From 4f684dc7c3b4fb65ee7fe6040726429f7fede7b5 Mon Sep 17 00:00:00 2001
From: atlas <atlas@pr1ma.darkest.space>
Date: Mon, 1 Jun 2026 23:20:37 +0200
Subject: [PATCH] fix(#1012): add path trigger for forge-avatar-sync so it
 fires on token arrival
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

On first agent deployment, the container boots before hive-c0re has
provisioned the forge-token. forge-avatar-sync was exiting early with
"no forge-token found", and RemainAfterExit=true prevented systemd
from ever re-running it — avatar never got uploaded until the next
container reboot.

Add a systemd.paths.forge-avatar-sync unit (PathExistsGlob on the
forge-token file) to re-fire the service once the token arrives, and
set RemainAfterExit=false to allow the re-fire. Mirrors the existing
matrix-avatar-sync pattern exactly.
---
 nix/templates/harness-base.nix | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/nix/templates/harness-base.nix b/nix/templates/harness-base.nix
index 6175d22f..627e66a9 100644
--- a/nix/templates/harness-base.nix
+++ b/nix/templates/harness-base.nix
@@ -1018,15 +1018,30 @@ in
       '';
     };
 
+    # Path-trigger sibling: re-fires forge-avatar-sync the moment
+    # `<state>/forge-token` appears. Mirrors the matrix-avatar-sync
+    # pattern — on first agent deployment the container boots before
+    # hive-c0re has provisioned the forge-token, so the service fires
+    # too early and exits with "no forge-token found". Without this path
+    # unit, RemainAfterExit=true would prevent systemd from ever
+    # re-running the service. See docs/persistence.md::forge-avatar-sync.
+    systemd.paths.forge-avatar-sync = {
+      description = "trigger forge-avatar-sync when forge-token appears";
+      wantedBy = [ "multi-user.target" ];
+      pathConfig.PathExistsGlob = "/agents/*/state/forge-token";
+    };
+
     # One-shot: hyperhive.icon → Forgejo profile avatar. Shape contract:
     # docs/conventions.md::Best-effort oneshot services.
+    # RemainAfterExit = false (unlike the old true) so the .path trigger
+    # above can re-fire this unit when the forge-token arrives after boot.
     systemd.services.forge-avatar-sync = {
       description = "sync agent icon to Forgejo user avatar (best-effort)";
       wantedBy = [ "multi-user.target" ];
       after = [ "tea-login.service" ];
       serviceConfig = {
         Type = "oneshot";
-        RemainAfterExit = true;
+        RemainAfterExit = false;
       };
       path = [
         pkgs.curl
@@ -1320,4 +1335,3 @@ in
     system.stateVersion = "25.11";
   };
 }
-