Merge branch 'main' into jaccl-build-fix

Add error handling to info gatherer monitor loops (#1422 )
## Motivation If any of the `InfoGatherer` monitor loops throw an unexpected exception, the entire monitoring task crashes and never recovers. This can silently stop memory, network, or Thunderbolt data collection for the lifetime of the process. ## Changes Wrap the body of each `while True` monitor loop in a try/except that logs the exception as a warning and continues to the next iteration. The sleep at the end of each loop runs regardless, providing natural backoff before retry. Affected methods: `_monitor_misc`, `_monitor_system_profiler_thunderbolt_data`, `_monitor_memory_usage`, `_watch_system_info`, `_monitor_thunderbolt_bridge_status`. `_monitor_macmon` already had its own error handling so was left as-is. ## Why It Works A transient error (e.g., a subprocess failing, a permission issue) in one iteration no longer kills the loop. The warning log provides visibility while the monitor continues collecting data on subsequent iterations. ## Test Plan ### Automated Testing - `uv run basedpyright` — 0 errors - `uv run ruff check` — passes Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: rltakashige <rl.takashige@gmail.com>
2026-02-13 07:32:30 -05:00 · 2026-02-10 12:29:04 +00:00 · 2026-02-10 12:24:43 +00:00 · 2026-02-10 12:18:45 +00:00 · 2026-02-10 11:53:23 +00:00 · 2026-02-06 17:08:26 +00:00
32 changed files with 2357 additions and 57 deletions
--- a/.mlx_typings/mlx/core/init.pyi
+++ b/.mlx_typings/mlx/core/init.pyi
@@ -2366,7 +2366,7 @@ class custom_function:
 def default_device() -> Device:
    """Get the default device."""

-def default_stream(device: Device) -> Stream:
+def default_stream(device: Device | DeviceType) -> Stream:
    """Get the device's default stream."""

 def degrees(a: array, /, *, stream: Stream | Device | None = ...) -> array:
--- a/flake.nix
+++ b/flake.nix
@@ -83,6 +83,9 @@
          _module.args.pkgs = import inputs.nixpkgs {
            inherit system;
            config.allowUnfreePredicate = pkg: (pkg.pname or "") == "metal-toolchain";
+            overlays = [
+              (final: _: { apple-sdk_26 = final.callPackage ./nix/apple-sdk/package.nix { darwinSdkMajorVersion = "26"; }; })
+            ];
          };
          treefmt = {
            projectRootFile = "flake.nix";
@@ -105,7 +108,10 @@
                enable = true;
                package = pkgsSwift.swiftPackages.swift-format;
              };
-              shfmt.enable = true;
+              shfmt = {
+                enable = true;
+                excludes = [ "nix/apple-sdk/**" ];
+              };
            };
          };

@@ -122,6 +128,11 @@
                inherit uvLockMlxVersion;
              };
              default = self'.packages.exo;
+              sdk-version = pkgs.runCommand "sdk-version" { } ''
+                mkdir -p $out
+                echo ${pkgs.apple-sdk_26.version} > $out/version
+              '';
+
            }
          );

