jellyfin-mcp: real vendorHash for 2026.1015.1

Reviewed-on: #15

packages/default.nix

@@ -32,5 +32,6 @@
   yarr = pkgs.callPackage ./yarr/package.nix { };
   pdf-mcp = pkgs.callPackage ./pdf-mcp/package.nix { };
   mcp-searxng = pkgs.callPackage ./mcp-searxng/package.nix { };
+  python-ssh-mcp = pkgs.callPackage ./python-ssh-mcp/package.nix { };
   # example-mcp-server = pkgs.callPackage ./example-mcp-server/package.nix { };
 }

packages/jellyfin-mcp/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "jellyfin-mcp";
-  version = "2026.604.2";
+  version = "2026.1015.1";
 
   src = fetchFromGitHub {
     owner = "jaredtrent";
     repo = "jellyfin-mcp";
     tag = "v${version}";
-    hash = "sha256-Ks54txfOAkNEWfhl5ZXEIaFzAbmCnwhHtN1+FIa7dgo=";
+    hash = "sha256-5wSYB/peTbvNYDlDBd2M0nA7JreP93nQe1G9rW3hv2I=";
   };
 
-  vendorHash = "sha256-cDy+PpZM6xL7ur/xq81y4vlyaDnSOpGkyVV2hh8qI7o=";
+  vendorHash = "sha256-L39HdshrVfVXD+rV3prsKQRosvidynwIlA9J6dtfqmU=";
 
   meta = with lib; {
     description = "MCP server for Jellyfin media server — search, playback, metadata, admin";

packages/python-ssh-mcp/package.nix

@@ -0,0 +1,86 @@
+{
+  lib,
+  python313Packages,
+  fetchFromGitHub,
+  fetchPypi,
+}:
+
+# Upstream pins `requires-python = ">=3.11,<3.14"`, so this must NOT be built
+# with the default `python3Packages` (which is 3.14.x on nixos-unstable and
+# would be rejected by the build backend's requires-python check). Pin the
+# 3.13 package set explicitly.
+#
+# `fastmcp[tasks]` is a HARD runtime dependency: `src/ssh_mcp/tools/exec_tools.py`
+# does `from fastmcp.server.tasks import TaskConfig` at import time, and the
+# decorator validates at import. nixpkgs' `fastmcp` installs only the
+# client+server extras (optional-dependencies are passthru-only in nix and
+# install nothing), so the `tasks` extra's backend -- pydocket -- has to be
+# listed explicitly or the server crashes at startup.
+let
+  # Internal dependency: upstream pins `unidiff>=0.7.5,<0.8.0`, but nixpkgs only
+  # carries 1.0.0. The 0.7.x API surface used by the ssh_edit tool
+  # (`PatchSet.from_string` and hunk iteration) is unchanged in 1.0.0, but
+  # buildPythonApplication's runtime-dep check enforces the specifier, so the
+  # pinned version still has to be provided. 0.7.5 is sdist-only on PyPI
+  # (no wheel), so this is a source build.
+  unidiff = python313Packages.buildPythonPackage rec {
+    pname = "unidiff";
+    version = "0.7.5";
+
+    pyproject = true;
+    build-system = [ python313Packages.setuptools ];
+
+    src = fetchPypi {
+      inherit pname version;
+      hash = "sha256-Ll8BYgUiSJRrnwlwpA6eEkI2v4bIK3CCEUOm/B3qJXQ=";
+    };
+
+    doCheck = false;
+    pythonImportsCheck = [ "unidiff" ];
+
+    meta = with lib; {
+      description = "Unified diff parsing and application";
+      homepage = "https://github.com/matiasb/python-unidiff";
+      license = licenses.mit;
+    };
+  };
+in
+python313Packages.buildPythonApplication rec {
+  pname = "python-ssh-mcp";
+  version = "1.5.2";
+
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "Nightreaver";
+    repo = "python-ssh-mcp";
+    rev = "73c00c9b0d26add59798bc7b39dff88ac547b15a"; # v1.5.2
+    hash = "sha256-OfwOiBan5sqGEs/zzHHC4vJdcALOLWaIr8uENCbQ4FU=";
+  };
+
+  build-system = [ python313Packages.hatchling ];
+
+  dependencies = with python313Packages; [
+    fastmcp
+    pydocket # the fastmcp[tasks] extra
+    asyncssh
+    pydantic
+    pydantic-settings
+    unidiff
+  ];
+
+  # Upstream ships no importable test suite in the sdist workflow used here
+  # (its 1649 tests need the dockerized sshd fixtures); skip and rely on the
+  # import check + the smoke test below.
+  doCheck = false;
+  pythonImportsCheck = [ "ssh_mcp" ];
+
+  meta = with lib; {
+    description = "SSH MCP server for multi-host systemd/docker/apt administration (read-only by default, tiered)";
+    homepage = "https://github.com/Nightreaver/python-ssh-mcp";
+    license = licenses.gpl3Only;
+    mainProgram = "ssh-mcp";
+    platforms = platforms.all;
+    maintainers = [ ];
+  };
+}

packages/zotero-mcp/package.nix

@@ -93,27 +93,31 @@ python3Packages.buildPythonApplication rec {
     # anything needed at runtime must live in this list.
     pymupdf
     ebooklib
+    # Runtime deps for the semantic-search tools (upstream "semantic" extra).
+    # zotero_mcp.semantic_search imports chromadb unconditionally at module
+    # scope (embeddings/providers/__init__.py, chroma_client.py), so these are
+    # hard requirements, not truly optional at runtime.
+    chromadb
+    sentence-transformers
+    openai
+    google-genai
+    tiktoken
   ];
 
-  # Optional extras (semantic search, PDF, scite).
-  # NOTE: buildPythonApplication stores these in passthru only and does NOT
-  # install them; adding an extra here has no runtime effect.
-  optional-dependencies = with python3Packages; {
-    semantic = [
-      chromadb
-      sentence-transformers
-      openai
-      google-genai
-      tiktoken
-    ];
-    pdf = [
-      pymupdf
-      ebooklib
-    ];
-    scite = [
-      requests
-    ];
-  };
+  # `zotero_get_pdf_outline` reads a PDF's table of contents in a throwaway
+  # `sys.executable -c ...` child (tools/write.py, _extract_pdf_toc). Under the
+  # Nix wrapper this package's dependencies are injected into the *parent*
+  # interpreter via site.addsitedir, never exported as PYTHONPATH, so the child
+  # gets a bare sys.path and its `import pymupdf` fails. The tool then reports
+  # "PyMuPDF (fitz) is required..." even though PyMuPDF is a build input.
+  # Forward the parent's sys.path so the child resolves the same modules.
+  # Mirrors nixpkgs' python-modules/vllm/0003-propagate-pythonpath.patch.
+  postPatch = ''
+    substituteInPlace src/zotero_mcp/tools/write.py \
+      --replace-fail \
+        'child_env.setdefault("PYTHONUTF8", "1")' \
+        'child_env.setdefault("PYTHONUTF8", "1"); child_env["PYTHONPATH"] = os.pathsep.join(p for p in sys.path if p)'
+  '';
 
   pythonImportsCheck = [ "zotero_mcp" ];