feat(nix): self-sufficient unit-PATH baseline — bash + shell-work basics #215

Merged

dominik.polakovics merged 2 commits from feat/unit-path-agent-baseline into main

2026-07-23 12:04:28 +02:00

dominik.polakovics commented

2026-07-23 11:51:24 +02:00

Owner

Problem

Since per-run instance HOMEs (#202/#209), the unit PATH is a session's only tool source: the agent's HOME is a fresh private dir, so user dotfiles, home-manager session vars, and ~/.claude/settings.json env.PATH no longer smuggle tools into sessions. On the deployed module this surfaced immediately: agents report no bash access / missing commands — the curated unit PATH carries no bash (NixOS has no /bin/bash), so Claude Code's Bash tool has no shell to execute through, and every user-profile tool vanished with the HOME rescue.

Change

bashInteractive joins the load-bearing head of the unit PATH (documented alongside openssh/util-linux in the module header).
The fixed baseline pins the shell-work basics explicitly: coreutils, findutils, gnugrep, gnused, diffutils, which — self-documenting rather than leaning on the implicit NixOS unit-path suffix.
Still deliberately no language toolchains (project flakes via nix, ADR-0033). extraPackages' description now states that host-specific agent tools (ddev, docker) must go there — environment.systemPackages does not reach sessions anymore.
The flake nixos-module check pins the extended baseline by package name (verified: eval asserts + built check pass).

Note for deployment

Pairs with #213 (per-run config-dir pin) and PR #212 (deterministic pane env): together they make a session's environment exactly unit PATH + explicit spawn env, independent of whoever's dotfiles are on the host. Before bumping the prod pin past #209, hosts relying on systemPackages leakage (e.g. dev-new's ddev comment) should move those tools to services.lab.extraPackages.

🤖 Generated with Claude Code

## Problem Since per-run instance HOMEs (#202/#209), the unit PATH is a session's **only** tool source: the agent's HOME is a fresh private dir, so user dotfiles, home-manager session vars, and `~/.claude/settings.json` `env.PATH` no longer smuggle tools into sessions. On the deployed module this surfaced immediately: agents report **no bash access / missing commands** — the curated unit PATH carries no bash (NixOS has no `/bin/bash`), so Claude Code's Bash tool has no shell to execute through, and every user-profile tool vanished with the HOME rescue. ## Change - `bashInteractive` joins the load-bearing head of the unit PATH (documented alongside openssh/util-linux in the module header). - The fixed baseline pins the shell-work basics explicitly: `coreutils`, `findutils`, `gnugrep`, `gnused`, `diffutils`, `which` — self-documenting rather than leaning on the implicit NixOS unit-path suffix. - Still deliberately no language toolchains (project flakes via `nix`, ADR-0033). `extraPackages`' description now states that host-specific agent tools (ddev, docker) must go there — `environment.systemPackages` does not reach sessions anymore. - The flake `nixos-module` check pins the extended baseline by package name (verified: eval asserts + built check pass). ## Note for deployment Pairs with #213 (per-run config-dir pin) and PR #212 (deterministic pane env): together they make a session's environment exactly *unit PATH + explicit spawn env*, independent of whoever's dotfiles are on the host. Before bumping the prod pin past #209, hosts relying on systemPackages leakage (e.g. dev-new's ddev comment) should move those tools to `services.lab.extraPackages`. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

dominik.polakovics added 1 commit

2026-07-23 11:51:24 +02:00

feat(nix): self-sufficient unit-PATH baseline — bash + shell-work basics

ci / native (pull_request) Has been cancelled

Details

ci-nix / flake-check (pull_request) Has been cancelled

Details

79770495a8

Since per-run instance HOMEs (#202) the unit PATH is a session's ONLY
tool source: the agent's HOME is a fresh private dir, so user dotfiles,
home-manager session vars, and ~/.claude/settings.json env.PATH no
longer smuggle tools into sessions. On the deployed module that surfaced
immediately as "no bash access" — the curated unit PATH carried no bash
at all (NixOS has no /bin/bash), so Claude Code's Bash tool had no shell
to execute through, and every user-profile tool was gone with it.

Add bashInteractive to the load-bearing head of the unit PATH and pin
the shell-work basics (coreutils, findutils, gnugrep, gnused, diffutils,
which) into the fixed baseline — explicit rather than leaning on the
NixOS default unit-path suffix, so the module documents the full session
contract in one place. Still deliberately no language toolchains (those
come from each project's flake via nix, ADR-0033); host-specific tools
(ddev, docker) belong in extraPackages, whose description now says so.

The flake's nixos-module check pins the extended baseline by name.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

dominik.polakovics added 1 commit

2026-07-23 11:54:06 +02:00

fix(claudecode): mirrorOAuthAccount creates its parent dir itself

ci / native (pull_request) Successful in 9m11s

Details

ci-nix / flake-check (pull_request) Successful in 21m22s

Details

fa30d4de18

Post-merge review follow-up on #213: the oauthAccount mirror wrote
<home>/.claude/.claude.json relying on the launch order to have created
<home>/.claude (SeedWorkspace's seedGlobalConfig, or the sibling
copyMasterCredentials). With master credentials absent but a master
oauthAccount present, a standalone InjectCredentials would be the first
write under the dir and CreateTemp ENOENTs. Unreachable at the sole
production call site today — defensive symmetry with
copyMasterCredentials, not a live bug.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

dominik.polakovics scheduled this pull request to auto merge when all checks succeed

2026-07-23 11:59:23 +02:00

dominik.polakovics merged commit f7e0af4d43 into main

2026-07-23 12:04:28 +02:00

dominik.polakovics deleted branch feat/unit-path-agent-baseline

2026-07-23 12:04:28 +02:00

dominik.polakovics referenced this pull request from a commit

2026-07-23 12:04:29 +02:00

Merge pull request 'feat(nix): self-sufficient unit-PATH baseline — bash + shell-work basics' (#215) from feat/unit-path-agent-baseline into main