Migrate the package set from nixpkgs to ekapkgs

[srid]

Draft until just ci is green. Darwin and Linux nix build .#olai both succeed. Do not put ekapkgs packages into corepkgs.

First just ci macos pass against 9c98faa19

Run 0mu5tbbpt-hr7vusln — both platforms, strict mode, so every leg posted to this PR. Cancelled by hand after ~10 minutes; this is what it had shown:

• Green on both platforms: _ci-setup, hm-module, plugin-fold, plugin-checks.
• kolu-ci-2 died mid-install, and its legs went with it: test[2-of-6]::install, typecheck[2-of-6]::install, e2e[2-of-6]::install and e2e[2-of-6]::nix errored, test[2-of-6]/typecheck[2-of-6]/e2e[2-of-6] skipped. The log says it was the host, not the recipe:

  [odu] shard lane died: surface stdio transport closed:
        odu-runner on kolu-ci-2: the peer stopped answering the keep-alive ping
  

  odu hosts now reports kolu-ci-2 … down — 'nix build' exited with code 1, and the box does not answer ssh.
• Every shard log carries the cache warning — ignoring untrusted substituter 'https://ekala-corepkgs.cachix.org', you are not a trusted user — so the runners were compiling nodejs/llvm/rustc from source, which is what killed that host.
• Darwin never got past install: building '/nix/store/0s3cwcs…-nodejs-24.20.0.drv', the disk wall in the section below.

Merges of master — 2026-09-17

Head is 9c98faa19 (Merge origin/master (#615) into the ekapkgs migration). Two merges landed today, both pushed:

• 9c98faa19 — master f9ada10bd (#615, Perfect backlinks). Clean: the commit touches only TypeScript (packages/format/src/imports.ts, ReferrersSection.tsx, backlinks memory), no nix, no conflicts. Everything below stands.

• d95882fff — master 97350f090 (#616). Was DIRTY; four conflicting paths resolved as follows (the commit message carries the same detail).

• npins/sources.json — ekapkgs stays; master's new pins (fenix, himalaya, pimalaya) come in; the branch's oss-olai bump wins. The nixpkgs pin has to come back, which undoes part of this migration: master's packages/plugins/mail/default.nix calls the himalaya pin with nixpkgs = "${npins.nixpkgs}", so dropping that pin leaves pins.nixpkgs missing. himalaya's own default.nix imports a real nixpkgs tree; ekapkgs cannot stand in for it.

• shell.nix — master's shape wins where the fold replaced shell state: OLAI_PLUGIN_INSTALL / OLAI_PLUGIN_EXTERNALS instead of the per-pin OLAI_ODU_*, and OLAI_KOLU_MARK_DIR / OLAI_ODU_MARK_DIR are gone (@olai/plugin-kit's mark.nix owns marks now). The migration's half stays: pkgs.mkDevShell, __structuredAttrs = false, and the tools list with nodejs.v24 and no npins. Master's env = {-closing }; went with it.

• nix/acp-agent.nix — deleted on master (its content is plugin-kit/nix/npm-adapter.nix plus the per-plugin default.nix files), so the deletion is accepted. The migration's ekapkgs npm-layout adaptation survives where master kept it: packages/plugins/codex/acp/default.nix keeps the @agentclientprotocol/codex-acp / $pname fallback through the merge, and claude/pi pass a shimName equal to the derivation's pname — the same $out/lib/node_modules/<name> directory under ekapkgs' npmInstallHook.

• docs/architecture/overview.md — master's marks paragraph, the migration's vendored-fonts note.

Evaluation: green on both platforms

Every flake output evaluates, and every drvPath forces, on x86_64-linux (kolu-ci-9) and aarch64-darwin (petit): 15 packages (olai, olai-client, olai-fonts, base, claude-agent, codex-agent, pi-agent, himalaya-bin, odu, odu-bin, kolu-mark, odu-mark, bun2nix, plugin-env), 5 checks (hm-module, plugin-fold, plugin-mail-surface, plugin-odu-surface, plugins) and 2 devShells (default, e2e).

