feat(ai-tools): declare Codex submodule

home/hosts/andromache/default.nix

@@ -25,6 +25,7 @@
   };
   ai-tools = {
     claude-code.enable = true;
+    codex.enable = true;
     opencode.enable = true;
   };
   anki.enable = true;

home/modules/ai-tools/codex.nix

@@ -0,0 +1,13 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+
+{
+  config = lib.mkIf config.ai-tools.codex.enable {
+    programs.codex.enable = true;
+    home.packages = with pkgs; [ codex ];
+  };
+}

home/modules/ai-tools/default.nix

@@ -20,6 +20,9 @@ in
         default = [ ];
       };
     };
+    codex = {
+      enable = lib.mkEnableOption "codex";
+    };
     opencode = {
       enable = lib.mkEnableOption "opencode";
     };
@@ -31,6 +34,7 @@ in
   imports = [
     ./claude-code.nix
     ./fabric.nix
+    ./codex.nix
     ./opencode.nix
     ./skills.nix
     ./tirith.nix

home/modules/ai-tools/opencode.nix

@@ -2,49 +2,61 @@
   config,
   lib,
   pkgs,
+  myUtils,
+  osConfig ? null,
+  inputs ? null,
   ...
 }:
 
 let
-  cfg = config.ai-tools.opencode;
+  sops = myUtils.sopsAvailability config osConfig;
+  standalone = osConfig == null;
 in
 {
-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf config.ai-tools.opencode.enable (
-    secrets.files.opencode = [ "api-key" ];
+    lib.optionalAttrs standalone {
-    secrets.templates."opencode/auth.json" = {
+      sops = {
-      path = ".local/share/opencode/auth.json";
+        secrets = myUtils.mkSopsSecrets "${toString inputs.nix-secrets}/secrets" {
-      content = ''
+          opencode = [ "api-key" ];
-        {
-          "zai-coding-plan": {
-            "type": "api",
-            "key": "${config.sops.placeholder."opencode/api-key"}"
-          }
-        }
-      '';
-    };
-
-    home.packages = [ pkgs.opencode ];
-
-    home.file.".config/opencode/opencode.json".text = builtins.toJSON {
-      "$schema" = "https://opencode.ai/config.json";
-      permission = {
-        external_directory = {
-          "/run/secrets/" = "deny";
-          "~/.config/sops/age/keys.txt" = "deny";
-          "~/.ssh/id_rsa" = "deny";
-          "~/.ssh/id_ed25519" = "deny";
-          "~/.ssh/id_ecdsa" = "deny";
-          "~/.ssh/id_dsa" = "deny";
-          "/etc/ssh/ssh_host_rsa_key" = "deny";
-          "/etc/ssh/ssh_host_ed25519_key" = "deny";
-          "/etc/ssh/ssh_host_ecdsa_key" = "deny";
-          "/etc/ssh/ssh_host_dsa_key" = "deny";
         };
-        command = {
+        templates."opencode/auth.json" = {
-          sops = "deny";
+          path = "${config.home.homeDirectory}/.local/share/opencode/auth.json";
+          content = builtins.toJSON {
+            zai-coding-plan = {
+              type = "api";
+              key = config.sops.placeholder."opencode/api-key";
+            };
+          };
         };
       };
-      plugin = [ "@mohak34/opencode-notifier@latest" ];
+    }
-    };
+    // {
-  };
+      warnings =
+        lib.optional (!sops.available)
+          "opencode is enabled, but sops templates are not available. the opencode API key will not be configured.";
+
+      home.packages = [ pkgs.opencode ];
+      home.file.".config/opencode/opencode.json".text = builtins.toJSON {
+        "$schema" = "https://opencode.ai/config.json";
+        permission = {
+          external_directory = {
+            "/run/secrets/" = "deny";
+            "~/.config/sops/age/keys.txt" = "deny";
+            "~/.ssh/id_rsa" = "deny";
+            "~/.ssh/id_ed25519" = "deny";
+            "~/.ssh/id_ecdsa" = "deny";
+            "~/.ssh/id_dsa" = "deny";
+            "/etc/ssh/ssh_host_rsa_key" = "deny";
+            "/etc/ssh/ssh_host_ed25519_key" = "deny";
+            "/etc/ssh/ssh_host_ecdsa_key" = "deny";
+            "/etc/ssh/ssh_host_dsa_key" = "deny";
+          };
+          command = {
+            sops = "deny";
+          };
+        };
+        plugin = [ "@mohak34/opencode-notifier@latest" ];
+      };
+    }
+  );
 }

home/modules/taskwarrior/default.nix

@@ -9,7 +9,6 @@
 }:
 
 let
-  cfg = config.taskwarrior;
   sops = myUtils.sopsAvailability config osConfig;
   standalone = osConfig == null;
 
@@ -62,7 +61,7 @@ in
 {
   options.taskwarrior.enable = lib.mkEnableOption "taskwarrior";
 
-  config = lib.mkIf cfg.enable (
+  config = lib.mkIf config.taskwarrior.enable (
     lib.optionalAttrs standalone {
       sops = {
         secrets = myUtils.mkSopsSecrets "${toString inputs.nix-secrets}/secrets" {