style: 将项目中所有英文注释统一改为中文

flake.nix

@@ -37,7 +37,7 @@
       mylib = import ./lib { inherit inputs; };
     in
     {
-      # ── macOS hosts ─────────────────────────────────────
+      # ── macOS 主机 ──────────────────────────────────────
       darwinConfigurations = {
         mac-mini = mylib.mkDarwin {
           hostname = "awesome-mac-mini";
@@ -54,7 +54,7 @@
         };
       };
 
-      # ── NixOS hosts (WSL on Windows PC) ─────────────────
+      # ── NixOS 主机（Windows PC 上的 WSL）──────────────
       nixosConfigurations = {
         wsl = mylib.mkNixos {
           hostname = "awesome-wsl";
@@ -67,7 +67,7 @@
         };
       };
 
-      # ── Packages ────────────────────────────────────────
+      # ── 自定义包 ─────────────────────────────────────────
       packages = nixpkgs.lib.genAttrs [ "aarch64-darwin" "x86_64-linux" ] (
         system:
         let

home/default.nix

@@ -24,7 +24,7 @@
   };
 
   home.packages = with pkgs; [
-    # Modern CLI replacements
+    # 现代 CLI 替代工具
     dust # du
     duf # df
     procs # ps
@@ -33,25 +33,25 @@
     yq # YAML
     wget
 
-    # System info
+    # 系统信息
     fastfetch
     tealdeer # tldr
 
-    # File management
+    # 文件管理
     gomi
-    ouch # compression/decompression
+    ouch # 压缩/解压
 
-    # Nix tools
+    # Nix 工具
     nix-output-monitor # nom
-    nvd # nix version diff
+    nvd # Nix 版本对比
-    nh # nix helper
+    nh # Nix 辅助工具
     just
 
-    # AI coding agent
+    # AI 编程代理
     opencode
     comment-checker
 
-    # Misc
+    # 其他
     ffmpeg
     pandoc
   ];

home/dev/languages.nix

@@ -2,16 +2,16 @@
 
 {
   home.packages = with pkgs; [
-    # ── Language runtimes ──
+    # ── 语言运行时 ──
     nodejs
     go
     bun
     python3
 
-    # ── Package management / version management ──
+    # ── 包管理 / 版本管理 ──
     uv
 
-    # ── LSP servers ──
+    # ── LSP 服务器 ──
     bash-language-server
     gopls
     typescript-language-server
@@ -22,7 +22,7 @@
     nixd
     just-lsp
 
-    # ── Linter / Formatter ──
+    # ── 代码检查 / 格式化 ──
     biome
     ruff
     shellcheck
@@ -31,7 +31,7 @@
     statix
     stylua
 
-    # ── Code intelligence ──
+    # ── 代码智能 ──
     ast-grep
   ];
 

home/dev/neovim.nix

@@ -1,7 +1,7 @@
 _:
 
 {
-  # Disable catppuccin/nix neovim integration — LazyVim manages its own colorscheme
+  # 禁用 catppuccin/nix 的 Neovim 集成 — LazyVim 自行管理配色方案
   catppuccin.nvim.enable = false;
 
   programs.neovim = {
@@ -22,7 +22,7 @@ _:
       lang.docker.enable = true;
     };
 
-    # Catppuccin Mocha colorscheme (managed by LazyVim, not catppuccin/nix)
+    # Catppuccin Mocha 配色方案（由 LazyVim 管理，非 catppuccin/nix）
     plugins = {
       colorscheme = ''
         return {

