fix(systemd,scripts): unhardcode /usr/bin paths for nix-migrated tools

The chezmoi-owned user units and ~/.local/bin wrapper scripts called
the migrated tools by absolute /usr/bin/ path. After the move to nix,
those binaries live under ~/.nix-profile/bin (no /usr/bin alias).

systemd user units: drop the /usr/bin/ prefix on cliphist-{text,image}
(wl-paste), inhibridge, swayidle, swayrd, waybar, and the inner wob
in wob.service (outer /usr/bin/sh stays, sh is system). systemd
resolves bare names through the unit's inherited PATH, which includes
~/.nix-profile/bin via hm-session-vars.

dictate: default_model now points at
~/.nix-profile/share/whisper-cpp-models/ggml-base.bin (overridable via
$WHISPER_MODEL). Header rewritten to mention nix instead of AUR.

yt-dlp / streamlink wrappers: pass $HOME/.nix-profile/bin/<tool> to
_sandbox-net-parser so the bwrap-sandboxed binary is resolved
explicitly (the wrappers shadow PATH lookup inside their own
~/.local/bin so re-entry would loop).

11 files changed, 18 insertions, 17 deletions

diff --git a/dot_config/systemd/user/cliphist-image.service b/dot_config/systemd/user/cliphist-image.service
index 5ddab8f..059695b 100644
--- a/dot_config/systemd/user/cliphist-image.service
+++ b/dot_config/systemd/user/cliphist-image.service
@@ -6,7 +6,7 @@ ConditionEnvironment=WAYLAND_DISPLAY
 
 [Service]
 Type=simple
-ExecStart=/usr/bin/wl-paste --type image --watch cliphist store
+ExecStart=wl-paste --type image --watch cliphist store
 Restart=on-failure
 RestartSec=2s
 
diff --git a/dot_config/systemd/user/cliphist-text.service b/dot_config/systemd/user/cliphist-text.service
index 96b0602..5ff00f5 100644
--- a/dot_config/systemd/user/cliphist-text.service
+++ b/dot_config/systemd/user/cliphist-text.service
@@ -6,7 +6,7 @@ ConditionEnvironment=WAYLAND_DISPLAY
 
 [Service]
 Type=simple
-ExecStart=/usr/bin/wl-paste --type text --watch cliphist store
+ExecStart=wl-paste --type text --watch cliphist store
 Restart=on-failure
 RestartSec=2s
 
diff --git a/dot_config/systemd/user/inhibridge.service b/dot_config/systemd/user/inhibridge.service
index a4435bf..0b36b35 100644
--- a/dot_config/systemd/user/inhibridge.service
+++ b/dot_config/systemd/user/inhibridge.service
@@ -7,7 +7,7 @@ ConditionEnvironment=DBUS_SESSION_BUS_ADDRESS
 
 [Service]
 Type=simple
-ExecStart=/usr/bin/inhibridge
+ExecStart=inhibridge
 Restart=on-failure
 RestartSec=2s
 
diff --git a/dot_config/systemd/user/swayidle.service b/dot_config/systemd/user/swayidle.service
index acd0196..d5b9cf1 100644
--- a/dot_config/systemd/user/swayidle.service
+++ b/dot_config/systemd/user/swayidle.service
@@ -6,7 +6,7 @@ ConditionEnvironment=WAYLAND_DISPLAY
 
 [Service]
 Type=simple
-ExecStart=/usr/bin/swayidle -w \
+ExecStart=swayidle -w \
     timeout 300 'swaymsg "output * power off"' \
         resume  'swaymsg "output * power on"' \
     timeout 330 'swaylock -f -e -c 000000' \
diff --git a/dot_config/systemd/user/swayrd.service b/dot_config/systemd/user/swayrd.service
index 82e4164..c718fe5 100644
--- a/dot_config/systemd/user/swayrd.service
+++ b/dot_config/systemd/user/swayrd.service
@@ -7,7 +7,7 @@ ConditionEnvironment=SWAYSOCK
 
 [Service]
 Type=simple
-ExecStart=/usr/bin/swayrd
+ExecStart=swayrd
 Restart=on-failure
 RestartSec=2s
 
diff --git a/dot_config/systemd/user/waybar.service b/dot_config/systemd/user/waybar.service
index fb3a29e..919bc9b 100644
--- a/dot_config/systemd/user/waybar.service
+++ b/dot_config/systemd/user/waybar.service
@@ -6,7 +6,7 @@ ConditionEnvironment=WAYLAND_DISPLAY
 
