kiro-cli currently builds one FHS environment per sub-command
(kiro-cli, kiro-cli-chat, kiro-cli-term). Since buildFHSEnv supports a
single entry point per environment, that gives each command its own
derivation — each carrying its own unfree license and each requiring
its own entry in the `allowUnfreePredicate` allowlist — alongside
`kiro-cli-unwrapped`, for four predicate names in total.
All three binaries ship in the same upstream artifact and need the same
runtime environment, so one sandbox is enough. The environment's entry
script dispatches to whichever command is passed to it, and
`extraInstallCommands` exposes one thin wrapper per command in
`$out/bin` (the same approach as `aja-desktop-software`). This reduces
the unfree allowlist to two names (`kiro-cli` and `kiro-cli-unwrapped`)
while keeping the unfree license truthful on the unwrapped derivation.
Assisted-by: DeepSeek V4 Flash / Neuralwatt / Pi coding agent
The new kiro-cli TUI extracts an embedded, generic-glibc `bun` to
~/.local/share/kiro-cli/ on first run and exec()s it. Its interpreter
(/lib64/ld-linux-x86-64.so.2) does not exist on NixOS, so the TUI fails
to start.
Split the package into an autoPatchelf'd `unwrapped` derivation and, on
Linux, wrap each command in a minimal buildFHSEnv that provides the
standard loader plus libstdc++/libgcc_s. The extracted bun then runs
unmodified — no build-time execution and no patching of the extracted
asset. Darwin ships a normal .app bundle and is unaffected, so it keeps
using the unwrapped derivation.
This also introduces a `kiro-cli-unwrapped`.
Fixes#516857.
Based on the feedback in #532447, and replaces that PR.
Assisted-by: Claude Code, Claude Opus 4.8
This commit changes my maintainer handle from `cvengler` to `cve`.
The reason for this is, that I feel more comfortable with this handle and
generally go as `cve` everywhere online, with my GitHub username being the
notable exception, due to `cve` already being taken there.
Unfortunately, I was not aware of this when I created this handle, as I thought
it had to be equal to the GitHub username.
Also migrates away from them with these commands, using ast-grep 0.43.0
with these commands in bash (assisted by ChatGPT):
```bash
for old in extractType1 extractType2; do
ast-grep \
--lang nix \
--pattern "\$TOOLS.$old" \
--rewrite '$TOOLS.extract' \
--update-all \
pkgs
done
ast-grep \
--lang nix \
--pattern '$TOOLS.wrapType1' \
--rewrite '$TOOLS.wrapType2' \
--update-all \
pkgs
```
Assisted-by: GPT-5.6-Sol Medium via ChatGPT