--- a/nix/apple-sdk/README.md
+++ b/nix/apple-sdk/README.md
--- a/nix/apple-sdk/common/add-core-symbolication.nix
+++ b/nix/apple-sdk/common/add-core-symbolication.nix
@@ -0,0 +1,48 @@
+{ lib
+, fetchFromGitHub
+, stdenvNoCC
+,
+}:
+
+let
+  CoreSymbolication = stdenvNoCC.mkDerivation (finalAttrs: {
+    pname = "CoreSymbolication";
+    version = "0-unstable-2018-06-17";
+
+    src = fetchFromGitHub {
+      repo = "CoreSymbolication";
+      owner = "matthewbauer";
+      rev = "24c87c23664b3ee05dc7a5a87d647ae476a680e4";
+      hash = "sha256-PzvLq94eNhP0+rLwGMKcMzxuD6MlrNI7iT/eV0obtSE=";
+    };
+
+    patches = [
+      # Add missing symbol definitions needed to build `zlog` in system_cmds.
+      # https://github.com/matthewbauer/CoreSymbolication/pull/2
+      ../patches/0001-Add-function-definitions-needed-to-build-zlog-in-sys.patch
+      ../patches/0002-Add-CF_EXPORT-To-const-symbols.patch
+    ];
+
+    dontBuild = true;
+
+    installPhase = ''
+      mkdir -p "$out/include"
+      cp *.h "$out/include"
+    '';
+
+    meta = {
+      description = "Reverse engineered headers for Apple's CoreSymbolication framework";
+      homepage = "https://github.com/matthewbauer/CoreSymbolication";
+      license = lib.licenses.mit;
+      teams = [ lib.teams.darwin ];
+      platforms = lib.platforms.darwin;
+    };
+  });
+in
+self: super: {
+  buildPhase = super.buildPhase or "" + ''
+    mkdir -p System/Library/PrivateFrameworks/CoreSymbolication.framework/Versions/A/Headers
+    ln -s Versions/Current/Headers System/Library/PrivateFrameworks/CoreSymbolication.framework/Headers
+    cp '${CoreSymbolication}/include/'*.h System/Library/PrivateFrameworks/CoreSymbolication.framework/Versions/A/Headers
+  '';
+}
--- a/nix/apple-sdk/common/derivation-options.nix
+++ b/nix/apple-sdk/common/derivation-options.nix
@@ -0,0 +1,13 @@
+{ lib, config }:
+
+self: super: {
+  preBuild = super.preBuild or "" + ''
+    platformPath=$out/Platforms/MacOSX.platform
+    sdkpath=$platformPath/Developer/SDKs
+  '';
+
+  preInstall = super.preInstall or "" + ''
+    platformPath=$out/Platforms/MacOSX.platform
+    sdkpath=$platformPath/Developer/SDKs
+  '';
+}
--- a/nix/apple-sdk/common/fetch-sdk.nix
+++ b/nix/apple-sdk/common/fetch-sdk.nix
@@ -0,0 +1,38 @@
+{ lib
+, fetchurl
+, cpio
+, pbzx
+,
+}:
+
+{ urls
+, version
+, hash
+,
+}:
+
+fetchurl {
+  pname = "macOS-SDK";
+  inherit version urls hash;
+
+  recursiveHash = true;
+
+  nativeBuildInputs = [
+    cpio
+    pbzx
+  ];
+
+  postFetch = ''
+    renamed=$(mktemp -d)/sdk.xar
+    mv "$downloadedFile" "$renamed"
+    pbzx "$renamed" | cpio -idm
+
+    src=Library/Developer/CommandLineTools/SDKs/MacOSX${lib.versions.majorMinor version}.sdk
+
+    # Remove unwanted binaries, man pages, and folders from the SDK.
+    rm -rf $src/usr/bin $src/usr/share $src/System/Library/Perl
+
+    mkdir -p "$out"
+    cp -rd $src/* "$out"
+  '';
+}
--- a/nix/apple-sdk/common/passthru-private-frameworks.nix
+++ b/nix/apple-sdk/common/passthru-private-frameworks.nix
@@ -0,0 +1,10 @@
+{ makeSetupHook, sdkVersion }:
+
+self: super: {
+  passthru = super.passthru or { } // {
+    privateFrameworksHook = makeSetupHook
+      {
+        name = "apple-sdk-private-frameworks-hook";
+      } ../setup-hooks/add-private-frameworks.sh;
+  };
+}
--- a/nix/apple-sdk/common/passthru-source-release-files.nix
+++ b/nix/apple-sdk/common/passthru-source-release-files.nix
@@ -0,0 +1,38 @@
+let
+  lockfile = builtins.fromJSON (builtins.readFile ../metadata/apple-oss-lockfile.json);
+in
+
+{ lib
+, fetchFromGitHub
+, stdenvNoCC
+, sdkVersion
+,
+}:
+
+let
+  sdkinfo = lockfile.${sdkVersion};
+in
+self: super: {
+  passthru = super.passthru or { } // {
+    # Returns the raw source from apple-oss-distributions repo.
+    # This is mostly useful for copying private headers needed to build other source releases.
+    #
+    # Note: The source releases are mostly not used to build the SDK. Unless they can be used to build binaries,
+    # they’re not used.
+    sourceRelease =
+      name:
+      let
+        lockinfo = sdkinfo.${name};
+      in
+      fetchFromGitHub
+        {
+          owner = "apple-oss-distributions";
+          repo = name;
+          rev = lockinfo.rev or "${name}-${lockinfo.version}";
+          inherit (lockinfo) hash;
+        }
+      // {
+        inherit (lockinfo) version;
+      };
+  };
+}
--- a/nix/apple-sdk/common/plists.nix
+++ b/nix/apple-sdk/common/plists.nix
@@ -0,0 +1,327 @@
+{ lib
+, stdenvNoCC
+, xcodePlatform
+, sdkVersion
+,
+}:
+
+let
+  inherit (lib.generators) toPlist;
+
+  Info = rec {
+    CFBundleIdentifier = "com.apple.platform.${Name}";
+    DefaultProperties = {
+      COMPRESS_PNG_FILES = "NO";
+      DEPLOYMENT_TARGET_SETTING_NAME = stdenvNoCC.hostPlatform.darwinMinVersionVariable;
+      STRIP_PNG_TEXT = "NO";
+    };
+    Description = if stdenvNoCC.hostPlatform.isMacOS then "macOS" else "iOS";
+    FamilyIdentifier = lib.toLower xcodePlatform;
+    FamilyName = Description;
+    Identifier = CFBundleIdentifier;
+    MinimumSDKVersion = stdenvNoCC.hostPlatform.darwinMinVersion;
+    Name = lib.toLower xcodePlatform;
+    Type = "Platform";
+    Version = sdkVersion;
+  };
+
+  # These files are all based off of Xcode spec files found in
+  # /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/Library/Xcode/PrivatePlugIns/IDEOSXSupportCore.ideplugin/Contents/Resources.
+
+  # Based off of the "MacOSX Architectures.xcspec" file. All i386 stuff
+  # is removed because NixPkgs only supports darwin-x86_64 and darwin-arm64.
+  Architectures = [
+    {
+      Identifier = "Standard";
+      Type = "Architecture";
+      Name = "Standard Architectures (Apple Silicon, 64-bit Intel)";
+      RealArchitectures = [
+        "arm64"
+        "x86_64"
+      ];
+      ArchitectureSetting = "ARCHS_STANDARD";
+    }
+    {
+      Identifier = "Universal";
+      Type = "Architecture";
+      Name = "Universal (Apple Silicon, 64-bit Intel)";
+      RealArchitectures = [
+        "arm64"
+        "x86_64"
+      ];
+      ArchitectureSetting = "ARCHS_STANDARD_32_64_BIT";
+    }
+    {
+      Identifier = "Native";
+      Type = "Architecture";
+      Name = "Native Architecture of Build Machine";
+      ArchitectureSetting = "NATIVE_ARCH_ACTUAL";
+    }
+    {
+      Identifier = "Standard64bit";
+      Type = "Architecture";
+      Name = "Apple Silicon, 64-bit Intel";
+      RealArchitectures = [
+        "arm64"
+        "x86_64"
+      ];
+      ArchitectureSetting = "ARCHS_STANDARD_64_BIT";
+    }
+    {
+      Identifier = stdenvNoCC.hostPlatform.darwinArch;
+      Type = "Architecture";
+      Name = "Apple Silicon or Intel 64-bit";
+    }
+    {
+      Identifier = "Standard_Including_64_bit";
+      Type = "Architecture";
+      Name = "Standard Architectures (including 64-bit)";
+      RealArchitectures = [
+        "arm64"
+        "x86_64"
+      ];
+      ArchitectureSetting = "ARCHS_STANDARD_INCLUDING_64_BIT";
+    }
+  ];
+
+  # Based off of the "MacOSX Package Types.xcspec" file. Only keep the
+  # bare minimum needed.
+  PackageTypes = [
+    {
+      Identifier = "com.apple.package-type.mach-o-executable";
+      Type = "PackageType";
+      Name = "Mach-O Executable";
+      DefaultBuildSettings = {
+        EXECUTABLE_NAME = "$(EXECUTABLE_PREFIX)$(PRODUCT_NAME)$(EXECUTABLE_VARIANT_SUFFIX)$(EXECUTABLE_SUFFIX)";
+        EXECUTABLE_PATH = "$(EXECUTABLE_NAME)";
+      };
+      ProductReference = {
+        FileType = "compiled.mach-o.executable";
+        Name = "$(EXECUTABLE_NAME)";
+      };
+    }
+    {
+      Identifier = "com.apple.package-type.mach-o-objfile";
+      Type = "PackageType";
+      Name = "Mach-O Object File";
+      DefaultBuildSettings = {
+        EXECUTABLE_NAME = "$(EXECUTABLE_PREFIX)$(PRODUCT_NAME)$(EXECUTABLE_VARIANT_SUFFIX)$(EXECUTABLE_SUFFIX)";
+        EXECUTABLE_PATH = "$(EXECUTABLE_NAME)";
+      };
+      ProductReference = {
+        FileType = "compiled.mach-o.objfile";
+        Name = "$(EXECUTABLE_NAME)";
+      };
+    }
+    {
+      Identifier = "com.apple.package-type.mach-o-dylib";
+      Type = "PackageType";
+      Name = "Mach-O Dynamic Library";
+      DefaultBuildSettings = {
+        EXECUTABLE_NAME = "$(EXECUTABLE_PREFIX)$(PRODUCT_NAME)$(EXECUTABLE_VARIANT_SUFFIX)$(EXECUTABLE_SUFFIX)";
+        EXECUTABLE_PATH = "$(EXECUTABLE_NAME)";
+      };
+      ProductReference = {
+        FileType = "compiled.mach-o.dylib";
+        Name = "$(EXECUTABLE_NAME)";
+      };
+    }
+    {
+      Identifier = "com.apple.package-type.static-library";
+      Type = "PackageType";
+      Name = "Mach-O Static Library";
+      DefaultBuildSettings = {
+        EXECUTABLE_PREFIX = "lib";
+        EXECUTABLE_SUFFIX = ".a";
+        EXECUTABLE_NAME = "$(EXECUTABLE_PREFIX)$(PRODUCT_NAME)$(EXECUTABLE_VARIANT_SUFFIX)$(EXECUTABLE_SUFFIX)";
+        EXECUTABLE_PATH = "$(EXECUTABLE_NAME)";
+      };
+      ProductReference = {
+        FileType = "archive.ar";
+        Name = "$(EXECUTABLE_NAME)";
+        IsLaunchable = "NO";
+      };
+    }
+    {
+      Identifier = "com.apple.package-type.wrapper";
+      Type = "PackageType";
+      Name = "Wrapper";
+      DefaultBuildSettings = {
+        WRAPPER_SUFFIX = ".bundle";
+        WRAPPER_NAME = "$(WRAPPER_PREFIX)$(PRODUCT_NAME)$(WRAPPER_SUFFIX)";
+        CONTENTS_FOLDER_PATH = "$(WRAPPER_NAME)/Contents";
+        EXECUTABLE_NAME = "$(EXECUTABLE_PREFIX)$(PRODUCT_NAME)$(EXECUTABLE_VARIANT_SUFFIX)$(EXECUTABLE_SUFFIX)";
+        EXECUTABLE_FOLDER_PATH = "$(CONTENTS_FOLDER_PATH)/MacOS";
+        EXECUTABLE_PATH = "$(EXECUTABLE_FOLDER_PATH)/$(EXECUTABLE_NAME)";
+        INFOPLIST_PATH = "$(CONTENTS_FOLDER_PATH)/Info.plist";
+        INFOSTRINGS_PATH = "$(LOCALIZED_RESOURCES_FOLDER_PATH)/InfoPlist.strings";
+        PKGINFO_PATH = "$(CONTENTS_FOLDER_PATH)/PkgInfo";
+        PBDEVELOPMENTPLIST_PATH = "$(CONTENTS_FOLDER_PATH)/pbdevelopment.plist";
+        VERSIONPLIST_PATH = "$(CONTENTS_FOLDER_PATH)/version.plist";
+        PUBLIC_HEADERS_FOLDER_PATH = "$(CONTENTS_FOLDER_PATH)/Headers";
+        PRIVATE_HEADERS_FOLDER_PATH = "$(CONTENTS_FOLDER_PATH)/PrivateHeaders";
+        EXECUTABLES_FOLDER_PATH = "$(CONTENTS_FOLDER_PATH)/Executables";
+        FRAMEWORKS_FOLDER_PATH = "$(CONTENTS_FOLDER_PATH)/Frameworks";
+        SHARED_FRAMEWORKS_FOLDER_PATH = "$(CONTENTS_FOLDER_PATH)/SharedFrameworks";
+        SHARED_SUPPORT_FOLDER_PATH = "$(CONTENTS_FOLDER_PATH)/SharedSupport";
+        UNLOCALIZED_RESOURCES_FOLDER_PATH = "$(CONTENTS_FOLDER_PATH)/Resources";
+        LOCALIZED_RESOURCES_FOLDER_PATH = "$(UNLOCALIZED_RESOURCES_FOLDER_PATH)/$(DEVELOPMENT_LANGUAGE).lproj";
+        DOCUMENTATION_FOLDER_PATH = "$(LOCALIZED_RESOURCES_FOLDER_PATH)/Documentation";
+        PLUGINS_FOLDER_PATH = "$(CONTENTS_FOLDER_PATH)/PlugIns";
+        SCRIPTS_FOLDER_PATH = "$(UNLOCALIZED_RESOURCES_FOLDER_PATH)/Scripts";
+      };
+      ProductReference = {
+        FileType = "wrapper.cfbundle";
+        Name = "$(WRAPPER_NAME)";
+        IsLaunchable = "NO";
+      };
+    }
+    {
+      Identifier = "com.apple.package-type.wrapper.application";
+      Type = "PackageType";
+      BasedOn = "com.apple.package-type.wrapper";
+      Name = "Application Wrapper";
+      DefaultBuildSettings = {
+        GENERATE_PKGINFO_FILE = "YES";
+      };
+      ProductReference = {
+        FileType = "wrapper.application";
+        Name = "$(WRAPPER_NAME)";
+        IsLaunchable = "YES";
+      };
+    }
+  ];
+
+  # Based off of the "MacOSX Product Types.xcspec" file. All
+  # bundles/wrapper are removed, because we prefer dynamic products in
+  # NixPkgs.
+  ProductTypes = [
+    {
+      Identifier = "com.apple.product-type.tool";
+      Type = "ProductType";
+      Name = "Command-line Tool";
+      PackageTypes = [ "com.apple.package-type.mach-o-executable" ];
+    }
+    {
+      Identifier = "com.apple.product-type.objfile";
+      Type = "ProductType";
+      Name = "Object File";
+      PackageTypes = [ "com.apple.package-type.mach-o-objfile" ];
+    }
+    {
+      Identifier = "com.apple.product-type.library.dynamic";
+      Type = "ProductType";
+      Name = "Dynamic Library";
+      PackageTypes = [ "com.apple.package-type.mach-o-dylib" ];
+      DefaultBuildProperties = {
+        FULL_PRODUCT_NAME = "$(EXECUTABLE_NAME)";
+        MACH_O_TYPE = "mh_dylib";
+        REZ_EXECUTABLE = "YES";
+        EXECUTABLE_SUFFIX = ".$(EXECUTABLE_EXTENSION)";
+        EXECUTABLE_EXTENSION = "dylib";
+        DYLIB_COMPATIBILITY_VERSION = "1";
+        DYLIB_CURRENT_VERSION = "1";
+        FRAMEWORK_FLAG_PREFIX = "-framework";
+        LIBRARY_FLAG_PREFIX = "-l";
+        LIBRARY_FLAG_NOSPACE = "YES";
+        STRIP_STYLE = "debugging";
+        GCC_INLINES_ARE_PRIVATE_EXTERN = "YES";
+        CODE_SIGNING_ALLOWED = "YES";
+        CODE_SIGNING_REQUIRED = "NO";
+      };
+    }
+    {
+      Identifier = "com.apple.product-type.library.static";
+      Type = "ProductType";
+      Name = "Static Library";
+      PackageTypes = [ "com.apple.package-type.static-library" ];
+      DefaultBuildProperties = {
+        FULL_PRODUCT_NAME = "$(EXECUTABLE_NAME)";
+        MACH_O_TYPE = "staticlib";
+        REZ_EXECUTABLE = "YES";
+        EXECUTABLE_PREFIX = "lib";
+        EXECUTABLE_SUFFIX = ".$(EXECUTABLE_EXTENSION)";
+        EXECUTABLE_EXTENSION = "a";
+        FRAMEWORK_FLAG_PREFIX = "-framework";
+        LIBRARY_FLAG_PREFIX = "-l";
+        LIBRARY_FLAG_NOSPACE = "YES";
+        STRIP_STYLE = "debugging";
