From 831254bb71579b67c80758076a862775049f2e22 Mon Sep 17 00:00:00 2001
From: asepharyana <superaseph@gmail.com>
Date: Mon, 3 Aug 2026 06:53:46 +0700
Subject: [PATCH] fix(nix): filter build artifacts from frontend source

path: literals in flakes do NOT respect .gitignore, so a dirty local
out/ (stale chunks from previous builds, e.g. 3y39nidcm2n_s.js from
the removed quick-prompt button) leaked into the sandbox and got
served forever. Add filterSource helper that excludes out, .next,
node_modules, pnpm-lock.yaml from the frontend derivation source.
---
 flake.nix | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/flake.nix b/flake.nix
index 178a61d..b614589 100644
--- a/flake.nix
+++ b/flake.nix
@@ -11,6 +11,19 @@
       let
         pkgs = import nixpkgs { inherit system; };
 
+        # Source filter: `path:` literals do NOT respect .gitignore by default,
+        # so a dirty local out/ (stale chunks from previous builds) leaks into
+        # the sandbox. Filter out build artifacts explicitly.
+        filterSource = { dir, ignore }: builtins.path {
+          path = dir;
+          name = "source";
+          filter = (path: type: let base = baseNameOf path; in !(builtins.elem base ignore));
+        };
+        frontendSrc = filterSource {
+          dir = ./services/frontend;
+          ignore = [ "out" ".next" "node_modules" "pnpm-lock.yaml" ];
+        };
+
         # OpenSSL headers (.dev output) + STATIC libs (pkgsStatic.openssl.out —
         # node-datachannel's CMakeLists sets OPENSSL_USE_STATIC_LIBS=TRUE, and
         # the default `pkgs.openssl` resolves to `bin` which has no lib/) merged
@@ -215,7 +228,7 @@ WRAPPER
           pname = "gmw-frontend";
           version = "1.0.0";
 
-          src = ./services/frontend;
+          src = frontendSrc;
 
           nativeBuildInputs = [ nodejs pnpm pkgs.gnumake pkgs.gcc pkgs.cacert ];