mirror of
https://github.com/NousResearch/hermes-agent.git
synced 2026-11-06 05:17:15 +00:00
Maciej Lisiewski
7062229090
pnpm 12.15.0 (native executable) installs every JS workspace from one pnpm-lock.yaml, imported from package-lock.json with the same resolved versions. website/, the WhatsApp bridge and the photon sidecar stay separate npm projects. Configuration moves from .npmrc and the root manifest into pnpm-workspace.yaml: the 14-day minimumReleaseAge and its excludes, overrides, allowBuilds (the old allowScripts set, with strictDepBuilds failing any unlisted build script), engineStrict, sideEffectsCache: false (in-place rebuilds must not write into the store) and verifyDepsBeforeRun: false (a `pnpm run` never installs). The pnpm version is pinned in pm/lock.json and in root devEngines. pmOnFail: ignore keeps that pin out of pnpm-lock.yaml: a leading pin document makes osv-scanner read zero packages. scripts/build/node-deps.mjs enforces the exact version instead, and every lock reader refuses a multi-document lock. A root preinstall refuses `npm install`; devEngines onFail is warn so npx (MCP servers, the tsc linter) keeps working inside the checkout. User-machine installs run --frozen-lockfile --trust-lockfile (release age is checked when locking, in CI, not per user). node-deps removes npm-era node_modules trees before the first pnpm install. Nix builds the store with fetchPnpmDeps and a hash file that CI checks.
70 lines
2.8 KiB
Nix
70 lines
2.8 KiB
Nix
# nix/devShell.nix — Dev shell that delegates setup to each package
|
|
#
|
|
# Each pnpm workspace package exposes passthru.packageJsonPath (e.g.
|
|
# "ui-tui/package.json"). This file collects them all and passes the
|
|
# list to mkPnpmDevShellHook, which stamps all package.jsons at once,
|
|
# then runs a single `pnpm install --lockfile-only` if any changed and
|
|
# `pnpm install --frozen-lockfile` if the lockfile changed.
|
|
{ ... }:
|
|
{
|
|
perSystem =
|
|
{ pkgs, lib, self', ... }:
|
|
let
|
|
packages = builtins.attrValues self'.packages;
|
|
hermesNpmLib = self'.packages.default.passthru.hermesNpmLib;
|
|
|
|
# Collect all packageJsonPath values from pnpm workspace packages.
|
|
npmPackageJsonPaths = builtins.filter (p: p != null) (
|
|
map (p: p.passthru.packageJsonPath or null) packages
|
|
);
|
|
|
|
hermesAgentDevShellHook = self'.packages.default.passthru.devShellHook;
|
|
in
|
|
{
|
|
devShells.default = pkgs.mkShell {
|
|
packages = with pkgs; [
|
|
(pkgs.runCommand "hermes" { } ''
|
|
mkdir -p $out/bin
|
|
install -Dm755 ${../hermes} $out/bin/hermes
|
|
'')
|
|
self'.packages.sandbox
|
|
]
|
|
# Wayland-only: cage and ghostty pull alsa-lib, which does not
|
|
# evaluate on darwin.
|
|
++ lib.optionals pkgs.stdenv.hostPlatform.isLinux [
|
|
# Headless Wayland compositor for E2E tests (test:e2e:visual).
|
|
# cage renders a single client with no window management, so
|
|
# the Electron window opens at a fixed size without tiling.
|
|
# libglvnd provides libEGL.so.1 that cage needs on NixOS.
|
|
cage
|
|
libglvnd
|
|
# Graphical terminal + Wayland screenshot client for CLI/TUI UI
|
|
# evidence. `cage -- ghostty ...` keeps captures off the user's
|
|
# live compositor; grim runs inside that isolated client session.
|
|
ghostty
|
|
grim
|
|
]
|
|
++ self'.packages.default.passthru.devDeps;
|
|
shellHook = ''
|
|
# The editable venv's .pth resolves the checkout through this.
|
|
export HERMES_PYTHON_SRC_ROOT=$(git rev-parse --show-toplevel)
|
|
|
|
${hermesAgentDevShellHook}
|
|
${hermesNpmLib.mkPnpmDevShellHook npmPackageJsonPaths}
|
|
|
|
# Force Node to use Nix's playwright-test binary instead of node_modules/.bin
|
|
export PATH="${pkgs.playwright-test}/bin:$PATH"
|
|
|
|
# The lock's interpreter is python-build-standalone, whose OpenSSL has
|
|
# no compiled-in NixOS trust store; point it at the CA bundle so
|
|
# urllib/httpx/requests verify certificates like the nixpkgs one.
|
|
export SSL_CERT_FILE="${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
|
|
export NIX_SSL_CERT_FILE="$SSL_CERT_FILE"
|
|
|
|
echo "Hermes Agent dev shell in $HERMES_PYTHON_SRC_ROOT"
|
|
echo "Ready. Run 'hermes' or 'sandbox hermes' to start."
|
|
'';
|
|
};
|
|
};
|
|
}
|