blob: ee81eadab223e7b9cf2d72ce27330b7a9674bcf4 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
|
{ pkgs, pkgs-unstable, ... }:
let
sbox = pkgs.writeShellScriptBin "sbox" ''
set -euo pipefail
${pkgs.coreutils}/bin/mkdir -p /tmp/pi "$HOME/.local/share/cargo-pi"
bwrap_args=(
--die-with-parent
--unshare-pid
--unshare-uts
--unshare-cgroup
--tmpfs /
--dev /dev
--proc /proc
--bind /tmp/pi /tmp
--ro-bind /etc /etc
--bind /nix/store /nix/store
--ro-bind /usr/bin/env /usr/bin/env
--setenv NIX_REMOTE daemon
--bind-try /nix/var/nix/daemon-socket /nix/var/nix/daemon-socket
--dir /run
--ro-bind-try /run/current-system /run/current-system
--ro-bind /doc /doc
# mount git and jj config
--ro-bind "$HOME/.config" "$HOME/.config"
--ro-bind "$HOME/repos/config" "$HOME/repos/config"
# jj must be able to write to ~/.config/jj/repos: https://github.com/jj-vcs/jj/issues/8841
--overlay-src "$HOME/.config/jj" --tmp-overlay "$HOME/.config/jj"
--setenv CARGO_HOME "$HOME/.local/share/cargo"
--bind "$HOME/.local/share/cargo-pi" "$HOME/.local/share/cargo"
)
exec ${pkgs.bubblewrap}/bin/bwrap "''${bwrap_args[@]}" "$@"
'';
pi = pkgs.writeShellScriptBin "pi" ''
set -euo pipefail
physical_pwd="$(${pkgs.coreutils}/bin/pwd -P)"
exec ${sbox}/bin/sbox \
--setenv PI_CODING_AGENT_DIR "$HOME/.config/pi" \
--setenv PATH "${pkgs.lib.makeBinPath [ pkgs.python3 ]}:$PATH" \
--bind "$HOME/.config/pi" "$HOME/.config/pi" \
--bind "$physical_pwd" "$physical_pwd" \
--chdir "$physical_pwd" \
${pkgs-unstable.pi-coding-agent}/bin/pi "$@"
'';
pit = pkgs.writeShellScriptBin "pit" ''
set -euo pipefail
tmp_cwd="$(${pkgs.coreutils}/bin/mktemp -d /tmp/pit.XXXXXX)"
cleanup() {
${pkgs.coreutils}/bin/rmdir "$tmp_cwd" 2>/dev/null || true
}
trap cleanup EXIT
cd "$tmp_cwd"
exec ${pi}/bin/pi "$@"
'';
in
{
environment.systemPackages = [
sbox
pi
pit
];
}
|
