chore(packages): bump packages to latest upstream versions

Update every package to its newest upstream release/commit:
- aionui 2.1.50 -> 2.2.2
- awg-tool 0.2.2 -> 0.3.0
- ds4 -> 0-unstable-2026-09-12
- freebuff 0.0.142 -> 0.0.174
- graphify 0.9.35 -> 0.9.61
- hipengine 0.3.0 -> 0.5.0
- mcp-gateway 3.4.0 -> 3.5.1
- omniroute 3.8.49 -> 3.8.50
- radar 1.9.1 -> 1.13.1
- relay-free-llm -> 0-unstable-2026-08-31
- traycer 1.1.10 -> 1.3.0

Refresh all source/dependency hashes (src, cargoHash, vendorHash,
npmDepsHash, bun FODs) and keep treefmt clean.

Packaging fixes required by the bumps:
- graphify: relax the setuptools>=83 build-backend pin (nixpkgs ships
  setuptools 80.x; the PEP 639 metadata needs only >=77).
- hipengine: add a llguidance 1.8.0 override (nixpkgs ships 1.7.x).
- omniroute: use npmDepsFetcherVersion 2; the v1 fetcher drops packages
  whose lockfile entries lack resolved URLs, breaking npm's cache check.
- radar: fix a frontend npmDepsHash/vendorHash swap from nix-update.

Packages already at latest are untouched: container-use, desloppify,
freetoken, kubernetes-mcp-server, loop, nftables-analyzer,
nftablesbuilder, stakpak, haivemind, skillsmcp. llama-cpp stays pinned
at b9645 and is tracked separately (manual HIP flag re-validation).