+        SEPARATE_STRIP = "YES";
+        CLANG_ENABLE_MODULE_DEBUGGING = "NO";
+      };
+    }
+    {
+      Type = "ProductType";
+      Identifier = "com.apple.product-type.bundle";
+      Name = "Bundle";
+      DefaultBuildProperties = {
+        FULL_PRODUCT_NAME = "$(WRAPPER_NAME)";
+        MACH_O_TYPE = "mh_bundle";
+        WRAPPER_PREFIX = "";
+        WRAPPER_SUFFIX = ".$(WRAPPER_EXTENSION)";
+        WRAPPER_EXTENSION = "bundle";
+        WRAPPER_NAME = "$(WRAPPER_PREFIX)$(PRODUCT_NAME)$(WRAPPER_SUFFIX)";
+        FRAMEWORK_FLAG_PREFIX = "-framework";
+        LIBRARY_FLAG_PREFIX = "-l";
+        LIBRARY_FLAG_NOSPACE = "YES";
+        STRIP_STYLE = "non-global";
+      };
+      PackageTypes = [ "com.apple.package-type.wrapper" ];
+      IsWrapper = "YES";
+      HasInfoPlist = "YES";
+      HasInfoPlistStrings = "YES";
+    }
+    {
+      Identifier = "com.apple.product-type.application";
+      Type = "ProductType";
+      BasedOn = "com.apple.product-type.bundle";
+      Name = "Application";
+      DefaultBuildProperties = {
+        MACH_O_TYPE = "mh_execute";
+        WRAPPER_SUFFIX = ".$(WRAPPER_EXTENSION)";
+        WRAPPER_EXTENSION = "app";
+      };
+      PackageTypes = [ "com.apple.package-type.wrapper.application" ];
+    }
+    {
+      Type = "ProductType";
+      Identifier = "com.apple.product-type.framework";
+      Name = "Bundle";
+      DefaultBuildProperties = {
+        FULL_PRODUCT_NAME = "$(WRAPPER_NAME)";
+        MACH_O_TYPE = "mh_bundle";
+        WRAPPER_PREFIX = "";
+        WRAPPER_SUFFIX = ".$(WRAPPER_EXTENSION)";
+        WRAPPER_EXTENSION = "bundle";
+        WRAPPER_NAME = "$(WRAPPER_PREFIX)$(PRODUCT_NAME)$(WRAPPER_SUFFIX)";
+        FRAMEWORK_FLAG_PREFIX = "-framework";
+        LIBRARY_FLAG_PREFIX = "-l";
+        LIBRARY_FLAG_NOSPACE = "YES";
+        STRIP_STYLE = "non-global";
+      };
+      PackageTypes = [ "com.apple.package-type.wrapper" ];
+      IsWrapper = "YES";
+      HasInfoPlist = "YES";
+      HasInfoPlistStrings = "YES";
+    }
+  ];
+
+  ToolchainInfo = {
+    Identifier = "com.apple.dt.toolchain.XcodeDefault";
+  };
+in
+{
+  "Info.plist" = builtins.toFile "Info.plist" (toPlist { escape = true; } Info);
+  "ToolchainInfo.plist" = builtins.toFile "ToolchainInfo.plist" (
+    toPlist { escape = true; } ToolchainInfo
+  );
+  "Architectures.xcspec" = builtins.toFile "Architectures.xcspec" (
+    toPlist { escape = true; } Architectures
+  );
+  "PackageTypes.xcspec" = builtins.toFile "PackageTypes.xcspec" (
+    toPlist { escape = true; } PackageTypes
+  );
+  "ProductTypes.xcspec" = builtins.toFile "ProductTypes.xcspec" (
+    toPlist { escape = true; } ProductTypes
+  );
+}
--- a/nix/apple-sdk/common/process-stubs.nix
+++ b/nix/apple-sdk/common/process-stubs.nix
@@ -0,0 +1,40 @@
+let
+  removedDylibs = [
+    # corecrypto is available under a very restrictive license (effectively: non-free, can’t use).
+    # Without the headers and not being able to use corecrypto due to its license, it’s not very useful.
+    # Stubs are included in the SDK for all dylibs, including corecrypto. They should be removed.
+    "/usr/lib/system/libcorecrypto.dylib"
+  ];
+in
+
+{ lib
+, jq
+, llvm
+,
+}:
+
+self: super: {
+  nativeBuildInputs = super.nativeBuildInputs or [ ] ++ [
+    jq
+    llvm
+  ];
+
+  buildPhase = super.buildPhase or "" + ''
+    echo "Removing the following dylibs from the libSystem reexported libraries list: ${lib.escapeShellArg (lib.concatStringsSep ", " removedDylibs)}"
+    for libSystem in libSystem.B.tbd libSystem.B_asan.tbd; do
+      # tbd-v5 is a JSON-based format, which can be manipulated by `jq`.
+      llvm-readtapi --filetype=tbd-v5 usr/lib/$libSystem \
+      | jq --argjson libs ${lib.escapeShellArg (builtins.toJSON removedDylibs)} '
+        if .libraries then
+          .libraries[] |= select(.install_names[] | any([.] | inside($libs)) | not)
+        else
+          .
+        end
+        | .main_library.reexported_libraries[].names[] |= select([.] | inside($libs) | not)
+      ' > usr/lib/$libSystem~
+      # Convert libSystem back to tbd-v4 because not all tooling supports the JSON-based format yet.
+      llvm-readtapi --filetype=tbd-v4 usr/lib/$libSystem~ -o usr/lib/$libSystem
+      rm usr/lib/$libSystem~
+    done
+  '';
+}
--- a/nix/apple-sdk/common/propagate-inputs.nix
+++ b/nix/apple-sdk/common/propagate-inputs.nix
@@ -0,0 +1,74 @@
+{ lib
+, cups
+, darwin
+, db
+, libiconv
+, ncurses
+, stdenv
+, stdenvNoCC
+, xcbuild
+,
+}:
+
+let
+  # CUPS has too many dependencies to build as part of the Darwin bootstrap. It’s also typically taken as an explicit
+  # dependency by other packages, so building only the headers (to satisfy other SDK headers) should be okay.
+  cupsHeaders = darwin.bootstrapStdenv.mkDerivation {
+    pname = "${lib.getName cups}-headers";
+    version = lib.getVersion cups;
+
+    inherit (cups) src;
+
+    patches = cups.patches or [ ];
+
+    strictDeps = true;
+
+    dontBuild = true;
+
+    buildInputs = [ darwin.libresolv ]; # The `configure` script requires libresolv headers.
+
+    # CUPS’s configure script fails to find `ar` when cross-compiling.
+    configureFlags = [ "ac_cv_path_AR=${stdenv.cc.targetPrefix}ar" ];
+
+    installTargets = [ "install-headers" ];
+
+    __structuredAttrs = true;
+
+    meta = {
+      inherit (cups.meta)
+        homepage
+        description
+        license
+        maintainers
+        platforms
+        ;
+    };
+  };
+in
+self: super: {
+  # These packages are propagated only because other platforms include them in their libc (or otherwise by default).
+  # Reducing the number of special cases required to support Darwin makes supporting it easier for package authors.
+  propagatedBuildInputs =
+    super.propagatedBuildInputs or [ ]
+    ++ [
+      libiconv
+      darwin.libresolv
+      darwin.libsbuf
+      # Shipped with the SDK only as a library with no headers
+      (lib.getLib darwin.libutil)
+    ]
+    # x86_64-darwin links the object files from Csu when targeting very old releases
+    ++ lib.optionals stdenvNoCC.hostPlatform.isx86_64 [ darwin.Csu ];
+
+  # The Darwin module for Swift requires certain headers to be included in the SDK (and not just be propagated).
+  buildPhase = super.buildPhase or "" + ''
+    for header in '${lib.getDev libiconv}/include/'* '${lib.getDev ncurses}/include/'* '${cupsHeaders}/include/'*; do
+      ln -s "$header" "usr/include/$(basename "$header")"
+    done
+  '';
+
+  # Exported to allow the headers to pass the requisites check in the stdenv bootstrap.
+  passthru = (super.passthru or { }) // {
+    cups-headers = cupsHeaders;
+  };
+}
--- a/nix/apple-sdk/common/propagate-xcrun.nix
+++ b/nix/apple-sdk/common/propagate-xcrun.nix
@@ -0,0 +1,53 @@
+{ lib
+, pkgsBuildHost
+, stdenv
+, stdenvNoCC
+, sdkVersion
+,
+}:
+
+let
+  plists = import ./plists.nix {
+    inherit lib stdenvNoCC sdkVersion;
+    xcodePlatform = if stdenvNoCC.hostPlatform.isMacOS then "MacOSX" else "iPhoneOS";
+  };
+  inherit (pkgsBuildHost) darwin cctools xcbuild;
+in
+self: super: {
+  propagatedNativeBuildInputs = super.propagatedNativeBuildInputs or [ ] ++ [ xcbuild.xcrun ];
+
+  postInstall = super.postInstall or "" + ''
+    specspath=$out/Library/Xcode/Specifications
+    toolchainsPath=$out/Toolchains/XcodeDefault.xctoolchain
+    mkdir -p "$specspath" "$toolchainsPath"
+
+    # xcbuild expects to find things relative to the plist locations. If these are linked instead of copied,
+    # it won’t find any platforms or SDKs.
+    cp '${plists."Info.plist"}' "$platformPath/Info.plist"
+    cp '${plists."ToolchainInfo.plist"}' "$toolchainsPath/ToolchainInfo.plist"
+
+    for spec in '${xcbuild}/Library/Xcode/Specifications/'*; do
+      ln -s "$spec" "$specspath/$(basename "$spec")"
+    done
+    cp '${plists."Architectures.xcspec"}' "$specspath/Architectures.xcspec"
+    cp '${plists."PackageTypes.xcspec"}' "$specspath/PackageTypes.xcspec"
+    cp '${plists."ProductTypes.xcspec"}' "$specspath/ProductTypes.xcspec"
+
+    mkdir -p "$out/usr/bin"
+    ln -s '${xcbuild.xcrun}/bin/xcrun' "$out/usr/bin/xcrun"
+
+    # Include `libtool` in the toolchain, so `xcrun -find libtool` can find it without requiring `cctools.libtool`
+    # as a `nativeBuildInput`.
+    mkdir -p "$toolchainsPath/usr/bin"
+    if [ -e '${cctools.libtool}/bin/${stdenv.cc.targetPrefix}libtool' ]; then
+      ln -s '${cctools.libtool}/bin/${stdenv.cc.targetPrefix}libtool' "$toolchainsPath/usr/bin/libtool"
+    fi
+
+    # Include additional binutils required by some packages (such as Chromium).
+    for tool in lipo nm otool size strip; do
+      if [ -e '${darwin.binutils-unwrapped}/bin/${stdenv.cc.targetPrefix}'$tool ]; then
+        ln -s '${darwin.binutils-unwrapped}/bin/${stdenv.cc.targetPrefix}'$tool "$toolchainsPath/usr/bin/$tool"
+      fi
+    done
+  '';
+}
--- a/nix/apple-sdk/common/remove-disallowed-packages.nix
+++ b/nix/apple-sdk/common/remove-disallowed-packages.nix
@@ -0,0 +1,24 @@
+let
+  disallowedPackages = builtins.fromJSON (builtins.readFile ../metadata/disallowed-packages.json);
+in
+
+{ lib
+, jq
+, stdenv
+,
+}:
+
+self: super: {
+  # Remove headers and stubs for packages that are available in nixpkgs.
+  buildPhase = super.buildPhase or "" + ''
+    ${lib.concatMapStringsSep "\n" (
+      pkg:
+      lib.concatLines (
+        [ ''echo "Removing headers and libraries from ${pkg.package}"'' ]
+        ++ (map (header: "rm -rf -- usr/include/${header}") pkg.headers or [ ])
+        ++ (map (framework: "rm -rf -- System/Library/Frameworks/${framework}") pkg.frameworks or [ ])
+        ++ (map (library: "rm -rf -- usr/lib/${library}") pkg.libraries or [ ])
+      )
+    ) disallowedPackages}
+  '';
+}
--- a/nix/apple-sdk/common/run-build-phase-hooks.nix
+++ b/nix/apple-sdk/common/run-build-phase-hooks.nix
@@ -0,0 +1,9 @@
+{}:
+
+self: super: {
+  buildPhase = ''
+    runHook preBuild
+    ${super.buildPhase or ""}
+    runHook postBuild
+  '';
+}
--- a/nix/apple-sdk/metadata/apple-oss-lockfile.json
+++ b/nix/apple-sdk/metadata/apple-oss-lockfile.json
@@ -0,0 +1,536 @@
+{
+  "14.4": {
+    "CarbonHeaders": {
+      "hash": "sha256-nIPXnLr21yVnpBhx9K5q3l/nPARA6JL/dED08MeyhP8=",
+      "version": "18.1"
+    },
+    "CommonCrypto": {
+      "hash": "sha256-/VoOR9wJuKnmGE1CWGGXxX8SpmALHnEooNTa3QM+ITc=",
+      "version": "600028.100.1"
+    },
+    "IOAudioFamily": {
+      "hash": "sha256-VSk3jvsITJugtL67Qt0m4qJ879i7Fj6B/NGBFVCwpiU=",
+      "version": "540.3"
+    },
+    "IOBDStorageFamily": {
+      "hash": "sha256-UgLMsQBe1QLzlbScmPmASBN7VH4YBmNOUX2CEDezjmE=",
+      "version": "22"
+    },
+    "IOCDStorageFamily": {
+      "hash": "sha256-p/2qM5zjXFDRb/DISpEHxQEdvmuLlRGt/Ygc71Yu2rI=",
+      "version": "61"
+    },
+    "IODVDStorageFamily": {
+      "hash": "sha256-1Sa8aZBGNtqJBNHva+YXxET6Wcdm2PgVrTzYT/8qrN4=",
+      "version": "45"
+    },
+    "IOFWDVComponents": {
+      "hash": "sha256-WkfkWnzRupEh20U7vjsTta89clhus6GTkOpXQWXw/bM=",
+      "version": "208"
+    },
+    "IOFireWireAVC": {
+      "hash": "sha256-IUytBKhhCgg0vtI+7q8d5kxpOUgO3tQD7TMy++jrorc=",
+      "version": "431"
+    },
+    "IOFireWireFamily": {
+      "hash": "sha256-W0KOF4hkA7kFOnL1ThAeFU/YlhFVqoqk9uzGjcBppX8=",
+      "version": "487"
+    },
+    "IOFireWireSBP2": {
+      "hash": "sha256-bItnRQIaGUxMyiU0q+4N8e5+jYiDEOUPmsrKhBFXvok=",
+      "version": "445"
+    },
+    "IOFireWireSerialBusProtocolTransport": {
+      "hash": "sha256-P7egeaD9SSa+YyrIRzM44gILKbIL7vezXK3M6q3MBOI=",
+      "version": "260"
+    },
+    "IOGraphics": {
+      "hash": "sha256-Ag37fd3tZJLXLVq1yzHOCWGOYYfwwTkC8hnvNaTEaWg=",
+      "version": "598"
+    },
+    "IOHIDFamily": {
+      "hash": "sha256-fmYTJsquAOBwzsgRmqPyjSJJi1hGcfnMmqLIcTe8W1s=",
+      "version": "2031.100.16"
+    },
+    "IOKitUser": {
+      "hash": "sha256-1bqRiLvyr2GQfbWwhXHXXIOtIka9YDw5GbKV6bd2k4k=",
+      "version": "100076.101.1"
+    },
+    "IONetworkingFamily": {
+      "hash": "sha256-J3cLeWKrQ8ypIaqgwRH9eU5JbjEDBVoezj3a2Lvwu5k=",
+      "version": "177"
+    },
+    "IOSerialFamily": {
+      "hash": "sha256-wVS4QTx6MBOS0VrwyCZ3s5Usezwaf8rWzmNnfdDTXTU=",
+      "version": "93"
+    },
+    "IOStorageFamily": {
+      "hash": "sha256-cllpJX11c3CX8zEYdOT2TC63sx7NUAHh33yRHhrG2Ro=",
+      "version": "315"
+    },
+    "IOUSBFamily": {
+      "hash": "sha256-Z0E3TfKP49toYo1Fo9kElRap8CZ+mVDHy5RIexgJTpA=",
+      "version": "630.4.5"
+    },
+    "Libc": {
+      "hash": "sha256-fxBM4KbPwQNVEJl7PCKP+1nUk9Oce/O2+0lVBxyngew=",
+      "version": "1592.100.35"
+    },
+    "Libinfo": {
+      "hash": "sha256-zZr6Mmou8Q+G6/wS+k0k7R+XirB94TNCUGS5dhi96ZE=",
+      "version": "583.0.1"
+    },
+    "Libm": {
+      "hash": "sha256-p4BndAag9d0XSMYWQ+c4myGv5qXbKx5E1VghudSbpTk=",
+      "version": "2026"
+    },
+    "Libnotify": {
+      "hash": "sha256-7X+6S3C7ZOTXJUeDXOOg5EmoZyLZvtE06x3Is0TGgSU=",
+      "version": "317.100.2"
+    },
+    "Librpcsvc": {
+      "hash": "sha256-UWYdCQ9QsBqwM01bWr+igINAHSdSluB/FrOclC5AjTI=",
+      "version": "31"
+    },
+    "Libsystem": {
+      "hash": "sha256-HsItciWrwyXujQ2hwqzv0JKOkkuynXYIqejLAEPJbMc=",
+      "version": "1345.100.2"
+    },
+    "OpenDirectory": {
+      "hash": "sha256-6fSl8PasCZSBfe0ftaePcBuSEO3syb6kK+mfDI6iR7A=",
+      "version": "146"
+    },
+    "Security": {
+      "hash": "sha256-NgTGbaw5JkpboDQpt1fSgUr9NYGS+bIOrEMQX7mLAME=",
+      "version": "61123.100.169"
+    },
+    "architecture": {
