From 699bcac2b436710b5c2250fec0a8c9a856c2a4fb Mon Sep 17 00:00:00 2001
From: furedea <132188853+furedea@users.noreply.github.com>
Date: Sun, 18 Oct 2026 00:08:40 +0900
Subject: [PATCH] build(nix): take lefthook from nixpkgs-unstable

lefthook before 2.1.6 runs hook commands under a pty, which agent sandboxes
deny. Take only lefthook from a new nixpkgs-unstable input and keep other
packages on nixpkgs 25.11.

Refs furedea/dotfiles#207

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 flake.lock | 19 ++++++++++++++++++-
 flake.nix  | 27 ++++++++++++++++-----------
 2 files changed, 34 insertions(+), 12 deletions(-)

diff --git a/flake.lock b/flake.lock
index 8c08a8c..ff7cc2c 100644
--- a/flake.lock
+++ b/flake.lock
@@ -16,9 +16,26 @@
         "type": "github"
       }
     },
+    "nixpkgs-unstable": {
+      "locked": {
+        "lastModified": 1792116957,
+        "narHash": "sha256-EjZqHKObBfIOeHZnMRVV87HB3pPq/WBkmRJWyFxmZu8=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "f20cd90e28fe0403873f473b29e42662cd86e8c4",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
     "root": {
       "inputs": {
-        "nixpkgs": "nixpkgs"
+        "nixpkgs": "nixpkgs",
+        "nixpkgs-unstable": "nixpkgs-unstable"
       }
     }
   },
diff --git a/flake.nix b/flake.nix
index 43a1c2b..c0a2e74 100644
--- a/flake.nix
+++ b/flake.nix
@@ -3,26 +3,31 @@
 
   inputs = {
     nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-25.11-darwin";
+    nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
   };
 
   outputs =
-    { nixpkgs, ... }:
+    { nixpkgs, nixpkgs-unstable, ... }:
     let
       system = "aarch64-darwin";
       pkgs = import nixpkgs { inherit system; };
     in
     {
       devShells.${system}.default = pkgs.mkShell {
-        packages = with pkgs; [
-          commitlint
-          deadnix
-          lefthook
-          ls-lint
-          nixfmt-rfc-style
-          python314
-          statix
-          uv
-        ];
+        packages =
+          (with pkgs; [
+            commitlint
+            deadnix
+            ls-lint
+            nixfmt-rfc-style
+            python314
+            statix
+            uv
+          ])
+          ++ [
+            # lefthook before 2.1.6 runs hooks under a pty, which agent sandboxes deny.
+            nixpkgs-unstable.legacyPackages.${system}.lefthook
+          ];
 
         env = {
           UV_PYTHON_DOWNLOADS = "never";