From c3cc35317e643329fbe23d1eee21ffc47f2da48e Mon Sep 17 00:00:00 2001
From: furedea <132188853+furedea@users.noreply.github.com>
Date: Sun, 18 Oct 2026 00:08:42 +0900
Subject: [PATCH] build(nix): take lefthook from nixpkgs-unstable

lefthook before 2.1.6 runs hook commands under a pty, which agent sandboxes
deny, so commits made inside the devShell failed in their hooks. Take only
lefthook from a new nixpkgs-unstable input; every other package stays on
nixpkgs 25.11.

Refs furedea/dotfiles#207

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 flake.lock | 19 ++++++++++++++++++-
 flake.nix  |  6 ++++--
 2 files changed, 22 insertions(+), 3 deletions(-)

diff --git a/flake.lock b/flake.lock
index 8c08a8c..ff7cc2c 100644
--- a/flake.lock
+++ b/flake.lock
@@ -16,9 +16,26 @@
         "type": "github"
       }
     },
+    "nixpkgs-unstable": {
+      "locked": {
+        "lastModified": 1792116957,
+        "narHash": "sha256-EjZqHKObBfIOeHZnMRVV87HB3pPq/WBkmRJWyFxmZu8=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "f20cd90e28fe0403873f473b29e42662cd86e8c4",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
     "root": {
       "inputs": {
-        "nixpkgs": "nixpkgs"
+        "nixpkgs": "nixpkgs",
+        "nixpkgs-unstable": "nixpkgs-unstable"
       }
     }
   },
diff --git a/flake.nix b/flake.nix
index 40722a8..bebb869 100644
--- a/flake.nix
+++ b/flake.nix
@@ -3,10 +3,11 @@
 
   inputs = {
     nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-25.11-darwin";
+    nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
   };
 
   outputs =
-    { nixpkgs, ... }:
+    { nixpkgs, nixpkgs-unstable, ... }:
     let
       system = "aarch64-darwin";
       pkgs = import nixpkgs { inherit system; };
@@ -20,7 +21,8 @@
           clippy
           commitlint
           deadnix
-          lefthook
+          # lefthook before 2.1.6 runs hooks under a pty, which agent sandboxes deny.
+          nixpkgs-unstable.legacyPackages.${system}.lefthook
           ls-lint
           nixfmt-rfc-style
           rustc