install: ship hooks as share/codedb/install-hooks.sh + codedb install-hooks, add nix flake

.gitignore

@@ -2,6 +2,10 @@
 .zig-cache/
 zig-out/
 
+# Nix build symlink
+/result
+/result-*
+
 # Local/dev files
 .codedb/
 

README.md

@@ -76,7 +76,7 @@
 curl -fsSL https://codedb.codegraff.com/install.sh | bash
 ```
 
-Downloads the binary for your platform and auto-registers codedb as an MCP server in **Claude Code**, **Codex**, **Gemini CLI**, **Cursor**, **Windsurf**, and **Devin** — each written directly and additively into that tool's config (only when the tool is present). The installer prints the exact `codedb mcp` command it registered plus hook setup pointers for Codex and Claude Code.
+Downloads the binary for your platform and auto-registers codedb as an MCP server in **Claude Code**, **Codex**, **Gemini CLI**, **Cursor**, **Windsurf**, and **Devin** — each written directly and additively into that tool's config (only when the tool is present). The installer prints the exact `codedb mcp` command it registered, and installs the packaged Claude Code and Codex hooks via `share/codedb/install-hooks.sh` (rerun any time with `codedb install-hooks`).
 
 On Windows, run this command inside WSL only if you want the Linux binary inside WSL. For the native Windows binary, use PowerShell below.
 
@@ -254,6 +254,7 @@ backed by api.wiki.codes was removed; DeepWiki replaces that role.)
 | `codedb mcp [path]` | JSON-RPC/MCP server over stdio |
 | `codedb update` | Self-update to the latest release on macOS/Linux; on Windows rerun the PowerShell installer |
 | `codedb nuke` | Uninstall codedb, remove caches/snapshots, and deregister MCP integrations |
+| `codedb install-hooks` | Install Claude Code and Codex hooks from the packaged `share/codedb/install-hooks.sh` script |
 | `codedb --version` | Print version |
 
 **Options:** `--no-telemetry` (or set `CODEDB_NO_TELEMETRY` env var)
@@ -467,6 +468,17 @@ rm -f codedb.snapshot      # remove snapshot from current project only
 
 **Requirements:** Zig `0.17.0-dev.813+2153f8143` (the exact tested development snapshot). See the [migration guide](docs/zig-0.17-migration.md) for reproducible zigup setup.
 
+### Nix
+
+```bash
+nix build                 # release build; binary at result/bin/codedb
+nix run . -- --version    # run the packaged CLI
+nix develop               # shell with the pinned Zig 0.17 dev snapshot
+nix flake check           # build + smoke-test the package
+```
+
+### Zig
+
 ```bash
 git clone https://github.com/justrach/codedb.git
 cd codedb

build.zig

@@ -47,6 +47,7 @@ pub fn build(b: *std.Build) void {
 
     const install_exe = b.addInstallArtifact(exe, .{});
     b.getInstallStep().dependOn(&install_exe.step);
+    b.installFile("install/install-hooks.sh", "share/codedb/install-hooks.sh");
 
     // #618: every macOS slice signs again. The x86_64 codesign crash (#504)
     // was missing load-command headerpad — codesign's appended

build.zig.zon

@@ -11,6 +11,7 @@
     .paths = .{
         "src",
         "vendor/nanoregex",
+        "install/install-hooks.sh",
         "build.zig",
         "build.zig.zon",
     },

docs/hooks-labs.md

@@ -5,8 +5,9 @@ or Claude Code can run hooks around MCP tool calls. Use hooks for local policy,
 logging, and guardrails around calls such as `codedb_search`; do not use them as
 the only security boundary.
 
-The installer registers the MCP server. Hook configuration is separate because
-hooks execute arbitrary commands with your user permissions.
+The installer registers the MCP server. `codedb install-hooks` installs the
+packaged Claude Code and Codex hook configuration; review hooks before enabling
+them because they execute arbitrary commands with your user permissions.
 