home/shell/fish.nix

@@ -5,9 +5,9 @@ let
   envCache = "${config.xdg.cacheHome}/op-env/env.fish";
 in
 {
-  # ── 1Password env template ──────────────────────────
+  # ── 1Password 环境变量模板 ─────────────────────────────
-  # op:// references only — no real secrets, safe to commit
+  # 仅包含 op:// 引用 — 无真实密钥，可安全提交
-  # Kept outside ~/.config/op — that dir must be 700 and owned by op CLI
+  # 放在 ~/.config/op 之外 — 该目录必须是 700 权限且属于 op CLI
   xdg.configFile."op-env/env.tpl".text = ''
     set -gx AI_GATEWAY_BASE_URL "{{ op://Developer/AI Gateway API/URL }}"
     set -gx AI_GATEWAY_API_KEY "{{ op://Developer/AI Gateway API/credential }}"
@@ -19,13 +19,13 @@ in
     enable = true;
 
     shellAbbrs = {
-      # Navigation (one-shot, no need to recall in history)
+      # 导航（一次性命令，无需记录历史）
       ".." = "cd ..";
       "..." = "cd ../..";
     };
 
     shellAliases = {
-      # File listing (eza) — base aliases (ls/la/lt) from programs.eza
+      # 文件列表（eza）— 基础别名（ls/la/lt）来自 programs.eza
       ll = "eza -lh";
       lla = "eza -lah --time-style=long-iso";
 
@@ -38,25 +38,25 @@ in
       set -g fish_greeting
       fish_add_path $HOME/go/bin $HOME/.bun/bin
 
-      # Sudo: double Escape to prepend sudo
+      # 双击 Escape 在命令前插入 sudo
       bind \e\e 'fish_commandline_prepend sudo'
 
-      # WSL clipboard
+      # WSL 剪贴板
       if set -q WSL_DISTRO_NAME
         alias pbcopy clip.exe
         alias pbpaste "powershell.exe -noprofile -c Get-Clipboard"
       end
 
-      # Windows Terminal: emit OSC 9;9 so new tab/pane opens in same directory
+      # Windows Terminal：发送 OSC 9;9 使新标签页/窗格在同一目录打开
       function __wt_osc9_9 --on-variable PWD
         if test -n "$WT_SESSION"
           printf "\e]9;9;%s\e\\" (wslpath -w "$PWD")
         end
       end
 
-      # 1Password → env vars (cached locally, no network on shell start)
+      # 1Password → 环境变量（本地缓存，启动时不联网）
-      # Startup only sources the cache; run op-env-refresh manually to fetch/update.
+      # 启动时仅加载缓存；手动执行 op-env-refresh 拉取/更新
-      # Auth via OP_SERVICE_ACCOUNT_TOKEN (set it in ~/.config/fish/local.fish)
+      # 通过 OP_SERVICE_ACCOUNT_TOKEN 认证（在 ~/.config/fish/local.fish 中设置）
       function op-env-refresh --description "Fetch secrets from 1Password and cache locally"
         if not type -q op
           echo "op-env: op CLI not found in PATH" >&2
@@ -85,7 +85,7 @@ in
           echo "op-env: inject failed; old cache kept" >&2
           return 1
         end
-        # Capture old var names before replacing cache
+        # 替换缓存前记录旧变量名
         set -l old_vars
         if test -f "${envCache}"
           set old_vars (string match -rg 'set -gx (\S+)' < "${envCache}")
@@ -115,12 +115,12 @@ in
         echo "op-env: cleared"
       end
 
-      # Source cached secrets (instant, no network)
+      # 加载缓存的密钥（即时，不联网）
       if test -f "${envCache}"
         source "${envCache}"
       end
 
-      # User-local config (OP_SERVICE_ACCOUNT_TOKEN, per-machine overrides)
+      # 用户本地配置（OP_SERVICE_ACCOUNT_TOKEN、机器特定覆盖）
       if test -f ~/.config/fish/local.fish
         source ~/.config/fish/local.fish
       end

home/shell/ghostty.nix

@@ -3,7 +3,7 @@
 {
   programs.ghostty = {
     enable = pkgs.stdenv.isDarwin;
-    package = null; # installed via Homebrew cask
+    package = null; # 通过 Homebrew cask 安装
     settings = {
       font-family = "Maple Mono NF CN";
       font-size = 14;

home/shell/tools.nix

@@ -19,7 +19,7 @@
     ];
   };
 
