mirror of
https://github.com/NousResearch/hermes-agent.git
synced 2026-11-06 05:17:15 +00:00
Maciej Lisiewski
7062229090
pnpm 12.15.0 (native executable) installs every JS workspace from one pnpm-lock.yaml, imported from package-lock.json with the same resolved versions. website/, the WhatsApp bridge and the photon sidecar stay separate npm projects. Configuration moves from .npmrc and the root manifest into pnpm-workspace.yaml: the 14-day minimumReleaseAge and its excludes, overrides, allowBuilds (the old allowScripts set, with strictDepBuilds failing any unlisted build script), engineStrict, sideEffectsCache: false (in-place rebuilds must not write into the store) and verifyDepsBeforeRun: false (a `pnpm run` never installs). The pnpm version is pinned in pm/lock.json and in root devEngines. pmOnFail: ignore keeps that pin out of pnpm-lock.yaml: a leading pin document makes osv-scanner read zero packages. scripts/build/node-deps.mjs enforces the exact version instead, and every lock reader refuses a multi-document lock. A root preinstall refuses `npm install`; devEngines onFail is warn so npx (MCP servers, the tsc linter) keeps working inside the checkout. User-machine installs run --frozen-lockfile --trust-lockfile (release age is checked when locking, in CI, not per user). node-deps removes npm-era node_modules trees before the first pnpm install. Nix builds the store with fetchPnpmDeps and a hash file that CI checks.
112 lines
3.9 KiB
Nix
112 lines
3.9 KiB
Nix
# nix/packages.nix — Hermes Agent package built with uv2nix
|
|
{ inputs, ... }:
|
|
{
|
|
perSystem =
|
|
{
|
|
pkgs,
|
|
lib,
|
|
inputs',
|
|
...
|
|
}:
|
|
let
|
|
|
|
sandbox = pkgs.callPackage ./sandbox.nix { };
|
|
|
|
# pm/lock.json translated into derivations — one per tool package
|
|
# with an artifact for this system. The lockfile carries resolved
|
|
# urls + hashes, so nix consumes it as pure data. callPackage adds
|
|
# .override/.overrideDerivation to the returned SET; keep only the
|
|
# real derivations.
|
|
pmPackages = lib.filterAttrs (_: lib.isDerivation) (
|
|
pkgs.callPackage ./pm-packages.nix { }
|
|
);
|
|
|
|
dirtyRevision = inputs.self.dirtyRev or null;
|
|
# inputs.self.sourceInfo is a string (store path) in current Nix, not a
|
|
# record. The metadata fields are available as top-level attributes on
|
|
# inputs.self directly. A flake URL's requested ref is intentionally not
|
|
# exposed as self.ref after Nix resolves it to an immutable source, so
|
|
# branch is normally null for remote flakes. Preserve null rather than
|
|
# inventing a sentinel that could be a real branch name.
|
|
rev =
|
|
inputs.self.rev or (if dirtyRevision != null then builtins.substring 0 40 dirtyRevision else null);
|
|
rawRef = inputs.self.ref or null;
|
|
branch = if rawRef != null then builtins.replaceStrings [ "refs/heads/" ] [ "" ] rawRef else null;
|
|
dirty = dirtyRevision != null;
|
|
lastModified = inputs.self.lastModified or null;
|
|
minimal = pkgs.callPackage ./hermes-agent.nix {
|
|
inherit (inputs) uv2nix pyproject-nix pyproject-build-systems;
|
|
# Passed explicitly so `override (prev: ...)` sees it: a function form that appends to
|
|
# `prev.extraDependencyGroups` worked before the shipped groups moved to
|
|
# defaultDependencyGroups, and an argument default never lands in `prev`.
|
|
extraDependencyGroups = [ ];
|
|
inherit pmPackages;
|
|
inherit
|
|
rev
|
|
branch
|
|
dirty
|
|
lastModified
|
|
;
|
|
};
|
|
|
|
# All platform-portable optional integrations pre-built. These are the
|
|
# variant's own groups, not the user's extras, so an
|
|
# `.override { extraDependencyGroups = ...; }` adds to them.
|
|
full = minimal.override {
|
|
defaultDependencyGroups = [
|
|
"anthropic"
|
|
"azure-identity"
|
|
"bedrock"
|
|
"daytona"
|
|
"dingtalk"
|
|
"edge-tts"
|
|
"exa"
|
|
"fal"
|
|
"feishu"
|
|
"firecrawl"
|
|
"messaging"
|
|
"modal"
|
|
"parallel-web"
|
|
"tts-premium"
|
|
"vercel"
|
|
"voice"
|
|
]
|
|
# matrix is Linux-only (oqs/liboqs lacks aarch64-darwin wheels).
|
|
++ lib.optionals pkgs.stdenv.hostPlatform.isLinux [ "matrix" ];
|
|
};
|
|
in
|
|
{
|
|
packages = {
|
|
node-gyp =
|
|
(pkgs.callPackage ./lib.nix {
|
|
inherit pmPackages;
|
|
}).node-gyp;
|
|
default = full;
|
|
|
|
inherit sandbox;
|
|
|
|
inherit minimal;
|
|
|
|
# Ships discord.py + python-telegram-bot + slack-sdk so a plain
|
|
# `nix profile install .#messaging` connects to Discord/Telegram/Slack
|
|
# on first run — lazy-install can't write to the read-only /nix/store.
|
|
messaging = minimal.override {
|
|
defaultDependencyGroups = [ "messaging" ];
|
|
};
|
|
|
|
tui = full.hermesTui;
|
|
web = full.hermesWeb;
|
|
webapp = full.hermesWebapp;
|
|
desktop = full.hermesDesktop;
|
|
|
|
# The fixed-output pnpm store every frontend installs from; its hash
|
|
# lives in nix/pnpm-deps-hash (`nix run .#update-pnpm-lockfile`).
|
|
pnpm-deps = full.hermesNpmLib.pnpmDeps;
|
|
update-pnpm-lockfile = full.hermesNpmLib.updatePnpmLockfile;
|
|
}
|
|
# Every pm lockfile tool as its own installable derivation:
|
|
# `nix build .#pm-ripgrep`, `nix build .#pm-gh`, ...
|
|
// lib.mapAttrs' (name: drv: lib.nameValuePair "pm-${name}" drv) pmPackages;
|
|
};
|
|
}
|