From b587efef87d2655d5736228c6aff173e6c399fe3 Mon Sep 17 00:00:00 2001
From: dawn <dawn@tangled.org>
Date: Sun, 11 Oct 2026 23:38:39 +0300
Subject: [PATCH] spindle/microvm: add a shared profile hook for guest images

Signed-off-by: dawn <dawn@tangled.org>
---
 nix/microvm/base.nix               |  2 ++
 nix/microvm/spindle-profile.sh     | 20 ++++++++++++++++++++
 nix/pkgs/spindle-image-helpers.nix |  1 +
 3 files changed, 23 insertions(+)
 create mode 100644 nix/microvm/spindle-profile.sh

diff --git a/nix/microvm/base.nix b/nix/microvm/base.nix
index a5e03865..59e38ed3 100644
--- a/nix/microvm/base.nix
+++ b/nix/microvm/base.nix
@@ -190,6 +190,8 @@ in {
   xdg.icons.enable = false;
   xdg.sounds.enable = false;
 
+  environment.loginShellInit = builtins.readFile ./spindle-profile.sh;
+
   users.groups.spindle-workflow = {
     gid = 970;
   };
diff --git a/nix/microvm/spindle-profile.sh b/nix/microvm/spindle-profile.sh
new file mode 100644
index 00000000..748472ef
--- /dev/null
+++ b/nix/microvm/spindle-profile.sh
@@ -0,0 +1,20 @@
+# keep this plain sh, alpine's debug shell is busybox ash
+
+# the devshell can overwrite PATH, so the image's goes back on the end
+if [ -f /run/spindle/devshell-env.sh ]; then
+	spindle_image_path=$PATH
+	. /run/spindle/devshell-env.sh
+	PATH="$PATH:$spindle_image_path"
+	unset spindle_image_path
+fi
+
+# where installers put binaries when /usr/local isn't writable
+PATH="$HOME/.local/bin:$HOME/.cargo/bin:$HOME/go/bin:$HOME/.deno/bin:$HOME/.bun/bin:$HOME/.npm-global/bin:$HOME/.local/share/pnpm:$HOME/.local/share/pnpm/bin:$PATH"
+
+# PATH from the workflow can't come in as PATH, the profile above resets it
+if [ -n "${SPINDLE_PATH_PREPEND:-}" ]; then
+	PATH="$SPINDLE_PATH_PREPEND:$PATH"
+	printf 'PATH is %s (PATH from the environment is prepended)\n' "$PATH" >&2
+fi
+
+export PATH
diff --git a/nix/pkgs/spindle-image-helpers.nix b/nix/pkgs/spindle-image-helpers.nix
index dba184e1..bdbeb648 100644
--- a/nix/pkgs/spindle-image-helpers.nix
+++ b/nix/pkgs/spindle-image-helpers.nix
@@ -59,6 +59,7 @@ in {
     install -D -m 0644 ${nixConf} "$rootfs"/etc/nix/nix.conf
     install -D -m 0755 ${postBuildHook} "$rootfs"/usr/libexec/spindle-post-build-hook
     install -D -m 0755 ${systemInit} "$rootfs"/sbin/spindle-system-init
+    install -D -m 0644 ${../microvm/spindle-profile.sh} "$rootfs"/etc/profile.d/zz-spindle.sh
 
     # this is necessary for nix to work, it is not a library but nix hardcodes
     # it in it's binary
-- 
2.51.2