 ## Lab 1: Codex Hooks
 

docs/mcp.md

@@ -25,10 +25,11 @@ curl -fsSL https://codedb.codegraff.com/install.sh | bash
 ```
 
 The installer downloads the binary for your platform, drops it in `~/bin`
-(or `$CODEDB_DIR` when set), and auto-registers
-codedb as an MCP server in every client it can find — Claude Code, Codex,
-Gemini CLI, Cursor, Windsurf, and Devin. It prints the exact `codedb mcp` command it
-registered.
+(or `$CODEDB_DIR` when set), installs the packaged hook helper under
+`share/codedb/install-hooks.sh`, and auto-registers codedb as an MCP server in
+every client it can find — Claude Code, Codex, Gemini CLI, Cursor, Windsurf, and
+Devin. It prints the exact `codedb mcp` command it registered and installs the
+Claude Code and Codex hooks.
 
 ### Windows x86_64 (native)
 

flake.nix

@@ -0,0 +1,137 @@
+{
+  description = "codedb - code intelligence server for AI agents";
+
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    # build.zig.zon pins a Zig nightly (minimum_zig_version). nixpkgs only
+    # carries tagged releases, so the toolchain comes from the overlay's
+    # master-<date> snapshot that matches that exact nightly.
+    zig-overlay = {
+      url = "github:mitchellh/zig-overlay";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+  };
+
+  outputs = { self, nixpkgs, zig-overlay }:
+    let
+      lib = nixpkgs.lib;
+      systems = [
+        "x86_64-linux"
+        "aarch64-linux"
+        "x86_64-darwin"
+        "aarch64-darwin"
+      ];
+      forAllSystems = lib.genAttrs systems;
+
+      # Snapshot providing 0.17.0-dev.813+2153f8143 — keep in step with
+      # `.minimum_zig_version` in build.zig.zon.
+      zigSnapshot = "master-2026-06-07";
+      zigFor = system: zig-overlay.packages.${system}.${zigSnapshot};
+
+      # Single source of truth for the version: build.zig.zon.
+      version =
+        let
+          lines = lib.splitString "\n" (builtins.readFile ./build.zig.zon);
+          pattern = "[[:space:]]*\\.version = \"([^\"]+)\",?[[:space:]]*";
+          matches = builtins.filter (m: m != null) (map (l: builtins.match pattern l) lines);
+        in
+        if matches == [ ] then "0.0.0" else builtins.head (builtins.head matches);
+
+      zigFlags = [
+        "-Doptimize=ReleaseFast"
+        "-Dcpu=baseline"
+      ];
+    in
+    {
+      packages = forAllSystems (system:
+        let
+          pkgs = import nixpkgs { inherit system; };
+          zig = zigFor system;
+        in
+        rec {
+          default = codedb;
+          codedb = pkgs.stdenv.mkDerivation {
+            pname = "codedb";
+            inherit version;
+
+            src = lib.cleanSourceWith {
+              src = ./.;
+              filter = path: type:
+                let
+                  name = builtins.baseNameOf path;
+                in
+                !(lib.elem name [
+                  ".git"
+                  ".direnv"
+                  ".zig-cache"
+                  "zig-out"
+                  "result"
+                  "codedb.snapshot"
+                ]);
+            };
+
+            # zig links libc dynamically and bakes in the host's default ELF
+            # interpreter (/lib64/ld-linux-*), which does not exist on NixOS —
+            # autoPatchelfHook rewrites it to the glibc in buildInputs.
+            nativeBuildInputs = [ zig ]
+              ++ lib.optional pkgs.stdenv.hostPlatform.isLinux pkgs.autoPatchelfHook;
+            buildInputs = lib.optional pkgs.stdenv.hostPlatform.isLinux pkgs.stdenv.cc.libc;
+            strictDeps = true;
+            dontConfigure = true;
+            dontBuild = true;
+
+            # All Zig dependencies are vendored as path deps in build.zig.zon,
+            # so the build needs no network access — only writable caches.
+            preInstall = ''
+              export ZIG_GLOBAL_CACHE_DIR="$TMPDIR/zig-global-cache"
+              export ZIG_LOCAL_CACHE_DIR="$TMPDIR/zig-local-cache"
+              mkdir -p "$ZIG_GLOBAL_CACHE_DIR" "$ZIG_LOCAL_CACHE_DIR"
+            '';
+
+            installPhase = ''
+              runHook preInstall
+              zig build install ${lib.escapeShellArgs zigFlags} --prefix "$out" --color off
+              runHook postInstall
+            '';
+
+            doInstallCheck = true;
+            installCheckPhase = ''
+              runHook preInstallCheck
+              "$out/bin/codedb" --version
+              test -f "$out/share/codedb/install-hooks.sh"
+              runHook postInstallCheck
+            '';
+
+            meta = {
+              description = "Code intelligence server for AI agents";
+              homepage = "https://github.com/justrach/codedb";
+              license = lib.licenses.bsd3;
+              mainProgram = "codedb";
+              platforms = lib.platforms.linux ++ lib.platforms.darwin;
+            };
+          };
+        });
+
+      apps = forAllSystems (system: {
+        default = {
+          type = "app";
+          program = lib.getExe self.packages.${system}.default;
+          meta.description = "Run codedb";
+        };
+      });
+
+      checks = forAllSystems (system: {
+        default = self.packages.${system}.default;
+      });
+
+      devShells = forAllSystems (system:
+        let
+          pkgs = import nixpkgs { inherit system; };
+        in
+        {
+          default = pkgs.mkShell {
+            packages = [ (zigFor system) pkgs.jq pkgs.python3 ];
+          };
+        });
+    };
+}