Add a Nix dev shell so Node and Rust match CI

.envrc

@@ -0,0 +1,5 @@
+# `use flake` only watches flake.nix and flake.lock, but flake.nix also reads
+# the pinned Rust toolchain, so watch that too or the shell goes stale.
+watch_file native/computer-use-broker/rust-toolchain.toml
+
+use flake

.gitignore

@@ -6,6 +6,9 @@ build/
 release/
 native/computer-use-broker/target/
 
+# Nix development shell (flake.nix and flake.lock stay versioned)
+.direnv/
+
 # Agent context (auto-generated, not worth versioning)
 .claude/
 .agents/

README.md

@@ -79,6 +79,14 @@ Core technologies include Electron 43, React 19, TypeScript, Vite, Tailwind CSS,
 - A full Xcode 26 or newer for the Apple Foundation Models helper
 - An Apple Development or Developer ID Application identity for packaged builds
 
+Node and Rust can come from the checked-in **Nix** flake instead, which pins both to the versions CI uses and reads the Cargo toolchain straight from `native/computer-use-broker/rust-toolchain.toml`. Xcode and the signing identities always come from the host.
+
+```bash
+nix develop
+```
+
+Run `direnv allow` once instead to have the shell load automatically on `cd`.
+
 ### Run locally
 
 ```bash

flake.nix

@@ -0,0 +1,51 @@
+{
+  description = "Development environment for Aiden Agent";
+
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    rust-overlay = {
+      url = "github:oxalica/rust-overlay";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+  };
+
+  outputs =
+    { nixpkgs, rust-overlay, ... }:
+    let
+      # macOS only: the Apple Foundation Models helper targets macOS 26 and
+      # packaging runs through `electron-builder --mac`.
+      forAllSystems = nixpkgs.lib.genAttrs [
+        "aarch64-darwin"
+        "x86_64-darwin"
+      ];
+    in
+    {
+      devShells = forAllSystems (
+        system:
+        let
+          pkgs = import nixpkgs {
+            inherit system;
+            overlays = [ rust-overlay.overlays.default ];
+          };
+        in
+        {
+          default = pkgs.mkShell {
+            packages = [
+              # package.json requires >=22.19; CI runs 22.22.3.
+              pkgs.nodejs_22
+
+              # Read the file cargo and rustup already read, so the pinned
+              # toolchain cannot drift from this shell. `npm test` runs
+              # `cargo clippy --locked -- -D warnings`, which is sensitive to
+              # the exact release.
+              (pkgs.rust-bin.fromRustupToolchainFile ./native/computer-use-broker/rust-toolchain.toml)
+            ];
+
+            # DEVELOPER_DIR, SDKROOT, CC and CXX are deliberately unset: the
+            # Swift helper builds against Apple's SDK and signing identities
+            # live in the login keychain, so both come from the host Xcode.
+          };
+        }
+      );
+    };
+}