feat(nix): add self-contained flake with generated shell completions

[schickling-assistant]

What

Adds a self-contained flake.nix at the repo root, so nix build works on this repo's own HEAD — and wires it up as this repo's first CI.

Outputs:

• packages.smalltalk / packages.default — st and smalltalk bins, meta.mainProgram = "st"
• checks.help — smoke test running st --help
• checks.completions — asserts every installed shell yields a non-empty script, and that fish output still binds to st
• checks.typecheck — runs the repo's own npm run build (typecheck-only) over src/ and examples/
• devShells.default

Inputs are nixpkgs, flake-utils, and github:compoundingtech/pty (nixpkgs follows). Nothing private, so anyone can build this standalone.

Why

Packaging for this repo currently lives out-of-tree in a private dotfiles wrapper, pinned to a fixed old rev via a smalltalk-src input. That means the repo's own HEAD was never buildable on its own and the packaging silently drifted from the source — the wrapper still symlinked the pre-rename @myobie/pty path, while package.json / package-lock.json now name the dep @compoundingtech/pty. This flake targets the current tree (src = self) and uses the current name.

Version is read from package.json rather than hardcoded. Reconciling that with a richer build identity is tracked in #103.

CI

.github/workflows/nix.yml is the repo's first CI, modeled on compoundingtech/pty's nix.yml: PR + push-to-main, ubuntu-latest, DeterminateSystems/determinate-nix-action@v3.

It runs nix flake check, not nix build — the distinction is the point. nix build would only prove the package compiles; nix flake check additionally evaluates every checks.*, so help, completions, and typecheck all gate the PR. Two of those exercise a real built binary: the completions contract is verified by invoking st completions <shell> on the artifact that was just built, not by inspecting committed files.

The flake is also what makes CI tractable at all here. package.json declares "@compoundingtech/pty": "file:../pty" — a sibling-checkout dependency. A plain Node workflow would have to clone pty next door at some manually-chosen rev and keep that in sync by hand; as a flake input, pty is resolved and pinned by flake.lock like any other dependency.

What CI does not cover

nix flake check does not run this repo's vitest suites. To be precise about why, since it is not the reason you would guess:

• unit — this very nearly works. Installing devDependencies in the sandbox turned out to be surmountable (see mkDevCheck in the flake), and 1322 of 1323 unit tests pass there. The single holdout is tests/unit/cli.test.ts, which asserts st <semver>+<short-sha>; the SHA is produced by shelling out to git rev-parse in the source dir, and a hermetic build has no .git. The CLI degrades gracefully by design — it is only the test that requires a git checkout. Making this green means settling build identity, i.e. Adopt the shared build-identity contract: st --version has no build identity, MCP serverInfo reports a different version #103, so it is deliberately left out rather than papered over.
• integration — not attempted, and shouldn't be: it shells out to rsync and spawns real pty sessions.

So: treat "CI green" as "it builds, the binary runs, completions are intact, and it typechecks" — not as "the test suite passed". Closing the unit gap is a viable follow-up; the cheapest version is skipping that one environment-dependent assertion when git is unavailable, which is a change to the test file and so out of scope for this PR.

Completions contract

Completions are generated at build time by the just-built binary (st completions <shell>), not committed, so they cannot drift from the command tree in src/commands/completions.ts. All three shells the generator supports are installed:

shell	installed path
bash	share/bash-completion/completions/st.bash
zsh	share/zsh/site-functions/_st
fish	share/fish/vendor_completions.d/st.fish

The generator hardcodes complete -c st (and the zsh/bash equivalents), so the scripts are always for st regardless of which bin name invoked them — hence --cmd st and the st.fish filename. checks.completions greps for ^complete -c st so a change that broke that binding would fail the check rather than silently ship dead completions.

Notes

• The sibling file: dep link is expressed as a small npm-name -> store path attrset mapped into ln -s lines, so adding a second sibling repo later is a one-line change.
• checks.typecheck needs devDependencies, which the shipped package omits. Two sandbox obstacles, both documented at mkDevCheck: npm cannot resolve file:../pty through a store symlink (it chmods the linked bin/pty, which is read-only in the store, and fails EPERM), so the sibling is copied to the relative path the lockfile names and made writable; and --ignore-scripts keeps node-pty's native build out of the sandbox. npmDepsHash is unchanged — prefetch-npm-deps already hashes the full lockfile, and --omit=dev is install-time only.
• # TODO(rust): markers flag the three things a Rust rewrite deletes: the npmDepsHash, the sibling-symlink block, and the node --experimental-strip-types bin shims.
• The bin shims export _ST_INVOKED_AS, matching what bin/st does, so smalltalk --help self-identifies correctly.
• Deliberately ships only st and smalltalk (exactly package.json's bin). The dotfiles wrapper also emitted a legacy coord alias, but this repo has zero references to it. No live regression: the dotfiles wrapper is unchanged for now.
• Added /result to .gitignore.

Verification

• nix build .#default succeeds. npmDepsHash = "sha256-CfgSssHEdSjL9liKjaw9aYKMtCJdaxWKGbFM59PgNwg=" (computed via nix run nixpkgs#prefetch-npm-deps -- package-lock.json, confirmed by the build; the two file:../pty entries are expectedly uncacheable and are supplied by the store symlink instead).
• nix flake check passes locally — help, completions, and typecheck all green.
• The workflow YAML was linted (yamllint, zero errors) and parsed before pushing.
• st --help, smalltalk --help, and st completions fish all verified against the built output; the fish script starts with complete -c st -e.