feat(claude): pin Claude Code 2.1.280 until nixos-unstable catches up

[NRGLine4Sec]

Opus 5.5 can't be selected in Claude Code before 2.1.280. Inside the VM the model picker shows "Update to 2.1.280+ to use Opus 5.5", and DISABLE_AUTOUPDATER keeps the CLI from updating itself.

The locked nixpkgs ships 2.1.258 and nixos-unstable is at 2.1.278 right now, so bumping the lock won't fix this yet.

This PR feeds the existing nixpkgs derivation the upstream 2.1.280 release manifest (copied as-is from nixpkgs master) via .override { manifest = ...; }. No package is vendored. The override only applies while pkgs.claude-code is older than the pinned manifest, so it turns into a no-op on the next lock update that brings a newer version. The JSON file can be dropped whenever that's convenient.

Tested:

• nix eval of the agent packages gives claude-code-2.1.280 on x86_64-linux and aarch64-linux
• built on x86_64-linux, claude --version reports 2.1.280 (Claude Code)
• the linux-x64 binary checksum matches the manifest

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features
  • Added support for a pinned Claude Code release when the version available through Nix is older, while continuing to use newer available versions.
  • The release includes builds for macOS, Linux, and Windows across supported ARM and x64 platforms, with Linux builds available for musl environments.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 25b14622-2d47-4f09-a904-1150611c9d64

📥 Commits

Reviewing files that changed from the base of the PR and between e76abad and 1e0b2dc.

📒 Files selected for processing (2)

• modules/agents/claude-code-manifest.json
• modules/agents/claude.nix

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The agent module now loads a Claude Code manifest and compares its version with the nixpkgs package version. It uses an override when nixpkgs has an older version, and adds the selected package to the agent’s extra packages.

Changes

Claude Code package selection

Layer / File(s)	Summary
Manifest-backed package selection modules/agents/claude-code-manifest.json, modules/agents/claude.nix	The manifest records version, build metadata, platform artifacts, and SDK compatibility data. The agent module uses the manifest to override an older nixpkgs package and adds the selected package to extraPackages.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: systemstart

Merge Risk: ⚪ Minimal · up to 1e0b2

The manifest-backed package selection has no identified issue that needs resolution before merge.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: pinning Claude Code version 2.1.280 until nixos-unstable provides that version.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[systemstart]

Thanks — full reasoning is on #22, which carries this same commit plus the
automation: [link to the #22 comment]

Short version: the mechanism is sound and I verified the manifest against
Anthropic's signature, but I want the nixpkgs lock to stay the single source of
what runs in the VM, so I'm not taking a parallel pin — with or without the
updater. On its own this PR would also recreate the manual-bump treadmill at
the next CLI-gated model.

If day-one access matters to you, the same override works from your own
configuration — see the offer on #22 about documenting that in the README.

Closing alongside #22.