Nothing the merged tree asks for is absent from ekapkgs: esbuild, procps, woff2, dockerTools, jq, patchelf, fetchpatch, lib.fileset, stdenv.hostPlatform.node all resolve.

nix build .#olai at the current head

9c98faa19 on kolu-ci-9: /nix/store/f4bcg1dh7xjmnsaj6v7hkrvha0lyn0zw-olai, built in 37 s (every input already in that host's store), olai --version → olai v0.1.0, olai --help prints its usage. The second merge (master #615) is TypeScript-only and changes none of the nix surface.

What breaks: nix build .#olai, and it is the cache and the disk, not the tree

1. Neither cache covers this closure. On petit — where ci is a trusted user, so the flake's nixConfig applies under --accept-flake-config — the 16 substituted paths split 15 from cache.nixos.asia/oss and 1 from ekala-corepkgs.cachix.org. corepkgs' nodejs-24.20.0 has no entry in either cache, so it is compiled from source on both platforms; so are cmake, himalaya's rust chain (rust-stable-with-std, cargo-vendor-dir, rustc-1.98.0) and, on Linux, llvm-21.1.8. .narinfo for llvm-tblgen-21.1.8.drv, rustc-1.98.0.drv and this tree's olai.drv is 404 on ekala-corepkgs.cachix.org and on cache.nixos.asia/oss.

2. ci@petit fails on disk exhaustion, not on the tree — twice. nodejs-24.20.0 dies in v8's libtool step:

   nodejs> fatal error: libtool: can't write to output file (No space left on device)
   nodejs> make: *** [Makefile:143: node] Error 2
   error: Cannot build '/nix/store/0s3cwcs33620b5n7rcpmrdjxxxjlz60c-nodejs-24.20.0.drv'.
          Reason: builder failed with exit code 2.
   

   Attempt 1 exited 1 with /nix (228 GiB, /dev/disk3s7) at 2.8 GiB free; attempt 2, started once the failed tree was reclaimed and 16 GiB were free, failed the same way with the volume back down to 728 MiB free. Everything the tree itself owns built first, from source, and succeeded: olai-fonts, olai-base (the client bundle — asset: styles-…css, xterm-…js), olai-client, himalaya-2.1.0, cmake-3.31.10, rustc-1.98.0 (bootstrap reached stage 2). The derivation that cannot fit is the one no cache holds.
   Remedy is host-side: free space on petit (nix-collect-garbage, or a bigger volume). Nothing in the tree needs changing.

3. toor on kolu-ci-9 is still not a trusted user, so the run pays every compile — and still succeeds:

   warning: ignoring untrusted substituter 'https://ekala-corepkgs.cachix.org', you are not a trusted user.
   warning: ignoring the client-specified setting 'trusted-public-keys', because it is a restricted setting and you are not a trusted user
   

   nix build --dry-run .#olai listed 44 derivations to build — llvm-tblgen-21.1.8, llvm-21.1.8, rustc-1.98.0, cargo-1.98.0, nodejs-24.20.0, cmake-3.31.10, himalaya-2.1.0, procps-4.0.4, ripgrep-15.2.0, prefetch-npm-deps-0.1.0, plus the tree's own npm-deps, olai-acp-claude-0.73.0, olai-acp-pi-0.0.33, olai-base, olai-client, olai-fonts, olai. The run finished EXIT=0 in ~50 min on 32 cores, with zero errors, and the artifact answers: olai --help prints its usage, olai --version prints olai v0.1.0. So on Linux the merged tree — master's plugin fold included, ekapkgs' npmInstallHook layout and all — builds.

4. The merge makes the compile bigger: master's mail plugin hands himalaya (npins.himalaya + pimalaya + fenix) to the fold as a knob, so the rust toolchain is now inside the olai closure where it previously was not.

