mirror of
https://github.com/nix-community/home-manager.git
synced 2026-11-02 02:38:53 +00:00
0e11b7bcba
Keep native settings and MCP configuration writable while applying declared values. Treat unspecified permission lists as absent in mutable native mode so activation does not reset undeclared application choices. Explicit lists, including empty lists, replace saved lists. Keep immutable and legacy defaults unchanged.
46 lines
1.4 KiB
Nix
46 lines
1.4 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
...
|
|
}:
|
|
let
|
|
cleanup = config.home.activation.antigravityImmutableSettings or null;
|
|
activation = config.home.activation.antigravitySettings or null;
|
|
in
|
|
{
|
|
programs.antigravity-cli = {
|
|
enable = true;
|
|
package = null;
|
|
permissions = {
|
|
allow = null;
|
|
deny = [ "command(curl)" ];
|
|
};
|
|
};
|
|
assertions = [
|
|
{
|
|
assertion = !config.programs.antigravity-cli.mutableSettings;
|
|
message = "Antigravity permissions must default to immutable settings ownership.";
|
|
}
|
|
{
|
|
assertion = activation == null && cleanup != null;
|
|
message = "Immutable Antigravity permissions must schedule cleanup, not a merge.";
|
|
}
|
|
{
|
|
assertion = cleanup.after == [ "writeBoundary" ] && cleanup.before == [ "linkGeneration" ];
|
|
message = "Antigravity cleanup must run between writeBoundary and linkGeneration.";
|
|
}
|
|
{
|
|
assertion =
|
|
lib.hasInfix ''"$HOME"/.gemini/antigravity-cli/settings.json'' cleanup.data
|
|
&& lib.hasInfix (builtins.unsafeDiscardStringContext (
|
|
toString config.home.file.".gemini/antigravity-cli/settings.json".source
|
|
)) cleanup.data;
|
|
message = "Antigravity cleanup must use the configured settings target and source.";
|
|
}
|
|
];
|
|
|
|
nmt.script = ''
|
|
assertFileContent home-files/.gemini/antigravity-cli/settings.json ${./permissions-immutable-expected.json}
|
|
'';
|
|
}
|