┌─ NIX ──────────────────────────────────────────────────────────────────────┐
│ { │
│ lib, │
│ stdenv, │
│ callPackage, │
│ rustPlatform, │
│ fetchFromGitHub, │
│ installShellFiles, │
│ bubblewrap, │
│ clang, │
│ cmake, │
│ gitMinimal, │
│ libcap, │
│ libclang, │
│ librusty_v8 ? │
│ callPackage ./librusty_v8.nix { │
│ inherit (callPackage ./fetchers.nix {}) fetchLibrustyV8; │
│ }, │
│ livekit-libwebrtc, │
│ lld, │
│ makeBinaryWrapper, │
│ nix-update-script, │
│ pkg-config, │
│ openssl, │
│ ripgrep, │
│ versionCheckHook, │
│ installShellCompletions ? stdenv.buildPlatform.canExecute stdenv.hostPlatform, │
│ }: │
│ rustPlatform.buildRustPackage (finalAttrs: { │
│ pname = "codex"; │
│ version = "0.144.1"; │
│ │
│ src = fetchFromGitHub { │
│ owner = "openai"; │
│ repo = "codex"; │
│ tag = "rust-v${finalAttrs.version}"; │
│ hash = "sha256-KHgrqIZyAmLhTZSRYbb7huBO8neOib/B1Vx/oPW2nEU="; │
│ }; │
│ │
│ sourceRoot = "${finalAttrs.src.name}/codex-rs"; │
│ │
│ cargoHash = "sha256-S4dsZXfmKvJItL2XYKyxfhqdCMATEG6oPjrtVRwkuYc="; │
│ │
│ __structuredAttrs = true; │
│ │
│ # Match upstream's release build for the codex binary, plus its │
│ # codex-code-mode-host runtime companion for out-of-process V8 execution. │
│ cargoBuildFlags = [ │
│ "--package" │
│ "codex-cli" │
│ "--package" │
│ "codex-code-mode-host" │
│ ]; │
│ cargoCheckFlags = [ │
│ "--package" │
│ "codex-cli" │
│ "--package" │
│ "codex-code-mode-host" │
│ ]; │
│ │
│ postPatch = '' │
│ # webrtc-sys asks rustc to link libwebrtc statically by default, │
│ # but nixpkgs provides libwebrtc as a shared library. │
│ # use LK_CUSTOM_WEBRTC to point to the packaged library and adjust linking │
│ # to use the shared library instead │
│ substituteInPlace $cargoDepsCopy/*/webrtc-sys-*/build.rs \ │
│ --replace-fail "cargo:rustc-link-lib=static=webrtc" "cargo:rustc-link-lib=dy │
│ lib=webrtc" │
│ substituteInPlace Cargo.toml \ │
│ --replace-fail 'lto = "thin"' "" \ │
│ --replace-fail 'codegen-units = 4' "" │
│ ''; │
│ │
│ nativeBuildInputs = [ │
│ clang │
│ cmake │
│ gitMinimal │
│ installShellFiles │
│ makeBinaryWrapper │
│ pkg-config │
│ ]; │
│ │
│ buildInputs = │
│ [ │
│ libclang │
│ openssl │
│ ] │
│ ++ lib.optionals stdenv.hostPlatform.isLinux [ │
│ libcap │
│ ]; │
│ │
│ # NOTE: set LIBCLANG_PATH so bindgen can locate libclang, and adjust │
│ # warning-as-error flags to avoid known false positives (GCC's │
│ # stringop-overflow in BoringSSL's a_bitstr.cc) while keeping Clang's │
│ # character-conversion warning-as-error disabled. │
│ env = │
│ { │
│ LIBCLANG_PATH = "${lib.getLib libclang}/lib"; │
│ LK_CUSTOM_WEBRTC = lib.getDev livekit-libwebrtc; │
│ NIX_CFLAGS_COMPILE = toString ( │
│ lib.optionals stdenv.cc.isGNU [ │
│ "-Wno-error=stringop-overflow" │
│ ] │
│ ++ lib.optionals stdenv.cc.isClang [ │
│ "-Wno-error=character-conversion" │
│ ] │
│ ); │
│ RUSTY_V8_ARCHIVE = librusty_v8; │
│ } │
│ // lib.optionalAttrs stdenv.hostPlatform.isDarwin { │
│ # Link with lld on Darwin. nixpkgs' classic open-source ld64 fails to insert │
│ # ARM64 branch thunks for this binary, producing `b(l) ARM64 branch out of r │
│ ange`. │
│ NIX_CFLAGS_LINK = "-fuse-ld=${lib.getExe' lld "ld64.lld"}"; │
│ }; │
│ │
│ # NOTE: part of the test suite requires access to networking, local shells, │
│ # apple system configuration, etc. since this is a very fast moving target │