 [Service]
 Type=simple
-ExecStart=/usr/bin/waybar
+ExecStart=waybar
 ExecReload=/bin/kill -SIGUSR2 $MAINPID
 Restart=on-failure
 RestartSec=2s
diff --git a/dot_config/systemd/user/wob.service b/dot_config/systemd/user/wob.service
index 913136e..c132501 100644
--- a/dot_config/systemd/user/wob.service
+++ b/dot_config/systemd/user/wob.service
@@ -7,7 +7,7 @@ ConditionEnvironment=WAYLAND_DISPLAY
 [Service]
 Type=simple
 ExecStartPre=/usr/bin/sh -c 'rm -f "$XDG_RUNTIME_DIR/wob.sock" && mkfifo "$XDG_RUNTIME_DIR/wob.sock"'
-ExecStart=/usr/bin/sh -c 'exec tail -f "$XDG_RUNTIME_DIR/wob.sock" | /usr/bin/wob'
+ExecStart=/usr/bin/sh -c 'exec tail -f "$XDG_RUNTIME_DIR/wob.sock" | wob'
 ExecStopPost=/usr/bin/rm -f %t/wob.sock
 Restart=on-failure
 RestartSec=2s
diff --git a/dot_local/bin/executable__sandbox-net-parser b/dot_local/bin/executable__sandbox-net-parser
index d998ace..3189d00 100644
--- a/dot_local/bin/executable__sandbox-net-parser
+++ b/dot_local/bin/executable__sandbox-net-parser
@@ -15,7 +15,7 @@
 # Set SANDBOX=0 to bypass entirely for a single invocation:
 #   SANDBOX=0 streamlink weird-stream-url
 #
-# Usage (called by the per-tool wrappers): _sandbox-net-parser /usr/bin/yt-dlp "$@"
+# Usage (called by the per-tool wrappers): _sandbox-net-parser $HOME/.nix-profile/bin/yt-dlp "$@"
 
 set -eu
 
diff --git a/dot_local/bin/executable_dictate b/dot_local/bin/executable_dictate
index dbf89b6..bf1157c 100644
--- a/dot_local/bin/executable_dictate
+++ b/dot_local/bin/executable_dictate
@@ -3,8 +3,9 @@
 # 2nd stops, transcribes via whisper.cpp, types the result into the focused
 # window with wtype, and copies it to the clipboard.
 #
-# Pacman:  pipewire-pulse (parecord), wtype, wl-clipboard, libnotify
-# AUR:     whisper.cpp, whisper.cpp-model-large-v3-turbo-q5_0
+# Pacman:  pipewire-pulse (parecord), libnotify
+# Nix:     whisper-cpp (+ vulkan), whisper-cpp-model-base, wtype, wl-clipboard
+#          (see nix/host.nix)
 #
 # Override via env:
 #   WHISPER_MODEL  path to a ggml-*.bin model
@@ -16,7 +17,7 @@ state_dir="${XDG_RUNTIME_DIR:-/tmp}/dictate"
 pid_file="$state_dir/pid"
 wav_file="$state_dir/audio.wav"
 log_file="$state_dir/whisper.log"
-default_model='/usr/share/whisper.cpp-model-base/ggml-base.bin'
+default_model="$HOME/.nix-profile/share/whisper-cpp-models/ggml-base.bin"
 model="${WHISPER_MODEL:-$default_model}"
 lang="${WHISPER_LANG:-auto}"
 
@@ -29,12 +30,12 @@ is_recording() {
 start_recording() {
   if ! command -v whisper-cli >/dev/null; then
     notify-send -u critical "🎙️ dictate" \
-      "whisper-cli not found. Install whisper.cpp (AUR)."
+      "whisper-cli not found. Run 'just nix-switch' (host profile)."
     exit 1
   fi
   if [ ! -r "$model" ]; then
     notify-send -u critical "🎙️ dictate" \
-      "Model missing: $model. Install whisper.cpp-model-base (AUR)."
+      "Model missing: $model. Run 'just nix-switch' (host profile)."
     exit 1
   fi
   rm -f "$wav_file"
diff --git a/dot_local/bin/executable_streamlink b/dot_local/bin/executable_streamlink
index 67dc122..d13a66d 100644
--- a/dot_local/bin/executable_streamlink
+++ b/dot_local/bin/executable_streamlink
@@ -1,6 +1,6 @@
 #!/usr/bin/env sh
-# Thin wrapper: run /usr/bin/streamlink inside _sandbox-net-parser. The
+# Thin wrapper: run streamlink inside _sandbox-net-parser. The
 # sandbox keeps `/` bind-mounted, so streamlink's configured player
 # (`flatpak run io.mpv.Mpv` — see ~/.config/streamlink/config) is reachable
 # via /usr/bin/flatpak.
-exec _sandbox-net-parser /usr/bin/streamlink "$@"
+exec _sandbox-net-parser "$HOME/.nix-profile/bin/streamlink" "$@"
diff --git a/dot_local/bin/executable_yt-dlp b/dot_local/bin/executable_yt-dlp
index 3298e3f..87947a8 100644
--- a/dot_local/bin/executable_yt-dlp
+++ b/dot_local/bin/executable_yt-dlp
@@ -1,4 +1,4 @@
 #!/usr/bin/env sh
-# Thin wrapper: run /usr/bin/yt-dlp inside _sandbox-net-parser. See that
+# Thin wrapper: run yt-dlp inside _sandbox-net-parser. See that
 # script for the threat model and the SANDBOX=0 escape hatch.
-exec _sandbox-net-parser /usr/bin/yt-dlp "$@"
+exec _sandbox-net-parser "$HOME/.nix-profile/bin/yt-dlp" "$@"