setup pilegram

Author: ngalaiko

README.md

@@ -67,6 +67,21 @@ nodes; use an ephemeral key so retired ones auto-clean (see step 3).
      may suffix it (`computer-1`) until the stale one is culled; exe.dev's
      public share is the stable public path if that matters.
 
+5. Place the Telegram gateway (pilegram) secrets — the bot token and your
+   allow-listed Telegram user id(s) — so the `assistant-gateway` service can
+   start. They stay out of this (public) repo and the image; the file lives
+   under the assistant home and is backed up, so it's restored on recreation:
+
+   ```
+   sudo install -d -o 2001 -g 2001 -m 700 /var/lib/assistant/.config/pilegram
+   sudo sh -c 'umask 077; printf "TELEGRAM_BOT_TOKEN=%s\nPILEGRAM_ALLOW=%s\n" "123456:AA..." "111222333" > /var/lib/assistant/.config/pilegram/env'
+   sudo chown 2001:2001 /var/lib/assistant/.config/pilegram/env
+   ```
+
+   `PILEGRAM_ALLOW` is comma-separated numeric Telegram user ids. In BotFather,
+   enable **Threaded Mode** so each Telegram topic is its own agent session. The
+   service retries every 10s until the file exists.
+
 ## Configuration
 
 ### Backups

flake.lock

@@ -2,21 +2,28 @@
   description = "Nix-built OCI image for exe.dev machines";
 
   inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
-    # 25.11 atuin (18.10) is too old for a DB migrated by a newer atuin.
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05";
+    # stable's atuin is older than the one that migrated the local atuin DB, so
+    # atuin (and other fast-moving tools) pin unstable — see
+    # hosts/macbook/home/atuin.nix and packages/unstable.nix.
     nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
     nix-darwin = {
-      url = "github:nix-darwin/nix-darwin/nix-darwin-25.11";
+      url = "github:nix-darwin/nix-darwin/nix-darwin-26.05";
       inputs.nixpkgs.follows = "nixpkgs";
     };
     home-manager = {
-      url = "github:nix-community/home-manager/release-25.11";
+      url = "github:nix-community/home-manager/release-26.05";
       inputs.nixpkgs.follows = "nixpkgs";
     };
     nixvim = {
-      url = "github:nix-community/nixvim/nixos-25.11";
+      url = "github:nix-community/nixvim/nixos-26.05";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    # my pi ⇄ Telegram gateway (the assistant's bridge). Deliberately does NOT
+    # follow our nixpkgs, even though both track 26.05: it's a hermetic flake
+    # whose node_modules is a fixed-output derivation pinned to its own nixpkgs'
+    # bun, and repinning bun (even across 26.05 revs) would break that hash.
+    pilegram.url = "github:ngalaiko/pilegram";
   };
 
   outputs =