* feat: use Nix profiles in sandbox Docker image
Replace manual tool installs (rustup, nodesource, curl installers) in
sandbox-image/Dockerfile.sandbox with a single `nix profile install .#sandbox`.
All tools (Rust, Node, Bun, Deno, Go, gh, sqlx-cli, cargo-watch, Chromium,
Playwright, etc.) are now managed declaratively via flake.nix.
- Add `packages.sandbox` and `packages.sandbox-full` buildEnv outputs to flake.nix
- Add `sandbox-env` helper script for browser tooling env vars
- Update playwrightWrapper to export PLAYWRIGHT_BROWSERS_PATH
- Rewrite Dockerfile.sandbox: Nix replaces ~50 lines of manual installs
- Update entrypoint.sh to source Nix profile PATH
- Delete deprecated root Dockerfile.sandbox
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: sandbox image runs as non-root user with wmdev
- Rewrite entrypoint.sh to start PostgreSQL as current user (no
chown/su needed), fixing "Operation not permitted" when wmdev
runs containers with --user
- Add chmod -R 777 /root and passwd entry for UID 1000 so non-root
containers can access bashrc, nix-profile, and tool configs
- Remove apt postgresql server (Nix profile provides it)
- Fix bash history expansion errors from literal `!` in system prompt
- Fix asciinema path reference (available on PATH, not hardcoded)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: wrap pkg-config in sandbox profiles to bake in Nix search path
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: add openssh-client and sudo to sandbox image for full root access
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: use useradd instead of manual passwd entry for sandbox agent user
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* refactor: rewrite flake.nix from scratch for clarity and modularity
Rewrite the Nix flake with clean separation of concerns, organized
let-bindings, and 4 purpose-specific devShells instead of a monolithic
default shell with broken package outputs.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat: add CLI tools to default devShell (gh, aws, playwright, mermaid, asciinema)
Add tools needed for AI agent workflows and dev tooling:
- gh (GitHub CLI)
- awscli2
- asciinema (terminal recording)
- playwright-driver with Nix-managed browsers
- mermaid-cli (diagram generation)
Playwright browsers are provided via nixpkgs' playwright-driver.browsers.
Mermaid/Puppeteer reuses the headless_shell from the same browser set.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: move wm-minio scripts to default devShell
MinIO (local S3) is needed for regular development, not just the full
profile.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: use playwright wrapper + chromium for browser tools
Replace playwright-driver (library, no CLI) with:
- A `playwright` wrapper script that calls the Nix playwright-core CLI
(version-matched to its own Nix-provided browsers)
- pkgs.chromium for Mermaid/Puppeteer (which respects PUPPETEER_EXECUTABLE_PATH)
This fixes playwright screenshot and mermaid diagram generation.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat: auto-load .env.local from main worktree in all devShells
Gitignored files like .env.local don't exist in git worktrees.
Add a shared shellHook that resolves back to the main tree via
git-common-dir and sources .env.local if present. This ensures
AWS credentials and other secrets are available in worktrees.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: replace deprecated pkgs.hostPlatform with stdenv.hostPlatform
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* chore: remove AWS CLI from flake and sandbox images
Pastebin is sufficient for screenshot sharing; AWS credentials
add unnecessary complexity.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: address PR review — ruby mismatch, quoting, shell dedup
- Fix pkgs.ruby → pkgs.ruby_3_4 in extraRuntimeVars to match extraRuntimes
- Replace $* with "$@" in all helper scripts (wm, wm-build, wm-caddy,
wm-bench, wm-cli) to correctly preserve argument boundaries
- Extract coreBuildInputs, browserVars, and playwrightWrapper as shared
let-bindings to eliminate duplication between default and full shells
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* chore: remove .env.local auto-loading from devShells
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