.beads/issues.jsonl

@@ -1,3 +1,4 @@
+{"_type":"issue","id":"nix-overlay-cfk","title":"Update all packages to latest upstream versions","description":"Bump every package in packages/ to its latest available upstream version, refresh hashes (src, cargoHash, vendorHash, npm deps, bun2nix, appimage, etc.), verify builds, and update README. Packages: aionui, awg-tool, container-use, desloppify, ds4, freebuff, freetoken, graphify, haivemind, hipengine, kubernetes-mcp-server, llama-cpp, loop, mcp-gateway, nftables-analyzer, nftablesbuilder, omniroute, radar, relay-free-llm, skillsmcp, stakpak, traycer.","status":"in_progress","priority":2,"issue_type":"task","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-09-13T13:59:31Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-09-13T13:59:35Z","started_at":"2026-09-13T13:59:35Z","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"nix-overlay-05o","title":"Add llama-cpp package (build 9645) to overlay","description":"Port the pinned llama.cpp b9645 derivation from nixos-config/modules/llm-engine.nix into packages/llama-cpp/ (default.nix + package.nix). ROCm + Vulkan enabled, znver5 CPU flags, strix-halo gfx1151 orientation. Must build via nix build .#llama-cpp.","status":"closed","priority":2,"issue_type":"feature","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-09-13T09:22:26Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-09-13T10:33:35Z","started_at":"2026-09-13T09:22:28Z","closed_at":"2026-09-13T10:33:35Z","close_reason":"llama-cpp b9645 packaged in packages/llama-cpp, built and smoke-tested on gfx1151 (ROCm + Vulkan)","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"nix-overlay-6y6","title":"Add Loop corporate messenger package","description":"Add Loop - Corporate messenger for your team. Distributed as x86-64 binary from https://artifacts.wilix.dev/repository/loop-files/loop-6.0.3/loop-desktop-6.0.3-linux-x64.tar.gz","status":"closed","priority":2,"issue_type":"feature","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-05-29T16:41:37Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-05-29T16:51:32Z","started_at":"2026-05-29T16:42:02Z","closed_at":"2026-05-29T16:51:32Z","close_reason":"Closed","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"nix-overlay-cdt","title":"radar-1.6.1","description":"update package radar to v1.6.1","status":"closed","priority":2,"issue_type":"task","owner":"alex@millerson.name","created_at":"2026-05-17T12:41:54Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-05-17T13:03:38Z","closed_at":"2026-05-17T13:03:38Z","close_reason":"Closed","dependency_count":0,"dependent_count":0,"comment_count":0}
@@ -12,3 +13,4 @@
 {"_type":"issue","id":"nix-overlay-dcx","title":"nix-overlay-2lr-2 · Approach 2: bun2nix генерация пакетов [parent:nix-overlay-2lr]","notes":"Skipping bun2nix — требует staging branch, неочевидная поддержка npm lockfiles. Проще перейти к Approach 3 (ручной stdenv.mkDerivation с nodejs/npm).","status":"closed","priority":2,"issue_type":"task","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-05-11T09:38:06Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-05-11T10:23:18Z","started_at":"2026-05-11T10:21:04Z","closed_at":"2026-05-11T10:23:18Z","dependencies":[{"issue_id":"nix-overlay-dcx","depends_on_id":"nix-overlay-2lr","type":"parent-child","created_at":"2026-05-11T12:42:12Z","created_by":"Alexander Miroshnichenko","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"nix-overlay-3ik","title":"nix-overlay-2lr-1 · Approach 1: buildNpmPackage + buildGoModule с npmDepsFetcherVersion=2 [parent:nix-overlay-2lr]","notes":"fetchNpmDeps v2 не resolves workspace-scoped packages (@vitejs/plugin-react ENOTCACHED). Approach blocked — same issue as previous attempt. Moving to Approach 2 (bun2nix).","status":"closed","priority":2,"issue_type":"task","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-05-11T09:37:43Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-05-11T10:20:38Z","started_at":"2026-05-11T09:39:05Z","closed_at":"2026-05-11T10:20:38Z","dependencies":[{"issue_id":"nix-overlay-3ik","depends_on_id":"nix-overlay-2lr","type":"parent-child","created_at":"2026-05-11T12:41:54Z","created_by":"Alexander Miroshnichenko","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"nix-overlay-2lr","title":"radar","description":"Используй karpathy-guidelines и Sequential Thinking для планирования шаг за шагом добавления нового пакета https://github.com/skyhook-io/radar.git в данный NIXOS overlay-репозиторий. Разбей задачу на подзадачи, используя beads. В написании кода используй mcp: nixos, refContext и context7.\n\n\n\n## Required Skills\ncaveman,karpathy-guidelines,nix,nix-flakes","notes":"Все 3 подхода провалены. fetchNpmDeps v2 НЕ работает с npm workspaces вопреки release notes - ENOTCACHED для workspace-scoped пакетов (@vitejs/plugin-react). Ручной сбор node_modules без npm ci слишком сложен (требует reimplement fetchNpmDeps). Текущее решение: pre-built binary из GitHub Releases. Нужно дождаться исправления fetchNpmDeps v2 в nixpkgs или upstream поддержки standalone lockfile для web/.","status":"closed","priority":2,"issue_type":"feature","assignee":"Alexander Miroshnichenko","owner":"alex@millerson.name","created_at":"2026-05-10T19:28:56Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-05-11T11:24:40Z","started_at":"2026-05-10T19:30:31Z","closed_at":"2026-05-11T11:24:40Z","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"nix-overlay-k38","title":"Bump llama-cpp pin b9645 -\u003e b10944","description":"packages/llama-cpp pins ggml-org/llama.cpp to b9645 and intentionally removes passthru.updateScript. Upstream latest is b10944. The nixpkgs llama-cpp skeleton and custom HIP/cmake flags (gfx1151 Strix Halo) target b9645; a bump needs re-validating flags (e.g. hipBLASLt/rocWMMA/unified-memory) and a full ROCm rebuild. Do manually per the comment in package.nix.","status":"open","priority":3,"issue_type":"task","owner":"alex@millerson.name","created_at":"2026-09-13T18:05:55Z","created_by":"Alexander Miroshnichenko","updated_at":"2026-09-13T18:05:55Z","dependency_count":0,"dependent_count":0,"comment_count":0}

packages/aionui/package.nix

@@ -15,13 +15,13 @@
 }:
 
 let
-  version = "2.1.50";
+  version = "2.2.2";
 
   src = fetchFromGitHub {
     owner = "iOfficeAI";
     repo = "AionUi";
     rev = "v${version}";
-    hash = "sha256-NsKygGMRN5pQXyKaehVW/sC2tyd4KmrYmiQrr5ZGeNY=";
+    hash = "sha256-HyDzlUOg0OAGNhNveG/5Ba2UbgoR4VTQsbUGUzGmKd4=";
   };
 
