feat: pre-install project devShell packages at build time#5
Draft
gotha wants to merge 3 commits into
Draft
Conversation
Pins the agentbox flake input from the floating default branch to the v0.1.0 tag in all four example flakes. Without this pin, consumers of the examples would silently pick up arbitrary future commits to the agentbox repo.
Adds flake.lock files for all four examples, pinning agentbox to commit 38317bb (= v0.1.0) and recording cryptographic narHashes for all transitive dependencies (nixpkgs, home-manager, gotha-nixpkgs, dotfiles). Provides a full reproducibility audit trail for the example builds.
Add an opt-in option to bake a project flake's devShell packages into the VM image at build time. When enabled, agentbox reads the declared devShell from a locked project flake input, extracts its packages, and installs them as global system packages so they are on PATH at boot — no download, no build, works offline, and a later `nix develop` finds them already in the store. - New `agentbox.project.devShellPackages` options (enable/flake/name) - lib/extract-devshell-packages.nix: extract packages from a devShell - modules/devshell-packages.nix: wire extracted packages into systemPackages and write the resolved set to /etc/agentbox/devshell-packages for visibility - Git source only (via locked flake input); fails clearly otherwise - Defaults to the "default" devShell; `name` selects a named shell - Fails loudly when the devShell is missing or declares no packages - Bump nixpkgs to nixos-26.05 - Tests + example (examples/devshell-prebuild-git) + spec docs Implements specs/001-devshell-package-prebuild.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds an opt-in option to bake a project flake's
devShellpackages into the agentbox VM image at build time. When enabled, agentbox reads the declareddevShellfrom a locked project flake input, extracts its packages, and installs them as global system packages — so they are onPATHthe moment the VM boots: no download, no build, works offline, and a laternix developfinds them already in the Nix store.Implements
specs/001-devshell-package-prebuild.What's included
agentbox.project.devShellPackages.{enable,flake,name}(disabled by default; default behavior unchanged).lib/extract-devshell-packages.nix— extracts the package set from adevShells.<system>.<name>.modules/devshell-packages.nix— wires the extracted packages intosystemPackagesand writes the resolved set to/etc/agentbox/devshell-packagesfor visibility.mount/copysources fail clearly, since their contents only exist after boot.defaultdevShell;nameselects a named shell.nixpkgstonixos-26.05.tests/devshell-packages*.nix, fixture project) + example (examples/devshell-prebuild-git) + spec docs.Notes for reviewers
main, which is 2 commits ahead oforigin/main(examples: pin to v0.1.0+examples: regenerate flake.lock). Those will appear in this PR's diff untilmainis pushed.Test plan
nix flake checkpasses (eval + module-eval tests).devShellPackages.enable = trueagainst a project flake with a known devShell; boot with networking disabled and confirm the declared packages are onPATH./etc/agentbox/devshell-packageslists the extracted set.🤖 Generated with Claude Code