84874c58a5
allow you to simulate the whole official curl | bash installer,
and subsequent hermes updates.
Run development commands in a bubblewrap filesystem and network sandbox
with a local HTTPS MITM fixture server and a fake github
git-upload-pack transport.
Package the sandbox command and expose it from the nix devShell.
Stage the local installer at its canonical fake HTTPS URL and add a
persistent installation/update test path. Route root installs through
sandbox-owned filesystem locations and snapshot dirty source worktrees
into temporary fake commits so update tests can fast-forward without
changing the real checkout.
Includes a --install-ref sandbox installer mode that fetches any commit
(--from-main is a nice shorthand for local development) outside the
sealed sandbox, installs from that snapshot, and then promotes the fake
remote to the current worktree so update flows can be exercised with FF.
Notes on non-root sandboxes:
Giving a non-root sandbox a network is tricky.
slirp4netns joins the target userns and setuids to root before configuring the
netns, so the userns must map a uid 0; bwrap's --unshare-user maps exactly ONE
uid, so --uid 1000 leaves no root to become and slirp diedswith
`setns(CLONE_NEWNET): Operation not permitted`. Stage 1 builds the user+net
namespaces with `unshare` and two one-id ranges:
inner 0 -> a subuid, unused by the payload, present only so slirp can
become root
inner 1000 -> our real host uid
Mapping the payload to the *host* uid (not a second subuid) keeps everything the
sandbox writes owned by us, so `rm -rf` on a persistent sandbox still needs no
privileges. Stage 2 execs bwrap WITHOUT --unshare-user -- it only adds mount/pid
-- sidestepping bwrap's refusal to accept --uid outside a userns it created.
Costs a /etc/subuid range for the invoking user (we error with the exact line to
add) and util-linux `unshare`; `--root` needs neither.
65 lines
2.5 KiB
Nix
65 lines
2.5 KiB
Nix
# nix/devShell.nix — Dev shell that delegates setup to each package
|
|
#
|
|
# Each npm workspace package exposes passthru.packageJsonPath (e.g.
|
|
# "ui-tui/package.json"). This file collects them all and passes the
|
|
# list to mkNpmDevShellHook, which stamps all package.jsons at once,
|
|
# then runs a single `npm i --package-lock-only` if any changed and
|
|
# `npm ci` if the lockfile changed.
|
|
{ ... }:
|
|
{
|
|
perSystem =
|
|
{ pkgs, self', ... }:
|
|
let
|
|
packages = builtins.attrValues self'.packages;
|
|
hermesNpmLib = self'.packages.default.passthru.hermesNpmLib;
|
|
|
|
# Collect all packageJsonPath values from npm workspace packages.
|
|
npmPackageJsonPaths = builtins.filter (p: p != null) (
|
|
map (p: p.passthru.packageJsonPath or null) packages
|
|
);
|
|
|
|
hermesAgentDevShellHook = self'.packages.default.passthru.devShellHook;
|
|
in
|
|
{
|
|
devShells.default = pkgs.mkShell {
|
|
packages = with pkgs; [
|
|
(pkgs.runCommand "hermes" { } ''
|
|
mkdir -p $out/bin
|
|
install -Dm755 ${../hermes} $out/bin/hermes
|
|
'')
|
|
self'.packages.sandbox
|
|
uv
|
|
# Headless Wayland compositor for E2E tests (test:e2e:visual).
|
|
# cage renders a single client with no window management, so
|
|
# the Electron window opens at a fixed size without tiling.
|
|
# libglvnd provides libEGL.so.1 that cage needs on NixOS.
|
|
cage
|
|
libglvnd
|
|
# Graphical terminal + Wayland screenshot client for CLI/TUI UI
|
|
# evidence. `cage -- ghostty ...` keeps captures off the user's
|
|
# live compositor; grim runs inside that isolated client session.
|
|
ghostty
|
|
grim
|
|
]
|
|
++ self'.packages.default.passthru.devDeps;
|
|
shellHook = ''
|
|
${hermesAgentDevShellHook}
|
|
${hermesNpmLib.mkNpmDevShellHook npmPackageJsonPaths}
|
|
|
|
# Force Node to use Nix's playwright-test binary instead of node_modules/.bin
|
|
export PATH="${pkgs.playwright-test}/bin:$PATH"
|
|
|
|
# for the devshell to pick up the src
|
|
export HERMES_PYTHON_SRC_ROOT=$(git rev-parse --show-toplevel)
|
|
|
|
# Let `uv run --active --no-sync` reuse Nix's provisioned Python
|
|
# environment instead of creating an empty project .venv.
|
|
export VIRTUAL_ENV="$(dirname "$(dirname "$(readlink -f "$(command -v python)")")")"
|
|
|
|
echo "Hermes Agent dev shell in $HERMES_PYTHON_SRC_ROOT"
|
|
echo "Ready. Run 'hermes' or 'sandbox hermes' to start."
|
|
'';
|
|
};
|
|
};
|
|
}
|