refactor: make workstation packages buildable via packages.*

7 files changed, 45 insertions, 23 deletions

diff --git a/AGENTS.md b/AGENTS.md
index 0ad33dc..53c787f 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -34,10 +34,10 @@ To get the store path to a pin, use the `get-path` npins subcommand:
 
     npins -d nixos/npins get-path <name>
 
-Build a package under `nixos/profiles/server/pkgs/`
+Build a package under `nixos/profiles/<profile>/pkgs/`
 (both `<package>.nix` and `<package>/package.nix` map to `<package>`):
 
-    nix build --no-link --file nixos packages.server.<package>
+    nix build --no-link --file nixos packages.<profile>.<package>
 
 ## Documentation
 
diff --git a/nixos/default.nix b/nixos/default.nix
index c164c7f..7a3d1bf 100644
--- a/nixos/default.nix
+++ b/nixos/default.nix
@@ -62,5 +62,15 @@ rec {
         directory = ./profiles/server/pkgs;
         callPackage = pkgs.newScope { inherit sources; };
       };
+
+    workstation =
+      let
+        pkgs = import sources.nixos.outPath { };
+        pkgs-unstable = import sources.nixos-unstable.outPath { };
+      in
+      pkgs.lib.packagesFromDirectoryRecursive {
+        directory = ./profiles/workstation/pkgs;
+        callPackage = pkgs.newScope { inherit (pkgs-unstable) pi-coding-agent; };
+      };
   };
 }
diff --git a/nixos/profiles/workstation/default.nix b/nixos/profiles/workstation/default.nix
index 77891fe..fd0a44d 100644
--- a/nixos/profiles/workstation/default.nix
+++ b/nixos/profiles/workstation/default.nix
@@ -27,7 +27,6 @@ in
     ./firefox.nix
     ./dev.nix
     ./create.nix
-    ./llm.nix
   ];
 
   config = {
@@ -84,18 +83,13 @@ in
 
       vim-full
 
+      (callPackage ./pkgs/pi.nix { inherit (pkgs-unstable) pi-coding-agent; })
+      (callPackage ./pkgs/scripts/package.nix {})
+
       cmd50
       (writeShellScriptBin "xdg-open" ''
         ${cmd50}/bin/open "$@"
       '')
-      (stdenv.mkDerivation {
-        name = "workstation-scripts";
-        src = ./scripts;
-        installPhase = ''
-          mkdir -p $out/bin
-          cp $src/* $out/bin/
-        '';
-      })
       restic
       cups
       skim
diff --git a/nixos/profiles/workstation/llm.nix b/nixos/profiles/workstation/pkgs/pi.nix
index a0dfc92..00e588a 100644
--- a/nixos/profiles/workstation/llm.nix
+++ b/nixos/profiles/workstation/pkgs/pi.nix
@@ -1,10 +1,16 @@
-{ pkgs, pkgs-unstable, ... }:
+{
+  bubblewrap,
+  coreutils,
+  pi-coding-agent,
+  symlinkJoin,
+  writeShellScriptBin,
+}:
 
 let
-  sbox = pkgs.writeShellScriptBin "sbox" ''
+  sbox = writeShellScriptBin "sbox" ''
     set -euo pipefail
 
-    ${pkgs.coreutils}/bin/mkdir -p /tmp/pi "$HOME/.local/share/cargo-pi"
+    ${coreutils}/bin/mkdir -p /tmp/pi "$HOME/.local/share/cargo-pi"
 
     bwrap_args=(
       --die-with-parent
@@ -31,31 +37,31 @@ let
       --bind "$HOME/.local/share/cargo-pi" "$HOME/.local/share/cargo"
     )
 
-    exec ${pkgs.bubblewrap}/bin/bwrap "''${bwrap_args[@]}" "$@"
+    exec ${bubblewrap}/bin/bwrap "''${bwrap_args[@]}" "$@"
   '';
 
-  pi = pkgs.writeShellScriptBin "pi" ''
+  pi = writeShellScriptBin "pi" ''
     set -euo pipefail
 
-    physical_pwd="$(${pkgs.coreutils}/bin/pwd -P)"
+    physical_pwd="$(${coreutils}/bin/pwd -P)"
 
     exec ${sbox}/bin/sbox \
       --setenv PI_CODING_AGENT_DIR "$HOME/.config/pi" \
       --bind "$HOME/.config/pi" "$HOME/.config/pi" \
       --bind "$physical_pwd" "$physical_pwd" \
       --chdir "$physical_pwd" \
-      ${pkgs-unstable.pi-coding-agent}/bin/pi \
+      ${pi-coding-agent}/bin/pi \
         --append-system-prompt "You're running in a sandbox with an ephemeral root filesystem and a separate PID namespace. The current working directory and a few configuration and cache paths are mounted from the host." \
         --append-system-prompt "$HOME/.config/pi/APPEND_SYSTEM.md" \
         "$@"
   '';
 
-  pit = pkgs.writeShellScriptBin "pit" ''
+  pit = writeShellScriptBin "pit" ''
     set -euo pipefail
 
-    tmp_cwd="$(${pkgs.coreutils}/bin/mktemp -d /tmp/pit.XXXXXX)"
+    tmp_cwd="$(${coreutils}/bin/mktemp -d /tmp/pit.XXXXXX)"
     cleanup() {
-      ${pkgs.coreutils}/bin/rmdir "$tmp_cwd" 2>/dev/null || true
+      ${coreutils}/bin/rmdir "$tmp_cwd" 2>/dev/null || true
     }
     trap cleanup EXIT
 
@@ -63,8 +69,9 @@ let
     exec ${pi}/bin/pi "$@"
   '';
 in
-{
-  environment.systemPackages = [
+symlinkJoin {
+  name = "pi-sandboxed";
+  paths = [
     sbox
     pi
     pit
diff --git a/nixos/profiles/workstation/pkgs/scripts/package.nix b/nixos/profiles/workstation/pkgs/scripts/package.nix
new file mode 100644
index 0000000..53d408a
--- /dev/null
+++ b/nixos/profiles/workstation/pkgs/scripts/package.nix
@@ -0,0 +1,11 @@
+{ stdenvNoCC }:
+
+stdenvNoCC.mkDerivation {
+  name = "workstation-scripts";
+  src = ./src;
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp $src/* $out/bin/
+  '';
+}
diff --git a/nixos/profiles/workstation/scripts/ed b/nixos/profiles/workstation/pkgs/scripts/src/ed
index e6c23d3..e6c23d3 100755
--- a/nixos/profiles/workstation/scripts/ed
+++ b/nixos/profiles/workstation/pkgs/scripts/src/ed
diff --git a/nixos/profiles/workstation/scripts/rsqlite b/nixos/profiles/workstation/pkgs/scripts/src/rsqlite
index d9dc2ae..d9dc2ae 100755
--- a/nixos/profiles/workstation/scripts/rsqlite
+++ b/nixos/profiles/workstation/pkgs/scripts/src/rsqlite