-  # ── Atuin (shell history) ────────────────────────────
+  # ── Atuin（Shell 历史记录）─────────────────────────────
   programs.atuin = {
     enable = true;
     enableFishIntegration = true;
@@ -33,11 +33,11 @@
     };
   };
 
-  # ── Zoxide (smart cd) ───────────────────────────────
+  # ── Zoxide（智能 cd）──────────────────────────────────
   programs.zoxide = {
     enable = true;
     enableFishIntegration = true;
-    options = [ "--cmd cd" ]; # cd/cdi instead of z/zi
+    options = [ "--cmd cd" ]; # 用 cd/cdi 替代 z/zi
   };
 
   # ── Direnv + nix-direnv ─────────────────────────────
@@ -50,7 +50,7 @@
     };
   };
 
-  # ── Bat (cat replacement) ───────────────────────────
+  # ── Bat（cat 替代）────────────────────────────────────
   programs.bat = {
     enable = true;
     extraPackages = with pkgs.bat-extras; [
@@ -59,7 +59,7 @@
     ];
   };
 
-  # ── Eza (ls replacement) ────────────────────────────
+  # ── Eza（ls 替代）─────────────────────────────────────
   programs.eza = {
     enable = true;
     enableFishIntegration = true;
@@ -70,14 +70,14 @@
     ];
   };
 
-  # ── Yazi (file manager) ─────────────────────────────
+  # ── Yazi（文件管理器）────────────────────────────────
   programs.yazi = {
     enable = true;
     enableFishIntegration = true;
     shellWrapperName = "y";
   };
 
-  # ── Btop (system monitor) ───────────────────────────
+  # ── Btop（系统监控）──────────────────────────────────
   programs.btop = {
     enable = true;
     settings = {
@@ -85,7 +85,7 @@
     };
   };
 
-  # ── Zellij (terminal multiplexer) ────────────────────
+  # ── Zellij（终端复用器）──────────────────────────────
   programs.zellij = {
     enable = true;
     enableFishIntegration = false;

hosts/mac-mini/default.nix

@@ -1,13 +1,13 @@
 { ... }:
 
 {
-  # ── Mac Mini specific ─────────────────────────────────
+  # ── Mac Mini 专属配置 ────────────────────────────────
-  # Always plugged in — 24/7 server role
+  # 常驻供电 — 全天候服务器角色
 
-  # Touch ID for sudo
+  # Touch ID 验证 sudo
   security.pam.services.sudo_local.touchIdAuth = true;
 
-  # ── Never sleep ─────────────────────────────────────
+  # ── 禁止睡眠 ────────────────────────────────────────
   power.sleep.computer = "never";
   power.sleep.display = "never";
   power.sleep.harddisk = "never";
@@ -15,15 +15,15 @@
   power.restartAfterPowerFailure = true;
   power.restartAfterFreeze = true;
 
-  # ── Wake on LAN ──────────────────────────────────
+  # ── 网络唤醒（WoL）─────────────────────────────────
   networking.wakeOnLan.enable = true;
 
-  # ── Screen Sharing (VNC) & pmset ─────────────────
+  # ── 屏幕共享（VNC）& pmset ──────────────────────────
   system.activationScripts.postActivation.text = ''
     # VNC
     launchctl enable system/com.apple.screensharing
     launchctl load -w /System/Library/LaunchDaemons/com.apple.screensharing.plist 2>/dev/null || true
-    # Disable Power Nap
+    # 禁用 Power Nap
     pmset -a powernap 0
   '';
 

hosts/macbook-air/default.nix

@@ -1,15 +1,15 @@
 { ... }:
 
 {
-  # ── MacBook Air specific ──────────────────────────────
+  # ── MacBook Air 专属配置 ─────────────────────────────
-  # Portable — battery-conscious settings
+  # 便携设备 — 注意电池续航
 
