feat(nix): add UI-embedded flake package, refresh lock + docs

Fixes #1088

The flake only built the standard `cbm` target, so `nix run`/`nix shell`
produced a binary without the embedded UI — `--ui=true` refused to start
the HTTP server. Add two flake outputs:

- `graph-ui`: the React frontend built via buildNpmPackage (offline, from
  the pinned package-lock.json; npmDepsHash tracks the lockfile)
- `codebase-memory-mcp-ui`: the server with those assets embedded, built
  by dropping the prebuilt dist/ into place and running the embed + link
  path inside the sandbox (no network access)

Also fold in adjacent Nix cleanups: bump default.version 0.6.0 -> 0.9.0
to match the release, refresh flake.lock (nixpkgs 2026-04 -> 2026-07),
ignore ./result build symlinks, and document both packages in the README.

Signed-off-by: Pim Snel <post@pimsnel.com>

.gitignore

@@ -86,3 +86,7 @@ soak-results-query-leak/
 # Scorecard as a binary artifact in source). Source only, never the build.
 /pkg/go/codebase-memory-mcp
 /pkg/go/codebase-memory-mcp.exe
+
+# Nix build symlinks (nix build → ./result, ./result-1, …)
+/result
+/result-*

README.md

@@ -353,6 +353,38 @@ paru -S codebase-memory-mcp-bin
 
 The `codebase-memory-mcp-bin` package is available at: https://aur.archlinux.org/packages/codebase-memory-mcp-bin
 
+### Nix (flake)
+
+The flake exposes two server packages plus the standalone frontend:
+
+| Package | Contents |
+|---------|----------|
+| `default` (`codebase-memory-mcp`) | Standard server, no UI |
+| `codebase-memory-mcp-ui` | Server with the graph UI embedded (`--ui=true` works) |
+| `graph-ui` | Just the built frontend assets (`dist/`) |
+
+Run directly without installing:
+
+```bash
+# Standard server
+nix run github:DeusData/codebase-memory-mcp
+
+# Server with the embedded graph UI
+nix run github:DeusData/codebase-memory-mcp#codebase-memory-mcp-ui -- --ui=true --port=9749
+# then open http://127.0.0.1:9749
+```
+
+Or build a binary into `./result/bin/codebase-memory-mcp`:
+
+```bash
+nix build github:DeusData/codebase-memory-mcp                          # standard
+nix build github:DeusData/codebase-memory-mcp#codebase-memory-mcp-ui   # with UI
+```
+
+Working in a clone? Use `.` in place of the flake URL, e.g. `nix run .#codebase-memory-mcp-ui -- --ui=true`, or drop into a shell that puts the binary on `PATH` with `nix shell .#codebase-memory-mcp-ui`.
+
+> **Note:** launched by hand (not from an MCP client) the server exits as soon as `stdin` closes — that's normal MCP behaviour. Keep `stdin` open while testing the UI, e.g. `sleep infinity | codebase-memory-mcp --ui=true --port=9749`. The `codebase-memory-mcp-ui` package embeds the UI at build time; `nix run`'ing the standard `default` package with `--ui=true` will refuse to start the HTTP server.
+
 ### Install via Claude Code
 
 ```

flake.lock

@@ -2,11 +2,11 @@
   "nodes": {
     "nixpkgs": {
       "locked": {
-        "lastModified": 1776255774,
-        "narHash": "sha256-psVTpH6PK3q1htMJpmdz1hLF5pQgEshu7gQWgKO6t6Y=",
+        "lastModified": 1783915482,
+        "narHash": "sha256-FmieJB8/OUvNxbkboi7+IGfIuSXY3nF/hZQm8kD0r50=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "566acc07c54dc807f91625bb286cb9b321b5f42a",
+        "rev": "6cdc7fc76e8bf7fde9fa43a849fcaaa70e230dee",
         "type": "github"
       },
       "original": {

flake.nix

@@ -60,10 +60,10 @@
         };
     in
     {
-      packages = forAllSystems (pkgs: {
+      packages = forAllSystems (pkgs: rec {
         default = pkgs.stdenv.mkDerivation {
           pname = "codebase-memory-mcp";
-          version = "0.6.0";
+          version = "0.9.0";
 
           src = ./.;
 
@@ -90,6 +90,56 @@
             platforms = systems;
           };
         };
+
+        # The graph-ui React frontend, built to static assets (graph-ui/dist).
+        # buildNpmPackage fetches npm deps offline via the pinned package-lock.json;
+        # bump npmDepsHash whenever that lockfile changes:
+        #   nix run nixpkgs#prefetch-npm-deps -- graph-ui/package-lock.json
+        graph-ui = pkgs.buildNpmPackage {
+          pname = "codebase-memory-graph-ui";
+          version = "0.1.0";
+
+          src = ./graph-ui;
+
+          npmDepsHash = "sha256-P1JVo+GFr+Gsq88dnn9OsedZqrTaj3DDGbej+nHbp4U=";
+
+          # `npm run build` runs `tsc -b && vite build`, emitting to dist/.
+          installPhase = ''
+            runHook preInstall
+            cp -r dist $out
+            runHook postInstall
+          '';
+        };
+
+        # Same server binary as `default`, but with the graph-ui assets embedded
+        # so `--ui=true` starts the HTTP server. The frontend is built separately
+        # by the graph-ui package above; here we drop its dist/ into place and run
+        # the embed + link path (cbm-with-ui) — no network access needed.
+        codebase-memory-mcp-ui = default.overrideAttrs (old: {
+          pname = "codebase-memory-mcp-ui";
+
+          buildPhase = ''
+            # cbm-with-ui depends on `embed`, which depends on `frontend`, which
+            # runs `npm ci && npm run build` — needs network access, unavailable
+            # in the sandbox. Supply the pre-built assets, run the embed script
+            # directly, then link with `cbm-with-ui` while telling make its
+            # `frontend`/`embed` prerequisites are already up to date (-o) so it
+            # won't re-run the npm build.
+            mkdir -p graph-ui/dist
+            cp -r ${graph-ui}/. graph-ui/dist/
+            chmod -R u+w graph-ui/dist
+
+            bash scripts/embed-frontend.sh graph-ui/dist build/c/embedded
+
+            make -j$NIX_BUILD_CORES -f Makefile.cbm \
+              -o frontend -o embed \
+              cbm-with-ui
+          '';
+
+          meta = old.meta // {
+            description = "codebase-memory-mcp with the embedded graph UI (--ui)";
+          };
+        });
       });
 
       devShells = forAllSystems (pkgs: {