+      "hash": "sha256-PRNUrhzSOrwmxSPkKmV0LV7yEIik65sdkfKdBqcwFhU=",
+      "version": "282"
+    },
+    "configd": {
+      "hash": "sha256-+3xesYxqfsNjWCW3T87OA7+Z1hBqmGEh/I8kP8Ajbso=",
+      "version": "1300.100.9"
+    },
+    "copyfile": {
+      "hash": "sha256-rSCTgzdHr7QmnPk9rJ9P4fOAolnEQv8PHfgAY+qA0s4=",
+      "version": "196.100.4"
+    },
+    "dtrace": {
+      "hash": "sha256-04Q35rCKnM5Csv5poFJKpK0VplWq4hvy251/Cb2Kl80=",
+      "version": "401.100.3"
+    },
+    "dyld": {
+      "hash": "sha256-6P/Da6xP19vmaCROoYv9pl7DaW3/U+qZBJT8PD33bn0=",
+      "version": "1160.6"
+    },
+    "eap8021x": {
+      "hash": "sha256-Ky6KSlJhyX1NRufGhVBcp+ZFmqYrAxwC/5QvJhC2PhU=",
+      "version": "354.100.3"
+    },
+    "hfs": {
+      "hash": "sha256-+YUVOttZU7C8I14CC6t3ZH2KxAjjTA2nB0y5bPgLxZM=",
+      "version": "650.0.2"
+    },
+    "launchd": {
+      "hash": "sha256-8mW9bnuHmRXCx9py8Wy28C5b2QPICW0rlAps5njYa00=",
+      "version": "842.1.4"
+    },
+    "libclosure": {
+      "hash": "sha256-M/jnIHzKYvdFCO0tJ1JXiD/UcZtJhLIoulaCQQUbn30=",
+      "version": "90"
+    },
+    "libdispatch": {
+      "hash": "sha256-igqIA5DMVHjG30WMHZZpYY7LRM9hZyMWItD+UxeTehY=",
+      "version": "1477.100.9"
+    },
+    "libmalloc": {
+      "hash": "sha256-Sh4/z7lGWRMldOPURkP5vLOAb5Ou6AUsVJEWz9wk9hI=",
+      "version": "521.100.59"
+    },
+    "libplatform": {
+      "hash": "sha256-gojt3sWOr7XO2yYI/B1CmNLTPFieSfoNtlOgQahOCok=",
+      "version": "316.100.10"
+    },
+    "libpthread": {
+      "hash": "sha256-phjfN8+IU8ibPsflR6LktnSi3giy89ghI+cFyrhiQNo=",
+      "version": "519.101.1"
+    },
+    "mDNSResponder": {
+      "hash": "sha256-0ECbWeMnIRTsi03BeBEe5boyR/84JJPbxzPQze8hHSA=",
+      "version": "2200.100.94.0.2"
+    },
+    "objc4": {
+      "hash": "sha256-eUVSpbyTEOMEdHoxSv6lZIZwB+cW/YWIaTZTcHgGOjo=",
+      "version": "912.3"
+    },
+    "ppp": {
+      "hash": "sha256-8+QUA79sHf85yvGSPE9qCmGsrZDT3NZnbgZVroJw/Hg=",
+      "version": "1016"
+    },
+    "removefile": {
+      "hash": "sha256-L6I0u8S3h3uV1veKA5HvkSebbBCd78ymlf//KWbebZo=",
+      "version": "70.100.4"
+    },
+    "xnu": {
+      "hash": "sha256-j5Ep1RX5DTJqTGszrF4d/JtzUqZ6nA6XoExqcIQ0RVQ=",
+      "version": "10063.101.15"
+    }
+  },
+  "15.5": {
+    "CarbonHeaders": {
+      "hash": "sha256-nIPXnLr21yVnpBhx9K5q3l/nPARA6JL/dED08MeyhP8=",
+      "version": "18.1"
+    },
+    "CommonCrypto": {
+      "hash": "sha256-+qAwL6+s7di9cX/qXtapLkjCFoDuZaSYltRJEG4qekM=",
+      "version": "600035"
+    },
+    "IOAudioFamily": {
+      "hash": "sha256-VSk3jvsITJugtL67Qt0m4qJ879i7Fj6B/NGBFVCwpiU=",
+      "version": "600.2"
+    },
+    "IOBDStorageFamily": {
+      "hash": "sha256-s8hTwX0jq2iPULfBLUwpzqtszWuvJrrLGbmrKa/fY4U=",
+      "version": "24"
+    },
+    "IOCDStorageFamily": {
+      "hash": "sha256-p/2qM5zjXFDRb/DISpEHxQEdvmuLlRGt/Ygc71Yu2rI=",
+      "version": "62"
+    },
+    "IODVDStorageFamily": {
+      "hash": "sha256-1Sa8aZBGNtqJBNHva+YXxET6Wcdm2PgVrTzYT/8qrN4=",
+      "version": "46"
+    },
+    "IOFWDVComponents": {
+      "hash": "sha256-WkfkWnzRupEh20U7vjsTta89clhus6GTkOpXQWXw/bM=",
+      "version": "208"
+    },
+    "IOFireWireAVC": {
+      "hash": "sha256-qR9lSTa7PN5Z9Nis4tfuXlcZGMIU48dete/NPD0UBbE=",
+      "version": "434"
+    },
+    "IOFireWireFamily": {
+      "hash": "sha256-hmErAXjLWIelqJaCrB8J4IiIxyB7S6EHFY+AY9YhmKQ=",
+      "version": "490"
+    },
+    "IOFireWireSBP2": {
+      "hash": "sha256-Xk+PDnUaO9q46nQwHwTKf/QXtGclfs0wTWiUbcV7e4s=",
+      "version": "452"
+    },
+    "IOFireWireSerialBusProtocolTransport": {
+      "hash": "sha256-P7egeaD9SSa+YyrIRzM44gILKbIL7vezXK3M6q3MBOI=",
+      "version": "261"
+    },
+    "IOGraphics": {
+      "hash": "sha256-iysZE42mOKZbFxSZBNspaBTCRKEKK38DFGBxZWQxZxI=",
+      "version": "599"
+    },
+    "IOHIDFamily": {
+      "hash": "sha256-gEYPyjXgQ2ABGufCKPjmzMdNRLxhELkCvOURCokyTO4=",
+      "version": "2115.100.21"
+    },
+    "IOKitUser": {
+      "hash": "sha256-p32U+jHfwA/tqnjF4p1BmojghEXK8KxiflW3IHs2iIY=",
+      "version": "100150.120.2"
+    },
+    "IONetworkingFamily": {
+      "hash": "sha256-gZ7Dkk4Iu7AV9K2ioqSeJ1W7bTNxv77bmT18iv3ljLg=",
+      "version": "185"
+    },
+    "IOSerialFamily": {
+      "hash": "sha256-wVS4QTx6MBOS0VrwyCZ3s5Usezwaf8rWzmNnfdDTXTU=",
+      "version": "93"
+    },
+    "IOStorageFamily": {
+      "hash": "sha256-/0H0tqWUWkgYigYypucbc7lOCFYDuukwF9fvLEOhwOk=",
+      "version": "323"
+    },
+    "IOUSBFamily": {
+      "hash": "sha256-Z0E3TfKP49toYo1Fo9kElRap8CZ+mVDHy5RIexgJTpA=",
+      "version": "630.4.5"
+    },
+    "Libc": {
+      "hash": "sha256-nWDokN0Vr5pUyNGculnDOah9RNgHiWr3S13RSQLmZrc=",
+      "version": "1698.100.8"
+    },
+    "Libinfo": {
+      "hash": "sha256-UI5mGvzZ6BPafGYD6CrNAJAKjeJLB6urAS2lpB6X/Ec=",
+      "version": "597"
+    },
+    "Libm": {
+      "hash": "sha256-p4BndAag9d0XSMYWQ+c4myGv5qXbKx5E1VghudSbpTk=",
+      "version": "2026"
+    },
+    "Libnotify": {
+      "hash": "sha256-GDYMVi1034f9empq0YOuumQp/BDJ7phTb0Zl4KTY9xg=",
+      "version": "342"
+    },
+    "Librpcsvc": {
+      "hash": "sha256-UWYdCQ9QsBqwM01bWr+igINAHSdSluB/FrOclC5AjTI=",
+      "version": "31"
+    },
+    "Libsystem": {
+      "hash": "sha256-nawWJiu2IJ34ek5iOX6CrlqMzev7TuJpUkvDp30ZQ/U=",
+      "version": "1351"
+    },
+    "OpenDirectory": {
+      "hash": "sha256-6fSl8PasCZSBfe0ftaePcBuSEO3syb6kK+mfDI6iR7A=",
+      "version": "146"
+    },
+    "Security": {
+      "hash": "sha256-ZOrOOCk+hZbzDilzkihpQfsDpzV3Ul4zy6fpFRWUQHw=",
+      "version": "61439.120.27"
+    },
+    "architecture": {
+      "hash": "sha256-PRNUrhzSOrwmxSPkKmV0LV7yEIik65sdkfKdBqcwFhU=",
+      "version": "282"
+    },
+    "configd": {
+      "hash": "sha256-ZdUq1SrOwB88Lx68ekrA4zeVsLDZz4TAJywNnF+uAzY=",
+      "version": "1351.120.3"
+    },
+    "copyfile": {
+      "hash": "sha256-rLqT6e44W2ohgwUXREmiOyJBYCrV3gRLbtVnbUq60xc=",
+      "version": "221.121.1"
+    },
+    "dtrace": {
+      "hash": "sha256-iNEZyxK3DmEwO3gzrfvCaVZSEuuOMQm5IG/6FodPNdI=",
+      "version": "411"
+    },
+    "dyld": {
+      "hash": "sha256-4OOghgUYyMJbsTe96fiWCndTJ1BS94rK9v6Kqn/ooYs=",
+      "version": "1285.19"
+    },
+    "eap8021x": {
+      "hash": "sha256-Kx/wwnt108hDm0qQPyTNbZ8KoHkD5m7L4yb5qjSuQjI=",
+      "version": "365.120.2"
+    },
+    "hfs": {
+      "hash": "sha256-5/3Ycp3cKqlgAl1kjBmbF5tFlfJYQS5rbrbk4SS66b8=",
+      "version": "683.120.3"
+    },
+    "launchd": {
+      "hash": "sha256-8mW9bnuHmRXCx9py8Wy28C5b2QPICW0rlAps5njYa00=",
+      "version": "842.1.4"
+    },
+    "libclosure": {
+      "hash": "sha256-pvwfcbeEJmTEPdt6/lgVswiabLRG+sMN6VT5FwG7C4Q=",
+      "version": "96"
+    },
+    "libdispatch": {
+      "hash": "sha256-jTp2DolOOCQPBt1HRotkmPnKgQ2LGgniEqeHoM+vlKg=",
+      "version": "1521.120.4"
+    },
+    "libmalloc": {
+      "hash": "sha256-d9AVHSYTqHDlgctv8Hh4HAYW53MJelj4F8LWPsjrsws=",
+      "version": "715.120.13"
+    },
+    "libplatform": {
+      "hash": "sha256-gpijoTMvdkM0PdG8gyIllOJlh/MtTc4ro9ODDAhN6gM=",
+      "version": "349"
+    },
+    "libpthread": {
+      "hash": "sha256-N+MMXdbthsxauTTfZ5ElUs39dVH+Chn1yyU6pObZpkU=",
+      "version": "536"
+    },
+    "mDNSResponder": {
+      "hash": "sha256-ILx12PRxj/+VqfpCCErJFEJXFI9yzTh4g+FK0UCenIE=",
+      "version": "2600.120.12"
+    },
+    "objc4": {
+      "hash": "sha256-DMxa25gXjKCkiDnVJ/8SyJUjaBlmBGABg8EfCHcmTj0=",
+      "version": "940.4"
+    },
+    "ppp": {
+      "hash": "sha256-8+QUA79sHf85yvGSPE9qCmGsrZDT3NZnbgZVroJw/Hg=",
+      "version": "1016"
+    },
+    "removefile": {
+      "hash": "sha256-Z5UD0mk/s80CQB0PZWDzSl2JWXmnVmwUvlNb28+hR3k=",
+      "version": "81"
+    },
+    "xnu": {
+      "hash": "sha256-o4tCuCAIgAYg/Li3wTs12mVWr5C/4vbwu1zi+kJ9d6w=",
+      "version": "11417.121.6"
+    }
+  },
+  "26.0": {
+    "CarbonHeaders": {
+      "hash": "sha256-nIPXnLr21yVnpBhx9K5q3l/nPARA6JL/dED08MeyhP8=",
+      "version": "18.1"
+    },
+    "CommonCrypto": {
+      "hash": "sha256-+qAwL6+s7di9cX/qXtapLkjCFoDuZaSYltRJEG4qekM=",
+      "version": "600035"
+    },
+    "IOAudioFamily": {
+      "hash": "sha256-A3iiAjjP29VdjMj40tLS5Q/ni4qeh9bBpnmNzeG2pIY=",
+      "version": "700.2"
+    },
+    "IOBDStorageFamily": {
+      "hash": "sha256-OcQUJ3nEfrpvWX/npnedJ4PECIGWFSLiM0PKoiH911w=",
+      "version": "26"
+    },
+    "IOCDStorageFamily": {
+      "hash": "sha256-p/2qM5zjXFDRb/DISpEHxQEdvmuLlRGt/Ygc71Yu2rI=",
+      "version": "62"
+    },
+    "IODVDStorageFamily": {
+      "hash": "sha256-1Sa8aZBGNtqJBNHva+YXxET6Wcdm2PgVrTzYT/8qrN4=",
+      "version": "46"
+    },
+    "IOFWDVComponents": {
+      "hash": "sha256-WkfkWnzRupEh20U7vjsTta89clhus6GTkOpXQWXw/bM=",
+      "version": "208"
+    },
+    "IOFireWireAVC": {
+      "hash": "sha256-qR9lSTa7PN5Z9Nis4tfuXlcZGMIU48dete/NPD0UBbE=",
+      "version": "436"
+    },
+    "IOFireWireFamily": {
+      "hash": "sha256-hmErAXjLWIelqJaCrB8J4IiIxyB7S6EHFY+AY9YhmKQ=",
+      "version": "492"
+    },
+    "IOFireWireSBP2": {
+      "hash": "sha256-Xk+PDnUaO9q46nQwHwTKf/QXtGclfs0wTWiUbcV7e4s=",
+      "version": "454"
+    },
+    "IOFireWireSerialBusProtocolTransport": {
+      "hash": "sha256-cM/VFhVWNVwdJYk+mme0UYttQd7eJwd7Hlo7KNRyHY0=",
+      "version": "262"
+    },
+    "IOGraphics": {
+      "hash": "sha256-iysZE42mOKZbFxSZBNspaBTCRKEKK38DFGBxZWQxZxI=",
+      "version": "599"
+    },
+    "IOHIDFamily": {
+      "hash": "sha256-YLnabX90g4Q8LxjwVuJF6KODCDxychWV+VJaNG9d8fI=",
+      "version": "2222.0.24"
+    },
+    "IOKitUser": {
+      "hash": "sha256-ngwi8YMUqE0q8j7Lr5cqJwi2V+IDu3ie3bduotHIUJU=",
+      "version": "100222.0.4"
+    },
+    "IONetworkingFamily": {
+      "hash": "sha256-ZF5ML41Y1l1liQn32qTkcl4mMvx9Xdizb9VgvTzVTL4=",
+      "version": "186"
+    },
+    "IOSerialFamily": {
+      "hash": "sha256-wVS4QTx6MBOS0VrwyCZ3s5Usezwaf8rWzmNnfdDTXTU=",
+      "version": "93"
+    },
+    "IOStorageFamily": {
+      "hash": "sha256-1FKSF622qeXPGngA3UmQ2M/IU1pdlMoYBPbXytUFDaQ=",
+      "version": "331"
+    },
+    "IOUSBFamily": {
+      "hash": "sha256-Z0E3TfKP49toYo1Fo9kElRap8CZ+mVDHy5RIexgJTpA=",
+      "version": "630.4.5"
+    },
+    "Libc": {
+      "hash": "sha256-k+HQ+qgye0ORFm0hU8WzE4ysbbEoFZ7wcbVl5giDH/E=",
+      "version": "1725.0.11"
+    },
+    "Libinfo": {
+      "hash": "sha256-4InBEPi0n2EMo/8mIBib1Im4iTKRcRJ4IlAcLCigVGk=",
+      "version": "600"
+    },
+    "Libm": {
+      "hash": "sha256-p4BndAag9d0XSMYWQ+c4myGv5qXbKx5E1VghudSbpTk=",
+      "version": "2026"
+    },
+    "Libnotify": {
+      "hash": "sha256-p8cJZlBYOFmI1NDHXGYjgcv8z9Ldc1amZuYlxxJfeVY=",
+      "version": "344.0.1"
+    },
+    "Librpcsvc": {
+      "hash": "sha256-UWYdCQ9QsBqwM01bWr+igINAHSdSluB/FrOclC5AjTI=",
+      "version": "31"
+    },
+    "Libsystem": {
+      "hash": "sha256-/NlSwPaoTVx+bl9hYsfz3C5MuLdqGv4vdAh0KDbDKmY=",
+      "version": "1356"
+    },
+    "OpenDirectory": {
+      "hash": "sha256-6fSl8PasCZSBfe0ftaePcBuSEO3syb6kK+mfDI6iR7A=",
+      "version": "146"
+    },
+    "Security": {
+      "hash": "sha256-oxOvZsDoNYZNiWf+MASHrR4Q2o5oaqvK2We51hH7CO8=",
+      "version": "61901.0.87.0.1"
+    },
+    "architecture": {
+      "hash": "sha256-PRNUrhzSOrwmxSPkKmV0LV7yEIik65sdkfKdBqcwFhU=",
+      "version": "282"
+    },
+    "configd": {
+      "hash": "sha256-58or+OQP788UgQKO7Y8k8pY/enaSqH971ks7xCPu8fA=",
+      "version": "1385.0.7"
+    },
+    "copyfile": {
+      "hash": "sha256-I9uDi5BDQKa7mO3XpHxv0d6PiROW2ueZ3vGfrsG0OJo=",
+      "version": "230.0.1.0.1"
+    },
+    "dtrace": {
+      "hash": "sha256-5HpH6Cg8vWWzOX5ADD//izKDvqGnzV05Giju8lmGeyA=",
+      "version": "413"
+    },
+    "dyld": {
+      "hash": "sha256-jzoFLwbms0rUwzyjYif/r6Rmr4kyn+as/bhc4paEPeY=",
+      "version": "1323.3"
+    },
+    "eap8021x": {
+      "hash": "sha256-17bseWT4OWMA8hF+YSDDjxhVyJpbpP2xwv8dGti1YoM=",
+      "version": "368.0.3"
+    },
+    "hfs": {
+      "hash": "sha256-OkgqZ03gwn2hTuHxZrPDmQOrY4Dwu7MrX+BfG+PTgvE=",
+      "version": "704.0.3.0.2"
+    },
+    "launchd": {
+      "hash": "sha256-8mW9bnuHmRXCx9py8Wy28C5b2QPICW0rlAps5njYa00=",
+      "version": "842.1.4"
+    },
+    "libclosure": {
+      "hash": "sha256-pvwfcbeEJmTEPdt6/lgVswiabLRG+sMN6VT5FwG7C4Q=",
+      "version": "96"
+    },
+    "libdispatch": {
+      "hash": "sha256-L0+Ho9dAlMXVpqFEGIcIMsJc0gULckRulUImNEZe5MU=",
+      "version": "1542.0.4"
+    },
+    "libmalloc": {
+      "hash": "sha256-482hgm1ESr3LWC/JhuQNGNu9smsa2Eap49/eH+YNAio=",
+      "version": "792.1.1"
+    },
+    "libplatform": {
+      "hash": "sha256-wGZ2Im81mRXx6epgj/tbOJpg89CEbAr0Z8oFEpkyNMU=",
+      "version": "359.1.2"
+    },
+    "libpthread": {
+      "hash": "sha256-VuMpQjxuMsdHsFq0q6QIWSWi88gVF2jNzIfti20Gkbw=",
+      "version": "539"
+    },
+    "mDNSResponder": {
+      "hash": "sha256-iRqCpPAQDRjgRbRz3s6q2oyzq6xo+w4FTBai79104Zo=",
+      "version": "2881.0.25"
+    },
+    "objc4": {
+      "hash": "sha256-Nlgr36yLvGkUJIEFQ5w8FAB0r2syEsRTw0KuUShNT8E=",
+      "version": "950"
+    },
+    "ppp": {
+      "hash": "sha256-FzHZ05o7JxwgTqz0e3D68b/DiLu2x2ErzGMh0U78fLo=",
+      "version": "1020.1.1"
+    },
+    "removefile": {
+      "hash": "sha256-Z5UD0mk/s80CQB0PZWDzSl2JWXmnVmwUvlNb28+hR3k=",
+      "version": "84"
+    },
+    "xnu": {
+      "hash": "sha256-Cuf7kPtsn4CPXqyZmxVsJlA5i+Ikryp8ezJyGrvT63c=",
+      "version": "12377.1.9"
+    }
+  }
+}
--- a/nix/apple-sdk/metadata/disallowed-packages.json
+++ b/nix/apple-sdk/metadata/disallowed-packages.json
@@ -0,0 +1,533 @@
+[
+  {
+    "package": "apache",
+    "headers": [
