From 252b893bbb79f320109522e34407070e36c511bb Mon Sep 17 00:00:00 2001
From: atlas <atlas@hyperhive.local>
Date: Fri, 9 Oct 2026 10:39:43 +0200
Subject: [PATCH] module-eval: agent-user test asserts the heal_own_dir form

---
 nix/module-eval/agent-user.nix | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/nix/module-eval/agent-user.nix b/nix/module-eval/agent-user.nix
index 7a076a3d..6c5f5af3 100644
--- a/nix/module-eval/agent-user.nix
+++ b/nix/module-eval/agent-user.nix
@@ -32,7 +32,18 @@ let
       name = "the agent's activation hands its own work dir to the agent user";
       ok =
         lib.hasInfix ''if [ "$(stat -c %U "/agents/$userName/work")" != "$userName" ]; then'' migrate
-        && lib.hasInfix ''chown -hR "$userName:$userName" "/agents/$userName/work"'' migrate;
+        && lib.hasInfix ''heal_own_dir "/agents/$userName/work"'' migrate;
+    }
+    {
+      # The helper is the only recursive chown of these dirs; it must hand the
+      # tree to the agent user and log a failure rather than discard it.
+      name = "the agent's activation hands state, harness and .claude to the agent user, logging failures";
+      ok =
+        lib.hasInfix ''chown -hR "$userName:$userName" "$1" 2>&1'' migrate
+        && lib.hasInfix "could not chown $1 to $userName" migrate
+        && lib.hasInfix ''heal_own_dir "/agents/$userName/state"'' migrate
+        && lib.hasInfix ''heal_own_dir "/agents/$userName/harness"'' migrate
+        && lib.hasInfix ''heal_own_dir "$homeDir/.claude"'' migrate;
     }
     {
       # hive-priv creates the host socket dir `0751 root` and never chowns it,