi7/sacMSDBOr6fseSERbVisef98M=,tag:Ci6sKjA70Jj13y1JwPPUBQ==,type:str] + lastmodified: "2026-07-31T13:37:26Z" + mac: ENC[AES256_GCM,data:z0o0HITRWvzn8YTehdMhhPCtKosM7Jx0jRCfhV5iJzncjs5cBMi6H8s+0aCd/Ymst6TZsWdq+9I2icwM8SHDWzRrkXzzrPZmqZ+jl4A+tTNcVbRr18ymojg/kz3888jxedYeClRkUbzKGkv/saxOidO5PPyutExdKcomVdcj1kE=,iv:gfEkvBDWmSH9A1qwbx6hSq5k9Xh5DwMcWIvvtkVC6tc=,tag:nse1YX5rYp2DUUOwfYFl0Q==,type:str] unencrypted_suffix: _unencrypted - version: 3.13.1 + version: 3.13.3 From 4cc228a47e2aae0672a195997958d33cb8dabca3 Mon Sep 17 00:00:00 2001 From: Tobias Ostner Date: Sat, 1 Aug 2026 12:04:20 +0700 Subject: [PATCH 06/10] nix flake update pi --- flake.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/flake.lock b/flake.lock index afae3e3..51ccbfc 100644 --- a/flake.lock +++ b/flake.lock @@ -164,11 +164,11 @@ "systems": "systems" }, "locked": { - "lastModified": 1785138805, - "narHash": "sha256-NZ9C/5I/PDJUERJ+gVqTBcZJqp5YlSgu/a6Y3I5RIG8=", + "lastModified": 1785511290, + "narHash": "sha256-oz9nu9DUlq657V8Lhb+jsSmRhjzHOQ8ty3oAw158+f4=", "owner": "lukasl-dev", "repo": "pi.nix", - "rev": "740d5d8af6d3cffca0b369418144cc7123a167a4", + "rev": "3d2bd32b017a0e55a072d74963443ab97eab9a27", "type": "github" }, "original": { From 76f1fe31ab160522e0b62d28f155114df3f2b5ce Mon Sep 17 00:00:00 2001 From: Tobias Ostner Date: Sat, 1 Aug 2026 07:12:06 +0200 Subject: [PATCH 07/10] Trust Aerospace Homebrew tap --- module/configuration.nix | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/module/configuration.nix b/module/configuration.nix index f4e67d1..c1aa220 100644 --- a/module/configuration.nix +++ b/module/configuration.nix @@ -54,7 +54,10 @@ taps = [ "homebrew/services" "mihaelamj/tap" - "nikitabobko/tap" + { + name = "nikitabobko/tap"; + trusted = true; + } ]; }; From e22cd118e77bdcccd2d3754de574bdb7d4737086 Mon Sep 17 00:00:00 2001 From: Tobias Ostner Date: Sat, 1 Aug 2026 07:21:18 +0200 Subject: [PATCH 08/10] Store Pi subagent artifacts with sessions --- module/home-manager.nix | 3 +++ 1 file changed, 3 insertions(+) diff --git a/module/home-manager.nix b/module/home-manager.nix index 6a2ae41..f7a2b0c 100644 --- a/module/home-manager.nix +++ b/module/home-manager.nix @@ -10,6 +10,9 @@ firecrawlApiKey = "$FIRECRAWL_API_KEY"; firecrawlFreshScrape = true; }; + home.file.".pi/agent/extensions/subagent/config.json".text = builtins.toJSON { + artifactDir = "session"; + }; home.file.".pi/agent/extensions/guardrails.json".text = builtins.toJSON { version = "0.13.0-20260619"; features = { From 9dfaa3e6c504b3064a2d71327c556c8eae1084e4 Mon Sep 17 00:00:00 2001 From: Tobias Ostner Date: Sat, 1 Aug 2026 16:46:39 +0700 Subject: [PATCH 09/10] Remove unavailable Cupertino Homebrew tap --- module/configuration.nix | 5 ----- 1 file changed, 5 deletions(-) diff --git a/module/configuration.nix b/module/configuration.nix index c1aa220..49dd371 100644 --- a/module/configuration.nix +++ b/module/configuration.nix @@ -26,10 +26,6 @@ enable = true; onActivation.cleanup = "zap"; - brews = [ - "mihaelamj/tap/cupertino" - ]; - casks = [ "aerospace" "chatgpt" @@ -53,7 +49,6 @@ taps = [ "homebrew/services" - "mihaelamj/tap" { name = "nikitabobko/tap"; trusted = true; From 1050439048b0ed58dfd8f3230dfd651691cfeb7e Mon Sep 17 00:00:00 2001 From: Tobias Ostner Date: Sat, 1 Aug 2026 16:50:21 +0700 Subject: [PATCH 10/10] Install GitHub and Forgejo CLIs --- module/home-manager.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/module/home-manager.nix b/module/home-manager.nix index f7a2b0c..fb6ddc4 100644 --- a/module/home-manager.nix +++ b/module/home-manager.nix @@ -62,6 +62,8 @@ coreutils curl fira-code + forgejo-cli + gh gnupg htop imagemagick