refactor(starship): sort language modules alphabetically

- Extract fonts, fish.enable, openssh.enable to modules/shared/
- Centralize sshKeys in lib/ via specialArgs
- Merge nixos/base.nix + locale.nix into nixos/default.nix
- Merge home/theme.nix into home/default.nix
- Simplify homeManagerConfig, flake packages output
- Remove redundant vim/wget from NixOS system packages
- Update AGENTS.md to reflect new structure

AGENTS.md

@@ -13,11 +13,11 @@ flake.nix
 └── nixosConfigurations.wsl          (x86_64-linux)
 ```
 
-- `lib/default.nix` — builders: `mkDarwin`, `mkNixos`. All hosts get shared modules + home-manager + lazyvim-nix (as HM sharedModule). NixOS also gets `catppuccin.nixosModules.catppuccin`; home-manager imports `catppuccin.homeModules.catppuccin` directly in `home/default.nix`.
+- `lib/default.nix` — builders `mkDarwin`/`mkNixos`, shared `sshKeys` constant (passed via `specialArgs`), `homeManagerConfig` helper. NixOS also gets `catppuccin.nixosModules.catppuccin`.
-- `modules/shared/` — both platforms: nixpkgs config, overlays, nix settings, Lix
+- `modules/shared/` — both platforms: nix/nixpkgs settings (Lix, overlays), fonts, `programs.fish.enable`, `services.openssh.enable`
-- `modules/darwin/` — macOS: system preferences, homebrew (casks/brews/masApps), fonts, fish shell, user
+- `modules/darwin/` — macOS: system preferences, homebrew (casks/brews/masApps), 1Password CLI, user
-- `modules/nixos/` — NixOS: base packages, docker, locale, user
+- `modules/nixos/` — NixOS: system packages, locale/timezone, docker, user
-- `home/` — home-manager (shared across all hosts via `useGlobalPkgs`)
+- `home/` — home-manager (shared across all hosts via `useGlobalPkgs`), catppuccin theme
 - `hosts/*/` — per-host overrides (mac-mini: 24/7 server with sleep disabled; macbook-air: portable)
 - `overlays/` + `pkgs/` — custom packages (comment-checker)
 
@@ -34,12 +34,12 @@ All platforms use **Lix** (`nix.package = pkgs.lix` in `modules/shared/nix.nix`)
 just rebuild mac-mini       # rebuild macOS host (on macOS)
 just rebuild macbook-air
 just rebuild                # rebuild WSL (linux only, default: "wsl")
+just rollback               # rollback to previous generation (linux only)
 just check                  # eval configs without building (platform-aware)
 just update                 # nix flake update
 just up nixpkgs             # update a single flake input
 just show                   # nix flake show
-just secrets                # sops secrets/secrets.yaml
+just clean                  # nix-collect-garbage -d (user-level only; NixOS system-level needs sudo)
-just clean                  # nix-collect-garbage -d
 just history                # list system profile generations
 just lsp mac-mini           # generate .vscode/settings.json for nixd option completion
 
@@ -51,15 +51,22 @@ nix build .#darwinConfigurations.mac-mini.system             # validate (full bu
 
 # First-time bootstrap (nix-darwin not yet installed)
 sudo nix run nix-darwin -- switch --flake .#mac-mini
+
+# First-time bootstrap WSL (fresh NixOS-WSL has no git)
+nix-shell -p git --run "git clone <repo-url> ~/nix-config"
+cd ~/nix-config && sudo nixos-rebuild switch --flake .#wsl
 ```
 
