From f447695899a9d1b2f62c823c011c0fb827c0bc3a Mon Sep 17 00:00:00 2001 From: Aarman Roy Date: Tue, 4 Aug 2026 11:11:48 +0530 Subject: [PATCH] Add a Nix dev shell for Node and Rust Contributors currently assemble the Node and Rust toolchains by hand, so local versions drift from CI. On one machine here: Node 22.21.0 against CI's 22.22.3, and Homebrew cargo 1.92.0 against the 1.96.1 pinned in native/computer-use-broker/rust-toolchain.toml. The cargo gap is the one that bites, because `npm test` runs `cargo clippy --locked -- -D warnings` and clippy changes its lint set between releases, so a change can pass locally and fail CI on lint alone. `nix develop` now provides both, matching CI exactly on npm (10.9.8) and cargo (1.96.1), and differing only in Node patch (22.23.2 vs 22.22.3, both satisfying the >=22.19 engines constraint). The shell reads rust-toolchain.toml through rust-overlay rather than repeating the version, so bumping that file moves the shell with it and the two cannot drift. This adds no new version state to maintain. Deliberately out of scope: there is no package output. electron-builder, ad-hoc signing, notarization, and the FoundationModels framework all need the host Xcode and login keychain, which a Nix sandbox cannot reach. For the same reason the shell leaves DEVELOPER_DIR, SDKROOT, CC, and CXX unset so the host Xcode continues to drive every native build. Xcode and signing identities remain host requirements, as the README now states. Nothing existing changes: no CI edits, and the flake is opt-in. Anyone not using Nix is unaffected. Co-Authored-By: Claude Opus 5 --- .envrc | 5 +++++ .gitignore | 3 +++ README.md | 8 ++++++++ flake.lock | 48 ++++++++++++++++++++++++++++++++++++++++++++++++ flake.nix | 51 +++++++++++++++++++++++++++++++++++++++++++++++++++ 5 files changed, 115 insertions(+) create mode 100644 .envrc create mode 100644 flake.lock create mode 100644 flake.nix diff --git a/.envrc b/.envrc new file mode 100644 index 0000000..45e4ebf --- /dev/null +++ b/.envrc @@ -0,0 +1,5 @@ +# `use flake` only watches flake.nix and flake.lock, but flake.nix also reads +# the pinned Rust toolchain, so watch that too or the shell goes stale. +watch_file native/computer-use-broker/rust-toolchain.toml + +use flake diff --git a/.gitignore b/.gitignore index e1182f7..e6cc80f 100644 --- a/.gitignore +++ b/.gitignore @@ -6,6 +6,9 @@ build/ release/ native/computer-use-broker/target/ +# Nix development shell (flake.nix and flake.lock stay versioned) +.direnv/ + # Agent context (auto-generated, not worth versioning) .claude/ .agents/ diff --git a/README.md b/README.md index 26c9ff2..c470075 100644 --- a/README.md +++ b/README.md @@ -79,6 +79,14 @@ Core technologies include Electron 43, React 19, TypeScript, Vite, Tailwind CSS, - A full Xcode 26 or newer for the Apple Foundation Models helper - An Apple Development or Developer ID Application identity for packaged builds +Node and Rust can come from the checked-in **Nix** flake instead, which pins both to the versions CI uses and reads the Cargo toolchain straight from `native/computer-use-broker/rust-toolchain.toml`. Xcode and the signing identities always come from the host. + +```bash +nix develop +``` + +Run `direnv allow` once instead to have the shell load automatically on `cd`. + ### Run locally ```bash diff --git a/flake.lock b/flake.lock new file mode 100644 index 0000000..265e23f --- /dev/null +++ b/flake.lock @@ -0,0 +1,48 @@ +{ + "nodes": { + "nixpkgs": { + "locked": { + "lastModified": 1785692966, + "narHash": "sha256-vUfIeBEfpbAfZ5zjgIkYk7eHBeVfCYVjLbWnMkseYnk=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "643809054d65fdd466a63e3155b8c498cb483c04", + "type": "github" + }, + "original": { + "owner": "NixOS", + "ref": "nixos-unstable", + "repo": "nixpkgs", + "type": "github" + } + }, + "root": { + "inputs": { + "nixpkgs": "nixpkgs", + "rust-overlay": "rust-overlay" + } + }, + "rust-overlay": { + "inputs": { + "nixpkgs": [ + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1785820796, + "narHash": "sha256-sZXy8mzUMi2cOGulhoW4HWAZB6JhXOAx1x8J4auZFWk=", + "owner": "oxalica", + "repo": "rust-overlay", + "rev": "b6916ba032e02122d6ed3064f40cabe937363d43", + "type": "github" + }, + "original": { + "owner": "oxalica", + "repo": "rust-overlay", + "type": "github" + } + } + }, + "root": "root", + "version": 7 +} diff --git a/flake.nix b/flake.nix new file mode 100644 index 0000000..b810c51 --- /dev/null +++ b/flake.nix @@ -0,0 +1,51 @@ +{ + description = "Development environment for Aiden Agent"; + + inputs = { + nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable"; + rust-overlay = { + url = "github:oxalica/rust-overlay"; + inputs.nixpkgs.follows = "nixpkgs"; + }; + }; + + outputs = + { nixpkgs, rust-overlay, ... }: + let + # macOS only: the Apple Foundation Models helper targets macOS 26 and + # packaging runs through `electron-builder --mac`. + forAllSystems = nixpkgs.lib.genAttrs [ + "aarch64-darwin" + "x86_64-darwin" + ]; + in + { + devShells = forAllSystems ( + system: + let + pkgs = import nixpkgs { + inherit system; + overlays = [ rust-overlay.overlays.default ]; + }; + in + { + default = pkgs.mkShell { + packages = [ + # package.json requires >=22.19; CI runs 22.22.3. + pkgs.nodejs_22 + + # Read the file cargo and rustup already read, so the pinned + # toolchain cannot drift from this shell. `npm test` runs + # `cargo clippy --locked -- -D warnings`, which is sensitive to + # the exact release. + (pkgs.rust-bin.fromRustupToolchainFile ./native/computer-use-broker/rust-toolchain.toml) + ]; + + # DEVELOPER_DIR, SDKROOT, CC and CXX are deliberately unset: the + # Swift helper builds against Apple's SDK and signing identities + # live in the login keychain, so both come from the host Xcode. + }; + } + ); + }; +}