[cleo] stuff

cleo.home.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, vars, ... }:
+{ config, lib, pkgs, vars, ... }:
 let
   # Agent/skill bodies live in the cleo-infinite checkout; symlinked so they
   # follow upstream on every pull.
@@ -10,7 +10,10 @@ in
     ./programs.vscode.nix
   ];
 
-  home.packages = with pkgs; [ ];
+  home.packages = with pkgs; [
+    mkcert
+    nginx
+  ];
 
   programs.mise = {
     enable = true;
@@ -56,11 +59,24 @@ in
     CLAUDE_CONFIG_DIR = "${config.home.homeDirectory}/.config/claude";
     # Points to the Homebrew location mentioned in your caveat
     JAVA_HOME = "/Library/Java/JavaVirtualMachines/zulu-17.jdk/Contents/Home";
-    NPM_CONFIG_PREFIX = "${config.home.homeDirectory}/.npm-global";
+    NPM_CONFIG_USERCONFIG = "${config.xdg.configHome}/npm/npmrc";
+    NPM_CONFIG_PREFIX = "${config.xdg.dataHome}/npm";
     GRANTED_ALIAS_CONFIGURED = "true";
     # Stub SDK root so tools that require ANDROID_HOME/platform-tools/adb work
     # even though adb is managed by Homebrew (android-platform-tools cask).
-    ANDROID_HOME = "${config.home.homeDirectory}/android-sdk";
+    ANDROID_HOME = "${config.xdg.dataHome}/android-sdk";
+    ANDROID_USER_HOME = "${config.xdg.dataHome}/android";
+    GRADLE_USER_HOME = "${config.xdg.dataHome}/gradle";
+    CP_HOME_DIR = "${config.xdg.dataHome}/cocoapods";
+    # Ruby comes from mise, so GEM_HOME is left alone (mise keeps per-version gem dirs).
+    GEM_SPEC_CACHE = "${config.xdg.cacheHome}/gem/specs";
+    BUNDLE_USER_CONFIG = "${config.xdg.configHome}/bundle/config";
+    BUNDLE_USER_CACHE = "${config.xdg.cacheHome}/bundle";
+    BUNDLE_USER_PLUGIN = "${config.xdg.dataHome}/bundle";
+    TREEHOUSE_ROOT = "${config.xdg.dataHome}/treehouse";
+    # mkcert CA and leaf certs for local dev TLS (tasks/config/dev-certs.yml).
+    CAROOT = "${config.xdg.dataHome}/mkcert";
+    DEV_CERTS_DIR = "${config.xdg.dataHome}/devcerts";
     # Runtime lookup from Apple Keychain — only the command, not the token, is in the store.
     JIRA_API_TOKEN = ''$(security find-generic-password -a "$USER" -s jira-token -w 2>/dev/null)'';
 
@@ -73,21 +89,37 @@ in
     COPILOT_OTEL_FILE_EXPORTER_PATH = ''$HOME/.copilot/otel/copilot-otel-$(date +%Y%m%d-%H%M%S).jsonl'';
   };
 
+  # Share one [sso-session] across the aws-sso-util profiles so `aws` and
+  # Granted's `assume` stay in sync (tasks/aws.yml). ~/.aws/config stays
+  # mutable because aws-sso-util rewrites it, so this converts it in place.
+  home.activation.awsSsoSession = lib.hm.dag.entryAfter [ "writeBoundary" ] ''
+    script="${ansibleFiles}/aws-sso-session.py"
+    if [ -f "$script" ] && [ -f "$HOME/.aws/config" ]; then
+      run ${pkgs.python3}/bin/python3 -I "$script" || [ $? -eq 3 ]
+    fi
+  '';
+
   home.sessionPath = [
-    "${config.home.homeDirectory}/.npm-global/bin"
-    "${config.home.homeDirectory}/.local/share/mise/shims"
+    "${config.xdg.dataHome}/npm/bin"
+    "${config.xdg.dataHome}/mise/shims"
   ];
 
   # git credential.helper=osxkeychain (parity with tasks/git.yml). Darwin-only, so
   # it lives here rather than in the cross-platform home.shared.nix.
-  programs.git.settings.credential.helper = "osxkeychain";
+  programs.git.settings.credential = {
+    helper = "osxkeychain";
+    # Moved from the stray ~/.gitconfig; the empty entry resets the helper list for these hosts.
+    "https://github.com".helper = [ "" "!/opt/homebrew/bin/gh auth git-credential" ];
+    "https://gist.github.com".helper = [ "" "!/opt/homebrew/bin/gh auth git-credential" ];
+  };
 
-  home.file.".npmrc".text = ''
-    prefix=${config.home.homeDirectory}/.npm-global
+  xdg.configFile."npm/npmrc".text = ''
+    prefix=${config.xdg.dataHome}/npm
+    cache=${config.xdg.cacheHome}/npm
   '';
 
-  home.file."android-sdk/platform-tools/adb".source = config.lib.file.mkOutOfStoreSymlink "/opt/homebrew/bin/adb";
-  home.file."android-sdk/cmdline-tools/latest/bin/sdkmanager".source = config.lib.file.mkOutOfStoreSymlink "/opt/homebrew/bin/sdkmanager";
+  xdg.dataFile."android-sdk/platform-tools/adb".source = config.lib.file.mkOutOfStoreSymlink "/opt/homebrew/bin/adb";
+  xdg.dataFile."android-sdk/cmdline-tools/latest/bin/sdkmanager".source = config.lib.file.mkOutOfStoreSymlink "/opt/homebrew/bin/sdkmanager";
 
   home.file.".ssh/authorized_keys".text = (builtins.concatStringsSep "\n" vars.sshPublicKeys) + "\n";
 
@@ -118,6 +150,8 @@ in
     config.lib.file.mkOutOfStoreSymlink "${config.home.homeDirectory}/nixos/claude/CLAUDE.md";
   xdg.configFile."claude/skills/prod-db".source =
     config.lib.file.mkOutOfStoreSymlink "${config.home.homeDirectory}/nixos/claude/skills/prod-db";
+  xdg.configFile."claude/skills/redis".source =
+    config.lib.file.mkOutOfStoreSymlink "${config.home.homeDirectory}/nixos/claude/skills/redis";
 
   # opencode (tasks/config/opencode.yml)
   xdg.configFile."opencode/opencode.json".text = builtins.toJSON {
@@ -140,6 +174,9 @@ in
   };
   xdg.configFile."treehouse/config.toml".text = ''
     [hooks]
-    post_create = ["./conditional-package-manage.sh"]
+    post_create = [
+      "if [ \"$(basename \"$PWD\")\" = \"wellthy.com\" ]; then (git diff HEAD..origin/cleo-native-local-patch | git apply --3way 2>/dev/null || true) && git status --porcelain | awk '{print $2}' >> \"$(git rev-parse --git-path info/exclude)\" && git status --porcelain | awk '{print $2}' | xargs -r git update-index --skip-worktree; fi",
+      "./conditional-package-manage.sh"
+    ]
   '';
 }