firstrun: put mise-installed AI agents on PATH via profile.d shims

Add /etc/profile.d/mise-shims.sh so globally-installed mise tools
(claude, codex, opencode, gemini, node) are runnable from any login
shell — including non-interactive `ssh host <cmd>` — without relying on
`mise activate` in dotfiles. Run `mise reshim` after the agent install
so the shims exist, and install node@latest first since gemini-cli is
npm-based.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

omalocal.sh

@@ -336,6 +336,25 @@ esac
 PROFILE_LOCAL_BIN
 chmod 644 /mnt/etc/profile.d/local-bin.sh
 
+# ---------------------------------------------- mise shims on PATH ----------
+# Put mise's shims dir on PATH for every login shell so globally-installed mise
+# tools (claude, codex, opencode, gemini, node, ...) are runnable from the
+# command line — including non-interactive `ssh host <cmd>` runs — without
+# depending on `mise activate` being wired into the user's dotfiles. The dir is
+# created by mise the first time a tool is installed; the [ -d ] guard means
+# this is a no-op until then, then takes effect on the next login shell.
+echo "==> Adding mise shims to PATH for all login shells..."
+cat > /mnt/etc/profile.d/mise-shims.sh <<'PROFILE_MISE_SHIMS'
+# Add mise's shims dir to PATH for login shells (idempotent).
+mise_shims="${MISE_DATA_DIR:-${XDG_DATA_HOME:-$HOME/.local/share}/mise}/shims"
+case ":$PATH:" in
+  *":$mise_shims:"*) ;;
+  *) [ -d "$mise_shims" ] && PATH="$mise_shims:$PATH" ;;
+esac
+unset mise_shims
+PROFILE_MISE_SHIMS
+chmod 644 /mnt/etc/profile.d/mise-shims.sh
+
 # ---------------------------------------------------- omalocal first-run ------
 # Offer to install omaterm on the user's first *interactive* login. This box is
 # headless + key-only SSH, so "first boot" really means "first ssh login" — a
@@ -400,20 +419,29 @@ case "$ans" in
     # bare-metal omaterm.org installer — they're mise tools that only the Docker
     # image bakes in. Offer to add them here via mise. mise itself comes with
     # OMATERM (pacman), so it's on PATH even before this shell sources its hooks.
+    # gemini (@google/gemini-cli) is an npm package, so it needs Node — which the
+    # bare-metal OMATERM install does NOT provide. Install node@latest first or
+    # gemini fails with "npm not found"; the other three are standalone binaries.
     if [ "$omaterm_ok" = 1 ] && command -v mise >/dev/null 2>&1; then
       echo
       read -rp "  Install AI agents (opencode, claude-code, codex, gemini) via mise? [Y/n] " ans </dev/tty
       case "$ans" in
         [Nn]*)
-          echo "        Skipped. Add later with: mise use -g opencode claude-code codex gemini"
+          echo "        Skipped. Add later with: mise use -g node@latest opencode claude-code codex gemini"
           ;;
         *)
           echo "        Installing agents (this can take a while)..."
-          if mise use -g -y opencode claude-code codex gemini; then
+          # node@latest first: gemini-cli is npm-based and needs it.
+          if mise use -g -y node@latest opencode claude-code codex gemini; then
+            # Generate shims so claude/codex/opencode/gemini land on PATH (the
+            # /etc/profile.d/mise-shims.sh snippet adds the shims dir next login).
+            mise reshim 2>/dev/null || true
             echo "        Agents installed."
+            echo "        Runnable as: claude, codex, opencode, gemini"
+            echo "        (start a fresh shell / re-login to pick them up on PATH)"
           else
             echo "        Some agents did not install — retry later with:"
-            echo "          mise use -g opencode claude-code codex gemini"
+            echo "          mise use -g node@latest opencode claude-code codex gemini"
           fi
           ;;
       esac