+      "apache2"
+    ]
+  },
+  {
+    "package": "apr",
+    "headers": [
+      "apr-1"
+    ],
+    "libraries": [
+      "libapr-1.*",
+      "libaprutil-1.*"
+    ]
+  },
+  {
+    "package": "boringssl",
+    "libraries": [
+      "libboringssl.*"
+    ]
+  },
+  {
+    "package": "bzip2",
+    "headers": [
+      "bzlib.h"
+    ],
+    "libraries": [
+      "libbz2.*"
+    ]
+  },
+  {
+    "package": "corecrypto",
+    "libraries": [
+      "system/libcorecrypto*"
+    ]
+  },
+  {
+    "package": "Csu",
+    "libraries": [
+      "*.o"
+    ]
+  },
+  {
+    "package": "cups",
+    "headers": [
+      "cups"
+    ],
+    "libraries": [
+      "libcups*"
+    ]
+  },
+  {
+    "package": "curl",
+    "headers": [
+      "curl"
+    ],
+    "libraries": [
+      "libcurl.*"
+    ]
+  },
+  {
+    "package": "cyrus_sasl",
+    "headers": [
+      "sasl"
+    ],
+    "libraries": [
+      "libsasl*"
+    ]
+  },
+  {
+    "package": "editline",
+    "headers": [
+      "editline.h",
+      "editline"
+    ],
+    "libraries": [
+      "libedit.*",
+      "libeditline.*"
+    ]
+  },
+  {
+    "package": "html-tidy",
+    "headers": [
+      "tidy*"
+    ],
+    "libraries": [
+      "libtidy.*"
+    ]
+  },
+  {
+    "package": "hunspell",
+    "headers": [
+      "hunspell"
+    ],
+    "libraries": [
+      "libhunspell*"
+    ]
+  },
+  {
+    "package": "icu",
+    "headers": [
+      "unicode"
+    ],
+    "libraries": [
+      "libicucore.*"
+    ]
+  },
+  {
+    "package": "libarchive",
+    "headers": [
+      "archive.h",
+      "archive_entry.h"
+    ],
+    "libraries": [
+      "libarchive.*"
+    ]
+  },
+  {
+    "package": "libc++",
+    "headers": [
+      "c++",
+      "cxxabi.h",
+      "__cxxabi_config.h"
+    ],
+    "libraries": [
+      "libc++*"
+    ]
+  },
+  {
+    "package": "ld64",
+    "libraries": [
+      "libcodedirectory.*",
+      "libcodedirectory_static.*"
+    ]
+  },
+  {
+    "package": "expat",
+    "headers": [
+      "expat.h",
+      "expat_config.h",
+      "expat_external.h"
+    ],
+    "libraries": [
+      "libexpat.*"
+    ]
+  },
+  {
+    "package": "libffi",
+    "headers": [
+      "ffi*"
+    ],
+    "libraries": [
+      "libffi*"
+    ]
+  },
+  {
+    "package": "libgcc",
+    "libraries": [
+      "libgcc*"
+    ]
+  },
+  {
+    "package": "libiconv",
+    "headers": [
+      "iconv.h",
+      "libcharset.h",
+      "localcharset.h"
+    ],
+    "libraries": [
+      "libcharset.*",
+      "libiconv.*",
+      "i18n"
+    ]
+  },
+  {
+    "package": "libiodbc",
+    "libraries": [
+      "libiodbc*"
+    ]
+  },
+  {
+    "package": "libkrb4",
+    "libraries": [
+      "libkrb4.*"
+    ]
+  },
+  {
+    "package": "libkrb5",
+    "headers": [
+      "com_err.h",
+      "gssapi",
+      "gssapi.h",
+      "gssrpc",
+      "kadm5",
+      "kdb.h",
+      "krad.h",
+      "krb5",
+      "krb5.h",
+      "profile.h",
+      "verto-module.h",
+      "verto.h"
+    ],
+    "libraries": [
+      "krb5",
+      "libcom_err.*",
+      "libgssapi_krb5.*",
+      "libgssrpc.*",
+      "libk5crypto.*",
+      "libkadm5clnt.*",
+      "libkadm5clnt_mit.*",
+      "libkadm5srv.*",
+      "libkadm5srv_mit.*",
+      "libkdb5.*",
+      "libkrad.*",
+      "libkrb5*",
+      "libkrb5support.*",
+      "libverto.*"
+    ]
+  },
+  {
+    "package": "libpcap",
+    "headers": [
+      "pcap*"
+    ],
+    "libraries": [
+      "libpcap.*"
+    ]
+  },
+  {
+    "package": "libresolv",
+    "headers": [
+      "arpa/nameser.h",
+      "arpa/nameser_compat.h",
+      "dns.h",
+      "dns_util.h",
+      "nameser.h",
+      "resolv.h"
+    ],
+    "libraries": [
+      "libresolv.*"
+    ]
+  },
+  {
+    "package": "libstdc++",
+    "libraries": [
+      "libstdc++.*"
+    ]
+  },
+  {
+    "package": "libsbuf",
+    "headers": [
+      "usbuf.h"
+    ],
+    "libraries": [
+      "libsbuf.*"
+    ]
+  },
+  {
+    "package": "libtermcap",
+    "headers": [
+      "termcap.h"
+    ],
+    "libraries": [
+      "libtermcap.*"
+    ]
+  },
+  {
+    "package": "libutil",
+    "headers": [
+      "libutil.h"
+    ],
+    "libraries": [
+      "libutil.*",
+      "libutil1.*"
+    ]
+  },
+  {
+    "package": "libxml2",
+    "headers": [
+      "libxml",
+      "libxml2"
+    ],
+    "libraries": [
+      "libxml2.*"
+    ]
+  },
+  {
+    "package": "libxo",
+    "headers": [
+      "libxo"
+    ],
+    "libraries": [
+      "libxo.*"
+    ]
+  },
+  {
+    "package": "libxslt",
+    "headers": [
+      "libexslt",
+      "libxslt"
+    ],
+    "libraries": [
+      "libexslt.*",
+      "libxslt.*"
+    ]
+  },
+  {
+    "package": "liby",
+    "libraries": [
+      "liby.a"
+    ]
+  },
+  {
+    "package": "marisa-trie",
+    "libraries": [
+      "libmarisa.*"
+    ]
+  },
+  {
+    "package": "ncurses",
+    "headers": [
+      "curses*",
+      "cursslk.h",
+      "eti.h",
+      "etip.h",
+      "form.h",
+      "menu.h",
+      "nc_tparm.h",
+      "ncurses*",
+      "panel.h",
+      "term.h",
+      "term_entry.h",
+      "termcap.h",
+      "tic.h",
+      "unctrl.h"
+    ],
+    "libraries": [
+      "libcurses.*",
+      "libform.*",
+      "libformw.*",
+      "libmenu.*",
+      "libmenuw.*",
+      "libncurses.*",
+      "libncursesw.*",
+      "libpanel.*",
+      "libpanelw.*",
+      "libtinfo.*"
+    ]
+  },
+  {
+    "package": "net-snmp",
+    "headers": [
+      "net-snmp"
+    ],
+    "libraries": [
+      "libnetsnmp*"
+    ]
+  },
+  {
+    "package": "nghttp",
+    "libraries": [
+      "lib*nghttp2.*"
+    ]
+  },
+  {
+    "package": "openblas",
+    "headers": [
+      "cblas.h",
+      "f77blas.h",
+      "lapack.h",
+      "lapacke.h",
+      "lapacke_config.h",
+      "lapacke_mangling.h",
+      "lapacke_utils.h",
+      "openblas_config.h"
+    ],
+    "libraries": [
+      "libblas.*",
+      "libcblas.*",
+      "libclapack.*",
+      "libf77lapack.*",
+      "liblapack.*",
+      "liblapacke.*",
+      "libopenblas.*",
+      "libopenblas.*",
+      "libopenblasp*"
+    ]
+  },
+  {
+    "package": "openldap",
+    "libraries": [
+      "liblber.*",
+      "liblber_r.*",
+      "libldap.*",
+      "libldap_r.*"
+    ]
+  },
+  {
+    "package": "openpam",
+    "headers": [
+      "security"
+    ],
+    "libraries": [
+      "libpam.*",
+      "pam_*"
+    ]
+  },
+  {
+    "package": "pcre",
+    "headers": [
+      "pcre.h",
+      "pcreposix.h"
+    ],
+    "libraries": [
+      "libpcre.*",
+      "libpcre2*",
+      "libpcreposix.*"
+    ]
+  },
+  {
+    "package": "php",
+    "headers": [
+      "php"
+    ],
+    "libraries": [
+      "php"
+    ]
+  },
+  {
+    "package": "postgresql",
+    "libraries": [
+      "libecpg*",
+      "libpg*",
+      "libpq*"
+    ]
+  },
+  {
+    "package": "python",
+    "headers": [
+      "python*"
+    ],
+    "frameworks": [
+      "Python.framework"
+    ],
+    "libraries": [
+      "libpython*",
+      "python*"
+    ]
+  },
+  {
+    "package": "readline",
+    "headers": [
+      "readline"
+    ],
+    "libraries": [
+      "libhistory.*",
+      "libreadline.*"
+    ]
+  },
+  {
+    "package": "ruby",
+    "frameworks": [
+      "Ruby.framework"
+    ],
+    "libraries": [
+      "libruby.*",
+      "ruby"
+    ]
+  },
+  {
+    "package": "sqlite3",
+    "headers": [
+      "sqlite3.h",
+      "sqlite3ext.h"
+    ],
+    "libraries": [
+      "libsqlite3.*"
+    ]
+  },
+  {
+    "package": "swift",
+    "libraries": [
+      "swift/shims"
+    ]
+  },
+  {
+    "package": "tcl",
+    "headers": [
+      "tcl*",
+      "tk*"
+    ],
+    "frameworks": [
+      "Tcl.framework",
+      "Tk.framework"
+    ],
+    "libraries": [
+      "libtcl*",
+      "libtk*",
+      "tclConfig.sh",
+      "tkConfig.sh"
+    ]
+  },
+  {
+    "package": "xar",
+    "headers": [
+      "xar"
+    ],
+    "libraries": [
+      "libxar.*"
+    ]
+  },
+  {
+    "package": "xz",
+    "headers": [
+      "lzma*"
+    ],
+    "libraries": [
+      "liblzma.*"
+    ]
+  },
+  {
+    "package": "zlib",
+    "headers": [
+      "zconf.h",
+      "zlib.h"
+    ],
+    "libraries": [
+      "libz.*"
+    ]
+  }
+]
--- a/nix/apple-sdk/metadata/versions.json
+++ b/nix/apple-sdk/metadata/versions.json
@@ -0,0 +1,26 @@
+{
+  "14": {
+    "urls": [
+      "https://swcdn.apple.com/content/downloads/14/48/052-59890-A_I0F5YGAY0Y/p9n40hio7892gou31o1v031ng6fnm9sb3c/CLTools_macOSNMOS_SDK.pkg",
+      "https://web.archive.org/web/20250211001355/https://swcdn.apple.com/content/downloads/14/48/052-59890-A_I0F5YGAY0Y/p9n40hio7892gou31o1v031ng6fnm9sb3c/CLTools_macOSNMOS_SDK.pkg"
+    ],
+    "version": "14.4",
+    "hash": "sha256-QozDiwY0Czc0g45vPD7G4v4Ra+3DujCJbSads3fJjjM="
+  },
+  "15": {
+    "urls": [
+      "https://swcdn.apple.com/content/downloads/52/01/082-41241-A_0747ZN8FHV/dectd075r63pppkkzsb75qk61s0lfee22j/CLTools_macOSNMOS_SDK.pkg",
+      "https://web.archive.org/web/20250530132510/https://swcdn.apple.com/content/downloads/52/01/082-41241-A_0747ZN8FHV/dectd075r63pppkkzsb75qk61s0lfee22j/CLTools_macOSNMOS_SDK.pkg"
+    ],
+    "version": "15.5",
+    "hash": "sha256-HBiSJuw1XBUK5R/8Sj65c3rftSEvQl/O9ZZVp/g1Amo="
+  },
+  "26": {
+    "urls": [
+      "https://swcdn.apple.com/content/downloads/60/22/089-71960-A_W8BL1RUJJ6/5zkyplomhk1cm7z6xja2ktgapnhhti6wwd/CLTools_macOSNMOS_SDK.pkg",
+      "https://web.archive.org/web/20250915230423/https://swcdn.apple.com/content/downloads/60/22/089-71960-A_W8BL1RUJJ6/5zkyplomhk1cm7z6xja2ktgapnhhti6wwd/CLTools_macOSNMOS_SDK.pkg"
+    ],
+    "version": "26.2",
+    "hash": "sha256-hXRlMieVv0smna5uiWRwq87IWOaPWtAjAldbi+wQXcw="
+  }
+}
--- a/nix/apple-sdk/package.nix
+++ b/nix/apple-sdk/package.nix
@@ -0,0 +1,110 @@
+let
+  sdkVersions = builtins.fromJSON (builtins.readFile ./metadata/versions.json);
+in
+
+{ lib
+, stdenv
+, stdenvNoCC
+, substitute
+, # Specifies the major version used for the SDK. Uses `hostPlatform.darwinSdkVersion` by default.
+  darwinSdkMajorVersion ? lib.versions.major stdenv.hostPlatform.darwinSdkVersion
+, # Enabling bootstrap disables propagation. Defaults to `false` (meaning to propagate certain packages and `xcrun`)
+  # except in stage0 of the Darwin stdenv bootstrap.
+  enableBootstrap ? stdenv.name == "bootstrap-stage0-stdenv-darwin"
+, # Required by various phases
+  callPackage
+,
+}:
+
+let
+  sdkInfo =
+    sdkVersions.${darwinSdkMajorVersion}
+      or (lib.throw "Unsupported SDK major version: ${darwinSdkMajorVersion}");
+  sdkVersion = sdkInfo.version;
+
+  fetchSDK = callPackage ./common/fetch-sdk.nix { };
+
+  phases = lib.composeManyExtensions (
+    [
+      (callPackage ./common/add-core-symbolication.nix { })
+      (callPackage ./common/derivation-options.nix { })
+      (callPackage ./common/passthru-private-frameworks.nix { inherit sdkVersion; })
+      (callPackage ./common/passthru-source-release-files.nix { inherit sdkVersion; })
+      (callPackage ./common/remove-disallowed-packages.nix { })
+      (callPackage ./common/process-stubs.nix { })
+    ]
+    # Avoid infinite recursions by not propagating certain packages, so they can themselves build with the SDK.
+    ++ lib.optionals (!enableBootstrap) [
+      (callPackage ./common/propagate-inputs.nix { })
+      (callPackage ./common/propagate-xcrun.nix { inherit sdkVersion; })
+    ]
+    # This has to happen last.
+    ++ [
+      (callPackage ./common/run-build-phase-hooks.nix { })
+    ]
+  );
+in
+stdenvNoCC.mkDerivation (
+  lib.extends phases (finalAttrs: {
+    pname = "apple-sdk";
+    inherit (sdkInfo) version;
+
+    src = fetchSDK sdkInfo;
+
+    dontConfigure = true;
+
+    strictDeps = true;
+
+    setupHooks = [
+      # `role.bash` is copied from `../build-support/setup-hooks/role.bash` due to the requirements not to reference
+      # paths outside the package when it is in `by-name`.  It needs to be kept in sync, but it fortunately does not
+      # change often. Once `build-support` is available as a package (or some other mechanism), it should be changed
+      # to whatever that replacement is.
+      ./setup-hooks/role.bash
+      (substitute {
+        src = ./setup-hooks/sdk-hook.sh;
+        substitutions = [
+          "--subst-var-by"
+          "sdkVersion"
+          (lib.escapeShellArgs (lib.splitVersion sdkVersion))
+        ];
+      })
+    ];
+
+    installPhase =
+      let
+        sdkName = "MacOSX${lib.versions.majorMinor sdkVersion}.sdk";
+        sdkMajor = lib.versions.major sdkVersion;
+      in
+      ''
+        runHook preInstall
+
+        mkdir -p "$sdkpath"
+
+        cp -rd . "$sdkpath/${sdkName}"
+        ln -s "${sdkName}" "$sdkpath/MacOSX${sdkMajor}.sdk"
+        ln -s "${sdkName}" "$sdkpath/MacOSX.sdk"
+
+        # Swift adds these locations to its search paths. Avoid spurious warnings by making sure they exist.
+        mkdir -p "$platformPath/Developer/Library/Frameworks"
+        mkdir -p "$platformPath/Developer/Library/PrivateFrameworks"
+        mkdir -p "$platformPath/Developer/usr/lib"
+
+        runHook postInstall
+      '';
+
+    passthru = {
+      sdkroot = finalAttrs.finalPackage + "/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk";
+    };
+
+    __structuredAttrs = true;
+
+    meta = {
+      description = "Frameworks and libraries required for building packages on Darwin";
+      homepage = "https://developer.apple.com";
+      teams = [ lib.teams.darwin ];
+      platforms = lib.platforms.darwin;
+      badPlatforms = [ lib.systems.inspect.patterns.is32bit ];
