From c1ffa12a993cd222d391c252846ff0cff505e8da Mon Sep 17 00:00:00 2001
From: atlas <atlas@hyperhive.local>
Date: Fri, 10 Jul 2026 14:24:57 +0200
Subject: [PATCH] =?UTF-8?q?feat(#2280):=20packages.hivectl=20and=20package?=
 =?UTF-8?q?s.hive-forge=20=E2=80=94=20single-bin=20splits?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Operators who only want hivectl or hive-forge can now add:
  inputs.hyperhive.packages.${system}.hivectl
  inputs.hyperhive.packages.${system}.hive-forge
to their environment.systemPackages without pulling the full
workspace (hive-c0re daemon, hive-ag3nt harness, etc.) into PATH.

Both reuse the shared cargoArtifacts so there is no extra compile
cost when both packages and the default workspace are built together.

packages.hivectl carries the shell completions and the wireguard-tools
wrapper identical to what packages.default ships for hivectl.
packages.hive-forge is a lean CLI-only build.
---
 flake.nix | 43 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 43 insertions(+)

diff --git a/flake.nix b/flake.nix
index a4b9e0e7..c27254ee 100644
--- a/flake.nix
+++ b/flake.nix
@@ -221,6 +221,49 @@
                 --prefix PATH : ${pkgs.wireguard-tools}/bin
             '';
           };
+          # Operator CLI only — ships `hivectl` (with shell completions
+          # and the `wg` wrapper) without the daemon binaries. Suitable
+          # for `nix profile install .#hivectl` / `environment.systemPackages
+          # = [ inputs.hyperhive.packages.${system}.hivectl ]` when the
+          # operator only wants the admin CLI on their workstation and
+          # does not want `hive-c0re` or `hive-ag3nt` in PATH.
+          # Shares `cargoArtifacts` with `packages.default` so there is no
+          # double-compile cost when both are in the same `nix build`
+          # invocation.
+          hivectl = craneLib.buildPackage {
+            src = cleanSrc;
+            inherit cargoArtifacts;
+            cargoExtraArgs = "--bin hivectl";
+            pname = "hivectl";
+            version = "0.1.0";
+            meta.description = "hyperhive operator CLI";
+            doCheck = false;
+            nativeBuildInputs = nativeBuildInputs ++ [
+              pkgs.installShellFiles
+              pkgs.makeWrapper
+            ];
+            postInstall = ''
+              installShellCompletion --cmd hivectl \
+                --bash <("$out/bin/hivectl" completions bash) \
+                --zsh <("$out/bin/hivectl" completions zsh) \
+                --fish <("$out/bin/hivectl" completions fish)
+              wrapProgram "$out/bin/hivectl" \
+                --prefix PATH : ${pkgs.wireguard-tools}/bin
+            '';
+          };
+          # Forgejo CLI only — ships `hive-forge` without the rest of
+          # the workspace. Useful for operator workstations / CI
+          # environments that only need forge access. Shares
+          # `cargoArtifacts` with `packages.default`.
+          hive-forge = craneLib.buildPackage {
+            src = cleanSrc;
+            inherit cargoArtifacts;
+            cargoExtraArgs = "--bin hive-forge";
+            pname = "hive-forge";
+            version = "0.1.0";
+            meta.description = "hyperhive Forgejo CLI";
+            doCheck = false;
+          };
           # Bundled browser assets — see ./nix/frontend.nix. Output is
           # $out/{dashboard,agent}/ which the Rust binaries serve via
           # tower_http::ServeDir.