...

configurations/home/srid@zest.nix

@@ -47,7 +47,9 @@ in
     pkgs.python3
     pkgs.portfwd
     # The kolu terminal-side CLIs, without running the kolu service itself.
+    inputs.kolu.packages.${pkgs.stdenv.hostPlatform.system}.kaval
     inputs.kolu.packages.${pkgs.stdenv.hostPlatform.system}.kaval-tui
+    inputs.kolu.packages.${pkgs.stdenv.hostPlatform.system}.padi
     inputs.kolu.packages.${pkgs.stdenv.hostPlatform.system}.padi-tui
   ];
 }

configurations/nixos/naiveintent/default.nix

@@ -24,6 +24,7 @@ in
   imports = [
     self.nixosModules.default
     ./configuration.nix
+    (self + /modules/nixos/linux/gc.nix)
     (self + /modules/nixos/linux/llm-debugging.nix)
   ];
 
@@ -37,7 +38,8 @@ in
     sandbox = "relaxed";
     extra-experimental-features = [ "impure-derivations" "ca-derivations" ];
   };
-  # GC is handled via home-manager (modules/home/nix/gc.nix)
+  # GC: system generations via modules/nixos/linux/gc.nix (root-owned);
+  # user profile via home-manager (modules/home/nix/gc.nix).
 
   zramSwap.enable = true;
   swapDevices = [{

configurations/nixos/pureintent/default.nix

@@ -30,7 +30,9 @@ in
     self.nixosModules.default
     ./configuration.nix
     ./devbox.nix
+    ./kolu-dev.nix
     (self + /modules/nixos/linux/beszel.nix)
+    (self + /modules/nixos/linux/gc.nix)
     (self + /modules/nixos/linux/incus)
     (self + /modules/nixos/linux/llm-debugging.nix)
   ];
@@ -78,7 +80,8 @@ in
     sandbox = "relaxed";
     extra-experimental-features = [ "impure-derivations" "ca-derivations" ];
   };
-  # GC is handled via home-manager (modules/home/nix/gc.nix)
+  # GC: system generations via modules/nixos/linux/gc.nix (root-owned);
+  # user profile via home-manager (modules/home/nix/gc.nix).
 
   zramSwap.enable = true;
   swapDevices = [{

configurations/nixos/pureintent/kolu-dev.nix

@@ -0,0 +1,14 @@
+# Host-side bits for kolu development on pureintent.
+{ flake, ... }:
+
+{
+  # Dedicated account for kolu end-to-end remote-terminal tests.
+  # Authorize srid (same machine) to `ssh kolu-e2e-remote@localhost` with his key.
+  users.users.kolu-e2e-remote = {
+    isNormalUser = true;
+    openssh.authorizedKeys.keys = [ 
+      # pureintent srid
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEnWriRB3c/G+O4/N5ALnOQBdBTp9LeGC6HNYTZCCGS2 srid@pureintent"
+    ];
+  };
+}

flake.lock

@@ -283,11 +283,11 @@
         "bun2nix": "bun2nix"
       },
       "locked": {
-        "lastModified": 1783304273,
+        "lastModified": 1783601954,
-        "narHash": "sha256-TaiFUcQjPk1MiIsTsYtLXhH9wwoKXYK3uk2qt9ZgbIk=",
+        "narHash": "sha256-tlebQqzg5CS/liUGV9GI8Rjxduxs29bXZcohhcVj/o4=",
         "owner": "srid",
         "repo": "drishti",
-        "rev": "25a1dcfda307ca07e40d9e049b13e9d9ae63854c",
+        "rev": "037ebbdd72e35d2d53f8c8199ad86d7c07b6a669",
         "type": "github"
       },
       "original": {
@@ -845,16 +845,16 @@
     },
     "kolu": {
       "locked": {
-        "lastModified": 1783521149,
+        "lastModified": 1783602023,
-        "narHash": "sha256-JeO5oKKXwLnrynIY9butaYh8YbpARNycZOK/wPFDhgo=",
+        "narHash": "sha256-bO5h/S9vTSkYj8grU98ZRRxi/O+MltvUSPCMfZFxlY4=",
         "owner": "juspay",
         "repo": "kolu",
-        "rev": "7d51cb2b290bdcaaabe6522c90152598d162d9bd",
+        "rev": "a56b0bbbcec72643c5980e4855976b0da85e2dca",
         "type": "github"
       },
       "original": {
         "owner": "juspay",
-        "ref": "master",
+        "ref": "feat/header-host-first-daemons",
         "repo": "kolu",
         "type": "github"
       }

flake.nix

@@ -34,7 +34,8 @@
     jumphost-nix.url = "github:srid/jumphost-nix";
     jumphost-nix.flake = false;
 
-    kolu.url = "github:juspay/kolu/master";
+    # Pinned to PR #1730 (padi W6 — the honest connect): https://github.com/juspay/kolu/pull/1730
+    kolu.url = "github:juspay/kolu/w6-honest-connect";
 
     # drishti remote host monitor (home-manager module)
     drishti.url = "github:srid/drishti/master";

justfile

@@ -12,7 +12,7 @@ mod pureintent 'configurations/nixos/pureintent/mod.just'
 [group('main')]
 activate host="":
     nix flake lock
-    @if [ -z "{{host}}" ]; then \
+    @if [ -z "{{ host }}" ]; then \
         if [ -f ./configurations/home/$USER@$HOSTNAME.nix ]; then \
             echo "Activating home env $USER@$HOSTNAME ..."; \
             nix run . $USER@$HOSTNAME; \
@@ -21,8 +21,8 @@ activate host="":
             nix run . $HOSTNAME; \
         fi \
     else \
-        echo "Deploying to {{host}} ..."; \
+        echo "Deploying to {{ host }} ..."; \
-        nix run . {{host}}; \
+        nix run . {{ host }}; \
     fi
 
 # Update primary flame inputs
@@ -30,6 +30,25 @@ activate host="":
 update:
     nix run .#update
 
+# Update Kolu/Drishti, then build Kolu and activate target environments.
+[group('main')]
+kolu: _kolu-update && _kolu-after-update
+
+_kolu-update:
+    nix flake update kolu drishti
+
+[parallel]
+_kolu-after-update: _kolu-build _kolu-activate-pureintent _kolu-activate-local
+
+_kolu-build:
+    nix build --inputs-from . kolu
+
+_kolu-activate-pureintent:
+    just activate pureintent
+
+_kolu-activate-local:
+    just activate
+
 # Misc commands
 # --------------------------------------------------------------------------------------------------
 

modules/nixos/linux/gc.nix

@@ -0,0 +1,18 @@
+# System-level Nix garbage collection + store optimisation.
+#
+# The home-manager `nix.gc` (modules/home/nix/gc.nix) runs as the user, so it
+# can prune the *user* profile and collect the store, but it can never touch
+# the root-owned `system-*` profile generations. Without a system-level GC,
+# those pile up unbounded — pureintent accumulated ~480 system generations
+# (~4 months of daily rebuilds), each pinning a full closure and keeping old
+# kernels/packages from ever being collected. This prunes them; auto-optimise
+# hardlinks identical files across the closures that remain.
+{ ... }:
+{
+  nix.gc = {
+    automatic = true;
+    dates = "weekly";
+    options = "--delete-older-than 30d";
+  };
+  nix.settings.auto-optimise-store = true;
+}