│ # (for now), with releases happening every other day, constantly figuring out │
│ # which tests need to be skipped, or finding workarounds, was too burdensome, │
│ # and in practice not adding any real value. this decision may be reversed in │
│ # the future once this software stabilizes. │
│ doCheck = false; │
│ │
│ postInstall = lib.optionalString installShellCompletions '' │
│ installShellCompletion --cmd codex \ │
│ --bash <($out/bin/codex completion bash) \ │
│ --fish <($out/bin/codex completion fish) \ │
│ --zsh <($out/bin/codex completion zsh) │
│ ''; │
│ │
│ postFixup = '' │
│ wrapProgram $out/bin/codex --prefix PATH : ${ │
│ lib.makeBinPath ([ripgrep] ++ lib.optionals stdenv.hostPlatform.isLinux [bub │
│ blewrap]) │
│ } │
│ ''; │
│ │
│ doInstallCheck = true; │
│ nativeInstallCheckInputs = [versionCheckHook]; │
│ │
│ passthru = { │
│ updateScript = nix-update-script { │
│ extraArgs = [ │
│ "--use-github-releases" │
│ "--version-regex" │
│ "^rust-v(\\d+\\.\\d+\\.\\d+)$" │
│ ]; │
│ }; │
│ }; │
│ │
│ meta = { │
│ description = "Lightweight coding agent that runs in your terminal"; │
│ homepage = "https://github.com/openai/codex"; │
│ changelog = "https://raw.githubusercontent.com/openai/codex/refs/tags/rust-v${ │
│ finalAttrs.version}/CHANGELOG.md"; │
│ license = lib.licenses.asl20; │
│ mainProgram = "codex"; │
│ maintainers = with lib.maintainers; [ │
│ delafthi │
│ jeafleohj │
│ malo │
│ ]; │
│ platforms = lib.platforms.unix; │
│ }; │
│ }) │
└────────────────────────────────────────────────────────────────────────────────────┘
┌─ NIX ────────────────────────────────┐
│ { │
│ lib, │
│ stdenv, │
│ callPackage, │
│ rustPlatform, │
│ fetchFromGitHub, │
│ installShellFiles, │
│ bubblewrap, │
│ clang, │
│ cmake, │
│ gitMinimal, │
│ libcap, │
│ libclang, │
│ librusty_v8 ? │
│ callPackage ./librusty_v8.nix { │
│ inherit (callPackage ./fetchers.nix {} │
│ ) fetchLibrustyV8; │
│ }, │
│ livekit-libwebrtc, │
│ lld, │
│ makeBinaryWrapper, │
│ nix-update-script, │
│ pkg-config, │
│ openssl, │
│ ripgrep, │
│ versionCheckHook, │
│ installShellCompletions ? stdenv.buildPlat │
│ form.canExecute stdenv.hostPlatform, │
│ }: │
│ rustPlatform.buildRustPackage (finalAttrs: { │
│ pname = "codex"; │
│ version = "0.144.1"; │
│ │
│ src = fetchFromGitHub { │
│ owner = "openai"; │
│ repo = "codex"; │
│ tag = "rust-v${finalAttrs.version}"; │
│ hash = "sha256-KHgrqIZyAmLhTZSRYbb7huBO8 │
│ neOib/B1Vx/oPW2nEU="; │
│ }; │
│ │
│ sourceRoot = "${finalAttrs.src.name}/codex │
│ -rs"; │
│ │
│ cargoHash = "sha256-S4dsZXfmKvJItL2XYKyxfh │
│ qdCMATEG6oPjrtVRwkuYc="; │
│ │
│ __structuredAttrs = true; │
│ │
│ # Match upstream's release build for the c │
│ odex binary, plus its │
│ # codex-code-mode-host runtime companion f │
│ or out-of-process V8 execution. │
│ cargoBuildFlags = [ │
│ "--package" │
│ "codex-cli" │
│ "--package" │
│ "codex-code-mode-host" │
│ ]; │
│ cargoCheckFlags = [ │
│ "--package" │
│ "codex-cli" │
│ "--package" │
│ "codex-code-mode-host" │
│ ]; │
│ │
│ postPatch = '' │
│ # webrtc-sys asks rustc to link libwebrt │
│ c statically by default, │
│ # but nixpkgs provides libwebrtc as a sh │
│ ared library. │
│ # use LK_CUSTOM_WEBRTC to point to the p │
│ ackaged library and adjust linking │
│ # to use the shared library instead │
