From 20a1ed1779c86139df6cb2b07b2cb2f27c0bcadd Mon Sep 17 00:00:00 2001
From: ethernet <arilotter@gmail.com>
Date: Wed, 15 Jul 2026 13:42:35 -0400
Subject: [PATCH] refactor(nix): overlay aliases self packages instead of
 re-instantiating
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The overlay previously re-called callPackage against the consumer's
nixpkgs (`final`), which meant `pkgs.hermes-agent` could be a different
derivation than `nix build .#default` and the NixOS module's default —
an untested build matrix against arbitrary consumer nixpkgs versions,
for a package whose Python side is uv2nix-locked anyway.

Now the overlay is a pure alias for the flake's own locked package:
one callPackage site (packages.nix), everything else references it.
.override { extraPythonPackages = ...; } still works — callPackage's
makeOverridable travels with the derivation.

This also removes callHermesArgs.nix (added earlier this branch): with
a single call site there's nothing left to share.

Verified: direct drvPath == overlaid drvPath, .override produces a
distinct drv, nix flake check exit 0 (all 16 checks).
---
 nix/callHermesArgs.nix | 13 -------------
 nix/overlays.nix       | 14 ++++++++------
 nix/packages.nix       | 13 +++++++------
 3 files changed, 15 insertions(+), 25 deletions(-)
 delete mode 100644 nix/callHermesArgs.nix

diff --git a/nix/callHermesArgs.nix b/nix/callHermesArgs.nix
deleted file mode 100644
index 824192156de..00000000000
--- a/nix/callHermesArgs.nix
+++ /dev/null
@@ -1,13 +0,0 @@
-# nix/callHermesArgs.nix — Shared callPackage arguments for hermes-agent.nix
-#
-# packages.nix (perSystem) and overlays.nix (overlay) both call
-# ./hermes-agent.nix with the same flake-input wiring.  This file is that
-# single set of args — import it and spread, adding only the
-# system-resolved npm-lockfile-fix package at each call site.
-#
-# Only embed clean revs — dirtyRev doesn't represent any upstream commit,
-# so comparing it would always claim "update available".
-inputs: {
-  inherit (inputs) uv2nix pyproject-nix pyproject-build-systems;
-  rev = inputs.self.rev or null;
-}
diff --git a/nix/overlays.nix b/nix/overlays.nix
index aaf7de57d72..53248a8a56e 100644
--- a/nix/overlays.nix
+++ b/nix/overlays.nix
@@ -1,12 +1,14 @@
 # nix/overlays.nix — Expose pkgs.hermes-agent for external NixOS configs
+#
+# The overlay is a pure alias for this flake's own package — NOT a
+# re-instantiation against the consumer's nixpkgs.  This guarantees
+# `pkgs.hermes-agent`, `nix build .#default`, and the NixOS module's
+# default package are all the exact same locked, tested derivation.
+# (.override { extraPythonPackages = ...; } still works — callPackage's
+# makeOverridable travels with the package.)
 { inputs, ... }:
 {
   flake.overlays.default = final: _: {
-    hermes-agent = final.callPackage ./hermes-agent.nix (
-      import ./callHermesArgs.nix inputs
-      // {
-        npm-lockfile-fix = inputs.npm-lockfile-fix.packages.${final.stdenv.hostPlatform.system}.default;
-      }
-    );
+    hermes-agent = inputs.self.packages.${final.stdenv.hostPlatform.system}.default;
   };
 }
diff --git a/nix/packages.nix b/nix/packages.nix
index 1936f843dd4..469306eb81b 100644
--- a/nix/packages.nix
+++ b/nix/packages.nix
@@ -4,12 +4,13 @@
   perSystem =
     { pkgs, lib, inputs', ... }:
     let
-      hermesAgent = pkgs.callPackage ./hermes-agent.nix (
-        import ./callHermesArgs.nix inputs
-        // {
-          npm-lockfile-fix = inputs'.npm-lockfile-fix.packages.default;
-        }
-      );
+      hermesAgent = pkgs.callPackage ./hermes-agent.nix {
+        inherit (inputs) uv2nix pyproject-nix pyproject-build-systems;
+        npm-lockfile-fix = inputs'.npm-lockfile-fix.packages.default;
+        # Only embed clean revs — dirtyRev doesn't represent any upstream
+        # commit, so comparing it would always claim "update available".
+        rev = inputs.self.rev or null;
+      };
     in
     {
       packages = {