From ed046787e0082187893f8317eb2e3be935e24ac1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?m=C3=BCde?= <git@darkest.space>
Date: Sat, 30 May 2026 22:07:41 +0200
Subject: [PATCH] nix/harness: chown /run/hive to agent user (#658 fixup)

---
 nix/templates/harness-base.nix | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/nix/templates/harness-base.nix b/nix/templates/harness-base.nix
index 6b9331f1..5d8c2825 100644
--- a/nix/templates/harness-base.nix
+++ b/nix/templates/harness-base.nix
@@ -687,6 +687,18 @@ in
         [ -d "$stateDir" ] || continue
         chown -hR "$userName:$userName" "$stateDir" 2>/dev/null || true
       done
+      # Same treatment for the per-agent runtime dir bind
+      # (`/run/hive` ← host `/run/hyperhive/{manager,agents/<n>}`,
+      # set by hive-c0re's `set_nspawn_flags`). Host creates it
+      # root:root 0755; post-#658 the harness service runs as the
+      # agent user and needs RW to drop `mcp.sock` and the
+      # claude-{mcp-config,settings,system-prompt} files there.
+      # Not recursive (-h still, no -R) — the dir itself is what
+      # the harness writes into; contents are owned by whoever
+      # created them at runtime.
+      if [ -d /run/hive ]; then
+        chown -h "$userName:$userName" /run/hive 2>/dev/null || true
+      fi
     '';
 
     # Auto-inject the matrix MCP entry when matrix is enabled (#548