From c73c8389eccc136fa3c2d3e7a19f0568f105c772 Mon Sep 17 00:00:00 2001
From: damocles <damocles@hyperhive>
Date: Sat, 30 May 2026 23:27:11 +0200
Subject: [PATCH] harness: prepend /run/wrappers/bin to service path so sudo
 wrapper resolves (#658 fixup)

---
 nix/templates/agent-base.nix | 13 ++++++++++++-
 nix/templates/manager.nix    | 13 ++++++++-----
 2 files changed, 20 insertions(+), 6 deletions(-)

diff --git a/nix/templates/agent-base.nix b/nix/templates/agent-base.nix
index 01fceb1a..53aa0e60 100644
--- a/nix/templates/agent-base.nix
+++ b/nix/templates/agent-base.nix
@@ -15,7 +15,18 @@ in
     # access to everything declared in `systemPackages` — including
     # anything an agent adds to its own `agent.nix` — without having to
     # touch the service definition.
-    path = [ "/run/current-system/sw" ];
+    #
+    # `/run/wrappers/bin` is prepended so the `security.wrappers`
+    # setuid shims (notably `sudo`) resolve before the bare nix-store
+    # binaries in `/run/current-system/sw/bin`. Post-#658 the harness
+    # runs as the per-agent user — without the wrapper dir on PATH,
+    # `sudo` resolves to the un-setuid nix-store binary and refuses
+    # with "must be owned by uid 0 and have the setuid bit set" even
+    # when `hyperhive.user.passwordlessSudo = true` is configured.
+    path = [
+      "/run/wrappers/bin"
+      "/run/current-system/sw"
+    ];
     environment = {
       SHELL = "${pkgs.bashInteractive}/bin/bash";
       # `HOME` defaults to `/` for systemd services without a User=
diff --git a/nix/templates/manager.nix b/nix/templates/manager.nix
index 66e9035d..d5c79d7a 100644
--- a/nix/templates/manager.nix
+++ b/nix/templates/manager.nix
@@ -39,11 +39,14 @@ in
       # populates /etc/profile, which systemd services don't inherit.
       HIVE_ASSETS_DIR = "${pkgs.hyperhive-assets}/share/hyperhive";
     };
-    # See note in agent-base.nix — `/run/current-system/sw` makes the
-    # harness service PATH track `environment.systemPackages` so anything
-    # an agent adds to its own `agent.nix` is visible without editing the
-    # service definition.
-    path = [ "/run/current-system/sw" ];
+    # See note in agent-base.nix for the rationale on both entries —
+    # `/run/wrappers/bin` so the setuid sudo shim resolves before the
+    # bare nix-store binary (#658 fixup), `/run/current-system/sw`
+    # so the harness PATH tracks `environment.systemPackages`.
+    path = [
+      "/run/wrappers/bin"
+      "/run/current-system/sw"
+    ];
     serviceConfig = {
       ExecStart = "${pkgs.hyperhive}/bin/hive-m1nd serve";
       Restart = "on-failure";