programs/devenv: init module (#1834 )

programs/devenv: init module
Signed-off-by: Anish Pallati <i@anish.land>
2026-07-19 22:34:20 +00:00 · 2026-07-19 00:17:39 -04:00 · 2026-07-18 08:19:57 +00:00 · 2026-07-17 22:20:27 -07:00 · 2026-07-15 13:58:56 +00:00 · 2026-07-07 03:45:56 +00:00
94 changed files with 3014 additions and 661 deletions
@@ -1,6 +1,7 @@
 name: "Test"
 on:
  pull_request:
+  merge_group:
  push:
    branches:
      - master
@@ -18,7 +19,7 @@ jobs:
  # TODO: Change them once the repository configuration is updated.

  test-stable:
-    runs-on: macos-13
+    runs-on: macos-14
    steps:
    - uses: actions/checkout@v4
    - name: Install Nix
@@ -28,7 +29,7 @@ jobs:
    - run: nix flake check --override-input nixpkgs nixpkgs/${{ env.NIXPKGS_BRANCH }}

  install-against-stable:
-    runs-on: macos-13
+    runs-on: macos-14
    timeout-minutes: 30
    steps:
    - uses: actions/checkout@v4
@@ -87,7 +88,7 @@ jobs:
          --override-input nixpkgs nixpkgs/${{ env.NIXPKGS_BRANCH }}

  install-flake:
-    runs-on: macos-13
+    runs-on: macos-14
    timeout-minutes: 30
    steps:
    - uses: actions/checkout@v4
@@ -1,2 +1,3 @@
+.DS_Store
 *.swp
 result*
@@ -1,3 +1,43 @@
+2026-05-16
+- The reversed split-window key bindings previously generated by
+  `programs.tmux.enableSensible` are no longer emitted when
+  `system.stateVersion` is 7 or later, so tmux uses its conventional
+  behavior: `%` splits the current pane horizontally and `"` splits it
+  vertically.
+
+  Existing configurations with `system.stateVersion` 6 or earlier keep
+  the previous reversed bindings. You can explicitly choose either
+  behavior with `programs.tmux.reverseSplitBindings`.
+
+2026-02-10
+- Major changes to `homebrew` module
+
+  `homebrew.brewPrefix` was renamed to `homebrew.prefix`, and its semantics
+  changed: the old option pointed to the bin directory (e.g.,
+  `/opt/homebrew/bin`), while the new option points to the Homebrew prefix
+  (e.g., `/opt/homebrew`), matching `brew --prefix`.
+
+  `homebrew.whalebrews` was removed. Whalebrew support was removed from
+  Homebrew Bundle in Homebrew 4.7.0 (Nov 2025), so `whalebrew` entries in a
+  Brewfile now cause `brew bundle` to fail.
+
+  `homebrew.global.lockfiles` and `homebrew.global.noLock` no longer have any
+  effect. Homebrew Bundle removed lockfile support in Homebrew 4.4.0 (Oct 2024).
+
+  `homebrew.onActivation.cleanup` now supports a `"check"` mode, which checks
+  for unlisted packages and aborts activation if any are found, without
+  removing them.
+
+  Shell integration options were added: `homebrew.enableBashIntegration`,
+  `homebrew.enableFishIntegration`, and `homebrew.enableZshIntegration`.
+
+  New Brewfile entry types were added: `homebrew.goPackages`,
+  `homebrew.cargoPackages`, and `homebrew.vscode`.
+
+  New options were added for brews: `postinstall`, `link = "overwrite"`, and
+  `restart_service = "always"`. The `postinstall` option was also added for
+  casks.
+
 2025-01-30
 - Previously, some nix-darwin options applied to the user running
  `darwin-rebuild`. As part of a long‐term migration to make
@@ -116,7 +156,7 @@

  `nix.daemonIONice` was renamed to `nix.daemonIOLowPriority`, and
  `nix.daemonNiceLevel` was removed in favor a new option
-  `nix.nix.daemonProcessType`.
+  `nix.daemonProcessType`.

 2021-01-16
 - Added `homebrew` module, to manage formulas installed by Homebrew via `brew bundle`.
@@ -13,20 +13,9 @@ nix-darwin is built up around [Nixpkgs](https://github.com/NixOS/nixpkgs), quite

 The only prerequisite is a Nix implementation; both Nix and Lix are supported.

-As the official Nix installer does not include an automated uninstaller, and manual uninstallation on macOS is a complex process, we recommend using one of the following installers instead:
-
-* The [Nix installer from Determinate Systems](https://github.com/DeterminateSystems/nix-installer?tab=readme-ov-file#determinate-nix-installer) is only recommended for use with flake-based setups.
-  It can install one of two distributions of Nix:
-
-  * To install the **recommended** vanilla upstream [Nix](https://nixos.org), you will need to explicitly say `no` when prompted to install `Determinate Nix`.
-
-  * When run with the `--determinate` flag, it will install the [Determinate](https://docs.determinate.systems/) distribution.
-    As Determinate manages the Nix installation itself, you will need to set `nix.enable = false;` in your configuration to disable nix-darwin’s own Nix management.
-    Some nix-darwin functionality that relies on managing the Nix installation, like the `nix.*` options to adjust Nix settings or configure a Linux builder, will be unavailable.
-
-* The [Lix installer](https://lix.systems/install/#on-any-other-linuxmacos-system) supports both flake-based and channel-based setups.
-
+As the official Nix installer does not include an automated uninstaller, and manual uninstallation on macOS is a complex process, we recommend using the [Lix installer](https://lix.systems/install/#on-any-other-linuxmacos-system), which supports both flake-based and channel-based setups.

+The installer you use doesn't affect which Nix interpreter your system will use later on. nix-darwin manages the Nix installation by default and will default to upstream Nix. If you wish to use Lix instead of Nix, set `nix.package = pkgs.lix` in your configuration.

 ## Getting started

@@ -50,13 +39,13 @@ cd /etc/nix-darwin

 # To use Nixpkgs unstable:
 nix flake init -t nix-darwin/master
-# To use Nixpkgs 24.11:
-nix flake init -t nix-darwin/nix-darwin-24.11
+# To use Nixpkgs 26.05:
+nix flake init -t nix-darwin/nix-darwin-26.05

 sed -i '' "s/simple/$(scutil --get LocalHostName)/" flake.nix
 ```

-Make sure to change `nixpkgs.hostPlatform` to `aarch64-darwin` if you are using Apple Silicon.
+Make sure to check if `nixpkgs.hostPlatform` is set to either `x86_64-darwin` for Intel or `aarch64-darwin` for Apple Silicon.

 </details>

@@ -71,9 +60,9 @@ Add the following to `flake.nix` in the same folder as `configuration.nix`:
  description = "John's darwin system";

  inputs = {
-    # Use `github:NixOS/nixpkgs/nixpkgs-24.11-darwin` to use Nixpkgs 24.11.
+    # Use `github:NixOS/nixpkgs/nixpkgs-26.05-darwin` to use Nixpkgs 26.05.
    nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
-    # Use `github:nix-darwin/nix-darwin/nix-darwin-24.11` to use Nixpkgs 24.11.
+    # Use `github:nix-darwin/nix-darwin/nix-darwin-26.05` to use Nixpkgs 26.05.
    nix-darwin.url = "github:nix-darwin/nix-darwin/master";
    nix-darwin.inputs.nixpkgs.follows = "nixpkgs";
  };
@@ -99,8 +88,8 @@ Unlike NixOS, `nix-darwin` does not have an installer, you can just run `darwin-
 ```bash
 # To use Nixpkgs unstable:
 sudo nix run nix-darwin/master#darwin-rebuild -- switch
-# To use Nixpkgs 24.11:
-sudo nix run nix-darwin/nix-darwin-24.11#darwin-rebuild -- switch
+# To use Nixpkgs 26.05:
+sudo nix run nix-darwin/nix-darwin-26.05#darwin-rebuild -- switch
 ```

 ### Step 3. Using `nix-darwin`
@@ -143,8 +132,8 @@ Copy the [simple](./modules/examples/simple.nix) example to `/etc/nix-darwin/con
 ```bash
 # If you use Nixpkgs unstable (the default):
 sudo nix-channel --add https://github.com/nix-darwin/nix-darwin/archive/master.tar.gz darwin
-# If you use Nixpkgs 24.11:
-sudo nix-channel --add https://github.com/nix-darwin/nix-darwin/archive/nix-darwin-24.11.tar.gz darwin
+# If you use Nixpkgs 26.05:
+sudo nix-channel --add https://github.com/nix-darwin/nix-darwin/archive/nix-darwin-26.05.tar.gz darwin

 sudo nix-channel --update
 ```
@@ -177,9 +166,11 @@ sudo nix-channel --update

 ## Documentation

-`darwin-help` will open up a local copy of the reference documentation, it can also be found online [here](https://nix-darwin.github.io/nix-darwin/manual/index.html).
+The reference documentation is available:

-The documentation is also available as manpages by running `man 5 configuration.nix`.
+* Online: [nix-darwin reference](https://nix-darwin.github.io/nix-darwin/manual/index.html)
+* Locally in your browser via the `darwin-help` command
+* As a manual page via `man 5 configuration.nix`

 ## Uninstalling

@@ -0,0 +1,82 @@
+
+# Nix
+if [ -e '/nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh' ]; then
+    . '/nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh'
+fi
+# End Nix
+
+        
+# System-wide profile for interactive zsh(1) shells.
+
+# Setup user specific overrides for this in ~/.zshrc. See zshbuiltins(1)
+# and zshoptions(1) for more details.
+
+# Correctly display UTF-8 with combining characters.  We'll assume UTF-8 if the
+# locale(1) binary is missing entirely.
+if [[ ! -x /usr/bin/locale ]] || [[ "$(locale LC_CTYPE)" == "UTF-8" ]]; then
+    setopt COMBINING_CHARS
+fi
+
+# Disable the log builtin, so we don't conflict with /usr/bin/log
+disable log
+
+# Save command history
+HISTFILE=${ZDOTDIR:-$HOME}/.zsh_history
+HISTSIZE=2000
+SAVEHIST=1000
+
+# Beep on error
+setopt BEEP
+
+# Use keycodes (generated via zkbd) if present, otherwise fallback on
+# values from terminfo
+if [[ -r ${ZDOTDIR:-$HOME}/.zkbd/${TERM}-${VENDOR} ]] ; then
+    source ${ZDOTDIR:-$HOME}/.zkbd/${TERM}-${VENDOR}
+else
+    typeset -g -A key
+
+    [[ -n "$terminfo[kf1]" ]] && key[F1]=$terminfo[kf1]
+    [[ -n "$terminfo[kf2]" ]] && key[F2]=$terminfo[kf2]
+    [[ -n "$terminfo[kf3]" ]] && key[F3]=$terminfo[kf3]
+    [[ -n "$terminfo[kf4]" ]] && key[F4]=$terminfo[kf4]
+    [[ -n "$terminfo[kf5]" ]] && key[F5]=$terminfo[kf5]
+    [[ -n "$terminfo[kf6]" ]] && key[F6]=$terminfo[kf6]
+    [[ -n "$terminfo[kf7]" ]] && key[F7]=$terminfo[kf7]
+    [[ -n "$terminfo[kf8]" ]] && key[F8]=$terminfo[kf8]
+    [[ -n "$terminfo[kf9]" ]] && key[F9]=$terminfo[kf9]
+    [[ -n "$terminfo[kf10]" ]] && key[F10]=$terminfo[kf10]
+    [[ -n "$terminfo[kf11]" ]] && key[F11]=$terminfo[kf11]
+    [[ -n "$terminfo[kf12]" ]] && key[F12]=$terminfo[kf12]
+    [[ -n "$terminfo[kf13]" ]] && key[F13]=$terminfo[kf13]
+    [[ -n "$terminfo[kf14]" ]] && key[F14]=$terminfo[kf14]
+    [[ -n "$terminfo[kf15]" ]] && key[F15]=$terminfo[kf15]
+    [[ -n "$terminfo[kf16]" ]] && key[F16]=$terminfo[kf16]
+    [[ -n "$terminfo[kf17]" ]] && key[F17]=$terminfo[kf17]
+    [[ -n "$terminfo[kf18]" ]] && key[F18]=$terminfo[kf18]
+    [[ -n "$terminfo[kf19]" ]] && key[F19]=$terminfo[kf19]
+    [[ -n "$terminfo[kf20]" ]] && key[F20]=$terminfo[kf20]
+    [[ -n "$terminfo[kbs]" ]] && key[Backspace]=$terminfo[kbs]
+    [[ -n "$terminfo[kich1]" ]] && key[Insert]=$terminfo[kich1]
+    [[ -n "$terminfo[kdch1]" ]] && key[Delete]=$terminfo[kdch1]
+    [[ -n "$terminfo[khome]" ]] && key[Home]=$terminfo[khome]
+    [[ -n "$terminfo[kend]" ]] && key[End]=$terminfo[kend]
+    [[ -n "$terminfo[kpp]" ]] && key[PageUp]=$terminfo[kpp]
+    [[ -n "$terminfo[knp]" ]] && key[PageDown]=$terminfo[knp]
+    [[ -n "$terminfo[kcuu1]" ]] && key[Up]=$terminfo[kcuu1]
+    [[ -n "$terminfo[kcub1]" ]] && key[Left]=$terminfo[kcub1]
+    [[ -n "$terminfo[kcud1]" ]] && key[Down]=$terminfo[kcud1]
+    [[ -n "$terminfo[kcuf1]" ]] && key[Right]=$terminfo[kcuf1]
+fi
+
+# Default key bindings
+[[ -n ${key[Delete]} ]] && bindkey "${key[Delete]}" delete-char
+[[ -n ${key[Home]} ]] && bindkey "${key[Home]}" beginning-of-line
+[[ -n ${key[End]} ]] && bindkey "${key[End]}" end-of-line
+[[ -n ${key[Up]} ]] && bindkey "${key[Up]}" up-line-or-search
+[[ -n ${key[Down]} ]] && bindkey "${key[Down]}" down-line-or-search
+
+# Default prompt
+PS1="%n@%m %1~ %# "
+
+# Useful support for interacting with Terminal.app or other terminal programs
+[ -r "/etc/zshrc_$TERM_PROGRAM" ] && . "/etc/zshrc_$TERM_PROGRAM"
@@ -0,0 +1,74 @@
+# System-wide profile for interactive zsh(1) shells.
+
+# Setup user specific overrides for this in ~/.zshrc. See zshbuiltins(1)
+# and zshoptions(1) for more details.
+
+# Correctly display UTF-8 with combining characters.  We'll assume UTF-8 if the
+# locale(1) binary is missing entirely.
+if [[ ! -x /usr/bin/locale ]] || [[ "$(locale LC_CTYPE)" == "UTF-8" ]]; then
+    setopt COMBINING_CHARS
+fi
+
+# Disable the log builtin, so we don't conflict with /usr/bin/log
+disable log
+
+# Save command history
+HISTFILE=${ZDOTDIR:-$HOME}/.zsh_history
+HISTSIZE=2000
+SAVEHIST=1000
+
+# Beep on error
+setopt BEEP
+
+# Use keycodes (generated via zkbd) if present, otherwise fallback on
+# values from terminfo
+if [[ -r ${ZDOTDIR:-$HOME}/.zkbd/${TERM}-${VENDOR} ]] ; then
+    source ${ZDOTDIR:-$HOME}/.zkbd/${TERM}-${VENDOR}
+else
+    typeset -g -A key
+
+    [[ -n "$terminfo[kf1]" ]] && key[F1]=$terminfo[kf1]
+    [[ -n "$terminfo[kf2]" ]] && key[F2]=$terminfo[kf2]
+    [[ -n "$terminfo[kf3]" ]] && key[F3]=$terminfo[kf3]
+    [[ -n "$terminfo[kf4]" ]] && key[F4]=$terminfo[kf4]
+    [[ -n "$terminfo[kf5]" ]] && key[F5]=$terminfo[kf5]
+    [[ -n "$terminfo[kf6]" ]] && key[F6]=$terminfo[kf6]
+    [[ -n "$terminfo[kf7]" ]] && key[F7]=$terminfo[kf7]
+    [[ -n "$terminfo[kf8]" ]] && key[F8]=$terminfo[kf8]
+    [[ -n "$terminfo[kf9]" ]] && key[F9]=$terminfo[kf9]
+    [[ -n "$terminfo[kf10]" ]] && key[F10]=$terminfo[kf10]
+    [[ -n "$terminfo[kf11]" ]] && key[F11]=$terminfo[kf11]
+    [[ -n "$terminfo[kf12]" ]] && key[F12]=$terminfo[kf12]
+    [[ -n "$terminfo[kf13]" ]] && key[F13]=$terminfo[kf13]
+    [[ -n "$terminfo[kf14]" ]] && key[F14]=$terminfo[kf14]
+    [[ -n "$terminfo[kf15]" ]] && key[F15]=$terminfo[kf15]
+    [[ -n "$terminfo[kf16]" ]] && key[F16]=$terminfo[kf16]
+    [[ -n "$terminfo[kf17]" ]] && key[F17]=$terminfo[kf17]
+    [[ -n "$terminfo[kf18]" ]] && key[F18]=$terminfo[kf18]
+    [[ -n "$terminfo[kf19]" ]] && key[F19]=$terminfo[kf19]
+    [[ -n "$terminfo[kf20]" ]] && key[F20]=$terminfo[kf20]
+    [[ -n "$terminfo[kbs]" ]] && key[Backspace]=$terminfo[kbs]
+    [[ -n "$terminfo[kich1]" ]] && key[Insert]=$terminfo[kich1]
+    [[ -n "$terminfo[kdch1]" ]] && key[Delete]=$terminfo[kdch1]
+    [[ -n "$terminfo[khome]" ]] && key[Home]=$terminfo[khome]
+    [[ -n "$terminfo[kend]" ]] && key[End]=$terminfo[kend]
+    [[ -n "$terminfo[kpp]" ]] && key[PageUp]=$terminfo[kpp]
+    [[ -n "$terminfo[knp]" ]] && key[PageDown]=$terminfo[knp]
+    [[ -n "$terminfo[kcuu1]" ]] && key[Up]=$terminfo[kcuu1]
+    [[ -n "$terminfo[kcub1]" ]] && key[Left]=$terminfo[kcub1]
+    [[ -n "$terminfo[kcud1]" ]] && key[Down]=$terminfo[kcud1]
+    [[ -n "$terminfo[kcuf1]" ]] && key[Right]=$terminfo[kcuf1]
+fi
+
+# Default key bindings
+[[ -n ${key[Delete]} ]] && bindkey "${key[Delete]}" delete-char
+[[ -n ${key[Home]} ]] && bindkey "${key[Home]}" beginning-of-line
+[[ -n ${key[End]} ]] && bindkey "${key[End]}" end-of-line
+[[ -n ${key[Up]} ]] && bindkey "${key[Up]}" up-line-or-search
+[[ -n ${key[Down]} ]] && bindkey "${key[Down]}" down-line-or-search
+
+# Default prompt
+PS1="%n@%m %1~ %# "
+
+# Useful support for interacting with Terminal.app or other terminal programs
+[ -r "/etc/zshrc_$TERM_PROGRAM" ] && . "/etc/zshrc_$TERM_PROGRAM"
@@ -0,0 +1,7 @@
+
+# Set up Nix only on SSH connections
+# See: https://github.com/DeterminateSystems/nix-installer/pull/714
+if [ -e '/nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh' ] && [ -n "${SSH_CONNECTION:-}" ] && [ "${SHLVL:-0}" -eq 1 ]; then
+    . '/nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh'
+fi
+# End Nix
@@ -0,0 +1,3 @@
+# Written by https://github.com/NixOS/nix-installer
+# The contents below are based on options specified at installation time.
+
@@ -0,0 +1,10 @@
+# Generated by https://github.com/NixOS/nix-installer
+# See `/nix/nix-installer --version` for the version details.
+
+extra-experimental-features = nix-command flakes
+always-allow-substitutes = true
+bash-prompt-prefix = (nix:$name)\040
+max-jobs = auto
+extra-nix-path = nixpkgs=flake:nixpkgs
+
+!include nix.custom.conf
@@ -0,0 +1,11 @@
+# Generated by https://install.lix.systems/.
+# See `/nix/lix-installer --version` for the version details.
+
+extra-experimental-features = nix-command
+always-allow-substitutes = true
+extra-trusted-substituters = https://cache.lix.systems
+extra-trusted-public-keys = cache.lix.systems:aBnZUw8zA7H35Cz2RyKFVs3H4PlGTLawyY5KRbvJR8o=
+bash-prompt-prefix = (nix:$name)\040
+max-jobs = auto
+
+!include nix.custom.conf
@@ -0,0 +1,3 @@
+# Written by https://install.lix.systems/.
+# The contents below are based on options specified at installation time.
+
@@ -0,0 +1,81 @@
+# System-wide profile for interactive zsh(1) shells.
+
+# Setup user specific overrides for this in ~/.zshrc. See zshbuiltins(1)
+# and zshoptions(1) for more details.
+
+# Correctly display UTF-8 with combining characters.  We'll assume UTF-8 if the
+# locale(1) binary is missing entirely.
+if [[ ! -x /usr/bin/locale ]] || [[ "$(locale LC_CTYPE)" == "UTF-8" ]]; then
+    setopt COMBINING_CHARS
+fi
+
+# Disable the log builtin, so we don't conflict with /usr/bin/log
+disable log
+
+# Save command history
+HISTFILE=${ZDOTDIR:-$HOME}/.zsh_history
+HISTSIZE=2000
+SAVEHIST=1000
+
+# Beep on error
+setopt BEEP
+
+# Use keycodes (generated via zkbd) if present, otherwise fallback on
+# values from terminfo
+if [[ -r ${ZDOTDIR:-$HOME}/.zkbd/${TERM}-${VENDOR} ]] ; then
+    source ${ZDOTDIR:-$HOME}/.zkbd/${TERM}-${VENDOR}
+else
+    typeset -g -A key
+
+    [[ -n "$terminfo[kf1]" ]] && key[F1]=$terminfo[kf1]
+    [[ -n "$terminfo[kf2]" ]] && key[F2]=$terminfo[kf2]
+    [[ -n "$terminfo[kf3]" ]] && key[F3]=$terminfo[kf3]
+    [[ -n "$terminfo[kf4]" ]] && key[F4]=$terminfo[kf4]
+    [[ -n "$terminfo[kf5]" ]] && key[F5]=$terminfo[kf5]
+    [[ -n "$terminfo[kf6]" ]] && key[F6]=$terminfo[kf6]
+    [[ -n "$terminfo[kf7]" ]] && key[F7]=$terminfo[kf7]
+    [[ -n "$terminfo[kf8]" ]] && key[F8]=$terminfo[kf8]
+    [[ -n "$terminfo[kf9]" ]] && key[F9]=$terminfo[kf9]
+    [[ -n "$terminfo[kf10]" ]] && key[F10]=$terminfo[kf10]
+    [[ -n "$terminfo[kf11]" ]] && key[F11]=$terminfo[kf11]
+    [[ -n "$terminfo[kf12]" ]] && key[F12]=$terminfo[kf12]
+    [[ -n "$terminfo[kf13]" ]] && key[F13]=$terminfo[kf13]
+    [[ -n "$terminfo[kf14]" ]] && key[F14]=$terminfo[kf14]
+    [[ -n "$terminfo[kf15]" ]] && key[F15]=$terminfo[kf15]
+    [[ -n "$terminfo[kf16]" ]] && key[F16]=$terminfo[kf16]
+    [[ -n "$terminfo[kf17]" ]] && key[F17]=$terminfo[kf17]
+    [[ -n "$terminfo[kf18]" ]] && key[F18]=$terminfo[kf18]
+    [[ -n "$terminfo[kf19]" ]] && key[F19]=$terminfo[kf19]
+    [[ -n "$terminfo[kf20]" ]] && key[F20]=$terminfo[kf20]
+    [[ -n "$terminfo[kbs]" ]] && key[Backspace]=$terminfo[kbs]
+    [[ -n "$terminfo[kich1]" ]] && key[Insert]=$terminfo[kich1]
+    [[ -n "$terminfo[kdch1]" ]] && key[Delete]=$terminfo[kdch1]
+    [[ -n "$terminfo[khome]" ]] && key[Home]=$terminfo[khome]
+    [[ -n "$terminfo[kend]" ]] && key[End]=$terminfo[kend]
+    [[ -n "$terminfo[kpp]" ]] && key[PageUp]=$terminfo[kpp]
+    [[ -n "$terminfo[knp]" ]] && key[PageDown]=$terminfo[knp]
+    [[ -n "$terminfo[kcuu1]" ]] && key[Up]=$terminfo[kcuu1]
+    [[ -n "$terminfo[kcub1]" ]] && key[Left]=$terminfo[kcub1]
+    [[ -n "$terminfo[kcud1]" ]] && key[Down]=$terminfo[kcud1]
+    [[ -n "$terminfo[kcuf1]" ]] && key[Right]=$terminfo[kcuf1]
+fi
+
+# Default key bindings
+[[ -n ${key[Delete]} ]] && bindkey "${key[Delete]}" delete-char
+[[ -n ${key[Home]} ]] && bindkey "${key[Home]}" beginning-of-line
+[[ -n ${key[End]} ]] && bindkey "${key[End]}" end-of-line
+[[ -n ${key[Up]} ]] && bindkey "${key[Up]}" up-line-or-search
+[[ -n ${key[Down]} ]] && bindkey "${key[Down]}" down-line-or-search
+
+# Default prompt
+PS1="%n@%m %1~ %# "
+
+# Useful support for interacting with Terminal.app or other terminal programs
+[ -r "/etc/zshrc_$TERM_PROGRAM" ] && . "/etc/zshrc_$TERM_PROGRAM"
+
+# Nix
+if [ -e '/nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh' ]; then
+  . '/nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh'
+fi
+# End Nix
+
@@ -0,0 +1,12 @@
+# Generated by https://install.lix.systems/.
+# See `/nix/lix-installer --version` for the version details.
+
+extra-experimental-features = nix-command flakes
+always-allow-substitutes = true
+extra-trusted-substituters = https://cache.lix.systems
+extra-trusted-public-keys = cache.lix.systems:aBnZUw8zA7H35Cz2RyKFVs3H4PlGTLawyY5KRbvJR8o=
+bash-prompt-prefix = (nix:$name)\040
+max-jobs = auto
+extra-nix-path = nixpkgs=flake:nixpkgs
+
+!include nix.custom.conf
@@ -0,0 +1,12 @@
+# System-wide profile for interactive zsh(1) login shells.
+
+# Setup user specific overrides for this in ~/.zprofile. See zshbuiltins(1)
+# and zshoptions(1) for more details.
+
+if [ -z "$LANG" ]; then
+	export LANG=C.UTF-8
+fi
+
+if [ -x /usr/libexec/path_helper ]; then
+	eval `/usr/libexec/path_helper -s`
+fi
@@ -94,8 +94,7 @@ in rec {
        --stylesheet highlightjs/mono-blue.css \
        --script ./highlightjs/highlight.pack.js \
        --script ./highlightjs/loader.js \
-        --toc-depth 1 \
-        --chunk-toc-depth 1 \
+        --sidebar-depth 1 \
        ./manual.md \
        $dst/index.html

@@ -0,0 +1,11 @@
+{
+  lib,
+  ...
