agentbox/lib/codex-binary.nix at main · DreamLab-AI/agentbox · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
# lib/codex-binary.nix
#
# Nix derivation for OpenAI's Rust-native Codex CLI.
# Release: https://github.com/openai/codex/releases/tag/rust-v0.128.0
#
# Uses the official pre-built musl tarballs (statically-linked, portable)
# rather than buildRustPackage from source — faster, deterministic, and
# matches upstream's own release artefact integrity.
#
# Per-arch SHA256s are pinned below. To bump the version:
#   1. Update codexVersion.
#   2. For each supported platform, run:
#        curl -sL <release-url>/codex-<triple>.tar.gz | sha256sum
#   3. Replace the hex strings below.
#
# Supported targets: x86_64-linux, aarch64-linux (musl).
# darwin / windows are NOT supported — agentbox is Linux-container-only; users
# on other hosts pull the published multi-arch image from GHCR.

{ lib, pkgs }:

let
  codexVersion = "0.128.0";
  baseUrl = "https://github.com/openai/codex/releases/download/rust-v${codexVersion}";

  # Map agentbox's system string to OpenAI's release asset triple.
  # musl tarballs chosen for container portability — a single static binary
  # with no glibc dependency, so it runs in our nix2container image regardless
  # of what libc the base has.
  assets = {
    "x86_64-linux" = {
      name   = "codex-x86_64-unknown-linux-musl.tar.gz";
      sha256 = "886b85e6118c0b43234437ca007fbe923611a53b103d00e0d3ae74aefb20e23a";
    };
    "aarch64-linux" = {
      name   = "codex-aarch64-unknown-linux-musl.tar.gz";
      sha256 = "3161b4d5304feaf7befbb0fcb41bf9a7ee40e31ba7e3ef36d40a00aa3ba6cbd0";
    };
  };

  assetFor = system:
    assets.${system} or (throw ''
      lib/codex-binary.nix: no Codex release asset for system "${system}".
      Supported: ${lib.concatStringsSep ", " (builtins.attrNames assets)}.
      For darwin/windows hosts, pull the published agentbox image from GHCR
      (which is always linux/amd64 or linux/arm64) rather than building
      natively.
    '');

in

{
  # Build a codex derivation for a given system string (e.g. "x86_64-linux").
  # Invoked from flake.nix when toolchainCfg.codex is enabled.
  makeCodex = system:
    let
      asset = assetFor system;
      tarball = pkgs.fetchurl {
        url    = "${baseUrl}/${asset.name}";
        sha256 = asset.sha256;
      };
    in
    pkgs.stdenv.mkDerivation {
      pname   = "codex";
      version = codexVersion;

      src = tarball;

      # Upstream tarballs don't have a wrapping directory — the binary is at
      # the archive root. unpackPhase is a no-op because stdenv handles it,
      # but we set sourceRoot to '.' to handle single-file tarballs uniformly.
      sourceRoot = ".";

      # No build required — pre-compiled binary.
      dontBuild = true;

      # Strip isn't needed (upstream already stripped).
      dontStrip = true;

      # Patchelf is optional on musl (no dynamic linker), but we skip to keep
      # the binary bit-identical to upstream.
      dontPatchELF = true;

      installPhase = ''
        runHook preInstall

        mkdir -p $out/bin
        # The tarball may contain 'codex', 'codex-<arch>', or a directory —
        # cover all common shapes.
        if [ -f codex ]; then
          install -Dm755 codex $out/bin/codex
        elif [ -f codex-x86_64-unknown-linux-musl ]; then
          install -Dm755 codex-x86_64-unknown-linux-musl $out/bin/codex
        elif [ -f codex-aarch64-unknown-linux-musl ]; then
          install -Dm755 codex-aarch64-unknown-linux-musl $out/bin/codex
        else
          # Fall back: find the first executable file and name it 'codex'
          first_exec=$(find . -maxdepth 1 -type f -executable | head -n 1)
          if [ -n "$first_exec" ]; then
            install -Dm755 "$first_exec" $out/bin/codex
          else
            echo "ERROR: no codex binary found in release tarball" >&2
            ls -la
            exit 1
          fi
        fi

        runHook postInstall
      '';

      meta = with lib; {
        description = "OpenAI's Rust-native Codex CLI (terminal agent for code)";
        homepage    = "https://github.com/openai/codex";
        license     = licenses.asl20;
        platforms   = builtins.attrNames assets;
        mainProgram = "codex";
      };
    };
}