   # FOD 1: All dependencies (dev + prod) for the build phase.
@@ -34,7 +34,7 @@ let
     ];
     outputHashAlgo = "sha256";
     outputHashMode = "recursive";
-    outputHash = "sha256-EeDapBXeiU/70N92ka1dmrKUMEDN65FON8VPVPsBfro=";
+    outputHash = "sha256-+vLK5f1rhcXAhHz0v1LkMbcBjBLFCHVTWbdamZIjOwY=";
     dontPatchShebangs = true;
     dontFixup = true;
     SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
@@ -63,7 +63,7 @@ let
     ];
     outputHashAlgo = "sha256";
     outputHashMode = "recursive";
-    outputHash = "sha256-L2UV+OsHfoQTsc1s+tBrJZtnoiCcB2mlnsAHbplTggc=";
+    outputHash = "sha256-CzVH9zQsssdkCX/BpUxQw1wnJQKzLYWWXZt3sn7eBFI=";
     dontPatchShebangs = true;
     dontFixup = true;
     SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";

packages/awg-tool/package.nix

@@ -8,13 +8,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "awg-tool";
-  version = "0.2.2";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "Vadim-Khristenko";
     repo = "awg-containers-and-tools";
     rev = "v${version}";
-    hash = "sha256-z4LG+z60uqsfkRyt7Dc8Fc5GMfpiF7G0N9PXnzTUJms=";
+    hash = "sha256-IRi2LPTDLT6qfuolCUHSJWaXTg5pt/kqVlosxqCMQDs=";
   };
 
   # awg-core builds ssh2 with vendored-openssl, which compiles libssh2
@@ -24,7 +24,7 @@ rustPlatform.buildRustPackage rec {
     perl
   ];
 
-  cargoHash = "sha256-Nb5tmwvhzKAldHai7yxtYapjbZmai0ujBX9c6nRGZk0=";
+  cargoHash = "sha256-7sDpdjvA3kAHtwQ2qmpRPQywmyQBXZzM2ClfLKbGoKc=";
 
   # Upstream tests exercise Docker/SSH targets; unit tests are already
   # covered by the upstream CI before a release is cut.

packages/ds4/default.nix

@@ -1,2 +1 @@
-{ pkgs, ... }:
+{ pkgs, ... }: pkgs.callPackage ./package.nix { }
-pkgs.callPackage ./package.nix { }

packages/ds4/package.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation {
   pname = "ds4";
-  version = "0-unstable-2026-08-05";
+  version = "0-unstable-2026-09-12";
 
   src = fetchFromGitHub {
     owner = "antirez";
     repo = "ds4";
-    rev = "b0309611041655f4e45671cfd9c9886aff161406";
+    rev = "bd66c402070042bf0a79ad6ece8242de4c93680c";
-    hash = "sha256-yBPQqX8oI9fElGiXfz72iWwIS8ZQpK4Bl9TWLZSa6JU=";
+    hash = "sha256-F/MKv3/0Oj8DLa+q6jMtv0wFDgUvii+Xo2f1dPBDg6A=";
   };
 
   nativeBuildInputs = [

packages/freebuff/package.nix

@@ -9,11 +9,11 @@
 }:
 
 let
-  version = "0.0.142";
+  version = "0.0.174";
 
   freebuffSrc = fetchurl {
     url = "https://registry.npmjs.org/freebuff/-/freebuff-${version}.tgz";
-    hash = "sha256-8DSNy/wJqLzp7mu2xsPBlMv69aBMIBNVva3SAaV13Tw=";
+    hash = "sha256-o767MqjDbhiu+Zy3Jc/43kBNIgLVLEgqC7D3GwtU0hg=";
   };
 
   pkgTar = fetchurl {
@@ -48,14 +48,14 @@ let
 
   binarySrc = fetchurl {
     url = "https://github.com/CodebuffAI/codebuff-community/releases/download/freebuff-v${version}/freebuff-linux-x64.tar.gz";
-    hash = "sha256-SuV5djfrvRZZ59p+dUyiux+OmEMOxscuIU5/YDGWHYI=";
+    hash = "sha256-W/+lPhdHxq0a5TWY/JodAuP2hLpCGlLU7E8SoNe+OYA=";
   };
 
 in
 
 stdenv.mkDerivation rec {
   pname = "freebuff";
-  version = "0.0.142";
+  version = "0.0.174";
 
   src = freebuffSrc;
 

packages/graphify/package.nix

@@ -6,14 +6,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "graphify";
-  version = "0.9.35";
+  version = "0.9.61";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "safishamsi";
     repo = "graphify";
     rev = "v${version}";
-    hash = "sha256-HESowqiR5c6WaeiNj1WDSYBzrrcpZQwqaKwQxroePD8=";
+    hash = "sha256-9AEbHmqqZv/fBioUMNv60KAb/FpvWpwC6QhGSdBxISs=";
   };
 
