refactor(noctalia): move config to prdlk/noctalia external

.chezmoidata/packages.yaml

@@ -76,7 +76,7 @@ packages:
         - noctalia
         - xwayland-satellite
         # polkitd (D-Bus activated, no unit to enable); Noctalia's built-in
-        # agent answers its prompts (dot_config/noctalia/config.toml), and
+        # agent answers its prompts (~/.config/noctalia/config.toml, prdlk/noctalia), and
         # niri still starts polkit-gnome
         - polkit
         - polkit-gnome

.chezmoiexternals/noctalia.toml

@@ -0,0 +1,6 @@
+[".config/noctalia"]
+    type = "git-repo"
+    url = "https://github.com/prdlk/noctalia.git"
+    refreshPeriod = "168h"
+    [".config/noctalia".pull]
+        args = ["--ff-only"]

.chezmoiignore.tmpl

@@ -64,7 +64,3 @@ dist
 
 # Noctalia's umbriel theme template output, rewritten on every theme change
 .config/umbriel/noctalia.toml
-
-# Runtime plugin state with embedded tokens — never managed
-.config/noctalia/plugins
-.config/noctalia/plugins/**

AGENTS.md

@@ -40,6 +40,7 @@ Fresh clone: `git submodule update --init`.
 | `~/.config/television` | prdlk/television | `.chezmoiexternals/television.toml` |
 | `~/.config/yazi` | prdlk/yazi | `.chezmoiexternals/yazi.toml` |
 | `~/.config/omarchy` | prdlk/omarchy | `.chezmoiexternals/omarchy.toml` (git themes/plugins live in its `extras.txt`, not this repo) |
+| `~/.config/noctalia` | prdlk/noctalia | `.chezmoiexternals/noctalia.toml` (desktop/laptop roles only; `plugins/` gitignored, holds tokens) |
 | `~/.omp` | prdlk/omp | `.chezmoiexternals/omp.toml` |
 | `~/.config/nvim` | prdlk/nvim | `.chezmoiexternal.toml` (no refresh; local checkout wins) |
 | `~/.config/tmux/plugins/tpm` | tmux-plugins/tpm | `.chezmoiexternal.toml` |

docs/chezmoi/externals-and-ignore.mdx

@@ -61,6 +61,7 @@ Per-app config repos, one file each in `.chezmoiexternals/<app>.toml`. Each is a
 | `kitty.toml` | `~/.config/kitty` | [prdlk/kitty](https://github.com/prdlk/kitty) |
 | `ghostty.toml` | `~/.config/ghostty` | [prdlk/ghostty](https://github.com/prdlk/ghostty) |
 | `omarchy.toml` | `~/.config/omarchy` | [prdlk/omarchy](https://github.com/prdlk/omarchy) — `shell.json`, hooks, menu extensions, themed templates; git-installed themes/plugins are gitignored there and restored by its `install-extras` script, `calendars.json` is never committed |
+| `noctalia.toml` | `~/.config/noctalia` | [prdlk/noctalia](https://github.com/prdlk/noctalia) — hand-written `config.toml` (merged under the GUI's unmanaged `~/.local/state/noctalia/settings.toml`); `plugins/` holds runtime state with embedded tokens and is gitignored there. Linux desktop/laptop roles only ([role gate](#chezmoiignore)) |
 
 Edit these in place under `~/.config/<app>`, then commit and push from that checkout.
 