 ## Critical gotchas
 
-- **Neovim uses lazyvim-nix**: `programs.lazyvim` in `home/dev/neovim.nix` manages neovim via the `lazyvim-nix` flake input. Catppuccin nvim integration is explicitly disabled (`catppuccin.nvim.enable = false`) because LazyVim manages its own colorscheme. Don't try to use `catppuccin.enable` for nvim or the old `programs.neovim.plugins` approach.
+- **Shared settings live in `modules/shared/`**: Fish, openssh, fonts, nix settings are enabled once in shared — don't re-declare in platform modules.
+- **SSH keys are centralized**: Defined as `sshKeys` in `lib/default.nix`, passed via `specialArgs`. Don't hardcode keys in platform modules.
+- **Neovim uses lazyvim-nix**: `programs.lazyvim` in `home/dev/neovim.nix` manages neovim via the `lazyvim-nix` flake input. Catppuccin nvim integration is explicitly disabled (`catppuccin.nvim.enable = false`) because LazyVim manages its own colorscheme. Don't use `catppuccin.enable` for nvim or the old `programs.neovim.plugins` approach.
 - **catppuccin module name**: Home-manager uses `catppuccin.homeModules.catppuccin` (imported in `home/default.nix`). NixOS uses `catppuccin.nixosModules.catppuccin` (in `lib/default.nix`). Don't use the old `homeManagerModules` name.
 - **Homebrew tap casks**: Casks from taps need full path (e.g. `"goooler/repo/fl-clash"`), not just the short name.
 - **`onActivation.cleanup = "zap"`**: Any brew formula/cask NOT declared in `modules/darwin/default.nix` WILL be removed on rebuild. Be comprehensive.
-- **First-time bootstrap requires sudo**: `sudo nix run nix-darwin -- switch --flake .#mac-mini` (not `darwin-rebuild` which doesn't exist yet).
+- **First-time macOS bootstrap requires sudo**: `sudo nix run nix-darwin -- switch --flake .#mac-mini` (not `darwin-rebuild` which doesn't exist yet).
+- **First-time WSL bootstrap needs `nix-shell -p git`**: Fresh NixOS-WSL has no `git`. Use `nix-shell -p git --run "git clone ..."` to clone, then `sudo nixos-rebuild switch`.
 - **mise for version management**: Activated in `home/shell/fish.nix` via `mise activate fish | source`. Config in `home/dev/languages.nix` trusts all config paths.
 
 ## Secrets (1Password CLI)

Justfile

@@ -27,6 +27,12 @@ check:
     @nix eval .#darwinConfigurations.mac-mini.system > /dev/null && echo "mac-mini: ok"
     @nix eval .#darwinConfigurations.macbook-air.system > /dev/null && echo "macbook-air: ok"
 
+# Rollback to previous system generation
+[linux]
+[group('build')]
+rollback:
+    sudo nixos-rebuild switch --rollback
+
 # Check configs evaluate without errors
 [linux]
 [group('build')]
@@ -66,15 +72,10 @@ clean:
 
 ############################################################################
 #
-#  Secrets & tooling
+#  Tooling
 #
 ############################################################################
 
-# Edit encrypted secrets
-[group('tools')]
-secrets:
-    sops secrets/secrets.yaml
-
 # Generate .vscode/settings.json with LSP option completion
 [macos]
 [group('tools')]

README.md

@@ -40,14 +40,16 @@ wsl --import NixOS C:\wsl\nixos nixos-wsl.tar.gz
 wsl -d NixOS
 ```
 
-2. 克隆仓库并构建：
+2. 首次初始化（全新的 NixOS-WSL 没有 `git`，需要借助 `nix-shell` 临时引入）：
 
 ```bash
-git clone <repo-url> ~/nix-config
+nix-shell -p git --run "git clone <repo-url> ~/nix-config"
 cd ~/nix-config
 sudo nixos-rebuild switch --flake .#wsl
 ```
 
+> 首次 rebuild 完成后 `git`、`just` 等工具会由配置声明安装，此后可直接使用 `just rebuild` 重建。
+
 ## 仓库结构
 
 ```
@@ -85,21 +87,28 @@ sudo nixos-rebuild switch --flake .#wsl
 
 ## 日常使用
 
+项目提供 [`justfile`](justfile)，首次 rebuild 后即可使用：
+
 ```bash
-# 重建（abbreviation 自动选择 darwin-rebuild 或 nixos-rebuild）
+just rebuild <host>   # 重建系统（自动选择 darwin-rebuild / nixos-rebuild）
-rebuild
+just update           # 更新所有 flake 输入
-
+just up <input>       # 更新单个输入，如 just up nixpkgs
-# 更新所有依赖
+just check            # 检查配置是否能正常 evaluate
-update
+just clean            # 清理旧 generation 并回收空间
-
+just rollback         # 回滚到上一个 generation（仅 NixOS）
-# 回滚（NixOS）
+just history          # 查看系统 profile 历史
-sudo nixos-rebuild switch --rollback
+just show             # 显示 flake 输出
-
-# 清理旧 generation
-sudo nix-collect-garbage -d   # NixOS
-nix-collect-garbage -d        # macOS
 ```
 
+Fish shell 中也定义了 abbreviation 可直接使用：
+
+```bash
+rebuild               # 自动选择 darwin-rebuild 或 nixos-rebuild
+update                # nix flake update
+```
+
+> **注意**：`just clean` 仅清理用户级 generation。NixOS 上如需清理系统级旧 generation，需要 `sudo nix-collect-garbage -d`。
+
 ## Shell
 