The nix-cache run for d95882fff (ubuntu + macos-latest-xlarge) is what would warm oss — and oss is a trusted substituter for toor, which is the fleet's path rather than the ekala cache's. Linux is proven green without it, at the cost of ~50 minutes of compiles; petit cannot get there at all until its /nix has room (a nix-collect-garbage on a ~150 GiB store, or a bigger volume). Warming oss is what would turn both into substitutions.

Summary

The package set is ekapkgs, pinned via npins the same way nixpkgs was (fetchTarball; the only flake input is bun2nix). Import is nix/ekapkgs.nix. Cache: ekala-corepkgs.cachix.org beside cache.nixos.asia/oss.

Current pin: ekala-project/ekapkgs master @ e1252ca5 (sha256 AeH2edfOTISToIEr8n+18reILmmrvrbuWM43nibFmKY=), after ekapkgs#8 merged (ripgrep 15.2.0, npins 0.5.1, nixpkgs-fmt 1.3.0) on Darwin-capable corepkgs#185.

HEAD: 9c98faa19 (merge of master #615, 2026-09-17). Branch: migrate-ekapkgs.

Builds

Platform	Host	Result
aarch64-darwin	ci@petit (trusted)	nix build .#olai → /nix/store/akg5prgj9rfasnshw9pqkql6yjgq56j6-olai (olai --help works)
x86_64-linux	toor@kolu-ci-9	nix build .#olai → /nix/store/cy0bn73ingjg0y4rwa4x9jp2lj0qr391-olai (olai --help works)
aarch64-darwin	ci@petit	d95882fff: FAILS (attempts 1 and 2, both exit 1) — nodejs-24.20.0 ENOSPC, taking olai-acp-claude-0.73.0 and olai down with it; olai-base/olai-client/olai-fonts/himalaya/rustc had already built
x86_64-linux	toor@kolu-ci-9	d95882fff: GREEN — nix build .#olai → /nix/store/mmhm9b8fxjhcmd9nrn5fqx0zccihcsww-olai, olai --version → olai v0.1.0; 44 drvs built from source, ~50 min on 32 cores

Petit git: Apple /usr/bin/git is an Xcode stub — use a store git. Clone used: /tmp/olai-eka-darwin. Linux clone: /tmp/olai-eka-linux.

Packages / APIs (do not put user tools in corepkgs)

corepkgs is stdenv, compilers, and core APIs. User tools belong in ekapkgs.

Item	Repo	Status
ripgrep 15.2.0	ekapkgs	ekapkgs#8 merged — on this pin
npins 0.5.1	ekapkgs	ekapkgs#8 — olai npins source pin dropped
nixpkgs-fmt 1.3.0	ekapkgs	ekapkgs#8 (tree is still nixpkgs-fmt-shaped; leftover nix/vendor/nixpkgs-fmt.nix deleted)
Hosted fonts	olai vendor	nix/vendor/fonts — ekapkgs#5 is mergeable, not pinned
playwright-driver (chromium-only)	olai overlay	nix/vendor/playwright — draft ekapkgs#9
Darwin unixtools / GYP / rustc LLVM	corepkgs	corepkgs#185 merged
drv.toDevShell	corepkgs	corepkgs#155 OPEN — not pinned; shell is pkgs.mkDevShell

Already on corepkgs Darwin master: stdenv-darwin, git. Do not reopen corepkgs#175. Do not restore ripgrep in corepkgs.

just ci

Blocked on the fleet, not on this tree. toor is not a trusted Nix user, so flake nixConfig cachix keys are ignored (warning: ignoring untrusted substituter 'https://ekala-corepkgs.cachix.org'). Shards then compile gcc/nodejs/clang from source until the odu-runner keep-alive dies (seen on kolu-ci-5 and kolu-ci-9).

Where shards finished: fmt-check, 5/6 test, 5/6 typecheck. Need daemon substituters/trusted-public-keys (or toor in trusted-users) so those hosts can use ekala-corepkgs.cachix.org.

just ci now does odu run --no-wait then odu wait --settle --timeout-ms from ODU_CI_TIMEOUT (just env(), because nix develop drops the outer env). Default watch is still 15m; use ODU_CI_TIMEOUT=6h just ci until the cache works.