+    };
+  })
+)
--- a/nix/apple-sdk/patches/0001-Add-function-definitions-needed-to-build-zlog-in-sys.patch
+++ b/nix/apple-sdk/patches/0001-Add-function-definitions-needed-to-build-zlog-in-sys.patch
@@ -0,0 +1,48 @@
+From 6531da946949a94643e6d8424236174ae64fe0ca Mon Sep 17 00:00:00 2001
+From: Randy Eckenrode <randy@largeandhighquality.com>
+Date: Sat, 30 Sep 2023 18:02:39 -0400
+Subject: [PATCH 1/2] Add function definitions needed to build zlog in
+ system_cmds
+
+---
+ CoreSymbolication.h | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/CoreSymbolication.h b/CoreSymbolication.h
+index a413860..f3cf63f 100644
+--- a/CoreSymbolication.h
+++ b/CoreSymbolication.h
+@@ -324,7 +324,9 @@ CSSymbolOwnerEditRelocations
+ CSSymbolOwnerForeachRegion
+ CSSymbolOwnerForeachRegionWithName
+ CSSymbolOwnerForeachSection
+-CSSymbolOwnerForeachSegment
+*/
+void CSSymbolOwnerForeachSegment(CSSymbolOwnerRef owner, void (^block)(CSSegmentRef));
+/*
+ CSSymbolOwnerForeachSourceInfo
+ CSSymbolOwnerForeachSymbol
+  */
+@@ -333,7 +335,9 @@ void CSSymbolOwnerForeachSymbolWithName(CSSymbolOwnerRef owner,  const char *sna
+ /*
+ CSSymbolOwnerGetArchitecture
+ CSSymbolOwnerGetBaseAddress
+-CSSymbolOwnerGetCFUUIDBytes
+*/
+const CFUUIDBytes* CSSymbolOwnerGetCFUUIDBytes(CSSymbolOwnerRef owner);
+/*
+ CSSymbolOwnerGetCompatibilityVersion
+ CSSymbolOwnerGetCurrentVersion
+ CSSymbolOwnerGetDataFlags
+@@ -390,7 +394,7 @@ CSSymbolOwnerSetLoadTimestamp
+ CSSymbolOwnerSetPath
+ CSSymbolOwnerSetRelocationCount
+  */
+-CSSymbolOwnerSetTransientUserData(CSSymbolOwnerRef owner, uint32_t gen);
+void CSSymbolOwnerSetTransientUserData(CSSymbolOwnerRef owner, uint32_t gen);
+  /*
+ CSSymbolOwnerSetUnloadTimestamp
+ */
+-- 
+2.44.1
+
--- a/nix/apple-sdk/patches/0002-Add-CF_EXPORT-To-const-symbols.patch
+++ b/nix/apple-sdk/patches/0002-Add-CF_EXPORT-To-const-symbols.patch
@@ -0,0 +1,45 @@
+From ae7ac6a7043dbae8e63d6ce5e63dfaf02b5977fe Mon Sep 17 00:00:00 2001
+From: Randy Eckenrode <randy@largeandhighquality.com>
+Date: Sat, 30 Sep 2023 18:37:18 -0400
+Subject: [PATCH 2/2] Add CF_EXPORT To const symbols
+
+---
+ CoreSymbolication.h | 15 ++++++++-------
+ 1 file changed, 8 insertions(+), 7 deletions(-)
+
+diff --git a/CoreSymbolication.h b/CoreSymbolication.h
+index f3cf63f..4124a54 100644
+--- a/CoreSymbolication.h
+++ b/CoreSymbolication.h
+@@ -49,6 +49,7 @@
+ 
+ 
+ #include <CoreFoundation/CoreFoundation.h>
+#include <CoreFoundation/CFBase.h>
+ #include <mach/mach.h>
+ 
+ 
+@@ -139,13 +140,13 @@ typedef void (^CSSegmentIterator)(CSSegmentRef segment);
+  * External symbols
+  */
+ 
+-const char* kCSRegionMachHeaderName;
+-const CSDictionaryKeyCallBacks kCSTypeDictionaryKeyCallBacks;
+-const CSDictionaryValueCallBacks kCSTypeDictionaryValueCallBacks;
+-const CSDictionaryKeyCallBacks kCSTypeDictionaryWeakKeyCallBacks;
+-const CSDictionaryValueCallBacks kCSTypeDictionaryWeakValueCallBacks;
+-const CSSetCallBacks kCSTypeSetCallBacks;
+-const CSSetCallBacks kCSTypeSetWeakCallBacks;
+CF_EXPORT const char* kCSRegionMachHeaderName;
+CF_EXPORT const CSDictionaryKeyCallBacks kCSTypeDictionaryKeyCallBacks;
+CF_EXPORT const CSDictionaryValueCallBacks kCSTypeDictionaryValueCallBacks;
+CF_EXPORT const CSDictionaryKeyCallBacks kCSTypeDictionaryWeakKeyCallBacks;
+CF_EXPORT const CSDictionaryValueCallBacks kCSTypeDictionaryWeakValueCallBacks;
+CF_EXPORT const CSSetCallBacks kCSTypeSetCallBacks;
+CF_EXPORT const CSSetCallBacks kCSTypeSetWeakCallBacks;
+ 
+ 
+ /*
+-- 
+2.44.1
+
--- a/nix/apple-sdk/scripts/get-sdks-from-catalog.sh
+++ b/nix/apple-sdk/scripts/get-sdks-from-catalog.sh
@@ -0,0 +1,41 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p coreutils curl file gzip jq xcbuild yq
+
+set -eu -o pipefail
+
+catalog=${1-}
+
+if [ -z "$catalog" ]; then
+  echo "usage: get-sdks-from-catalog.sh <catalog>"
+  echo " <catalog>   Apple software update catalog (may be gzipped)" >&2
+  exit 1
+fi
+
+scratch=$(mktemp)
+trap 'rm -f -- "$scratch"' EXIT
+
+if [[ "$(file "$catalog")" =~ gzip ]]; then
+  gzcat "$catalog" >"$scratch"
+else
+  cp --reflink=auto "$catalog" "$scratch"
+fi
+
+# Grab all SDK packages from the catalog
+filter='.Products[].Packages[] | select(.URL | test(".*CLTools_macOSNMOS_SDK.pkg")) | "\(.URL)|\(.MetadataURL)"'
+
+declare -A package_list
+for package in $(plutil -convert json -o - "$scratch" | jq -r "$filter"); do
+  package_list[${package%%|*}]=${package#*|}
+done
+
+truncate --size 0 "$scratch"
+for pkg in "${!package_list[@]}"; do
+  ver=$(curl --silent "${package_list[$pkg]}" | xq -r '."pkg-info"."@version"')
+  echo "{\"url\": \"$pkg\", \"version\": \"$(cut -d. -f1-3 <<<"$ver")\", \"long_version\": \"$ver\"}" >>"$scratch"
+done
+
+jq -r --slurp '
+    group_by(.version | split(".")[0])
+    | map(max_by(.version))
+    | sort_by(.version)[]
+    | "Package URL: \(.url)\n  Xcode Ver: \(.version) (\(.long_version))\n"' "$scratch"
--- a/nix/apple-sdk/scripts/lock-sdk-deps.sh
+++ b/nix/apple-sdk/scripts/lock-sdk-deps.sh
@@ -0,0 +1,70 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p coreutils curl git gnutar jq moreutils nix
+
+set -eu -o pipefail
+
+if [ ! -v 2 ]; then
+  echo "usage: lock-sdk-deps.sh <SDK version> <Packages>" >&2
+  echo " <SDK version>   Decimal-separated version number." >&2
+  echo "                 Must correspond to a tag in https://github.com/apple-oss-distributions/distribution-macOS" >&2
+  echo " <Packages>      List of packages from the distributions-macOS repository." >&2
+  echo "                 Packages not in the repository at the tag for <SDK version> will be ignored."
+  exit 1
+fi
+
+pkgdir=$(dirname "$(dirname "$(realpath "$0")")")
+
+lockfile=$pkgdir/metadata/apple-oss-lockfile.json
+if [ ! -e "$lockfile" ]; then
+  touch "$lockfile"
+fi
+
+workdir=$(mktemp -d)
+trap 'rm -rf -- "$workdir"' EXIT
+
+sdkVersion=$1
+shift
+tag="macos-${sdkVersion//./}"
+
+declare -a packages=("$@")
+
+echo "Locking versions for macOS $sdkVersion using tag '$tag'..."
+
+pushd "$workdir" >/dev/null
+
+git clone --branch "$tag" https://github.com/apple-oss-distributions/distribution-macOS.git &>/dev/null
+cd distribution-macOS
+
+for package in "${packages[@]}"; do
+  # If the tag exists in `release.json`, use that as an optimization to avoid downloading unnecessarily from Github.
+  packageTag=$(jq -r --arg package "$package" '.projects[] | select(.project == $package) | .tag' release.json)
+  packageCommit=$(git ls-tree -d HEAD "$package" | awk '{print $3}')
+
+  if [ ! -d "$package" ]; then
+    packageCommit=HEAD
+  fi
+
+  # However, sometimes it doesn’t exist. In that case, fall back to cloning the repo and check manually
+  # which tag corresponds to the commit from the submodule.
+  if [ -z "$packageTag" ]; then
+    git clone --no-checkout "https://github.com/apple-oss-distributions/$package.git" ../source &>/dev/null
+    pushd ../source >/dev/null
+    packageTag=$(git tag --points-at "$packageCommit")
+    popd >/dev/null
+    rm -rf ../source
+  fi
+
+  packageVersion=${packageTag##"$package"-}
+
+  curl -OL "https://github.com/apple-oss-distributions/$package/archive/$packageTag.tar.gz" &>/dev/null
+  tar axf "$packageTag.tar.gz"
+
+  packageHash=$(nix --extra-experimental-features nix-command hash path "$package-$packageTag")
+
+  pkgsjson="{\"$sdkVersion\": {\"$package\": {\"version\": \"$packageVersion\", \"hash\": \"$packageHash\"}}}"
+
+  echo "   - Locking $package to version $packageVersion with hash '$packageHash'"
+  jq --argjson pkg "$pkgsjson" -S '. * $pkg' "$lockfile" | sponge "$lockfile"
+done
+
+popd >/dev/null
--- a/nix/apple-sdk/scripts/regenerate-lockfile.sh
+++ b/nix/apple-sdk/scripts/regenerate-lockfile.sh
@@ -0,0 +1,62 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p coreutils jq
+
+set -eu -o pipefail
+
+pkgdir=$(dirname "$(dirname "$(realpath "$0")")")
+
+echo '{}' >"$pkgdir/metadata/apple-oss-lockfile.json"
+
+declare -a versions
+readarray -t versions < <(jq -r '.[].version' "$pkgdir/metadata/versions.json")
+
+declare -a packages=(
+  CarbonHeaders
+  CommonCrypto
+  IOAudioFamily
+  IOFireWireFamily
+  IOFWDVComponents
+  IOFireWireAVC
+  IOFireWireSBP2
+  IOFireWireSerialBusProtocolTransport
+  IOGraphics
+  IOHIDFamily
+  IONetworkingFamily
+  IOSerialFamily
+  IOStorageFamily
+  IOBDStorageFamily
+  IOCDStorageFamily
+  IODVDStorageFamily
+  IOUSBFamily
+  IOKitUser
+  Libc
+  Libinfo
+  Libm
+  Libnotify
+  Librpcsvc
+  Libsystem
+  OpenDirectory
+  Security
+  architecture
+  configd
+  copyfile
+  dtrace
+  dyld
+  eap8021x
+  hfs
+  launchd
+  libclosure
+  libdispatch
+  libmalloc
+  libplatform
+  libpthread
+  mDNSResponder
+  objc4
+  ppp
+  removefile
+  xnu
+)
+
+for version in "${versions[@]}"; do
+  "$pkgdir/scripts/lock-sdk-deps.sh" "$version" "${packages[@]}"
+done
--- a/nix/apple-sdk/setup-hooks/add-private-frameworks.sh
+++ b/nix/apple-sdk/setup-hooks/add-private-frameworks.sh
@@ -0,0 +1,6 @@
+function enablePrivateFrameworks() {
+  export NIX_CFLAGS_COMPILE+=" -iframework $DEVELOPER_DIR/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/System/Library/PrivateFrameworks"
+  export NIX_LDFLAGS+=" -F$DEVELOPER_DIR/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/System/Library/PrivateFrameworks"
+}
+
+preConfigureHooks+=(enablePrivateFrameworks)
--- a/nix/apple-sdk/setup-hooks/role.bash
+++ b/nix/apple-sdk/setup-hooks/role.bash
@@ -0,0 +1,71 @@
+# Since the same derivation can be depended on in multiple ways, we need to
+# accumulate *each* role (i.e. host and target platforms relative the depending
+# derivation) in which the derivation is used.
+#
+# The role is intended to be used as part of other variables names like
+#  - $NIX_SOMETHING${role_post}
+
+function getRole() {
+    case $1 in
+        -1)
+            role_post='_FOR_BUILD'
+            ;;
+        0)
+            role_post=''
+            ;;
+        1)
+            role_post='_FOR_TARGET'
+            ;;
+        *)
+            echo "@name@: used as improper sort of dependency" >&2
+            return 1
+            ;;
+    esac
+}
+
+# `hostOffset` describes how the host platform of the package is slid relative
+# to the depending package. `targetOffset` likewise describes the target
+# platform of the package. Both are brought into scope of the setup hook defined
+# for dependency whose setup hook is being processed relative to the package
+# being built.
+
+function getHostRole()   {
+    getRole "$hostOffset"
+}
+function getTargetRole() {
+    getRole "$targetOffset"
+}
+
+# `depHostOffset` describes how the host platform of the dependencies are slid
+# relative to the depending package. `depTargetOffset` likewise describes the
+# target platform of dependenices. Both are brought into scope of the
+# environment hook defined for the dependency being applied relative to the
+# package being built.
+
+function getHostRoleEnvHook()   {
+    getRole "$depHostOffset"
+}
+function getTargetRoleEnvHook() {
+    getRole "$depTargetOffset"
+}
+
+# This variant is intended specifically for code-producing tool wrapper scripts
+# `NIX_@wrapperName@_TARGET_*_@suffixSalt@` tracks this (needs to be an exported
+# env var so can't use fancier data structures).
+function getTargetRoleWrapper() {
+    case $targetOffset in
+        -1)
+            export NIX_@wrapperName@_TARGET_BUILD_@suffixSalt@=1
+            ;;
+        0)
+            export NIX_@wrapperName@_TARGET_HOST_@suffixSalt@=1
+            ;;
+        1)
+            export NIX_@wrapperName@_TARGET_TARGET_@suffixSalt@=1
+            ;;
+        *)
+            echo "@name@: used as improper sort of dependency" >&2
+            return 1
+            ;;
+    esac
+}
--- a/nix/apple-sdk/setup-hooks/sdk-hook.sh
+++ b/nix/apple-sdk/setup-hooks/sdk-hook.sh
@@ -0,0 +1,17 @@
+local role_post
+getHostRole
+
+local sdkVersionVar=NIX_APPLE_SDK_VERSION${role_post}
+local developerDirVar=DEVELOPER_DIR${role_post}
+
+local sdkVersionArr=(@sdkVersion@)
+local sdkVersion
+sdkVersion=$(printf "%02d%02d%02d" "${sdkVersionArr[0]-0}" "${sdkVersionArr[1]-0}" "${sdkVersionArr[2]-0}")
+
+if [ "$sdkVersion" -gt "${!sdkVersionVar-000000}" ]; then
+  export "$developerDirVar"='@out@'
+  export "$sdkVersionVar"="$sdkVersion"
+  export "SDKROOT${role_post}"="${!developerDirVar}/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk"
+fi
+
+unset -v role_post developerDirVar sdkVersion sdkVersionArr sdkVersionVar
--- a/nix/mlx.nix
+++ b/nix/mlx.nix
@@ -86,6 +86,7 @@ let
        (lib.cmakeOptionType "filepath" "FETCHCONTENT_SOURCE_DIR_NANOBIND" "${nanobind}")
        (lib.cmakeBool "FETCHCONTENT_FULLY_DISCONNECTED" true)
        (lib.cmakeBool "MLX_BUILD_METAL" true)
+        (lib.cmakeBool "MLX_BUILD_CPU" true)
        (lib.cmakeOptionType "filepath" "FETCHCONTENT_SOURCE_DIR_METAL_CPP" "${metal_cpp}")
        (lib.cmakeOptionType "string" "CMAKE_OSX_DEPLOYMENT_TARGET" "${apple-sdk_26.version}")
        (lib.cmakeOptionType "filepath" "CMAKE_OSX_SYSROOT" "${apple-sdk_26.passthru.sdkroot}")
--- a/src/exo/utils/info_gatherer/info_gatherer.py
+++ b/src/exo/utils/info_gatherer/info_gatherer.py
@@ -352,7 +352,10 @@ class InfoGatherer:
        if self.misc_poll_interval is None:
            return
        while True:
-            await self.info_sender.send(await MiscData.gather())
+            try:
+                await self.info_sender.send(await MiscData.gather())
+            except Exception as e:
+                logger.warning(f"Error gathering misc data: {e}")
            await anyio.sleep(self.misc_poll_interval)

