refactor: make workstation packages buildable via packages.*

4 files changed, 117 insertions, 0 deletions

diff --git a/nixos/profiles/workstation/pkgs/pi.nix b/nixos/profiles/workstation/pkgs/pi.nix
new file mode 100644
index 0000000..00e588a
--- /dev/null
+++ b/nixos/profiles/workstation/pkgs/pi.nix
@@ -0,0 +1,79 @@
+{
+  bubblewrap,
+  coreutils,
+  pi-coding-agent,
+  symlinkJoin,
+  writeShellScriptBin,
+}:
+
+let
+  sbox = writeShellScriptBin "sbox" ''
+    set -euo pipefail
+
+    ${coreutils}/bin/mkdir -p /tmp/pi "$HOME/.local/share/cargo-pi"
+
+    bwrap_args=(
+      --die-with-parent
+      --unshare-pid
+      --unshare-uts
+      --unshare-cgroup
+      --tmpfs /
+      --dev /dev
+      --proc /proc
+      --bind /tmp/pi /tmp
+      --ro-bind /etc /etc
+      --bind /nix/store /nix/store
+      --ro-bind /usr/bin/env /usr/bin/env
+      --setenv NIX_REMOTE daemon
+      --bind-try /nix/var/nix/daemon-socket /nix/var/nix/daemon-socket
+      --dir /run
+      --ro-bind-try /run/current-system /run/current-system
+      # mount git and jj config
+      --ro-bind "$HOME/.config" "$HOME/.config"
+      --ro-bind "$HOME/repos/config" "$HOME/repos/config"
+      # jj must be able to write to ~/.config/jj/repos: https://github.com/jj-vcs/jj/issues/8841
+      --overlay-src "$HOME/.config/jj" --tmp-overlay "$HOME/.config/jj"
+      --setenv CARGO_HOME "$HOME/.local/share/cargo"
+      --bind "$HOME/.local/share/cargo-pi" "$HOME/.local/share/cargo"
+    )
+
+    exec ${bubblewrap}/bin/bwrap "''${bwrap_args[@]}" "$@"
+  '';
+
+  pi = writeShellScriptBin "pi" ''
+    set -euo pipefail
+
+    physical_pwd="$(${coreutils}/bin/pwd -P)"
+
+    exec ${sbox}/bin/sbox \
+      --setenv PI_CODING_AGENT_DIR "$HOME/.config/pi" \
+      --bind "$HOME/.config/pi" "$HOME/.config/pi" \
+      --bind "$physical_pwd" "$physical_pwd" \
+      --chdir "$physical_pwd" \
+      ${pi-coding-agent}/bin/pi \
+        --append-system-prompt "You're running in a sandbox with an ephemeral root filesystem and a separate PID namespace. The current working directory and a few configuration and cache paths are mounted from the host." \
+        --append-system-prompt "$HOME/.config/pi/APPEND_SYSTEM.md" \
+        "$@"
+  '';
+
+  pit = writeShellScriptBin "pit" ''
+    set -euo pipefail
+
+    tmp_cwd="$(${coreutils}/bin/mktemp -d /tmp/pit.XXXXXX)"
+    cleanup() {
+      ${coreutils}/bin/rmdir "$tmp_cwd" 2>/dev/null || true
+    }
+    trap cleanup EXIT
+
+    cd "$tmp_cwd"
+    exec ${pi}/bin/pi "$@"
+  '';
+in
+symlinkJoin {
+  name = "pi-sandboxed";
+  paths = [
+    sbox
+    pi
+    pit
+  ];
+}
diff --git a/nixos/profiles/workstation/pkgs/scripts/package.nix b/nixos/profiles/workstation/pkgs/scripts/package.nix
new file mode 100644
index 0000000..53d408a
--- /dev/null
+++ b/nixos/profiles/workstation/pkgs/scripts/package.nix
@@ -0,0 +1,11 @@
+{ stdenvNoCC }:
+
+stdenvNoCC.mkDerivation {
+  name = "workstation-scripts";
+  src = ./src;
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp $src/* $out/bin/
+  '';
+}
diff --git a/nixos/profiles/workstation/pkgs/scripts/src/ed b/nixos/profiles/workstation/pkgs/scripts/src/ed
new file mode 100755
index 0000000..e6c23d3
--- /dev/null
+++ b/nixos/profiles/workstation/pkgs/scripts/src/ed
@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+
+list_files() {
+    if git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+        git -c core.quotePath=false ls-files --cached --others --exclude-standard
+    else
+        find . -type f -not -path "*/.*"
+    fi
+}
+
+files=$(list_files | sk --no-info "$@") || exit
+$VISUAL "$files"
diff --git a/nixos/profiles/workstation/pkgs/scripts/src/rsqlite b/nixos/profiles/workstation/pkgs/scripts/src/rsqlite
new file mode 100755
index 0000000..d9dc2ae
--- /dev/null
+++ b/nixos/profiles/workstation/pkgs/scripts/src/rsqlite
@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+if [[ "$#" != 2 && "$#" != "3" ]]; then
+    echo "usage: $0 <host> <path_in_var_lib> [sql]"
+    exit 1
+fi
+
+printf -v path %q "$2"
+
+if [[ "$#" == "3" ]]; then
+    printf -v sql %q "$3"
+else
+    sql=""
+fi
+
+ssh "$1" -t "sudo su -c 'sqlite3 /var/lib/$path $sql'"