nix: a flake that builds every binary, the tool image and a dev shell

Follows the owner's other projects (sift, tether): nixpkgs pinned to nixos-26.05, x86_64-linux, the version from the commit. `packages.default` builds all six binaries with rustPlatform (tests stay in `make gate`), `packages.tools-image` is deploy/tools-image.nix, and `devShells.default` has Rust 1.95.0, clippy, rustfmt, cargo-deny and make. No NixOS module yet: that is M8 (P22). Checked on straylight: `nix flake check` passes; `nix build` gives brokerd, bxctl, gatewayd, inferproxy, loopd and toolkit, each printing its usage; `nix build .#tools-image` and `nix develop` work. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
2026-09-25 16:41:29 -07:00
parent 45f311ecfc
commit 41f8329afe
5 changed files with 119 additions and 0 deletions
@@ -0,0 +1,76 @@
+{
+  description = "boxmaker: a sovereign personal agent harness";
+
+  inputs.nixpkgs.url = "nixpkgs/nixos-26.05";
+
+  outputs =
+    { self, nixpkgs }:
+    let
+      systems = [ "x86_64-linux" ];
+      forAllSystems = nixpkgs.lib.genAttrs systems;
+      version =
+        if self ? shortRev then
+          self.shortRev
+        else if self ? dirtyShortRev then
+          self.dirtyShortRev
+        else
+          "dev";
+    in
+    {
+      packages = forAllSystems (
+        system:
+        let
+          pkgs = nixpkgs.legacyPackages.${system};
+          lib = pkgs.lib;
+          # Only what the build reads: no target/, no .state/, no docs.
+          src = lib.cleanSourceWith {
+            src = ./.;
+            filter =
+              path: type:
+              let
+                rel = lib.removePrefix (toString ./. + "/") (toString path);
+              in
+              rel == "Cargo.toml" || rel == "Cargo.lock" || rel == "crates" || lib.hasPrefix "crates/" rel;
+          };
+          # Every binary of the workspace: the roles, bxctl and toolkit.
+          boxmaker = pkgs.rustPlatform.buildRustPackage {
+            pname = "boxmaker";
+            inherit version src;
+            cargoLock.lockFile = ./Cargo.lock;
+            # The tests run in `make gate`: they need Unix sockets under /tmp and scripts they write
+            # and run, which the build sandbox is not checked to allow.
+            doCheck = false;
+            meta = {
+              description = "a sovereign personal agent harness";
+              mainProgram = "bxctl";
+            };
+          };
+          # The image every tool container runs from; see the file for how it is loaded.
+          tools-image = import ./deploy/tools-image.nix { inherit pkgs; };
+        in
+        {
+          inherit boxmaker tools-image;
+          default = boxmaker;
+        }
+      );
+
+      devShells = forAllSystems (
+        system:
+        let
+          pkgs = nixpkgs.legacyPackages.${system};
+        in
+        {
+          default = pkgs.mkShell {
+            nativeBuildInputs = [
+              pkgs.cargo
+              pkgs.rustc
+              pkgs.clippy
+              pkgs.rustfmt
+              pkgs.cargo-deny
+              pkgs.gnumake
+            ];
+          };
+        }
+      );
+    };
+}