hyperhive/nix/packages/default.nix

# All flake package outputs. Imported per system from flake.nix; the
# shared rust build wiring (cleanSrc / cargoArtifacts /
# nativeBuildInputs) comes in via `rust` (see ../rust.nix).
{
  pkgs,
  craneLib,
  rust,
  self,
  nixpkgs,
}:
let
  inherit (rust) cleanSrc cargoArtifacts nativeBuildInputs;

  docsAttrs = import ../docs {
    inherit pkgs self;
    inherit (nixpkgs) lib;
    inherit (nixpkgs.lib) nixosSystem;
  };

  # One package per daemon/harness/MCP-server binary — matches the
  # `hivectl` / `hive-forge` split below rather than grouping them
  # into a single derivation. Consumers (agent containers, host
  # module, `nix profile install`) depend on exactly the binaries
  # they need instead of an all-or-nothing bundle. All share
  # `cargoArtifacts` (built once via `buildDepsOnly`), so each call
  # below only pays for compiling + linking its own bin's workspace
  # crates.
  #
  # Tests are kept in the separate `checks.cargo-test` derivation
  # (carries the hyperhive-assets build input for the prompt-template
  # assertions in hive-ag3nt::prompt::tests). Keeping them out of the
  # binary derivations means a prompt edit doesn't bust the cargo cache.
  mkDaemonBin =
    bin: description:
    craneLib.buildPackage {
      src = cleanSrc;
      inherit cargoArtifacts nativeBuildInputs;
      cargoExtraArgs = "--bin ${bin}";
      pname = bin;
      version = "0.1.0";
      meta.description = description;
      doCheck = false;
    };
  hiveC0rePkg = mkDaemonBin "hive-c0re" "hyperhive host coordinator daemon";
  hivePrivPkg = mkDaemonBin "hive-priv" "hyperhive privileged root helper";
  hiveAgentPkg = mkDaemonBin "hive-agent" "hyperhive in-container agent harness serve loop";
  hiveAgentMcpPkg = mkDaemonBin "hive-agent-mcp" "hyperhive agent-surface MCP server";
  hiveAgentWakePkg = mkDaemonBin "hive-agent-wake" "hyperhive external wake CLI — push a message into an agent's own inbox";
  hiveBashDaemonPkg = mkDaemonBin "hive-bash-daemon" "hyperhive per-agent bash-task runner daemon";
  hiveBashMcpPkg = mkDaemonBin "hive-bash-mcp" "hyperhive bash-task MCP bridge";
  hiveMatrixDaemonPkg = mkDaemonBin "hive-matrix-daemon" "hyperhive per-agent matrix-sdk daemon";
  hiveMatrixMcpPkg = mkDaemonBin "hive-matrix-mcp" "hyperhive matrix MCP bridge";
  hiveMetricPkg = mkDaemonBin "hive-metric" "hyperhive agent-emitted custom metrics CLI";

  # Operator CLI — ships `hivectl` (with shell completions and the
  # `wg` wrapper) without the daemon binaries. Suitable for
  # `nix profile install .#hivectl` / `environment.systemPackages
  # = [ inputs.hyperhive.packages.${system}.hivectl ]` when the
  # operator only wants the admin CLI. Shares `cargoArtifacts` with
  # the daemon bins so there is no double-rustc cost.
  hivectlPkg = craneLib.buildPackage {
    src = cleanSrc;
    inherit cargoArtifacts;
    cargoExtraArgs = "--bin hivectl";
    pname = "hivectl";
    version = "0.1.0";
    meta.description = "hyperhive operator CLI";
    doCheck = false;
    # `installShellFiles` + `makeWrapper` scoped to this derivation
    # only — daemon bins don't need them.
    nativeBuildInputs = nativeBuildInputs ++ [
      pkgs.installShellFiles
      pkgs.makeWrapper
    ];
    # Ship shell completions (the binary's own `completions <shell>`
    # verb is the single source of truth, so they never drift from
    # the actual verbs). Wrap with wireguard-tools so `hivectl wg`
    # subcommands work before `swarm.wireguard.enable` is set (wg
    # init is the very first setup step). Completion generation runs
    # before wrapProgram since wrapProgram renames the real binary.
    postInstall = ''
      installShellCompletion --cmd hivectl \
        --bash <("$out/bin/hivectl" completions bash) \
        --zsh <("$out/bin/hivectl" completions zsh) \
        --fish <("$out/bin/hivectl" completions fish)
      wrapProgram "$out/bin/hivectl" \
        --prefix PATH : ${pkgs.wireguard-tools}/bin
    '';
  };

