From 40be58b0b90d36cbdd8caa319c5de194b7b6b340 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?m=C3=BCde?= <git@darkest.space>
Date: Wed, 3 Jun 2026 00:37:55 +0200
Subject: [PATCH] fix(#702): heal proposed-config ownership in
 agent-user-migrate

The migration chown stomped agents/<name>/config (the proposed-config repo)
to hive-core like everything else, but hive-agent-user-migrate only re-chowned
state/harness/.claude on boot, leaving config core-owned. config is owned by
the editing parent/manager agent (core only pulls from it), so chown it to
this user too. RO self-mount in an agent's own container fails harmlessly.
---
 nix/templates/harness-base.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/nix/templates/harness-base.nix b/nix/templates/harness-base.nix
index b7fafaa5..491fb360 100644
--- a/nix/templates/harness-base.nix
+++ b/nix/templates/harness-base.nix
@@ -738,6 +738,15 @@ in
         [ -d "$harnessDir" ] || continue
         chown -hR "$userName:$userName" "$harnessDir" 2>/dev/null || true
       done
+      # The proposed-config repo is RW-mounted into the editing (parent/
+      # manager) agent and owned by it; hive-c0re only pulls from it. Heal
+      # it to this user too — same as state/harness. In an agent's own
+      # container its config is RO-mounted, so the chown there just fails
+      # harmlessly (|| true).
+      for configDir in /agents/*/config; do
+        [ -d "$configDir" ] || continue
+        chown -hR "$userName:$userName" "$configDir" 2>/dev/null || true
+      done
       if [ -d "$homeDir/.claude" ]; then
         chown -hR "$userName:$userName" "$homeDir/.claude" 2>/dev/null || true
       fi