From d29f63d4cfb38522ef268a431cf7a61f1b6194d8 Mon Sep 17 00:00:00 2001
From: atlas <atlas@hyperhive.local>
Date: Wed, 28 Oct 2026 16:36:16 +0100
Subject: [PATCH] keep the backend file order case independent of the proxy
 file

---
 nix/module-eval/agent-runtime.nix | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/nix/module-eval/agent-runtime.nix b/nix/module-eval/agent-runtime.nix
index 8f9c0093..308f4b4f 100644
--- a/nix/module-eval/agent-runtime.nix
+++ b/nix/module-eval/agent-runtime.nix
@@ -167,11 +167,15 @@ let
             "-${backendEnv}"
             "-/run/hive-agent-backend-env/env"
           ];
+          # The proxy file is loaded too (./egress-proxy.nix); its own cases
+          # cover it, and the order that matters here is the backend's.
+          backendFiles =
+            u: lib.remove "-/run/hive-agent-proxy-credential/proxy.env" u.serviceConfig.EnvironmentFile;
         in
-        (harness claudeApiKeyBao).serviceConfig.EnvironmentFile == want
-        && (subagent claudeApiKeyBao).serviceConfig.EnvironmentFile == want
-        && (harness acpBao).serviceConfig.EnvironmentFile == [ "-/run/hive-agent-backend-env/env" ]
-        && (subagent acpBao).serviceConfig.EnvironmentFile == [ "-/run/hive-agent-backend-env/env" ];
+        backendFiles (harness claudeApiKeyBao) == want
+        && backendFiles (subagent claudeApiKeyBao) == want
+        && backendFiles (harness acpBao) == [ "-/run/hive-agent-backend-env/env" ]
+        && backendFiles (subagent acpBao) == [ "-/run/hive-agent-backend-env/env" ];
     }
     {
       # The case above is the presence control: the same lookup finds the