From 45065980c27be3d15e52b42b4435f1db481756b7 Mon Sep 17 00:00:00 2001
From: "assistant-ngalaiko[bot]"
 <307087249+assistant-ngalaiko[bot]@users.noreply.github.com>
Date: Fri, 23 Oct 2026 16:58:08 +0000
Subject: [PATCH] Fix exedev runner tool discovery

Include system tools and privileged wrappers after the account profile so agent
subprocesses can find sh, Bash, Nix, SSH, and diagnostic tools. Keep each user
profile separate and supply qrencode for existing BankID login workflows.

Amp-Thread-ID: T-01a169a1-b58f-747d-8dfa-f3b5a4e3ed4b
---
 hosts/exedev/users/amp.nix   | 8 +++++++-
 hosts/exedev/users/dasha.nix | 6 +++++-
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/hosts/exedev/users/amp.nix b/hosts/exedev/users/amp.nix
index b774f1b..e362e3e 100644
--- a/hosts/exedev/users/amp.nix
+++ b/hosts/exedev/users/amp.nix
@@ -66,6 +66,7 @@ in
       tmux
       fd
       ledger
+      qrencode
     ];
   };
   users.groups.amp.gid = 2002;
@@ -82,7 +83,12 @@ in
     # Restore the user-owned configuration before starting the runner.
     wants = [ "backup-restore.service" ];
     after = [ "backup-restore.service" ];
-    path = [ "/etc/profiles/per-user/amp" ];
+    # Account tools plus the system shell, Nix, SSH, and privileged wrappers.
+    path = [
+      "/run/wrappers"
+      "/etc/profiles/per-user/amp"
+      "/run/current-system/sw"
+    ];
     environment = toolEnvironment // {
       HOME = home;
       SSL_CERT_FILE = "/etc/ssl/certs/ca-certificates.crt";
diff --git a/hosts/exedev/users/dasha.nix b/hosts/exedev/users/dasha.nix
index 8f5b83b..b88448d 100644
--- a/hosts/exedev/users/dasha.nix
+++ b/hosts/exedev/users/dasha.nix
@@ -58,7 +58,11 @@ in
       "backup-restore.service"
       "dasha-ledger.service"
     ];
-    path = [ "/etc/profiles/per-user/dasha" ];
+    path = [
+      "/run/wrappers"
+      "/etc/profiles/per-user/dasha"
+      "/run/current-system/sw"
+    ];
     environment = removeAttrs runner.environment [ "PATH" ] // {
       HOME = home;
       XDG_RUNTIME_DIR = "/run/user/${toString config.users.users.dasha.uid}";