Commit c5215d81322a

@@ -8,26 +8,6 @@ let
   # Unified AI agent storage (XDG-compliant)
   # Physical storage in ai-sync (syncthing folder), symlinked to ai/
   aiSyncDir = "${config.xdg.dataHome}/ai-sync";
-  # Wrap Node.js-based CLI tools with LD_LIBRARY_PATH for NSS resolution
-  # on non-NixOS hosts (Fedora CSB) where user accounts come from sssd.
-  # Without this, libuv's uv_os_get_passwd fails with ENOENT.
-  # ponytail: blanket /usr/lib64; scope to just libnss_sss if issues arise
-  isNonNixOS = !builtins.pathExists /etc/NIXOS;
-  wrapForNSS =
-    pkg:
-    if isNonNixOS then
-      pkgs.symlinkJoin {
-        name = pkg.name;
-        paths = [ pkg ];
-        nativeBuildInputs = [ pkgs.makeWrapper ];
-        postBuild = ''
-          for f in $out/bin/*; do
-            wrapProgram "$f" --prefix LD_LIBRARY_PATH : /usr/lib64
-          done
-        '';
-      }
-    else
-      pkg;
 in
 {
   # Ensure claude-sync directory structure exists (legacy, still used by claude)
@@ -110,7 +90,7 @@ in
     # AI coding agents (from numtide/llm-agents.nix)
     llm-agents.claude-code
     llm-agents.claude-agent-acp
-    (wrapForNSS llm-agents.gemini-cli)
+    (config.custom.nss.wrap llm-agents.gemini-cli)
     llm-agents.opencode
     llm-agents.pi
     llm-agents.skills

@@ -1,7 +1,7 @@
-{ pkgs, ... }:
+{ pkgs, config, ... }:
 {
   home.packages = with pkgs; [
-    nh
+    (config.custom.nss.wrap nh)
     nix-output-monitor
     nix-prefetch-scripts
     nix-update

@@ -0,0 +1,34 @@
+# Expose wrapForNSS as config.lib.nss.wrap for use across home-manager modules.
+# On non-NixOS hosts (Fedora CSB), wraps binaries with LD_LIBRARY_PATH=/usr/lib64
+# so Nix's glibc can find system NSS modules (libnss_sss for sssd).
+# On NixOS, returns the package unchanged (nscd handles NSS).
+{
+  pkgs,
+  lib,
+  ...
+}:
+let
+  isNonNixOS = !builtins.pathExists /etc/NIXOS;
+in
+{
+  options.custom.nss.wrap = lib.mkOption {
+    type = lib.types.raw;
+    readOnly = true;
+    description = "Wrap a package with LD_LIBRARY_PATH for NSS resolution on non-NixOS hosts.";
+    default =
+      pkg:
+      if isNonNixOS then
+        pkgs.symlinkJoin {
+          name = pkg.name;
+          paths = [ pkg ];
+          nativeBuildInputs = [ pkgs.makeWrapper ];
+          postBuild = ''
+            for f in $out/bin/*; do
+              wrapProgram "$f" --prefix LD_LIBRARY_PATH : /usr/lib64
+            done
+          '';
+        }
+      else
+        pkg;
+  };
+}

@@ -11,6 +11,7 @@
 }:
 {
   imports = [
+    ./modules/nss-wrapper.nix
     ./common/shell
   ]
   ++ lib.optional (builtins.isString desktop) ./common/desktop