Add support for Nix and NixOS (#130)

* fix: add missing resolved/integrity fields to package-lock.json npm omits resolved URLs and integrity hashes for workspace-local node_modules overrides. This breaks offline installers like Nix's npm ci. Add the missing fields for 25 workspace-hoisted packages. * feat: add Nix flake with package and NixOS module Add a Nix flake that builds the Paseo daemon (server + CLI) and provides a NixOS module for declarative deployment. Package (nix/package.nix): - Builds relay, server, and CLI workspaces - Skips onnxruntime-node install script (sandbox-incompatible) - Rebuilds only node-pty for native terminal support - Source filter excludes app/website/desktop workspaces NixOS module (nix/module.nix): - Systemd service with configurable user, port, listen address - allowedHosts for DNS rebinding protection - relay.enable to toggle remote access via app.paseo.sh - inheritUserEnvironment to expose user tools (git, ssh) to agents - openFirewall and extra environment variables ci: add Nix hash maintenance scripts and workflows scripts/fix-lockfile.mjs: Adds missing resolved/integrity fields to package-lock.json for workspace-local overrides. Idempotent, uses `npm view`. scripts/update-nix.sh: Runs fix-lockfile.mjs, prefetches deps, computes NAR hash, and updates npmDepsHash in nix/package.nix. Supports --check for CI. .github/workflows/nix-build.yml: Builds the Nix package on push/PR and verifies the lockfile and hash are up to date. .github/workflows/fix-nix-hash.yml: Auto-fixes lockfile signatures and Nix hash on dependabot PRs. fix: update npmDepsHash after upstream sync nix: allowlist workspace symlinks instead of blocklist Prevents build failures when upstream adds new workspace packages. * don't block PRs on nix failures * better document npm workaround * fix hash update script, and update hash * integrate with npm run build:daemon * ci: trigger nix build on highlight changes * fix(nix): update npmDepsHash --------- Co-authored-by: Mohamed Boudra <boudra.moha@gmail.com>
2026-03-25 23:42:44 +07:00
parent 765a11c7ab
commit bb560809c7
9 changed files with 716 additions and 25 deletions
@@ -34942,7 +34942,9 @@
        "expo": "*",
        "react": "*",
        "react-native": "*"
-      }
+      },
+      "resolved": "https://registry.npmjs.org/expo-clipboard/-/expo-clipboard-8.0.7.tgz",
+      "integrity": "sha512-zvlfFV+wB2QQrQnHWlo0EKHAkdi2tycLtE+EXFUWTPZYkgu1XcH+aiKfd4ul7Z0SDF+1IuwoiW9AA9eO35aj3Q=="
    },
    "packages/app/node_modules/react-native-nitro-modules": {
      "version": "0.33.8",
@@ -34959,7 +34961,9 @@
      "license": "MIT",
      "funding": {
        "url": "https://github.com/sponsors/colinhacks"
-      }
+      },
+      "resolved": "https://registry.npmjs.org/zod/-/zod-3.25.76.tgz",
+      "integrity": "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ=="
    },
    "packages/cli": {
      "name": "@getpaseo/cli",
@@ -34993,14 +34997,18 @@
      },
      "funding": {
        "url": "https://github.com/chalk/chalk?sponsor=1"
-      }
+      },
+      "resolved": "https://registry.npmjs.org/chalk/-/chalk-5.6.2.tgz",
+      "integrity": "sha512-7NzBL0rN6fMUW+f7A6Io4h40qQlG+xGmtMxfbnH/K7TAtt8JQWVQK+6g0UXKMeVJoyV5EkkNsErQ8pVD3bLHbA=="
    },
    "packages/cli/node_modules/commander": {
      "version": "12.1.0",
      "license": "MIT",
      "engines": {
        "node": ">=18"
-      }
+      },
+      "resolved": "https://registry.npmjs.org/commander/-/commander-12.1.0.tgz",
+      "integrity": "sha512-Vw8qHK3bZM9y/P10u3Vib8o/DdkvA2OtPtZvD871QKjy74Wj1WSKFILMPRPSdUSx5RFK1arlJzEtA4PkFgnbuA=="
    },
    "packages/desktop": {
      "name": "@getpaseo/desktop",
@@ -35351,7 +35359,9 @@
      },
      "engines": {
        "node": ">=18"
-      }
+      },
+      "resolved": "https://registry.npmjs.org/@modelcontextprotocol/sdk/-/sdk-1.20.1.tgz",
+      "integrity": "sha512-j/P+yuxXfgxb+mW7OEoRCM3G47zCTDqUPivJo/VzpjbG8I9csTXtOprCf5FfOfHK4whOJny0aHuBEON+kS7CCA=="
