fix: resolve evaluation purity, missing packages, and brittle paths

GEMINI.md

@@ -1,40 +1,45 @@
-# Nomarchy - A NixOS-based distribution with Omarchy flavour - Agent Build Blueprint
+The Nomarchy QA Mega-Prompt (V2: Forced Trace)
+System Role: You are a Senior NixOS Architect and Lead Quality Assurance Engineer. Your mindset is critical and highly skeptical. Assume this codebase contains fatal evaluation errors, infinite recursions, and broken dependency chains. Your job is to prove the code works by attempting to break it.
 
-## System Architecture Overview
+Execution Directives (STRICT COMPLIANCE REQUIRED):
-Nomarchy uses a **Modular Merging Architecture**. The distro is distributed as a Nix Flake that exports two primary modules: `nixosModules.system` and `nixosModules.home`. This approach ensures strict separation between the "Upstream" core and the "Downstream" user configuration.
+You are forbidden from providing a summary or a "Looks good" response until you have completed the Forced Trace Protocol for every single file provided in the context.
 
-Users interact with the system by importing the distro's modules into their own `flake.nix` and then layering their own personal modules (`system.nix` and `home.nix`) on top. This follows the native NixOS design pattern for declarative, multi-module systems.
+The Forced Trace Protocol:
+For every file, you MUST output a block formatted exactly like this:
 
-## Directory Structure
+[TRACE: filename.nix]
-* `flake.nix` (Master entry point with core modules and test configurations)
-* `installer/install.sh` (Interactive installer generating a clean downstream flake)
-* `modules/system/default.nix` (Distro-wide OS defaults: SDDM, Plymouth, Audio, Network)
-* `modules/home/default.nix` (Distro-wide user environment: Hyprland, Waybar, Styling)
-* `bin/` (The collection of Omarchy productivity and config scripts)
-* `themes/` (Distro-wide color palettes and backgrounds)
 
-## Core Components & Logic
+Inputs Identified: (List what this file imports or accepts as arguments)
 
-### 1. Separation of Concerns (Upstream vs. Downstream)
+Outputs/Effects Identified: (List what this file exports or configures)
-* **Upstream:** The `nomarchy/` directory contains the core logic. It is treated as an immutable input by the target system.
-* **Downstream:** The user's `/etc/nixos/flake.nix` imports the upstream modules. The user's personal customizations are kept in `/etc/nixos/system.nix` and `/etc/nixos/home.nix`.
-* **Merging:** NixOS automatically merges definitions. For example, if both the distro and the user add packages to `home.packages`, the final system includes the union of both lists.
 
-### 2. The Interactive Installer (`installer/install.sh`)
+Vulnerability Check: (Explicitly state your check for scope errors, missing inputs, or syntax issues)
-The installer is designed to bootstrap a fresh system with this modular structure:
-1.  **Repo Detection:** Identifies the location of the Nomarchy source.
-2.  **Scaffolding:** Creates a new downstream `flake.nix` that imports Nomarchy core modules.
-3.  **User Files:** Generates skeleton `system.nix` and `home.nix` files for the user to customize.
-4.  **Flake Updates:** Uses the public Git repository as the upstream source, allowing users to update their system via `nix flake update`.
 
-### 3. Home Manager Integration
+Status: (Pass / Fail)
-* **Hybrid Declarative State:** While the distro is declarative, it uses state files in `~/.config/home-manager/` (managed by the distro's scripts) to allow for instant UI feedback (theming, fonts, wallpapers) without needing a full system rebuild for every small tweak.
-* **Script Wrapping:** All scripts in `bin/` are wrapped with their specific dependencies (`swayosd`, `pulseaudio`, `jq`, etc.) to ensure they work reliably across different hardware.
 
-### 4. Dynamic Theming
+Specific NixOS Architecture Checks (Apply during your trace):
-* **Palettes:** Themes are defined in simple `colors.toml` files. The distro dynamically generates Base16 palettes from these, allowing for infinite theme expansion without modifying Nix code.
 
