feat(nix): flake has no UI-embedded package — nix run/shell can't serve --ui

[mipmip]

What problem does this solve?

The flake's only package (default) builds the cbm Makefile target, which links src/ui/embedded_stub.c (no assets). So a binary from nix run/nix shell/nix build has no embedded UI, and codebase-memory-mcp --ui=true refuses to start:

--ui requested, but this binary was built without the embedded UI, so the HTTP server will not start.

There's no Nix-native way to get the UI-embedded server — the cbm-with-ui target runs npm ci && npm run build, which needs network access and so can't run in the build sandbox as wired today. (Distinct from #705, which is about build.sh/make failing in the dev shell on macOS.)

Proposed solution

Add two flake outputs alongside default:

• graph-ui — the React frontend built with buildNpmPackage (deps fetched offline from the pinned graph-ui/package-lock.json via npmDepsHash).
• codebase-memory-mcp-ui — the server with those assets embedded: drop the prebuilt dist/ into graph-ui/dist, run scripts/embed-frontend.sh directly, then make cbm-with-ui with frontend/embed marked up-to-date (-o) so npm never runs in the sandbox.

Then nix run .#codebase-memory-mcp-ui -- --ui=true serves the UI. Also document both packages in the README. I have this working locally (verified /, JS, and CSS all serve 200 on x86_64-linux) and would like to open a PR.

Alternatives considered

• Fetch npm deps in a fixed-output derivation by hand — buildNpmPackage already does this and is the idiomatic choice.
• Leave Nix UI-less and point users at scripts/build.sh --with-ui — works, but Nix users reasonably expect nix run to produce a functioning binary.

Confirmations

• I searched existing issues and this is not a duplicate.

[mipmip]

Scope note — the PR for this will also fold in a few small Nix cleanups that touch the same surface, to keep it to one focused change:

• flake version — default.version was pinned at 0.6.0; bumped to 0.9.0 to match the current release.
• flake.lock — refreshed nixpkgs from ~2026-04 (rev 566acc0) to a current 2026-07 snapshot (6cdc7fc); ~3 months stale. Verified nix flake check, nix build .#default, and nix build .#codebase-memory-mcp-ui all pass on the new lock (npmDepsHash still validates).
• .gitignore — added /result + /result-* for the nix build output symlinks.
• README — Installation → Nix section documenting both server packages.

Happy to split any of these out if a maintainer would prefer them as separate PRs.

[DeusData]

Thanks for the clear Nix-specific breakdown. This is triaged as a normal-priority 0.9.2-rc enhancement, with PR #1089 as the current implementation candidate. Review will focus on reproducible offline npm inputs, the new nixpkgs lock provenance, and keeping the standard non-UI package behavior unchanged.