Nix flake build fails in sandboxed environments (network access during buildPhase)

[derekbelrose]

The current flake.nix fails to build in standard Nix sandboxed environments because bun install is called during the buildPhase, which attempts to download dependencies from the network.

Error

  qmd> Running phase: buildPhase
  qmd> bun install v1.3.9 (cf6cdbbb)
  qmd> error: ConnectionRefused downloading tarball typescript@5.9.3
  qmd> error: ConnectionRefused downloading tarball node-llama-cpp@3.14.5
  ... (hundreds of similar errors)

Nix builds run in a sandbox without network access by default. The current buildPhase attempts to fetch packages at build time:

  buildPhase = ''
    export HOME=$(mktemp -d)
    bun install --frozen-lockfile
  '';

Environment

• NixOS 26.05
• nix.settings.sandbox = true (default)
• Using qmd as a flake input in another flake