modules/{direnv,starship}: Enable direnv landrun sandbox

3 files changed, 27 insertions, 14 deletions

diff --git a/modules/by-name/di/direnv/landrun-fish.sh b/modules/by-name/di/direnv/landrun-fish.sh
index 09687afb..66add23a 100755
--- a/modules/by-name/di/direnv/landrun-fish.sh
+++ b/modules/by-name/di/direnv/landrun-fish.sh
@@ -1,19 +1,22 @@
 #! /usr/bin/env sh
 
-export NO_DIRENV_LOAD=true
+_new_tmp="$(mktemp --directory -t landrun_fish_XXXXX)"
+trap 'rm --recursive "$_new_tmp"' EXIT
+
+# NOTE: We need to keep the XDG_RUNTIME_DIR, as pam_systemd sets it only once upon login. <2026-08-25>
 landrun \
-    --env PATH \
-    --env USER \
-    --env IN_NIX_SHELL \
+    --env XDG_RUNTIME_DIR \
     --env NIX_SHELL_LEVEL \
-    --env NO_DIRENV_LOAD \
+    --env TERM \
     --env SHLVL \
+    --env IN_DIRENV_SANDBOX=true \
+    --env TMPDIR="$_new_tmp" \
     --rox /nix/store \
+    --rw "$_new_tmp" \
     --ro /etc/ \
     --ro /proc/ \
     --rw /dev/ \
-    --rw "/run/user/$(id --user)" \
-    --ro "$HOME/.config" \
+    --rw "$XDG_RUNTIME_DIR" \
     --rw "$HOME/.cache" \
     --ro "$HOME/.local/share/nix/trusted-settings.json" \
     --rw "$HOME/.local/share/nix/repl-history" \
@@ -21,10 +24,15 @@ landrun \
     --rw "$HOME/.local/share/nvim/" \
     --rw "$HOME/.local/share/cargo/" \
     --rw "$HOME/.local/share/ctpv/" \
-    --rw "$HOME/.local/share/direnv" \
+    --rw "$HOME/.local/share/direnv/" \
+    --rw "$HOME/.local/share/lf/" \
     --ro "$HOME/.config/fish/" \
+    --ro "$HOME/.config/task/" \
+    --ro "$HOME/.config/nvim/" \
+    --ro "$HOME/.config/turtle/" \
+    --rwx "$PWD" \
     --connect-tcp 80 \
     --connect-tcp 443 \
-    -- fish "$@"
+    -- fish --login "$@"
 
 # vim: ft=sh
diff --git a/modules/by-name/di/direnv/module.nix b/modules/by-name/di/direnv/module.nix
index 4a1a4768..9c2975c3 100644
--- a/modules/by-name/di/direnv/module.nix
+++ b/modules/by-name/di/direnv/module.nix
@@ -53,7 +53,12 @@ in {
         end
 
         function _direnv_hook --on-event fish_preexec --on-variable PWD
+          if not set --query IN_DIRENV_SANDBOX; and set --query SHOULD_SANDBOX_DIRENV; and ${direnvPkg} status | grep 'Found RC path' --invert-match | grep 'No .envrc or .env loaded' --quiet
+            # We found a rc path, but none are loaded. So we can start our shell.
+            ${lib.getExe landrun-fish} --interactive --command='_direnv_export_eval'
+          else
             _direnv_export_eval
+          end
         end
       '';
 
diff --git a/modules/by-name/st/starship/module.nix b/modules/by-name/st/starship/module.nix
index 9c0ef7ba..a271d645 100644
--- a/modules/by-name/st/starship/module.nix
+++ b/modules/by-name/st/starship/module.nix
@@ -37,7 +37,7 @@ in {
         format = lib.concatStrings [
           "$directory"
           "$username"
-          "\${custom.in_nixos_shell}"
+          "\${custom.in_direnv_sandbox}"
           "$cmd_duration"
           "$status"
           "$character"
@@ -121,12 +121,12 @@ in {
         };
 
         custom = {
-          in_nixos_shell = {
-            symbol = "VM ";
+          in_direnv_sandbox = {
+            symbol = " ";
             style = "bold white";
-            when = ''test "$IN_NIXOS_SHELL" = true'';
+            when = ''test "$IN_DIRENV_SANDBOX" = true'';
             shell = ["${lib.getExe pkgs.dash}"];
-            description = "Show if a shell is run in a vm";
+            description = "Show if a shell is run in a direnv landrun sandbox";
           };
         };