+}:
+{
+  options.flake.darwinConfigurations = lib.mkOption {
+    type = lib.types.lazyAttrsOf lib.types.raw;
+    default = { };
+    description = "Darwin system configurations";
+  };
+}
@@ -2,11 +2,11 @@
  "nodes": {
    "nixpkgs": {
      "locked": {
-        "lastModified": 1746061036,
-        "narHash": "sha256-OxYwCGJf9VJ2KnUO+w/hVJVTjOgscdDg/lPv8Eus07Y=",
+        "lastModified": 1783279667,
+        "narHash": "sha256-/NAkDSsve+GNM0Bt6tleJdCGfsTlK89nPjkVOzZMo0s=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "3afd19146cac33ed242fc0fc87481c67c758a59e",
+        "rev": "f205b5574fd0cb7da5b702a2da51507b7f4fdd1b",
        "type": "github"
      },
      "original": {
@@ -56,6 +56,8 @@
      darwin-uninstaller = prev.callPackage ./pkgs/darwin-uninstaller { };
    };

+    flakeModules.default = ./flake-module.nix;
+
    darwinModules.hydra = ./modules/examples/hydra.nix;
    darwinModules.lnl = ./modules/examples/lnl.nix;
    darwinModules.simple = ./modules/examples/simple.nix;
@@ -0,0 +1,149 @@
+# This module defines the packages that appear in
+# /run/current-system/sw.
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+
+  makeDrvBinPath = lib.concatMapStringsSep ":" (p: if lib.isDerivation p then "${p}/bin" else p);
+
+  defaultPackageNames = [ ];
+  defaultPackages = map (
+    n:
+    let
+      pkg = pkgs.${n};
+    in
+    lib.setPrio ((pkg.meta.priority or lib.meta.defaultPriority) + 3) pkg
+  ) defaultPackageNames;
+  defaultPackagesText = "[ ${lib.concatMapStringsSep " " (n: "pkgs.${n}") defaultPackageNames} ]";
+
+in
+
+{
+  imports = [
+    (lib.mkRenamedOptionModule ["environment" "postBuild"] ["environment" "extraSetup"])
+  ];
+
+  options = {
+
+    environment = {
+      systemPath = lib.mkOption {
+        type = lib.types.listOf (lib.types.either lib.types.path lib.types.str);
+        description = "The set of paths that are added to PATH.";
+        apply = x: if lib.isList x then makeDrvBinPath x else x;
+      };
+
+      systemPackages = lib.mkOption {
+        type = lib.types.listOf lib.types.package;
+        default = [ ];
+        example = lib.literalExpression "[ pkgs.firefox pkgs.thunderbird ]";
+        description = ''
+          The set of packages that appear in
+          /run/current-system/sw.  These packages are
+          automatically available to all users, and are
+          automatically updated every time you rebuild the system
+          configuration.  (The latter is the main difference with
+          installing them in the default profile,
+          {file}`/nix/var/nix/profiles/default`.
+        '';
+      };
+
+      defaultPackages = lib.mkOption {
+        type = lib.types.listOf lib.types.package;
+        default = defaultPackages;
+        defaultText = lib.literalMD ''
+          these packages, with their `meta.priority` numerically increased
+          (thus lowering their installation priority):
+
+              ${defaultPackagesText}
+        '';
+        example = [ ];
+        description = ''
+          Set of default packages that aren't strictly necessary
+          for a running system, entries can be removed for a more
+          minimal NixOS installation.
+
+          Like with systemPackages, packages are installed to
+          {file}`/run/current-system/sw`. They are
+          automatically available to all users, and are
+          automatically updated every time you rebuild the system
+          configuration.
+        '';
+      };
+
+      pathsToLink = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        # According to https://github.com/NixOS/nixpkgs/blob/2795c506fe8fb7b03c36ccb51f75b6df0ab2553f/nixos/modules/config/system-path.nix#L108-L109
+        # `/lib` needs to be added to make NSS modules work, however currently we don't add it
+        # and it's unclear whether the comment applies on macOS as well.
+        default = [ ];
+        example = [ "/share/doc" ];
+        description = "List of directories to be symlinked in {file}`/run/current-system/sw`.";
+      };
+
+      extraOutputsToInstall = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        default = [ ];
+        example = [
+          "dev"
+          "info"
+        ];
+        description = ''
+          Entries listed here will be appended to the `meta.outputsToInstall` attribute for each package in `environment.systemPackages`, and the files from the corresponding derivation outputs symlinked into {file}`/run/current-system/sw`.
+
+          For example, this can be used to install the `dev` and `info` outputs for all packages in the system environment, if they are available.
+
+          To use specific outputs instead of configuring them globally, select the corresponding attribute on the package derivation, e.g. `libxml2.dev` or `coreutils.info`.
+        '';
+      };
+
+      extraSetup = lib.mkOption {
+        type = lib.types.lines;
+        default = "";
+        description = "Shell fragments to be run after the system environment has been created. This should only be used for things that need to modify the internals of the environment, e.g. generating MIME caches. The environment being built can be accessed at $out.";
+      };
+
+    };
+
+    system = {
+
+      path = lib.mkOption {
+        internal = true;
+        description = ''
+          The packages you want in the system environment.
+        '';
+      };
+
+    };
+
+  };
+
+  config = {
+
+    environment.systemPackages = config.environment.defaultPackages;
+
+    environment.pathsToLink = [
+      "/bin"
+      "/share/locale"
+    ];
+
+    system.path = pkgs.buildEnv {
+      name = "system-path";
+      paths = config.environment.systemPackages;
+      inherit (config.environment) pathsToLink extraOutputsToInstall;
+      ignoreCollisions = true;
+      # !!! Hacky, should modularise.
+      # outputs TODO: note that the tools will often not be linked by default
+      postBuild = ''
+        # Remove wrapped binaries, they shouldn't be accessible via PATH.
+        find $out/bin -maxdepth 1 -name ".*-wrapped" -type l -delete
+
+        ${config.environment.extraSetup}
+      '';
+    };
+
+  };
+}
@@ -0,0 +1,90 @@
+# This module manages the terminfo database
+# and its integration in the system.
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+{
+
+  options = {
+    environment.enableAllTerminfo = lib.mkOption {
+      default = false;
+      type = lib.types.bool;
+      description = ''
+        Whether to install all terminfo outputs
+      '';
+    };
+
+    security.sudo.keepTerminfo = lib.mkOption {
+      default = true;
+      type = lib.types.bool;
+      description = ''
+        Whether to preserve the `TERMINFO` and `TERMINFO_DIRS`
+        environment variables, for `root` and the `admin` group.
+      '';
+    };
+  };
+
+  config = {
+
+    # This should not contain packages that are broken or can't build, since it
+    # will break this expression
+    #
+    # can be generated with:
+    # lib.attrNames (lib.filterAttrs
+    #  (_: drv: (builtins.tryEval (
+    #    lib.isDerivation drv && drv ? terminfo && drv.meta.available && !drv.meta.broken && !drv.meta.unsupported)).value)
+    #  pkgs)
+    environment.systemPackages = lib.mkIf config.environment.enableAllTerminfo (
+      map (x: x.terminfo) (
+        with pkgs.pkgsBuildBuild;
+        [
+          alacritty
+          alacritty-graphics
+          ghostty-bin
+          kitty
+          mtm
+          rio
+          rxvt-unicode-unwrapped
+          rxvt-unicode-unwrapped-emoji
+          st
+          tmux
+          wezterm
+        ]
+      )
+    );
+
+    environment.pathsToLink = [
+      "/share/terminfo"
+    ];
+
+    environment.etc.terminfo = {
+      source = "${config.system.path}/share/terminfo";
+    };
+
+    # TODO: use `environment.profileRelativeSessionVariables`
+    environment.variables = {
+      TERMINFO_DIRS = map (path: path + "/share/terminfo") config.environment.profiles ++ [ "/usr/share/terminfo" ];
+    };
+
+    environment.extraInit = ''
+      # reset TERM with new TERMINFO available (if any)
+      export TERM=$TERM
+    '';
+
+    security =
+      let
+        extraConfig = ''
+
+          # Keep terminfo database for root and %admin.
+          Defaults:root,%admin env_keep+=TERMINFO_DIRS
+          Defaults:root,%admin env_keep+=TERMINFO
+        '';
+      in
+      lib.mkIf config.security.sudo.keepTerminfo {
+        sudo = { inherit extraConfig; };
+      };
+  };
+}
@@ -11,13 +11,10 @@ let
  aliasCommands =
    mapAttrsToList (n: v: ''alias ${n}=${escapeShellArg v}'')
      (filterAttrs (k: v: v != null) cfg.shellAliases);
-
-  makeDrvBinPath = concatMapStringsSep ":" (p: if isDerivation p then "${p}/bin" else p);
 in

 {
  imports = [
-    (mkRenamedOptionModule ["environment" "postBuild"] ["environment" "extraSetup"])
    (mkRemovedOptionModule [ "environment" "loginShell" ] ''
      This option was only used to change the default command in tmux.

@@ -26,46 +23,11 @@ in
  ];

  options = {
-    environment.systemPackages = mkOption {
-      type = types.listOf types.package;
-      default = [];
-      example = literalExpression "[ pkgs.curl pkgs.vim ]";
-      description = ''
-        The set of packages that appear in
-        /run/current-system/sw.  These packages are
-        automatically available to all users, and are
-        automatically updated every time you rebuild the system
-        configuration.  (The latter is the main difference with
-        installing them in the default profile,
-        {file}`/nix/var/nix/profiles/default`.
-      '';
-    };
-
-    environment.systemPath = mkOption {
-      type = types.listOf (types.either types.path types.str);
-      description = "The set of paths that are added to PATH.";
-      apply = x: if isList x then makeDrvBinPath x else x;
-    };
-
    environment.profiles = mkOption {
      type = types.listOf types.str;
      description = "A list of profiles used to setup the global environment.";
    };

-    environment.extraOutputsToInstall = mkOption {
-      type = types.listOf types.str;
-      default = [];
-      example = [ "doc" "info" "devdoc" ];
-      description = "List of additional package outputs to be symlinked into {file}`/run/current-system/sw`.";
-    };
-
-    environment.pathsToLink = mkOption {
-      type = types.listOf types.str;
-      default = [];
-      example = [ "/share/doc" ];
-      description = "List of directories to be symlinked in {file}`/run/current-system/sw`.";
-    };
-
    environment.darwinConfig = mkOption {
      type = types.nullOr (types.either types.path types.str);
      default =
@@ -126,7 +88,7 @@ in
      description = ''
        Shell script code called during global environment initialisation
        after all variables and profileVariables have been set.
-        This code is asumed to be shell-independent, which means you should
+        This code is assumed to be shell-independent, which means you should
        stick to pure sh without sh word split.
      '';
    };
@@ -160,17 +122,6 @@ in
      '';
      type = types.lines;
    };
-
-    environment.extraSetup = mkOption {
-      type = types.lines;
-      default = "";
-      description = ''
-        Shell fragments to be run after the system environment has been created.
-        This should only be used for things that need to modify the internals
-        of the environment, e.g. generating MIME caches.
-        The environment being built can be accessed at $out.
-      '';
-    };
  };

  config = {
@@ -196,16 +147,7 @@ in
      [ "/run/current-system/sw" "/nix/var/nix/profiles/default" ]
    ];

-    environment.pathsToLink = [
-      "/bin"
-      "/share/locale"
-      "/share/terminfo"
-    ];
-
    environment.extraInit = ''
-       # reset TERM with new TERMINFO available (if any)
-       export TERM=$TERM
-
       export NIX_USER_PROFILE_DIR="/nix/var/nix/profiles/per-user/$USER"
       export NIX_PROFILES="${concatStringsSep " " (reverseList cfg.profiles)}"
    '';
@@ -214,19 +156,10 @@ in
      {
        XDG_CONFIG_DIRS = map (path: path + "/etc/xdg") cfg.profiles;
        XDG_DATA_DIRS = map (path: path + "/share") cfg.profiles;
-        TERMINFO_DIRS = map (path: path + "/share/terminfo") cfg.profiles ++ [ "/usr/share/terminfo" ];
        EDITOR = mkDefault "nano";
        PAGER = mkDefault "less -R";
      };

-    system.path = pkgs.buildEnv {
-      name = "system-path";
-      paths = cfg.systemPackages;
-      postBuild = cfg.extraSetup;
-      ignoreCollisions = true;
-      inherit (cfg) pathsToLink extraOutputsToInstall;
-    };
-
    system.build.setEnvironment = pkgs.writeText "set-environment" ''
      # Prevent this file from being sourced by child shells.
      export __NIX_DARWIN_SET_ENVIRONMENT_DONE=1
@@ -50,8 +50,6 @@
      pkgs.jq
      pkgs.ripgrep
      pkgs.shellcheck
-
-      pkgs.qes
    ];

  services.yabai.enable = true;
@@ -12,7 +12,7 @@ let

  mkBrewfileSectionString = heading: entries: optionalString (entries != [ ]) ''
    # ${heading}
-    ${concatMapStringsSep "\n" (v: v.brewfileLine or v) entries}
+    ${concatStringsSep "\n" (unique (map (v: v.brewfileLine or v) entries))}

  '';

@@ -28,9 +28,23 @@ let
  mkBrewfileLineOptionsListString = attrs:
    concatStringsSep ", " (mapAttrsToList (n: v: "${n}: ${v}") attrs);

+  # Renders a Brewfile option that can be either a bool or a Ruby symbol (e.g. `:overwrite`).
+  mkBrewfileLineBoolOrSymbolString = name: config: sCfg:
+    optionalString (hasAttr name sCfg) (
+      ", ${name}: " + (
+        if isBool config.${name} then sCfg.${name}
+        else ":${config.${name}}"
+      )
+    );
+

  # Option and submodule helper functions ----------------------------------------------------------

+  mkShellIntegrationOption = shell: mkEnableOption ''
+    Homebrew ${shell} shell integration, which sets up Homebrew's environment
+    and shell completions
+  '';
+
  mkNullOrBoolOption = args: mkOption (args // {
    type = types.nullOr types.bool;
    default = null;
@@ -54,37 +68,44 @@ let
  # Submodules -------------------------------------------------------------------------------------
  # Option values and descriptions of Brewfile entries are sourced/derived from:
  #   * `brew` manpage: https://docs.brew.sh/Manpage
-  #   * `brew bundle` source files (at https://github.com/Homebrew/homebrew-bundle/tree/9fffe077f1a5a722ed5bd26a87ed622e8cb64e0c):
-  #     * lib/bundle/dsl.rb
-  #     * lib/bundle/{brew,cask,tap}_installer.rb
-  #     * spec/bundle/{brew,cask,tap}_installer_spec.rb
+  #   * `brew bundle` source files (at https://github.com/Homebrew/brew/tree/master/Library/Homebrew/bundle):
+  #     * dsl.rb
+  #     * {brew,cask,tap}_installer.rb
+  #     * ../test/bundle/{brew,cask,tap}_installer_spec.rb

  onActivationOptions = { config, ... }: {
    options = {
      cleanup = mkOption {
-        type = types.enum [ "none" "uninstall" "zap" ];
+        type = types.enum [ "none" "check" "uninstall" "zap" ];
        default = "none";
        example = "uninstall";
        description = ''
-          This option manages what happens to formulae installed by Homebrew, that aren't present in
+          This option manages what happens to packages installed by Homebrew that aren't present in
          the Brewfile generated by this module, during {command}`nix-darwin` system
          activation.

-          When set to `"none"` (the default), formulae not present in the generated
+          When set to `"none"` (the default), packages not present in the generated
          Brewfile are left installed.

+          When set to `"check"`, {command}`nix-darwin` verifies during system activation that no
+          Homebrew packages (taps, formulae, casks, etc.) are installed that aren't present in the
+          generated Brewfile. If extra packages are found, activation fails with a list of them.
+          Note that when this check fails during {command}`darwin-rebuild switch`, the entire
+          system activation is aborted and no other configuration changes will be applied until
+          the issue is resolved.
+
          When set to `"uninstall"`, {command}`nix-darwin` invokes
          {command}`brew bundle [install]` with the {command}`--cleanup` flag. This
-          uninstalls all formulae not listed in generated Brewfile, i.e.,
-          {command}`brew uninstall` is run for those formulae.
+          uninstalls all packages not listed in the generated Brewfile, i.e.,
+          {command}`brew uninstall` is run for those packages.

          When set to `"zap"`, {command}`nix-darwin` invokes
          {command}`brew bundle [install]` with the {command}`--cleanup --zap`
-          flags. This uninstalls all formulae not listed in the generated Brewfile, and if the
-          formula is a cask, removes all files associated with that cask. In other words,
-          {command}`brew uninstall --zap` is run for all those formulae.
+          flags. This uninstalls all packages not listed in the generated Brewfile, and if the
+          package is a cask, removes all files associated with that cask. In other words,
+          {command}`brew uninstall --zap` is run for all those packages.

-          If you plan on exclusively using {command}`nix-darwin` to manage formulae
+          If you plan on exclusively using {command}`nix-darwin` to manage packages
          installed by Homebrew, you probably want to set this option to
          `"uninstall"` or `"zap"`.
        '';
@@ -97,7 +118,7 @@ let
          {command}`nix-darwin` system activation. The default is `false`
          so that repeated invocations of {command}`darwin-rebuild switch` are idempotent.

-          Note that Homebrew auto-updates when it's been more then 5 minutes since it last updated.
+          Note that Homebrew auto-updates when it's been more than 5 minutes since it last updated.

          Although auto-updating is disabled by default during system activation, note that Homebrew
          will auto-update when you manually invoke certain Homebrew commands. To modify this
@@ -121,6 +142,26 @@ let
          activation.
        '';
      };
+      extraEnv = mkOption {
+        type = types.attrsOf types.str;
+        default = { };
+        example = {
+          HOMEBREW_NO_ENV_HINTS = "1";
+          HOMEBREW_NO_ANALYTICS = "1";
+        };
+        description = ''
+          Extra environment variables to set when {command}`nix-darwin` invokes
+          {command}`brew bundle [install]` during system checks and activation.
+
+          Useful for setting Homebrew's `HOMEBREW_NO_*` variables (e.g.,
+          `HOMEBREW_NO_ENV_HINTS`, `HOMEBREW_NO_ANALYTICS`, `HOMEBREW_NO_UPDATE_REPORT_NEW`)
+          that aren't inherited from the user's shell environment because activation runs
+          under sudo.
+
+          Each entry is prepended to the {command}`brew bundle` invocation in the form
+          `KEY=VALUE`, alongside `HOMEBREW_NO_AUTO_UPDATE=1` when applicable.
+        '';
+      };
      extraFlags = mkOption {
        type = types.listOf types.str;
        default = [ ];
@@ -131,17 +172,31 @@ let
        '';
      };

-      brewBundleCmd = mkInternalOption { type = types.str; };
+      brewBundleCmd = mkInternalOption { type = types.functionTo types.str; };
    };

    config = {
-      brewBundleCmd = concatStringsSep " " (
-        optional (!config.autoUpdate) "HOMEBREW_NO_AUTO_UPDATE=1"
+      brewBundleCmd = { onlyCheck }: concatStringsSep " " (
+        [
+          ''PATH="${cfg.prefix}/bin:${lib.makeBinPath [ pkgs.mas ]}:$PATH"''
+          "sudo"
+          "--preserve-env=PATH"
+          "--user=${escapeShellArg cfg.user}"
+          "--set-home"
+          "env"
+        ]
+        ++ optional (onlyCheck || !config.autoUpdate) "HOMEBREW_NO_AUTO_UPDATE=1"
+        ++ mapAttrsToList (k: v: "${k}=${escapeShellArg v}") config.extraEnv
        ++ [ "brew bundle --file='${brewfileFile}'" ]
-        ++ optional (!config.upgrade) "--no-upgrade"
-        ++ optional (config.cleanup == "uninstall") "--cleanup"
-        ++ optional (config.cleanup == "zap") "--cleanup --zap"
-        ++ config.extraFlags
+        ++ (
+          if onlyCheck then
+            [ "cleanup 2>&1" ]
+          else
+            optional (!config.upgrade) "--no-upgrade"
+            ++ optional (config.cleanup == "uninstall") "--force-cleanup"
+            ++ optional (config.cleanup == "zap") "--zap --force-cleanup"
+            ++ config.extraFlags
+        )
      );
    };
  };
@@ -155,14 +210,6 @@ let
          Whether to enable Homebrew to automatically use the Brewfile that this module generates in
          the Nix store, when you manually invoke {command}`brew bundle`.

-          Enabling this option will change the default value of
-          [](#opt-homebrew.global.lockfiles) to `false` since, with
-          this option enabled, {command}`brew bundle [install]` will default to using the
-          Brewfile that this module generates in the Nix store, unless you explicitly point it at
-          another Brewfile using the `--file` flag. As a result, it will try to
-          write the lockfile in the Nix store, and complain that it can't (though the command will
-          run successfully regardless).
-
          Implementation note: when enabled, this option sets the
          `HOMEBREW_BUNDLE_FILE` environment variable to the path of the Brewfile
          that this module generates in the Nix store, by adding it to
@@ -178,7 +225,7 @@ let
          {command}`brew tap`, and {command}`brew bundle [install]`.

          Note that Homebrew auto-updates when you manually invoke commands like the ones mentioned
-          above if it's been more then 5 minutes since it last updated.
+          above if it's been more than 5 minutes since it last updated.

          You may want to consider disabling this option if you have
          [](#opt-homebrew.onActivation.upgrade) enabled, and
@@ -191,31 +238,13 @@ let
          [](#opt-environment.variables).
        '';
      };
-      lockfiles = mkOption {
-        type = types.bool;
-        default = !config.brewfile;
-        defaultText = literalExpression "!config.homebrew.global.brewfile";
-        description = ''
-          Whether to enable Homebrew to generate lockfiles when you manually invoke
-          {command}`brew bundle [install]`.
-
-          This option will default to `false` if
-          [](#opt-homebrew.global.brewfile) is enabled since, with that option enabled,
-          {command}`brew bundle [install]` will default to using the Brewfile that this
-          module generates in the Nix store, unless you explicitly point it at another Brewfile
-          using the `--file` flag. As a result, it will try to write the
-          lockfile in the Nix store, and complain that it can't (though the command will run
-          successfully regardless).
-
-          Implementation note: when disabled, this option sets the
-          `HOMEBREW_BUNDLE_NO_LOCK` environment variable, by adding it to
-          [](#opt-environment.variables).
-        '';
-      };
-
-      # The `noLock` option was replaced by `lockfiles`. Due to `homebrew.global` being a submodule,
-      # we can't use `mkRemovedOptionModule`, so we leave this option definition here, and trigger
-      # and error message with an assertion below if it's set by the user.
+      # `noLock` was the original option; `lockfiles` replaced it (with inverted semantics).
+      # Both are now dead: Homebrew Bundle removed lockfile support in Homebrew 4.4.0
+      # (Oct 2024), so the `HOMEBREW_BUNDLE_NO_LOCK` env var and `--no-lock` CLI flag are
+      # ignored. We keep both definitions with null defaults to detect explicit user
+      # configuration and emit a warning below. We can't use `mkRemovedOptionModule` because
+      # `homebrew.global` is a submodule.
+      lockfiles = mkOption { visible = false; default = null; };
      noLock = mkOption { visible = false; default = null; };

      homebrewEnvironmentVariables = mkInternalOption { type = types.attrs; };
@@ -225,7 +254,6 @@ let
      homebrewEnvironmentVariables = {
        HOMEBREW_BUNDLE_FILE = mkIf config.brewfile "${brewfileFile}";
        HOMEBREW_NO_AUTO_UPDATE = mkIf (!config.autoUpdate) "1";
-        HOMEBREW_BUNDLE_NO_LOCK = mkIf (!config.lockfiles) "1";
      };
    };
  };
@@ -234,7 +262,7 @@ let
    options = {
      name = mkOption {
        type = types.str;
-        example = "homebrew/cask-fonts";
+        example = "apple/apple";
        description = ''
          When {option}`clone_target` is unspecified, this is the name of a formula
          repository to tap from GitHub using HTTPS. For example, `"user/repo"`
@@ -253,6 +281,25 @@ let
        description = ''
          Whether to auto-update the tap even if it is not hosted on GitHub. By default, only taps
          hosted on GitHub are auto-updated (for performance reasons).
+
+          Note: Homebrew Bundle accepts this option in Brewfile syntax but may silently ignore it
+          during installation. See [the Homebrew Bundle source](https://github.com/Homebrew/brew/tree/master/Library/Homebrew/bundle)
+          for current behavior.
+        '';
+      };
+      trusted = mkOption {
+        type = types.bool;
+        default = false;
+        example = true;
+        description = ''
+          Whether to trust this tap during {command}`nix-darwin` system activation, by adding the
+          `trusted: true` option to its {command}`brew bundle` Brewfile entry.
+
+          Homebrew 6.0.0 enabled `HOMEBREW_REQUIRE_TAP_TRUST` by default, which refuses to
+          load formulae/casks from non-official taps that haven't been trusted, aborting activation.
+          Set this to `true` for non-official taps you control so their formulae and casks are
+          installed during activation. Official taps are always trusted, so this has no effect only
+          them.
        '';
      };

@@ -268,7 +315,8 @@ let
          "tap ${sCfg.name}"
          + optionalString (sCfg ? clone_target) ", ${sCfg.clone_target}"
          + optionalString (sCfg ? force_auto_update)
-            ", force_auto_update: ${sCfg.force_auto_update}";
+            ", force_auto_update: ${sCfg.force_auto_update}"
+          + optionalString config.trusted ", trusted: true";
      };
  };

@@ -385,19 +433,34 @@ let
      };
      require_sha = mkNullOrBoolOption {
        description = ''
-          Whether to require cask(s) to have a checksum.
+          Whether to require casks to have a checksum.

          Homebrew's default is `false`.
        '';
      };
      no_quarantine = mkNullOrBoolOption {
-        description = "Whether to disable quarantining of downloads.";
+        description = ''
+          Whether to disable quarantining of downloads.
+
+          Note: this option is deprecated in Homebrew and may be removed in a
+          future release. See [Homebrew/brew#20755](https://github.com/Homebrew/brew/issues/20755).
+
+          Homebrew's default is `false`.
+        '';
      };
      no_binaries = mkNullOrBoolOption {
-        description = "Whether to disable linking of helper executables.";
+        description = ''
+          Whether to disable linking of helper executables.
+
+          Homebrew's default is `false`.
+        '';
      };
      ignore_dependencies = mkNullOrBoolOption {
-        description = "Ignore casks dependencies in case you manage them extrenally";
+        description = ''
+          Whether to ignore cask dependencies, e.g., when you manage them externally.
+
+          Homebrew's default is `false`.
+        '';
      };

      brewfileLine = mkInternalOption { type = types.nullOr types.str; };
@@ -424,7 +487,7 @@ let
        type = with types; nullOr (listOf str);
        default = null;
        description = ''
-          Arguments flags to pass to {command}`brew install`. Values should not include the
+          Argument flags to pass to {command}`brew install`. Values should not include the
          leading `"--"`.
