feat(hermes): pre-bundle google-api-python-client into hermes python3 #3

Open

Lauria wants to merge 1 commit from agent/python-tooling into refactor/services-blocks-v2

Lauria commented

2026-06-09 21:17:43 -04:00

Collaborator

What

Add a new modules/hermes-tooling.nix that exposes a single option,
hermes.tooling.python, resolving to a python3 derivation with
google-api-python-client, google-auth-oauthlib, and requests
already on PYTHONPATH. Switch services.hermes-agent.extraPackages
on server to use this new derivation in place of the bare python3.

Why

The hermes agent runs ad-hoc Python scripts for Google Calendar / Drive
/ etc. via the google-api-python-client library. The current setup
only ships python3 in extraPackages, so every script that needs
those libs has to be wrapped in:

nix-shell -p python3 python3Packages.google-api-python-client \
  python3Packages.google-auth-oauthlib \
  --run 'python3 script.py'

This pulls a ~157 MiB closure on every cold invocation (and the first
build can take 30-60s while packages are fetched from the binary
cache). Pre-bundling the libs in the system profile makes
python3 script.py Just Work and removes the wrapper from skill
recipes.

The module is shared (modules/) rather than hard-coded in
devices/server/configuration.nix so any future device that runs the
hermes agent can opt in the same way.

Diffstat

 devices/server/configuration.nix | 14 +++++++-------
 modules/default.nix              |  2 +-
 modules/hermes-tooling.nix       | 42 +++++++++++++++++++++++++++++++++++++++
 3 files changed, 50 insertions(+), 8 deletions(-)

Verification

After nixos-rebuild switch --flake .#server:

# hermes.tooling.python should be a python3 with the libs pre-installed
nix eval .#nixosConfigurations.server.config.hermes.tooling.python.outPath
# → /nix/store/...-python3-3.13.x-env

# A bare script should work without nix-shell:
python3 -c "from googleapiclient.discovery import build; print('ok')"
# → ok

Caveats

Closure size of the system profile grows by ~5 MiB (just the three
libs and their transitive deps). Negligible vs. the build that
nix-shell was already doing on demand.
To add a new library, edit the withPackages list in
modules/hermes-tooling.nix. The python3 derivation is content-
addressed so only the affected layer of the closure rebuilds.
I couldn't run nix eval end-to-end on this host because the
prixdugaz flake input can't be re-fetched from github (SSH auth
denied). The module parses and nix-instantiate --eval on it
succeeds in isolation — but a real nixos-rebuild switch on server
is the definitive test.

## What Add a new `modules/hermes-tooling.nix` that exposes a single option, `hermes.tooling.python`, resolving to a `python3` derivation with `google-api-python-client`, `google-auth-oauthlib`, and `requests` already on `PYTHONPATH`. Switch `services.hermes-agent.extraPackages` on `server` to use this new derivation in place of the bare `python3`. ## Why The hermes agent runs ad-hoc Python scripts for Google Calendar / Drive / etc. via the `google-api-python-client` library. The current setup only ships `python3` in `extraPackages`, so every script that needs those libs has to be wrapped in: ``` nix-shell -p python3 python3Packages.google-api-python-client \ python3Packages.google-auth-oauthlib \ --run 'python3 script.py' ``` This pulls a ~157 MiB closure on every cold invocation (and the first build can take 30-60s while packages are fetched from the binary cache). Pre-bundling the libs in the system profile makes `python3 script.py` Just Work and removes the wrapper from skill recipes. The module is shared (`modules/`) rather than hard-coded in `devices/server/configuration.nix` so any future device that runs the hermes agent can opt in the same way. ## Diffstat ``` devices/server/configuration.nix | 14 +++++++------- modules/default.nix | 2 +- modules/hermes-tooling.nix | 42 +++++++++++++++++++++++++++++++++++++++ 3 files changed, 50 insertions(+), 8 deletions(-) ``` ## Verification After `nixos-rebuild switch --flake .#server`: ```sh # hermes.tooling.python should be a python3 with the libs pre-installed nix eval .#nixosConfigurations.server.config.hermes.tooling.python.outPath # → /nix/store/...-python3-3.13.x-env # A bare script should work without nix-shell: python3 -c "from googleapiclient.discovery import build; print('ok')" # → ok ``` ## Caveats - Closure size of the system profile grows by ~5 MiB (just the three libs and their transitive deps). Negligible vs. the build that `nix-shell` was already doing on demand. - To add a new library, edit the `withPackages` list in `modules/hermes-tooling.nix`. The python3 derivation is content- addressed so only the affected layer of the closure rebuilds. - I couldn't run `nix eval` end-to-end on this host because the `prixdugaz` flake input can't be re-fetched from github (SSH auth denied). The module parses and `nix-instantiate --eval` on it succeeds in isolation — but a real `nixos-rebuild switch` on `server` is the definitive test.

Lauria added 1 commit

2026-06-09 21:17:44 -04:00

feat(hermes): pre-bundle google-api-python-client etc. into hermes python3 2dfae4fac5

Add a shared module exposing hermes.tooling.python — a python3
derivation with google-api-python-client, google-auth-oauthlib, and
requests already on PYTHONPATH. Replace the bare python3 in the
hermes-agent extraPackages list with this new derivation so ad-hoc
nix-shell invocations are no longer needed to run Google API scripts.

This pull request can be merged automatically.

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin agent/python-tooling:agent/python-tooling

git switch agent/python-tooling

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.