From 3cc4fdb54cad4bd3b1596a1bd78fe00a0269b0fb Mon Sep 17 00:00:00 2001 From: atlas Date: Wed, 4 Nov 2026 21:02:49 +0100 Subject: [PATCH] agent: say claude-code is only on PATH for the claude runtime in acp.command --- docs/process/gotchas.md | 5 ++++- nix/agent-modules/agent-service.nix | 9 ++++++++- 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/docs/process/gotchas.md b/docs/process/gotchas.md index 03812067..f4eba9c4 100644 --- a/docs/process/gotchas.md +++ b/docs/process/gotchas.md @@ -133,7 +133,10 @@ at the container level to allowlist `claude-code` specifically — scoped, only this one package, because each per-agent `nixosConfiguration` evaluates its own nixpkgs instance and the operator's host-level `allowUnfree` does **not** propagate in. -Operators don't need to set anything on their side. +Operators don't need to set anything on their side. Only `runtime = "claude"` +agents get `claude` and the allowance; an ACP agent whose `acp.command` +needs `claude` adds `pkgs.claude-code` and +`nixpkgs.config.allowUnfreePackages = [ "claude-code" ]` itself. That same isolation is why an agent can't pick a claude out of a _different_ nixpkgs by itself: a container only ever sees the one diff --git a/nix/agent-modules/agent-service.nix b/nix/agent-modules/agent-service.nix index 0061386b..8e8e2b5e 100644 --- a/nix/agent-modules/agent-service.nix +++ b/nix/agent-modules/agent-service.nix @@ -264,7 +264,14 @@ in type = lib.types.str; default = ""; example = lib.literalExpression ''"''${pkgs.opencode}/bin/opencode"''; - description = "Program the harness spawns as its ACP agent (`HIVE_ACP_COMMAND`)."; + description = '' + Program the harness spawns as its ACP agent (`HIVE_ACP_COMMAND`). + + `claude` is on PATH only when `services.hyperhive.agent.runtime` is + `"claude"`. A command that runs `claude` (a Claude ACP adapter, say) + needs `pkgs.claude-code` in `environment.systemPackages` and + `"claude-code"` in `nixpkgs.config.allowUnfreePackages`. + ''; }; args = lib.mkOption {