        '';
      };
@@ -437,12 +500,14 @@ let
        '';
      };
      restart_service = mkOption {
-        type = with types; nullOr (either bool (enum [ "changed" ]));
+        type = with types; nullOr (either bool (enum [ "changed" "always" ]));
        default = null;
        description = ''
          Whether to run {command}`brew services restart` for the formula and register it to
          launch at login (or boot). If set to `"changed"`, the service will only
-          be restarted on version changes.
+          be restarted when the formula is newly installed or upgraded. If set to
+          `"always"`, the service will be restarted on every {command}`brew bundle`
+          run, even if nothing changed.

          Homebrew's default is `false`.
        '';
@@ -450,17 +515,53 @@ let
      start_service = mkNullOrBoolOption {
        description = ''
          Whether to run {command}`brew services start` for the formula and register it to
-          launch at login (or boot).
+          launch at login (or boot). Unlike {option}`restart_service`, this only starts
+          the service if it is not currently running, without restarting an already-running
+          service.

          Homebrew's default is `false`.
        '';
      };
-      link = mkNullOrBoolOption {
+      link = mkOption {
+        type = with types; nullOr (either bool (enum [ "overwrite" ]));
+        default = null;
        description = ''
-          Whether to link the formula to the Homebrew prefix. When this option is
-          `null`, Homebrew will use it's default behavior which is to link the
-          formula if it's currently unlinked and not keg-only, and to unlink the formula if it's
-          currently linked and keg-only.
+          Whether to link the formula to the Homebrew prefix. When set to `"overwrite"`,
+          existing symlinks will be overwritten ({command}`brew link --overwrite`). When this
+          option is `null`, Homebrew will use its default behavior, which is to link the formula
+          if it's currently unlinked and not keg-only, and to unlink the formula if it's currently
+          linked and keg-only.
+        '';
+      };
+      postinstall = mkNullOrStrOption {
+        description = ''
+          A shell command to run after the formula is installed or upgraded. The command is passed
+          to the system shell and only executes when the formula actually changed (was freshly
+          installed or upgraded), not on every {command}`brew bundle` run.
+        '';
+      };
+      # `version_file` is intentionally not exposed: it writes the installed version to a file
+      # path relative to the `brew bundle` working directory, which is not meaningful during
+      # nix-darwin system activation.
+      trusted = mkOption {
+        type = types.bool;
+        default = true;
+        example = false;
+        description = ''
+          Whether to trust this formula during {command}`nix-darwin` system activation, by adding the
+          `trusted: true` option to its {command}`brew bundle` Brewfile entry.
+
+          Homebrew 6.0.0 enabled `HOMEBREW_REQUIRE_TAP_TRUST` by default, which refuses to
+          load formulae from non-official taps that haven't been trusted, aborting activation. Set
+          this to `true` for a formula from a non-official tap you control so it is installed during
+          activation.
+
+          This only takes effect when {option}`name` is a fully-qualified name (`user/repo/formula`),
+          since only fully-qualified names map to a tap and can be trusted (and installed) on their
+          own. When {option}`name` is a plain formula name, it is resolved through your tapped
+          repositories, so trust must instead come from the containing tap being marked as trusted
+          (see [](#opt-homebrew.taps)). Official taps are always trusted, so this has no effect on
+          them.
        '';
      };

@@ -470,20 +571,15 @@ let
    config =
      let
        sCfg = mkProcessedSubmodConfig config;
-        sCfgSubset = removeAttrs sCfg [ "name" "restart_service" ];
+        sCfgSubset = removeAttrs sCfg [ "name" "restart_service" "link" "trusted" ];
      in
      {
        brewfileLine =
          "brew ${sCfg.name}"
          + optionalString (sCfgSubset != { }) ", ${mkBrewfileLineOptionsListString sCfgSubset}"
-          # We need to handle the `restart_service` option seperately since it can be either a bool
-          # or `:changed` in the Brewfile.
-          + optionalString (sCfg ? restart_service) (
-            ", restart_service: " + (
-              if isBool config.restart_service then sCfg.restart_service
-              else ":${config.restart_service}"
-            )
-          );
+          + mkBrewfileLineBoolOrSymbolString "link" config sCfg
+          + mkBrewfileLineBoolOrSymbolString "restart_service" config sCfg
+          + optionalString config.trusted ", trusted: true";
      };
  };

@@ -502,12 +598,42 @@ let
          [](#opt-homebrew.caskArgs) for the available options.
        '';
      };
-      greedy = mkNullOrBoolOption {
+      greedy = mkOption {
+        type = types.nullOr types.bool;
+        default = cfg.greedyCasks;
        description = ''
          Whether to always upgrade this cask regardless of whether it's unversioned or it updates
          itself.
        '';
      };
+      postinstall = mkNullOrStrOption {
+        description = ''
+          A shell command to run after the cask is installed or upgraded. The command is passed to
+          the system shell and only executes when the cask was actually installed or upgraded, not
+          on every {command}`brew bundle` run.
+        '';
+      };
+      trusted = mkOption {
+        type = types.bool;
+        default = true;
+        example = false;
+        description = ''
+          Whether to trust this cask during {command}`nix-darwin` system activation, by adding the
+          `trusted: true` option to its {command}`brew bundle` Brewfile entry.
+
+          Homebrew 6.0.0 enabled `HOMEBREW_REQUIRE_TAP_TRUST` by default, which refuses to
+          load casks from non-official taps that haven't been trusted, silently skipping them. Set
+          this to `true` for a cask from a non-official tap you control so it is installed during
+          activation.
+
+          This only takes effect when {option}`name` is a fully-qualified name (`user/repo/cask`),
+          since only fully-qualified names map to a tap and can be trusted (and installed) on their
+          own. When {option}`name` is a plain cask name, it is resolved through your tapped
+          repositories, so trust must instead come from the containing tap being marked as trusted
+          (see [](#opt-homebrew.taps)). Official taps are always trusted, so this has no effect on
+          them.
+        '';
+      };

      brewfileLine = mkInternalOption { type = types.nullOr types.str; };
    };
@@ -515,12 +641,13 @@ let
    config =
      let
        sCfg = mkProcessedSubmodConfig config;
-        sCfgSubset = removeAttrs sCfg [ "name" ];
+        sCfgSubset = removeAttrs sCfg [ "name" "trusted" ];
      in
      {
        brewfileLine =
          "cask ${sCfg.name}"
-          + optionalString (sCfgSubset != { }) ", ${mkBrewfileLineOptionsListString sCfgSubset}";
+          + optionalString (sCfgSubset != { }) ", ${mkBrewfileLineOptionsListString sCfgSubset}"
+          + optionalString config.trusted ", trusted: true";
      };
  };
 in
@@ -531,21 +658,26 @@ in
  imports = [
    (mkRenamedOptionModule [ "homebrew" "autoUpdate" ] [ "homebrew" "onActivation" "autoUpdate" ])
    (mkRenamedOptionModule [ "homebrew" "cleanup" ] [ "homebrew" "onActivation" "cleanup" ])
+    (mkRemovedOptionModule [ "homebrew" "brewPrefix" ] "`homebrew.brewPrefix` has been renamed to `homebrew.prefix` and its semantics changed: the old option pointed to the bin directory (e.g., `/opt/homebrew/bin`), while the new option points to the Homebrew prefix (e.g., `/opt/homebrew`), matching `brew --prefix`. Please replace `homebrew.brewPrefix` with `homebrew.prefix`, removing the trailing `/bin` if present.")
+    (mkRemovedOptionModule [ "homebrew" "whalebrews" ] "Whalebrew support was removed from Homebrew Bundle in Homebrew 4.7.0 (Nov 2025). `whalebrew` entries in a Brewfile now cause `brew bundle` to fail. Please manage Whalebrew images directly using the `whalebrew` CLI.")
  ];

  options.homebrew = {
    enable = mkEnableOption ''
      {command}`nix-darwin` to manage installing/updating/upgrading Homebrew taps, formulae,
-      and casks, as well as Mac App Store apps and Docker containers, using Homebrew Bundle.
+      casks, Mac App Store apps, Visual Studio Code extensions, Go packages, and Cargo
+      crates using Homebrew Bundle.

      Note that enabling this option does not install Homebrew, see the Homebrew
      [website](https://brew.sh) for installation instructions.

      Use the [](#opt-homebrew.brews), [](#opt-homebrew.casks),
-      [](#opt-homebrew.masApps), and [](#opt-homebrew.whalebrews) options
-      to list the Homebrew formulae, casks, Mac App Store apps, and Docker containers you'd like to
-      install. Use the [](#opt-homebrew.taps) option, to make additional formula
-      repositories available to Homebrew. This module uses those options (along with the
+      [](#opt-homebrew.masApps), [](#opt-homebrew.vscode),
+      [](#opt-homebrew.goPackages), and [](#opt-homebrew.cargoPackages) options to list
+      the Homebrew formulae, casks, Mac App Store apps, Visual Studio Code extensions,
+      Go packages, and Cargo crates you'd like to install. Use the
+      [](#opt-homebrew.taps) option, to make additional formula repositories available to
+      Homebrew. This module uses those options (along with the
      [](#opt-homebrew.caskArgs) options) to generate a Brewfile that
      {command}`nix-darwin` passes to the {command}`brew bundle` command during
      system activation.
@@ -570,20 +702,27 @@ in
      '';
    };

-    brewPrefix = mkOption {
+    prefix = mkOption {
      type = types.str;
-      default = if pkgs.stdenv.hostPlatform.isAarch64 then "/opt/homebrew/bin" else "/usr/local/bin";
+      default = if pkgs.stdenv.hostPlatform.isAarch64 then "/opt/homebrew" else "/usr/local";
      defaultText = literalExpression ''
-        if pkgs.stdenv.hostPlatform.isAarch64 then "/opt/homebrew/bin"
-        else "/usr/local/bin"
+        if pkgs.stdenv.hostPlatform.isAarch64 then "/opt/homebrew"
+        else "/usr/local"
      '';
      description = ''
-        The path prefix where the {command}`brew` executable is located. This will be set to
-        the correct value based on your system's platform, and should only need to be changed if you
-        manually installed Homebrew in a non-standard location.
+        The Homebrew prefix directory, i.e., the value that {command}`brew --prefix` returns.
+        The default is automatically set based on your system's platform, and should only need
+        to be changed if you manually installed Homebrew in a non-standard location.
      '';
    };

+    # These default to `false` (unlike direnv, which defaults to `true`) because existing users
+    # likely already have `brew shellenv` in their dotfiles, and enabling by default would cause
+    # duplicate evaluation.
+    enableBashIntegration = mkShellIntegrationOption "Bash";
+    enableFishIntegration = mkShellIntegrationOption "Fish";
+    enableZshIntegration = mkShellIntegrationOption "Zsh";
+
    onActivation = mkOption {
      type = types.submodule onActivationOptions;
      default = { };
@@ -605,10 +744,10 @@ in
      type = with types; listOf (coercedTo str (name: { inherit name; }) (submodule tapOptions));
      default = [ ];
      example = literalExpression ''
-        # Adapted examples from https://github.com/Homebrew/homebrew-bundle#usage
+        # Adapted from https://docs.brew.sh/Brew-Bundle-and-Brewfile
        [
          # `brew tap`
-          "homebrew/cask"
+          "apple/apple"

          # `brew tap` with custom Git URL and arguments
          {
@@ -642,11 +781,20 @@ in
      '';
    };

+    greedyCasks = mkNullOrBoolOption {
+      description = ''
+        Whether to always upgrade casks listed in [](#opt-homebrew.casks) regardless
+        of whether it's unversioned or it updates itself.
+
+        Homebrew's default is `false`.
+      '';
+    };
+
    brews = mkOption {
      type = with types; listOf (coercedTo str (name: { inherit name; }) (submodule brewOptions));
      default = [ ];
      example = literalExpression ''
-        # Adapted examples from https://github.com/Homebrew/homebrew-bundle#usage
+        # Adapted from https://docs.brew.sh/Brew-Bundle-and-Brewfile
        [
          # `brew install`
          "imagemagick"
@@ -665,6 +813,12 @@ in
            link = true;
            conflicts_with = [ "mysql" ];
          }
+
+          # `brew install`, run a post-install command on version changes
+          {
+            name = "postgresql@16";
+            postinstall = "\''${HOMEBREW_PREFIX}/opt/postgresql@16/bin/postgres -D \''${HOMEBREW_PREFIX}/var/postgresql@16";
+          }
        ]
      '';
      description = ''
@@ -680,7 +834,7 @@ in
      type = with types; listOf (coercedTo str (name: { inherit name; }) (submodule caskOptions));
      default = [ ];
      example = literalExpression ''
-        # Adapted examples from https://github.com/Homebrew/homebrew-bundle#usage
+        # Adapted from https://docs.brew.sh/Brew-Bundle-and-Brewfile
        [
          # `brew install --cask`
          "google-chrome"
@@ -696,6 +850,12 @@ in
            name = "opera";
            greedy = true;
          }
+
+          # `brew install --cask`, run a post-install command on install or upgrade
+          {
+            name = "google-cloud-sdk";
+            postinstall = "\''${HOMEBREW_PREFIX}/bin/gcloud components update";
+          }
        ]
      '';
      description = ''
@@ -730,21 +890,47 @@ in
      '';
    };

-    whalebrews = mkOption {
+    vscode = mkOption {
      type = with types; listOf str;
      default = [ ];
-      example = [ "whalebrew/wget" ];
+      example = [ "golang.go" ];
      description = ''
-        List of Docker images to install using {command}`whalebrew`.
+        List of Visual Studio Code extensions to install using Homebrew Bundle.

-        When this option is used, `"whalebrew"` is automatically added to
-        [](#opt-homebrew.brews).
+        A compatible editor (Visual Studio Code, VSCodium, Cursor, or VS Code Insiders)
+        must be available. If none is found, Homebrew will attempt to install
+        `visual-studio-code` automatically.

-        For more information on {command}`whalebrew` see:
-        [github.com/whalebrew/whalebrew](https://github.com/whalebrew/whalebrew).
+        For more information on {command}`code` see:
+        [VSCode Extension Marketplace](https://code.visualstudio.com/docs/editor/extension-marketplace).
      '';
    };

+    goPackages = mkOption {
+      type = with types; listOf str;
+      default = [ ];
+      example = [ "github.com/charmbracelet/crush" ];
+      description = ''
+        List of Go packages to install using {command}`go install`.
+
+        Homebrew will automatically install the {command}`go` formula if it is not already
+        installed.
+      '';
+    };
+
+    cargoPackages = mkOption {
+      type = with types; listOf str;
+      default = [ ];
+      example = [ "ripgrep" ];
+      description = ''
+        List of Rust packages to install using {command}`cargo install`.
+
+        Homebrew will automatically install the {command}`rust` formula if it is not already
+        installed.
+      '';
+    };
+
+
    extraConfig = mkOption {
      type = types.lines;
      default = "";
@@ -757,7 +943,7 @@ in

    brewfile = mkInternalOption {
      type = types.str;
-      description = "String reprensentation of the generated Brewfile useful for debugging.";
+      description = "String representation of the generated Brewfile useful for debugging.";
    };
  };

@@ -766,22 +952,16 @@ in

  config = {

-    assertions = [
-      # See comment above `homebrew.global.noLock` option declaration for why this is required.
-      { assertion = cfg.global.noLock == null; message = "The option `homebrew.global.noLock' was removed, use `homebrew.global.lockfiles' in it's place."; }
-    ];
-
    warnings = [
      (mkIf (options.homebrew.autoUpdate.isDefined || options.homebrew.cleanup.isDefined) "The `homebrew' module no longer upgrades outdated formulae and apps by default during `nix-darwin' system activation. To enable upgrading, set `homebrew.onActivation.upgrade = true'.")
+      (mkIf (cfg.global.noLock != null || cfg.global.lockfiles != null) "The options `homebrew.global.noLock' and `homebrew.global.lockfiles' have been deprecated. Homebrew Bundle removed lockfile support in Homebrew 4.4.0 (Oct 2024), so these options no longer have any effect. Please remove them from your configuration.")
+      (mkIf (hasSuffix "/bin" cfg.prefix) "`homebrew.prefix` should be the Homebrew prefix directory (e.g., `/opt/homebrew`), not the bin directory. The value should match what `brew --prefix` returns. Did you mean to remove the trailing `/bin`?")
    ];

    system.requiresPrimaryUser = mkIf (cfg.enable && options.homebrew.user.highestPrio == (mkOptionDefault {}).priority) [
      "homebrew.enable"
    ];

-    homebrew.brews =
-      optional (cfg.whalebrews != [ ]) "whalebrew";
-
    homebrew.brewfile =
      "# Created by `nix-darwin`'s `homebrew` module\n\n"
      + mkBrewfileSectionString "Taps" cfg.taps
@@ -791,23 +971,73 @@ in
      + mkBrewfileSectionString "Casks" cfg.casks
      + mkBrewfileSectionString "Mac App Store apps"
        (mapAttrsToList (n: id: ''mas "${n}", id: ${toString id}'') cfg.masApps)
-      + mkBrewfileSectionString "Docker containers" (map (v: ''whalebrew "${v}"'') cfg.whalebrews)
+      + mkBrewfileSectionString "Visual Studio Code extensions" (map (v: ''vscode "${v}"'') cfg.vscode)
+      + mkBrewfileSectionString "Go packages" (map (v: ''go "${v}"'') cfg.goPackages)
+      + mkBrewfileSectionString "Cargo packages" (map (v: ''cargo "${v}"'') cfg.cargoPackages)
      + optionalString (cfg.extraConfig != "") ("# Extra config\n" + cfg.extraConfig);

    environment.variables = mkIf cfg.enable cfg.global.homebrewEnvironmentVariables;

+    programs = mkIf cfg.enable {
+      bash.interactiveShellInit = mkIf cfg.enableBashIntegration ''
+        eval "$(${cfg.prefix}/bin/brew shellenv bash)"
+        if [[ -r "${cfg.prefix}/etc/profile.d/bash_completion.sh" ]]; then
+          source "${cfg.prefix}/etc/profile.d/bash_completion.sh"
+        else
+          for COMPLETION in "${cfg.prefix}/etc/bash_completion.d/"*; do
+            [[ -r "$COMPLETION" ]] && source "$COMPLETION"
+          done
+        fi
+      '';
+
+      zsh.interactiveShellInit = mkIf cfg.enableZshIntegration ''
+        eval "$(${cfg.prefix}/bin/brew shellenv zsh)"
+      '';
+
+      fish.interactiveShellInit = mkIf cfg.enableFishIntegration ''
+        eval (${cfg.prefix}/bin/brew shellenv fish)
+        if test -d "${cfg.prefix}/share/fish/completions"
+          set -p fish_complete_path "${cfg.prefix}/share/fish/completions"
+        end
+        if test -d "${cfg.prefix}/share/fish/vendor_completions.d"
+          set -p fish_complete_path "${cfg.prefix}/share/fish/vendor_completions.d"
+        end
+      '';
+    };
+
+    system.checks.text = mkIf (cfg.enable && cfg.onActivation.cleanup == "check") ''
+      if [ -f "${cfg.prefix}/bin/brew" ]; then
+        homebrewCleanupExitCode=0
+        homebrewCleanupResult=$(${cfg.onActivation.brewBundleCmd { onlyCheck = true; }}) || homebrewCleanupExitCode=$?
+        if [ "$homebrewCleanupExitCode" -eq 1 ]; then
+          printf >&2 '\e[1;31merror: found Homebrew packages not listed in the Brewfile, aborting activation\e[0m\n'
+          printf >&2 '%s\n' "$homebrewCleanupResult"
+          printf >&2 '\n'
+          printf >&2 'To fix this, either:\n'
+          printf >&2 '  - Add the listed packages to your nix-darwin Homebrew configuration\n'
+          printf >&2 '  - Remove them by running: brew bundle cleanup --force\n'
+          printf >&2 '  - Set homebrew.onActivation.cleanup to "uninstall" or "zap"\n'
+          exit 2
+        elif [ "$homebrewCleanupExitCode" -ne 0 ]; then
+          printf >&2 '\e[1;31merror: brew bundle cleanup failed, aborting activation\e[0m\n'
+          printf >&2 '%s\n' "$homebrewCleanupResult"
+          exit 2
+        fi
+      fi
+    '';
+
    system.activationScripts.homebrew.text = mkIf cfg.enable ''
      # Homebrew Bundle
      echo >&2 "Homebrew bundle..."
-      if [ -f "${cfg.brewPrefix}/brew" ]; then
-        PATH="${cfg.brewPrefix}:${lib.makeBinPath [ pkgs.mas ]}:$PATH" \
-        sudo \
-          --user=${escapeShellArg cfg.user} \
-          --set-home \
-          ${cfg.onActivation.brewBundleCmd}
+      if [ -f "${cfg.prefix}/bin/brew" ]; then
+        ${cfg.onActivation.brewBundleCmd { onlyCheck = false; }}
      else
        echo -e "\e[1;31merror: Homebrew is not installed, skipping...\e[0m" >&2
      fi
    '';
  };
+
+  meta.maintainers = [
+    lib.maintainers.malo or "malo"
+  ];
 }
@@ -9,7 +9,7 @@ let

  toEnvironmentText = name: value: {
    name = "${value.serviceConfig.Label}.plist";
-    value.text = generators.toPlist { } value.serviceConfig;
+    value.text = generators.toPlist { escape = true; } value.serviceConfig;
  };

  launchdConfig = import ./launchd.nix;
@@ -90,7 +90,7 @@ let
        serviceConfig.ProgramArguments = mkIf (config.command != "") [
          "/bin/sh"
          "-c"
-          "/bin/wait4path /nix/store &amp;&amp; exec ${config.command}"
+          "/bin/wait4path /nix/store && exec ${config.command}"
        ];
        serviceConfig.EnvironmentVariables = mkIf (env != {}) env;
      };
@@ -120,6 +120,18 @@ in
        This key maps to the second argument of `execvp(3)`.  This key is required in the absence of the Program
        key. Please note: many people are confused by this key. Please read `execvp(3)` very carefully!
      '';
+      # TODO: Remove this some time after 25.11.
+      apply =
+        val:
+        if (builtins.isNull val) then
+          val
+        else
+          (map (
+            item:
+            lib.warnIf (lib.hasInfix "&amp;" item)
+              "A value for `ProgramArguments` contains the literal string `&amp;`. This is no longer necessary and will lead to double-escaping, as nix-darwin now automatically escapes special characters."
+            item
+          ) val);
    };

    EnableGlobbing = mkOption {
@@ -1,5 +1,7 @@
 [
  ./alias.nix
+  ./config/system-path.nix
+  ./config/terminfo.nix
  ./documentation
  ./meta.nix
  ./misc/ids.nix
@@ -47,6 +49,7 @@
  ./system/version.nix
  ./time
  ./networking
+  ./networking/applicationFirewall.nix
  ./nix
  ./nix/linux-builder.nix
  ./nix/nix-darwin.nix
@@ -103,14 +106,17 @@
  ./services/jankyborders
  ./programs/_1password.nix
  ./programs/_1password-gui.nix
+  ./programs/arqbackup.nix
  ./programs/bash
+  ./programs/devenv.nix
  ./programs/direnv.nix
  ./programs/fish.nix
  ./programs/gnupg.nix
  ./programs/man.nix
+  ./programs/mas.nix
  ./programs/info
  ./programs/nix-index
-  ./programs/ssh
+  ./programs/ssh.nix
  ./programs/tmux.nix
  ./programs/vim.nix
  ./programs/zsh
@@ -0,0 +1,73 @@
+{ config, lib, ... }:
+let
+  cfg = config.networking.applicationFirewall;
+
+  socketfilterfw =
+    option: value:
+    lib.concatStringsSep " " [
+      "/usr/libexec/ApplicationFirewall/socketfilterfw"
+      "--${option}"
+      (if value then "on" else "off")
+    ];
+in
+{
+  meta.maintainers = [
+    (lib.maintainers.prince213 or "prince213")
+    (lib.maintainers.ryanccn or "ryanccn")
+  ];
+
+  options.networking.applicationFirewall = {
+    enable = lib.mkOption {
+      type = lib.types.nullOr lib.types.bool;
+      default = null;
+      example = true;
+      description = "Whether to enable application firewall.";
+    };
+
+    blockAllIncoming = lib.mkOption {
+      type = lib.types.nullOr lib.types.bool;
+      default = null;
+      example = true;
+      description = "Whether to block all incoming connections.";
+    };
+
+    allowSigned = lib.mkOption {
+      type = lib.types.nullOr lib.types.bool;
+      default = null;
+      example = true;
+      description = "Whether to allow built-in software to receive incoming connections.";
+    };
+
+    allowSignedApp = lib.mkOption {
+      type = lib.types.nullOr lib.types.bool;
+      default = null;
+      example = true;
+      description = "Whether to allow downloaded signed software to receive incoming connections.";
+    };
+
+    enableStealthMode = lib.mkOption {
+      type = lib.types.nullOr lib.types.bool;
+      default = null;
+      example = true;
+      description = "Whether to enable stealth mode.";
+    };
+  };
+
+  config = {
+    system.activationScripts.networking.text = ''
+      echo "configuring application firewall..." >&2
+
+      ${lib.optionalString (cfg.enable != null) (socketfilterfw "setglobalstate" cfg.enable)}
+      ${lib.optionalString (cfg.blockAllIncoming != null) (
+        socketfilterfw "setblockall" cfg.blockAllIncoming
+      )}
+      ${lib.optionalString (cfg.allowSigned != null) (socketfilterfw "setallowsigned" cfg.allowSigned)}
+      ${lib.optionalString (cfg.allowSignedApp != null) (
+        socketfilterfw "setallowsignedapp" cfg.allowSignedApp
+      )}
+      ${lib.optionalString (cfg.enableStealthMode != null) (
+        socketfilterfw "setstealthmode" cfg.enableStealthMode
+      )}
+    '';
+  };
+}
@@ -18,6 +18,9 @@ let
        *${lib.escapeShellArg srv}*)
          networksetup -setdnsservers ${lib.escapeShellArgs ([ srv ] ++ (emptyList cfg.dns))}
          networksetup -setsearchdomains ${lib.escapeShellArgs ([ srv ] ++ (emptyList cfg.search))}
+          ${optionalString (cfg.dhcpClientId != null) ''
+            networksetup -setdhcp ${lib.escapeShellArgs [ srv cfg.dhcpClientId ]}
+          ''}
          ;;
      esac
    '') cfg.knownNetworkServices}
@@ -133,6 +136,21 @@ in
      '';
    };

+    networking.dhcpClientId = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      example = "my-client-id";
+      description = ''
+        The DHCP client identifier to use when requesting an IP address from a DHCP server.
+
+        If this option is set, it will be used by the system when requesting an IP address.
+        If not set, no changes will be made.
+
+        Set to the string "empty" to clear any previously configured client ID
+        and restore the system default behavior.
+      '';
+    };
+
    networking.dns = mkOption {
      type = types.listOf types.str;
      default = [];
@@ -162,6 +180,7 @@ in
    warnings = [
      (mkIf (cfg.knownNetworkServices == [] && cfg.dns != []) "networking.knownNetworkServices is empty, dns servers will not be configured.")
      (mkIf (cfg.knownNetworkServices == [] && cfg.search != []) "networking.knownNetworkServices is empty, dns searchdomains will not be configured.")
+      (mkIf (cfg.knownNetworkServices == [] && cfg.dhcpClientId != null) "networking.knownNetworkServices is empty, dhcp client ID will not be configured.")
