feat(claude): broaden allowed tool permissions in settings

Replace restrictive bash-only permissions with full tool access
including Read, Glob, Grep, WebFetch, WebSearch, Agent, and
NotebookEdit for a more capable Claude Code experience.

.gitignore

@@ -0,0 +1,2 @@
+.omc/
+wg1.conf

configuration.nix

@@ -125,7 +125,7 @@
   # networking.firewall.allowedTCPPorts = [ ... ];
   # networking.firewall.allowedUDPPorts = [ ... ];
   # Or disable the firewall altogether.
-  # networking.firewall.enable = false;
+  networking.firewall.enable = false;
 
   # This value determines the NixOS release from which the default
   # settings for stateful data, like file locations and database versions
@@ -158,7 +158,7 @@
 
   # KiCad footprint libraries
   environment.sessionVariables = {
-    KICAD9_FOOTPRINT_DIR = "${pkgs.kicad-libraries.footprints}/share/kicad/footprints";
+    KICAD9_FOOTPRINT_DIR = "${pkgs.kicad-small.libraries.footprints}/share/kicad/footprints";
   };
 
   # Enable flakes and extras
@@ -182,12 +182,22 @@
   # WireGuard VPN
   networking.wg-quick.interfaces.wg0 = {
     address = [ "10.0.1.67/32" ];
-    dns = [ "10.0.1.65" ];
+    dns = [ "1.1.1.1" ];
     privateKeyFile = "/etc/wireguard/private.key";
 
+    # Route endpoint via local gateway to avoid routing loop
+    preUp = ''
+      GW=$(ip route show default | awk '{print $3; exit}')
+      DEV=$(ip route show default | awk '{print $5; exit}')
+      ip route add 69.48.243.22/32 via "$GW" dev "$DEV" || true
+    '';
+    postDown = ''
+      ip route del 69.48.243.22/32 || true
+    '';
+
     peers = [{
       publicKey = "VEpzr/CeGdS6Wsy0NDDfmlB/bCYxS55A155HWGCIIzc=";
-      endpoint = "vpn.leeworks.dev:51820";
+      endpoint = "69.48.243.22:51820";
       # Route all traffic through VPN EXCEPT the local 10.0.0.0/24 network
       allowedIPs = [
         "0.0.0.0/5"

home.nix

@@ -29,6 +29,7 @@
     gnomeExtensions.arc-menu
     freecad
     gtk3  # Provides org.gtk.Settings.FileChooser schema for FreeCAD
+    nodejs  # Required by claude-code and oh-my-claudecode (HUD, npm plugins)
   ];
 
   # --------------------------
@@ -216,14 +217,21 @@
     source = "${caveman}/skills/caveman-help";
     recursive = true;
   };
-  home.file.".claude/skills/oh-my-claudecode" = {
+  home.file.".claude/skills" = {
     source = "${oh-my-claudecode}/skills";
     recursive = true;
   };
 
+  # Claude Code agents (managed declaratively via flake inputs)
+  home.file.".claude/agents" = {
+    source = "${oh-my-claudecode}/agents";
+    recursive = true;
+  };
+
   # Claude Code configuration
   home.file.".claude/CLAUDE.md" = {
-    text = ''
+    text = builtins.readFile "${oh-my-claudecode}/CLAUDE.md" + ''
+
       ## Commit Behavior
 
       After completing each logical unit of work, use the /commit skill to stage
@@ -268,14 +276,27 @@
         allow = [
           "Edit"
           "Write"
-          "Bash(git:*)"
+          "Read"
-          "Bash(nix-shell:*)"
+          "Glob"
-          "Bash(nix eval:*)"
+          "Grep"
-          "Bash(nix flake check:*)"
+          "Bash"
-         ];
+          "WebFetch"
+          "WebSearch"
+          "Agent"
+          "NotebookEdit"
+        ];
       };
       alwaysThinkingEnabled = true;
       includeCoAuthoredBy = false;
+      statusLine = {
+        type = "command";
+        command = "node \${CLAUDE_CONFIG_DIR:-$HOME/.claude}/hud/omc-hud.mjs";
+      };
+      env = {
+        CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS = "1";
+        OMC_PLUGIN_ROOT = "${oh-my-claudecode}";
+      };
+      teammateMode = "tmux";
     };
     force = true;
   };