 使用 **Fish** 作为默认 shell，搭配：

flake.nix

@@ -68,13 +68,18 @@
       };
 
       # ── Packages ────────────────────────────────────────
-      packages = nixpkgs.lib.genAttrs [ "aarch64-darwin" "x86_64-linux" ] (system: {
+      packages = nixpkgs.lib.genAttrs [ "aarch64-darwin" "x86_64-linux" ] (
-        comment-checker =
+        system:
-          (import nixpkgs {
+        let
+          pkgs = import nixpkgs {
             inherit system;
             overlays = [ self.overlays.default ];
-          }).comment-checker;
+          };
-      });
+        in
+        {
+          inherit (pkgs) comment-checker;
+        }
+      );
 
       # ── Overlays ───────────────────────────────────────
       overlays.default = import ./overlays;

home/default.nix

@@ -10,9 +10,13 @@
     inputs.catppuccin.homeModules.catppuccin
     ./shell
     ./dev
-    ./theme.nix
   ];
 
+  catppuccin = {
+    enable = true;
+    flavor = "mocha";
+  };
+
   home = {
     username = username;
     homeDirectory = if pkgs.stdenv.isDarwin then "/Users/${username}" else "/home/${username}";
@@ -20,9 +24,7 @@
   };
 
   # ── User-level packages ────────────────────────────
-  home.packages =
+  home.packages = with pkgs; [
-    with pkgs;
-    [
     # Modern CLI replacements
     dust # du
     duf # df
@@ -45,9 +47,6 @@
     nh # nix helper
     just
 
-      # Secrets management (WSL uses Windows op.exe via interop)
-    ]
-    ++ (with pkgs; [
     # AI coding agent
     opencode
     comment-checker
@@ -55,7 +54,7 @@
     # Misc
     ffmpeg
     pandoc
-    ]);
+  ];
 
   # XDG directories
   xdg.enable = true;

home/dev/git.nix

@@ -5,10 +5,8 @@
     enable = true;
     signing.format = null;
     settings = {
-      user = {
+      user.name = "imbytecat";
-        name = "imbytecat";
+      user.email = "imbytecat@gmail.com";
-        email = "imbytecat@gmail.com";
-      };
       merge.conflictstyle = "zdiff3";
       pull.rebase = true;
       push.autoSetupRemote = true;

home/dev/languages.nix

@@ -3,14 +3,11 @@
 {
   home.packages = with pkgs; [
     # ── Language runtimes ──
-    # Node.js: 默认跟随 nixpkgs，当前 unstable 为 v24.14.0
-    # 如需固定 LTS 版本，改为: nodejs_22 或 nodejs_20
     nodejs
     go
     bun
 
     # ── Package management / version management ──
-    mise
     uv
 
     # ── LSP servers ──
@@ -21,25 +18,30 @@
     vue-language-server
     dockerfile-language-server
     lua-language-server
-    nixd # Nix LSP
+    nixd
-    just-lsp # Justfile LSP
+    just-lsp
 
     # ── Linter / Formatter ──
     biome
     ruff
     shellcheck
     shfmt
-    nixfmt # nix formatter
+    nixfmt
-    statix # nix linter
+    statix
     stylua
 
     # ── Code intelligence ──
     ast-grep
   ];
 
-  # ── mise config ──────────────────────────────────────
+  # ── mise ─────────────────────────────────────────────
-  xdg.configFile."mise/config.toml".text = ''
+  programs.mise = {
-    [settings]
+    enable = true;
-    trusted_config_paths = ["/"]
+    enableFishIntegration = true;
-  '';
+    globalConfig = {
+      settings = {
+        trusted_config_paths = [ "/" ];
+      };
+    };
+  };
 }

home/shell/default.nix

@@ -1,6 +1,7 @@
 {
   imports = [
     ./fish.nix
+    ./ghostty.nix
     ./starship.nix
     ./tools.nix
   ];

home/shell/fish.nix

@@ -42,9 +42,6 @@ in
       # PATH
       fish_add_path $HOME/go/bin $HOME/.bun/bin
 