    ];

    system.activationScripts.networking.text = ''
@@ -443,11 +443,14 @@ in
      nixPath = mkOption {
        type = nixPathType;
        inherit (managedDefault "nix.nixPath" (
-          lib.optionals cfg.channel.enable [
-            # Include default path <darwin-config>.
-            { darwin-config = "${config.environment.darwinConfig}"; }
-            "/nix/var/nix/profiles/per-user/root/channels"
-          ]
+          lib.optionals cfg.channel.enable (
+            lib.optionals (config.environment.darwinConfig != null) [
+              # Include default path <darwin-config>.
+              { darwin-config = "${config.environment.darwinConfig}"; }
+            ] ++ [
+              "/nix/var/nix/profiles/per-user/root/channels"
+            ]
+          )
        )) default;

        defaultText = lib.literalExpression ''
@@ -754,6 +757,9 @@ in
      "6bb8d6b0dd16b44ee793a9b8382dac76c926e4c16ffb8ddd2bb4884d1ca3f811"  # DeterminateSystems Nix installer 0.34.0
      "24797ac05542ff8b52910efc77870faa5f9e3275097227ea4e50c430a5f72916"  # lix-installer 0.17.1 with flakes
      "b027b5cad320b5b8123d9d0db9f815c3f3921596c26dc3c471457098e4d3cc40"  # lix-installer 0.17.1 without flakes
+      "74ee0ae5ad21a1b101617685fd3d001f74a9466d9d763d92eb75b99cc740db91"  # experimental official Nix installer 2.33.3
+      "daa9d824601c088f52de3da176e14328ba41e7be3eb450fdf8b93c86f236f722"  # lix-installer 3.95.0 (47bc300) with flakes
+      "7659f39ef9ab9cdf50f8e6ae3476cbf3f27be6485500d1f225d45574d943a9f7"  # lix-installer 3.95.0 (47bc300) without flakes
    ];

    environment.etc."nix/registry.json".text = builtins.toJSON {
@@ -811,9 +817,12 @@ in
        { assertion = config.users.groups ? "nixbld" -> config.users.groups.nixbld.members != []; message = "refusing to remove all members from nixbld group, this would break nix"; }

        {
-          # Should be fixed in Lix by https://gerrit.lix.systems/c/lix/+/2100
+          # Should be fixed in Lix by https://gerrit.lix.systems/c/lix/+/2100, Nix by https://github.com/NixOS/nix/commit/d888846b68dd5fad998b84c5cb6246b1b63398cd
          # Lix 2.92.0 will set `VERSION_SUFFIX` to `""`; `lib.versionAtLeast "" "pre20241107"` will return `true`.
-          assertion = cfg.settings.auto-optimise-store -> (cfg.package.pname == "lix" && (isNixAtLeast "2.92.0" && versionAtLeast (strings.removePrefix "-" cfg.package.VERSION_SUFFIX) "pre20241107"));
+          assertion = cfg.settings.auto-optimise-store -> (
+            (cfg.package.pname == "lix" && (isNixAtLeast "2.92.0" && versionAtLeast (strings.removePrefix "-" cfg.package.VERSION_SUFFIX) "pre20241107"))
+            || (cfg.package.pname == "nix" && ((isNixAtLeast "2.31.3" && !isNixAtLeast "2.32") || isNixAtLeast "2.32.5" || isNixAtLeast "2.33"))
+          );
          message = "`nix.settings.auto-optimise-store` is known to corrupt the Nix Store, please use `nix.optimise.automatic` instead.";
        }
      ];
@@ -832,7 +841,7 @@ in

    system.requiresPrimaryUser = mkIf (
      config.system.stateVersion < 2
-      && options.nix.nixPath.highestPrio == (mkDefault {}).priotity
+      && options.nix.nixPath.highestPrio == (mkDefault {}).priority
    ) [
      "nix.nixPath"
    ];
@@ -878,10 +887,14 @@ in
    # to express that we want it deleted and know only one hash?
    system.activationScripts.checks.text = mkAfter ''
      nixCustomConfKnownSha256Hashes=(
-        # v0.33.0
+        # DetSys v0.33.0
        6787fade1cf934f82db554e78e1fc788705c2c5257fddf9b59bdd963ca6fec63
-        # v0.34.0
+        # DetSys v0.34.0
        3bd68ef979a42070a44f8d82c205cfd8e8cca425d91253ec2c10a88179bb34aa
+        # Nix 2.33.3
+        71f7fdc9f6c9e55ca0f2e6f85137037d660b3224a34d59305e8530ca292bc734
+        # Lix 2.95.1
+        a6dee4985bf207d3bec6a3cee28aefb33e60f5d0a91d8c20bbd71b9dadb2e601
      )
      if [[ -e /etc/nix/nix.custom.conf ]]; then
        nixCustomConfSha256Output=$(shasum -a 256 /etc/nix/nix.custom.conf)
@@ -17,10 +17,13 @@ let
  mergeConfig =
    lhs_: rhs_:
    let
-      lhs = optCall lhs_ { inherit pkgs; };
-      rhs = optCall rhs_ { inherit pkgs; };
+      lhs = optCall lhs_ { inherit lib pkgs; };
+      rhs = optCall rhs_ { inherit lib pkgs; };
    in
    lib.recursiveUpdate lhs rhs
+    // lib.optionalAttrs (lhs ? allowUnfreePackages) {
+      allowUnfreePackages = lhs.allowUnfreePackages ++ (lib.attrByPath [ "allowUnfreePackages" ] [ ] rhs);
+    }
    // lib.optionalAttrs (lhs ? packageOverrides) {
      packageOverrides =
        pkgs:
@@ -0,0 +1,41 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+
+let
+  cfg = config.programs.arqbackup;
+in
+{
+  options = {
+    programs.arqbackup = {
+      enable = lib.mkEnableOption "Arq backup";
+
+      # If `arq` is not available then we set `default` to `null` to prevent
+      # eval from breaking while `arq` hasn't been merged yet. Only if a user
+      # enables the module will they be required to set this option.
+      package = lib.mkPackageOption pkgs "arq" (lib.optionalAttrs (!pkgs ? arq) { default = null; });
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
+
+    launchd.daemons.arqagent = {
+      command = "${cfg.package}/Applications/Arq.app/Contents/Resources/ArqAgent.app/Contents/MacOS/ArqAgent";
+      serviceConfig.Label = "com.haystacksoftware.arqagent";
+      serviceConfig.RunAtLoad = true;
+      serviceConfig.KeepAlive = true;
+    };
+
+    launchd.user.agents.ArqMonitor = {
+      command = "${cfg.package}/Applications/Arq.app/Contents/Resources/ArqMonitor.app/Contents/MacOS/ArqMonitor";
+      serviceConfig.Label = "com.haystacksoftware.ArqMonitor";
+      serviceConfig.RunAtLoad = true;
+      serviceConfig.KeepAlive = true;
+      managedBy = "programs.arqbackup.enable";
+    };
+  };
+}
@@ -0,0 +1,53 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.programs.devenv;
+
+  hook = shell: "${lib.getExe cfg.package} hook ${shell}";
+in
+{
+  meta.maintainers = [
+    lib.maintainers.domenkozar or "domenkozar"
+    lib.maintainers.sandydoo or "sandydoo"
+    lib.maintainers.anish or "anish"
+  ];
+
+  options.programs.devenv = {
+    enable = lib.mkEnableOption "devenv, fast, declarative, reproducible and composable developer environments";
+
+    package = lib.mkPackageOption pkgs "devenv" { };
+
+    enableBashIntegration = lib.mkEnableOption "auto-activation of devenv environments in Bash" // {
+      default = true;
+    };
+
+    enableFishIntegration = lib.mkEnableOption "auto-activation of devenv environments in Fish" // {
+      default = true;
+    };
+
+    enableZshIntegration = lib.mkEnableOption "auto-activation of devenv environments in Zsh" // {
+      default = true;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
+
+    programs.bash.interactiveShellInit = lib.mkIf cfg.enableBashIntegration ''
+      eval "$(${hook "bash"})"
+    '';
+
+    programs.fish.interactiveShellInit = lib.mkIf cfg.enableFishIntegration ''
+      ${hook "fish"} | source
+    '';
+
+    programs.zsh.interactiveShellInit = lib.mkIf cfg.enableZshIntegration ''
+      eval "$(${hook "zsh"})"
+    '';
+  };
+}
@@ -5,12 +5,19 @@
  ...
 }: let
  cfg = config.programs.direnv;
+  enabledOption =
+    x:
+    lib.mkEnableOption x
+    // {
+      default = true;
+      example = false;
+    };
+  format = pkgs.formats.toml {};
 in {
  meta.maintainers = [
    lib.maintainers.mattpolzin or "mattpolzin"
  ];
  options.programs.direnv = {
-
    enable = lib.mkEnableOption ''
      direnv integration. Takes care of both installation and
      setting up the sourcing of the shell. Additionally enables nix-direnv
@@ -19,6 +26,22 @@ in {

    package = lib.mkPackageOption pkgs "direnv" {};

+    finalPackage = lib.mkOption {
+      type = lib.types.package;
+      readOnly = true;
+      description = "The wrapped direnv package.";
+    };
+
+    enableBashIntegration = enabledOption ''
+      Bash integration
+    '';
+    enableZshIntegration = enabledOption ''
+      Zsh integration
+    '';
+    enableFishIntegration = enabledOption ''
+      Fish integration
+    '';
+
    direnvrcExtra = lib.mkOption {
      type = lib.types.lines;
      default = "";
@@ -54,53 +77,76 @@ in {

      package = lib.mkPackageOption pkgs "nix-direnv" {};
    };
+
+    settings = lib.mkOption {
+      inherit (format) type;
+      default = {};
+      example = lib.literalExpression ''
+        {
+          global = {
+            log_format = "-";
+            log_filter = "^$";
+          };
+        }
+      '';
+      description = ''
+        Direnv configuration. Refer to {manpage}`direnv.toml(1)`.
+      '';
+    };
  };

  config = lib.mkIf cfg.enable {
-
    programs = {
-      zsh.interactiveShellInit = ''
+      direnv = {
+        finalPackage = pkgs.symlinkJoin {
+          inherit (cfg.package) name;
+          paths = [cfg.package];
+          # direnv has a fish library which automatically sources direnv for some reason
+          postBuild = ''
+            rm -rf "$out/share/fish"
+          '';
+          meta.mainProgram = "direnv";
+        };
+        settings = lib.mkIf cfg.silent {
+          global = {
+            log_format = lib.mkDefault "-";
+            log_filter = lib.mkDefault "^$";
+          };
+        };
+      };
+      zsh.interactiveShellInit = lib.mkIf cfg.enableZshIntegration ''
        if ${lib.boolToString cfg.loadInNixShell} || printenv PATH | grep -vqc '/nix/store'; then
-         eval "$(${lib.getExe cfg.package} hook zsh)"
+         eval "$(${lib.getExe cfg.finalPackage} hook zsh)"
        fi
      '';

      #$NIX_GCROOT for "nix develop" https://github.com/NixOS/nix/blob/6db66ebfc55769edd0c6bc70fcbd76246d4d26e0/src/nix/develop.cc#L530
      #$IN_NIX_SHELL for "nix-shell"
-      bash.interactiveShellInit = ''
+      bash.interactiveShellInit = lib.mkIf cfg.enableBashIntegration ''
        if ${lib.boolToString cfg.loadInNixShell} || [ -z "$IN_NIX_SHELL$NIX_GCROOT$(printenv PATH | grep '/nix/store')" ] ; then
-         eval "$(${lib.getExe cfg.package} hook bash)"
+         eval "$(${lib.getExe cfg.finalPackage} hook bash)"
        fi
      '';

-      fish.interactiveShellInit = ''
+      fish.interactiveShellInit = lib.mkIf cfg.enableFishIntegration ''
        if ${lib.boolToString cfg.loadInNixShell};
        or printenv PATH | grep -vqc '/nix/store';
-         ${lib.getExe cfg.package} hook fish | source
+         ${lib.getExe cfg.finalPackage} hook fish | source
        end
      '';
    };

    environment = {
-      systemPackages =
-        if cfg.loadInNixShell then [cfg.package]
-        else [
-          #direnv has a fish library which sources direnv for some reason
-          (cfg.package.overrideAttrs (old: {
-            installPhase =
-              (old.installPhase or "")
-              + ''
-                rm -rf $out/share/fish
-              '';
-          }))
-        ];
-
+      systemPackages = [
+        cfg.finalPackage
+      ];
      variables = {
        DIRENV_CONFIG = "/etc/direnv";
-        DIRENV_LOG_FORMAT = lib.mkIf cfg.silent "";
      };
-
      etc = {
+        "direnv/direnv.toml".source = lib.mkIf (cfg.settings != {}) (
+          format.generate "direnv.toml" cfg.settings
+        );
        "direnv/direnvrc".text = ''
          ${lib.optionalString cfg.nix-direnv.enable ''
            #Load nix-direnv
@@ -8,6 +8,10 @@ let

  cfg = config.programs.fish;

+  fishAbbrs = concatStringsSep "\n" (
+    mapAttrsToList (k: v: "abbr -a ${k} -- ${escapeShellArg v}") cfg.shellAbbrs
+  );
+
  fishAliases = concatStringsSep "\n" (
    mapAttrsToList (k: v: "alias ${k} ${escapeShellArg v}")
      (filterAttrs (k: v: v != null) cfg.shellAliases)
@@ -101,6 +105,18 @@ in
        '';
      };

+      shellAbbrs = mkOption {
+        default = {};
+        example = {
+          gco = "git checkout";
+          npu = "nix-prefetch-url";
+        };
+        description = ''
+          Set of fish abbreviations.
+        '';
+        type = with types; attrsOf str;
+      };
+
      shellAliases = mkOption {
        default = config.environment.shellAliases;
        description = ''
@@ -217,6 +233,7 @@ in
        # if we haven't sourced the interactive config, do it
        status --is-interactive; and not set -q __fish_nix_darwin_interactive_config_sourced
        and begin
+          ${fishAbbrs}
          ${fishAliases}

          ${sourceEnv "interactiveShellInit"}
@@ -1,8 +1,19 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:

 let
+  inherit (lib)
+    getExe'
+    mkIf
+    mkOption
+    mkPackageOption
+    optionalString
+    types
+    ;

  cfg = config.programs.gnupg;

@@ -10,6 +21,8 @@ in

 {
  options.programs.gnupg = {
+    package = mkPackageOption pkgs "gnupg" { };
+
    agent.enable = mkOption {
      type = types.bool;
      default = false;
@@ -29,9 +42,12 @@ in
  };

  config = mkIf cfg.agent.enable {
+    environment.systemPackages = [ cfg.package ];
+
    launchd.user.agents.gnupg-agent.serviceConfig = {
      ProgramArguments = [
-        "${pkgs.gnupg}/bin/gpg-connect-agent" "/bye"
+        (getExe' cfg.package "gpg-connect-agent")
+        "/bye"
      ];
      RunAtLoad = cfg.agent.enableSSHSupport;
      KeepAlive.SuccessfulExit = false;
@@ -40,12 +56,13 @@ in
    environment.extraInit = ''
      # Bind gpg-agent to this TTY if gpg commands are used.
      export GPG_TTY=$(tty)
-    '' + (optionalString cfg.agent.enableSSHSupport ''
+    ''
+    + (optionalString cfg.agent.enableSSHSupport ''
      # SSH agent protocol doesn't support changing TTYs, so bind the agent
      # to every new TTY.
-      ${pkgs.gnupg}/bin/gpg-connect-agent --quiet updatestartuptty /bye > /dev/null 2>&1
+      ${getExe' cfg.package "gpg-connect-agent"} --quiet updatestartuptty /bye > /dev/null 2>&1

-      export SSH_AUTH_SOCK=$(${pkgs.gnupg}/bin/gpgconf --list-dirs agent-ssh-socket)
+      export SSH_AUTH_SOCK=$(${getExe' cfg.package "gpgconf"} --list-dirs agent-ssh-socket)
    '');
  };
 }
@@ -0,0 +1,209 @@
+{
+  config,
+  lib,
+  options,
+  pkgs,
+  ...
+}:
+
+let
+  inherit (lib)
+    attrValues
+    concatStringsSep
+    escapeShellArg
+    getExe
+    literalExpression
+    mapAttrsToList
+    mkEnableOption
+    mkIf
+    mkOption
+    mkOptionDefault
+    mkPackageOption
+    optionalString
+    types
+    ;
+
+  cfg = config.programs.mas;
+
+  apps = mapAttrsToList (name: id: { inherit name id; }) cfg.packages;
+
+  desiredIds = map (app: toString app.id) apps;
+  homebrewIds = map toString (attrValues config.homebrew.masApps);
+
+  hasWork = cfg.update || cfg.packages != { } || cfg.cleanup || homebrewIds != [ ];
+
+  activationScript =
+    if hasWork then
+      ''
+        echo >&2 "setting up App Store apps (mas)..."
+
+        runAsUser() {
+          sudo \
+            --preserve-env=PATH \
+            --set-home \
+            --user=${escapeShellArg cfg.user} \
+            "$@"
+        }
+
+        listStatus=0
+        listOutput=$(
+          runAsUser ${getExe cfg.package} list 2>&1
+        ) || listStatus=$?
+
+        if (( listStatus != 0 )); then
+          echo >&2 "warning: mas list failed (exit ''${listStatus}):"
+          echo >&2 "''${listOutput}"
+          if echo "''${listOutput}" | grep -qi "not signed in"; then
+            echo >&2 "login required; skipping App Store installs/updates/cleanup"
+            exit 0
+          fi
+        fi
+
+        # Only emit cleanup-only shell variables when cleanup is enabled; otherwise shellcheck
+        # treats them as unused and fails the activation script build.
+        installedIds=()
+        ${if cfg.cleanup then
+          ''
+            # Parse mas list output: "ID  AppName  (version)"
+            declare -A installedApps
+            while IFS= read -r line; do
+              [[ -z "$line" ]] && continue
+              line="''${line#"''${line%%[![:space:]]*}"}"
+              id="''${line%% *}"
+              rest="''${line#"$id"}"
+              rest="''${rest#"''${rest%%[![:space:]]*}"}"
+              name="''${rest% (*}"
+              name="''${name%"''${name##*[![:space:]]}"}"
+              [[ -n "$id" ]] && {
+                installedIds+=( "$id" )
+                installedApps["$id"]="$name"
+              }
+            done <<<"$listOutput"
+          ''
+        else
+          ''
+            while IFS= read -r line; do
+              [[ -z "$line" ]] && continue
+              line="''${line#"''${line%%[![:space:]]*}"}"
+              id="''${line%% *}"
+              [[ -n "$id" ]] && installedIds+=( "$id" )
+            done <<<"$listOutput"
+          ''}
+
+        ${optionalString cfg.update ''
+          runAsUser ${getExe cfg.package} update || true
+        ''}
+
+        desiredIds=(
+          ${concatStringsSep "\n          " desiredIds}
+        )
+
+        is_installed() {
+          local needle=$1
+          for id in "''${installedIds[@]}"; do
+            if [[ "$id" == "$needle" ]]; then
+              return 0
+            fi
+          done
+          return 1
+        }
+
+        ${optionalString (cfg.packages != { }) ''
+          for appId in "''${desiredIds[@]}"; do
+            if is_installed "$appId"; then
+              continue
+            fi
+            runAsUser ${getExe cfg.package} install "$appId" || true
+          done
+        ''}
+
+        ${optionalString cfg.cleanup ''
+          homebrewIds=(
+            ${concatStringsSep "\n            " homebrewIds}
+          )
+
+          keepIds=( "''${desiredIds[@]}" "''${homebrewIds[@]}" )
+
+          for installedId in "''${installedIds[@]}"; do
+            keep=false
+            for keepId in "''${keepIds[@]}"; do
+              if [[ "$installedId" == "$keepId" ]]; then
+                keep=true
+                break
+              fi
+            done
+
+            if ! $keep; then
+              appName="''${installedApps[$installedId]:-$installedId}"
+              echo >&2 "removing $appName from App Store"
+              runAsUser ${getExe cfg.package} uninstall "$installedId" || true
+            fi
+          done
+        ''}
+      ''
+    else
+      "";
+in
+{
+  options.programs.mas = {
+    enable = mkEnableOption "managing Mac App Store apps with mas";
+
+    user = mkOption {
+      type = types.str;
+      default = config.system.primaryUser;
+      defaultText = literalExpression "config.system.primaryUser";
+      description = ''
+        The user account that runs {command}`mas`. This user must be signed into the Mac App Store
+        for installs or updates to succeed.
+      '';
+    };
+
+    package = mkPackageOption pkgs "mas" { };
+
+    packages = mkOption {
+      type = types.attrsOf types.ints.positive;
+      default = { };
+      example = literalExpression ''
+        {
+          Xcode = 497799835;
+          "1Password for Safari" = 1569813296;
+        }
+      '';
+      description = ''
+        Applications to install from the Mac App Store. Attribute names are only for readability;
+        values must be the numeric identifiers used by {command}`mas`.
+      '';
+    };
+
+    update = mkOption {
+      type = types.bool;
+      default = true;
+      description = ''
+        Whether to run {command}`mas update` during system activation in addition to installing the
+        configured apps.
+      '';
+    };
+
+    cleanup = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Whether to uninstall Mac App Store apps that are currently installed but not listed in
+        {option}`programs.mas.packages`. Apps listed in {option}`homebrew.masApps` are also preserved.
+        This runs before install/update; any app id not in either set will be removed.
+      '';
+    };
+  };
+
+  config = {
+    system.requiresPrimaryUser =
+      mkIf (cfg.enable && options.programs.mas.user.highestPrio == (mkOptionDefault { }).priority)
+        [
+          "programs.mas.enable"
+        ];
+
+    environment.systemPackages = mkIf cfg.enable [ cfg.package ];
+
+    system.activationScripts.mas.text = mkIf cfg.enable activationScript;
+  };
+}
@@ -1,14 +1,12 @@
 { config, lib, ... }:

-with lib;
-
 let
  cfg = config.programs.ssh;

-  knownHosts = map (h: getAttr h cfg.knownHosts) (attrNames cfg.knownHosts);
+  knownHosts = builtins.attrValues cfg.knownHosts;

  host =
-    { name, ... }:
+    { name, config, ... }:
    {
      options = {
        certAuthority = lib.mkOption {
@@ -19,17 +17,30 @@ let
            individual host's key.
          '';
        };
-        hostNames = mkOption {
-          type = types.listOf types.str;
-          default = [];
+        hostNames = lib.mkOption {
+          type = lib.types.listOf lib.types.str;
+          default = [ name ] ++ config.extraHostNames;
          description = ''
-            A list of host names and/or IP numbers used for accessing
-            the host's ssh service.
+            The set of system-wide known SSH hosts. To make simple setups more
+            convenient the name of an attribute in this set is used as a host name
+            for the entry. This behaviour can be disabled by setting
+            `hostNames` explicitly. You can use
+            `extraHostNames` to add additional host names without
+            disabling this default.
          '';
        };
-        publicKey = mkOption {
+        extraHostNames = lib.mkOption {
+          type = lib.types.listOf lib.types.str;
+          default = [];
+          description = ''
+            A list of additional host names and/or IP numbers used for
+            accessing the host's ssh service. This list is ignored if
+            `hostNames` is set explicitly.
+          '';
+        };
+        publicKey = lib.mkOption {
          default = null;
-          type = types.nullOr types.str;
+          type = lib.types.nullOr lib.types.str;
          example = "ecdsa-sha2-nistp521 AAAAE2VjZHN...UEPg==";
          description = ''
            The public key data for the host. You can fetch a public key
@@ -38,9 +49,9 @@ let
            the key type and the key itself.
          '';
        };
-        publicKeyFile = mkOption {
+        publicKeyFile = lib.mkOption {
          default = null;
-          type = types.nullOr types.path;
+          type = lib.types.nullOr lib.types.path;
          description = ''
            The path to the public key file for the host. The public
            key file is read at build time and saved in the Nix store.
@@ -51,16 +62,13 @@ let
          '';
        };
      };
-      config = {
-        hostNames = mkDefault [ name ];
-      };
    };
  # Taken from: https://github.com/NixOS/nixpkgs/blob/f4aa6afa5f934ece2d1eb3157e392d056be01617/nixos/modules/services/networking/ssh/sshd.nix#L46-L93
  userOptions = {

    options.openssh.authorizedKeys = {
-      keys = mkOption {
-        type = types.listOf types.str;
+      keys = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
        default = [];
        description = ''
          A list of verbatim OpenSSH public keys that should be added to the
@@ -73,8 +81,8 @@ let
        '';
      };

-      keyFiles = mkOption {
-        type = types.listOf types.path;
+      keyFiles = lib.mkOption {
+        type = lib.types.listOf lib.types.path;
        default = [];
        description = ''
          A list of files each containing one OpenSSH public key that should be
@@ -89,29 +97,29 @@ let
  };

  authKeysFiles = let
-    mkAuthKeyFile = u: nameValuePair "ssh/nix_authorized_keys.d/${u.name}" {
+    mkAuthKeyFile = u: lib.nameValuePair "ssh/nix_authorized_keys.d/${u.name}" {
      text = ''
-        ${concatStringsSep "\n" u.openssh.authorizedKeys.keys}
-        ${concatMapStrings (f: readFile f + "\n") u.openssh.authorizedKeys.keyFiles}
+        ${builtins.concatStringsSep "\n" u.openssh.authorizedKeys.keys}
+        ${lib.concatMapStrings (f: builtins.readFile f + "\n") u.openssh.authorizedKeys.keyFiles}
      '';
    };
-    usersWithKeys = attrValues (flip filterAttrs config.users.users (n: u:
-      length u.openssh.authorizedKeys.keys != 0 || length u.openssh.authorizedKeys.keyFiles != 0
+    usersWithKeys = builtins.attrValues (lib.flip lib.filterAttrs config.users.users (n: u:
+      lib.length u.openssh.authorizedKeys.keys != 0 || lib.length u.openssh.authorizedKeys.keyFiles != 0
    ));
-  in listToAttrs (map mkAuthKeyFile usersWithKeys);
+  in lib.listToAttrs (map mkAuthKeyFile usersWithKeys);

  oldAuthorizedKeysHash = "5a5dc1e20e8abc162ad1cc0259bfd1dbb77981013d87625f97d9bd215175fc0a";
 in

 {
  imports = [
-    (mkRemovedOptionModule [ "services" "openssh" "authorizedKeysFiles" ] "No `nix-darwin` equivalent to this NixOS option.")
+    (lib.mkRemovedOptionModule [ "services" "openssh" "authorizedKeysFiles" ] "No `nix-darwin` equivalent to this NixOS option.")
  ];

  options = {

-    users.users = mkOption {
-      type = with types; attrsOf (submodule userOptions);
+    users.users = lib.mkOption {
+      type = with lib.types; attrsOf (submodule userOptions);
    };

    programs.ssh.extraConfig = lib.mkOption {
@@ -123,41 +131,47 @@ in
      '';
    };

-    programs.ssh.knownHosts = mkOption {
+    programs.ssh.knownHosts = lib.mkOption {
      default = {};
-      type = types.attrsOf (types.submodule host);
+      type = lib.types.attrsOf (lib.types.submodule host);
      description = ''
-        The set of system-wide known SSH hosts.
