feat: package moshi-hook as Nix overlay - #2147
Conversation
|
|
You do not have enough credits to review this pull request. Please purchase more credits to continue. |
📝 WalkthroughSummary by CodeRabbit
WalkthroughAdds a pinned, platform-specific Changesmoshi-hook integration
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request packages the moshi-hook binary as a Nix derivation, adds it to the home-manager package list, and updates the moshi-hook service to reference the package directly from the Nix store instead of a hardcoded home directory path. The review feedback suggests sorting the package list alphabetically and adding dontStrip = true; to the overlay derivation to prevent potential binary corruption or signature invalidation on prebuilt binaries.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
| claude-code | ||
| cmake | ||
| codex | ||
| moshi-hook |
There was a problem hiding this comment.
The package list under lib.optionals stdenv.isLinux is sorted alphabetically. moshi-hook should be moved to its correct alphabetical position, which is between libsecret and opencode.
| dontConfigure = true; | ||
| dontBuild = true; |
There was a problem hiding this comment.
For prebuilt binaries (especially Go binaries or binaries running on macOS), stripping them can corrupt the executable or invalidate ad-hoc code signatures (leading to Killed: 9 errors). It is highly recommended to set dontStrip = true; to prevent Nix from attempting to strip the binary.
dontConfigure = true;
dontBuild = true;
dontStrip = true;
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
overlays/default.nix (1)
77-77: 🚀 Performance & Scalability | 🔵 Trivial | 💤 Low valuePrefer
stdenvNoCC.mkDerivationfor pre-compiled binaries.Since this derivation simply downloads and installs a pre-compiled static binary without compiling any C/C++ code, using
prev.stdenvNoCC.mkDerivationinstead ofprev.stdenv.mkDerivationis considered a best practice in Nix. It avoids bringing the C compiler toolchain into the build dependencies, saving evaluation overhead and build time.♻️ Proposed refactor
- moshi-hook = prev.stdenv.mkDerivation rec { + moshi-hook = prev.stdenvNoCC.mkDerivation rec {🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@overlays/default.nix` at line 77, Update the moshi-hook derivation to use prev.stdenvNoCC.mkDerivation instead of prev.stdenv.mkDerivation, preserving the existing download and installation behavior for the pre-compiled binary.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@overlays/default.nix`:
- Around line 86-94: Correct the architecture condition in the sha256 selection
to use the valid Nixpkgs hostPlatform x86_64 attribute, alongside the existing
isAarch64 check. Also inspect the referenced tarball’s listing and update the
package’s sourceRoot/installPhase handling so the binary named moshi-hook is
found whether extraction places it at the archive root or inside a containing
directory.
---
Nitpick comments:
In `@overlays/default.nix`:
- Line 77: Update the moshi-hook derivation to use prev.stdenvNoCC.mkDerivation
instead of prev.stdenv.mkDerivation, preserving the existing download and
installation behavior for the pre-compiled binary.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 23df47e9-005e-435b-9c8c-96e2087015f1
📒 Files selected for processing (3)
home-manager/packages/default.nixhome-manager/services/moshi-hook/default.nixoverlays/default.nix
| sha256 = | ||
| if prev.stdenv.isLinux && prev.stdenv.hostPlatform.isx86_64 then | ||
| "381ab508dba6e0ea161a2441a1e24f8a4fff974e5c5f48f003117adf306c7008" | ||
| else if prev.stdenv.isLinux && prev.stdenv.hostPlatform.isAarch64 then | ||
| "47520550b9a1f9196954bdb92f33582c09233aa148b1033eb58cd3bfbe9c45b3" | ||
| else if prev.stdenv.isDarwin && prev.stdenv.hostPlatform.isAarch64 then | ||
| "bb4a70ff48d0578e2c4c302178a3e0ed3ce722a8bc751b188c6860450b2e4e13" | ||
| else | ||
| "65d864ef4a4e47461c7c629a5f9109c0e18e54f871933bc9eb847c6edb952358"; |
There was a problem hiding this comment.
