chore: sync from personal branch (sanitized)

Recent commits synced:
3fc55be Merge remote-tracking branch 'origin/personal' into personal
95eeff9 feat: force Claude Code max effort level via env vars
1e057cb refactor: make Framework 16 NVIDIA dGPU toggleable, disable for ama-tech-001
12f5f01 fix: disable Goodix fingerprint autosuspend to prevent EC log overflow
3dd76be feat: add Google Workspace CLI (gws) and relocate google-cloud-sdk to common

Auto-synced by GitHub Actions (personal info stripped)

Author: github-actions[bot]

devenv.lock

@@ -3,11 +3,11 @@
     "devenv": {
       "locked": {
         "dir": "src/modules",
-        "lastModified": 1773034036,
-        "narHash": "sha256-J03ioow4WAtkKmZQ04cCXhar4UwW2RrpXzk7msFJUUA=",
+        "lastModified": 1776863933,
+        "narHash": "sha256-v9NoQFSln9n5zqVWUWUc9PajsMaGmga51HOAJqMx7Qw=",
         "owner": "cachix",
         "repo": "devenv",
-        "rev": "32c9ecdacbd7093ae096e5ca312c4497e3758159",
+        "rev": "863b4204725efaeeb73811e376f928232b720646",
         "type": "github"
       },
       "original": {
@@ -17,16 +17,75 @@
         "type": "github"
       }
     },
+    "flake-compat": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1767039857,
+        "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
+        "owner": "NixOS",
+        "repo": "flake-compat",
+        "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "git-hooks": {
+      "inputs": {
+        "flake-compat": "flake-compat",
+        "gitignore": "gitignore",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1776796298,
+        "narHash": "sha256-PcRvlWayisPSjd0UcRQbhG8Oqw78AcPE6x872cPRHN8=",
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "rev": "3cfd774b0a530725a077e17354fbdb87ea1c4aad",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "type": "github"
+      }
+    },
+    "gitignore": {
+      "inputs": {
+        "nixpkgs": [
+          "git-hooks",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1709087332,
+        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "type": "github"
+      }
+    },
     "nixpkgs": {
       "inputs": {
         "nixpkgs-src": "nixpkgs-src"
       },
       "locked": {
-        "lastModified": 1772749504,
-        "narHash": "sha256-eqtQIz0alxkQPym+Zh/33gdDjkkch9o6eHnMPnXFXN0=",
+        "lastModified": 1776852779,
+        "narHash": "sha256-WwO/ITisCXwyiRgtktZgv3iGhAGO+IB5Av4kKCwezR0=",
         "owner": "cachix",
         "repo": "devenv-nixpkgs",
-        "rev": "08543693199362c1fddb8f52126030d0d374ba2e",
+        "rev": "ec3063523dcd911aeadb50faa589f237cdab5853",
         "type": "github"
       },
       "original": {
@@ -39,11 +98,11 @@
     "nixpkgs-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1772173633,
-        "narHash": "sha256-MOH58F4AIbCkh6qlQcwMycyk5SWvsqnS/TCfnqDlpj4=",
+        "lastModified": 1776329215,
+        "narHash": "sha256-a8BYi3mzoJ/AcJP8UldOx8emoPRLeWqALZWu4ZvjPXw=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "c0f3d81a7ddbc2b1332be0d8481a672b4f6004d6",
+        "rev": "b86751bc4085f48661017fa226dee99fab6c651b",
         "type": "github"
       },
       "original": {
@@ -56,10 +115,11 @@
     "root": {
       "inputs": {
         "devenv": "devenv",
+        "git-hooks": "git-hooks",
         "nixpkgs": "nixpkgs"
       }
     }
   },
   "root": "root",
   "version": 7
-}
+}

flake.lock

@@ -107,9 +107,11 @@
       };
 
       # Tech profile helper — full power-user setup (350+ packages, AI orchestration)
-      mkTechHost = { hostname, username, system ? "x86_64-linux", extraModules ? [ ] }: nixpkgs.lib.nixosSystem {
+      # enableDGPU: threaded through specialArgs so framework-16.nix and host files can
+      # gate NVIDIA configuration when the expansion bay is physically absent.
+      mkTechHost = { hostname, username, system ? "x86_64-linux", enableDGPU ? false, extraModules ? [ ] }: nixpkgs.lib.nixosSystem {
         inherit system;
-        specialArgs = { inherit inputs username; };
+        specialArgs = { inherit inputs username enableDGPU; };
         modules = [
           # Host-specific configuration
           ./hosts/${hostname}
@@ -196,16 +198,24 @@
           username = "guyfawkes";
         };
 
