alex
e2f24b0876
- awg-tool 0.4.0 -> 0.5.0 - awgen 0.1 -> 0.2 - codeaf 0.7.1 -> 0.8.2 - ds4 -> ee7e840 (2026-10-21) - freebuff 0.2.19 -> 0.2.34 - graphify 0.9.77 -> 0.9.95 (add pyyaml dependency) - hipengine 0.6.1 -> 0.8.3 - kubernetes-mcp-server 0.0.67 -> 0.0.69 (build with go_1_27) - kyojin 1.3 -> 1.7.1 (drop obsolete setup.py/pyproject patches, ship gr_mix_hip from the package, add ninja runtime dependency) - marmel -> de3e99c (2026-10-23) - omniroute 3.8.50 -> 3.8.52 - open-code-review 1.12.12 -> 1.13.3 (build with go_1_27) - pilotdeck 2026.10.17 -> 2026.10.20 - radar 1.16.2 -> 1.18.0 - traycer 1.4.2 -> 1.5.1 Verified: nix build passes for every bumped package; kyojin.tests.jit compiles all five JIT kernels. 🤖 Generated with Codebuff Co-Authored-By: Codebuff <noreply@codebuff.com>
102 lines
4.3 KiB
Nix
102 lines
4.3 KiB
Nix
{
|
|
lib,
|
|
rustPlatform,
|
|
fetchFromGitHub,
|
|
cacert,
|
|
}:
|
|
|
|
rustPlatform.buildRustPackage rec {
|
|
pname = "marmel";
|
|
# Upstream publishes no git tags and no GitHub releases, and Cargo.toml still
|
|
# says 1.0.0, so the version is meaningless and the source is tracked by
|
|
# branch head, dated by nix-update's 0-unstable-* scheme. Bump with
|
|
# nix-update (see passthru.updateScript).
|
|
version = "0-unstable-2026-10-23";
|
|
|
|
src = fetchFromGitHub {
|
|
owner = "Na1w";
|
|
repo = "marmel";
|
|
rev = "de3e99c89b18bf43fbb471930bd9f7a40e1ca1b2";
|
|
hash = "sha256-Z8qvzwSTpri9M05xZ07PJi9xSYIgBOos9bDh0NijSZg=";
|
|
};
|
|
|
|
cargoHash = "sha256-FbtY6K+0tG7JymhG/PnK+SU7SW/IFjG8Wswt+EnWPhg=";
|
|
|
|
nativeCheckInputs = [ cacert ];
|
|
|
|
# Both downstream patches are gone as of b08923eaef60 ("Landlock improvements",
|
|
# Na1w/marmel#17) and 62cb75634c6e ("report missing TLS trust store instead of
|
|
# panicking", #16): upstream now lists /nix/store and /gnu/store in
|
|
# BUILTIN_READONLY_PATHS, and the HTTP client reports a missing trust store
|
|
# instead of panicking through reqwest::Client::default().
|
|
|
|
# The test suite exercises real HTTP round-trips against loopback servers and
|
|
# builds its `reqwest::Client`s through rustls-native-certs, which probes only
|
|
# SSL_CERT_FILE, SSL_CERT_DIR and a fixed list of /etc dirs (/etc/ssl,
|
|
# /etc/pki/tls, ...), none of which exist in the build sandbox. Without a CA
|
|
# bundle the client build fails ("No CA certificates were loaded from the
|
|
# system") and every request fails terminally with ChatError::TrustStore, so
|
|
# point the tests at nixpkgs' bundle. Build-time only; the installed binary
|
|
# still uses the host's trust store at runtime.
|
|
preCheck = ''
|
|
export SSL_CERT_FILE=${cacert}/etc/ssl/certs/ca-bundle.crt
|
|
'';
|
|
|
|
# Serialise the test harness. The lib suite shares process-global worker
|
|
# registries and steer/abort buses (src/orchestrator/workers.rs,
|
|
# src/orchestrator/bus.rs, src/orchestrator/preemption.rs), so the
|
|
# manager-loop tests fail nondeterministically when the harness runs them on
|
|
# parallel threads: rebuilding one unchanged derivation yielded 3 failures,
|
|
# then 1 failure, then 0 with serial threads. Drop this flag once upstream
|
|
# makes that state per-instance.
|
|
#
|
|
# Only the DNS sandbox-exec test is skipped. It re-execs `sh` through
|
|
# `marmel --internal-sandbox-exec` and then reads /etc/resolv.conf, which the
|
|
# no-network build sandbox does not provide (upstream's own decision note in
|
|
# src/harness/sandbox.rs says the same: the exec half works on a store host,
|
|
# the resolv.conf half is a fixture question). Upstream now lists
|
|
# /nix/store and /gnu/store in BUILTIN_READONLY_PATHS, so the cross-directory
|
|
# rename test and test_internal_sandbox_extra_readonly_paths_never_grant_write
|
|
# run for real here: no SKIP line is printed and the lib suite passes at 1055
|
|
# tests with that single filter.
|
|
cargoTestFlags = [
|
|
"--"
|
|
"--test-threads=1"
|
|
"--skip"
|
|
"harness::sandbox::tests::test_internal_sandbox_exec_dev_null_and_dns"
|
|
];
|
|
|
|
# Role prompts are embedded with `include_str!`, so the binary needs no
|
|
# runtime data files. The annotated example configs are the de-facto
|
|
# first-run documentation, since a backend URL and model are mandatory.
|
|
postInstall = ''
|
|
install -Dm644 marmel.toml.example $out/share/doc/${pname}/examples/marmel.toml.example
|
|
install -Dm644 marmel.toml.cloud $out/share/doc/${pname}/examples/marmel.toml.cloud
|
|
'';
|
|
|
|
passthru = {
|
|
category = "AI Coding Agents";
|
|
# nix-update rejects a leading dot in the attribute path (".#marmel" →
|
|
# AttributePathError), so the bare attribute name is what the bare
|
|
# `nix-update --flake` invocation takes. Verify with
|
|
# `nix-update --flake marmel --use-update-script`.
|
|
updateScript = [
|
|
"nix-update"
|
|
"--flake"
|
|
"marmel"
|
|
"--version=branch=main"
|
|
];
|
|
};
|
|
|
|
meta = {
|
|
description = "Autonomous agentic coding assistant with Manager + specialist subagent orchestration over any OpenAI-compatible LLM backend";
|
|
homepage = "https://github.com/Na1w/marmel";
|
|
# Upstream README states MIT, but the repository ships no LICENSE file and
|
|
# Cargo.toml has no license field.
|
|
license = lib.licenses.mit;
|
|
sourceProvenance = with lib.sourceTypes; [ fromSource ];
|
|
mainProgram = "marmel";
|
|
platforms = lib.platforms.unix;
|
|
};
|
|
}
|