    },
    "packages/server/node_modules/@modelcontextprotocol/sdk/node_modules/ajv": {
      "version": "6.12.6",
@@ -35365,7 +35375,9 @@
      "funding": {
        "type": "github",
        "url": "https://github.com/sponsors/epoberezkin"
-      }
+      },
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.12.6.tgz",
+      "integrity": "sha512-j3fVLgvTo527anyYyJOGTYJbG+vnnQYvE0m5mmkc1TK+nxAppkCLMIL0aZ4dblVCNoGShhm+kzE4ZUykBoMg4g=="
    },
    "packages/server/node_modules/@modelcontextprotocol/sdk/node_modules/express": {
      "version": "5.1.0",
@@ -35405,7 +35417,9 @@
      "funding": {
        "type": "opencollective",
        "url": "https://opencollective.com/express"
-      }
+      },
+      "resolved": "https://registry.npmjs.org/express/-/express-5.1.0.tgz",
+      "integrity": "sha512-DT9ck5YIRU+8GYzzU5kT3eHGA5iL+1Zd0EutOmTE9Dtk+Tvuzd23VBU+ec7HPNSTxXYO55gPV/hq4pSBJDjFpA=="
    },
    "packages/server/node_modules/@modelcontextprotocol/sdk/node_modules/json-schema-traverse": {
      "version": "0.4.1",
@@ -35422,7 +35436,9 @@
      },
      "engines": {
        "node": ">= 0.6"
-      }
+      },
+      "resolved": "https://registry.npmjs.org/accepts/-/accepts-2.0.0.tgz",
+      "integrity": "sha512-5cvg6CtKwfgdmVqY1WIiXKc3Q1bkRqGLi+2W/6ao+6Y7gu/RCwRuAhGEzh5B4KlszSuTLgZYuqFqo5bImjNKng=="
    },
    "packages/server/node_modules/ajv": {
      "version": "8.17.1",
@@ -35436,7 +35452,9 @@
      "funding": {
        "type": "github",
        "url": "https://github.com/sponsors/epoberezkin"
-      }
+      },
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.17.1.tgz",
+      "integrity": "sha512-B/gBuNg5SiMTrPkC+A2+cW0RszwxYmn6VYxB/inlBStS5nx6xHIt/ehKRhIMhqusl7a8LjQoZnjCs5vhwxOQ1g=="
    },
    "packages/server/node_modules/ansi-regex": {
      "version": "6.2.2",
@@ -35446,7 +35464,9 @@
      },
      "funding": {
        "url": "https://github.com/chalk/ansi-regex?sponsor=1"
-      }
+      },
+      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-6.2.2.tgz",
+      "integrity": "sha512-Bq3SmSpyFHaWjPk8If9yc6svM8c56dB5BAtW4Qbw5jHTwwXXcTLoRMkpDJp6VL0XzlWaCHTXrkFURMYmD0sLqg=="
    },
    "packages/server/node_modules/body-parser": {
      "version": "2.2.0",
@@ -35464,7 +35484,9 @@
      },
      "engines": {
        "node": ">=18"
-      }
+      },
+      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.2.0.tgz",
+      "integrity": "sha512-02qvAaxv8tp7fBa/mw1ga98OGm+eCbqzJOKoRt70sLmfEEi+jyBYVTDGfCL/k06/4EMk/z01gCe7HoCH/f2LTg=="
    },
    "packages/server/node_modules/content-disposition": {
      "version": "1.0.0",
@@ -35474,14 +35496,18 @@
      },
      "engines": {
        "node": ">= 0.6"
-      }
+      },
+      "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-1.0.0.tgz",
+      "integrity": "sha512-Au9nRL8VNUut/XSzbQA38+M78dzP4D+eqg3gfJHMIHHYa3bg067xj1KxMUWj+VULbiZMowKngFFbKczUrNJ1mg=="
    },
    "packages/server/node_modules/cookie-signature": {
      "version": "1.2.2",
      "license": "MIT",
      "engines": {
        "node": ">=6.6.0"
-      }
+      },
+      "resolved": "https://registry.npmjs.org/cookie-signature/-/cookie-signature-1.2.2.tgz",
+      "integrity": "sha512-D76uU73ulSXrD1UXF4KE2TMxVVwhsnCgfAyTg9k8P6KGZjlXKrOLe4dJQKI3Bxi5wjesZoFXJWElNWBjPZMbhg=="
    },
    "packages/server/node_modules/finalhandler": {
      "version": "2.1.0",
@@ -35496,21 +35522,27 @@
      },
      "engines": {
        "node": ">= 0.8"
-      }
+      },
+      "resolved": "https://registry.npmjs.org/finalhandler/-/finalhandler-2.1.0.tgz",
+      "integrity": "sha512-/t88Ty3d5JWQbWYgaOGCCYfXRwV1+be02WqYYlL6h0lEiUAMPM8o8qKGO01YIkOHzka2up08wvgYD0mDiI+q3Q=="
    },
    "packages/server/node_modules/fresh": {
      "version": "2.0.0",
      "license": "MIT",
      "engines": {
        "node": ">= 0.8"
-      }
+      },
+      "resolved": "https://registry.npmjs.org/fresh/-/fresh-2.0.0.tgz",
