From 2e9c50ecc7faf9eaf7a0f293a359fcfff42bc8fa Mon Sep 17 00:00:00 2001
From: atlas <atlas@hyperhive>
Date: Sat, 30 May 2026 23:35:54 +0200
Subject: [PATCH] nix/harness-base: prepend /run/wrappers/bin to PATH (argus
 #676 / #672 fixup)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

argus on #676 🔴: this PR deletes agent-base.nix + manager.nix and
moves the harness service to harness-base.nix without carrying
forward damocles's #672 fix (which adds `/run/wrappers/bin` to the
service PATH so the setuid sudo wrapper resolves before the bare
nix-store binary).

Pull the #672 fix forward: prepend `/run/wrappers/bin` to the unified
harness service's path list. Same shape as damocles's diff on
agent-base + manager, but applied once in harness-base.nix.

Without this, post-#658 `sudo` inside the container resolves to the
un-setuid nix-store binary and refuses with "must be owned by uid 0
and have the setuid bit set" even when
`hyperhive.user.passwordlessSudo = true` is configured.

Verified via `nix eval`:
- agent-base.systemd.services.hive-ag3nt.path[0] = "/run/wrappers/bin" ✓
- manager.systemd.services.hive-m1nd.path[0]    = "/run/wrappers/bin" ✓

#672 (damocles) supersedes when this lands — the two changes are
equivalent and the consolidated harness-base.nix is now the canonical
home for the fix.
---
 nix/templates/harness-base.nix | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/nix/templates/harness-base.nix b/nix/templates/harness-base.nix
index 39416ca5..fbc5c9d7 100644
--- a/nix/templates/harness-base.nix
+++ b/nix/templates/harness-base.nix
@@ -1252,7 +1252,21 @@ in
         # access to everything declared in `systemPackages` — including
         # anything an agent adds to its own `agent.nix` — without having
         # to touch the service definition.
-        path = [ "/run/current-system/sw" ];
+        #
+        # `/run/wrappers/bin` prepended so the `security.wrappers`
+        # setuid shims (notably `sudo`) resolve before the bare
+        # nix-store binaries in `/run/current-system/sw/bin`.
+        # Post-#658 the harness runs as the per-agent user — without
+        # the wrapper dir on PATH, `sudo` resolves to the un-setuid
+        # nix-store binary and refuses with "must be owned by uid 0
+        # and have the setuid bit set" even when
+        # `hyperhive.user.passwordlessSudo = true` is configured
+        # (#672 fixup pulled forward into this PR to avoid the
+        # regression argus flagged on #676).
+        path = [
+          "/run/wrappers/bin"
+          "/run/current-system/sw"
+        ];
         environment = {
           SHELL = "${pkgs.bashInteractive}/bin/bash";
           # `HOME` defaults to `/` for systemd services without a User=