143 lines
3.7 KiB
Nix
143 lines
3.7 KiB
Nix
{
|
|
description = "Reusable jailed LLM agents (opencode)";
|
|
|
|
inputs = {
|
|
nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
|
|
jail-nix.url = "sourcehut:~alexdavid/jail.nix";
|
|
llm-agents.url = "github:numtide/llm-agents.nix";
|
|
flake-utils.url = "github:numtide/flake-utils";
|
|
};
|
|
|
|
outputs =
|
|
{
|
|
self,
|
|
nixpkgs,
|
|
flake-utils,
|
|
jail-nix,
|
|
llm-agents,
|
|
...
|
|
}:
|
|
flake-utils.lib.eachDefaultSystem (
|
|
system:
|
|
let
|
|
pkgs = nixpkgs.legacyPackages.${system};
|
|
jail = jail-nix.lib.init pkgs;
|
|
|
|
makeJailedAgent =
|
|
{
|
|
name,
|
|
pkg,
|
|
extraPkgs ? [ ],
|
|
extraCombinators ? [ ],
|
|
}:
|
|
jail name pkg (
|
|
with jail.combinators;
|
|
(
|
|
[
|
|
network
|
|
time-zone
|
|
no-new-session
|
|
mount-cwd
|
|
(readwrite (noescape "~/.config/${name}"))
|
|
(readwrite (noescape "~/.local/share/${name}"))
|
|
(readwrite (noescape "~/.local/state/${name}"))
|
|
(add-pkg-deps (
|
|
with pkgs;
|
|
[
|
|
bashInteractive
|
|
curl
|
|
wget
|
|
jq
|
|
git
|
|
which
|
|
ripgrep
|
|
gnugrep
|
|
gawkInteractive
|
|
ps
|
|
findutils
|
|
gzip
|
|
unzip
|
|
gnutar
|
|
diffutils
|
|
]
|
|
))
|
|
(add-pkg-deps extraPkgs)
|
|
]
|
|
++ extraCombinators
|
|
)
|
|
);
|
|
|
|
opencodePkg = llm-agents.packages.${system}.opencode;
|
|
|
|
opencode-jailed = makeJailedAgent {
|
|
name = "opencode";
|
|
pkg = opencodePkg;
|
|
};
|
|
|
|
claudePkg = llm-agents.packages.${system}.claude;
|
|
|
|
claude-jailed = makeJailedAgent {
|
|
name = "claude";
|
|
pkg = claudePkg;
|
|
};
|
|
in
|
|
{
|
|
packages = {
|
|
inherit opencode-jailed claude-jailed;
|
|
};
|
|
|
|
lib = {
|
|
# Call as: inputs.jailed-agents.lib.makeJailed system { extraPkgs = [...]; }
|
|
makeJailed =
|
|
system':
|
|
{
|
|
agentTool,
|
|
extraPkgs ? [ ],
|
|
extraCombinators ? [ ],
|
|
}:
|
|
let
|
|
pkgs' = nixpkgs.legacyPackages.${system'};
|
|
jail' = jail-nix.lib.init pkgs';
|
|
pkg' = llm-agents.packages.${system'}.opencode;
|
|
in
|
|
jail' agentTool pkg' (
|
|
with jail'.combinators;
|
|
(
|
|
[
|
|
network
|
|
time-zone
|
|
no-new-session
|
|
mount-cwd
|
|
(readwrite (noescape "~/.config/${agentTool}"))
|
|
(readwrite (noescape "~/.local/share/${agentTool}"))
|
|
(readwrite (noescape "~/.local/state/${agentTool}"))
|
|
(add-pkg-deps (
|
|
with pkgs';
|
|
[
|
|
bashInteractive
|
|
curl
|
|
wget
|
|
jq
|
|
git
|
|
which
|
|
ripgrep
|
|
gnugrep
|
|
gawkInteractive
|
|
ps
|
|
findutils
|
|
gzip
|
|
unzip
|
|
gnutar
|
|
diffutils
|
|
]
|
|
))
|
|
(add-pkg-deps extraPkgs)
|
|
]
|
|
++ extraCombinators
|
|
)
|
|
);
|
|
};
|
|
}
|
|
);
|
|
}
|