---
phase: 01-minimal-viable-sandbox
plan: 02
subsystem: infra
tags: [nix, bubblewrap, bwrap, sandbox, verification, smoke-test]

requires:
  - phase: 01-01
    provides: "claudebox flake.nix and claudebox.sh"
provides:
  - "verified working claudebox command"
  - "sandbox path resolution fix for NixOS symlink chains"
affects: []

tech-stack:
  added: []
  patterns: [readlink-f-for-nix-store-resolution]

key-files:
  created: []
  modified: [claudebox.sh]

key-decisions:
  - "readlink -f required to resolve NixOS profile symlinks to real nix store paths for bwrap visibility"

patterns-established:
  - "readlink -f for all host-resolved binaries passed into bwrap: NixOS profile paths are symlink chains that don't exist inside the sandbox"

requirements-completed: [NIX-03, SAND-02, SAND-03, SAND-04, SAND-05, SAND-06, SAND-09, SAND-10, SAND-12, SAND-13, SAND-14, TOOL-01, TOOL-02]

duration: 1min
completed: 2026-04-09
---

# Phase 1 Plan 02: Build Verification and Smoke Tests Summary

**Fixed NixOS symlink resolution for bwrap, verified nix build succeeds and claudebox --version returns Claude Code 2.1.70 inside sandbox**

## Performance

- **Duration:** ~1 min
- **Started:** 2026-04-09T09:13:38Z
- **Completed:** 2026-04-09T09:15:01Z
- **Tasks:** 2
- **Files modified:** 1 (claudebox.sh)

## Accomplishments
- `nix build` succeeds with shellcheck passing
- `result/bin/claudebox` executable exists with full runtimeInputs PATH (bubblewrap, git, curl, jq, ripgrep, fd, nix, comma-with-db, nodejs)
- `claudebox --version` returns "2.1.70 (Claude Code)" confirming end-to-end sandbox launch
- Fixed path resolution bug where NixOS profile symlinks weren't accessible inside bwrap

## Task Commits

Each task was committed atomically:

1. **Task 1: Build flake and run automated smoke tests** - `9296453` (fix)

## Files Created/Modified
- `claudebox.sh` - Added readlink -f for claude binary and env resolution to handle NixOS symlink chains

## Decisions Made
- Used `readlink -f` to resolve both `claude` and `env` binaries to their real nix store paths, since NixOS profile paths (`/etc/profiles/per-user/...`) are symlink chains not visible inside the bwrap sandbox

## Deviations from Plan

### Auto-fixed Issues

**1. [Rule 1 - Bug] Fixed NixOS symlink resolution for bwrap**
- **Found during:** Task 1 (Build and smoke test)
- **Issue:** `command -v claude` returns `/etc/profiles/per-user/toph/bin/claude` which is a symlink chain. This path doesn't exist inside bwrap since only `/nix/store` is mounted. Same issue with `env`.
- **Fix:** Changed `command -v claude` to `readlink -f "$(command -v claude)"` and same for env, resolving to real `/nix/store/...` paths
- **Files modified:** claudebox.sh
- **Verification:** `claudebox --version` now returns "2.1.70 (Claude Code)" instead of "execvp: No such file or directory"
- **Committed in:** 9296453

---

**Total deviations:** 1 auto-fixed (1 bug)
**Impact on plan:** Essential fix -- sandbox was completely non-functional without it on NixOS.

## Issues Encountered
None beyond the auto-fixed symlink resolution.

## User Setup Required
None - no external service configuration required.

## Next Phase Readiness
- claudebox builds and launches successfully
- Manual verification of env isolation, filesystem isolation, and tool access is the next step (auto-approved in this run)
- Ready for phase 2 (hardening/refinement) if applicable

## Self-Check: PASSED