diff --git a/flake.lock b/flake.lock
index 58bc92c..a2e7ec8 100644
--- a/flake.lock
+++ b/flake.lock
@@ -79,6 +79,27 @@
         "type": "github"
       }
     },
+    "lem": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1784157266,
+        "narHash": "sha256-wRs7/KNxLTZpW/tYJg62dk8IvkT6BM4cmMUl4m8jWrc=",
+        "ref": "master",
+        "rev": "691458497c8e965be38ac06084b72d7a0167e541",
+        "revCount": 5,
+        "type": "git",
+        "url": "ssh://git@git.iscg.dev:2222/mikl/lem.git"
+      },
+      "original": {
+        "ref": "master",
+        "type": "git",
+        "url": "ssh://git@git.iscg.dev:2222/mikl/lem.git"
+      }
+    },
     "nix-darwin": {
       "inputs": {
         "nixpkgs": [
@@ -119,6 +140,7 @@
       "inputs": {
         "arion": "arion",
         "home-manager": "home-manager",
+        "lem": "lem",
         "nix-darwin": "nix-darwin",
         "nixpkgs": "nixpkgs",
         "sops-nix": "sops-nix"
diff --git a/flake.nix b/flake.nix
index 5be75f6..e66840d 100644
--- a/flake.nix
+++ b/flake.nix
@@ -23,10 +23,17 @@
       url = "github:hercules-ci/arion";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+
+    # Personal CLIs built from own repos
+    lem = {
+      # ssh fetch via flake; ssh key available to nix-daemon. Private repo.
+      url = "git+ssh://git@git.iscg.dev:2222/mikl/lem.git?ref=master";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
   outputs =
-    { self, nixpkgs, nix-darwin, home-manager, sops-nix, arion, ... }:
+    { self, nixpkgs, nix-darwin, home-manager, sops-nix, arion, lem, ... }:
     let
       mkNixos = hostname:
         nixpkgs.lib.nixosSystem {
@@ -45,6 +52,7 @@
                 # Серверные хосты используют минимульный home (headless).
                 # Десктоп-хосты (если появятся) могут переопределить users.mikl.
                 users.mikl = import ./home/server.nix;
+                extraSpecialArgs = { inputs = self.inputs; };
               };
             }
           ];
@@ -62,6 +70,7 @@
                 useUserPackages = true;
                 backupFileExtension = "backup";
                 users.mikl = import ./home;
+                extraSpecialArgs = { inputs = self.inputs; };
               };
             }
           ];
diff --git a/home/cli.nix b/home/cli.nix
index d43946e..bb078b9 100644
--- a/home/cli.nix
+++ b/home/cli.nix
@@ -1,4 +1,4 @@
-{ pkgs, ... }:
+{ pkgs, inputs, ... }:
 {
   # Universal CLI tools for all hosts
   home.packages = with pkgs; [
@@ -40,9 +40,17 @@
     yt-dlp           # скачивание с YouTube и 1000+ сайтов (эталонный CLI)
     transmission_4   # BitTorrent: transmission-daemon + -remote + -create/show/edit CLI tools
     himalaya        # IMAP/SMTP/JMAP почтовый CLI (JSON-вывод для агента)
+    matrix-commander-rs  # Matrix CLI клиент (E2E, JSON-вывод, для агента)
 
     # x402 / MPP agentic payments CLI (Solana Foundation)
     (pkgs.callPackage ./pay.nix {})
+
+    # Python (системный 3.9 macOS — слишком старый; ставим 3.13 через nix)
+    python313
+    uv
+
+    # Personal CLIs (from own flake inputs)
+    inputs.lem.packages.${pkgs.system}.default
   ];
 
