vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(#1304) scope state/harness chowns to own agent dir in hive-agent-user-migrate

Browse source
This commit is contained in:
damocles 2026-06-04 20:47:40 +02:00 • committed by mara
commit 6c16d25039
1 changed files with 13 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

21
nix/templates/harness-base.nix
View file

@ -705,14 +705,19 @@ in
fi
mkdir -p "$(dirname "$marker")"
: > "$marker"
for stateDir in /agents/*/state; do
[ -d "$stateDir" ] || continue
chown -hR "$userName:$userName" "$stateDir" 2>/dev/null || true
done
for harnessDir in /agents/*/harness; do
[ -d "$harnessDir" ] || continue
chown -hR "$userName:$userName" "$harnessDir" 2>/dev/null || true
done
# Scope state + harness chowns to THIS container's own dirs only.
# The glob `/agents/*/state` also matches child-agent state dirs that
# are bind-mounted into parent containers, which would clobber the
# ownership those dirs' own activation scripts set — producing
# intermittent EACCES for the child agent's harness between a parent
# rebuild and the child's next activation. Config dirs are kept broad
# because the parent legitimately owns child proposed-config repos.
if [ -d "/agents/$userName/state" ]; then
chown -hR "$userName:$userName" "/agents/$userName/state" 2>/dev/null || true
fi
if [ -d "/agents/$userName/harness" ]; then
chown -hR "$userName:$userName" "/agents/$userName/harness" 2>/dev/null || true
fi
# The proposed-config repo is RW-mounted into the editing (parent/
# manager) agent and owned by it; hive-c0re only pulls from it. Heal
# it to this user too — same as state/harness. In an agent's own