refactor: centralize Nix-managed Codex assets and integrations

modules/capabilities/ai.nix

@@ -7,18 +7,7 @@ in
   flake.modules.nixos.ai =
     { pkgs, ... }:
     let
-      context7Headers = pkgs.writeShellScript "context7-http-headers" ''
-        set -euo pipefail
-
-        CONTEXT7_KEY_FILE="''${XDG_CONFIG_HOME:-$HOME/.config}/context7/api-key"
-        [[ -r "$CONTEXT7_KEY_FILE" ]]
-        CONTEXT7_KEY="$(< "$CONTEXT7_KEY_FILE")"
-
-        exec ${pkgs.jq}/bin/jq --null-input --compact-output \
-          --arg authorization "Bearer $CONTEXT7_KEY" \
-          '{ Authorization: $authorization }'
-      '';
-
+      ai = import ./ai/_assets.nix { inherit pkgs; };
       codexConfig = (pkgs.formats.toml { }).generate "codex-config.toml" {
         model = "gpt-5.6-sol";
         model_reasoning_effort = "high";
@@ -43,18 +32,21 @@ in
           status_line_use_colors = true;
         };
 
-        mcp_servers = {
-          context7 = {
-            url = "https://mcp.context7.com/mcp";
-            http_headers_helper = "${context7Headers}";
+        features.plugins = true;
+        marketplaces.nix-managed = {
+          source_type = "local";
+          source = "${ai.marketplace}";
+        };
+        plugins."ponytail@nix-managed".enabled = true;
+        hooks = ai.codexHooks;
+        mcp_servers = ai.servers // {
+          context7 = ai.servers.context7 // {
+            http_headers_helper = "${ai.context7Headers}";
           };
-          nixos = {
-            command = "${pkgs.uv}/bin/uvx";
-            args = [ "mcp-nixos" ];
+          nixos = ai.servers.nixos // {
             startup_timeout_sec = 60.0;
             tools.nix.approval_mode = "approve";
           };
-          openaiDeveloperDocs.url = "https://developers.openai.com/mcp";
         };
       };
     in
@@ -82,7 +74,10 @@ in
     };
 
   flake.modules.homeManager.ai =
-    { pkgs, ... }:
+    { pkgs, lib, ... }:
+    let
+      ai = import ./ai/_assets.nix { inherit pkgs; };
+    in
     {
       services.podman = {
         volumes = {
@@ -111,6 +106,7 @@ in
       home.packages = [
         # Node-based Codex plugin hooks and skill scripts need node/npm outside project dev shells.
         pkgs.nodejs
+        pkgs.python3
         pkgs.llm-agents.codex
         pkgs.llm-agents.pi
         pkgs.llm-agents.claude-code
@@ -193,70 +189,18 @@ in
         height = "90%"
       '';
 
-      home.file.".codex/AGENTS.md".text = ''
-        # Environment
-
-        This is Nix; use `nix run` for missing commands.
-
-        - Default Nix commands to `--quiet`; inspect logs only for failing derivations.
-        - Never emit full package, derivation, closure, GC, or store-tree listings. Capture them in `/tmp`, summarize or filter, then inspect targeted excerpts.
-        - For store sources, locate files first, then read exact ranges; avoid broad `rg -C` searches.
-
-        # Work
-
-        - Inspect the relevant implementation and follow project conventions.
-        - Prefer the simplest complete solution.
-        - Identify and address root causes rather than masking symptoms.
-        - Prefer existing capabilities and defaults. Add custom code, wrappers, helpers, defensive checks, fallbacks, compatibility layers, or abstractions only for a concrete need.
-        - Delete unnecessary code; keep related logic together.
-        - Use types, schemas, and interfaces to prevent invalid states where practical.
-        - Keep changes focused; preserve behavior unless requested or fixing a confirmed defect.
-        - Verify unfamiliar, version-sensitive, or consequential APIs against current documentation; prefer context7.
-        - Run the most relevant checks; report only verification performed.
-
-        # Reviews and refactoring
-
-        - Inspect complete relevant context, not just the obvious file or diff.
-        - Find unnecessary or duplicated code, redundant state, avoidable checks, reimplemented capabilities, and repeated defaults.
-        - Ask whether defensive code protects a realistic state or hides an unclear invariant.
-        - Optimize conceptual complexity, not line count.
-        - Separate confirmed problems from optional improvements; explain important tradeoffs.
-
-        # Context
-
-        Every action must justify its context. Minimize tools and skills; prefer targeted queries and bounded output. Ask for readily available large output instead of retrieving it.
-
-        # Remote state
-
-        GitHub and all other repository remotes are strictly read-only. Fetching,
-        cloning, and reading metadata, issues, pull requests, checks, and diffs are
-        allowed. Never push or mutate remote repositories, issues, pull requests,
-        reviews, comments, labels, assignments, projects, workflows, releases,
-        settings, keys, secrets, or variables. Local files and local Git state may
-        be modified as authorized.
-      '';
-
-      home.file = {
-        ".agents/plugins/marketplace.json".text = builtins.toJSON {
-          name = "nix-managed";
-          plugins = [
-            {
-              name = "ponytail";
-              source = {
-                source = "local";
-                path = "./.codex/plugins/ponytail";
-              };
-              policy = {
-                installation = "AVAILABLE";
-                authentication = "ON_INSTALL";
-              };
-              category = "Productivity";
-            }
-          ];
+      # Codex owns its writable user config; Nix owns assets and system defaults.
+      home.file =
+        lib.mapAttrs' (
+          name: source: lib.nameValuePair ".agents/skills/${name}" { inherit source; }
+        ) ai.skills
+        // {
+          ".codex/AGENTS.md".text = builtins.readFile ./ai/instructions/codex.md;
+          # Codex's installed-plugin scanner skips symlinked version directories.
+          "${ai.codexCache}" = {
+            source = ai.sources.ponytail;
+            recursive = true;
+          };
         };
-        ".agents/skills/context7-mcp".source = ./skills/context7-mcp;
-        ".agents/skills/nixos-maintainer".source = ./skills/nixos-maintainer;
-        ".codex/plugins/ponytail".source = inputs.ponytail;
-      };
     };
 }