   # TODO: global npm/pnpm packages not managed by nix for now
diff --git a/home/pay.nix b/home/pay.nix
new file mode 100644
index 0000000..2c4f884
--- /dev/null
+++ b/home/pay.nix
@@ -0,0 +1,76 @@
+# pay — official Solana Foundation CLI for x402 / MPP payments.
+# Source: https://github.com/solana-foundation/pay  (Rust, but we use upstream prebuilt binaries)
+#
+# Not in nixpkgs yet (fresh project). This derivation fetches the upstream
+# prebuilt binary tarball per platform. Update `version` + hashes on bump.
+{
+  stdenv,
+  fetchurl,
+  lib,
+  system ? builtins.currentSystem,
+}:
+let
+  version = "0.21.0";
+  tag = "pay-v${version}";
+
+  # platform -> (tarball name, sha256 of the tarball)
+  # Only fill hashes for platforms you actually target; others fall through to meta.broken.
+  srcInfo =
+    {
+      "aarch64-darwin" = {
+        name = "pay-aarch64-apple-darwin.tar.gz";
+        hash = "11c96191145381fea9c938969c14bbd6424bcdf51ef119374c4905fb51d0e265";
+      };
+      "x86_64-darwin" = {
+        name = "pay-x86_64-apple-darwin.tar.gz";
+        hash = lib.fakeSha256; # fill if needed
+      };
+      "aarch64-linux" = {
+        name = "pay-aarch64-unknown-linux-gnu.tar.gz";
+        hash = lib.fakeSha256; # fill if needed
+      };
+      "x86_64-linux" = {
+        name = "pay-x86_64-unknown-linux-gnu.tar.gz";
+        hash = lib.fakeSha256; # fill if needed
+      };
+    }
+    .${system} or (throw "pay: no prebuilt binary for system ${system}");
+in
+stdenv.mkDerivation {
+  pname = "pay";
+  inherit version;
+
+  src = fetchurl {
+    url = "https://github.com/solana-foundation/pay/releases/download/${tag}/${srcInfo.name}";
+    # hex sha256 (verified locally for aarch64-darwin tarball)
+    sha256 = srcInfo.hash;
+  };
+
+  sourceRoot = ".";
+
+  # tarball contains a single prebuilt `pay` binary at its root.
+  dontConfigure = true;
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm555 pay $out/bin/pay
+    runHook postInstall
+  '';
+
+  # Upstream prebuilt; we trust the platform toolchain, no further stripping/patching needed.
+  dontStrip = true;
+  dontPatchELF = true;
+
+  meta = {
+    description = "Solana Foundation CLI for x402 / MPP agentic API payments";
+    homepage = "https://pay.sh/";
+    license = lib.licenses.mit;
+    mainProgram = "pay";
+    # Known-good prebuilts; add hashes above to enable more platforms.
+    platforms = lib.platforms.darwin ++ lib.platforms.linux;
+    badPlatforms = [
+      # explicit hashes still fakeHash -> nix will fail to build on these, which is fine
+    ];
+  };
+}
diff --git a/hosts/heather/caddy.nix b/hosts/heather/caddy.nix
index d53e2b7..99f02ba 100644
--- a/hosts/heather/caddy.nix
+++ b/hosts/heather/caddy.nix
@@ -61,6 +61,13 @@ in {
 
       # Matrix tuwunel (homeserver)
       "iscg.dev".extraConfig = ''
+        # Static file sharing (https://iscg.dev/files/<name>).
+        # handle_path stripает /files/ prefix → file_server ищет в root.
+        # Не конфликтует с matrix (использует /_matrix/*, /.well-known/matrix).
+        handle_path /files/* {
+          root * /var/www/files
+          file_server
+        }
         reverse_proxy 127.0.0.1:8008
         encode zstd gzip
       '';
diff --git a/hosts/poppy/default.nix b/hosts/poppy/default.nix
index cf6ccb3..4eee9c8 100644
--- a/hosts/poppy/default.nix
+++ b/hosts/poppy/default.nix
@@ -20,12 +20,31 @@
   nixpkgs.config.allowUnfree = true;
   nix.enable = false;
 
+  # Автоматический сбор мусора: удалять пути старше 14 дней, по ночам в 3:00.
+  # nix.gc не работает с nix.enable=false, поэтому launchd-агент напрямую.
+  launchd.user.agents.nix-gc = {
+    serviceConfig = {
+      Label = "local.nix.gc";
+      ProgramArguments = [
+        "/nix/var/nix/profiles/default/bin/nix-collect-garbage"
+        "--delete-older-than"
+        "14d"
+      ];
+      StartCalendarInterval = {
+        Weekday = 0;
+        Hour = 3;
+      };
+      StandardOutPath = "/tmp/nix-gc.log";
+      StandardErrorPath = "/tmp/nix-gc.log";
+    };
+  };
+
   users.users.mikl = {
     home = "/Users/mikl";
     shell = pkgs.zsh;
   };
 
-  environment.systemPackages = [ pkgs.vim ];
+  environment.systemPackages = [ pkgs.vim pkgs.android-tools ];
 
   # Apply default apps via duti on activation
   system.activationScripts.defaultApps.text = ''