Conventions

• Node: pkgs.nodejs.v24. No top-level pkgs.nodejs_24.
• Shell: pkgs.mkDevShell. corepkgs defaults __structuredAttrs; packages then miss PATH under nix develop -c, so this tree sets __structuredAttrs = false and a shellHook PATH until corepkgs#155 is on Darwin-capable master.
• Bun: 1.4.1 from corepkgs. nix/bun.nix overlay is gone.
• npm layout: ekapkgs npmInstallHook installs under $out/lib/node_modules/${pname}.
• patchelf: patchelf, not patchelfUnstable.
• GHA nix-cache: linux + macos-latest-xlarge. attic-client from pinned nixpkgs SHA afb4584a80bbf779ce0f691509ff902d188c2b3d.
• Fonts: vendored in nix/vendor/fonts, converted by packages/fonts/default.nix. Drop when ekapkgs#5 is on the pin.
• Playwright FODs: keep as playwright-driver inner chrome/ffmpeg, not pkgs.chromium / pkgs.ffmpeg.

Upstream

Repo	Kind	Link	What	This PR
ekapkgs	PR	#8	ripgrep, npins, nixpkgs-fmt	MERGED — pin e1252ca5
ekapkgs	PR	#5	Hosted typefaces	OPEN, mergeable — not pinned; fonts vendored
ekapkgs	PR	#9	playwright-driver 1.61.1	DRAFT
corepkgs	PR	#185	Darwin unixtools/GYP/rustc LLVM	MERGED
python-packages	PR	#17	charset-normalizer withMypyc	MERGED
corepkgs	PR	#173	bun 1.4.1	MERGED
corepkgs	PR	#155	drv.toDevShell	OPEN — not pinned

Closed without merging: corepkgs#174. Darwin stdenv corepkgs#175 stays closed.

What ekapkgs does not yet ship

nix/overlay.nix / nix/vendor still overlay:

• hosted fonts (nix/vendor/fonts)
• chromium-only playwright-driver

Test plan

• Darwin nix eval of pkgs.stdenv on ci@petit (stdenv-darwin)
• Darwin nix eval .#packages.aarch64-darwin.olai
• Darwin nix build .#olai on ci@petit
• Linux nix eval .#packages.x86_64-linux.olai
• Linux nix build .#olai on kolu-ci-9
• just ci / odu run --platform x86_64-linux — blocked on untrusted substituters
• just e2e shard (needs the above)
• Hosted fonts from ekapkgs once tests: unit/integration split, parallel raco test, cli.rkt four ways #5 is on the pin (nix build .#olai-fonts already works from the vendor overlay)

[srid]

Pin updated to ekapkgs master bcc18c13 (lib.mkFlake + corepkgs bump) with ekapkgs#5 rebased on top (c6c13602). Vanilla pin now has ripgrep, default nodejs 24.20.0, bun 1.4.0. Overlay still supplies mkShell, bun 1.4.1, npins, nixpkgs-fmt, playwright-driver.

[srid]

corepkgs#172 is not fixed for ekapkgs consumers: corepkgs' own charset-normalizer already has withMypyc, but ekapkgs overlays python-packages, which still does not take that argument. Vanilla ekapkgs master still fails the repro.

• Comment: fetch-cargo-vendor: charset-normalizer.override { withMypyc = false } fails with python-pkgs ekala-project/corepkgs#172 (comment)
• Fix: charset-normalizer: accept withMypyc ekala-project/python-packages#17
• ekapkgs#5 now also pins that PR head; this branch dropped the local overlay.

[srid]

Keeping this as a draft: ekapkgs cannot evaluate on Darwin yet (stdenv/darwin is missing, so pkgs.stdenv does not instantiate on aarch64-darwin). Linux is the path that works. Ready for review once upstream has macOS support.