+        The set of system-wide known SSH hosts. To make simple setups more
+        convenient the name of an attribute in this set is used as a host name
+        for the entry. This behaviour can be disabled by setting
+        `hostNames` explicitly. You can use
+        `extraHostNames` to add additional host names without
+        disabling this default.
      '';
-      example = literalExpression ''
-        [
-          {
-            hostNames = [ "myhost" "myhost.mydomain.com" "10.10.1.4" ];
+      example = lib.literalExpression ''
+        {
+          myhost = {
+            extraHostNames = [ "myhost.mydomain.com" "10.10.1.4" ];
            publicKeyFile = ./pubkeys/myhost_ssh_host_dsa_key.pub;
-          }
-          {
-            hostNames = [ "myhost2" ];
+          };
+          "myhost2.net".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILIRuJ8p1Fi+m6WkHV0KWnRfpM1WxoW8XAS+XvsSKsTK";
+          "myhost2.net/dsa" = {
+            hostNames = [ "myhost2.net" ];
            publicKeyFile = ./pubkeys/myhost2_ssh_host_dsa_key.pub;
-          }
-        ]
+          };
+        }
      '';
    };
  };

  config = {

-    assertions = flip mapAttrsToList cfg.knownHosts (name: data: {
+    assertions = lib.flip lib.mapAttrsToList cfg.knownHosts (name: data: {
      assertion = (data.publicKey == null && data.publicKeyFile != null) ||
                  (data.publicKey != null && data.publicKeyFile == null);
      message = "knownHost ${name} must contain either a publicKey or publicKeyFile";
    });

    environment.etc = authKeysFiles //
-      { "ssh/ssh_known_hosts" = mkIf (builtins.length knownHosts > 0) {
-          text = (flip (concatMapStringsSep "\n") knownHosts
+      { "ssh/ssh_known_hosts" = lib.mkIf (builtins.length knownHosts > 0) {
+          text = (lib.flip (lib.concatMapStringsSep "\n") knownHosts
            (h: assert h.hostNames != [];
-              lib.optionalString h.certAuthority "@cert-authority " + concatStringsSep "," h.hostNames + " "
-              + (if h.publicKey != null then h.publicKey else readFile h.publicKeyFile)
+              lib.optionalString h.certAuthority "@cert-authority " + builtins.concatStringsSep "," h.hostNames + " "
+              + (if h.publicKey != null then h.publicKey else builtins.readFile h.publicKeyFile)
            )) + "\n";
        };
        "ssh/ssh_config.d/100-nix-darwin.conf".text = config.programs.ssh.extraConfig;
@@ -57,6 +57,17 @@ in
      description = "Enable sensible configuration options for tmux.";
    };

+    programs.tmux.reverseSplitBindings = mkOption {
+      type = types.bool;
+      default = config.system.stateVersion <= 6 && cfg.enableSensible;
+      defaultText = literalExpression "config.system.stateVersion <= 6 && config.programs.tmux.enableSensible";
+      example = true;
+      description = ''
+        Whether to reverse the `%` and `"` split-window key bindings
+        emitted by the tmux module.
+      '';
+    };
+
    programs.tmux.enableMouse = mkOption {
      type = types.bool;
      default = false;
@@ -127,8 +138,6 @@ in
      set -s escape-time 0

      bind c new-window -c '#{pane_current_path}'
-      bind % split-window -v -c '#{pane_current_path}'
-      bind '"' split-window -h -c '#{pane_current_path}'

      # TODO: make these interactive
      bind C new-session
@@ -138,6 +147,11 @@ in
      # set -g utf8 on
    '';

+    programs.tmux.tmuxOptions.splitBindings.text = mkIf cfg.reverseSplitBindings ''
+      bind % split-window -v -c '#{pane_current_path}'
+      bind '"' split-window -h -c '#{pane_current_path}'
+    '';
+
    programs.tmux.tmuxOptions.mouse.text = mkIf cfg.enableMouse ''
      set -g mouse on
      setw -g mouse on
@@ -77,7 +77,7 @@ in
  config = mkIf cfg.enable {

    environment.systemPackages =
-      [ # Include vim_configurable package.
+      [ # Include vim-full package.
        cfg.package
      ];

@@ -92,7 +92,7 @@ in
      endif
    '';

-    programs.vim.package = pkgs.vim_configurable.customize {
+    programs.vim.package = pkgs.vim-full.customize {
      name = "vim";
      vimrcConfig.customRC = config.environment.etc."vimrc".text;
      vimrcConfig.vam = {
@@ -59,6 +59,18 @@ in
      description = "Shell script code used to initialise the zsh prompt.";
    };

+    programs.zsh.histSize = mkOption {
+      type = types.int;
+      default = 2000;
+      description = "Change history size.";
+    };
+
+    programs.zsh.histFile = mkOption {
+      type = types.str;
+      default = "$HOME/.zsh_history";
+      description = "Change history file.";
+    };
+
    programs.zsh.enableCompletion = mkOption {
      type = types.bool;
      default = true;
@@ -102,6 +114,12 @@ in
      description = "Enable fzf keybinding for Ctrl-r history search.";
    };

+    programs.zsh.enableAutosuggestions = mkOption {
+      type = types.bool;
+      default = false;
+      description = "Enable zsh-autosuggestions.";
+    };
+
    programs.zsh.enableSyntaxHighlighting = mkOption {
      type = types.bool;
      default = false;
@@ -123,6 +141,7 @@ in
      [ # Include zsh package
        pkgs.zsh
      ] ++ optional cfg.enableCompletion pkgs.nix-zsh-completions
+        ++ optional cfg.enableAutosuggestions pkgs.zsh-autosuggestions
        ++ optional cfg.enableSyntaxHighlighting pkgs.zsh-syntax-highlighting
        ++ optional cfg.enableFastSyntaxHighlighting pkgs.zsh-fast-syntax-highlighting;

@@ -182,10 +201,11 @@ in
      if [ -n "$__ETC_ZSHRC_SOURCED" -o -n "$NOSYSZSHRC" ]; then return; fi
      __ETC_ZSHRC_SOURCED=1

-      # history defaults
-      SAVEHIST=2000
-      HISTSIZE=2000
-      HISTFILE=$HOME/.zsh_history
+      # Setup command line history.
+      # Don't export these, otherwise other shells (bash) will try to use same HISTFILE.
+      SAVEHIST=${builtins.toString cfg.histSize}
+      HISTSIZE=${builtins.toString cfg.histSize}
+      HISTFILE=${cfg.histFile}

      setopt HIST_IGNORE_DUPS SHARE_HISTORY HIST_FCNTL_LOCK

@@ -199,12 +219,16 @@ in
      ${optionalString cfg.enableGlobalCompInit "autoload -U compinit && compinit"}
      ${optionalString cfg.enableBashCompletion "autoload -U bashcompinit && bashcompinit"}

+      ${optionalString cfg.enableAutosuggestions
+        "source ${pkgs.zsh-autosuggestions}/share/zsh-autosuggestions/zsh-autosuggestions.zsh"
+      }
+
      ${optionalString cfg.enableSyntaxHighlighting
        "source ${pkgs.zsh-syntax-highlighting}/share/zsh-syntax-highlighting/zsh-syntax-highlighting.zsh"
      }

      ${optionalString cfg.enableFastSyntaxHighlighting
-        "source ${pkgs.zsh-fast-syntax-highlighting}/share/zsh/site-functions/fast-syntax-highlighting.plugin.zsh"
+        "source ${pkgs.zsh-fast-syntax-highlighting}/share/zsh/plugins/fast-syntax-highlighting/fast-syntax-highlighting.plugin.zsh"
      }

      ${optionalString cfg.enableFzfCompletion "source ${fzfCompletion}"}
@@ -220,18 +244,23 @@ in
    environment.etc."zprofile".knownSha256Hashes = [
      "db8422f92d8cff684e418f2dcffbb98c10fe544b5e8cd588b2009c7fa89559c5"
      "0235d3c1b6cf21e7043fbc98e239ee4bc648048aafaf6be1a94a576300584ef2"  # macOS
+      "f320016e2cf13573731fbee34f9fe97ba867dd2a31f24893d3120154e9306e92"  # macOS 26b1 and higher
    ];

    environment.etc."zshrc".knownSha256Hashes = [
      "19a2d673ffd47b8bed71c5218ff6617dfc5e8533b240b9ba79142a45f8823c23"
      "fb5827cb4712b7e7932d438067ec4852c8955a9ff0f55e282473684623ebdfa1"  # macOS
+      "4d1ab5704f9d167a042fecac0d056c8a79a8ebd71e032d3489536c8db9ffe3e0"  # macOS 26b1 and higher
      "c5a00c072c920f46216454978c44df044b2ec6d03409dc492c7bdcd92c94a110"  # official Nix installer
      "40b0d8751adae5b0100a4f863be5b75613a49f62706427e92604f7e04d2e2261"  # official Nix installer
+      "bf76c5ed8e65e616f4329eccf662ee91be33b8bfd33713ce9946f2fe94fea7fa"  # official Nix installer (macOS 26b1 and higher)
      "2af1b563e389d11b76a651b446e858116d7a20370d9120a7e9f78991f3e5f336"  # DeterminateSystems installer
+      "27274e44b88a1174787f9a3d437d3387edc4f9aaaf40356054130797f5dc7912"  # DeterminateSystems installer (macOS 26b1 and higher)
    ];

    environment.etc."zshenv".knownSha256Hashes = [
      "d07015be6875f134976fce84c6c7a77b512079c1c5f9594dfa65c70b7968b65f"  # DeterminateSystems installer
+      "4e8f7cb9b699511f4ba5f9d5f8de1c9f5efb5c607de88faf5f58b8b9cb38edbf"  # experimental official Nix installer 2.33.3
    ];

  };
@@ -199,6 +199,7 @@ in
              type = enum [
                "qwerty"
                "dvorak"
+                "colemak"
              ];
              default = "qwerty";
              description = "Keymapping preset.";
@@ -78,7 +78,7 @@ in
  config = mkIf (cfg.sessions != []) {

    launchd.daemons =
-      lib.fold ( s : acc : acc //
+      lib.foldr ( s : acc : acc //
        {
          "autossh-${s.name}" =
            let
@@ -42,18 +42,42 @@ in
        { localhost = "127.0.0.1"; }
        '';
    };
+
+    services.dnsmasq.servers = mkOption {
+      type = types.listOf types.str;
+      default = [];
+      description = ''
+        List of upstream DNS servers to forward queries to.
+        If empty, dnsmasq will use the servers from /etc/resolv.conf.
+        Each entry can be:
+        - An IP address (e.g., "1.2.3.4")
+        - A domain-specific server (e.g., "/example.com/1.2.3.4")
+        - A server with port (e.g., "1.2.3.4#5353")
+        See dnsmasq(8) man page for --server option for full syntax.
+      '';
+      example = literalExpression ''
+        [
+          "8.8.8.8"
+          "8.8.4.4"
+          "/internal.example.com/192.168.1.1"
+        ]
+      '';
+    };
  };

  config = mkIf cfg.enable {
    environment.systemPackages = [ cfg.package ];

    launchd.daemons.dnsmasq = {
-      serviceConfig.ProgramArguments = [
-        "${cfg.package}/bin/dnsmasq"
-        "--listen-address=${cfg.bind}"
-        "--port=${toString cfg.port}"
-        "--keep-in-foreground"
-      ] ++ (mapA (domain: addr: "--address=/${domain}/${addr}") cfg.addresses);
+      command = let
+        args = [
+          "--listen-address=${cfg.bind}"
+          "--port=${toString cfg.port}"
+          "--keep-in-foreground"
+        ] ++ (mapA (domain: addr: "--address=/${domain}/${addr}") cfg.addresses)
+          ++ (map (server: "--server=${server}") cfg.servers);
+      in
+        "${cfg.package}/bin/dnsmasq ${concatStringsSep " " args}";

      serviceConfig.KeepAlive = true;
      serviceConfig.RunAtLoad = true;
@@ -262,8 +262,8 @@ in
        };

        nodeRuntimes = mkOption {
-          type = with types; nonEmptyListOf (enum [ "node20" ]);
-          default = [ "node20" ];
+          type = with types; nonEmptyListOf (enum [ "node20" "node24" ]);
+          default = [ "node24" ];
          description = ''
            List of Node.js runtimes the runner should support.
          '';
@@ -2,13 +2,13 @@

 let
  inherit (lib) any attrValues boolToString concatStringsSep escapeShellArg
-    flatten flip getExe getExe' hasAttr hasPrefix mapAttrsToList mapAttrs' mkBefore
-    mkDefault mkIf mkMerge nameValuePair optionalAttrs optionalString replaceStrings;
+    flatten flip getExe getExe' hasPrefix mapAttrsToList mapAttrs' mkBefore
+    mkDefault mkIf mkMerge nameValuePair optionalString replaceStrings;

  mkSvcName = name: "github-runner-${name}";
  mkStateDir = cfg: "/var/lib/github-runners/${cfg.name}";
  mkLogDir = cfg: "/var/log/github-runners/${cfg.name}";
-  mkWorkDir = cfg: if (cfg.workDir != null) then cfg.workDir else "/var/lib/github-runners/_work/${cfg.name}";
+  mkWorkDir = cfg: if (cfg.workDir != null) then cfg.workDir else "/private/var/lib/github-runners/_work/${cfg.name}";
 in
 {
  config.assertions = flatten (
@@ -27,7 +27,7 @@ in
        message = "`services.github-runners.${name}`: The `extraLabels` option is mandatory if `noDefaultLabels` is set";
      }
      {
-        assertion = cfg.workDir == null || !(hasPrefix "/run/" cfg.workDir || hasPrefix "/var/run/" cfg.workDir || hasPrefix "/private/var/run/");
+        assertion = cfg.workDir == null || !(hasPrefix "/run/" cfg.workDir || hasPrefix "/var/run/" cfg.workDir || hasPrefix "/private/var/run/" cfg.workDir);
        message = "`services.github-runners.${name}`: `workDir` being inside /run is not supported";
      }
    ])
@@ -54,7 +54,7 @@ in
    in
    {
      launchd = mkIf cfg.enable {
-        text = mkBefore (''
+        text = mkBefore ''
          echo >&2 "setting up GitHub Runner '${cfg.name}'..."

          # shellcheck disable=SC2174
@@ -70,13 +70,13 @@ in
            ${getExe' pkgs.coreutils "mkdir"} -p -m u=rwx,g=rx,o= ${escapeShellArg (mkWorkDir cfg)}
            ${getExe' pkgs.coreutils "chown"} ${user}:${group} ${escapeShellArg (mkWorkDir cfg)}
          ''}
-        '');
+        '';
      };
    }));

  config.launchd.daemons = flip mapAttrs' config.services.github-runners (name: cfg:
    let
-      package = cfg.package.override (old: optionalAttrs (hasAttr "nodeRuntimes" old) { inherit (cfg) nodeRuntimes; });
+      package = cfg.package.override { inherit (cfg) nodeRuntimes; };
      stateDir = mkStateDir cfg;
      logDir = mkLogDir cfg;
      workDir = mkWorkDir cfg;
@@ -22,7 +22,7 @@ in {
  ];

  options.services.jankyborders = {
-    enable = mkEnableOption "Enable the jankyborders service.";
+    enable = mkEnableOption "the jankyborders service.";

    package = mkPackageOption pkgs "jankyborders" {};

@@ -102,7 +102,7 @@ in
    launchd.user.agents.karabiner_session_monitor = {
      serviceConfig.ProgramArguments = [
        "/bin/sh" "-c"
-        "/bin/wait4path /run/wrappers/bin &amp;&amp; /run/wrappers/bin/karabiner_session_monitor"
+        "/bin/wait4path /run/wrappers/bin && /run/wrappers/bin/karabiner_session_monitor"
      ];
      serviceConfig.Label = "org.pqrs.karabiner.karabiner_session_monitor";
      serviceConfig.KeepAlive = true;
@@ -33,7 +33,7 @@ in
    services.khd.i3Keybindings = mkOption {
      type = types.bool;
      default = false;
-      description = "Wether to configure i3 style keybindings for kwm.";
+      description = "Whether to configure i3 style keybindings for kwm.";
    };
  };

@@ -7,8 +7,8 @@

 let
  inherit (lib)
+    escapeShellArg
    concatStringsSep
-    escapeShellArgs
    getExe
    mkEnableOption
    mkIf
@@ -104,7 +104,8 @@ in {
        ]
        ++ (map (collector: "--collector.${collector}") cfg.enabledCollectors)
        ++ (map (collector: "--no-collector.${collector}") cfg.disabledCollectors)
-      ) + escapeShellArgs cfg.extraFlags;
+        ++ (map escapeShellArg cfg.extraFlags)
+      );
      serviceConfig = let
        logPath = config.users.users._prometheus-node-exporter.home
          + "/prometheus-node-exporter.log";
@@ -66,6 +66,9 @@ in {
        KeepAlive = true;
        RunAtLoad = true;
      };
+
+      # https://github.com/influxdata/telegraf/issues/17607
+      environment.HOME = "/var/root";
    };
  };
 }
@@ -1,18 +1,110 @@
-{ config, lib, ... }:
+{ config, lib, pkgs, ... }:

 let
  cfg = config.services.openssh;
+
+  hostKeyOpts = {
+    options = {
+      type = lib.mkOption {
+        type = lib.types.enum [ "dsa" "ecdsa" "ed25519" "rsa" ];
+        description = ''
+          Key type passed to `ssh-keygen -t`.
+        '';
+      };
+
+      path = lib.mkOption {
+        type = lib.types.str;
+        description = ''
+          Path to the private key file.
+        '';
+      };
+
+      bits = lib.mkOption {
+        type = lib.types.nullOr lib.types.int;
+        default = null;
+        description = ''
+          Key size in bits. If `null`, `ssh-keygen` uses the default
+          for the given key type (RSA=3072, ECDSA=256, ED25519=fixed).
+        '';
+      };
+
+      comment = lib.mkOption {
+        type = lib.types.str;
+        default = "";
+        description = ''
+          Comment for the key, passed to `ssh-keygen -C`.
+
+          Defaults to an empty string to match Apple's built-in host key
+          generation and avoid leaking the hostname.
+        '';
+      };
+    };
+  };
+
+  hostKeysConfig = lib.concatMapStringsSep "\n"
+    (k: "HostKey ${k.path}")
+    cfg.hostKeys;
+
+  keygenScript = lib.concatMapStrings (k:
+    let
+      escapedPath = lib.escapeShellArg k.path;
+    in ''
+      if ! [[ -s ${escapedPath} ]]; then
+        if ! [[ -L ${escapedPath} ]]; then
+          rm -f ${escapedPath}
+        fi
+
+        keygenArgs=(
+          -t ${lib.escapeShellArg k.type}
+          ${lib.optionalString (k.bits != null) "-b ${toString k.bits}"}
+          -C ${lib.escapeShellArg k.comment}
+          -f ${escapedPath}
+          -N ""
+        )
+
+        mkdir -p "$(dirname ${escapedPath})"
+        chmod 0755 "$(dirname ${escapedPath})"
+        ${lib.getExe' pkgs.openssh "ssh-keygen"} "''${keygenArgs[@]}"
+      fi
+    '') cfg.hostKeys;
 in
 {
  options = {
-    services.openssh.enable = lib.mkOption {
-      type = lib.types.nullOr lib.types.bool;
-      default = null;
-      description = ''
-        Whether to enable Apple's built-in OpenSSH server.
+    services.openssh = {
+      enable = lib.mkOption {
+        type = lib.types.nullOr lib.types.bool;
+        default = null;
+        description = ''
+          Whether to enable Apple's built-in OpenSSH server.

-        The default is null which means let macOS manage the OpenSSH server.
-      '';
+          The default is null which means let macOS manage the OpenSSH server.
+        '';
+      };
+
+      extraConfig = lib.mkOption {
+        type = lib.types.lines;
+        default = "";
+        description = ''
+          Extra configuration text loaded in {file}`sshd_config`.
+          See {manpage}`sshd_config(5)` for help.
+        '';
+      };
+
+      hostKeys = lib.mkOption {
+        type = lib.types.listOf (lib.types.submodule hostKeyOpts);
+        default = [
+          { type = "rsa"; path = "/etc/ssh/ssh_host_rsa_key"; }
+          { type = "ecdsa"; path = "/etc/ssh/ssh_host_ecdsa_key"; }
+          { type = "ed25519"; path = "/etc/ssh/ssh_host_ed25519_key"; }
+        ];
+        description = ''
+          SSH host key declarations. Each entry specifies a key type and path.
+          `HostKey` directives are written to the sshd configuration for each
+          entry.
+
+          The default matches the keys that macOS automatically generates.
+        '';
+      };
    };
  };

@@ -29,5 +121,13 @@ in
        launchctl disable system/com.openssh.sshd
      fi
    '');
+
+    environment.etc."ssh/sshd_config.d/099-host-keys.conf" = lib.mkIf (cfg.hostKeys != []) {
+      text = hostKeysConfig;
+    };
+
+    environment.etc."ssh/sshd_config.d/100-nix-darwin.conf".text = cfg.extraConfig;
+
+    system.activationScripts.openssh.text = lib.mkIf (cfg.hostKeys != []) keygenScript;
  };
 }
@@ -22,11 +22,12 @@ in
    services.spacebar.enable = mkOption {
      type = bool;
      default = false;
-      description = "Whether to enable the spacebar spacebar.";
+      description = "Whether to enable the spacebar.";
    };

    services.spacebar.package = mkOption {
      type = path;
+      default = pkgs.spacebar;
      description = "The spacebar package to use.";
    };

@@ -83,7 +83,7 @@ let
      preDown = mkOption {
        type = with types; coercedTo (listOf str) (concatStringsSep "\n") lines;
        default = "";
-        description = "List of commadns to run before interface shutdown.";
+        description = "List of commands to run before interface shutdown.";
      };

      preUp = mkOption {
@@ -121,6 +121,7 @@ in
      ${cfg.activationScripts.applications.text}
      ${cfg.activationScripts.pam.text}
      ${cfg.activationScripts.patches.text}
+      ${cfg.activationScripts.openssh.text}
      ${cfg.activationScripts.etc.text}
      ${cfg.activationScripts.defaults.text}
      ${cfg.activationScripts.userDefaults.text}
@@ -133,6 +134,7 @@ in
      ${cfg.activationScripts.keyboard.text}
      ${cfg.activationScripts.fonts.text}
      ${cfg.activationScripts.nvram.text}
+      ${cfg.activationScripts.mas.text}
      ${cfg.activationScripts.homebrew.text}

      ${cfg.activationScripts.postActivation.text}
@@ -1,23 +1,65 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
-
-let
-
-  cfg = config.system;
-
-in
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:

 {
-  options = {
-  };
-
  config = {
+    system.checks.text = lib.mkAfter ''
+      ensureAppManagement() {
+        for appBundle in /Applications/Nix\ Apps/*.app; do
+          if [[ -d "$appBundle" ]]; then
+            if ! touch "$appBundle/.DS_Store" &> /dev/null; then
+              return 1
+            fi
+          fi
+        done
+
+        return 0
+      }
+
+      if ! ensureAppManagement; then
+        if [[ "$(launchctl managername)" != Aqua ]]; then
+          # It is possible to grant the App Management permission to `sshd-keygen-wrapper`, however
+          # there are many pitfalls like requiring the primary user to grant the permission and to
+          # be logged in when `darwin-rebuild` is run over SSH and it will still fail sometimes...
+          printf >&2 '\e[1;31merror: permission denied when trying to update apps over SSH, aborting activation\e[0m\n'
+          printf >&2 'Apps could not be updated as `darwin-rebuild` requires Full Disk Access to work over SSH.\n'
+          printf >&2 'You can either:\n'
+          printf >&2 '\n'
+          printf >&2 '  grant Full Disk Access to all programs run over SSH\n'
+          printf >&2 '\n'
+          printf >&2 'or\n'
+          printf >&2 '\n'
+          printf >&2 '  run `darwin-rebuild` in a graphical session.\n'
+          printf >&2 '\n'
+          printf >&2 'The option "Allow full disk access for remote users" can be found by\n'
+          printf >&2 'navigating to System Settings > General > Sharing > Remote Login\n'
+          printf >&2 'and then pressing on the i icon next to the switch.\n'
+          exit 1
+        else
+          # The TCC service required to modify notarised app bundles is `kTCCServiceSystemPolicyAppBundles`
+          # and we can reset it to ensure the user gets another prompt
+          tccutil reset SystemPolicyAppBundles > /dev/null
+
+          if ! ensureAppManagement; then
+            printf >&2 '\e[1;31merror: permission denied when trying to update apps, aborting activation\e[0m\n'
+            printf >&2 '`darwin-rebuild` requires permission to update your apps, please accept the notification\n'
+            printf >&2 'and grant the permission for your terminal emulator in System Settings.\n'
+            printf >&2 '\n'
+            printf >&2 'If you did not get a notification, you can navigate to System Settings > Privacy & Security > App Management.\n'
+            exit 1
+          fi
+        fi
+      fi
+    '';

    system.build.applications = pkgs.buildEnv {
      name = "system-applications";
      paths = config.environment.systemPackages;
-      pathsToLink = "/Applications";
+      pathsToLink = [ "/Applications" ];
    };

    system.activationScripts.applications.text = ''
@@ -40,13 +82,33 @@ in
        fi
      ''}

-      if [ ! -e '/Applications/Nix Apps' ] \
-         || ourLink '/Applications/Nix Apps'; then
-        ln -sfn ${cfg.build.applications}/Applications '/Applications/Nix Apps'
-      else
-        echo "warning: /Applications/Nix Apps is not owned by nix-darwin, skipping App linking..." >&2
-      fi
-    '';
+      targetFolder='/Applications/Nix Apps'

+      # Clean up old style symlink to nix store
+      if [ -e "$targetFolder" ] && ourLink "$targetFolder"; then
+        rm "$targetFolder"
+      fi
+
+      mkdir -p "$targetFolder"
+
+      rsyncFlags=(
+        # mtime is standardized in the nix store, which would leave only file size to distinguish files.
+        # Thus we need checksums, despite the speed penalty.
+        --checksum
+        # Converts all symlinks pointing outside of the copied tree (thus unsafe) into real files and directories.
+        # This neatly converts all the symlinks pointing to application bundles in the nix store into
+        # real directories, without breaking any relative symlinks inside of application bundles.
+        # This is good enough, because the make-symlinks-relative.sh setup hook converts all $out internal
+        # symlinks to relative ones.