-      # mise
-      mise activate fish | source
-
       # Sudo: double Escape to prepend sudo
       bind \e\e 'fish_commandline_prepend sudo'
 

home/shell/ghostty.nix

@@ -0,0 +1,13 @@
+{ pkgs, ... }:
+
+{
+  programs.ghostty = {
+    enable = pkgs.stdenv.isDarwin;
+    package = null; # installed via Homebrew cask
+    settings = {
+      font-family = "Maple Mono NF CN";
+      font-size = 14;
+      shell-integration-features = "cursor,sudo,title,ssh-env,ssh-terminfo";
+    };
+  };
+}

home/shell/starship.nix

@@ -18,10 +18,11 @@
         "$git_branch"
         "$git_status"
         "[](fg:yellow bg:green)"
-        "$nodejs"
+        "$bun"
-        "$python"
         "$golang"
         "$nix_shell"
+        "$nodejs"
+        "$python"
         "[](fg:green bg:sapphire)"
         "$docker_context"
         "[](fg:sapphire bg:lavender)"
@@ -38,6 +39,7 @@
         symbols = {
           Linux = "󰌽";
           Macos = "󰀵";
+          NixOS = "";
           Windows = "";
         };
       };
@@ -74,17 +76,10 @@
         format = "[[($all_status$ahead_behind )](fg:crust bg:yellow)]($style)";
       };
 
-      nodejs = {
+      bun = {
-        symbol = "";
+        symbol = "";
         style = "bg:green";
         format = "[[ $symbol( $version) ](fg:crust bg:green)]($style)";
-        detect_extensions = [ ];
-      };
-
-      python = {
-        symbol = "";
-        style = "bg:green";
-        format = "[[ $symbol( $version)(\\($virtualenv\\)) ](fg:crust bg:green)]($style)";
       };
 
       golang = {
@@ -99,6 +94,19 @@
         format = "[[ $symbol$state( \\($name\\)) ](fg:crust bg:green)]($style)";
       };
 
+      nodejs = {
+        symbol = "";
+        style = "bg:green";
+        format = "[[ $symbol( $version) ](fg:crust bg:green)]($style)";
+        detect_extensions = [ ];
+      };
+
+      python = {
+        symbol = "";
+        style = "bg:green";
+        format = "[[ $symbol( $version)(\\($virtualenv\\)) ](fg:crust bg:green)]($style)";
+      };
+
       docker_context = {
         symbol = "";
         style = "bg:sapphire";

home/theme.nix

@@ -1,8 +0,0 @@
-{ ... }:
-
-{
-  catppuccin = {
-    enable = true;
-    flavor = "mocha";
-  };
-}

lib/default.nix

@@ -3,21 +3,19 @@
 let
   inherit (inputs.nixpkgs) lib;
 
+  sshKeys = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDRTOo48gzzRGT+bF9dzJCFJu61YgsQVONFtxU9kTPIg"
+  ];
+
   # Shared home-manager configuration block
-  homeManagerConfig =
+  homeManagerConfig = username: {
-    {
-      username,
-      sharedModules ? [ ],
-    }:
-    {
     home-manager = {
       useGlobalPkgs = true;
       useUserPackages = true;
       backupFileExtension = "bak";
       sharedModules = [
         inputs.lazyvim.homeManagerModules.default
-        ]
+      ];
-        ++ sharedModules;
       extraSpecialArgs = {
         inherit inputs username;
       };
@@ -37,14 +35,19 @@ in
     lib.nixosSystem {
       inherit system;
       specialArgs = {
-        inherit inputs hostname username;
+        inherit
+          inputs
+          hostname
+          username
+          sshKeys
+          ;
       };
       modules = [
         ../modules/shared
         ../modules/nixos
         inputs.home-manager.nixosModules.home-manager
         inputs.catppuccin.nixosModules.catppuccin
-        (homeManagerConfig { inherit username; })
+        (homeManagerConfig username)
         { networking.hostName = hostname; }
       ]
       ++ extraModules;
@@ -61,13 +64,18 @@ in
     inputs.nix-darwin.lib.darwinSystem {
       inherit system;
       specialArgs = {
-        inherit inputs hostname username;
+        inherit
+          inputs
+          hostname
+          username
+          sshKeys
+          ;
       };
       modules = [
         ../modules/shared
         ../modules/darwin
         inputs.home-manager.darwinModules.home-manager
-        (homeManagerConfig { inherit username; })
+        (homeManagerConfig username)
         { networking.hostName = hostname; }
       ]
       ++ extraModules;

modules/darwin/default.nix

@@ -1,35 +1,26 @@
-{ pkgs, username, ... }:
+{
+  pkgs,
+  username,
+  sshKeys,
+  ...
+}:
 