-        # Framework Laptop 16 (AMD Ryzen AI 9 HX 370 + NVIDIA RTX 5070) — Amatino
+        # Framework Laptop 16 (AMD Ryzen AI 9 HX 370, optional RTX 5070 bay) — Amatino
         # Build: nixos-rebuild switch --flake .#ama-tech-001
-        ama-tech-001 = mkTechHost {
-          hostname = "ama-tech-001";
-          username = "guyfawkes";
-          extraModules = [
-            # NixOS Hardware module for Framework 16 with AMD AI 300 + NVIDIA
-            nixos-hardware.nixosModules.framework-16-amd-ai-300-series-nvidia
-          ];
-        };
+        # Flip enableDGPU to true when the NVIDIA expansion bay is installed.
+        ama-tech-001 =
+          let
+            enableDGPU = false;
+          in
+          mkTechHost {
+            hostname = "ama-tech-001";
+            username = "guyfawkes";
+            inherit enableDGPU;
+            extraModules = [
+              # Pick the nixos-hardware variant matching the expansion bay state
+              (if enableDGPU
+              then nixos-hardware.nixosModules.framework-16-amd-ai-300-series-nvidia
+              else nixos-hardware.nixosModules.framework-16-amd-ai-300-series)
+            ];
+          };
 
         # ── Business workstations ──────────────────────────────────────
 

flake.nix

@@ -1,6 +1,7 @@
 # Framework Laptop 16 host configuration
-# AMD Ryzen AI 9 HX 370 + NVIDIA RTX 5070 + 64GB DDR5-5600
-{ config, pkgs, inputs, username, lib, ... }:
+# AMD Ryzen AI 9 HX 370 + 64GB DDR5-5600
+# Optional: NVIDIA RTX 5070 Expansion Bay (toggle via enableDGPU in flake.nix)
+{ config, pkgs, inputs, username, enableDGPU ? false, lib, ... }:
 
 {
   imports = [
@@ -16,7 +17,8 @@
   networking.hostName = "ama-tech-001";
 
   # NVIDIA PRIME Bus IDs (from lspci: c1:00.0 = NVIDIA, c2:00.0 = AMD)
-  hardware.nvidia.prime = {
+  # Only applied when the expansion bay is installed.
+  hardware.nvidia.prime = lib.mkIf enableDGPU {
     amdgpuBusId = "PCI:194:0:0";
     nvidiaBusId = "PCI:193:0:0";
   };

hosts/ama-tech-001/default.nix

@@ -1,11 +1,11 @@
 # Framework Laptop 16 — extras beyond nixos-hardware
-# AMD Ryzen AI 9 HX 370 + NVIDIA RTX 5070 Expansion Bay
+# AMD Ryzen AI 9 HX 370 + optional NVIDIA RTX 5070 Expansion Bay
 #
-# Base hardware support (AMD GPU params, fingerprint, PPD, QMK, fwupd,
-# PRIME offload, Blackwell open modules) comes from:
-#   nixos-hardware.nixosModules.framework-16-amd-ai-300-series-nvidia
-# imported in flake.nix. This file adds NVIDIA tuning, workarounds, and extras.
-{ config, pkgs, lib, inputs, ... }:
+# Base hardware support (AMD GPU params, fingerprint, PPD, QMK, fwupd, PRIME
+# offload if applicable, Blackwell open modules) comes from the matching
+# nixos-hardware module, chosen in flake.nix based on enableDGPU.
+# This file adds shared Framework 16 tuning plus NVIDIA bits gated on enableDGPU.
+{ config, pkgs, lib, inputs, enableDGPU ? false, ... }:
 
