From 6bad956c8fe528fdddca50dd6c3c476af770004c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jos=C3=A9=20Albornoz?= <jojo@eljojo.net>
Date: Sat, 21 Mar 2026 11:13:49 -0400
Subject: [PATCH] fix hash update script, and update hash

---
 nix/package.nix       |  2 +-
 scripts/update-nix.sh | 21 ++++++++++++++++-----
 2 files changed, 17 insertions(+), 6 deletions(-)

diff --git a/nix/package.nix b/nix/package.nix
index 7243d1649..b53b97314 100644
--- a/nix/package.nix
+++ b/nix/package.nix
@@ -42,7 +42,7 @@ buildNpmPackage rec {
 
   # To update: run `nix build` with lib.fakeHash, copy the `got:` hash.
   # CI auto-updates this when package-lock.json changes (see .github/workflows/).
-  npmDepsHash = "sha256-/jkIg4ZVLp+EuMij4YpmtbwLihUtKi8U/jLh981M4CI=";
+  npmDepsHash = "sha256-qRknrMt2VBCCRGGedyTrPEBs3u+Z8lmDZuuvX7mE2Cg=";
 
   # Prevent onnxruntime-node's install script from running during automatic
   # npm rebuild (it tries to download from api.nuget.org, which fails in the sandbox).
diff --git a/scripts/update-nix.sh b/scripts/update-nix.sh
index 9a314d574..387007dfb 100755
--- a/scripts/update-nix.sh
+++ b/scripts/update-nix.sh
@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 # Fix workspace-local lockfile entries and update the Nix dependency hash.
-# Requires: node, npm, nix (with prefetch-npm-deps from nixpkgs)
+# Requires: node, npm, nix
 #
 # Usage:
 #   ./scripts/update-nix.sh          # fix lockfile + update hash
@@ -24,11 +24,22 @@ node "$SCRIPT_DIR/fix-lockfile.mjs" "$LOCK_FILE"
 
 # 2. Prefetch deps and compute hash
 echo "Prefetching npm dependencies..."
-TMPDIR_DEPS="$(mktemp -d)"
-trap "rm -rf $TMPDIR_DEPS" EXIT
 
-prefetch-npm-deps "$LOCK_FILE" "$TMPDIR_DEPS/deps" 2>/dev/null
-NEW_HASH="$(nix hash path "$TMPDIR_DEPS/deps")"
+# Resolve prefetch-npm-deps from the same nixpkgs pinned in flake.lock
+NIXPKGS_URL="$(node -p "
+  const l = JSON.parse(require('fs').readFileSync('$ROOT_DIR/flake.lock', 'utf8'));
+  const n = l.nodes.nixpkgs.locked;
+  'github:' + n.owner + '/' + n.repo + '/' + n.rev;
+")"
+
+STDERR_LOG="$(mktemp)"
+trap "rm -f '$STDERR_LOG'" EXIT
+
+if ! NEW_HASH="$(nix shell "${NIXPKGS_URL}#prefetch-npm-deps" -c prefetch-npm-deps "$LOCK_FILE" 2>"$STDERR_LOG")"; then
+  echo "ERROR: prefetch-npm-deps failed:" >&2
+  tail -20 "$STDERR_LOG" >&2
+  exit 1
+fi
 echo "Computed hash: $NEW_HASH"
 
 # 3. Read current hash