+        --copy-unsafe-links
+        --archive
+        --delete
+        --chmod=-w
+        --no-group
+        --no-owner
+      )
+
+      ${lib.getExe pkgs.rsync} "''${rsyncFlags[@]}" ${config.system.build.applications}/Applications/ "$targetFolder"
+    '';
  };
 }
@@ -173,7 +173,7 @@ let
      printf >&2 'Make sure that %s exists,\n' \
        ${escapeDoubleQuote (
          if config.environment.darwinConfig == null then
-            "the \\`<darwin-config>\\` entry in `nix.nixPath`"
+            "the \\`<darwin-config>\\` entry in \\`nix.nixPath\\`"
          else
            "\\`${config.environment.darwinConfig}\\`"
        )}
@@ -252,7 +252,7 @@ let
  '';

  homebrewInstalled = ''
-    if [[ ! -f ${escapeShellArg config.homebrew.brewPrefix}/brew && -z "''${INSTALLING_HOMEBREW:-}" ]]; then
+    if [[ ! -f ${escapeShellArg config.homebrew.prefix}/bin/brew && -z "''${INSTALLING_HOMEBREW:-}" ]]; then
        echo "[1;31merror: Using the homebrew module requires homebrew installed, aborting activation[0m" >&2
        echo "Homebrew doesn't seem to be installed. Please install homebrew separately." >&2
        echo "You can install homebrew using the following command:" >&2
@@ -11,7 +11,7 @@ let
  failedAssertions = map (x: x.message) (filter (x: !x.assertion) config.assertions);

  throwAssertions = res: if (failedAssertions != []) then throw "\nFailed assertions:\n${concatStringsSep "\n" (map (x: "- ${x}") failedAssertions)}" else res;
-  showWarnings = res: fold (w: x: builtins.trace "[1;31mwarning: ${w}[0m" x) res config.warnings;
+  showWarnings = res: foldr (w: x: builtins.trace "[1;31mwarning: ${w}[0m" x) res config.warnings;

 in

@@ -20,21 +20,13 @@ in

    system.build = mkOption {
      internal = true;
-      type = types.attrsOf types.unspecified;
+      type = types.lazyAttrsOf types.unspecified;
      default = {};
      description = ''
        Attribute set of derivation used to setup the system.
      '';
    };

-    system.path = mkOption {
-      internal = true;
-      type = types.package;
-      description = ''
-        The packages you want in the system environment.
-      '';
-    };
-
    system.profile = mkOption {
      type = types.path;
      default = "/nix/var/nix/profiles/system";
@@ -6,7 +6,7 @@ let
  cfg = config.system.defaults;

  writeDefault = domain: key: value:
-    "defaults write ${domain} '${key}' $'${strings.escape [ "'" ] (generators.toPlist { } value)}'";
+    "defaults write ${domain} ${escapeShellArg key} ${escapeShellArg (generators.toPlist { escape = true; } value)}";

  defaultsToList = domain: attrs: mapAttrsToList (writeDefault domain) (filterAttrs (n: v: v != null) attrs);
  userDefaultsToList = domain: attrs: let
@@ -20,7 +20,6 @@ let
  dockFiltered = (builtins.removeAttrs cfg.dock ["expose-group-by-app"]);

  # defaults
-  alf = defaultsToList "/Library/Preferences/com.apple.alf" cfg.alf;
  loginwindow = defaultsToList "/Library/Preferences/com.apple.loginwindow" cfg.loginwindow;
  smb = defaultsToList "/Library/Preferences/SystemConfiguration/com.apple.smb.server" cfg.smb;
  SoftwareUpdate = defaultsToList "/Library/Preferences/com.apple.SoftwareUpdate" cfg.SoftwareUpdate;
@@ -89,7 +88,6 @@ in
      ];

    system.activationScripts.defaults.text = mkIfLists [
-      alf
      loginwindow
      smb
      SoftwareUpdate
@@ -98,7 +96,6 @@ in
      ''
        # Set defaults
        echo >&2 "system defaults..."
-        ${concatStringsSep "\n" alf}
        ${concatStringsSep "\n" loginwindow}
        ${concatStringsSep "\n" smb}
        ${concatStringsSep "\n" SoftwareUpdate}
@@ -52,6 +52,19 @@ in {
      '';
    };

+    system.defaults.NSGlobalDomain.AppleIconAppearanceTheme = mkOption {
+      type = types.nullOr (types.enum [ "RegularDark" "RegularAutomatic" "ClearLight" "ClearDark" "ClearAutomatic" "TintedLight" "TintedDark" "TintedAutomatic" ]);
+      default = null;
+      description = ''
+        Set icon and widget style
+
+        To set to default mode, set this to `null` and you'll need to manually run
+        {command}`defaults delete -g AppleIconAppearanceTheme`.
+
+        This option requires logging out and logging back in to apply.
+      '';
+    };
+
    system.defaults.NSGlobalDomain.AppleInterfaceStyleSwitchesAutomatically = mkOption {
      type = types.nullOr types.bool;
      default = null;
@@ -61,10 +74,14 @@ in {
    };

    system.defaults.NSGlobalDomain.AppleKeyboardUIMode = mkOption {
-      type = types.nullOr (types.enum [ 3 ]);
+      type = types.nullOr (types.enum [ 0 2 3 ]);
      default = null;
      description = ''
-        Configures the keyboard control behavior.  Mode 3 enables full keyboard control.
+        Configures the keyboard control behavior. The default is 0.
+
+        0 = Disabled
+        2 = Enabled on Sonoma or later
+        3 = Enabled on older macOS versions
      '';
    };

@@ -72,7 +89,7 @@ in {
      type = types.nullOr types.bool;
      default = null;
      description = ''
-        Whether to enable the press-and-hold feature.  The default is true.
+        Whether to enable the press-and-hold feature. The default is true.
      '';
    };

@@ -112,7 +129,7 @@ in {
      type = types.nullOr types.bool;
      default = null;
      description = ''
-        Whether to enable automatic capitalization.  The default is true.
+        Whether to enable automatic capitalization. The default is true.
      '';
    };

@@ -120,7 +137,7 @@ in {
      type = types.nullOr types.bool;
      default = null;
      description = ''
-        Whether to enable inline predictive text.  The default is true.
+        Whether to enable inline predictive text. The default is true.
      '';
    };

@@ -128,7 +145,7 @@ in {
      type = types.nullOr types.bool;
      default = null;
      description = ''
-        Whether to enable smart dash substitution.  The default is true.
+        Whether to enable smart dash substitution. The default is true.
      '';
    };

@@ -136,7 +153,7 @@ in {
      type = types.nullOr types.bool;
      default = null;
      description = ''
-        Whether to enable smart period substitution.  The default is true.
+        Whether to enable smart period substitution. The default is true.
      '';
    };

@@ -144,7 +161,7 @@ in {
      type = types.nullOr types.bool;
      default = null;
      description = ''
-        Whether to enable smart quote substitution.  The default is true.
+        Whether to enable smart quote substitution. The default is true.
      '';
    };

@@ -152,7 +169,7 @@ in {
      type = types.nullOr types.bool;
      default = null;
      description = ''
-        Whether to enable automatic spelling correction.  The default is true.
+        Whether to enable automatic spelling correction. The default is true.
      '';
    };

@@ -160,7 +177,7 @@ in {
      type = types.nullOr types.bool;
      default = null;
      description = ''
-        Whether to animate opening and closing of windows and popovers.  The default is true.
+        Whether to animate opening and closing of windows and popovers. The default is true.
      '';
    };

@@ -176,7 +193,7 @@ in {
      type = types.nullOr types.bool;
      default = null;
      description = ''
-        Whether to save new documents to iCloud by default.  The default is true.
+        Whether to save new documents to iCloud by default. The default is true.
      '';
    };

@@ -184,7 +201,7 @@ in {
      type = types.nullOr (types.enum [ "manual" "always" "fullscreen" ]);
      default = null;
      description = ''
-        Sets the window tabbing when opening a new document: 'manual', 'always', or 'fullscreen'.  The default is 'fullscreen'.
+        Sets the window tabbing when opening a new document: 'manual', 'always', or 'fullscreen'. The default is 'fullscreen'.
      '';
    };

@@ -192,7 +209,7 @@ in {
      type = types.nullOr types.bool;
      default = null;
      description = ''
-        Whether to use expanded save panel by default.  The default is false.
+        Whether to use expanded save panel by default. The default is false.
      '';
    };

@@ -200,7 +217,7 @@ in {
      type = types.nullOr types.bool;
      default = null;
      description = ''
-        Whether to use expanded save panel by default.  The default is false.
+        Whether to use expanded save panel by default. The default is false.
      '';
    };

@@ -253,6 +270,24 @@ in {
      '';
    };

+    system.defaults.NSGlobalDomain.NSStatusItemSpacing = mkOption {
+      type = types.nullOr types.int;
+      default = null;
+      example = 12;
+      description = ''
+        Sets the spacing between status icons in the menu bar.
+      '';
+    };
+
+    system.defaults.NSGlobalDomain.NSStatusItemSelectionPadding = mkOption {
+      type = types.nullOr types.int;
+      default = null;
+      example = 6;
+      description = ''
+        Sets the padding around status icons in the menu bar.
+      '';
+    };
+
    system.defaults.NSGlobalDomain.InitialKeyRepeat = mkOption {
      type = types.nullOr types.int;
      default = null;
@@ -307,7 +342,7 @@ in {
      type = types.nullOr (types.enum [ 1 ]);
      default = null;
      description = ''
-        Configures the trackpad tap behavior.  Mode 1 enables tap to click.
+        Configures the trackpad tap behavior. Mode 1 enables tap to click.
      '';
    };

@@ -342,7 +377,7 @@ in {
      type = types.nullOr types.bool;
      default = null;
      description = ''
-        Whether to enable trackpad secondary click.  The default is true.
+        Whether to enable trackpad secondary click. The default is true.
      '';
    };

@@ -350,7 +385,7 @@ in {
      type = types.nullOr (types.enum [ 1 ]);
      default = null;
      description = ''
-        Configures the trackpad corner click behavior.  Mode 1 enables right click.
+        Configures the trackpad corner click behavior. Mode 1 enables right click.
      '';
    };

@@ -358,7 +393,7 @@ in {
      type = types.nullOr floatWithDeprecationError;
      default = null;
      description = ''
-        Configures the trackpad tracking speed (0 to 3).  The default is "1".
+        Configures the trackpad tracking speed (0 to 3). The default is "1".
      '';
    };

@@ -391,7 +426,7 @@ in {
      type = types.nullOr types.bool;
      default = null;
      description = ''
-        Whether to enable "Natural" scrolling direction.  The default is true.
+        Whether to enable "Natural" scrolling direction. The default is true.
      '';
    };

@@ -399,7 +434,7 @@ in {
      type = types.nullOr (types.enum [ "Centimeters" "Inches" ]);
      default = null;
      description = ''
-        Whether to use centimeters (metric) or inches (US, UK) as the measurement unit.  The default is based on region settings.
+        Whether to use centimeters (metric) or inches (US, UK) as the measurement unit. The default is based on region settings.
      '';
    };

@@ -407,7 +442,7 @@ in {
      type = types.nullOr (types.enum [ 0 1 ]);
      default = null;
      description = ''
-        Whether to use the metric system.  The default is based on region settings.
+        Whether to use the metric system. The default is based on region settings.
      '';
    };

@@ -415,7 +450,7 @@ in {
      type = types.nullOr (types.enum [ "Celsius" "Fahrenheit" ]);
      default = null;
      description = ''
-        Whether to use Celsius or Fahrenheit.  The default is based on region settings.
+        Whether to use Celsius or Fahrenheit. The default is based on region settings.
      '';
    };

@@ -423,7 +458,7 @@ in {
      type = types.nullOr types.bool;
      default = null;
      description = ''
-        Whether to use 24-hour or 12-hour time.  The default is based on region settings.
+        Whether to use 24-hour or 12-hour time. The default is based on region settings.
      '';
    };

@@ -431,7 +466,7 @@ in {
      type = types.nullOr types.bool;
      default = null;
      description = ''
-        Whether to autohide the menu bar.  The default is false.
+        Whether to autohide the menu bar. The default is false.
      '';
    };

@@ -1,74 +1,26 @@
-{ config, lib, ... }:
-
-with lib;
+{ lib, ... }:

+let
+  path = [
+    "system"
+    "defaults"
+    "alf"
+  ];
+in
 {
-  options = {
-    system.defaults.alf.globalstate = mkOption {
-      type = types.nullOr types.int;
-      default = null;
-      description = ''
-        Apple menu > System Preferences > Security and Privacy > Firewall
-
-        Enable the internal firewall to prevent unauthorised applications, programs
-        and services from accepting incoming connections.
-
-        0 = disabled
-        1 = enabled
-        2 = blocks all connections except for essential services
-      '';
-    };
-
-    system.defaults.alf.allowsignedenabled = mkOption {
-      type = types.nullOr types.int;
-      default = null;
-      description = ''
-        Apple menu > System Preferences > Security and Privacy > Firewall
-
-        Allows any signed Application to accept incoming requests. Default is true.
-
-        0 = disabled
-        1 = enabled
-      '';
-    };
-
-    system.defaults.alf.allowdownloadsignedenabled = mkOption {
-      type = types.nullOr types.int;
-      default = null;
-      description = ''
-        Apple menu > System Preferences > Security and Privacy > Firewall
-
-        Allows any downloaded Application that has been signed to accept incoming requests. Default is 0.
-
-        0 = disabled
-        1 = enabled
-      '';
-    };
-
-    system.defaults.alf.loggingenabled = mkOption {
-      type = types.nullOr types.int;
-      default = null;
-      description = ''
-        Apple menu > System Preferences > Security and Privacy > Firewall
-
-        Enable logging of requests made to the firewall. Default is 0.
-
-        0 = disabled
-        1 = enabled
-      '';
-    };
-
-    system.defaults.alf.stealthenabled = mkOption {
-      type = types.nullOr types.int;
-      default = null;
-      description = ''
-        Apple menu > System Preferences > Security and firewall
-
-        Drops incoming requests via ICMP such as ping requests. Default is 0.
-
-        0 = disabled
-        1 = enabled
-      '';
-    };
-  };
+  imports = [
+    (lib.mkRemovedOptionModule (path ++ [ "globalstate" ])
+      "Use `networking.applicationFirewall.enable' and `networking.applicationFirewall.blockAllIncoming' instead."
+    )
+    (lib.mkRemovedOptionModule (
+      path ++ [ "allowsignedenabled" ]
+    ) "Use `networking.applicationFirewall.allowSigned' instead.")
+    (lib.mkRemovedOptionModule (
+      path ++ [ "allowdownloadsignedenabled" ]
+    ) "Use `networking.applicationFirewall.allowSignedApp' instead.")
+    (lib.mkRemovedOptionModule (path ++ [ "loggingenabled" ]) "It's no longer necessary.")
+    (lib.mkRemovedOptionModule (
+      path ++ [ "stealthenabled" ]
+    ) "Use `networking.applicationFirewall.enableStealthMode' instead.")
+  ];
 }
@@ -197,16 +197,93 @@ in {
    };

    system.defaults.dock.persistent-others = mkOption {
-      type = types.nullOr (types.listOf (types.either types.path types.str));
+      type = let
+        folderType = types.submodule {
+          options.path = mkOption {
+            description = "Path to a folder to be added to the dock.";
+            type = types.str;
+          };
+          options.arrangement = mkOption {
+            description = "Sort order for files in folder when clicked.";
+            type = types.enum ["name" "date-added" "date-modified" "date-created" "kind"];
+            default = "name";
+          };
+          options.displayas = mkOption {
+            description = "How to display the folder before clicked.  stack: Stack of file previews.  folder: A folder icon";
+            type = types.enum ["stack" "folder"];
+            default = "stack";
+          };
+          options.showas = mkOption {
+            description = "Effect to show files when clicked.  fan: fan-out effect, grid: box, list: list";
+            type = types.enum ["automatic" "fan" "grid" "list"];
+            default = "automatic";
+          };
+        };
+        taggedType = types.attrTag {
+          file = mkOption {
+            description = "A file to be added to the dock.";
+            type = types.str;
+          };
+          folder = mkOption {
+            description = "A folder to be added to the dock.";
+            type = types.coercedTo types.str (str: { path = str; }) folderType;
+          };
+        };
+        simpleType = types.either types.str types.path;
+        # Below to NOT break exisiting config
+        toTagged = _path: let path = builtins.toString _path; in if strings.hasInfix "." (last (splitString "/" path)) then { file = path; } else { folder = path; };
+        # toTagged = path: { folder = path; }; # or this to be consistent with persistent-apps
+      in
+        types.nullOr (types.listOf (types.coercedTo simpleType toTagged taggedType));
      default = null;
-      example = [ "~/Documents" "~/Downloads" ];
+      example = lib.literalExpression ''
+      [
+        ./flake.nix
+        "/Volumes"
+        { folder = "/Users/@username@/Downloads"; }
+        { folder = { path = "/Users/@username@/.emacs.d"; showas = "grid"; }; }
+        { file = "/Users/@username@/Desktop/this_is_a_file"; }      
+      ]'';
      description = ''
-        Persistent folders in the dock.
+        Persistent files, and folders in the dock.
      '';
-      apply = value:
-        if !(isList value)
-        then value
-        else map (folder: { tile-data = { file-data = { _CFURLString = "file://" + folder; _CFURLStringType = 15; }; }; tile-type = if strings.hasInfix "." (last (splitString "/" folder)) then "file-tile" else "directory-tile"; }) value;
+      apply = let
+        arrangementMap = {
+          name          = 1;
+          date-added    = 2;
+          date-modified = 3;
+          date-created  = 4;
+          kind          = 5;
+        };
+        displayasMap = {
+          stack  = 0;
+          folder = 1;
+        };
+        showasMap = {
+          automatic = 0;
+          fan       = 1;
+          grid      = 2;
+          list      = 3;
+        };
+        parseFolder = (folder:
+          builtins.mapAttrs (name: val:
+            if name == "arrangement" then arrangementMap.${val}
+            else if name == "displayas" then displayasMap.${val}
+            else if name == "showas" then showasMap.${val}
+            else val
+          ) folder
+        );
+        toTile = item: {
+          tile-data = {
+            file-data = {
+              _CFURLString = "file://" + (if item ? folder then item.folder.path else item.file);
+              _CFURLStringType = 15;
+            };
+          } // (if item ? folder then {inherit (parseFolder item.folder) arrangement displayas showas;} else {});
+          tile-type = if item ? folder then "directory-tile" else "file-tile";
+        };
+      in
+        value: if value == null then null else map toTile value;
    };

    system.defaults.dock.scroll-to-open = mkOption {
@@ -217,6 +294,38 @@ in {
      '';
    };

+    system.defaults.dock.showAppExposeGestureEnabled = mkOption {
+      type = types.nullOr types.bool;
+      default = null;
+      description = ''
+        Whether to enable trackpad gestures (three- or four-finger vertical swipe) to show App Exposé. The default is false. This feature interacts with `system.defaults.trackpad.TrackpadFourFingerVertSwipeGesture` and `system.defaults.trackpad.TrackpadThreeFingerVertSwipeGesture` to determine which gesture triggers App Exposé.
+      '';
+    };
+
+    system.defaults.dock.showDesktopGestureEnabled = mkOption {
+      type = types.nullOr types.bool;
+      default = null;
+      description = ''
+        Whether to enable four-finger spread gesture to show the Desktop. The default is false. 
+      '';
+    };
+
+    system.defaults.dock.showLaunchpadGestureEnabled = mkOption {
+      type = types.nullOr types.bool;
+      default = null;
+      description = ''
+        Whether to enable four-finger pinch gesture to show the Launchpad. The default is false. 
+      '';
+    };
+
+    system.defaults.dock.showMissionControlGestureEnabled = mkOption {
+      type = types.nullOr types.bool;
+      default = null;
+      description = ''
+        Whether to enable trackpad gestures (three- or four-finger vertical swipe) to show Mission Control. The default is false. This feature interacts with `system.defaults.trackpad.TrackpadFourFingerVertSwipeGesture` and `system.defaults.trackpad.TrackpadThreeFingerVertSwipeGesture` to determine which gesture triggers Mission Control.
+      '';
+    };
+
    system.defaults.dock.show-process-indicators = mkOption {
      type = types.nullOr types.bool;
      default = null;
@@ -367,3 +476,4 @@ in {

    };
 }
+
@@ -116,6 +116,15 @@ in
      '';
    };

+    system.defaults.finder._FXEnableColumnAutoSizing = mkOption {
+      type = types.nullOr types.bool;
+      default = null;
+      description = ''
+        Resize columns to fit filenames.
+        The default is false.
+      '';
+    };
+
    system.defaults.finder._FXShowPosixPathInTitle = mkOption {
      type = types.nullOr types.bool;
      default = null;
@@ -41,6 +41,14 @@ with lib;
      '';
    };

+    system.defaults.screencapture.save-selections = mkOption {
+      type = types.nullOr types.bool;
+      default = null;
+      description = ''
+        Remember the selection window of the last screencapture. The default is true.
+      '';
+    };
+
    system.defaults.screencapture.show-thumbnail = mkOption {
      type = types.nullOr types.bool;
      default = null;
@@ -9,7 +9,7 @@ with lib;
      type = types.nullOr types.bool;
      default = null;
      description = ''
-        Whether to enable trackpad tap to click.  The default is false.
+        Whether to enable tap to click. The default is false.
      '';
    };

@@ -17,7 +17,7 @@ with lib;
      type = types.nullOr types.bool;
      default = null;
      description = ''
-        Whether to enable tap-to-drag. The default is false.
+        Whether to enable tap to drag. The default is false.
      '';
    };

@@ -25,7 +25,8 @@ with lib;
      type = types.nullOr types.bool;
      default = null;
      description = ''
-        Whether to enable trackpad right click.  The default is false.
+        Whether to enable trackpad right click (two-finger tap/click).
+        The default is false.
      '';
    };

@@ -33,7 +34,7 @@ with lib;
      type = types.nullOr types.bool;
      default = null;
      description = ''
-        Whether to enable three finger drag.  The default is false.
+        Whether to enable three-finger drag. The default is false.
      '';
    };

@@ -41,7 +42,7 @@ with lib;
      type = types.nullOr (types.enum [ 0 1 ]);
      default = null;
      description = ''
-        0 to enable Silent Clicking, 1 to disable.  The default is 1.
+        0 to enable Silent Clicking, 1 to disable. The default is 1.
      '';
    };

@@ -67,10 +68,134 @@ with lib;
      type = types.nullOr (types.enum [ 0 2 ]);
      default = null;
      description = ''
-        0 to disable three finger tap, 2 to trigger Look up & data detectors.
+        Whether to enable three-finger tap gesture: 0 to disable, 2 to trigger Look up & data detectors.
        The default is 2.
      '';
    };

+    system.defaults.trackpad.ActuateDetents = mkOption {
+      type = types.nullOr types.bool;
+      default = null;
+      description = ''
+        Whether to enable haptic feedback. The default is true.
+      '';
+    };
+
+    system.defaults.trackpad.DragLock = mkOption {
+      type = types.nullOr types.bool;
+      default = null;
+      description = ''
+        Whether to enable drag lock. The default is false.
+      '';
+    };
+
+    system.defaults.trackpad.ForceSuppressed = mkOption {
+      type = types.nullOr types.bool;
+      default = null;
+      description = ''
+        Whether to disable force click. The default is false.
+      '';
+    };
+
+    system.defaults.trackpad.TrackpadCornerSecondaryClick = mkOption {
+      type = types.nullOr (types.enum [ 0 1 2 ]);
+      default = null;
+      description = ''
+        Whether to enable secondary click: 0 to disable, 1 to set bottom-left corner, 2 to set bottom-right corner.
+        The default is 0.
+      '';
+    };
+
+    system.defaults.trackpad.TrackpadFourFingerHorizSwipeGesture = mkOption {
+      type = types.nullOr (types.enum [ 0 2 ]);
+      default = null;
+      description = ''
+        Whether to enable four-finger horizontal swipe gesture: 0 to disable, 2 to swipe between full-screen applications.
+        The default is 0.
+      '';
+    };
+
+    system.defaults.trackpad.TrackpadFourFingerPinchGesture = mkOption {
+      type = types.nullOr (types.enum [ 0 2 ]);
+      default = null;
+      description = ''
+        Whether to enable four-finger pinch gesture (spread shows the Desktop, pinch shows the Launchpad): 0 to disable, 2 to enable.
+        The default is 0.
+        This setting interacts with `system.defaults.dock.showDesktopGestureEnabled` and `system.defaults.dock.showLaunchpadGestureEnabled` to determine whether gestures are enabled for the Desktop, Launchpad, or both.
+      '';
+    };
+
+    system.defaults.trackpad.TrackpadFourFingerVertSwipeGesture = mkOption {
+      type = types.nullOr (types.enum [ 0 2 ]);
+      default = null;
+      description = ''
+        0 to disable four finger vertical swipe gestures, 2 to enable (down for Mission Control, up for App Exposé).
+        The default is 2.
+        When both three- and four-finger vertical swipe gestures are enabled, the three-finger variant takes precedence. This setting interacts with `system.defaults.dock.showAppExposeGestureEnabled` and `system.defaults.dock.showMissionControlGestureEnabled` to determine whether vertical swipe gestures are enabled for App Exposé, Mission Control, or both. 
+      '';
+    };
+
+    system.defaults.trackpad.TrackpadMomentumScroll = mkOption {
+      type = types.nullOr types.bool;
+      default = null;
+      description = ''
+        Whether to use inertia when scrolling. The default is true.
+      '';
+    };
+
+    system.defaults.trackpad.TrackpadPinch = mkOption {
+      type = types.nullOr types.bool;
+      default = null;
+      description = ''
+        Whether to enable two-finger pinch gesture for zooming in and out.
+        The default is false.
+      '';
+    };
+
+    system.defaults.trackpad.TrackpadRotate = mkOption {
+      type = types.nullOr types.bool;
+      default = null;
+      description = ''
+        Whether to enable two-finger rotation gesture. The default is false.
+      '';
+    };
+
+    system.defaults.trackpad.TrackpadThreeFingerHorizSwipeGesture = mkOption {
+      type = types.nullOr (types.enum [ 0 1 2 ]);
+      default = null;
+      description = ''
+        Whether to enable three-finger horizontal swipe gesture: 0 to disable, 1 to swipe between pages, 2 to swipe between full-screen applications.
+        The default is 2.
+      '';
+    };
+
+    system.defaults.trackpad.TrackpadThreeFingerVertSwipeGesture = mkOption {
+      type = types.nullOr (types.enum [ 0 2 ]);
+      default = null;
+      description = ''
+        Whether to enable three-finger vertical swipe gesture (down for Mission Control, up for App Exposé): 0 to disable, 2 to enable.
+        The default is 2.
+        This setting interacts with `system.defaults.dock.showAppExposeGestureEnabled` and `system.defaults.dock.showMissionControlGestureEnabled` to determine whether vertical swipe gestures are enabled for App Exposé, Mission Control, or both.
+      '';
+    };
+
+    system.defaults.trackpad.TrackpadTwoFingerDoubleTapGesture = mkOption {
+      type = types.nullOr types.bool;
+      default = null;
+      description = ''
+        Whether to enable smart zoom when double-tapping with two fingers.
+        The default is false.
+      '';
+    };
+
+    system.defaults.trackpad.TrackpadTwoFingerFromRightEdgeSwipeGesture = mkOption {
+      type = types.nullOr (types.enum [ 0 3 ]);
+      default = null;
+      description = ''
+        Whether to enable two-finger swipe-from-right-edge gesture: 0 to disable, 3 to open Notification Center.
+        The default is 0.
