nixo/flake.nix at master · HashWarlock/nixo · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
{
  description = "nixosandbox -- reproducible, isolated sandbox environments";

  nixConfig = {
    extra-substituters = [ "https://cache.numtide.com" ];
    extra-trusted-public-keys = [ "niks3.numtide.com-1:DTx8wZduET09hRmMtKdQDxNNthLQETkc/yaX7M4qK0g=" ];
  };

  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
    llm-agents.url = "github:numtide/llm-agents.nix";
  };

  outputs = { self, nixpkgs, llm-agents }:
  let
    # Sandbox rootfs is always Linux
    linuxSystem = "x86_64-linux";
    linuxPkgs = nixpkgs.legacyPackages.${linuxSystem};
    mkSandboxRootfs = import ./nix/mkSandboxRootfs.nix { pkgs = linuxPkgs; };

    # Unified catalog: agents from llm-agents.nix + tools from nixpkgs
    linuxCatalog = import ./nix/catalog.nix {
      pkgs = linuxPkgs;
      llm-agents-pkgs = llm-agents.packages.${linuxSystem} or {};
    };

    # Catalog-aware sandbox builder
    mkAgentSandbox = import ./nix/mkAgentSandbox.nix {
      catalog = linuxCatalog;
      inherit mkSandboxRootfs;
    };

    # Helper: load a profile JSON and resolve package names to nixpkgs attrs
    loadProfile = path:
      let
        spec = builtins.fromJSON (builtins.readFile path);
        resolvedPkgs = map (name:
          if builtins.hasAttr name linuxPkgs
          then builtins.getAttr name linuxPkgs
          else throw "nixosandbox: unknown package '${name}' in profile ${spec.name}"
        ) spec.packages;
      in
        mkSandboxRootfs {
          name = spec.name;
          packages = resolvedPkgs;
          env = spec.env or {};
        };

    # Rootfs derivations (always x86_64-linux, buildable from any host)
    sandboxPackages = {
      sandbox-build-install = loadProfile ./nix/profiles/build-install.json;
      sandbox-offline-review = loadProfile ./nix/profiles/offline-review.json;
      sandbox-strict = loadProfile ./nix/profiles/strict.json;
      sandbox-debug-network = loadProfile ./nix/profiles/debug-network.json;
    };

    # All systems that can build/use nixosandbox
    supportedSystems = [ "x86_64-linux" "aarch64-linux" "aarch64-darwin" "x86_64-darwin" ];

    forAllSystems = f: nixpkgs.lib.genAttrs supportedSystems f;
  in
  {
    # Library functions for custom rootfs and catalog composition
    lib = {
      inherit mkSandboxRootfs;
      inherit mkAgentSandbox;
    };

    # Catalog: queryable package listing (always x86_64-linux for rootfs)
    catalog = linuxCatalog;

    packages = forAllSystems (system:
      let
        pkgs = nixpkgs.legacyPackages.${system};
      in
        sandboxPackages // {
          nixosandbox = pkgs.rustPlatform.buildRustPackage {
            pname = "nixosandbox";
            version = "0.1.0";
            src = ./crates/nixosandbox;
            cargoLock.lockFile = ./crates/nixosandbox/Cargo.lock;
          };

          default = self.packages.${system}.nixosandbox;
        }
    );

    devShells = forAllSystems (system:
      let
        pkgs = nixpkgs.legacyPackages.${system};
      in {
        default = pkgs.mkShell {
          name = "nixosandbox-dev";
          buildInputs = with pkgs; [
            rustc
            cargo
            pkg-config
            jq
          ] ++ pkgs.lib.optionals pkgs.stdenv.isLinux [
            bubblewrap
          ];
        };
      }
    );
  };
}