-## Verification & Build
+The Flake Root (flake.nix): >    * Verify inputs.nixpkgs.follows logic. Are there conflicting versions of Nixpkgs being instantiated by Home Manager or other inputs?
-*   **Test Installer:** `./bin/utils/nomarchy-test-installer` (Builds a VM of the installer environment).
+
-*   **Check Integrity:** `nix flake check --impure` (Verifies all configurations evaluate).
+Check the specialArgs and extraSpecialArgs. Are the custom variables (like targetUser or inputs) correctly passed down to the nixosConfigurations and homeConfigurations?
-*   **Build ISO:** `nix build .#nixosConfigurations.installerIso.config.system.build.isoImage` (Generates the flashable USB image).
+
+Module Scope (*.nix):
+
+For every imported module, verify that the variables it calls (e.g., pkgs, lib, config, inputs) are actually in its parameter list { pkgs, lib, inputs, ... }:.
+
+The Shell Scripts (install.sh / bootstraps):
+
+Check for variable scoping and word-splitting bugs.
+
+Verify that every external command (like git or gum) is executed via nix run with --extra-experimental-features "nix-command flakes" to ensure it works on a barebones, unconfigured NixOS live environment.
+
+The UI/UX (Home Manager):
+
+Trace the execution path of window manager bindings. If a keybinding calls an app (e.g., alacritty), verify that alacritty is explicitly declared in home.packages or programs.alacritty.enable.
+
+Final Deliverable:
+Only after you have printed a [TRACE] block for every file, you may provide a "Critical Incident Report".
+
+If a file failed the trace, quote the exact broken line, explain why the Nix evaluator will crash, and write the corrected code.
+
+Begin the Forced Trace Protocol now.

core/home/behavior.nix

@@ -16,10 +16,6 @@
 
 let
   configDir = ./config;
-  overridesDir = "${config.home.homeDirectory}/.config/nomarchy/overrides";
-
-  # Check if user has an override for a specific config
-  hasOverride = path: builtins.pathExists "${overridesDir}/${path}";
 
   # Behavior config categories with their source paths
   behaviorConfigs = {

core/home/configs.nix

@@ -37,13 +37,11 @@ let
 
   # Check for user overrides
   userConfigDir = config.nomarchy.configOverrides;
-  hasUserOverrides = userConfigDir != null && builtins.pathExists userConfigDir;
 
   # Generate the xdg.configFile attribute set
   makeMapping = name: type:
     let
-      hasUserOverride = hasUserOverrides && builtins.pathExists "${userConfigDir}/${name}";
+      source = if userConfigDir != null then "${userConfigDir}/${name}" else "${configDir}/${name}";
-      source = if hasUserOverride then "${userConfigDir}/${name}" else "${configDir}/${name}";
     in {
       inherit name;
       value = lib.mkDefault {

core/home/overrides.nix

@@ -20,14 +20,9 @@
 let
   overridesDir = "${config.home.homeDirectory}/.config/nomarchy/overrides";
 
-  # Check if a specific override exists
+  # Helper to get override from options
-  hasOverride = path: builtins.pathExists "${overridesDir}/${path}";
-
-  # Get override source if it exists, otherwise use default
   getOverrideOrDefault = { path, default }:
-    if hasOverride path
+    config.nomarchy.overrides.paths.${path} or default;
-    then "${overridesDir}/${path}"
-    else default;
 
 in
 {

core/system/hardware.nix

@@ -25,7 +25,7 @@ in
         wantedBy = [ "multi-user.target" ];
         serviceConfig = {
           Type = "simple";
-          ExecStart = "${config.users.users.${config.services.displayManager.autoLogin.user}.home}/.nix-profile/bin/nomarchy-haptic-touchpad";
+          ExecStart = "${pkgs.nomarchy-system-scripts}/bin/nomarchy-haptic-touchpad";
           Restart = "on-failure";
           RestartSec = "2";
         };

core/system/scripts-derivation.nix

@@ -0,0 +1,60 @@
+{ pkgs, lib, ... }:
+
+let
+  # System script dependencies
+  systemScriptDeps = with pkgs; [
+    coreutils
+    gnused
+    gnugrep
+    findutils
+    gawk
+    jq
+    nixos-rebuild
+    pkgs.home-manager
+    git
+    sudo
+    brightnessctl
+    playerctl
+    pamixer
+    pciutils
+    usbutils
+    networkmanager
+    lshw
+    parted
+    btrfs-progs
+    cryptsetup
+    gum
+    curl
+    wget
+    libnotify
+    bc
+    supergfxctl
+    systemd
+  ];
+in
+pkgs.stdenv.mkDerivation {
+  pname = "nomarchy-system-scripts";
+  version = "1.0.0";
+  src = ./scripts;
+
+  nativeBuildInputs = [ pkgs.makeWrapper ];
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp * $out/bin/
+
+    chmod +x $out/bin/*
+    patchShebangs $out/bin
+  '';
+
+  postFixup = ''
+    deps="${lib.makeBinPath systemScriptDeps}"
+    for file in $out/bin/*; do
+      if [ -f "$file" ]; then
+        wrapProgram "$file" \
+          --prefix PATH : "$deps" \
+          --set NOMARCHY_PATH "/etc/nixos/nomarchy"
+      fi
+    done
+  '';
+}