│ substituteInPlace $cargoDepsCopy/*/webrt │
│ c-sys-*/build.rs \ │
│ --replace-fail "cargo:rustc-link-lib=s │
│ tatic=webrtc" "cargo:rustc-link-lib=dylib=we │
│ brtc" │
│ substituteInPlace Cargo.toml \ │
│ --replace-fail 'lto = "thin"' "" \ │
│ --replace-fail 'codegen-units = 4' "" │
│ ''; │
│ │
│ nativeBuildInputs = [ │
│ clang │
│ cmake │
│ gitMinimal │
│ installShellFiles │
│ makeBinaryWrapper │
│ pkg-config │
│ ]; │
│ │
│ buildInputs = │
│ [ │
│ libclang │
│ openssl │
│ ] │
│ ++ lib.optionals stdenv.hostPlatform.isL │
│ inux [ │
│ libcap │
│ ]; │
│ │
│ # NOTE: set LIBCLANG_PATH so bindgen can l │
│ ocate libclang, and adjust │
│ # warning-as-error flags to avoid known fa │
│ lse positives (GCC's │
│ # stringop-overflow in BoringSSL's a_bitst │
│ r.cc) while keeping Clang's │
│ # character-conversion warning-as-error di │
│ sabled. │
│ env = │
│ { │
│ LIBCLANG_PATH = "${lib.getLib libclang │
│ }/lib"; │
│ LK_CUSTOM_WEBRTC = lib.getDev livekit- │
│ libwebrtc; │
│ NIX_CFLAGS_COMPILE = toString ( │
│ lib.optionals stdenv.cc.isGNU [ │
│ "-Wno-error=stringop-overflow" │
│ ] │
│ ++ lib.optionals stdenv.cc.isClang [ │
│ "-Wno-error=character-conversion" │
│ ] │
│ ); │
│ RUSTY_V8_ARCHIVE = librusty_v8; │
│ } │
│ // lib.optionalAttrs stdenv.hostPlatform │
│ .isDarwin { │
│ # Link with lld on Darwin. nixpkgs' cl │
│ assic open-source ld64 fails to insert │
│ # ARM64 branch thunks for this binary, │
│ producing `b(l) ARM64 branch out of range`. │
│ NIX_CFLAGS_LINK = "-fuse-ld=${lib.getE │
│ xe' lld "ld64.lld"}"; │
│ }; │
│ │
│ # NOTE: part of the test suite requires ac │
│ cess to networking, local shells, │
│ # apple system configuration, etc. since t │
│ his is a very fast moving target │
│ # (for now), with releases happening every │
│ other day, constantly figuring out │
│ # which tests need to be skipped, or findi │
│ ng workarounds, was too burdensome, │
│ # and in practice not adding any real valu │
│ e. this decision may be reversed in │
│ # the future once this software stabilizes │
│ . │
│ doCheck = false; │
│ │
│ postInstall = lib.optionalString installSh │
│ ellCompletions '' │
│ installShellCompletion --cmd codex \ │
│ --bash <($out/bin/codex completion bas │
│ h) \ │
│ --fish <($out/bin/codex completion fis │
│ h) \ │
│ --zsh <($out/bin/codex completion zsh) │
│ ''; │
│ │
│ postFixup = '' │
│ wrapProgram $out/bin/codex --prefix PATH │
│ : ${ │
│ lib.makeBinPath ([ripgrep] ++ lib.opti │
│ onals stdenv.hostPlatform.isLinux [bubblewra │
│ p]) │
│ } │
│ ''; │
│ │
│ doInstallCheck = true; │
│ nativeInstallCheckInputs = [versionCheckHo │
│ ok]; │
│ │
│ passthru = { │
│ updateScript = nix-update-script { │
│ extraArgs = [ │
│ "--use-github-releases" │
│ "--version-regex" │
│ "^rust-v(\\d+\\.\\d+\\.\\d+)$" │
│ ]; │
│ }; │
│ }; │
│ │
│ meta = { │
│ description = "Lightweight coding agent │
│ that runs in your terminal"; │
│ homepage = "https://github.com/openai/co │
│ dex"; │
│ changelog = "https://raw.githubuserconte │
│ nt.com/openai/codex/refs/tags/rust-v${finalA │
│ ttrs.version}/CHANGELOG.md"; │
│ license = lib.licenses.asl20; │
│ mainProgram = "codex"; │
│ maintainers = with lib.maintainers; [ │
│ delafthi │
│ jeafleohj │
│ malo │
│ ]; │
│ platforms = lib.platforms.unix; │
│ }; │
│ }) │
└──────────────────────────────────────────────┘