🎯 Functional Correctness | 🔴 Critical | ⚡ Quick win
Fix invalid hostPlatform attribute and verify tarball contents.
There is a typo in the architecture check on line 87: prev.stdenv.hostPlatform.isx86_64 should be isx86_64 (with an underscore). The attribute isx86_64 does not exist in Nixpkgs and will cause an evaluation error (attribute 'isx86_64' missing) on Linux systems.
Additionally, please verify that the downloaded .tar.gz extracts a binary exactly named moshi-hook into the root of the archive. If it extracts into a subdirectory (e.g., moshi-hook_Linux_x86_64/moshi-hook), the installPhase will fail because sourceRoot = "." restricts Nix to looking for moshi-hook in the top-level extraction directory.
🐛 Proposed fix for the architecture flag
sha256 =
- if prev.stdenv.isLinux && prev.stdenv.hostPlatform.isx86_64 then
+ if prev.stdenv.isLinux && prev.stdenv.hostPlatform.isx86_64 then
"381ab508dba6e0ea161a2441a1e24f8a4fff974e5c5f48f003117adf306c7008"
else if prev.stdenv.isLinux && prev.stdenv.hostPlatform.isAarch64 thenRun the following script to inspect the tarball layout:
#!/bin/bash
# Description: Check if moshi-hook is at the root level of the tarball
curl -sL https://cdn.getmoshi.app/hook/v0.2.55/moshi-hook_Linux_x86_64.tar.gz | tar -tz🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@overlays/default.nix` around lines 86 - 94, Correct the architecture
condition in the sha256 selection to use the valid Nixpkgs hostPlatform x86_64
attribute, alongside the existing isAarch64 check. Also inspect the referenced
tarball’s listing and update the package’s sourceRoot/installPhase handling so
the binary named moshi-hook is found whether extraction places it at the archive
root or inside a containing directory.
![indent-zero[bot]](https://avatars.githubusercontent.com/in/1426746?s=60&v=4){kind=small}
| claude-code | ||
| cmake | ||
| codex | ||
| moshi-hook |
There was a problem hiding this comment.
Nit — alphabetical ordering: this Linux block is sorted alphabetically (atop, below, binutils, blueman, bubblewrap, claude-code, cmake, codex, collectd, fwupd, gcc, gemini-cli, glib, keychain, libiconv, libsecret, opencode, ...). moshi-hook should sit between libsecret and opencode, not between codex and collectd.
| else if prev.stdenv.isDarwin && prev.stdenv.hostPlatform.isAarch64 then | ||
| "bb4a70ff48d0578e2c4c302178a3e0ed3ce722a8bc751b188c6860450b2e4e13" | ||
| else | ||
| "65d864ef4a4e47461c7c629a5f9109c0e18e54f871933bc9eb847c6edb952358"; |
There was a problem hiding this comment.
Latent — silent fallback: this else returns the Darwin x86_64 hash for every non-enumerated platform. Combined with the URL builder above, an i686-linux or armv7-linux evaluation would fetch moshi-hook_Linux_x86_64.tar.gz (wrong arch) and validate against a Darwin hash, producing a confusing hash-mismatch error rather than a clean 'unsupported platform' failure. Prefer an explicit branch for Darwin x86_64 + else throw "moshi-hook: unsupported platform ${prev.stdenv.hostPlatform.system}", or add meta.platforms = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" "aarch64-darwin" ]; so Nix rejects unsupported hosts before evaluating src.
| dontBuild = true; | ||
| installPhase = '' | ||
| install -Dm755 moshi-hook $out/bin/moshi-hook | ||
| ln -s moshi-hook $out/bin/moshi |
There was a problem hiding this comment.
