菜单
Check and update digest pins for third-party docker images used by selfhost services on sietch. Use when the user asks to update, bump, or check container images, image pins, or docker digests for self-hosted services.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Add a new persistent self-hosted service on sietch, exposed on the tailnet as <name>.sole-pierce.ts.net via Tailscale Services. Use when the user asks to host, self-host, deploy, or expose a new service (web app, API, MCP server, media tool) on sietch or "my server". Covers the nix module, agenix secrets, the tailscale admin-console steps, and verification.
Desktop inspection and control for the local NixOS + niri Wayland session. Use when an agent needs to see or drive the desktop - take screenshots of windows/outputs (including hidden workspaces), inspect windows/workspaces via niri, focus or launch apps (with or without stealing focus), click/type/scroll into GUI apps, run app tasks in the background on the agent workspace, or recover a confused desktop (overview open, focus lost). Route browser work to agent-browser/CDP and terminal work to tmux; use this skill's acu tool for everything the compositor and pixels must solve.
Control a dedicated Helium browser profile through agent-browser and Chrome DevTools Protocol. Use when an agent needs to drive the user's Helium browser locally or through an SSH-forwarded CDP endpoint, inspect browser state, open pages in a visible browser, collaborate on local or remote dev-server debugging, take screenshots, read snapshots, manage tabs, or validate browser behavior in the Helium profile.
Ask Codex CLI (gpt-5.5) to run local app verification that needs browser automation, desktop control, screenshots, app launching, or independent runtime inspection. This is how gpt-5.5 is invoked for computer-use work, and the preferred route for browser verification on this machine. Use when the user asks to test a flow, verify UI behavior, inspect a running app, capture screenshots, or report confirmation and feedback about implemented behavior.
Ask Codex CLI (gpt-5.5) to implement scoped code changes in the current repository, then have the current agent inspect the resulting diff and verification. This is how gpt-5.5 is invoked for implementation work. Use when the user asks to delegate implementation to Codex or gpt-5.5, when the model-selection rubric routes the work to gpt-5.5, or when a bounded task would benefit from another coding agent producing a patch.
Ask Codex CLI (gpt-5.5) for an independent code review of uncommitted changes, a branch diff, a commit, or a specific implementation. Use when the user asks for Codex or gpt-5.5 review work, when the model-selection rubric calls for a gpt-5.5 review perspective, or when Codex should audit a diff, find bugs or regressions, or compare an implementation against requirements. For a review by the current agent itself, use the normal review process instead.
| name | update-image-pins |
| description | Check and update digest pins for third-party docker images used by selfhost services on sietch. Use when the user asks to update, bump, or check container images, image pins, or docker digests for self-hosted services. |
Third-party images in modules/nixos/selfhost/ are pinned by digest:
image = "<registry>/<name>:<tag>@sha256:<digest>";
The tag documents intent; docker resolves the digest. Because the generated
units use --pull missing, changing the pin and switching is the entire
update path — no manual docker pull or restart. Mutable tags are never
auto-pulled (supply-chain caution; see issue #7 context).
Self-built images (e.g. siren while it was docker-based) are NOT digest-pinned;
they update via local build + systemctl restart docker-<name>. Services from
flake inputs update via nix flake update <input>.
Check for drift (skopeo runs via nix shell, no install needed):
bin/image-pins check
For each drifted image, look up what changed before updating — find the project's releases/changelog (e.g. github releases for the repo behind the image) and summarize it for the user. Do not blind-bump.
Update the pin(s):
bin/image-pins update # all drifted
bin/image-pins update executor # one image, by substring
(Or Edit the .nix file directly — the pin line is self-describing.)
Validate and apply:
git add -u
nix build .#nixosConfigurations.sietch.config.system.build.toplevel --no-link
Then ask the user to run: ! sudo nixos-rebuild switch --flake ~/dotfiles#sietch
Verify the service after the switch (unit active + its https endpoint responds; see the add-selfhost-service skill for the commands), then commit the pin bump with the upstream version/changes noted in the message.
nix shell nixpkgs#skopeo -c skopeo inspect --format '{{.Digest}}' docker://<registry>/<name>:<tag>
Append @<digest> to the image string in the service's nix file.