{
  lib,
  rustPlatform,
  fetchFromGitHub,
  cacert,
}:

rustPlatform.buildRustPackage rec {
  pname = "marmel";
  # Upstream publishes no git tags and no GitHub releases, and Cargo.toml still
  # says 1.0.0, so the version is meaningless and the source is tracked by
  # branch head, dated by nix-update's 0-unstable-* scheme. Bump with
  # nix-update (see passthru.updateScript).
  version = "0-unstable-2026-10-23";

  src = fetchFromGitHub {
    owner = "Na1w";
    repo = "marmel";
    rev = "de3e99c89b18bf43fbb471930bd9f7a40e1ca1b2";
    hash = "sha256-Z8qvzwSTpri9M05xZ07PJi9xSYIgBOos9bDh0NijSZg=";
  };

  cargoHash = "sha256-FbtY6K+0tG7JymhG/PnK+SU7SW/IFjG8Wswt+EnWPhg=";

  nativeCheckInputs = [ cacert ];

  # Both downstream patches are gone as of b08923eaef60 ("Landlock improvements",
  # Na1w/marmel#17) and 62cb75634c6e ("report missing TLS trust store instead of
  # panicking", #16): upstream now lists /nix/store and /gnu/store in
  # BUILTIN_READONLY_PATHS, and the HTTP client reports a missing trust store
  # instead of panicking through reqwest::Client::default().

  # The test suite exercises real HTTP round-trips against loopback servers and
  # builds its `reqwest::Client`s through rustls-native-certs, which probes only
  # SSL_CERT_FILE, SSL_CERT_DIR and a fixed list of /etc dirs (/etc/ssl,
  # /etc/pki/tls, ...), none of which exist in the build sandbox. Without a CA
  # bundle the client build fails ("No CA certificates were loaded from the
  # system") and every request fails terminally with ChatError::TrustStore, so
  # point the tests at nixpkgs' bundle. Build-time only; the installed binary
  # still uses the host's trust store at runtime.
  preCheck = ''
    export SSL_CERT_FILE=${cacert}/etc/ssl/certs/ca-bundle.crt
  '';

  # Serialise the test harness. The lib suite shares process-global worker
  # registries and steer/abort buses (src/orchestrator/workers.rs,
  # src/orchestrator/bus.rs, src/orchestrator/preemption.rs), so the
  # manager-loop tests fail nondeterministically when the harness runs them on
  # parallel threads: rebuilding one unchanged derivation yielded 3 failures,
  # then 1 failure, then 0 with serial threads. Drop this flag once upstream
  # makes that state per-instance.
  #
  # Only the DNS sandbox-exec test is skipped. It re-execs `sh` through
  # `marmel --internal-sandbox-exec` and then reads /etc/resolv.conf, which the
  # no-network build sandbox does not provide (upstream's own decision note in
  # src/harness/sandbox.rs says the same: the exec half works on a store host,
  # the resolv.conf half is a fixture question). Upstream now lists
  # /nix/store and /gnu/store in BUILTIN_READONLY_PATHS, so the cross-directory
  # rename test and test_internal_sandbox_extra_readonly_paths_never_grant_write
  # run for real here: no SKIP line is printed and the lib suite passes at 1055
  # tests with that single filter.
  cargoTestFlags = [
    "--"
    "--test-threads=1"
    "--skip"
    "harness::sandbox::tests::test_internal_sandbox_exec_dev_null_and_dns"
  ];

  # Role prompts are embedded with `include_str!`, so the binary needs no
  # runtime data files. The annotated example configs are the de-facto
  # first-run documentation, since a backend URL and model are mandatory.
  postInstall = ''
    install -Dm644 marmel.toml.example $out/share/doc/${pname}/examples/marmel.toml.example
    install -Dm644 marmel.toml.cloud $out/share/doc/${pname}/examples/marmel.toml.cloud
  '';

  passthru = {
    category = "AI Coding Agents";
    # nix-update rejects a leading dot in the attribute path (".#marmel" →
    # AttributePathError), so the bare attribute name is what the bare
    # `nix-update --flake` invocation takes. Verify with
    # `nix-update --flake marmel --use-update-script`.
    updateScript = [
      "nix-update"
      "--flake"
      "marmel"
      "--version=branch=main"
    ];
  };

  meta = {
    description = "Autonomous agentic coding assistant with Manager + specialist subagent orchestration over any OpenAI-compatible LLM backend";
    homepage = "https://github.com/Na1w/marmel";
    # Upstream README states MIT, but the repository ships no LICENSE file and
    # Cargo.toml has no license field.
    license = lib.licenses.mit;
    sourceProvenance = with lib.sourceTypes; [ fromSource ];
    mainProgram = "marmel";
    platforms = lib.platforms.unix;
  };
}