Nit — the moshi symlink is unused. grep -rn '\bmoshi\b' across the repo shows only moshi-hook invocations (systemd unit, hooks.json, moshi-hooks.ts, homebrew cask). Unless upstream expects both names, this symlink can be removed to keep the derivation minimal.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
1 issue found across 3 files
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="overlays/default.nix">
<violation number="1" location="overlays/default.nix:94">
P2: The `else` branch in the sha256 cascade silently falls through to the Darwin x86_64 hash for any platform not explicitly matched. On an unsupported platform (e.g., 32-bit ARM Linux or `riscv64-linux`), the URL would be constructed as `moshi-hook_Linux_x86_64.tar.gz` but the hash would be the Darwin x86_64 one, causing a confusing hash mismatch rather than a clear, actionable error. Consider either (a) adding `meta.platforms` to the derivation to restrict buildability to only the four supported platform combos, or (b) replacing the fallback hash with an explicit `throw` to surface a clear message when someone evaluates on an unexpected platform.</violation>
</file>
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
| else if prev.stdenv.isDarwin && prev.stdenv.hostPlatform.isAarch64 then | ||
| "bb4a70ff48d0578e2c4c302178a3e0ed3ce722a8bc751b188c6860450b2e4e13" | ||
| else | ||
| "65d864ef4a4e47461c7c629a5f9109c0e18e54f871933bc9eb847c6edb952358"; |
There was a problem hiding this comment.
P2: The else branch in the sha256 cascade silently falls through to the Darwin x86_64 hash for any platform not explicitly matched. On an unsupported platform (e.g., 32-bit ARM Linux or riscv64-linux), the URL would be constructed as moshi-hook_Linux_x86_64.tar.gz but the hash would be the Darwin x86_64 one, causing a confusing hash mismatch rather than a clear, actionable error. Consider either (a) adding meta.platforms to the derivation to restrict buildability to only the four supported platform combos, or (b) replacing the fallback hash with an explicit throw to surface a clear message when someone evaluates on an unexpected platform.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At overlays/default.nix, line 94:
<comment>The `else` branch in the sha256 cascade silently falls through to the Darwin x86_64 hash for any platform not explicitly matched. On an unsupported platform (e.g., 32-bit ARM Linux or `riscv64-linux`), the URL would be constructed as `moshi-hook_Linux_x86_64.tar.gz` but the hash would be the Darwin x86_64 one, causing a confusing hash mismatch rather than a clear, actionable error. Consider either (a) adding `meta.platforms` to the derivation to restrict buildability to only the four supported platform combos, or (b) replacing the fallback hash with an explicit `throw` to surface a clear message when someone evaluates on an unexpected platform.</comment>
<file context>
@@ -73,6 +73,35 @@
+ else if prev.stdenv.isDarwin && prev.stdenv.hostPlatform.isAarch64 then
+ "bb4a70ff48d0578e2c4c302178a3e0ed3ce722a8bc751b188c6860450b2e4e13"
+ else
+ "65d864ef4a4e47461c7c629a5f9109c0e18e54f871933bc9eb847c6edb952358";
+ };
+ sourceRoot = ".";
</file context>
10653e9 to
fad3a51
Compare
1 participant
Summary
moshi-hookv0.2.55 as a Nix overlay (static Go binary fromcdn.getmoshi.app) with SHA256 checksums for all 4 platformsmoshi-hookto Linux home-manager packages~/.local/binTest plan
nix evalsucceeds formaticNixOS configurationmoshi-hook version 0.2.55)moshisymlink created in$out/binnixos-rebuild switchon maticsystemctl --user status moshi-hookshows activeSummary by cubic
Package
moshi-hookv0.2.69 as a Nix overlay, integrate it into the Linux home profile, and add an automated upgrader. The systemd user service now runs from the Nix store for reproducible installs.New Features
$out/binwith amoshisymlink; added to Linuxhome-managerpackages.${pkgs.moshi-hook}/bin/moshi-hook serve.scripts/upgrade-overlays.shupdatesmoshi-hookto the latest release and rewrites checksums.Refactors
make overlays-updatenow skips only in Docker (runs in CI).Written for commit 34d2433. Summary will update on new commits.