feat(nix): install LLM agent CLIs via numtide/llm-agents.nix flake input

CLAUDE.md

@@ -53,6 +53,11 @@ and **GNU Stow** for dotfile symlinking.
 - **Self-managed CLIs**: Tools with native installers that auto-update (e.g.,
   Claude Code) are declared in `selfManagedCLIs` lists at any config level
   (common, platform-specific, or user-specific)
+- **LLM agent CLIs**: Packaged agents (codex, gemini-cli, pi, ...) come from
+  the `llm-agents` flake input (numtide/llm-agents.nix) and are added to
+  `home.packages` in `nix/shared/home/common.nix`. Do not make this input
+  follow another nixpkgs — it is built/cached against its own pin
+  (cache.numtide.com). Update via `./rebuild.sh --update-unstable`
 
 ### Self-Managed CLIs
 

flake.nix

@@ -7,9 +7,11 @@
   nixConfig = {
     extra-substituters = [
       "https://nixos-raspberrypi.cachix.org"
+      "https://cache.numtide.com"
     ];
     extra-trusted-public-keys = [
       "nixos-raspberrypi.cachix.org-1:4iMO9LXa8BqhU+Rpg6LQKiGa2lsNh/j2oiYLNOQ5sPI="
+      "niks3.numtide.com-1:DTx8wZduET09hRmMtKdQDxNNthLQETkc/yaX7M4qK0g="
     ];
   };
 
@@ -56,6 +58,11 @@
       url = "github:nix-community/home-manager/master";
       inputs.nixpkgs.follows = "nixpkgs-unstable";
     };
+    # AI coding agent CLIs (codex, gemini-cli, pi, ...), updated daily upstream.
+    # NOTE: Do NOT make this follow another nixpkgs: packages are built and
+    # cached against its own pinned nixpkgs-unstable, and cache.numtide.com
+    # only serves those builds.
+    llm-agents.url = "github:numtide/llm-agents.nix";
     dotfiles = {
       # Used by home-manager for dotfiles bootstrapping.
       url = "github:fredrikaverpil/dotfiles";

nix/shared/home/common.nix

@@ -8,6 +8,7 @@
 }:
 let
   unstable = inputs.nixpkgs-unstable.legacyPackages.${pkgs.stdenv.hostPlatform.system};
+  llmAgents = inputs.llm-agents.packages.${pkgs.stdenv.hostPlatform.system};
 
   # Bob's neovim proxy (~/.local/share/bob/nvim-bin/nvim) is a copy of the bob
   # binary and inherits its permissions. The Nix-store bob is read-only, so the
@@ -54,11 +55,7 @@ in
     ];
 
     # npm packages via bun (macOS only, mergeable across config levels)
-    packageTools.npmPackages = [
-      "@google/gemini-cli"
-      "@openai/codex"
-      "@earendil-works/pi-coding-agent"
-    ];
+    packageTools.npmPackages = [ ];
 
     # Python CLI tools via uv (mergeable across config levels)
     packageTools.uvTools = [
@@ -188,6 +185,12 @@ in
       slides
       chafa # Required for showing images in slides
 
+      # AI coding agents from the llm-agents flake input (see flake.nix).
+      # Update via `./rebuild.sh --update-unstable` (or --update).
+      llmAgents.codex # @openai/codex
+      llmAgents.gemini-cli # @google/gemini-cli
+      llmAgents.pi # @earendil-works/pi-coding-agent
+
       # ========================================================================
       # Infrastructure & Cloud
       # ========================================================================

rebuild.sh

@@ -65,7 +65,7 @@ use_nix() {
 	# Update only unstable inputs if requested
 	elif [[ "$UPDATE_UNSTABLE" == "true" ]]; then
 		echo "🔄 Updating unstable inputs..."
-		nix flake update nixpkgs-unstable nix-darwin home-manager-unstable dotfiles
+		nix flake update nixpkgs-unstable nix-darwin home-manager-unstable llm-agents dotfiles
 		echo "✅ Unstable inputs updated!"
 	fi