Add Firefox and Bitwarden to the shared desktop-applications profile

Tom wanted a browser and password manager provisioned declaratively:
Firefox and the Bitwarden desktop client join the existing GUI app
list, and bitwarden-cli joins the developer CLI tools. All three are
free-licensed in current nixpkgs, so no unfree-allowlist change is
needed.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

1 files changed, 29 insertions, 0 deletions

diff --git a/openspec/changes/archive/2026-09-21-add-firefox-bitwarden/proposal.md b/openspec/changes/archive/2026-09-21-add-firefox-bitwarden/proposal.md
new file mode 100644
index 0000000..c67dd12
--- /dev/null
+++ b/openspec/changes/archive/2026-09-21-add-firefox-bitwarden/proposal.md
@@ -0,0 +1,29 @@
+## Why
+
+The shared home-manager profile provisions chat/communication/music GUI apps (`desktop-applications`) and CLI tooling (`developer-environment`), but has no web browser and no password manager. Tom wants Firefox and Bitwarden (desktop app + CLI) available on any machine built from this flake without installing them by hand.
+
+## What Changes
+
+- Add `pkgs.firefox` and nixpkgs' current Bitwarden desktop client package (`pkgs.bitwarden-desktop` — the old `bitwarden` attribute was renamed upstream) to `modules/home/desktop-apps.nix`'s cross-platform app list, following the existing `lib.meta.availableOn` filtering pattern.
+- Add `pkgs.bitwarden-cli` to `modules/home/dev-tools.nix`'s CLI tool list, following the same pattern already used for `claude-code`.
+- No `lib/unfree-allowlist.nix` change: verified via `nix eval` against the flake's pinned `nixos-unstable` nixpkgs that `firefox` (MPL-2.0), `bitwarden-desktop` (GPL-3.0), and `bitwarden-cli` (GPL-3.0) are all free-licensed today, so `nixpkgs.config.allowUnfreePredicate` needs no new entries.
+- Explicitly **not** in scope (per user decision): no OS/XDG default-browser association (`xdg.mimeApps`) and no `programs.firefox` extension/policy management — Firefox extensions, including Bitwarden's, are expected to sync in via Firefox Sync login.
+- **BREAKING**: none — additive only.
+
+## Capabilities
+
+### New Capabilities
+(none)
+
+### Modified Capabilities
+- `desktop-applications`: add a requirement that Firefox and the Bitwarden desktop client are provisioned via the shared home profile alongside the existing Slack/Discord/Spotify/teams-for-linux apps.
+
+(`developer-environment` is unaffected at the requirement level: adding `bitwarden-cli` is already covered by its existing requirement that the shared profile "SHALL include the user's evidenced most-used CLI and client tools," the same reasoning used previously for `claude-code` — no requirement text changes needed.)
+
+## Impact
+
+- **Affected code**: `modules/home/desktop-apps.nix` (add firefox + bitwarden-desktop to `crossPlatformApps`), `modules/home/dev-tools.nix` (add bitwarden-cli to the CLI package list).
+- **Not affected**: `lib/unfree-allowlist.nix`, `lib/mkHome.nix`, `lib/mkNixos.nix` — all three new packages are free-licensed, so the existing `allowUnfreePredicate` wiring needs no changes.
+- **Dependencies**: nixpkgs' `firefox`, `bitwarden-desktop`, and `bitwarden-cli` packages (all already present in the pinned `nixos-unstable` input; no new flake inputs).
+- **Platforms**: all three packages have `aarch64-darwin` and `x86_64-linux`/`aarch64-linux` builds in nixpkgs today, so they're expected to be included on every currently-relevant target (`tom@linux`, `tom@darwin`) via the existing `lib.meta.availableOn` filter — no platform-specific gating (like teams-for-linux's Linux-only restriction) is needed for this change.
+- **Known limitation, out of scope**: no default-browser (XDG mime) or Firefox extension/policy management, by explicit user decision — see "What Changes".