+      '';
+    };
+
  };
 }
@@ -38,6 +38,18 @@ in
      description = "Whether to swap the left Command key and left Alt key.";
    };

+    system.keyboard.swapRightCommandAndRightOption = mkOption {
+      type = types.bool;
+      default = false;
+      description = "Whether to swap the right Command key and right Option key.";
+    };
+
+    system.keyboard.swapCapsLockAndEscape = mkOption {
+      type = types.bool;
+      default = false;
+      description = "Whether to swap the Caps Lock key and Escape key.";
+    };
+
    system.keyboard.swapLeftCtrlAndFn = mkOption {
      type = types.bool;
      default = false;
@@ -64,6 +76,14 @@ in
      (mkIf cfg.remapCapsLockToControl { HIDKeyboardModifierMappingSrc = 30064771129; HIDKeyboardModifierMappingDst = 30064771296; })
      (mkIf cfg.remapCapsLockToEscape { HIDKeyboardModifierMappingSrc = 30064771129; HIDKeyboardModifierMappingDst = 30064771113; })
      (mkIf cfg.nonUS.remapTilde { HIDKeyboardModifierMappingSrc = 30064771172; HIDKeyboardModifierMappingDst = 30064771125; })
+      (mkIf cfg.swapCapsLockAndEscape {
+        HIDKeyboardModifierMappingSrc = 30064771129;
+        HIDKeyboardModifierMappingDst = 30064771113;
+      })
+      (mkIf cfg.swapCapsLockAndEscape {
+        HIDKeyboardModifierMappingSrc = 30064771113;
+        HIDKeyboardModifierMappingDst = 30064771129;
+      })
      (mkIf cfg.swapLeftCommandAndLeftAlt {
        HIDKeyboardModifierMappingSrc = 30064771299;
        HIDKeyboardModifierMappingDst = 30064771298;
@@ -72,6 +92,14 @@ in
        HIDKeyboardModifierMappingSrc = 30064771298;
        HIDKeyboardModifierMappingDst = 30064771299;
      })
+      (mkIf cfg.swapRightCommandAndRightOption {
+        HIDKeyboardModifierMappingSrc = 30064771303;
+        HIDKeyboardModifierMappingDst = 30064771302;
+      })
+      (mkIf cfg.swapRightCommandAndRightOption {
+        HIDKeyboardModifierMappingSrc = 30064771302;
+        HIDKeyboardModifierMappingDst = 30064771303;
+      })
      (mkIf cfg.swapLeftCtrlAndFn {
        HIDKeyboardModifierMappingSrc = 30064771296;
        HIDKeyboardModifierMappingDst = 1095216660483;
@@ -1,6 +1,5 @@
 {
  lib,
-  options,
  config,
  ...
 }:
@@ -51,11 +50,7 @@
          )}

          To continue using these options, set `system.primaryUser` to the name
-          of the user you have been using to run `darwin-rebuild`. In the long
-          run, this setting will be deprecated and removed after all the
-          functionality it is relevant for has been adjusted to allow
-          specifying the relevant user separately, moved under the
-          `users.users.*` namespace, or migrated to Home Manager.
+          of the user you have been using to run `darwin-rebuild`.

          If you run into any unexpected issues with the migration, please
          open an issue at <https://github.com/nix-darwin/nix-darwin/issues/new>
@@ -51,7 +51,7 @@ in
    system.maxStateVersion = mkOption {
      internal = true;
      type = types.int;
-      default = 6;
+      default = 7;
    };

    system.darwinLabel = mkOption {
@@ -3,19 +3,8 @@
 with lib;

 let
-
  cfg = config.time;
-
-  timeZone = optionalString (cfg.timeZone != null) ''
-    if ! systemsetup -listtimezones | grep -q "^ ${cfg.timeZone}$"; then
-      echo "${cfg.timeZone} is not a valid timezone. The command 'listtimezones' will show a list of valid time zones." >&2
-      false
-    fi
-    systemsetup -settimezone "${cfg.timeZone}" 2>/dev/null 1>&2
-  '';
-
 in
-
 {
  options = {

@@ -37,8 +26,12 @@ in
    system.activationScripts.time.text = mkIf (cfg.timeZone != null) ''
      # Set defaults
      echo "configuring time..." >&2
-
-      ${timeZone}
+  
+      if ! systemsetup -listtimezones | grep -q "^ ${cfg.timeZone}$"; then
+        echo "${cfg.timeZone} is not a valid timezone. The command 'listtimezones' will show a list of valid time zones." >&2
+        false
+      fi
+      systemsetup -settimezone "${cfg.timeZone}" 2>/dev/null 1>&2
    '';

  };
@@ -203,7 +203,9 @@ in
              else
                homeDirectory=$(dscl . -read ${dsclUser} NFSHomeDirectory)
                homeDirectory=''${homeDirectory#NFSHomeDirectory: }
-                if [[ ${escapeShellArg v.home} != "$homeDirectory" ]]; then
+                configuredHomeDirectory=$(realpath ${escapeShellArg v.home})
+                homeDirectory=$(realpath "$homeDirectory")
+                if [[ "$configuredHomeDirectory" != "$homeDirectory" ]]; then
                  printf >&2 '\e[1;31merror: config contains the wrong home directory for %s, aborting activation\e[0m\n' ${name}
                  printf >&2 'nix-darwin does not support changing the home directory of existing users.\n'
                  printf >&2 '\n'
@@ -11,6 +11,10 @@ fi
 export PATH=@path@
 export NIX_PATH=${NIX_PATH:-@nixPath@}

+# Use the daemon even as `root` so that resource limits, TLS and proxy
+# configuration, etc. work as expected.
+export NIX_REMOTE=${NIX_REMOTE:-daemon}
+
 showSyntax() {
  echo "darwin-rebuild [--help] {edit | switch | activate | build | check | changelog}" >&2
  echo "               [--list-generations] [{--profile-name | -p} name] [--rollback]" >&2
@@ -24,7 +28,7 @@ showSyntax() {
  echo "                             [--no-update-lock-file] [--no-write-lock-file]" >&2
  echo "                             [--override-input input flake] [--update-input input]" >&2
  echo "                             [--no-registries] [--offline] [--refresh]]" >&2
-  echo "               [--substituters substituters-list] ..." >&2
+  echo "               [--substituters substituters-list] [--log-format log-format] ..." >&2
  exit 1
 }

@@ -124,7 +128,7 @@ while [ $# -gt 0 ]; do
      fi
      shift 1
      ;;
-    --substituters)
+    --substituters|--log-format)
      if [ -z "$1" ]; then
        echo "$0: '$i' requires an argument"
        exit 1
@@ -21,6 +21,17 @@ _arguments \
  '(--keep-going -k)'{--keep-going,-k}"[keep going until all builds are finished]"\
  '(--keep-failed -K)'{--keep-failed,-K}'[keep failed builds (usually in /tmp)]'\
  '--fallback[If binary download fails, fall back on building from source]'\
+  '--flake[Build from the given flake URI]:flake uri:'\
+  '--no-flake[Disable implicit flake detection]'\
+  '(-L --print-build-logs)'{-L,--print-build-logs}'[Print build logs during the build]'\
+  '--refresh[Refresh flake inputs]'\
+  '--impure[Allow impure evaluation for flakes]'\
+  '--recreate-lock-file[Recreate flake.lock from scratch]'\
+  '*--update-input[Update a specific flake input]:input name:'\
+  '*--override-input[Override a flake input]:input name: :flake url: '\
+  '--offline[Do not access the network]'\
+  '--dry-run[Show what would be done without making changes]'\
+  '-Q[Only print the resulting store path]'\
  '--show-trace[Print stack trace of evaluation errors]'\
  '*--option[set Nix configuration option]:options:_nix_options:value:_nix_options_value'\
  '*--arg[argument to pass to the Nix function]:Name:_nix_complete_function_arg:Value: '\
@@ -83,12 +83,21 @@ in {
  tests.environment-path = makeTest ./tests/environment-path.nix;
  tests.environment-terminfo = makeTest ./tests/environment-terminfo.nix;
  tests.homebrew = makeTest ./tests/homebrew.nix;
+  tests.homebrew-cleanup-check = makeTest ./tests/homebrew-cleanup-check.nix;
+  tests.homebrew-shell-integration = makeTest ./tests/homebrew-shell-integration.nix;
  tests.launchd-daemons = makeTest ./tests/launchd-daemons.nix;
  tests.launchd-setenv = makeTest ./tests/launchd-setenv.nix;
+  tests.networking-firewall = makeTest ./tests/networking-firewall.nix;
  tests.networking-hostname = makeTest ./tests/networking-hostname.nix;
  tests.networking-networkservices = makeTest ./tests/networking-networkservices.nix;
+  tests.networking-networkservices-no-dhcp-client-id = makeTest ./tests/networking-networkservices-no-dhcp-client-id.nix;
  tests.nix-enable = makeTest ./tests/nix-enable.nix;
  tests.nixpkgs-overlays = makeTest ./tests/nixpkgs-overlays.nix;
+  tests.nixpkgs-config-allow-unfree = makeTest ./tests/nixpkgs-config-allow-unfree.nix;
+  tests.programs-devenv = makeTest ./tests/programs-devenv.nix;
+  tests.programs-gnupg = makeTest ./tests/programs-gnupg.nix;
+  tests.programs-mas = makeTest ./tests/programs-mas.nix;
+  tests.programs-mas-no-cleanup = makeTest ./tests/programs-mas-no-cleanup.nix;
  tests.programs-ssh = makeTest ./tests/programs-ssh.nix;
  tests.programs-tmux = makeTest ./tests/programs-tmux.nix;
  tests.programs-zsh = makeTest ./tests/programs-zsh.nix;
@@ -111,6 +120,7 @@ in {
  tests.services-netdata = makeTest ./tests/services-netdata.nix;
  tests.services-ofborg = makeTest ./tests/services-ofborg.nix;
  tests.services-offlineimap = makeTest ./tests/services-offlineimap.nix;
+  tests.services-openssh = makeTest ./tests/services-openssh.nix;
  tests.services-privoxy = makeTest ./tests/services-privoxy.nix;
  tests.services-redis = makeTest ./tests/services-redis.nix;
  tests.services-skhd = makeTest ./tests/services-skhd.nix;
@@ -0,0 +1,75 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+git checkout master
+git pull
+
+version=$(jq -r .release version.json)
+
+# branch off ${version}
+echo "Cutting nix-darwin-${version} release branch"
+
+git checkout -b "nix-darwin-${version}"
+
+sed -i -e "s!- master!- nix-darwin-${version}!" .github/workflows/test.yml
+sed -i -e "s!NIXPKGS_BRANCH: nixpkgs-unstable!NIXPKGS_BRANCH: nixpkgs-${version}-darwin!" .github/workflows/test.yml
+
+sed -i -e "s!nixpkgs-unstable!nixpkgs-${version}-darwin!" modules/examples/flake/flake.nix
+sed -i -e "s!github:nix-darwin/nix-darwin/master!github:nix-darwin/nix-darwin/nix-darwin-${version}!" modules/examples/flake/flake.nix
+
+sed -i -e "s!nixpkgs/unstable!nixpkgs/stable!g" modules/nix/nixpkgs.nix
+
+sed -i -e "s!nixpkgs-unstable!nixpkgs-${version}-darwin!" flake.nix
+nix flake lock
+
+cat <<EOF > README.md
+# nix-darwin
+
+This is the ${version} release branch of nix-darwin. See [the main readme](https://github.com/nix-darwin/nix-darwin#readme) for documentation
+EOF
+
+cat <<EOF > version.json
+{
+  "release": "${version}",
+  "isReleaseBranch": true
+}
+EOF
+
+git add .
+git commit -m "version: branch off ${version}"
+
+# update master
+echo "Updating master to point to next version"
+
+git checkout master
+
+## update version.json to point to the next version
+
+IFS='.' read -r major minor <<< "$version"
+
+if [[ "$minor" = "11" ]]; then
+    major=$(( major + 1 ))
+    minor="05"
+else
+    minor="11"
+fi
+
+cat <<EOF > version.json
+{
+  "release": "${major}.${minor}",
+  "isReleaseBranch": false
+}
+EOF
+
+## update readme so that instructions refer to the version we're cutting (our supported stable version)
+
+sed -i -e "s![0-9][0-9]\.[0-9][0-9]!${version}!g" README.md
+
+git add .
+git commit -m "version: bump to ${major}.${minor}"
+
+nix flake update
+
+git add .
+git commit -m "flake.lock: update"
@@ -1,10 +1,18 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
+{ config, ... }:

 {
+  environment.enableAllTerminfo = true;
+
  test = ''
+    set -v
+
    echo checking /usr/share/terminfo in environment >&2
    grep 'export TERMINFO_DIRS=.*:/usr/share/terminfo' ${config.system.build.setEnvironment}
+
+    # https://serverfault.com/a/225827
+    echo checking /etc/terminfo contains lots of terminfos >&2
+    find -L ${config.system.path} -name alacritty | grep .
+    find -L ${config.system.path} -name xterm-kitty | grep .
+    find -L ${config.system.path} -name wezterm | grep .
  '';
 }
@@ -1,10 +1,10 @@
-defaults write /Library/Preferences/SystemConfiguration/com.apple.smb.server 'NetBIOSName' $'<?xml version="1.0" encoding="UTF-8"?>
+defaults write /Library/Preferences/SystemConfiguration/com.apple.smb.server NetBIOSName '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <string>IMAC-000000</string>
 </plist>'
-defaults write /Library/Preferences/SystemConfiguration/com.apple.smb.server 'ServerDescription' $'<?xml version="1.0" encoding="UTF-8"?>
+defaults write /Library/Preferences/SystemConfiguration/com.apple.smb.server ServerDescription '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
-<string>Darwin\\\\U2019\'s iMac</string>
+<string>Darwin\\U2019&apos;s iMac</string>
 </plist>'
@@ -1,251 +1,256 @@
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g 'AppleEnableMouseSwipeNavigateWithScrolls' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g AppleEnableMouseSwipeNavigateWithScrolls '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <false/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g 'AppleEnableSwipeNavigateWithScrolls' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g AppleEnableSwipeNavigateWithScrolls '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <false/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g 'AppleFontSmoothing' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g AppleFontSmoothing '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <integer>1</integer>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g 'AppleICUForce24HourTime' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g AppleICUForce24HourTime '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <true/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g 'AppleKeyboardUIMode' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g AppleIconAppearanceTheme '<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<string>RegularDark</string>
+</plist>'
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g AppleKeyboardUIMode '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <integer>3</integer>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g 'ApplePressAndHoldEnabled' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g ApplePressAndHoldEnabled '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <true/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g 'AppleScrollerPagingBehavior' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g AppleScrollerPagingBehavior '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <true/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g 'AppleShowAllExtensions' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g AppleShowAllExtensions '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <true/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g 'AppleShowAllFiles' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g AppleShowAllFiles '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <true/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g 'AppleShowScrollBars' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g AppleShowScrollBars '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <string>Always</string>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g 'AppleSpacesSwitchOnActivate' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g AppleSpacesSwitchOnActivate '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <false/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g 'AppleWindowTabbingMode' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g AppleWindowTabbingMode '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <string>always</string>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g 'InitialKeyRepeat' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g InitialKeyRepeat '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <integer>10</integer>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g 'KeyRepeat' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g KeyRepeat '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <integer>1</integer>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g 'NSAutomaticCapitalizationEnabled' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g NSAutomaticCapitalizationEnabled '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <false/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g 'NSAutomaticDashSubstitutionEnabled' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g NSAutomaticDashSubstitutionEnabled '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <false/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g 'NSAutomaticInlinePredictionEnabled' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g NSAutomaticInlinePredictionEnabled '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <false/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g 'NSAutomaticPeriodSubstitutionEnabled' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g NSAutomaticPeriodSubstitutionEnabled '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <false/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g 'NSAutomaticQuoteSubstitutionEnabled' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g NSAutomaticQuoteSubstitutionEnabled '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <false/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g 'NSAutomaticSpellingCorrectionEnabled' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g NSAutomaticSpellingCorrectionEnabled '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <false/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g 'NSAutomaticWindowAnimationsEnabled' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g NSAutomaticWindowAnimationsEnabled '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <false/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g 'NSDisableAutomaticTermination' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g NSDisableAutomaticTermination '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <true/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g 'NSDocumentSaveNewDocumentsToCloud' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g NSDocumentSaveNewDocumentsToCloud '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <false/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g 'NSNavPanelExpandedStateForSaveMode' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g NSNavPanelExpandedStateForSaveMode '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <true/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g 'NSNavPanelExpandedStateForSaveMode2' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g NSNavPanelExpandedStateForSaveMode2 '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <true/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g 'NSScrollAnimationEnabled' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g NSScrollAnimationEnabled '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <true/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g 'NSTableViewDefaultSizeMode' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g NSTableViewDefaultSizeMode '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <integer>2</integer>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g 'NSTextShowsControlCharacters' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g NSTextShowsControlCharacters '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <true/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g 'NSUseAnimatedFocusRing' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g NSUseAnimatedFocusRing '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <false/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g 'NSWindowResizeTime' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g NSWindowResizeTime '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <real>0.010000</real>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g 'NSWindowShouldDragOnGesture' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g NSWindowShouldDragOnGesture '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <true/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g 'PMPrintingExpandedStateForPrint' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g PMPrintingExpandedStateForPrint '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <true/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g 'PMPrintingExpandedStateForPrint2' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g PMPrintingExpandedStateForPrint2 '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <true/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g 'com.apple.keyboard.fnState' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g com.apple.keyboard.fnState '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <true/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g 'com.apple.mouse.tapBehavior' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g com.apple.mouse.tapBehavior '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <integer>1</integer>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g 'com.apple.springing.delay' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g com.apple.springing.delay '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <real>0.000000</real>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g 'com.apple.springing.enabled' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g com.apple.springing.enabled '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <true/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g 'com.apple.swipescrolldirection' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g com.apple.swipescrolldirection '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <true/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g 'com.apple.trackpad.enableSecondaryClick' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g com.apple.trackpad.enableSecondaryClick '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <true/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g 'com.apple.trackpad.trackpadCornerClickBehavior' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write -g com.apple.trackpad.trackpadCornerClickBehavior '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <integer>1</integer>
 </plist>'

-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write .GlobalPreferences 'com.apple.sound.beep.sound' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write .GlobalPreferences com.apple.sound.beep.sound '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <string>/System/Library/Sounds/Funk.aiff</string>
 </plist>'

-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.menuextra.clock 'FlashDateSeparators' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.menuextra.clock FlashDateSeparators '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <false/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.menuextra.clock 'Show24Hour' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.menuextra.clock Show24Hour '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <false/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.menuextra.clock 'ShowDate' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.menuextra.clock ShowDate '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <integer>2</integer>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.menuextra.clock 'ShowDayOfWeek' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.menuextra.clock ShowDayOfWeek '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <true/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.dock 'appswitcher-all-displays' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.dock appswitcher-all-displays '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <false/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.dock 'autohide-delay' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.dock autohide-delay '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <real>0.240000</real>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.dock 'expose-group-apps' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.dock expose-group-apps '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <true/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.dock 'orientation' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.dock orientation '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <string>left</string>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.dock 'persistent-apps' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.dock persistent-apps '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <array>
@@ -319,20 +324,26 @@ launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user
 	</dict>
 </array>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.dock 'persistent-others' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.dock persistent-others '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <array>
 	<dict>
 		<key>tile-data</key>
 		<dict>
+			<key>arrangement</key>
+			<integer>1</integer>
+			<key>displayas</key>
+			<integer>0</integer>
 			<key>file-data</key>
 			<dict>
 				<key>_CFURLString</key>
-				<string>file://~/Documents</string>
+				<string>file:///file</string>
 				<key>_CFURLStringType</key>
 				<integer>15</integer>
 			</dict>
+			<key>showas</key>
+			<integer>0</integer>
 		</dict>
 		<key>tile-type</key>
 		<string>directory-tile</string>
@@ -343,7 +354,7 @@ launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user
 			<key>file-data</key>
 			<dict>
 				<key>_CFURLString</key>
-				<string>file://~/Downloads/file.txt</string>
+				<string>file:///file</string>
 				<key>_CFURLStringType</key>
 				<integer>15</integer>
 			</dict>
@@ -351,151 +362,210 @@ launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user
 		<key>tile-type</key>
 		<string>file-tile</string>
 	</dict>
+	<dict>
+		<key>tile-data</key>
+		<dict>
+			<key>file-data</key>
+			<dict>
+				<key>_CFURLString</key>
+				<string>file:///folder.d</string>
+				<key>_CFURLStringType</key>
+				<integer>15</integer>
+			</dict>
+		</dict>
+		<key>tile-type</key>
+		<string>file-tile</string>
+	</dict>
+	<dict>
+		<key>tile-data</key>
+		<dict>
+			<key>arrangement</key>
+			<integer>5</integer>
+			<key>displayas</key>
+			<integer>1</integer>
+			<key>file-data</key>
+			<dict>
+				<key>_CFURLString</key>
+				<string>file:///folder.d</string>
+				<key>_CFURLStringType</key>
+				<integer>15</integer>
+			</dict>
+			<key>showas</key>
+			<integer>2</integer>
+		</dict>
+		<key>tile-type</key>
+		<string>directory-tile</string>
+	</dict>
+	<dict>
+		<key>tile-data</key>
+		<dict>
+			<key>arrangement</key>
+			<integer>1</integer>
+			<key>displayas</key>
+			<integer>0</integer>
+			<key>file-data</key>
+			<dict>
+				<key>_CFURLString</key>
+				<string>file:///folder</string>
+				<key>_CFURLStringType</key>
+				<integer>15</integer>
+			</dict>
+			<key>showas</key>
+			<integer>0</integer>
+		</dict>
+		<key>tile-type</key>
+		<string>directory-tile</string>
+	</dict>
 </array>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.dock 'scroll-to-open' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.dock scroll-to-open '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <false/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.finder 'AppleShowAllExtensions' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.finder AppleShowAllExtensions '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <true/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.finder 'AppleShowAllFiles' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.finder AppleShowAllFiles '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <true/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.finder 'CreateDesktop' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.finder CreateDesktop '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <false/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.finder 'FXDefaultSearchScope' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.finder FXDefaultSearchScope '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <string>SCcf</string>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.finder 'FXEnableExtensionChangeWarning' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.finder FXEnableExtensionChangeWarning '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <false/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.finder 'FXPreferredViewStyle' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.finder FXPreferredViewStyle '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <string>Flwv</string>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.finder 'FXRemoveOldTrashItems' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.finder FXRemoveOldTrashItems '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <false/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.finder 'NewWindowTarget' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.finder NewWindowTarget '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <string>PfLo</string>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.finder 'NewWindowTargetPath' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.finder NewWindowTargetPath '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <string>file:///Library/Apple</string>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.finder 'QuitMenuItem' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.finder QuitMenuItem '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <true/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.finder 'ShowExternalHardDrivesOnDesktop' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.finder ShowExternalHardDrivesOnDesktop '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <false/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.finder 'ShowHardDrivesOnDesktop' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.finder ShowHardDrivesOnDesktop '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <false/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.finder 'ShowMountedServersOnDesktop' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.finder ShowMountedServersOnDesktop '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <false/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.finder 'ShowPathbar' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.finder ShowPathbar '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <true/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.finder 'ShowRemovableMediaOnDesktop' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.finder ShowRemovableMediaOnDesktop '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <false/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.finder 'ShowStatusBar' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.finder ShowStatusBar '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <true/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.finder '_FXShowPosixPathInTitle' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.finder _FXShowPosixPathInTitle '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <true/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.finder '_FXSortFoldersFirst' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.finder _FXSortFoldersFirst '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <true/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.finder '_FXSortFoldersFirstOnDesktop' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.finder _FXSortFoldersFirstOnDesktop '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <false/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.HIToolbox 'AppleFnUsageType' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.HIToolbox AppleFnUsageType '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <integer>2</integer>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.iCal 'CalendarSidebarShown' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.iCal CalendarSidebarShown '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <true/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.iCal 'TimeZone support enabled' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.iCal 'TimeZone support enabled' '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <true/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.iCal 'first day of week' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.iCal 'first day of week' '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <integer>4</integer>
