From 93b196f86886ec0516f4e4146313cafcd8e817bf Mon Sep 17 00:00:00 2001
From: Martin Fischer <martin@push-f.com>
Date: Sat, 17 Oct 2026 17:15:45 +0200
Subject: refactor: make workstation packages buildable via packages.*

---
 nixos/profiles/workstation/pkgs/pi.nix | 79 ++++++++++++++++++++++++++++++++++
 1 file changed, 79 insertions(+)
 create mode 100644 nixos/profiles/workstation/pkgs/pi.nix

(limited to 'nixos/profiles/workstation/pkgs/pi.nix')

diff --git a/nixos/profiles/workstation/pkgs/pi.nix b/nixos/profiles/workstation/pkgs/pi.nix
new file mode 100644
index 0000000..00e588a
--- /dev/null
+++ b/nixos/profiles/workstation/pkgs/pi.nix
@@ -0,0 +1,79 @@
+{
+  bubblewrap,
+  coreutils,
+  pi-coding-agent,
+  symlinkJoin,
+  writeShellScriptBin,
+}:
+
+let
+  sbox = writeShellScriptBin "sbox" ''
+    set -euo pipefail
+
+    ${coreutils}/bin/mkdir -p /tmp/pi "$HOME/.local/share/cargo-pi"
+
+    bwrap_args=(
+      --die-with-parent
+      --unshare-pid
+      --unshare-uts
+      --unshare-cgroup
+      --tmpfs /
+      --dev /dev
+      --proc /proc
+      --bind /tmp/pi /tmp
+      --ro-bind /etc /etc
+      --bind /nix/store /nix/store
+      --ro-bind /usr/bin/env /usr/bin/env
+      --setenv NIX_REMOTE daemon
+      --bind-try /nix/var/nix/daemon-socket /nix/var/nix/daemon-socket
+      --dir /run
+      --ro-bind-try /run/current-system /run/current-system
+      # mount git and jj config
+      --ro-bind "$HOME/.config" "$HOME/.config"
+      --ro-bind "$HOME/repos/config" "$HOME/repos/config"
+      # jj must be able to write to ~/.config/jj/repos: https://github.com/jj-vcs/jj/issues/8841
+      --overlay-src "$HOME/.config/jj" --tmp-overlay "$HOME/.config/jj"
+      --setenv CARGO_HOME "$HOME/.local/share/cargo"
+      --bind "$HOME/.local/share/cargo-pi" "$HOME/.local/share/cargo"
+    )
+
+    exec ${bubblewrap}/bin/bwrap "''${bwrap_args[@]}" "$@"
+  '';
+
+  pi = writeShellScriptBin "pi" ''
+    set -euo pipefail
+
+    physical_pwd="$(${coreutils}/bin/pwd -P)"
+
+    exec ${sbox}/bin/sbox \
+      --setenv PI_CODING_AGENT_DIR "$HOME/.config/pi" \
+      --bind "$HOME/.config/pi" "$HOME/.config/pi" \
+      --bind "$physical_pwd" "$physical_pwd" \
+      --chdir "$physical_pwd" \
+      ${pi-coding-agent}/bin/pi \
+        --append-system-prompt "You're running in a sandbox with an ephemeral root filesystem and a separate PID namespace. The current working directory and a few configuration and cache paths are mounted from the host." \
+        --append-system-prompt "$HOME/.config/pi/APPEND_SYSTEM.md" \
+        "$@"
+  '';
+
+  pit = writeShellScriptBin "pit" ''
+    set -euo pipefail
+
+    tmp_cwd="$(${coreutils}/bin/mktemp -d /tmp/pit.XXXXXX)"
+    cleanup() {
+      ${coreutils}/bin/rmdir "$tmp_cwd" 2>/dev/null || true
+    }
+    trap cleanup EXIT
+
+    cd "$tmp_cwd"
+    exec ${pi}/bin/pi "$@"
+  '';
+in
+symlinkJoin {
+  name = "pi-sandboxed";
+  paths = [
+    sbox
+    pi
+    pit
+  ];
+}
-- 
cgit v1.3.1