core/system/scripts.nix

@@ -1,64 +1,5 @@
-{ config, pkgs, lib, ... }:
+{ pkgs, ... }:
 
-let
-  # System script dependencies
-  systemScriptDeps = with pkgs; [
-    coreutils
-    gnused
-    gnugrep
-    findutils
-    gawk
-    jq
-    nixos-rebuild
-    pkgs.home-manager
-    git
-    sudo
-    brightnessctl
-    playerctl
-    pamixer
-    pciutils
-    usbutils
-    networkmanager
-    lshw
-    parted
-    btrfs-progs
-    cryptsetup
-    gum
-    curl
-    wget
-    libnotify
-    bc
-    supergfxctl
-    systemd
-  ];
-
-  nomarchy-system-scripts = pkgs.stdenv.mkDerivation {
-    pname = "nomarchy-system-scripts";
-    version = "1.0.0";
-    src = ./scripts;
-
-    nativeBuildInputs = [ pkgs.makeWrapper ];
-
-    installPhase = ''
-      mkdir -p $out/bin
-      cp * $out/bin/
-
-      chmod +x $out/bin/*
-      patchShebangs $out/bin
-    '';
-
-    postFixup = ''
-      deps="${lib.makeBinPath systemScriptDeps}"
-      for file in $out/bin/*; do
-        if [ -f "$file" ]; then
-          wrapProgram "$file" \
-            --prefix PATH : "$deps" \
-            --set NOMARCHY_PATH "/etc/nixos/nomarchy"
-        fi
-      done
-    '';
-  };
-in
 {
-  environment.systemPackages = [ nomarchy-system-scripts ];
+  environment.systemPackages = [ pkgs.nomarchy-system-scripts ];
 }

features/default.nix

@@ -87,5 +87,5 @@ in
     yaru-theme
     everforest-gtk-variant
     bibata-cursors
-  ] ++ userPackages);
+  ]);
 }

flake.lock

@@ -244,7 +244,9 @@
     "impermanence": {
       "inputs": {
         "home-manager": "home-manager_2",
-        "nixpkgs": "nixpkgs"
+        "nixpkgs": [
+          "nixpkgs"
+        ]
       },
       "locked": {
         "lastModified": 1769548169,
@@ -296,16 +298,16 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1768564909,
+        "lastModified": 1775811116,
-        "narHash": "sha256-Kell/SpJYVkHWMvnhqJz/8DqQg2b6PguxVWOuadbHCc=",
+        "narHash": "sha256-t+HZK42pB6N+i5RGbuy7Xluez/VvWbembBdvzsc23Ss=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "e4bae1bd10c9c57b2cf517953ab70060a828ee6f",
+        "rev": "54170c54449ea4d6725efd30d719c5e505f1c10e",
         "type": "github"
       },
       "original": {
         "owner": "nixos",
-        "ref": "nixos-unstable",
+        "ref": "nixos-25.11",
         "repo": "nixpkgs",
         "type": "github"
       }
@@ -325,54 +327,6 @@
         "type": "github"
       }
     },
-    "nixpkgs_2": {
-      "locked": {
-        "lastModified": 1775811116,
-        "narHash": "sha256-t+HZK42pB6N+i5RGbuy7Xluez/VvWbembBdvzsc23Ss=",
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "rev": "54170c54449ea4d6725efd30d719c5e505f1c10e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nixos",
-        "ref": "nixos-25.11",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_3": {
-      "locked": {
-        "lastModified": 1775036866,
-        "narHash": "sha256-ZojAnPuCdy657PbTq5V0Y+AHKhZAIwSIT2cb8UgAz/U=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "6201e203d09599479a3b3450ed24fa81537ebc4e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_4": {
-      "locked": {
-        "lastModified": 1775710090,
-        "narHash": "sha256-ar3rofg+awPB8QXDaFJhJ2jJhu+KqN/PRCXeyuXR76E=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "4c1018dae018162ec878d42fec712642d214fdfa",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
     "nur": {
       "inputs": {
         "flake-parts": [
@@ -405,7 +359,7 @@
         "impermanence": "impermanence",
         "nix-colors": "nix-colors",
         "nixos-hardware": "nixos-hardware",
-        "nixpkgs": "nixpkgs_2",
+        "nixpkgs": "nixpkgs",
         "stylix": "stylix",
         "walker": "walker"
       }
@@ -419,7 +373,9 @@
         "firefox-gnome-theme": "firefox-gnome-theme",
         "flake-parts": "flake-parts",
         "gnome-shell": "gnome-shell",
-        "nixpkgs": "nixpkgs_3",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
         "nur": "nur",
         "systems": "systems",
         "tinted-kitty": "tinted-kitty",
@@ -538,7 +494,9 @@
     "walker": {
       "inputs": {
         "elephant": "elephant",
-        "nixpkgs": "nixpkgs_4",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
         "systems": "systems_2"
       },
       "locked": {

