From c1bbb4d0740137014523a08ffc2b3ec7188cc7db Mon Sep 17 00:00:00 2001
From: Martin Fischer <martin@push-f.com>
Date: Sun, 13 Sep 2026 14:47:11 +0200
Subject: feat(workstation): add pi

---
 nixos/profiles/workstation/default.nix |  1 +
 nixos/profiles/workstation/llm.nix     | 64 ++++++++++++++++++++++++++++++++++
 2 files changed, 65 insertions(+)
 create mode 100644 nixos/profiles/workstation/llm.nix

(limited to 'nixos')

diff --git a/nixos/profiles/workstation/default.nix b/nixos/profiles/workstation/default.nix
index e6fc7e1..fef1757 100644
--- a/nixos/profiles/workstation/default.nix
+++ b/nixos/profiles/workstation/default.nix
@@ -19,6 +19,7 @@ in
     ./firefox.nix
     ./dev.nix
     ./create.nix
+    ./llm.nix
   ];
 
   config = {
diff --git a/nixos/profiles/workstation/llm.nix b/nixos/profiles/workstation/llm.nix
new file mode 100644
index 0000000..3301ff2
--- /dev/null
+++ b/nixos/profiles/workstation/llm.nix
@@ -0,0 +1,64 @@
+{ pkgs, pkgs-unstable, ... }:
+
+let
+  sbox = pkgs.writeShellScriptBin "sbox" ''
+    set -euo pipefail
+
+    bwrap_args=(
+      --die-with-parent
+      --tmpfs /
+      --dev /dev
+      --proc /proc
+      --tmpfs /tmp
+      --ro-bind /etc /etc
+      --bind /nix/store /nix/store
+      --ro-bind /usr/bin/env /usr/bin/env
+      --setenv NIX_REMOTE daemon
+      --bind-try /nix/var/nix/daemon-socket /nix/var/nix/daemon-socket
+      --dir /run
+      --ro-bind-try /run/current-system /run/current-system
+      # mount git and jj config
+      --ro-bind "$HOME/.config" "$HOME/.config"
+      --ro-bind "$HOME/repos/config" "$HOME/repos/config"
+      # jj must be able to write to ~/.config/jj/repos: https://github.com/jj-vcs/jj/issues/8841
+      --overlay-src "$HOME/.config/jj" --tmp-overlay "$HOME/.config/jj"
+    )
+
+    exec ${pkgs.bubblewrap}/bin/bwrap "''${bwrap_args[@]}" "$@"
+  '';
+in
+{
+  environment.systemPackages = [
+    sbox
+
+    (pkgs.writeShellScriptBin "pi" ''
+      set -euo pipefail
+
+      export PI_CODING_AGENT_DIR="$HOME/.config/pi"
+
+      exec ${sbox}/bin/sbox \
+        --bind "$HOME/.config/pi" "$HOME/.config/pi" \
+        --bind "$PWD" "$PWD" \
+        --chdir "$PWD" \
+        ${pkgs-unstable.pi-coding-agent}/bin/pi "$@"
+    '')
+
+    (pkgs.writeShellScriptBin "pit" ''
+      set -euo pipefail
+
+      tmp_cwd="$(${pkgs.coreutils}/bin/mktemp -d /tmp/pit.XXXXXX)"
+      cleanup() {
+        ${pkgs.coreutils}/bin/rmdir "$tmp_cwd" 2>/dev/null || true
+      }
+      trap cleanup EXIT
+
+      export PI_CODING_AGENT_DIR="$HOME/.config/pi"
+
+      ${sbox}/bin/sbox \
+        --bind "$HOME/.config/pi" "$HOME/.config/pi" \
+        --bind "$tmp_cwd" "$tmp_cwd" \
+        --chdir "$tmp_cwd" \
+        ${pkgs-unstable.pi-coding-agent}/bin/pi "$@"
+    '')
+  ];
+}
-- 
cgit v1.3.1