 </plist>'


-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.screencapture 'include-date' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.screencapture include-date '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <true/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.screencapture 'location' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.screencapture location '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <string>/tmp</string>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.screencapture 'target' $'<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<string>file</string>
-</plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.screensaver 'askForPassword' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.screencapture save-selections '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <true/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.screensaver 'askForPasswordDelay' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.screencapture target '<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<string>file</string>
+</plist>'
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.screensaver askForPassword '<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<true/>
+</plist>'
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.screensaver askForPasswordDelay '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <integer>5</integer>
@@ -503,62 +573,62 @@ launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user



-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.universalaccess 'closeViewScrollWheelToggle' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.universalaccess closeViewScrollWheelToggle '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <true/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.universalaccess 'closeViewZoomFollowsFocus' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.universalaccess closeViewZoomFollowsFocus '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <true/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.universalaccess 'mouseDriverCursorSize' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.universalaccess mouseDriverCursorSize '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <real>1.500000</real>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.universalaccess 'reduceMotion' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.universalaccess reduceMotion '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <true/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.universalaccess 'reduceTransparency' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.universalaccess reduceTransparency '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <true/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.ActivityMonitor 'IconType' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.ActivityMonitor IconType '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <integer>3</integer>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.ActivityMonitor 'OpenMainWindow' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.ActivityMonitor OpenMainWindow '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <true/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.ActivityMonitor 'ShowCategory' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.ActivityMonitor ShowCategory '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <integer>103</integer>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.ActivityMonitor 'SortColumn' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.ActivityMonitor SortColumn '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <string>CPUUsage</string>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.ActivityMonitor 'SortDirection' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.ActivityMonitor SortDirection '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <integer>0</integer>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write NSGlobalDomain 'TISRomanSwitchState' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write NSGlobalDomain TISRomanSwitchState '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <integer>1</integer>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.Safari 'NSUserKeyEquivalents' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.Safari NSUserKeyEquivalents '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
@@ -566,102 +636,102 @@ launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user
 	<string>@^q</string>
 </dict>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.Safari 'com.apple.Safari.ContentPageGroupIdentifier.WebKit2DeveloperExtrasEnabled' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.Safari com.apple.Safari.ContentPageGroupIdentifier.WebKit2DeveloperExtrasEnabled '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <true/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.WindowManager 'AppWindowGroupingBehavior' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.WindowManager AppWindowGroupingBehavior '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <true/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.WindowManager 'AutoHide' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.WindowManager AutoHide '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <false/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.WindowManager 'EnableStandardClickToShowDesktop' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.WindowManager EnableStandardClickToShowDesktop '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <false/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.WindowManager 'EnableTiledWindowMargins' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.WindowManager EnableTiledWindowMargins '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <true/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.WindowManager 'EnableTilingByEdgeDrag' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.WindowManager EnableTilingByEdgeDrag '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <true/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.WindowManager 'EnableTilingOptionAccelerator' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.WindowManager EnableTilingOptionAccelerator '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <true/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.WindowManager 'EnableTopTilingByEdgeDrag' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.WindowManager EnableTopTilingByEdgeDrag '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <true/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.WindowManager 'GloballyEnabled' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.WindowManager GloballyEnabled '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <false/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.WindowManager 'HideDesktop' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.WindowManager HideDesktop '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <false/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.WindowManager 'StageManagerHideWidgets' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.WindowManager StageManagerHideWidgets '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <true/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.WindowManager 'StandardHideDesktopIcons' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.WindowManager StandardHideDesktopIcons '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <false/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.WindowManager 'StandardHideWidgets' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write com.apple.WindowManager StandardHideWidgets '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <true/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write ~test-defaults-user/Library/Preferences/ByHost/com.apple.controlcenter 'AirDrop' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write ~test-defaults-user/Library/Preferences/ByHost/com.apple.controlcenter AirDrop '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <integer>18</integer>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write ~test-defaults-user/Library/Preferences/ByHost/com.apple.controlcenter 'BatteryShowPercentage' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write ~test-defaults-user/Library/Preferences/ByHost/com.apple.controlcenter BatteryShowPercentage '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <true/>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write ~test-defaults-user/Library/Preferences/ByHost/com.apple.controlcenter 'Bluetooth' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write ~test-defaults-user/Library/Preferences/ByHost/com.apple.controlcenter Bluetooth '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <integer>18</integer>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write ~test-defaults-user/Library/Preferences/ByHost/com.apple.controlcenter 'Display' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write ~test-defaults-user/Library/Preferences/ByHost/com.apple.controlcenter Display '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <integer>24</integer>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write ~test-defaults-user/Library/Preferences/ByHost/com.apple.controlcenter 'FocusModes' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write ~test-defaults-user/Library/Preferences/ByHost/com.apple.controlcenter FocusModes '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <integer>24</integer>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write ~test-defaults-user/Library/Preferences/ByHost/com.apple.controlcenter 'NowPlaying' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write ~test-defaults-user/Library/Preferences/ByHost/com.apple.controlcenter NowPlaying '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <integer>18</integer>
 </plist>'
-launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write ~test-defaults-user/Library/Preferences/ByHost/com.apple.controlcenter 'Sound' $'<?xml version="1.0" encoding="UTF-8"?>
+launchctl asuser "$(id -u -- test-defaults-user)" sudo --user=test-defaults-user -- defaults write ~test-defaults-user/Library/Preferences/ByHost/com.apple.controlcenter Sound '<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <integer>24</integer>
@@ -0,0 +1,23 @@
+{ config, ... }:
+
+let
+  brewBundleInstallCmd = config.homebrew.onActivation.brewBundleCmd { onlyCheck = false; };
+in
+
+{
+  homebrew.enable = true;
+  homebrew.user = "test-homebrew-user";
+  homebrew.onActivation.cleanup = "check";
+
+  test = ''
+    echo "checking that cleanup check is present in system checks" >&2
+    grep "brew bundle --file='.*-Brewfile' cleanup" ${config.out}/activate
+
+    echo "checking that brew bundle [install] command does not have --cleanup flag" >&2
+    if echo "${brewBundleInstallCmd}" | grep -F -- '--cleanup' > /dev/null; then
+      echo "Expected no --cleanup flag in brewBundleInstallCmd"
+      echo "Actual: ${brewBundleInstallCmd}"
+      exit 1
+    fi
+  '';
+}
@@ -0,0 +1,29 @@
+{ config, ... }:
+
+{
+  homebrew.enable = true;
+  programs.bash.enable = true;
+  programs.zsh.enable = true;
+  programs.fish.enable = true;
+
+  homebrew.user = "test-homebrew-user";
+
+  homebrew.enableBashIntegration = true;
+  homebrew.enableFishIntegration = true;
+  homebrew.enableZshIntegration = true;
+
+  test = ''
+    echo >&2 "checking bash shell integration in /etc/bashrc"
+    grep 'brew shellenv bash' ${config.out}/etc/bashrc
+    echo >&2 "checking bash completions in /etc/bashrc"
+    grep 'bash_completion' ${config.out}/etc/bashrc
+
+    echo >&2 "checking zsh shell integration in /etc/zshrc"
+    grep 'brew shellenv zsh' ${config.out}/etc/zshrc
+
+    echo >&2 "checking fish shell integration in /etc/fish/config.fish"
+    grep 'brew shellenv fish' ${config.out}/etc/fish/config.fish
+    echo >&2 "checking fish completions in /etc/fish/config.fish"
+    grep 'fish_complete_path' ${config.out}/etc/fish/config.fish
+  '';
+}
@@ -17,7 +17,7 @@ in

  homebrew.user = "test-homebrew-user";

-  # Examples taken from https://github.com/Homebrew/homebrew-bundle
+  # Examples adapted from https://docs.brew.sh/Brew-Bundle-and-Brewfile
  homebrew.taps = [
    "homebrew/cask"
    {
@@ -41,7 +41,8 @@ in
    {
      name = "denji/nginx/nginx-full";
      args = [ "with-rmtp" ];
-      restart_service = "changed";
+      link = "overwrite";
+      restart_service = "always";
    }
    {
      name = "mysql@5.6";
@@ -49,6 +50,10 @@ in
      link = true;
      conflicts_with = [ "mysql" ];
    }
+    {
+      name = "postgresql@16";
+      postinstall = "\${HOMEBREW_PREFIX}/opt/postgresql@16/bin/postgres -D \${HOMEBREW_PREFIX}/var/postgresql@16";
+    }
  ];

  homebrew.casks = [
@@ -61,6 +66,10 @@ in
      name = "opera";
      greedy = true;
    }
+    {
+      name = "google-cloud-sdk";
+      postinstall = "\${HOMEBREW_PREFIX}/bin/gcloud components update";
+    }
  ];

  homebrew.masApps = {
@@ -68,10 +77,19 @@ in
    Xcode = 497799835;
  };

-  homebrew.whalebrews = [
-    "whalebrew/wget"
+  homebrew.vscode = [
+    "golang.go"
  ];

+  homebrew.goPackages = [
+    "github.com/charmbracelet/crush"
+  ];
+
+  homebrew.cargoPackages = [
+    "ripgrep"
+  ];
+
+
  test = ''
    bf=${lib.escapeShellArg config.homebrew.brewfile}

@@ -85,19 +103,33 @@ in

    echo "checking brew entries in Brewfile" >&2
    ${mkTest "imagemagick" ''brew "imagemagick"''}
-    ${mkTest "denji/nginx/nginx-full" ''brew "denji/nginx/nginx-full", args: ["with-rmtp"], restart_service: :changed''}
+    ${mkTest "denji/nginx/nginx-full" ''brew "denji/nginx/nginx-full", args: ["with-rmtp"], link: :overwrite, restart_service: :always''}
    ${mkTest "mysql@5.6" ''brew "mysql@5.6", conflicts_with: ["mysql"], link: true, restart_service: true''}
+    ${mkTest "postgresql@16" ''brew "postgresql@16", postinstall: "''${HOMEBREW_PREFIX}/opt/postgresql@16/bin/postgres -D ''${HOMEBREW_PREFIX}/var/postgresql@16"''}

    echo "checking cask entries in Brewfile" >&2
    ${mkTest "google-chrome" ''cask "google-chrome"''}
    ${mkTest "firefox" ''cask "firefox", args: { appdir: "~/my-apps/Applications" }''}
    ${mkTest "opera" ''cask "opera", greedy: true''}
+    ${mkTest "google-cloud-sdk" ''cask "google-cloud-sdk", postinstall: "''${HOMEBREW_PREFIX}/bin/gcloud components update"''}

    echo "checking mas entries in Brewfile" >&2
    ${mkTest "1Password for Safari" ''mas "1Password for Safari", id: 1569813296''}
    ${mkTest "Xcode" ''mas "Xcode", id: 497799835''}

-    echo "checking whalebrew entries in Brewfile" >&2
-    ${mkTest "whalebrew/wget" ''whalebrew "whalebrew/wget"''}
+    echo "checking vscode entries in Brewfile" >&2
+    ${mkTest "golang.go" ''vscode "golang.go"''}
+
+    echo "checking go entries in Brewfile" >&2
+    ${mkTest "github.com/charmbracelet/crush" ''go "github.com/charmbracelet/crush"''}
+
+    echo "checking cargo entries in Brewfile" >&2
+    ${mkTest "ripgrep" ''cargo "ripgrep"''}
+
+    echo "checking that shell integration is absent by default" >&2
+    (! grep 'brew shellenv' ${config.out}/etc/zshrc)
+
+    echo "checking that cleanup check is absent by default" >&2
+    (! grep 'brew bundle cleanup --file=' ${config.out}/activate)
  '';
 }
@@ -0,0 +1,17 @@
+{ config, ... }:
+{
+  networking.applicationFirewall = {
+    enable = true;
+    blockAllIncoming = true;
+    allowSignedApp = false;
+    enableStealthMode = null;
+  };
+
+  test = ''
+    echo "checking socketfilterfw calls in /activate" >&2
+    grep "/usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on" ${config.out}/activate
+    grep "/usr/libexec/ApplicationFirewall/socketfilterfw --setblockall on" ${config.out}/activate
+    grep "/usr/libexec/ApplicationFirewall/socketfilterfw --setallowsignedapp off" ${config.out}/activate
+    (! grep "/usr/libexec/ApplicationFirewall/socketfilterfw --setstealthmode" ${config.out}/activate)
+  '';
+}
@@ -0,0 +1,14 @@
+{ config, lib, ... }:
+
+{
+  networking.knownNetworkServices = [ "Wi-Fi" "Thunderbolt Ethernet" ];
+  networking.dns = [ "8.8.8.8" "8.8.4.4" ];
+
+  test = ''
+    echo checking dhcp client ID is not configured in /activate >&2
+    if grep -q "networksetup -setdhcp" ${config.out}/activate; then
+      echo "unexpected dhcp client ID configuration in /activate" >&2
+      exit 1
+    fi
+  '';
+}
@@ -3,11 +3,14 @@
 {
  networking.knownNetworkServices = [ "Wi-Fi" "Thunderbolt Ethernet" ];
  networking.dns = [ "8.8.8.8" "8.8.4.4" ];
+  networking.dhcpClientId = "test-client-id";

  test = ''
    echo checking dns settings in /activate >&2
    grep "networksetup -setdnsservers ${lib.escapeShellArgs [ "Wi-Fi" "8.8.8.8" "8.8.4.4" ]}" ${config.out}/activate
    grep "networksetup -setdnsservers ${lib.escapeShellArgs [ "Thunderbolt Ethernet" "8.8.8.8" "8.8.4.4" ]}" ${config.out}/activate
+    grep "networksetup -setdhcp ${lib.escapeShellArgs [ "Wi-Fi" "test-client-id" ]}" ${config.out}/activate
+    grep "networksetup -setdhcp ${lib.escapeShellArgs [ "Thunderbolt Ethernet" "test-client-id" ]}" ${config.out}/activate
    echo checking empty searchdomain settings in /activate >&2
    grep "networksetup -setsearchdomains ${lib.escapeShellArgs [ "Wi-Fi" "empty" ]}" ${config.out}/activate
    grep "networksetup -setsearchdomains ${lib.escapeShellArgs [ "Thunderbolt Ethernet" "empty" ]}" ${config.out}/activate
@@ -0,0 +1,45 @@
+# Check that nixpkgs.config.allowUnfreePackages is merged correctly
+# run with: nix-build release.nix -A tests.nixpkgs-config-allow-unfree
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  # Module 1: Define some unfree packages
+  nixpkgs.config.allowUnfreePackages = [
+    "vscode"
+    "slack"
+  ];
+
+  # Module 2: Define more unfree packages (simulating multiple modules)
+  # In a real scenario, this would be in a separate file
+  imports = [
+    (
+      { config, ... }:
+      {
+        nixpkgs.config.allowUnfreePackages = [
+          "zoom"
+          "discord"
+        ];
+      }
+    )
+  ];
+
+  test = ''
+    echo checking allowUnfreePackages merging >&2
+
+    # Verify that all packages from both modules are present
+    expected_packages=("discord" "slack" "vscode" "zoom")
+    actual_packages=(${builtins.toString (builtins.sort builtins.lessThan config.nixpkgs.config.allowUnfreePackages)})
+
+    for pkg in "''${expected_packages[@]}"; do
+      if [[ ! " ''${actual_packages[@]} " =~ " $pkg " ]]; then
+        echo "ERROR: Expected package '$pkg' not found in allowUnfreePackages" >&2
+        exit 1
+      fi
+    done
+  '';
+}
@@ -0,0 +1,42 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  devenv =
+    pkgs.runCommand "devenv-0.0.0" { } ''
+      mkdir -p $out/bin
+      cat > $out/bin/devenv <<'EOF'
+      #!/usr/bin/env bash
+      exit 0
+      EOF
+      chmod +x $out/bin/devenv
+    ''
+    // {
+      meta.mainProgram = "devenv";
+    };
+in
+{
+  programs.bash.enable = true;
+  programs.zsh.enable = true;
+  programs.fish.enable = true;
+
+  programs.devenv = {
+    enable = true;
+    package = devenv;
+  };
+
+  test = ''
+    echo >&2 "checking devenv bash integration in /etc/bashrc"
+    grep 'devenv hook bash' ${config.out}/etc/bashrc
+
+    echo >&2 "checking devenv zsh integration in /etc/zshrc"
+    grep 'devenv hook zsh' ${config.out}/etc/zshrc
+
+    echo >&2 "checking devenv fish integration in /etc/fish/config.fish"
+    grep 'devenv hook fish' ${config.out}/etc/fish/config.fish
+  '';
+}
@@ -0,0 +1,31 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  gnupg = pkgs.runCommand "gnupg-0.0.0" { } "mkdir -p $out/bin";
+in
+
+{
+  system.primaryUser = "test-gnupg-user";
+
+  programs.gnupg.package = gnupg;
+  programs.gnupg.agent.enable = true;
+  programs.gnupg.agent.enableSSHSupport = true;
+
+  test = ''
+    echo >&2 "checking gnupg-agent service in ~/Library/LaunchAgents"
+    grep "org.nixos.gnupg-agent" ${config.out}/user/Library/LaunchAgents/org.nixos.gnupg-agent.plist
+    grep "${gnupg}/bin/gpg-connect-agent" ${config.out}/user/Library/LaunchAgents/org.nixos.gnupg-agent.plist
+
+    echo >&2 "checking GPG_TTY in set-environment"
+    grep 'export GPG_TTY=\$(tty)' ${config.system.build.setEnvironment}
+
+    echo >&2 "checking SSH support in set-environment"
+    grep "${gnupg}/bin/gpg-connect-agent --quiet updatestartuptty /bye" ${config.system.build.setEnvironment}
+    grep "${gnupg}/bin/gpgconf --list-dirs agent-ssh-socket" ${config.system.build.setEnvironment}
+  '';
+}
@@ -0,0 +1,60 @@
+{
+  config,
+  pkgs,
+  ...
+}:
+
+let
+  mas =
+    pkgs.runCommand "mas-0.0.0" { } ''
+          mkdir -p $out/bin
+          cat > $out/bin/mas <<'EOF'
+      #!/usr/bin/env bash
+      exit 0
+      EOF
+          chmod +x $out/bin/mas
+    ''
+    // {
+      meta.mainProgram = "mas";
+    };
+in
+{
+  system.primaryUser = "primary-mas-user";
+
+  programs.mas = {
+    enable = true;
+    user = "test-mas-user";
+    package = mas;
+    update = true;
+    cleanup = false;
+    packages = {
+      Xcode = 497799835;
+    };
+  };
+
+  homebrew.masApps = {
+    "KeepFromHomebrew" = 424242;
+  };
+
+  test = ''
+    echo "checking mas present in systemPackages" >&2
+    test -x ${config.out}/sw/bin/mas
+
+    echo "checking mas activation script still installs and updates apps" >&2
+    grep 'desiredIds=(' ${config.out}/activate
+    grep '497799835' ${config.out}/activate
+    grep 'mas install \"$appId\"' ${config.out}/activate
+    grep 'mas update' ${config.out}/activate
+
+    echo "checking cleanup-only variables are omitted" >&2
+    if grep 'declare -A installedApps' ${config.out}/activate; then
+      echo "unexpected installedApps declaration when cleanup is disabled" >&2
+      exit 1
+    fi
+
+    if grep 'keepIds=(' ${config.out}/activate; then
+      echo "unexpected keepIds declaration when cleanup is disabled" >&2
+      exit 1
+    fi
+  '';
+}
@@ -0,0 +1,71 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  mas =
+    pkgs.runCommand "mas-0.0.0" { } ''
+          mkdir -p $out/bin
+          cat > $out/bin/mas <<'EOF'
+      #!/usr/bin/env bash
+      exit 0
+      EOF
+          chmod +x $out/bin/mas
+    ''
+    // {
+      meta.mainProgram = "mas";
+    };
+in
+{
+  system.primaryUser = "primary-mas-user";
+
+  programs.mas = {
+    enable = true;
+    user = "test-mas-user";
+    package = mas;
+    update = true;
+    cleanup = true;
+    packages = {
+      "1Password for Safari" = 1569813296;
+      Xcode = 497799835;
+    };
+  };
+
+  homebrew.masApps = {
+    "KeepFromHomebrew" = 424242;
+  };
+
+  test = ''
+    echo "checking mas present in systemPackages" >&2
+    test -x ${config.out}/sw/bin/mas
+
+    echo "checking mas activation script uses requested user" >&2
+    grep -- '--user=test-mas-user' ${config.out}/activate
+
+    echo "checking mas desired ids are present" >&2
+    grep 'desiredIds=(' ${config.out}/activate
+    grep '1569813296' ${config.out}/activate
+    grep '497799835' ${config.out}/activate
+
+    echo "checking mas install loop exists" >&2
+    grep 'mas install \"$appId\"' ${config.out}/activate
+
+    echo "checking mas update is triggered" >&2
+    grep 'mas update' ${config.out}/activate
+
+    echo "checking mas parses installedApps from mas list" >&2
+    grep 'declare -A installedApps' ${config.out}/activate
+    grep 'installedApps\[' ${config.out}/activate
+
+    echo "checking mas cleanup log and uninstall" >&2
+    grep 'removing .* from App Store' ${config.out}/activate
+    grep 'runAsUser .*/mas uninstall' ${config.out}/activate
+
+    echo "checking homebrew.masApps ids are kept during cleanup" >&2
+    grep 'homebrewIds=(' ${config.out}/activate
+    grep '424242' ${config.out}/activate
+  '';
+}
@@ -8,6 +8,7 @@
   programs.zsh.enable = true;
   programs.zsh.enableCompletion = true;
   programs.zsh.enableBashCompletion = false;
+   programs.zsh.enableAutosuggestions = true;

   programs.zsh.shellInit = "source /etc/zshenv.d/*.conf";
   programs.zsh.interactiveShellInit = "source /etc/zshrc.d/*.conf";
@@ -35,6 +36,8 @@
     grep 'autoload -U compinit && compinit' ${config.out}/etc/zshrc
     echo >&2 "checking bashcompinit in /etc/zshrc"
     (! grep 'bashcompinit' ${config.out}/etc/zshrc)
+     echo >&2 "checking zsh-autosuggestions in /etc/zshrc"
+     grep 'source ${pkgs.zsh-autosuggestions}/share/zsh-autosuggestions/zsh-autosuggestions.zsh' ${config.out}/etc/zshrc

     echo >&2 "checking zprofile.d in /etc/zprofile"
     grep 'source /etc/zprofile.d/\*.conf' ${config.out}/etc/zprofile
@@ -12,6 +12,10 @@ in
  services.dnsmasq.addresses = {
    localhost = "127.0.0.1";
  };
+  services.dnsmasq.servers = [
+    "8.8.8.8"
+    "/example.com/192.168.1.1"
+  ];

  test = ''
    echo >&2 "checking dnsmasq service in /Library/LaunchDaemons"
@@ -19,6 +23,10 @@ in
    grep "${dnsmasq}/bin/dnsmasq" ${config.out}/Library/LaunchDaemons/org.nixos.dnsmasq.plist
    grep -F -- "--address=/localhost/127.0.0.1" ${config.out}/Library/LaunchDaemons/org.nixos.dnsmasq.plist

+    echo >&2 "checking server options"
+    grep -F -- "--server=8.8.8.8" ${config.out}/Library/LaunchDaemons/org.nixos.dnsmasq.plist
+    grep -F -- "--server=/example.com/192.168.1.1" ${config.out}/Library/LaunchDaemons/org.nixos.dnsmasq.plist
+
    echo >&2 "checking resolver config"
    grep -F "port 53" ${config.out}/etc/resolver/localhost
    grep -F "nameserver 127.0.0.1" ${config.out}/etc/resolver/localhost
@@ -4,9 +4,6 @@
    enable = true;
    url = "https://github.com/nixos/nixpkgs";
    tokenFile = "/secret/path/to/a/github/token";
-    # We need an overridable derivation but cannot use the actual github-runner package
-    # since it still relies on Node.js 16 which is marked as insecure.
-    package = pkgs.hello;
  };

  test = ''
@@ -0,0 +1,37 @@
+{ config, ... }:
+
+{
+  services.openssh.enable = true;
+  services.openssh.extraConfig = ''
+    StreamLocalBindUnlink yes
+  '';
+  services.openssh.hostKeys = [
+    { type = "ed25519"; path = "/etc/ssh/custom_host_ed25519_key"; comment = "my-host"; }
+    { type = "rsa"; path = "/etc/ssh/custom_host_rsa_key"; bits = 4096; }
+  ];
+
+  test = ''
+    echo >&2 "checking for StreamLocalBindUnlink in /etc/ssh/sshd_config.d/100-nix-darwin.conf"
+    grep 'StreamLocalBindUnlink yes' ${config.out}/etc/ssh/sshd_config.d/100-nix-darwin.conf
+
+    echo >&2 "checking for HostKey directives in /etc/ssh/sshd_config.d/099-host-keys.conf"
+    grep 'HostKey /etc/ssh/custom_host_ed25519_key' ${config.out}/etc/ssh/sshd_config.d/099-host-keys.conf
+    grep 'HostKey /etc/ssh/custom_host_rsa_key' ${config.out}/etc/ssh/sshd_config.d/099-host-keys.conf
+
+    echo >&2 "checking that default keys are absent from config"
+    (! grep 'HostKey /etc/ssh/ssh_host_rsa_key' ${config.out}/etc/ssh/sshd_config.d/099-host-keys.conf)
+    (! grep 'HostKey /etc/ssh/ssh_host_ecdsa_key' ${config.out}/etc/ssh/sshd_config.d/099-host-keys.conf)
+    (! grep 'HostKey /etc/ssh/ssh_host_ed25519_key' ${config.out}/etc/ssh/sshd_config.d/099-host-keys.conf)
+
+    echo >&2 "checking for ssh-keygen commands in activation script"
+    grep 'ssh-keygen.*keygenArgs' ${config.out}/activate
+
+    echo >&2 "checking for keygenArgs in activation script"
+    grep '\-t ed25519' ${config.out}/activate
+    grep '\-C my-host' ${config.out}/activate
+    grep '\-f /etc/ssh/custom_host_ed25519_key' ${config.out}/activate
+    grep '\-t rsa' ${config.out}/activate
+    grep '\-b 4096' ${config.out}/activate
+    grep '\-f /etc/ssh/custom_host_rsa_key' ${config.out}/activate
+  '';
+}
@@ -26,6 +26,7 @@
  system.defaults.NSGlobalDomain.AppleEnableMouseSwipeNavigateWithScrolls = false;
  system.defaults.NSGlobalDomain.AppleEnableSwipeNavigateWithScrolls = false;
  system.defaults.NSGlobalDomain.AppleFontSmoothing = 1;
+  system.defaults.NSGlobalDomain.AppleIconAppearanceTheme = "RegularDark";
  system.defaults.NSGlobalDomain.AppleICUForce24HourTime = true;
  system.defaults.NSGlobalDomain.AppleKeyboardUIMode = 3;
  system.defaults.NSGlobalDomain.ApplePressAndHoldEnabled = true;
@@ -79,7 +80,14 @@
    { folder = "/Applications/Utilities"; }
    { file = "/Users/example/Downloads/test.csv"; }
  ];
-  system.defaults.dock.persistent-others = ["~/Documents" "~/Downloads/file.txt"];
+  system.defaults.dock.persistent-others = [
+    # ./. # TODO: how to test for paths while NOT being brittle?
+    "/file"
+    { file = "/file"; }
+    "/folder.d"
+    { folder = { path = "/folder.d"; arrangement="kind"; displayas="folder"; showas = "grid"; }; }
+    { folder = "/folder"; }
+  ];
  system.defaults.dock.scroll-to-open = false;
  system.defaults.finder.AppleShowAllFiles = true;
  system.defaults.finder.ShowStatusBar = true;
@@ -107,10 +115,11 @@
  system.defaults.screencapture.location = "/tmp";
  system.defaults.screencapture.target = "file";
  system.defaults.screencapture.include-date = true;
+  system.defaults.screencapture.save-selections = true;
  system.defaults.screensaver.askForPassword = true;
  system.defaults.screensaver.askForPasswordDelay = 5;
  system.defaults.smb.NetBIOSName = "IMAC-000000";
-  system.defaults.smb.ServerDescription = ''Darwin\\\\U2019's iMac'';
+  system.defaults.smb.ServerDescription = ''Darwin\\U2019's iMac'';
  system.defaults.universalaccess.mouseDriverCursorSize = 1.5;
  system.defaults.universalaccess.reduceMotion = true;
  system.defaults.universalaccess.reduceTransparency = true;
@@ -5,20 +5,28 @@
  system.keyboard.remapCapsLockToControl = true;
  system.keyboard.remapCapsLockToEscape = true;
  system.keyboard.nonUS.remapTilde = true;
+  system.keyboard.swapCapsLockAndEscape = true;
  system.keyboard.swapLeftCommandAndLeftAlt = true;
+  system.keyboard.swapRightCommandAndRightOption = true;
  system.keyboard.swapLeftCtrlAndFn = true;

  test = ''
    echo checking keyboard mappings in /activate >&2
    grep "hidutil property --set '{\"UserKeyMapping\":.*}'" ${config.out}/activate
    grep "\"HIDKeyboardModifierMappingSrc\":30064771129" ${config.out}/activate
+    grep "\"HIDKeyboardModifierMappingSrc\":30064771113" ${config.out}/activate
    grep "\"HIDKeyboardModifierMappingSrc\":30064771172" ${config.out}/activate
    grep "\"HIDKeyboardModifierMappingDst\":30064771113" ${config.out}/activate
    grep "\"HIDKeyboardModifierMappingDst\":30064771125" ${config.out}/activate
+    grep "\"HIDKeyboardModifierMappingDst\":30064771129" ${config.out}/activate
    grep "\"HIDKeyboardModifierMappingDst\":30064771296" ${config.out}/activate
    grep "\"HIDKeyboardModifierMappingDst\":30064771298" ${config.out}/activate
    grep "\"HIDKeyboardModifierMappingDst\":30064771299" ${config.out}/activate
    grep "\"HIDKeyboardModifierMappingDst\":30064771296" ${config.out}/activate
+    grep "\"HIDKeyboardModifierMappingSrc\":30064771303" ${config.out}/activate
+    grep "\"HIDKeyboardModifierMappingSrc\":30064771302" ${config.out}/activate
+    grep "\"HIDKeyboardModifierMappingDst\":30064771302" ${config.out}/activate
+    grep "\"HIDKeyboardModifierMappingDst\":30064771303" ${config.out}/activate
    grep "\"HIDKeyboardModifierMappingDst\":1095216660483" ${config.out}/activate
  '';
 }
@@ -1,4 +1,4 @@
 {
-  "release": "25.05",
+  "release": "26.11",
  "isReleaseBranch": false
 }