-  # Touch ID for sudo
+  # Touch ID 验证 sudo
   security.pam.services.sudo_local.touchIdAuth = true;
 
-  # ── Notch-specific ─────────────────────────────────
+  # ── 刘海屏适配 ──────────────────────────────────────
   homebrew.casks = [
-    "thaw" # menu bar manager for notched display
+    "thaw" # 刘海屏菜单栏管理工具
   ];
 
   system.stateVersion = 5;

hosts/wsl/default.nix

@@ -2,7 +2,7 @@
 
 {
   # ── Shell ─────────────────────────────────────────────
-  # Remove NixOS default aliases (ls/ll/l) — managed by Home Manager eza
+  # 移除 NixOS 默认别名（ls/ll/l）— 由 Home Manager eza 管理
   environment.shellAliases = lib.mkForce { };
 
   # ── WSL ──────────────────────────────────────────────

lib/default.nix

@@ -7,7 +7,7 @@ let
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDRTOo48gzzRGT+bF9dzJCFJu61YgsQVONFtxU9kTPIg"
   ];
 
-  # Shared home-manager configuration block
+  # 共享的 Home Manager 配置块
   homeManagerConfig = username: {
     home-manager = {
       useGlobalPkgs = true;
@@ -24,7 +24,7 @@ let
   };
 in
 {
-  # ── NixOS host builder ──────────────────────────────
+  # ── NixOS 主机构建器 ─────────────────────────────────
   mkNixos =
     {
       hostname,
@@ -53,7 +53,7 @@ in
       ++ extraModules;
     };
 
-  # ── nix-darwin host builder ─────────────────────────
+  # ── nix-darwin 主机构建器 ────────────────────────────
   mkDarwin =
     {
       hostname,

modules/darwin/default.nix

@@ -8,7 +8,7 @@
 {
   system.primaryUser = username;
 
-  # ── Passwordless sudo ───────────────────────────────
+  # ── 免密 sudo ────────────────────────────────────────
   security.sudo.extraConfig = ''
     ${username} ALL=(ALL) NOPASSWD:ALL
   '';
@@ -21,7 +21,7 @@
     openssh.authorizedKeys.keys = sshKeys;
   };
 
-  # ── macOS system preferences ───────────────────────
+  # ── macOS 系统偏好设置 ────────────────────────────────
   system.defaults = {
     LaunchServices.LSQuarantine = false;
     dock = {
@@ -42,7 +42,7 @@
       KeyRepeat = 2;
     };
     CustomUserPreferences."ch.sudo.cyberduck" = {
-      # Suppress donation prompt permanently (date far in the future)
+      # 永久禁用捐赠提示（日期设为遥远的未来）
       "donate.reminder.date" = 253402300799000;
     };
   };
@@ -50,7 +50,10 @@
   # ── Homebrew ───────────────────────────────────────
   homebrew = {
     enable = true;
-    greedyCasks = true; # always upgrade casks even if they auto-update
+    greedyCasks = true; # 即使 cask 自动更新也始终升级
+    # 已废弃：Homebrew 将于 2026-09 后移除 --no-quarantine
+    # 待所有 cask 通过 Gatekeeper（签名且公证）后移除此项
+    caskArgs.no_quarantine = true;
 
     taps = [
       "goooler/repo"
@@ -60,7 +63,7 @@
       "mole"
     ];
 
-    # GUI apps
+    # GUI 应用
     casks = [
       "1password"
       "brave-browser"
@@ -101,7 +104,7 @@
     onActivation = {
       autoUpdate = true;
       upgrade = true;
-      cleanup = "zap"; # remove anything not declared above
+      cleanup = "zap"; # 移除所有未声明的内容
     };
   };
 }

modules/shared/nix.nix

@@ -11,7 +11,7 @@
     warn-dirty = false;
   };
 
-  # Disable channels — we use flakes exclusively
+  # 禁用 channels — 仅使用 flakes
   nix.channel.enable = false;
 
   nixpkgs = {