    async def _monitor_system_profiler_thunderbolt_data(self):
@@ -363,15 +366,17 @@ class InfoGatherer:
            return

        while True:
-            data = await ThunderboltConnectivity.gather()
-            assert data is not None
+            try:
+                data = await ThunderboltConnectivity.gather()
+                assert data is not None

-            idents = [it for i in data if (it := i.ident(iface_map)) is not None]
-            await self.info_sender.send(MacThunderboltIdentifiers(idents=idents))
-
-            conns = [it for i in data if (it := i.conn()) is not None]
-            await self.info_sender.send(MacThunderboltConnections(conns=conns))
+                idents = [it for i in data if (it := i.ident(iface_map)) is not None]
+                await self.info_sender.send(MacThunderboltIdentifiers(idents=idents))

+                conns = [it for i in data if (it := i.conn()) is not None]
+                await self.info_sender.send(MacThunderboltConnections(conns=conns))
+            except Exception as e:
+                logger.warning(f"Error gathering Thunderbolt data: {e}")
            await anyio.sleep(self.system_profiler_interval)

    async def _monitor_memory_usage(self):
@@ -384,26 +389,35 @@ class InfoGatherer:
        if self.memory_poll_rate is None:
            return
        while True:
-            await self.info_sender.send(
-                MemoryUsage.from_psutil(override_memory=override_memory)
-            )
+            try:
+                await self.info_sender.send(
+                    MemoryUsage.from_psutil(override_memory=override_memory)
+                )
+            except Exception as e:
+                logger.warning(f"Error gathering memory usage: {e}")
            await anyio.sleep(self.memory_poll_rate)