   build-system = with python3Packages; [
@@ -40,6 +40,9 @@ python3Packages.buildPythonApplication rec {
   # either `>` (versioned) or `"` (bare) via alternation. This also avoids
   # prefix collisions (e.g. tree-sitter-c vs tree-sitter-c-sharp).
   postPatch = ''
+    # relax the build-backend pin: nixpkgs' setuptools is older than 83, but
+    # the PEP 639 license metadata graphify relies on needs only >=77.
+    sed -i 's/setuptools>=83\.[0-9.]*/setuptools/' pyproject.toml
     sed -i \
       -e '/tree-sitter-typescript>\|tree-sitter-typescript"/d' \
       -e '/tree-sitter-go>\|tree-sitter-go"/d' \

packages/hipengine/default.nix

@@ -1,2 +1,30 @@
-{ pkgs, ... }:
+{
-pkgs.callPackage ./package.nix { }
+  pkgs,
+  ...
+}:
+# hipEngine >= 0.5.0 requires llguidance >= 1.8,<2; nixpkgs only provides
+# 1.7.x. Override nixpkgs' llguidance to 1.8.0 and hand the resulting
+# interpreter/package set to the package.
+let
+  python = pkgs.python3.override {
+    packageOverrides = self: super: {
+      llguidance = super.llguidance.overridePythonAttrs (old: rec {
+        version = "1.8.0";
+        src = pkgs.fetchFromGitHub {
+          owner = "guidance-ai";
+          repo = "llguidance";
+          tag = "v${version}";
+          hash = "sha256-/rHTefKTq5ch38NqbcLYTXBJwkW+WzG5OFvignDIie4=";
+        };
+        cargoDeps = pkgs.rustPlatform.fetchCargoVendor {
+          pname = "llguidance";
+          inherit src version;
+          hash = "sha256-aa9R+6xgFVGAD3snHbkPRF5jMYwC3DFNjXcUtaOzDbU=";
+        };
+      });
+    };
+  };
+in
+python.pkgs.callPackage ./package.nix {
+  python3Packages = python.pkgs;
+}

packages/hipengine/package.nix

@@ -6,14 +6,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "hipengine";
-  version = "0.3.0";
+  version = "0.5.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "shisa-ai";
     repo = "hipEngine";
     rev = "v${version}";
-    hash = "sha256-lnYsXTxke5LLMbHOt6i2FM8IrnHCimC/va1fJL5G4PQ=";
+    hash = "sha256-xjVpdr2avDKA2IoXA9W5Q/c6cT+G/BxrTDzjP5Tm+3Y=";
   };
 
   build-system = with python3Packages; [
@@ -23,6 +23,7 @@ python3Packages.buildPythonApplication rec {
   dependencies = with python3Packages; [
     fastapi
     jinja2
+    llguidance
     numpy
     safetensors
     tokenizers

packages/loop/default.nix

@@ -1,2 +1 @@
-{ pkgs, ... }:
+{ pkgs, ... }: pkgs.callPackage ./package.nix { }
-pkgs.callPackage ./package.nix { }

packages/mcp-gateway/package.nix

@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mcp-gateway";
-  version = "3.4.0";
+  version = "3.5.1";
 
   src = fetchFromGitHub {
     owner = "MikkoParkkola";
     repo = "mcp-gateway";
     rev = "v${version}";
-    hash = "sha256-shn2cv463SnegamsMu6NmfylnNaFzGJLoL2H7QhETY8=";
+    hash = "sha256-fcH2einyG9bNNLKZPomAlfGonNw0rw+TuwlYw38531E=";
   };
 
-  cargoHash = "sha256-XuOYuYapb2l7RHQIgLDfcDPtSdMDpEgti8Ud5ssuGC8=";
+  cargoHash = "sha256-3QI7s5IpxbW9nvnk3X3xuUopNQJZftANN5BtbQNhKrY=";
 
   nativeBuildInputs = [ pkg-config ];
 

packages/omniroute/package.nix

@@ -8,10 +8,10 @@
 }:
 
 let
-  version = "3.8.49";
+  version = "3.8.50";
   npmTarball = fetchurl {
     url = "https://registry.npmjs.org/omniroute/-/omniroute-${version}.tgz";
-    hash = "sha256-fcGsAxOdv1ZSwt24eHJu97lyRATKBw8rYeFvGTRhxYs=";
+    hash = "sha256-c4xYrx+q6MV+tkOpOdEZH41+CD2Sle9haH0r/wSHjCk=";
   };
 in
 