 {
   # ── Primary user (required by nix-darwin) ──────────
   system.primaryUser = username;
 
-  # ── Shell ──────────────────────────────────────────
-  programs.fish.enable = true;
-
   # ── 1Password CLI ───────────────────────────────────
   programs._1password.enable = true;
 
-  # ── SSH ───────────────────────────────────────────
-  services.openssh.enable = true;
-
   # ── User ───────────────────────────────────────────
   users.knownUsers = [ username ];
   users.users.${username} = {
     home = "/Users/${username}";
     shell = pkgs.fish;
     uid = 501;
-    openssh.authorizedKeys.keys = [
+    openssh.authorizedKeys.keys = sshKeys;
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDRTOo48gzzRGT+bF9dzJCFJu61YgsQVONFtxU9kTPIg"
-    ];
   };
 
-  # ── Fonts ──────────────────────────────────────────
-  fonts.packages = with pkgs; [
-    maple-mono.NF-CN-unhinted
-    nerd-fonts.symbols-only
-  ];
-
   # ── macOS system preferences ───────────────────────
   system.defaults = {
     LaunchServices.LSQuarantine = false;
@@ -65,7 +56,7 @@
     ];
 
     brews = [
-      "mole" # broken in nixpkgs
+      "mole"
     ];
 
     # GUI apps

modules/nixos/base.nix

@@ -1,18 +0,0 @@
-{ pkgs, ... }:
-
-{
-  # ── System-essential packages ──────────────────────
-  # User-level tools live in home-manager (home/)
-  environment.systemPackages = with pkgs; [
-    curl
-    git
-    vim
-    wget
-  ];
-
-  # ── Fonts ──────────────────────────────────────────
-  fonts.packages = with pkgs; [
-    maple-mono.NF-CN-unhinted
-    nerd-fonts.symbols-only
-  ];
-}

modules/nixos/default.nix

@@ -1,26 +1,35 @@
-{ pkgs, username, ... }:
+{
+  pkgs,
+  username,
+  sshKeys,
+  ...
+}:
 
 {
   imports = [
-    ./base.nix
     ./docker.nix
-    ./locale.nix
   ];
 
-  # ── Default shell ──────────────────────────────────
+  # ── System-essential packages ──────────────────────
-  programs.fish.enable = true;
+  environment.systemPackages = with pkgs; [
+    curl
+    git
+    ghostty.terminfo
+  ];
 
-  # ── SSH ──────────────────────────────────────────
+  # ── Locale / Timezone ──────────────────────────────
-  services.openssh.enable = true;
+  i18n = {
+    defaultLocale = "en_US.UTF-8";
+    supportedLocales = [ "en_US.UTF-8/UTF-8" ];
+  };
+  time.timeZone = "Asia/Shanghai";
 
   # ── Default user ───────────────────────────────────
   users.users.${username} = {
     isNormalUser = true;
     shell = pkgs.fish;
     extraGroups = [ "wheel" ];
-    openssh.authorizedKeys.keys = [
+    openssh.authorizedKeys.keys = sshKeys;
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDRTOo48gzzRGT+bF9dzJCFJu61YgsQVONFtxU9kTPIg"
-    ];
   };
 
   # ── sudo ───────────────────────────────────────────

modules/nixos/docker.nix

@@ -8,8 +8,4 @@
   environment.systemPackages = with pkgs; [
     docker-compose
   ];
-
-  # WSL 环境下如使用 Docker Desktop，可改为：
-  #   wsl.docker-desktop.enable = true;
-  # 并将上面的 virtualisation.docker.enable 设为 false
 }

modules/nixos/locale.nix

@@ -1,10 +0,0 @@
-{ ... }:
-
-{
-  i18n = {
-    defaultLocale = "en_US.UTF-8";
-    supportedLocales = [ "en_US.UTF-8/UTF-8" ];
-  };
-
-  time.timeZone = "Asia/Shanghai";
-}

modules/shared/default.nix

@@ -1,3 +1,9 @@
 {
-  imports = [ ./nix.nix ];
+  imports = [
+    ./fonts.nix
+    ./nix.nix
+  ];
+
+  programs.fish.enable = true;
+  services.openssh.enable = true;
 }

modules/shared/fonts.nix

@@ -0,0 +1,8 @@
+{ pkgs, ... }:
+
+{
+  fonts.packages = with pkgs; [
+    maple-mono.NF-CN-unhinted
+    nerd-fonts.symbols-only
+  ];
+}