    async def _watch_system_info(self):
        if self.interface_watcher_interval is None:
            return
        while True:
-            nics = await get_network_interfaces()
-            await self.info_sender.send(NodeNetworkInterfaces(ifaces=nics))
+            try:
+                nics = await get_network_interfaces()
+                await self.info_sender.send(NodeNetworkInterfaces(ifaces=nics))
+            except Exception as e:
+                logger.warning(f"Error gathering network interfaces: {e}")
            await anyio.sleep(self.interface_watcher_interval)

    async def _monitor_thunderbolt_bridge_status(self):
        if self.thunderbolt_bridge_poll_interval is None:
            return
        while True:
-            curr = await ThunderboltBridgeInfo.gather()
-            if curr is not None:
-                await self.info_sender.send(curr)
+            try:
+                curr = await ThunderboltBridgeInfo.gather()
+                if curr is not None:
+                    await self.info_sender.send(curr)
+            except Exception as e:
+                logger.warning(f"Error gathering Thunderbolt Bridge status: {e}")
            await anyio.sleep(self.thunderbolt_bridge_poll_interval)

    async def _monitor_macmon(self, macmon_path: str):
--- a/src/exo/utils/info_gatherer/net_profile.py
+++ b/src/exo/utils/info_gatherer/net_profile.py
@@ -1,4 +1,5 @@
-from collections.abc import Mapping
+from collections import defaultdict
+from collections.abc import AsyncGenerator, Mapping

 import anyio
 import httpx
@@ -8,6 +9,7 @@ from loguru import logger
 from exo.shared.topology import Topology
 from exo.shared.types.common import NodeId
 from exo.shared.types.profiling import NodeNetworkInfo
+from exo.utils.channels import Sender, channel

 REACHABILITY_ATTEMPTS = 3

@@ -80,10 +82,10 @@ async def check_reachable(
    topology: Topology,
    self_node_id: NodeId,
    node_network: Mapping[NodeId, NodeNetworkInfo],
-) -> dict[NodeId, set[str]]:
-    """Check which nodes are reachable and return their IPs."""
+) -> AsyncGenerator[tuple[str, NodeId], None]:
+    """Yield (ip, node_id) pairs as reachability probes complete."""

-    reachable: dict[NodeId, set[str]] = {}
+    send, recv = channel[tuple[str, NodeId]]()

    # these are intentionally httpx's defaults so we can tune them later
    timeout = httpx.Timeout(timeout=5.0)
@@ -93,6 +95,18 @@ async def check_reachable(
        keepalive_expiry=5,
    )

+    async def _probe(
+        target_ip: str,
+        expected_node_id: NodeId,
+        client: httpx.AsyncClient,
+        send: Sender[tuple[str, NodeId]],
+    ) -> None:
+        async with send:
+            out: defaultdict[NodeId, set[str]] = defaultdict(set)
+            await check_reachability(target_ip, expected_node_id, out, client)
+            if expected_node_id in out:
+                await send.send((target_ip, expected_node_id))
+
    async with (
        httpx.AsyncClient(timeout=timeout, limits=limits) as client,
        create_task_group() as tg,
@@ -103,12 +117,9 @@ async def check_reachable(
            if node_id == self_node_id:
                continue
            for iface in node_network[node_id].interfaces:
-                tg.start_soon(
-                    check_reachability,
-                    iface.ip_address,
-                    node_id,
-                    reachable,
-                    client,
-                )
+                tg.start_soon(_probe, iface.ip_address, node_id, client, send.clone())
+        send.close()

-    return reachable
+        with recv:
+            async for item in recv:
+                yield item
--- a/src/exo/worker/engines/mlx/auto_parallel.py
+++ b/src/exo/worker/engines/mlx/auto_parallel.py
@@ -121,10 +121,15 @@ class PipelineFirstLayer(CustomMlxLayer):
        super().__init__(original_layer)
        self.r: int = r
        self.group = group
+        self.is_prefill: bool = False

    def __call__(self, x: mx.array, *args: object, **kwargs: object) -> mx.array:
        if self.r != 0:
            x = mx.distributed.recv_like(x, (self.r - 1), group=self.group)
+            if self.is_prefill:
+                # We want to avoid GPU timeout errors by evalling the distributed operation
+                # so that it stays on CPU, which does not have a timeout.
+                mx.eval(x)
        return self.original_layer(x, *args, **kwargs)


@@ -141,6 +146,7 @@ class PipelineLastLayer(CustomMlxLayer):
        self.s: int = s
        self.group = group
        self.original_layer_signature = signature(self.original_layer.__call__)
+        self.is_prefill: bool = False

    def __call__(self, x: mx.array, *args: object, **kwargs: object) -> mx.array:
        cache = self.original_layer_signature.bind_partial(
@@ -155,14 +161,25 @@ class PipelineLastLayer(CustomMlxLayer):
            )
            if cache is not None:
                cache.keys = mx.depends(cache.keys, output)  # type: ignore[reportUnknownMemberType]
+            if self.is_prefill:
+                mx.eval(output)
+                if cache is not None:
+                    mx.eval(cache.keys)  # type: ignore

-        output = mx.distributed.all_gather(output, group=self.group)[
-            -output.shape[0] :
-        ]  # type :ignore
+        if not self.is_prefill:
+            output = mx.distributed.all_gather(output, group=self.group)[
+                -output.shape[0] :
+            ]

        return output


+def set_pipeline_prefill(model: nn.Module, is_prefill: bool) -> None:
+    for layer in model.layers:  # type: ignore
+        if isinstance(layer, (PipelineFirstLayer, PipelineLastLayer)):
+            layer.is_prefill = is_prefill
+
+
 def _inner_model(model: nn.Module) -> nn.Module:
    inner = getattr(model, "model", None)
    if isinstance(inner, nn.Module):
--- a/src/exo/worker/engines/mlx/generator/generate.py
+++ b/src/exo/worker/engines/mlx/generator/generate.py
@@ -24,6 +24,7 @@ from exo.shared.types.worker.runner_response import (
    GenerationResponse,
 )
 from exo.worker.engines.mlx import Model
+from exo.worker.engines.mlx.auto_parallel import set_pipeline_prefill
 from exo.worker.engines.mlx.cache import (
    CacheSnapshot,
    KVPrefixCache,
@@ -83,6 +84,8 @@ def prefill(
        if has_ssm:
            snapshots.append(snapshot_ssm_states(cache))

+    set_pipeline_prefill(model, is_prefill=True)
+
    # Use max_tokens=1 because max_tokens=0 does not work.
    # We just throw away the generated token - we only care about filling the cache
    for _ in stream_generate(
@@ -92,13 +95,15 @@ def prefill(
        max_tokens=1,
        sampler=sampler,
        prompt_cache=cache,
-        prefill_step_size=2048,
+        prefill_step_size=8192,
        kv_group_size=KV_GROUP_SIZE,
        kv_bits=KV_BITS,
        prompt_progress_callback=progress_callback,
    ):
        break  # Stop after first iteration - cache is now filled

+    set_pipeline_prefill(model, is_prefill=False)
+
    # stream_generate added 1 extra generated token to the cache, so we should trim it.
    # Because of needing to roll back arrays cache, we will generate on 2 tokens so trim 1 more.
    pre_gen = deepcopy(snapshots[-2]) if has_ssm else None
@@ -325,6 +330,9 @@ def mlx_generate(
    reasoning_tokens = 0
    think_start = tokenizer.think_start
    think_end = tokenizer.think_end
+
+    mx_barrier(group)
+
    for completion_tokens, out in enumerate(
        stream_generate(
            model=model,
@@ -334,8 +342,7 @@ def mlx_generate(
            sampler=sampler,
            logits_processors=logits_processors,
            prompt_cache=caches,
-            # TODO: Dynamically change prefill step size to be the maximum possible without timing out.
-            prefill_step_size=2048,
+            prefill_step_size=1,
            kv_group_size=KV_GROUP_SIZE,
            kv_bits=KV_BITS,
        ),
--- a/src/exo/worker/main.py
+++ b/src/exo/worker/main.py
@@ -1,3 +1,4 @@
+from collections import defaultdict
 from datetime import datetime, timezone
 from random import random
 from typing import Iterator
@@ -345,29 +346,29 @@ class Worker:
            edges = set(
                conn.edge for conn in self.state.topology.out_edges(self.node_id)
            )
-            conns = await check_reachable(
+            conns: defaultdict[NodeId, set[str]] = defaultdict(set)
+            async for ip, nid in check_reachable(
                self.state.topology,
                self.node_id,
                self.state.node_network,
-            )
-            for nid in conns:
-                for ip in conns[nid]:
-                    edge = SocketConnection(
-                        # nonsense multiaddr
-                        sink_multiaddr=Multiaddr(address=f"/ip4/{ip}/tcp/52415")
-                        if "." in ip
-                        # nonsense multiaddr
-                        else Multiaddr(address=f"/ip6/{ip}/tcp/52415"),
-                    )
-                    if edge not in edges:
-                        logger.debug(f"ping discovered {edge=}")
-                        await self.event_sender.send(
-                            TopologyEdgeCreated(
-                                conn=Connection(
-                                    source=self.node_id, sink=nid, edge=edge
-                                )
-                            )
+            ):
+                if ip in conns[nid]:
+                    continue
+                conns[nid].add(ip)
+                edge = SocketConnection(
+                    # nonsense multiaddr
+                    sink_multiaddr=Multiaddr(address=f"/ip4/{ip}/tcp/52415")
+                    if "." in ip
+                    # nonsense multiaddr
+                    else Multiaddr(address=f"/ip6/{ip}/tcp/52415"),
+                )
+                if edge not in edges:
+                    logger.debug(f"ping discovered {edge=}")
+                    await self.event_sender.send(
+                        TopologyEdgeCreated(
+                            conn=Connection(source=self.node_id, sink=nid, edge=edge)
                        )
+                    )

            for conn in self.state.topology.out_edges(self.node_id):
                if not isinstance(conn.edge, SocketConnection):
@@ -377,8 +378,7 @@ class Worker:
                    continue
                if (
                    conn.sink not in conns
-                    or conn.edge.sink_multiaddr.ip_address
-                    not in conns.get(conn.sink, set())
+                    or conn.edge.sink_multiaddr.ip_address not in conns[conn.sink]
                ):
                    logger.debug(f"ping failed to discover {conn=}")
                    await self.event_sender.send(TopologyEdgeDeleted(conn=conn))
Author	SHA1	Message	Date
rltakashige	ed4ee8010b	Merge branch 'main' into jaccl-build-fix	2026-02-10 12:29:04 +00:00
Alex Cheema	163cf18384	Add error handling to info gatherer monitor loops (#1422 ) ## Motivation If any of the `InfoGatherer` monitor loops throw an unexpected exception, the entire monitoring task crashes and never recovers. This can silently stop memory, network, or Thunderbolt data collection for the lifetime of the process. ## Changes Wrap the body of each `while True` monitor loop in a try/except that logs the exception as a warning and continues to the next iteration. The sleep at the end of each loop runs regardless, providing natural backoff before retry. Affected methods: `_monitor_misc`, `_monitor_system_profiler_thunderbolt_data`, `_monitor_memory_usage`, `_watch_system_info`, `_monitor_thunderbolt_bridge_status`. `_monitor_macmon` already had its own error handling so was left as-is. ## Why It Works A transient error (e.g., a subprocess failing, a permission issue) in one iteration no longer kills the loop. The warning log provides visibility while the monitor continues collecting data on subsequent iterations. ## Test Plan ### Automated Testing - `uv run basedpyright` — 0 errors - `uv run ruff check` — passes Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: rltakashige <rl.takashige@gmail.com>	2026-02-10 12:24:43 +00:00
rltakashige	2204f651c8	Yield from reachability checks (#1427 ) ## Motivation check_reachable waits for all connection profile checks to be completed. Since there are retries on failures, this can take around 20s to resolve, preventing any instances from showing up. This feels very slow for UX, and it slows down distributed testing. ## Changes Made check_reachable an async generator. ## Test Plan ### Manual Testing Works for me at least.	2026-02-10 12:18:45 +00:00
rltakashige	4abdaaf74b	Address GPU timeouts (#1429 ) ## Motivation For large prompts and/or slow machines, users are running into GPU timeout errors very often. ## Changes Only during prefill, we eval distributed operations. We don't do this during decode to maintain decode performance. Raise the prefill step size to 8192 because now we can (we see a speedup here). We also now see a 2x speedup in pipeline parallel prefill by disabling an unnecessary all_gather during prefill. ## Why It Works GPU timeout errors happen in the Metal backend when GPU operations take too long without making progress. By isolating distributed operations, we can allow them to run without any timeouts. ## Test Plan ### Manual Testing Doesn't GPU timeout on 100k tokens on Minimax anymore. Also tested on Kimi. ### Automated Testing Needs more exo bench, but I think this is a good step in the right direction.	2026-02-10 11:53:23 +00:00
Evan	103cbdee58	shfmt ignore	2026-02-06 17:08:26 +00:00
Evan	dbcc829625	sdk version?	2026-02-06 16:58:18 +00:00
Evan	30b384e2e6	vendor the apple sdk nix package	2026-02-06 16:40:10 +00:00
Evan	6675feed71	enable MLX_BUILD_CPU in nix built mlx	2026-02-06 16:14:04 +00:00