@@ -156,7 +157,7 @@ mise tool versions stay local to each machine and are not managed.
 {{ end }}
 ```
 
-The block is emitted, and these paths skipped, unless the OS is `linux` and the role is `desktop` or `laptop`. `mac` and `server` machines, and any non-Linux machine regardless of role, never receive the niri, Umbriel, and Hyprland configs (`dot_config/niri/`, `dot_config/umbriel/`, `dot_config/hypr/`), the Noctalia config (`dot_config/noctalia/config.toml`), fontconfig (`dot_config/fontconfig/fonts.conf`), default-app associations (`dot_config/mimeapps.list`), the fish auto-start hook (`dot_config/fish/auto-Niri.fish`), the systemd user units (`dot_config/systemd/user/kitty-day-save.service`, `projects-sync.service`, `projects-sync.timer`), or the `niri-launch`, `umbriel-launch`, `umbriel-smart-move`, `cp-appid`, `kitty-day-save` and `projects-sync` scripts. The `niri-dynamic-workspaces` rule matches nothing in the current source tree; it only takes effect if that config is added later.
+The block is emitted, and these paths skipped, unless the OS is `linux` and the role is `desktop` or `laptop`. `mac` and `server` machines, and any non-Linux machine regardless of role, never receive the niri, Umbriel, and Hyprland configs (`dot_config/niri/`, `dot_config/umbriel/`, `dot_config/hypr/`), the Noctalia external (`~/.config/noctalia`, never cloned there), fontconfig (`dot_config/fontconfig/fonts.conf`), default-app associations (`dot_config/mimeapps.list`), the fish auto-start hook (`dot_config/fish/auto-Niri.fish`), the systemd user units (`dot_config/systemd/user/kitty-day-save.service`, `projects-sync.service`, `projects-sync.timer`), or the `niri-launch`, `umbriel-launch`, `umbriel-smart-move`, `cp-appid`, `kitty-day-save` and `projects-sync` scripts. The `niri-dynamic-workspaces` rule matches nothing in the current source tree; it only takes effect if that config is added later.
 
 | Machine | Desktop layer |
 | --- | --- |
@@ -173,12 +174,3 @@ See [Desktop](/desktop/niri) for what the layer contains. Gaps in the gate: the
 ```
 
 Noctalia's umbriel template rewrites this file on every theme change, so it stays out of the repo on every machine. `config.toml` includes it as an optional file; see [Umbriel](/desktop/umbriel#theme).
-
-### Secrets in runtime state
-
-```txt
-.config/noctalia/plugins
-.config/noctalia/plugins/**
-```
-
-noctalia writes plugin state containing embedded tokens here. These paths are ignored on every machine so tokens are never pulled into the repo.

docs/desktop/umbriel.mdx

@@ -5,7 +5,7 @@ description: Umbriel scrolling compositor config — Noctalia-only session, niri
 
 [Umbriel](https://docs.noctalia.dev/umbriel/) is a wlroots scrolling compositor from the Noctalia project. The config ports the [niri](/desktop/niri) layout, rules, springs, and binds, and adds the per-app scratch workspaces from [Hyprland](/desktop/hyprland) as Umbriel scratchpads. The session starts only `noctalia`: its launcher, clipboard history, polkit agent, notifications, and OSD replace vicinae, cliphist, and polkit-gnome.
 
-Noctalia's polkit agent is off by default. `dot_config/noctalia/config.toml` (→ `~/.config/noctalia/config.toml`, merged under the GUI's unmanaged `~/.local/state/noctalia/settings.toml`) sets `[shell] polkit_agent = true`, so `pkexec` and other privileged actions prompt in a Noctalia panel. `polkitd` itself is D-Bus activated (`polkit.service` is static; nothing to enable). The setting also applies under niri, which still starts polkit-gnome: only one agent registers per session, whichever starts first.
+Noctalia's polkit agent is off by default. `~/.config/noctalia/config.toml` (the [prdlk/noctalia](https://github.com/prdlk/noctalia) external, see [externals](/chezmoi/externals-and-ignore#app-externals); merged under the GUI's unmanaged `~/.local/state/noctalia/settings.toml`) sets `[shell] polkit_agent = true`, so `pkexec` and other privileged actions prompt in a Noctalia panel. `polkitd` itself is D-Bus activated (`polkit.service` is static; nothing to enable). The setting also applies under niri, which still starts polkit-gnome: only one agent registers per session, whichever starts first.
 
 :::note
 Linux `desktop` and `laptop` roles only (`.chezmoiignore.tmpl`). `umbriel` and its portal backend `xdg-desktop-portal-umbriel` (screenshots and screen sharing for portal clients) come from the `[cachyos]` repo (`packages.arch.desktop.cachyos`); the AUR `umbriel` is a placeholder and `umbriel-git` conflicts with the repo build, so other Arch machines install them by hand.

dot_config/noctalia/config.toml

@@ -1,9 +0,0 @@
-# Noctalia hand-written config (merged under the GUI's
-# ~/.local/state/noctalia/settings.toml, which is not managed).
-# Reference: https://docs.noctalia.dev/noctalia/configuration/
-
-[shell]
-# Built-in polkit authentication agent: the Umbriel session starts nothing but
-# Noctalia, so without it pkexec and other privileged actions fail with "no
-# agent is available". Only one agent can register per session.
-polkit_agent = true