sandboxing

home/agents.nix

@@ -236,8 +236,8 @@ in
 {
   home-manager.users = lib.mkMerge [
     (home-manager-config {
-      uid = 1002;
-      username = "agent";
+      uid = 1001;
+      username = "sandbox";
     })
   ];
 }

home/nvim/default.nix

@@ -61,13 +61,13 @@ in
             })
           '';
         }
-        # {
-        #   plugin = comment-nvim;
-        #   type = "lua";
-        #   config = ''
-        #     require('Comment').setup()
-        #   '';
-        # }
+        {
+          plugin = comment-nvim;
+          type = "lua";
+          config = ''
+            require('Comment').setup()
+          '';
+        }
         {
           plugin = conform-nvim;
           type = "lua";
@@ -87,7 +87,7 @@ in
             		less = { "prettierd" },
             		blade = { "blade-formatter" },
             		go = { "gofmt" },
-                    wgsl = { "wgsl_fmt" },
+                    wgsl = { "wgslfmt" },
                     odin = { "odinfmt" },
             	},
             })
@@ -143,13 +143,13 @@ in
         #   plugin = neotest-zig;
         #   type = "lua";
         # }
-        # {
-        #   plugin = nvim-autopairs;
-        #   type = "lua";
-        #   config = ''
-        #     require('nvim-autopairs').setup()
-        #   '';
-        # }
+        {
+          plugin = nvim-autopairs;
+          type = "lua";
+          config = ''
+            require('nvim-autopairs').setup()
+          '';
+        }
         {
           plugin = nvim-dap;
           type = "lua";

home/user.nix

@@ -62,13 +62,16 @@
       systemd.user.services.waypipe-socket = {
         Unit = {
           Description = "start waypipe client";
+          After = [ "niri.service" ];
+          Requires = [ "niri.service" ];
         };
         Install = {
           WantedBy = [ "graphical-session.target" ];
         };
         Service = {
           ExecStart = "${pkgs.waypipe}/bin/waypipe --socket /tmp/waypipe.sock client";
-          ExecStartPost = "${pkgs.acl}/bin/setfacl -m u:agent:rw /tmp/waypipe.sock";
+          ExecStartPost = "${pkgs.acl}/bin/setfacl -m g:sandbox:rw /tmp/waypipe.sock";
+          ExecStopPost = "${pkgs.coreutils}/bin/rm /tmp/waypipe.sock";
           RuntimeDirectory = "waypipe";
           Type = "simple";
           Restart = "on-failure";
@@ -255,6 +258,7 @@
       };
 
       programs = {
+        opencode.enable = true;
         dank-material-shell.enable = true;
         ssh = {
           enable = true;
@@ -351,7 +355,7 @@
             };
             safe = {
               directory = [
-                "/home/agent/*"
+                "/home/sandbox/*"
               ];
             };
           };
@@ -360,9 +364,9 @@
 
       home.packages = with pkgs; [
         xrdb
-        (writeShellScriptBin "agent" ''
-          machinectl shell agent@ ${waypipe}/bin/waypipe --socket /run/waypipe.sock server fish
-        '')
+        # (writeShellScriptBin "agent" ''
+        #   machinectl shell agent@ ${waypipe}/bin/waypipe --socket /run/waypipe.sock server fish
+        # '')
         (writeShellApplication {
           name = "tmux-sessionizer";
           runtimeInputs = [