+      "integrity": "sha512-Rx/WycZ60HOaqLKAi6cHRKKI7zxWbJ31MhntmtwMoaTeF7XFH9hhBp8vITaMidfljRQ6eYWCKkaTK+ykVJHP2A=="
    },
    "packages/server/node_modules/media-typer": {
      "version": "1.1.0",
      "license": "MIT",
      "engines": {
        "node": ">= 0.8"
-      }
+      },
+      "resolved": "https://registry.npmjs.org/media-typer/-/media-typer-1.1.0.tgz",
+      "integrity": "sha512-aisnrDP4GNe06UcKFnV5bfMNPBUw4jsLGaWwWfnH3v02GnBuXX2MCVn5RbrWo0j3pczUilYblq7fQ7Nw2t5XKw=="
    },
    "packages/server/node_modules/merge-descriptors": {
      "version": "2.0.0",
@@ -35520,7 +35552,9 @@
      },
      "funding": {
        "url": "https://github.com/sponsors/sindresorhus"
-      }
+      },
+      "resolved": "https://registry.npmjs.org/merge-descriptors/-/merge-descriptors-2.0.0.tgz",
+      "integrity": "sha512-Snk314V5ayFLhp3fkUREub6WtjBfPdCPY1Ln8/8munuLuiYhsABgBVWsozAG+MWMbVEvcdcpbi9R7ww22l9Q3g=="
    },
    "packages/server/node_modules/mime-types": {
      "version": "3.0.1",
@@ -35530,14 +35564,18 @@
      },
      "engines": {
        "node": ">= 0.6"
-      }
+      },
+      "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-3.0.1.tgz",
+      "integrity": "sha512-xRc4oEhT6eaBpU1XF7AjpOFD+xQmXNB5OVKwp4tqCuBpHLS/ZbBDrc07mYTDqVMg6PfxUjjNp85O6Cd2Z/5HWA=="
    },
    "packages/server/node_modules/negotiator": {
      "version": "1.0.0",
      "license": "MIT",
      "engines": {
        "node": ">= 0.6"
-      }
+      },
+      "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-1.0.0.tgz",
+      "integrity": "sha512-8Ofs/AUQh8MaEcrlq5xOX0CQ9ypTF5dl78mjlMNfOK08fzpgTHQRQPBxcPlEtIw0yRpws+Zo/3r+5WRby7u3Gg=="
    },
    "packages/server/node_modules/raw-body": {
      "version": "3.0.2",
@@ -35588,7 +35626,9 @@
      },
      "engines": {
        "node": ">= 18"
-      }
+      },
+      "resolved": "https://registry.npmjs.org/send/-/send-1.2.0.tgz",
+      "integrity": "sha512-uaW0WwXKpL9blXE2o0bRhoL2EGXIrZxQ2ZQ4mgcfoBxdFmQold+qWsD2jLrfZ0trjKL6vOw0j//eAwcALFjKSw=="
    },
    "packages/server/node_modules/serve-static": {
      "version": "2.2.0",
@@ -35601,7 +35641,9 @@
      },
      "engines": {
        "node": ">= 18"
-      }
+      },
+      "resolved": "https://registry.npmjs.org/serve-static/-/serve-static-2.2.0.tgz",
+      "integrity": "sha512-61g9pCh0Vnh7IutZjtLGGpTA355+OPn2TyDv/6ivP2h/AdAVX9azsoxmg2/M6nZeQZNYBEwIcsne1mJd9oQItQ=="
    },
    "packages/server/node_modules/strip-ansi": {
      "version": "7.1.2",
@@ -35614,7 +35656,9 @@
      },
      "funding": {
        "url": "https://github.com/chalk/strip-ansi?sponsor=1"
-      }
+      },
+      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.1.2.tgz",
+      "integrity": "sha512-gmBGslpoQJtgnMAvOVqGZpEz9dyoKTCzy2nfz/n8aIFhN/jCE/rCmcxabB6jOOHV+0WNnylOxaxBQPSvcWklhA=="
    },
    "packages/server/node_modules/type-is": {
      "version": "2.0.1",
@@ -35626,14 +35670,18 @@
      },
      "engines": {
        "node": ">= 0.6"
-      }
+      },
+      "resolved": "https://registry.npmjs.org/type-is/-/type-is-2.0.1.tgz",
+      "integrity": "sha512-OZs6gsjF4vMp32qrCbiVSkrFmXtG/AZhY3t0iAMrMBiAZyV9oALtXO8hsrHbMXF9x6L3grlFuwW2oAz7cav+Gw=="
    },
    "packages/server/node_modules/zod": {
      "version": "3.25.76",
      "license": "MIT",
      "funding": {
        "url": "https://github.com/sponsors/colinhacks"
-      }
+      },
+      "resolved": "https://registry.npmjs.org/zod/-/zod-3.25.76.tgz",
+      "integrity": "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ=="
    },
    "packages/website": {
      "name": "@getpaseo/website",
@@ -35667,7 +35715,9 @@
      "license": "MIT",
      "dependencies": {
        "undici-types": "~6.21.0"
-      }
+      },
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-22.19.6.tgz",
+      "integrity": "sha512-qm+G8HuG6hOHQigsi7VGuLjUVu6TtBo/F05zvX04Mw2uCg9Dv0Qxy3Qw7j41SidlTcl5D/5yg0SEZqOB+EqZnQ=="
    },
    "packages/website/node_modules/react": {
      "version": "19.2.4",