modules/direnv: Implement a landrun based sandbox for dev-shells

2 files changed, 87 insertions, 16 deletions

diff --git a/modules/by-name/di/direnv/landrun-fish.sh b/modules/by-name/di/direnv/landrun-fish.sh
new file mode 100755
index 00000000..09687afb
--- /dev/null
+++ b/modules/by-name/di/direnv/landrun-fish.sh
@@ -0,0 +1,30 @@
+#! /usr/bin/env sh
+
+export NO_DIRENV_LOAD=true
+landrun \
+    --env PATH \
+    --env USER \
+    --env IN_NIX_SHELL \
+    --env NIX_SHELL_LEVEL \
+    --env NO_DIRENV_LOAD \
+    --env SHLVL \
+    --rox /nix/store \
+    --ro /etc/ \
+    --ro /proc/ \
+    --rw /dev/ \
+    --rw "/run/user/$(id --user)" \
+    --ro "$HOME/.config" \
+    --rw "$HOME/.cache" \
+    --ro "$HOME/.local/share/nix/trusted-settings.json" \
+    --rw "$HOME/.local/share/nix/repl-history" \
+    --rw "$HOME/.local/share/task/" \
+    --rw "$HOME/.local/share/nvim/" \
+    --rw "$HOME/.local/share/cargo/" \
+    --rw "$HOME/.local/share/ctpv/" \
+    --rw "$HOME/.local/share/direnv" \
+    --ro "$HOME/.config/fish/" \
+    --connect-tcp 80 \
+    --connect-tcp 443 \
+    -- fish "$@"
+
+# vim: ft=sh
diff --git a/modules/by-name/di/direnv/module.nix b/modules/by-name/di/direnv/module.nix
index baa0d954..242fa1c2 100644
--- a/modules/by-name/di/direnv/module.nix
+++ b/modules/by-name/di/direnv/module.nix
@@ -15,6 +15,7 @@
   ...
 }: let
   cfg = config.soispha.programs.direnv;
+  direnvCfg = config.home-manager.users.soispha.programs.direnv;
 
   inherit (sources) devshells nixpkgs;
 
@@ -25,34 +26,74 @@
       --replace-fail "%DEVSHELLS_REPO%" "${devshells}" \
       --replace-fail "%DEVSHELLS_REPO_REF%" "${devshells.sourceInfo.rev}.${builtins.readFile "${nixpkgs}/.git-revision"}"
   '';
+
+  landrun-fish = pkgs.writeShellApplication {
+    name = "landrun-fish";
+    text = builtins.readFile ./landrun-fish.sh;
+    inheritPath = true;
+    runtimeInputs = [
+      pkgs.landrun
+    ];
+  };
 in {
   options.soispha.programs.direnv = {
     enable = lib.mkEnableOption "direnv";
   };
 
-  config.home-manager.users.soispha = lib.mkIf cfg.enable {
-    programs.direnv = {
-      enable = true;
+  config = lib.mkIf cfg.enable {
+    soispha.programs.fish.integrations.direnv =
+      # fish
+      ''
+        function __direnv_export_eval
+          ${lib.getExec direnvCfg.package} export fish | source;
+        end
+
+        if test -z "$NO_DIRENV_LOAD"
+          function _direnv_hook()
+            if test -f ".env" or test -f ".envrc" or test -f ".nenvrc"
+              ${landrun-fish} --interactive --command='__direnv_export_eval'
+            end
+          end
 
-      package = pkgs.direnv-patched;
+          function __direnv_on_prompt --on-event fish_prompt;
+            _direnv_hook
+          end
 
-      nix-direnv = {
+          function _direnv_on_preexec --on-event fish_preexec;
+            _direnv_hook
+          end
+        end
+      '';
+
+    home-manager.users.soispha = {
+      programs.direnv = {
         enable = true;
-        package = pkgs.nix-direnv.override {nix = config.nix.package;};
-      };
 
-      config = {
-        warn_timeout = 0;
+        package = pkgs.direnv-patched;
 
-        # NOTE: Something variable is undeclared in the my default loaded stuff :/. <2026-08-18>
-        # strict_env = true;
+        nix-direnv = {
+          enable = true;
+          package = pkgs.nix-direnv.override {nix = config.nix.package;};
+        };
 
-        # disable_stdin = true;
+        # Handled by myself (and the script is overridden)
+        enableBashIntegration = true;
+        enableZshIntegration = true;
+        enableFishIntegration = false;
+
+        config = {
+          warn_timeout = 0;
+
+          # NOTE: Something variable is undeclared in the my default loaded stuff :/. <2026-08-18>
+          # strict_env = true;
+
+          # disable_stdin = true;
+        };
       };
-    };
-    xdg.configFile = {
-      "direnv/lib/hm-pre-cache.sh" = {
-        source = pre-cache;
+      xdg.configFile = {
+        "direnv/lib/hm-pre-cache.sh" = {
+          source = pre-cache;
+        };
       };
     };
   };