  # Forgejo CLI — ships `hive-forge` without the rest of the
  # workspace. Useful for operator workstations / CI environments
  # that only need forge access. Shares `cargoArtifacts` with the
  # daemon bins.
  hiveForgePkg = craneLib.buildPackage {
    src = cleanSrc;
    inherit cargoArtifacts nativeBuildInputs;
    cargoExtraArgs = "--bin hive-forge";
    pname = "hive-forge";
    version = "0.1.0";
    meta.description = "hyperhive Forgejo CLI";
    doCheck = false;
  };
in
{
  # All workspace binaries in one derivation via symlinkJoin.
  # Each binary is compiled exactly once (one rustc per bin, all
  # sharing `cargoArtifacts`); symlinkJoin assembles the outputs
  # without any additional compilation. The NixOS module's
  # `pkgs.hyperhive` (= this) and `nix build .#` both land here.
  default = pkgs.symlinkJoin {
    name = "hyperhive";
    paths = [
      hiveC0rePkg
      hivePrivPkg
      hiveAgentPkg
      hiveAgentMcpPkg
      hiveAgentWakePkg
      hiveBashDaemonPkg
      hiveBashMcpPkg
      hiveMatrixDaemonPkg
      hiveMatrixMcpPkg
      hiveMetricPkg
      hivectlPkg
      hiveForgePkg
    ];
  };
  # Per-bin split packages. Agent containers depend on the
  # individual bins they actually exec/PATH-need (see
  # `harness-base.nix`) instead of the `default` bundle — that
  # keeps `hivectl` (dials the *host* admin socket, unreachable
  # from inside a container, drags in `wireguard-tools`) and a
  # redundant `hive-forge` copy out of every agent's closure.
  hivectl = hivectlPkg;
  hive-forge = hiveForgePkg;
  hive-c0re = hiveC0rePkg;
  hive-priv = hivePrivPkg;
  hive-agent = hiveAgentPkg;
  hive-agent-mcp = hiveAgentMcpPkg;
  hive-agent-wake = hiveAgentWakePkg;
  hive-bash-daemon = hiveBashDaemonPkg;
  hive-bash-mcp = hiveBashMcpPkg;
  hive-matrix-daemon = hiveMatrixDaemonPkg;
  hive-matrix-mcp = hiveMatrixMcpPkg;
  hive-metric = hiveMetricPkg;

  # Bundled browser assets — see ./frontend.nix. Output is
  # $out/{dashboard,agent}/ which the Rust binaries serve via
  # tower_http::ServeDir.
  frontend = pkgs.callPackage ./frontend.nix {
    branding-svg = ../../branding/hyperhive.svg;
  };
  # Static runtime assets the rust binaries read via
  # `hive_sh4re::assets::*`: branding/* + prompts/*, plus the
  # rendered agent-configs.png. Split out of the rust derivation so
  # a tweak to e.g. system.md doesn't bust the cargo cache. Build
  # input of the `cargo-test` check but NOT of `packages.default`,
  # so the binary derivation stays cached when a prompt edit ripples
  # through.
  assets = pkgs.callPackage ./assets.nix { };
  # The repo docs/ markdown tree as a standalone derivation —
  # agents read it in-container (added as a claude additional
  # directory) and the website repo reuses it as a flake input,
  # neither of which needs the branding/prompt assets. See
  # ./reference-docs.nix. (`docs` below is the auto-generated
  # nix-options reference, a different artifact.)
  reference-docs = pkgs.callPackage ./reference-docs.nix { };
  # XDG icon set + .desktop entries for hyperhive processes.
  # Narrow input: only the branding SVG, so unrelated source changes
  # don't bust this derivation's cache.
  xdg-icons = pkgs.callPackage ./hive-xdg-icons.nix {
    hyperhiveSvg = ../../branding/hyperhive.svg;
  };

  # Pre-built per-container system closures. Exposed as packages
  # so operators can `nix build .#agent-base-toplevel` (or wire
  # them into their host system closure via the
  # `preBuildAgentTemplates` option on the hive-c0re module —
  # see nix/modules/hive-c0re.nix). Speeds up the first agent
  # spawn dramatically because the heavy lifting (nixpkgs +
  # claude-code + hive-ag3nt binary) is already in the store
  # when the meta evaluator goes to build the container.
  #
  # nixosConfigurations are pinned to x86_64-linux (nixos-
  # containers only run native arch), so these toplevels are
  # only useful on an x86_64-linux host — flake check across
  # systems still tolerates evaluating them on aarch64 because
  # they're plain derivations, but `nix build` from a non-x86
  # host would only succeed via a remote x86 builder.
  agent-base-toplevel = self.nixosConfigurations.agent-base.config.system.build.toplevel;
  ruth-toplevel = self.nixosConfigurations.ruth.config.system.build.toplevel;

  # Auto-generated nix options reference for hyperhive.
  # `docs` bundles host + agent pages into one tree; the split
  # outputs are useful when consumers only want one surface.
  # All three are pure markdown — no rust or frontend deps in
  # the closure, so `nix build .#docs` is cheap.
  docs = docsAttrs.bundle;
  docs-host = docsAttrs.host;
  docs-agent = docsAttrs.agent;
}