commit - 7acbb47bbdd08b9c860900d4e8da0af533d244bd
commit + 83bc7cfdcca77ad326721a0a3a4eca57ca551a63
blob - 0844196b584aa0656dd298ac2059da68663e40b8
blob + eaa57876a5f21c1322454748bc288c642aa16b93
--- hosts/impish/default.nix
+++ hosts/impish/default.nix
@@ -9,7 +9,8 @@
   nixpkgs.overlays = [
     (_final: prev: let
       pinnedPkgs = import (import ./npins).nixpkgs {
-        inherit (prev) system config;
+        inherit (prev.stdenv.hostPlatform) system;
+        inherit (prev) config;
       };
     in {
       inherit (pinnedPkgs) picard dupeguru;
@@ -178,6 +179,7 @@
         hyperfine
         cntr
         radare2
+        semgrep
       ];
 
       utils = [
blob - 19a2036ff0ba6d31f55baeff5a97e30b789d585b
blob + c11759f412c7f0b79fd94868379db7736a9d9951
Binary files hosts/impish/overlays/config/magdalena/config.json.nix and hosts/impish/overlays/config/magdalena/config.json.nix differ
blob - 3bf11c68cb61ed768901c9541e27d9dc84f09230
blob + cb437e6166730e25ebf0d0b4ecb0fb0356eb6769
--- modules/mixins/dotfiles/bin/amen
+++ modules/mixins/dotfiles/bin/amen
@@ -10,8 +10,13 @@ my %config = (
     tailnet => [ '100.64.0.1', 6695 ],
     remote  => [ '127.0.0.1',  7695 ],
     local   => [ '127.0.0.1',  6695 ],
+    urdig   => [ '127.0.0.1',  6600 ],
 );
 
+my %password_file = (
+    urdig => "$home/.config/urdig/puck/mpd.password",
+);
+
 my $mode = $ARGV[0];
 
 if ( defined $ARGV[0] ) {
@@ -38,8 +43,22 @@ unless ( defined $mode && $config{$mode} ) {
     exit 0;
 }
 
-my $c = $config{$mode};
-$ENV{MPD_HOST} = $c->[0];
+my $c    = $config{$mode};
+my $host = $c->[0];
+
+if ( my $pw_file = $password_file{$mode} ) {
+    if ( open my $pw_fh, '<', $pw_file ) {
+        my $password = <$pw_fh>;
+        close $pw_fh;
+        chomp $password if defined $password;
+        $host = "$password\@$host" if defined $password && length $password;
+    }
+    else {
+        print STDERR "amen: no password at $pw_file; $mode will refuse every command\n";
+    }
+}
+
+$ENV{MPD_HOST} = $host;
 $ENV{MPD_PORT} = $c->[1];
 print "MPD_HOST=$ENV{MPD_HOST}\n";
 print "MPD_PORT=$ENV{MPD_PORT}\n";
blob - 84a74ddc004410cc929004a1cf3efbedd3027a4a
blob + c9d9c26d7635c507fc0be4fa004fd50085105518
--- modules/mixins/dotfiles/config/git/ignore
+++ modules/mixins/dotfiles/config/git/ignore
@@ -2,7 +2,5 @@
 .codex
 result
 target
-*.allium
+*.allium*
 AGENTS.md
-.#*
-*#
blob - 75d16006d79798f109098764bca12e2e3978feda
blob + fff600caca5826c525079c7c3e4e2620354f07c1
--- modules/mixins/dotfiles/config/zsh/rc/llm
+++ modules/mixins/dotfiles/config/zsh/rc/llm
@@ -1,14 +1,12 @@
 #!/bin/bash
 
-alias alpaci='alpaci -k $(pass show alpaca)'
-alias alpacu='alpacu -k $(pass show alpaca)'
-alias alpacua='command alpacu -p anthropic'
-alias alpacuo='command alpacu -p openai'
+alias alpac='alpaca compose'
+alias alpacc='alpaca compose --continue'
+alias alpaq='alpaca quota --provider ollama'
+alias alpaqo='alpaca quota --provider openai'
+alias alpaqa='alpaca quota --provider anthropic'
+alias alpaqdi='alpaca quota --provider deepinfra'
 
-alpaca() {
-	command pisol alpaca -m "${ALPACA_MODEL:-glm-5.3-flash}" --reasoning-effort "${ALPACA_EFFORT:-low}" --apikey "$(pass show alpaca)" "$@"
-}
-
 ollama_agent_marker="${XDG_RUNTIME_DIR:-/tmp}/ollama-agent-$(id -u)"
 
 ollama_stop_if_unused() {