{

lib,

buildNpmPackage,

fetchurl,

nodejs,

ripgrep,

}:

# Command Code, an AI coding agent CLI.

# https://commandcode.ai

# https://github.com/CommandCodeAI/command-code

#

# LICENSING -- READ BEFORE REDISTRIBUTING:

# The npm package declares `"license": "UNLICENSED"` and the GitHub repository

# has no detected SPDX license. "UNLICENSED" is npm's marker for "no rights

# granted", not a synonym for public domain. This is therefore packaged as

# unfree and for local use only. Do NOT push this to a binary cache that other

# people can reach, and do not attempt to upstream it to nixpkgs.

#

# Packaging notes:

# * Not in nixpkgs, and effectively unpackageable there given the license.

# * npm is the only distribution channel: the upstream repo publishes no

# GitHub releases at all, so there is no binary artifact to pin.

# * Unlike the Vercel CLI (see ../vercel-cli), this one is NOT self-contained.

# Running `node dist/index.mjs` against the bare tarball fails immediately

# with ERR_MODULE_NOT_FOUND on '@opentelemetry/api', so the 47 runtime

# dependencies really are required and buildNpmPackage is necessary.

# * The npm tarball ships no package-lock.json, so one is vendored here.

# It was generated by stripping devDependencies/scripts from the published

# package.json and running `npm install --package-lock-only`.

#

# Stripping devDependencies is REQUIRED, not cosmetic: upstream leaves five

# internal monorepo packages in that field --

# @commandcode/{harness,providers,remote,shared,tui}

# -- none of which are published. They are 404 on the public registry, and

# npm resolves the full tree when building a lockfile even under

# `--omit=dev`, so leaving them in makes lock generation impossible. The

# same strip is reapplied in postPatch so the lock matches package.json.

# * dist/ is prebuilt in the tarball, so there is no build step; this

# derivation only has to resolve node_modules and wire up the bins.

# * Upstream exposes four bin names (cmd, cmdc, commandcode, command-code),

# all pointing at dist/index.mjs. npmInstallHook creates all four.

# NOTE: `cmd` is a very generic name to put on PATH -- see meta.mainProgram

# and consider whether it collides with anything you use.

# * @vscode/ripgrep is an optionalDependency whose postinstall downloads a

# ripgrep binary from the network. Scripts are disabled (as they must be in

# a sandboxed build), so nixpkgs' ripgrep is put on PATH instead.

# * To update: bump version, update `hash`, regenerate package-lock.json as

# described above, then set npmDepsHash from the build failure message.

let

version = "1.74.1";

in

buildNpmPackage {

pname = "command-code";

inherit version nodejs;

src = fetchurl {

url = "https://registry.npmjs.org/command-code/-/command-code-${version}.tgz";

hash = "sha256-fl6fUK0qhF5Y86r6oZegUAU22P/L4BomqKvKMmsChlk=";

};

postPatch = ''

cp ${./package-lock.json} package-lock.json

chmod +w package.json package-lock.json

${lib.getExe nodejs} -e '

const fs = require("fs");

const p = JSON.parse(fs.readFileSync("package.json", "utf8"));

delete p.devDependencies;

delete p.scripts;

delete p.workspaces;

fs.writeFileSync("package.json", JSON.stringify(p, null, 2));

'

'';

npmDepsHash = "sha256-puhRomgBf65s43s8LO3K7D7K/0AklPq1nTiYTVZ/YeI=";

npmFlags = [

"--ignore-scripts"

"--no-audit"

"--no-fund"

];

dontNpmBuild = true;

postInstall = ''

for bin in cmd cmdc commandcode command-code; do

if [ -e "$out/bin/$bin" ]; then

wrapProgram "$out/bin/$bin" \

--prefix PATH : ${lib.makeBinPath [ ripgrep ]}

fi

done

'';

meta = {

description = "AI coding agent CLI for open models";

homepage = "https://commandcode.ai";

# Upstream grants no license: npm says UNLICENSED, repo has no SPDX file.

license = lib.licenses.unfree;

mainProgram = "cmdc";

platforms = lib.platforms.all;

};

}