 {
   # Disable nixos-hardware's amd_pstate module — it sets amd_pstate=active for
@@ -26,9 +26,6 @@
   boot.blacklistedKernelModules = [ "ucsi_acpi" ];
 
   boot.kernelParams = [
-    # NVIDIA VRAM preservation across suspend/resume
-    "nvidia.NVreg_PreserveVideoMemoryAllocations=1"
-    "nvidia.NVreg_TemporaryFilePath=/var/tmp"
     # Guided mode: OS sets min/max bounds, firmware picks optimal frequency.
     # Passive/active modes fail on Strix Point — firmware ignores CPPC requests.
     # Guided cooperates with the firmware's autonomous frequency control.
@@ -39,6 +36,10 @@
     "amdgpu.cwsr_enable=0"
     # Force NVMe to stay at full PCIe link speed (prevents Gen 3 fallback)
     "pcie_aspm=off"
+  ] ++ lib.optionals enableDGPU [
+    # NVIDIA VRAM preservation across suspend/resume
+    "nvidia.NVreg_PreserveVideoMemoryAllocations=1"
+    "nvidia.NVreg_TemporaryFilePath=/var/tmp"
     # Explicitly disable NVIDIA dynamic power management (RTD3).
     # Open kernel modules (565+) default to 0x03 (fine-grained) on laptops,
     # which causes UCSI link drops on the USB-C DP alt-mode path.
@@ -53,7 +54,7 @@
   # can cause DRM contention during VT switches and suspend/resume.
   # Must use modprobe options — kernel cmdline param is silently overridden
   # because NixOS appends fbdev=1 AFTER our params (last-wins).
-  boot.extraModprobeConfig = ''
+  boot.extraModprobeConfig = lib.optionalString enableDGPU ''
     options nvidia-drm fbdev=0
   '';
 
@@ -79,14 +80,24 @@
     ''
       SUBSYSTEM=="usb", ATTRS{idVendor}=="0e8d", ATTRS{idProduct}=="0717", ATTR{power/autosuspend}="-1"
     ''
+    # Disable USB autosuspend on the Goodix fingerprint sensor (27c6:609c).
+    # The Goodix firmware's USB runtime PM is flaky: it auto-suspends after 2s
+    # idle and fails to wake cleanly, causing repeated xhci resets ("usb 3-4.1:
+    # reset full-speed USB device") that correlate with cros-ec LPC channel
+    # overflow ("cros-ec-dev: Some logs may have been dropped"). Observed in
+    # every boot regardless of whether fprintd is active. Default is
+    # autosuspend=2s with control=auto, which is far too aggressive.
+    ''
+      SUBSYSTEM=="usb", ATTRS{idVendor}=="27c6", ATTRS{idProduct}=="609c", ATTR{power/autosuspend}="-1"
+    ''
     # Auto-switch power profile on AC plug/unplug via systemd service trigger
     ''
       SUBSYSTEM=="power_supply", ATTR{type}=="Mains", ACTION=="change", TAG+="systemd", ENV{SYSTEMD_WANTS}="set-power-profile-ac.service"
     ''
   ];
 
   # NVIDIA tuning (driver, modesetting, offload, open modules handled by nixos-hardware)
-  hardware.nvidia = {
+  hardware.nvidia = lib.mkIf enableDGPU {
     package = config.boot.kernelPackages.nvidiaPackages.production;
     modesetting.enable = true; # Required for Wayland
     # RTD3 fine-grained PM disabled — causes UCSI link drops on the rear USB-C
@@ -98,14 +109,15 @@
     nvidiaSettings = true;
   };
 
-  # Vulkan + VA-API support for AMD iGPU and NVIDIA dGPU
+  # Vulkan + VA-API support for AMD iGPU (plus NVIDIA dGPU when present)
   hardware.graphics = {
     enable = true;
     enable32Bit = true; # Steam/gaming compatibility
     extraPackages = with pkgs; [
       libva
       vulkan-loader
       vulkan-validation-layers
+    ] ++ lib.optionals enableDGPU [
       nvidia-vaapi-driver
     ];
     extraPackages32 = with pkgs.pkgsi686Linux; [
@@ -268,8 +280,9 @@
   # Framework-specific packages
   environment.systemPackages = with pkgs; [
     framework-tool
-    nvtopPackages.nvidia
     powertop
+  ] ++ lib.optionals enableDGPU [
+    nvtopPackages.nvidia
   ];
 
   # Build settings for 12-core AMD / 64GB RAM