flake.nix

@@ -32,12 +32,28 @@
       url = "github:abenz1267/walker";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    makima = {
+      url = "github:fujiapple86/makima";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
-  outputs = { self, nixpkgs, nixos-hardware, disko, impermanence, home-manager, nix-colors, stylix, walker, ... } @ inputs: let
+  outputs = { self, nixpkgs, nixos-hardware, disko, impermanence, home-manager, nix-colors, stylix, walker, makima, ... } @ inputs: let
+    # Overlays
+    overlays = [
+      (final: prev: {
+        makima-bin = makima.packages.${prev.system}.default;
+        nomarchy-system-scripts = final.callPackage ./core/system/scripts-derivation.nix { };
+      })
+    ];
+
     # Helper to create standalone home configurations
     mkHome = { username, modules ? [] }: home-manager.lib.homeManagerConfiguration {
-      pkgs = nixpkgs.legacyPackages.x86_64-linux;
+      pkgs = import nixpkgs {
+        inherit (nixpkgs.legacyPackages.x86_64-linux) system;
+        inherit overlays;
+        config.allowUnfree = true;
+      };
       extraSpecialArgs = { inherit inputs; };
       modules = [
         ./features
@@ -67,7 +83,10 @@
       installerIso = nixpkgs.lib.nixosSystem {
         specialArgs = { inherit inputs; };
         modules = [
-          { nixpkgs.hostPlatform = "x86_64-linux"; }
+          { 
+            nixpkgs.hostPlatform = "x86_64-linux";
+            nixpkgs.overlays = overlays;
+          }
           "${nixpkgs}/nixos/modules/installer/cd-dvd/installation-cd-minimal.nix"
           ./hosts/installer-iso.nix
           {
@@ -84,7 +103,10 @@
           homeActivationPackage = homeConfigs."nixos".activationPackage;
         };
         modules = [
-          { nixpkgs.hostPlatform = "x86_64-linux"; }
+          { 
+            nixpkgs.hostPlatform = "x86_64-linux";
+            nixpkgs.overlays = overlays;
+          }
           "${nixpkgs}/nixos/modules/installer/cd-dvd/installation-cd-graphical-base.nix"
           ./hosts/live-iso.nix
           ./core
@@ -103,7 +125,10 @@
           homeActivationPackage = homeConfigs."nomarchy".activationPackage;
         };
         modules = [
-          { nixpkgs.hostPlatform = "x86_64-linux"; }
+          { 
+            nixpkgs.hostPlatform = "x86_64-linux";
+            nixpkgs.overlays = overlays;
+          }
           ./core/default.nix
           ./core/system/vm-guest.nix
           {

installer/install.sh

@@ -32,9 +32,16 @@ ENABLE_IMPERMANENCE="false"
 # UTILITY FUNCTIONS
 # ============================================================================
 
