From 35ac95651d2c73fe785c9b064e990c0bcb2f115d Mon Sep 17 00:00:00 2001 From: OpenAI Coding Assistant Date: Sat, 5 Sep 2026 22:18:49 -0500 Subject: [PATCH] feat: keep pi and nix features current --- README.md | 14 +++++++------- common.nix | 12 ++++++++++++ flake.lock | 19 ++++++++++++++++++- flake.nix | 4 ++++ tools.nix | 1 + update-system.sh | 8 ++++---- update-test.py | 2 +- 7 files changed, 47 insertions(+), 13 deletions(-) diff --git a/README.md b/README.md index d2b75f8..b3aac2c 100644 --- a/README.md +++ b/README.md @@ -17,7 +17,7 @@ Flat, explicit NixOS modules, with locked inputs. Required machine setup belongs | `desktop.nix`, `hyprland.lua`, `anyrun.css`, `wallpaper.svg` | Hyprland/UWSM, bar, launcher, original wallpaper, notifications, lock/idle, PipeWire and desktop styling | | `apps.nix` | Firefox ESR, KeePassXC, Thunderbird, Steam, Element, Slack and Zathura | | `workstation.nix`, `nvidia.nix` | Separately selected physical-workstation/greeter and NVIDIA integration; not enabled on EC2 | -| `updates.nix`, `update-system.sh` | Daily stable-input updates in an isolated Git worktree; validated commits, no forced reboot or GC | +| `updates.nix`, `update-system.sh` | Daily package-input updates in an isolated Git worktree; validated commits, no forced reboot or GC | | `desktop-test.nix`, `desktop-test.py`, `audit-desktop.sh`, `update-test.py` | Disposable graphical audit and updater failure/concurrency tests | | `network.nix` | WireGuard/OpenVPN clients and network diagnostics; optional resolved, host-owned interface management | | `neovim.nix`, `neovim-test.lua` | Editor, unchanged upstream dotfile deployment and opt-in native runtime audit | @@ -62,12 +62,12 @@ From an administrator shell: ```sh cd /etc/nix -nix --extra-experimental-features 'nix-command flakes' flake check --no-build --no-update-lock-file -nix --extra-experimental-features 'nix-command flakes' build \ +nix flake check --no-build --no-update-lock-file +nix build \ .#checks.x86_64-linux.physical-config \ .#checks.x86_64-linux.updates .#checks.x86_64-linux.desktop-config \ --no-update-lock-file --no-link -nix --extra-experimental-features 'nix-command flakes' build \ +nix build \ .#nixosConfigurations.nixos.config.system.build.toplevel \ --no-update-lock-file --out-link result-nixos built=$(readlink -f result-nixos) @@ -132,7 +132,7 @@ nix --extra-experimental-features 'nix-command flakes' build \ .#nixosConfigurations.dev.config.system.build.toplevel --no-update-lock-file ``` -Then review/apply the resulting closure as above. The configuration creates `dev`, sets permissions and deploys its files. **No separate Neovim clone, copy, useradd, chown or global Git-config recipe is required.** +Then review/apply the resulting closure as above. The configuration creates `dev`, sets permissions and deploys its files. **No separate Neovim clone, copy, useradd, chown or global Git-config recipe is required.** After either host configuration is active, `nix-command` and `flakes` are system defaults through `nix.settings.experimental-features`; the temporary flag is only for bootstrapping older bases that cannot read flakes yet. This host build does not use a mutable channel. NixOS's native flake integration pins the `nixpkgs` registry entry and login-shell `` lookup to the system input; the global `nix-path` setting keeps the same pin when `NIX_PATH` is unset. Old root channel profiles are retained for recovery, not used as build inputs. Dev-environment templates/composition remain deferred; there is no flake framework here. @@ -159,8 +159,8 @@ Make focused changes, format/evaluate them, and commit regularly. Build and acti ## Updates and safety -- **EC2 only:** `nixos-update.timer` checks daily with up to one hour of jitter. Only the stable Nixpkgs/Home Manager branches advance; Neovim's source stays fixed. The updater skips a dirty repository, builds in a detached worktree, records a tested commit and applies it without rebooting. It attempts rollback if activation fails and retains recovery generations. Inspect `journalctl -u nixos-update` or trigger it with `sudo systemctl start nixos-update`. -- For a manual input refresh: `nix flake update nixpkgs home-manager`, review `flake.lock`, then check/build. The exact resolved revisions and hashes remain committed. +- **EC2 only:** `nixos-update.timer` checks daily with up to one hour of jitter. Nixpkgs/Home Manager release branches and the latest developer-tool package input advance; Neovim's source stays fixed. The updater skips a dirty