refactor(claude): delegate programs.claude.* to nix-claude-code

[JacobPEvans-personal]

Summary

PR3 of the nix-ai → nix-claude-code migration (Checkpoint 2/4 per
docs/migration-from-nix-ai.md).
nix-ai now consumes the Claude module from dryvist/nix-claude-code instead of
defining its own.

• Add nix-claude-code as a flake input with nixpkgs/home-manager/
  ai-assistant-instructions/claude-code-plugins follows overrides.
• Drop 20 marketplace flake inputs (anthropic-agent-skills, bills-claude-skills,
  bitwarden-marketplace, browser-use-skills, cc-dev-tools, cc-marketplace,
  claude-code-plugins-plus, claude-code-workflows, claude-plugins-official,
  claude-skills, jacobpevans-cc-plugins, lunar-claude, obsidian-skills,
  openai-codex, axton-obsidian-visual-skills, superpowers-marketplace,
  visual-explainer-marketplace, wakatime, huggingface-skills,
  vct-cribl-pack-validator-skills) plus claude-cookbooks. They're now transitive
  inputs through nix-claude-code; surfaced to non-Claude consumers via
  nix-claude-code.inputs in flake/home-manager-modules.nix. karpathy-skills
  stays in nix-ai (newly added to main while PR3 was in flight; not yet in
  nix-claude-code's catalog).
• Delete the migrated Claude code (~30 files, ~4500 deletions) and its
  CI-only generators:
  • modules/claude/{options-*.nix, settings.nix, plugins.nix, components.nix, registry.nix, orphan-cleanup.nix, marketplace-overrides.nix, default.nix, README.md, bws_helper.py, get-api-key.py, bws-env.example, fabric-curated-patterns.json, hooks/, scripts/, statusline/}
  • modules/{claude-plugins.nix, claude-latest.nix}
  • modules/claude/plugins/marketplaces.nix (tier files
    01-official.nix..05-specialty.nix stay; default.nix rewritten to a
    smaller tier aggregator)
  • modules/permissions/claude-permissions-{allow,ask,deny}.nix
  • lib/{claude-settings.nix, claude-registry.nix}
• Rewrite modules/claude-config.nix as a pure-values module (model,
  marketplaces, hooks, settings.*). Marketplaces come from
  nix-claude-code.lib.{marketplaceCatalog, marketplaceOverrides};
  settings.permissions still flows through nix-ai's modules/common
  formatter engine so Codex/Gemini share the source of truth.
• Add modules/claude/automode-environment.nix (homelab-trust prose for
  Claude's auto-mode classifier, sourced from userConfig.user.fullName).
• Update flake/home-manager-modules.nix to import
  nix-claude-code.homeModules.claude alongside ../modules/default.nix
  for the default module and ../modules/claude-config.nix for the
  standalone claude module. The import lives at this layer (not inside
  default.nix) so the import list resolves without depending on
  _module.args.nix-claude-code — module imports run before args are
  wired, which would otherwise cause infinite recursion.
• Rewrite lib/checks/claude.nix to drop tests that referenced deleted
  lib/claude-settings.nix; structural settings.json validation is now
  covered by nix-claude-code's own CI. Trim fabric-marketplace-build
  from lib/checks/fabric.nix (now lives in nix-claude-code).
• Rebuild lib.ci.claudeSettingsJson from nix-claude-code.lib helpers
  • nix-ai's plugin tier files + permission formatters so downstream
    consumers (nix-darwin's _claude-settings.yml CI gate) see byte-
    identical output.

Why

Separation of concerns: nix-claude-code is the canonical owner of
programs.claude.* schema, the marketplace catalog, synthetic marketplace
derivations, the settings.json renderer, and hooks/MCP/statusline wiring.
nix-ai keeps the cross-tool surface (Codex, Gemini, Copilot, MCP, MLX,
Fabric, plugin enablement tiers, auto-mode trust prose).

This is Checkpoint 2/4 of the migration plan, executed without the
intermediate useExternalModule toggle because PR2
(dryvist/nix-claude-code#26)
already landed every option, hook, lib helper, and CI shim nix-ai needs.

Byte-equivalence (the safety contract)

diff <(nix eval --raw '/path/to/nix-ai/main#lib.ci.claudeSettingsJson' | jq -S .) \
     <(nix eval --raw '.#lib.ci.claudeSettingsJson' | jq -S .)
# → empty (0 lines)
# 716 lines on both sides

The CI fixture is byte-identical to current main. Downstream nix-darwin's
_claude-settings.yml workflow will see the same generated settings.json.

Test plan

• Local nix flake check --no-build --all-systems --refresh passes
  every Claude-relevant check (module-eval, options-regression,
  defaults-regression, etc.).
• Three baseline failures (agent-skills-home-files,
  fabric-version-sync, gemini-policy-engine) are pre-existing on
  main and unrelated to PR3 — verified by stashing this PR's changes
  and re-running flake check.
• nix eval --raw .#lib.ci.claudeSettingsJson produces byte-identical
  output to main.
• CI on x86_64-linux runs and passes (where the eval-cached drvs
  actually build).
• Local darwin-rebuild build --flake ${HOME}/git/public/nix-darwin/main
  with this branch as the nix-ai input to validate end-to-end activation.

Deviations from the original plan

• Kept karpathy-skills as a nix-ai-side flake input. It was added to
  main (PR feat(agent-skills): add karpathy-skills + auto-discover all marketplaces #831) while PR3 was in flight and isn't in nix-claude-code's
  marketplace catalog yet — promote upstream as a follow-up.
• Schema renames are handled transparently by
  lib.mkRenamedOptionModule shims inside nix-claude-code's module
  (enabledPlugins → plugins.enabled, marketplaces → plugins.marketplaces,
  statusLine → statusline, hooks.extraHooks → settings.hooks), so no
  nix-ai-side renames were needed.
• hooks.captureSessionOutput and hooks.refreshMarketplaces toggles
  replace the explicit postToolUse/sessionStart script paths
  (last-output.sh/marketplace-refresh.sh are vendored inside
  nix-claude-code now).

Refs: dryvist/nix-claude-code#26, #838, dryvist/nix-darwin#1141

[github-actions]

CI Auto-Fix Attempt 1/2

Claude is analyzing the CI failure and attempting a fix...

[github-actions]

CI Auto-Fix Attempt 2/2

Claude is analyzing the CI failure and attempting a fix...