@@ -23,12 +23,16 @@ buildNpmPackage (finalAttrs: {
     owner = "diegosouzapw";
     repo = "OmniRoute";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-nRLziV4NWPoa0ev57DV7jmAvLpL/1MP1EMZO2/drrTU=";
+    hash = "sha256-+2FMc9wrvPtQS3+mGsBVvKrd5RprYe/r/GJvjAVMBpc=";
   };
 
   nodejs = nodejs_22;
 
-  npmDepsHash = "sha256-R0u93MLUUWC8xFgq4S0Aj/7wg4pygTKwxP/eWkWMgCw=";
+  # Upstream's package-lock omits `resolved` URLs for some entries, which the
+  # v1 fetcher drops from the cache (npm then fails with ENOTCACHED).
+  npmDepsFetcherVersion = 2;
+
+  npmDepsHash = "sha256-wa5vQMYugA8E7lXOh4lgNH7JNbKOinNaW6Zk8Mw2e8k=";
 
   # Skip Next.js build (requires network for Google Fonts).
   # Pre-built dist/ is copied from the npm tarball in preConfigure.

packages/radar/package.nix

@@ -6,13 +6,13 @@
 }:
 
 let
-  version = "1.9.1";
+  version = "1.13.1";
 
   src = fetchFromGitHub {
     owner = "skyhook-io";
     repo = "radar";
     rev = "v${version}";
-    hash = "sha256-VZLzmxW86yMtYILhmKswkj57KD4Z+8ILwHKiO53YMWE=";
+    hash = "sha256-jRcX7wv+uHxH2hoYSoLEjcVnuRGAnrTt4tbwZozDb7Y=";
   };
 
   # Build the frontend as a separate derivation.
@@ -26,7 +26,7 @@ let
     # Upstream lockfile ships complete resolved/integrity fields for all
     # packages since v1.9.x, so no lockfile patching is needed anymore.
 
-    npmDepsHash = "sha256-9xS5ChQ1xBix/n9N8vyBsHlHYmYXsibTK5J+X6mRgM4=";
+    npmDepsHash = "sha256-TuSBPGktl6s1adHWbP81+TOEZufo5y2gwiUnfiaLoOc=";
     npmDepsFetcherVersion = 2;
     makeCacheWritable = true;
 
@@ -54,7 +54,7 @@ buildGoModule {
   pname = "radar";
   inherit version src;
 
-  vendorHash = "sha256-d26tlh+Twv9GFX6NmR25Q9OpP/pUL2T4grdncQHYSg4=";
+  vendorHash = "sha256-sFlj1sE+ciXQauReWm3mLQZK21lqTaU4cAj06flpx30=";
 
   # Copy pre-built frontend assets before Go compilation for go:embed
   preBuild = ''

packages/relay-free-llm/package.nix

@@ -59,14 +59,14 @@ let
 in
 python3Packages.buildPythonApplication {
   pname = "relay-free-llm";
-  version = "0.1.0+unstable";
+  version = "0-unstable-2026-08-31";
   format = "other";
 
   src = fetchFromGitHub {
     owner = "msmarkgu";
     repo = "RelayFreeLLM";
-    rev = "96e6c48a552755bf250c3155b14176916c69d8d8";
+    rev = "9a1aabe1905ac1d6b3d48ac492089a0ea9668388";
-    hash = "sha256-SNux6hVOij+2kYFH/gUQQj8QLfxGzjcdakkZ48AIWPU=";
+    hash = "sha256-DjHaskOW28g9BEI1TbMwuDgcEH4++VEMmXUzpqZ9KMc=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

packages/traycer/package.nix

@@ -5,10 +5,10 @@
 }:
 
 let
-  version = "1.1.10";
+  version = "1.3.0";
   src = fetchurl {
     url = "https://github.com/traycerai/traycer/releases/download/desktop-v${version}/traycer-desktop-linux-x86_64.AppImage";
-    hash = "sha256-+aSlqX1RCpbKuV0j7xEBMQDAq/IzpvCC5XZ/psQJcjY=";
+    hash = "sha256-iDpbpDpd0OeRGTKwUVRYiIpRSltnAIb59W+yIfH8HFU=";
   };
   appimageContents = appimageTools.extractType2 {
     pname = "traycer";