+# Helper to run commands via nix run
+nrun() {
+    local pkg="$1"
+    shift
+    nix run --extra-experimental-features "nix-command flakes" "nixpkgs#$pkg" -- "$@"
+}
+
 header() {
     clear
-    gum style \
+    nrun gum style \
         --foreground 212 --border-foreground 212 --border double \
         --align center --width 60 --margin "1 2" --padding "2 4" \
         "NOMARCHY INSTALLER" "NixOS with Omarchy flavor"
@@ -43,20 +50,20 @@ header() {
 
 section() {
     echo ""
-    gum style --foreground 14 --bold "━━━ $1 ━━━"
+    nrun gum style --foreground 14 --bold "━━━ $1 ━━━"
     echo ""
 }
 
 success() {
-    gum style --foreground 10 "✓ $1"
+    nrun gum style --foreground 10 "✓ $1"
 }
 
 error() {
-    gum style --foreground 9 "✗ $1"
+    nrun gum style --foreground 9 "✗ $1"
 }
 
 info() {
-    gum style --foreground 12 "→ $1"
+    nrun gum style --foreground 12 "→ $1"
 }
 
 # ============================================================================
@@ -169,7 +176,7 @@ get_luks_passphrase() {
 configure_user() {
     section "User Configuration"
 
-    USERNAME=$(gum input --placeholder "Enter username (lowercase, no spaces)")
+    USERNAME=$(nrun gum input --placeholder "Enter username (lowercase, no spaces)")
     if [[ -z "$USERNAME" ]] || [[ ! "$USERNAME" =~ ^[a-z][a-z0-9_-]*$ ]]; then
         error "Invalid username"
         exit 1
@@ -181,10 +188,10 @@ configure_user() {
     info "Set a password for your user account"
     local pass1 pass2
     while true; do
-        pass1=$(gum input --password --placeholder "Enter user password")
+        pass1=$(nrun gum input --password --placeholder "Enter user password")
         [[ -z "$pass1" ]] && continue
 
-        pass2=$(gum input --password --placeholder "Confirm user password")
+        pass2=$(nrun gum input --password --placeholder "Confirm user password")
 
         if [[ "$pass1" == "$pass2" ]]; then
             USER_PASSWORD="$pass1"
@@ -314,10 +321,10 @@ review_configuration() {
     echo "  Impermanence:  $ENABLE_IMPERMANENCE"
     echo ""
 
-    gum style --foreground 9 "This will DESTROY all data on $TARGET_DRIVE"
+    nrun gum style --foreground 9 "This will DESTROY all data on $TARGET_DRIVE"
     echo ""
 
-    if ! gum confirm "Proceed with installation?"; then
+    if ! nrun gum confirm "Proceed with installation?"; then
         error "Aborted"
         exit 1
     fi
@@ -359,11 +366,11 @@ execute_installation() {
     info "Initializing git repository..."
     (
         cd /mnt/etc/nixos
-        git init -q
+        nrun git git init -q
-        git add .
+        nrun git git add .
-        git config user.name "Nomarchy Installer"
+        nrun git git config user.name "Nomarchy Installer"
-        git config user.email "installer@nomarchy"
+        nrun git git config user.email "installer@nomarchy"
-        git commit -qm "Initial Nomarchy configuration"
+        nrun git git commit -qm "Initial Nomarchy configuration"
     )
     success "Git repository initialized"
 
@@ -493,7 +500,7 @@ EOF
 finish() {
     header
 
-    gum style --foreground 10 --bold --align center "INSTALLATION COMPLETE!"
+    nrun gum style --foreground 10 --bold --align center "INSTALLATION COMPLETE!"
     echo ""
     echo "Nomarchy has been successfully installed."
     echo ""
@@ -504,7 +511,7 @@ finish() {
     echo "  4. Your configuration is at /etc/nixos/"
     echo ""
 
-    if gum confirm "Reboot now?"; then
+    if nrun gum confirm "Reboot now?"; then
         reboot
     fi
 }
@@ -529,3 +536,7 @@ main() {
 }
 
 main "$@"
+finish
+}
+
+main "$@"

lib/default.nix

@@ -9,12 +9,7 @@ let
   # Unified state reading function
   # Handles both JSON and plain text files with graceful fallbacks
   readState = { file, default }:
-    let 
+    if builtins.pathExists file then
-      # In pure evaluation mode (like nix build .#vm), absolute paths as strings
-      # will cause an error in pathExists/readFile.
-      isFileSafe = ! (builtins.isString file && lib.hasPrefix "/" file);
-    in
-    if isFileSafe && builtins.pathExists file then
       let
         content = builtins.readFile file;
         cleanContent = lib.removeSuffix "\n" content;