flake.nix

@@ -171,51 +171,47 @@
             inherit (nixpkgs) lib;
             inherit (nixpkgs.lib) nixosSystem;
           };
-          # Daemon + harness + MCP server binaries. Excludes hivectl and
+        in
-          # hive-forge which are their own derivations below — so each bin
+        {
-          # is compiled exactly once. `packages.default` joins all three
+          # Build the workspace binaries without running tests. Tests
-          # via symlinkJoin; no binary is compiled more than once regardless
+          # are run as a separate check (`checks.cargo-test`) that
-          # of which packages the operator builds together.
+          # carries the `hyperhive-assets` build input — `hive-ag3nt::
-          #
+          # prompt::tests` reads the production prompt template at test
-          # Tests are kept in the separate `checks.cargo-test` derivation
+          # runtime through `$HIVE_ASSETS_DIR`, so wiring the env var
-          # (carries the hyperhive-assets build input for the prompt-template
+          # into the build phase here would make the prompt's hash a
-          # assertions in hive-ag3nt::prompt::tests). Keeping them out of the
+          # build input of `default` (defeats the asset-split cache goal: a
-          # binary derivations means a prompt edit doesn't bust the cargo cache.
+          # prompt edit would still bust the binary derivation, even
-          daemonBins = craneLib.buildPackage {
+          # though no .rs file changed). Keeping tests in a separate
-            src = cleanSrc;
+          # check derivation localises the asset-rebuild blast radius
-            inherit cargoArtifacts nativeBuildInputs;
+          # to that one check — `nix flake check` still exercises them.
-            cargoExtraArgs = "--bin hive-c0re --bin hive-agent --bin hive-agent-mcp --bin hive-agent-wake --bin hive-bash-daemon --bin hive-bash-mcp --bin hive-matrix-daemon --bin hive-matrix-mcp --bin hive-metric";
+          default = craneLib.buildPackage {
-            pname = "hyperhive-daemon";
-            version = "0.1.0";
-            meta.description = "hyperhive daemon + agent harness + bash/matrix MCP servers";
-            doCheck = false;
-          };
-          # Operator CLI — ships `hivectl` (with shell completions and the
-          # `wg` wrapper) without the daemon binaries. Suitable for
-          # `nix profile install .#hivectl` / `environment.systemPackages
-          # = [ inputs.hyperhive.packages.${system}.hivectl ]` when the
-          # operator only wants the admin CLI. Shares `cargoArtifacts` with
-          # `daemonBins` so there is no double-rustc cost.
-          hivectlPkg = craneLib.buildPackage {
             src = cleanSrc;
             inherit cargoArtifacts;
-            cargoExtraArgs = "--bin hivectl";
+            # `installShellFiles` provides `installShellCompletion` and
-            pname = "hivectl";
+            # `makeWrapper` provides `wrapProgram` for the postInstall below;
-            version = "0.1.0";
+            # appended (not in the shared set) so they're build inputs only of
-            meta.description = "hyperhive operator CLI";
+            # this binary derivation.
-            doCheck = false;
-            # `installShellFiles` + `makeWrapper` scoped to this derivation
-            # only — daemon bins don't need them.
             nativeBuildInputs = nativeBuildInputs ++ [
               pkgs.installShellFiles
               pkgs.makeWrapper
             ];
-            # Ship shell completions (the binary's own `completions <shell>`
+            pname = "hyperhive-workspace";
-            # verb is the single source of truth, so they never drift from
+            version = "0.1.0";
-            # the actual verbs). Wrap with wireguard-tools so `hivectl wg`
+            meta.description = "hyperhive workspace (hive-c0re, hive-ag3nt, hive-root)";
-            # subcommands work before `swarm.wireguard.enable` is set (wg
+            doCheck = false;
-            # init is the very first setup step). Completion generation runs
+            # Ship hivectl shell completions in the package (the binary's own
-            # before wrapProgram since wrapProgram renames the real binary.
+            # `completions <shell>` verb is the single source of truth, so they
+            # never drift from the actual verbs). Lands at
+            # `$out/share/{zsh/site-functions,bash-completion,fish}/…`; an
+            # operator gets working completion as soon as hivectl is in their
+            # system/user profile with the shell's completion enabled.
+            #
+            # Then wrap hivectl with `wireguard-tools` on PATH so its `wg`
+            # subcommands (`wg init`/`peer`/`status`) work even before the
+            # WireGuard mesh is configured — `wg init` is the *first* setup
+            # step, run before `swarm.wireguard.enable` (which would otherwise
+            # be what pulls wireguard-tools onto the system). Completion
+            # generation runs first since wrapProgram renames the real binary.
             postInstall = ''
               installShellCompletion --cmd hivectl \
                 --bash <("$out/bin/hivectl" completions bash) \
@@ -225,38 +221,6 @@
                 --prefix PATH : ${pkgs.wireguard-tools}/bin
             '';
           };
-          # Forgejo CLI — ships `hive-forge` without the rest of the
-          # workspace. Useful for operator workstations / CI environments
-          # that only need forge access. Shares `cargoArtifacts` with
-          # `daemonBins`.
-          hiveForgePkg = craneLib.buildPackage {
-            src = cleanSrc;
-            inherit cargoArtifacts nativeBuildInputs;
-            cargoExtraArgs = "--bin hive-forge";
-            pname = "hive-forge";
-            version = "0.1.0";
-            meta.description = "hyperhive Forgejo CLI";
-            doCheck = false;
-          };
-        in
-        {
-          # All workspace binaries in one derivation via symlinkJoin.
-          # Each binary is compiled exactly once (one rustc per bin, all
-          # sharing `cargoArtifacts`); symlinkJoin assembles the outputs
-          # without any additional compilation. The NixOS module's
-          # `pkgs.hyperhive` (= this) and `nix build .#` both land here.
-          default = pkgs.symlinkJoin {
-            name = "hyperhive";
-            paths = [
-              daemonBins
-              hivectlPkg
-              hiveForgePkg
-            ];
-          };
-          # Per-bin split packages — useful for operator workstations that
-          # only want the CLI(s) without the daemon binaries.
-          hivectl = hivectlPkg;
-          hive-forge = hiveForgePkg;
           # Bundled browser assets — see ./nix/frontend.nix. Output is
           # $out/{dashboard,agent}/ which the Rust binaries serve via
           # tower_http::ServeDir.