repository, builds in a detached worktree, records a tested commit and applies it without rebooting. It attempts rollback if activation fails and retains recovery generations. Inspect `journalctl -u nixos-update` or trigger it with `sudo systemctl start nixos-update`. +- For a manual input refresh: `nix flake update nixpkgs home-manager nixpkgs-latest`, review `flake.lock`, then check/build. The exact resolved revisions and hashes remain committed. - Keep the EC2 module on the EC2 target only. Preserve sandboxing, signature verification and each host's recovery access. - `system.stateVersion` and `home.stateVersion` are both `26.05`; these preserve compatibility, not package versions. - `test` activates changes too; it is not a dry run. Keep the original system generation. diff --git a/common.nix b/common.nix index 833917c..38772ba 100644 --- a/common.nix +++ b/common.nix @@ -11,6 +11,18 @@ ]; nixpkgs.hostPlatform = "x86_64-linux"; + nixpkgs.overlays = [ + (_final: prev: { + # Pi is a fast-moving agent harness; stable branches can be generations old. + # Use the latest resolving Nixpkgs input while keeping the rest of the + # system on the stable release branch. + pi-coding-agent = + (import inputs.nixpkgs-latest { + inherit (prev.stdenv.hostPlatform) system; + config = prev.config or { }; + }).pi-coding-agent; + }) + ]; nix = { channel.enable = false; diff --git a/flake.lock b/flake.lock index 8ca1bcd..44cebcf 100644 --- a/flake.lock +++ b/flake.lock @@ -55,11 +55,28 @@ "type": "github" } }, + "nixpkgs-latest": { + "locked": { + "lastModified": 1788659161, + "narHash": "sha256-rIzUUvgwhfJeWwm7y1ZF+xRo2Gep+QYkxpj9mJbG6cM=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "de0ba0a81b0f6eed798a97fdec6f03a754b9d966", + "type": "github" + }, + "original": { + "owner": "NixOS", + "ref": "master", + "repo": "nixpkgs", + "type": "github" + } + }, "root": { "inputs": { "home-manager": "home-manager", "neovim-dots": "neovim-dots", - "nixpkgs": "nixpkgs" + "nixpkgs": "nixpkgs", + "nixpkgs-latest": "nixpkgs-latest" } } }, diff --git a/flake.nix b/flake.nix index 661d7e1..9b2108d 100644 --- a/flake.nix +++ b/flake.nix @@ -10,6 +10,10 @@ inputs.nixpkgs.follows = "nixpkgs"; }; + # Fast-moving developer tools can lag behind stable release branches. + # flake.lock still records the exact resolved snapshot. + nixpkgs-latest.url = "github:NixOS/nixpkgs/master"; + neovim-dots = { url = "git+https://git.cyber.ayyalasomayajula.net/marsultor/neovim-dots?ref=main&rev=380eb86778a7c53a0f1c18e84f14037456155347"; flake = false; diff --git a/tools.nix b/tools.nix index 71c331b..1a9827c 100644 --- a/tools.nix +++ b/tools.nix @@ -11,6 +11,7 @@ in environment.systemPackages = with pkgs; [ nixfmt + # Overridden in common.nix to stay current beyond stable release lag. pi-coding-agent # Runtime build prerequisites for the unchanged Lazy/Mason plugin workflow. gcc diff --git a/update-system.sh b/update-system.sh index 54fa4e0..b14a5f1 100644 --- a/update-system.sh +++ b/update-system.sh @@ -21,10 +21,10 @@ trap cleanup EXIT git worktree add --detach "$work" "$baseline" cd "$work" -# Only these stable release inputs advance. Neovim's source stays pinned. -nix flake update nixpkgs home-manager +# Advance package inputs to newest resolving branch heads. Neovim stays pinned. +nix flake update nixpkgs home-manager nixpkgs-latest if git diff --quiet -- flake.lock; then - echo 'Stable inputs are already current.' + echo 'Package inputs are already current.' exit 0 fi nix flake check --no-build --no-update-lock-file @@ -32,7 +32,7 @@ nix build .#checks.x86_64-linux.updates .#checks.x86_64-linux.desktop-config \ --no-update-lock-file --no-link git add flake.lock git -c user.name='NixOS Updater' -c user.email='nixos-updater@localhost' \ - commit -m 'chore: update stable NixOS and Home Manager inputs' + commit -m 'chore: update NixOS package inputs' built=$(nix build .#nixosConfigurations.dev.config.system.build.toplevel \ --no-update-lock-file --no-link --print-out-paths) candidate=$(git rev-parse HEAD) diff --git a/update-test.py b/update-test.py index 6617131..2f0ea6f 100644 --- a/update-test.py +++ b/update-test.py @@ -17,7 +17,7 @@ with open(os.environ["CALLS"], "a") as f: f.write(json.dumps([name, *args]) + "\n") if name == "nix": if args[:2] == ["flake", "update"]: - assert args[2:] == ["nixpkgs", "home-manager"] + assert args[2:] == ["nixpkgs", "home-manager", "nixpkgs-latest"] if scenario != "unchanged": pathlib.Path("flake.lock").write_text('{"revision":2}\n') elif args[:2] == ["flake", "check"]: