defangdevs · defangdevs · Aug 25, 2026 · Aug 19, 2026 · Aug 19, 2026 · Aug 19, 2026
diff --git a/bin/assemble-module.py b/bin/assemble-module.py
@@ -42,7 +42,7 @@
 from pathlib import Path
 
 MARKER = re.compile(
-    r"^(?P<indent>[ ]*)@@include(?P<verbatim>-verbatim)?:(?P<path>[^@]+)@@[ ]*$"
+    r"^(?P<indent>[ ]*)@@include(?P<verbatim>-verbatim)?:(?P<path>.+)@@[ ]*$"
 )
 
 BANNER = """\

diff --git a/flake.nix b/flake.nix
@@ -44,15 +44,30 @@
             # whole Caddy/ttyd/settings/webhook/self-update surface too.
             web = [ self.nixosModules.agent-box ./hosts/vm.nix ./tests/golden-web.nix ];
           };
+          # multi-user.target/sockets.target (issue #154 Phase 3): the module
+          # doesn't own these units, but it drops a `Wants=` override onto
+          # each one to enable a per-user %i template instance (see the
+          # agent-box@/agent-box-settings@/agent-box-webhook@/
+          # agent-web-terminal@ instances below) — a mechanism the earlier
+          # per-instance `wantedBy` attempt got wrong in a way no eval-level
+          # check caught (only a real VM boot did, unit stayed inactive).
+          # Capturing the override text here is what would have caught it.
           unitFilter = n:
-            builtins.match "(agent-box|agent-web|caddy|fail2ban|earlyoom).*" n != null;
+            builtins.match
+              "(agent-box|agent-web|caddy|fail2ban|earlyoom).*|multi-user\\.target|sockets\\.target"
+              n != null;
           # /etc content the module owns or materially shapes. The fail2ban
           # dir entries (filter.d/, action.d/) are upstream package trees and
           # deliberately excluded; the module's own filter and the jail
           # settings land in the files below.
           etcFilter = n:
             builtins.match
-              "agent-box-guides/.*|caddy/caddy_config|codex/config\\.toml|fail2ban/(fail2ban|jail)\\.local|fail2ban/filter\\.d/agent-web-auth\\.conf|sudoers"
+              # agent-box/units/*.env (issue #154 Phase 3): the per-user
+              # generated env files the "%i" template units' EnvironmentFile=
+              # reads — the payload capture below only scans Nix-visible
+              # `environment` attrs, so these plain-text files are the review
+              # surface for what moved out of that attrset.
+              "agent-box-guides/.*|agent-box/units/.*|caddy/caddy_config|codex/config\\.toml|fail2ban/(fail2ban|jail)\\.local|fail2ban/filter\\.d/agent-web-auth\\.conf|sudoers"
               n != null;
           manifestOf = modules:
             let sys = nixpkgs.lib.nixosSystem { inherit system modules; }; in
@@ -171,7 +186,14 @@
             ];
           };
           services = multiUser.config.systemd.services;
-          wanted = [ "agent-box-alice" "agent-box-bob" "agent-box-coder" "agent-box-ci" ];
+          # issue #154 Phase 3: "agent-box@" is the systemd %i template unit,
+          # shipped verbatim via systemd.packages (not a systemd.services
+          # Nix declaration — a template-level drop-in there was found to
+          # silently never merge into any real instance, so all host-level
+          # content moved onto the per-instance declaration below). Each
+          # configured user gets its own "agent-box@<user>" drop-in instead
+          # of a flat "agent-box-<user>" unit.
+          wanted = [ "agent-box@alice" "agent-box@bob" "agent-box@coder" "agent-box@ci" ];
           missing = builtins.filter (n: ! builtins.hasAttr n services) wanted;
         in
         {

diff --git a/modules/agent-box.nix b/modules/agent-box.nix
diff --git a/modules/agent-box.nix.in b/modules/agent-box.nix.in
diff --git a/modules/src/spot-monitor.sh b/modules/src/spot-monitor.sh
@@ -97,7 +97,7 @@ while true; do
     sleep "$GRACE"
     echo "spot-monitor: stopping agent units (no respawn)" >&2
     for u in $USERS; do
-      $SYSTEMCTL stop "agent-box-$u.service" || true
+      $SYSTEMCTL stop "agent-box@$u.service" || true
     done
     $SYNC
     echo "spot-monitor: prepared; leaving the stop to AWS (preserves persistent-Spot auto-restart)" >&2

diff --git a/modules/src/units/agent-box-settings@.service b/modules/src/units/agent-box-settings@.service
@@ -0,0 +1,31 @@
+[Unit]
+Description=Per-user secrets settings page for %i
+After=network-online.target agent-box-settings@%i.socket
+Requires=agent-box-settings@%i.socket
+Wants=network-online.target
+
+[Service]
+User=%i
+Restart=always
+RestartSec=5s
+Environment=TMUX_TMPDIR=/run/agent-box-%i
+Environment=AGENT_BOX_SETTINGS_USER=%i
+Environment=AGENT_BOX_SETTINGS_ENV_FILE=/home/%i/.config/agent-box/env
+Environment=AGENT_BOX_SETTINGS_BASE=/%i/settings
+Environment=AGENT_BOX_TMUX_SOCKET=agent-box
+Environment=AGENT_BOX_TMUX_TMPDIR=/run/agent-box-%i
+Environment=AGENT_BOX_SESSIONS_FILE=/home/%i/.config/agent-box/sessions.json
+EnvironmentFile=-/etc/agent-box/units/agent-box-settings-%i.env
+EnvironmentFile=-/etc/agent-box/units/agent-box-settings-%i.local.env
+ExecStart=agent-box-settings
+ProtectSystem=strict
+ReadWritePaths=/home/%i /run/agent-box-%i /var/lib/agent-box-web
+ProtectHome=false
+PrivateDevices=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+RestrictRealtime=true
+LockPersonality=true
+NoNewPrivileges=false
diff --git a/modules/src/units/agent-box-settings@.socket b/modules/src/units/agent-box-settings@.socket
@@ -0,0 +1,8 @@
+[Unit]
+Description=Settings page socket for %i
+
+[Socket]
+ListenStream=/run/agent-box-settings/%i.sock
+SocketUser=%i
+SocketGroup=caddy
+SocketMode=0660
diff --git a/modules/src/units/agent-box-webhook@.service b/modules/src/units/agent-box-webhook@.service
@@ -0,0 +1,40 @@
+[Unit]
+Description=Webhook receiver daemon (local-webhook) for %i
+After=network-online.target agent-box-webhook@%i.socket
+Requires=agent-box-webhook@%i.socket
+Wants=network-online.target
+
+[Service]
+User=%i
+Restart=always
+RestartSec=5s
+Environment=LOCAL_WEBHOOK_RECEIVER_ONLY=1
+Environment=LOCAL_WEBHOOK_STATE_DIR=/home/%i/.local/state/local-webhook
+Environment=LOCAL_WEBHOOK_PORT=0
+EnvironmentFile=-/etc/agent-box/units/agent-box-webhook-%i.env
+EnvironmentFile=-/etc/agent-box/units/agent-box-webhook-%i.local.env
+# LOCAL_WEBHOOK_SELF: who this box acts as, so "@self" in a standing
+# watch's ignoreSenders resolves (issue #261). Written by
+# agent-box-webhook-self from the token in a SESSION's environment - the
+# only place that token exists - which is why this is a file the receiver
+# reads and not a value the module declares: the identity follows the
+# token, and the token arrives (and is swapped) at runtime. Optional
+# ("-"): absent before the first session resolves it, and on a box whose
+# user never gives the agent a token. Loaded at start, so a re-resolved
+# login reaches the daemon on its next restart; sessions pick it up as
+# they respawn.
+EnvironmentFile=-/home/%i/.local/state/local-webhook/self.env
+ExecStartPre=agent-box-webhook-policy-apply
+ExecStart=agent-box-webhook-receiver
+StandardInput=null
+ProtectSystem=strict
+ReadWritePaths=/home/%i
+ProtectHome=false
+PrivateDevices=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+RestrictRealtime=true
+LockPersonality=true
+NoNewPrivileges=true
diff --git a/modules/src/units/agent-box-webhook@.socket b/modules/src/units/agent-box-webhook@.socket
@@ -0,0 +1,8 @@
+[Unit]
+Description=Webhook ingress socket for %i
+
+[Socket]
+ListenStream=/run/agent-box-webhook/%i.sock
+SocketUser=%i
+SocketGroup=caddy
+SocketMode=0660
diff --git a/modules/src/units/agent-box@.service b/modules/src/units/agent-box@.service
@@ -0,0 +1,30 @@
+[Unit]
+Description=Coding agent sessions (tmux) for %i
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=exec
+User=%i
+Restart=always
+RestartSec=2s
+ExecStart=agent-box-supervisor
+ExecStop=tmux -L agent-box kill-server
+RuntimeDirectory=agent-box-%i
+RuntimeDirectoryMode=0700
+RuntimeDirectoryPreserve=yes
+Environment=HOME=/home/%i
+Environment=TMUX_TMPDIR=/run/agent-box-%i
+EnvironmentFile=-/etc/agent-box/units/%i.env
+EnvironmentFile=-/etc/agent-box/units/%i.local.env
+PrivateTmp=true
+PrivateDevices=true
+ProtectSystem=strict
+ReadWritePaths=/home/%i
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+ProtectClock=true
+RestrictSUIDSGID=true
+RestrictRealtime=true
+LockPersonality=true
diff --git a/modules/src/units/agent-web-terminal@.service b/modules/src/units/agent-web-terminal@.service
@@ -0,0 +1,14 @@
+[Unit]
+Description=Browser terminal (ttyd) attached to %i's tmux
+After=agent-box@%i.service network-online.target
+Wants=network-online.target
+
+[Service]
+User=%i
+Restart=always
+RestartSec=5s
+Environment=TMUX_TMPDIR=/run/agent-box-%i
+Environment=AGENT_BOX_SESSIONS_FILE=/home/%i/.config/agent-box/sessions.json
+EnvironmentFile=-/etc/agent-box/units/agent-web-terminal-%i.env
+EnvironmentFile=-/etc/agent-box/units/agent-web-terminal-%i.local.env
+ExecStart=ttyd --writable --url-arg -p ${AGENT_BOX_TTYD_PORT} -i 127.0.0.1 -b /%i -t disableLeaveAlert=true -t titleFixed=%i@${AGENT_BOX_WEB_DOMAIN} -t macOptionClickForcesSelection=true agent-box-attach
diff --git a/tests/connect.nix b/tests/connect.nix
@@ -139,7 +139,7 @@ in
       # variable the module computes, so the daemon cannot tell the
       # difference — which is the point of naming binaries rather than
       # relying on PATH.
-      systemd.services.agent-box-settings-agent.environment.AGENT_BOX_CONNECT_BINS =
+      systemd.services."agent-box-settings@agent".environment.AGENT_BOX_CONNECT_BINS =
         lib.mkForce "claude=${stubClaude}/bin/claude github=${stubGh}/bin/gh";
 
       system.activationScripts.agent-web-password-hash.text = ''
@@ -169,8 +169,8 @@ in
     import shlex
 
     start_all()
-    machine.wait_for_unit("agent-box-agent.service")
-    machine.wait_for_unit("agent-box-settings-agent.service")
+    machine.wait_for_unit("agent-box@agent.service")
+    machine.wait_for_unit("agent-box-settings@agent.service")
 
     sock = "curl -s --max-time 20 --unix-socket /run/agent-box-settings/agent.sock"
     page = "http://localhost/agent/settings/"
@@ -339,7 +339,7 @@ in
         # A server started here would parent every session the supervisor
         # later spawns, moving the agents out of their hardened unit's
         # namespace and into the settings daemon's.
-        machine.succeed("systemctl stop agent-box-agent.service")
+        machine.succeed("systemctl stop agent-box@agent.service")
         machine.wait_until_fails(tmux("list-sessions"))
         assert post("/agent/settings/connect/start", "flow=claude") == "409"
         machine.fail(tmux("list-sessions"))

diff --git a/tests/golden/DUPLICATES b/tests/golden/DUPLICATES
@@ -21,5 +21,9 @@ web/payloads/agent-box-envstore/bin/agent-box-envstore -> vm/payloads/agent-box-
 web/payloads/agent-box-profile/bin/agent-box-profile -> vm/payloads/agent-box-profile/bin/agent-box-profile
 web/payloads/agent-box-session/bin/agent-box-session -> vm/payloads/agent-box-session/bin/agent-box-session
 web/payloads/agent-box-spot-monitor -> vm/payloads/agent-box-spot-monitor
-web/payloads/agent-box-supervisor -> vm/payloads/agent-box-supervisor
+web/payloads/agent-box-supervisor/bin/agent-box-supervisor -> vm/payloads/agent-box-supervisor/bin/agent-box-supervisor
+web/units/agent-box-settings@robot.service -> web/units/agent-box-settings@agent.service
+web/units/agent-box-webhook@robot.service -> web/units/agent-box-webhook@agent.service
+web/units/agent-box@robot.service -> web/units/agent-box@agent.service
+web/units/agent-web-terminal@robot.service -> web/units/agent-web-terminal@agent.service
 web/units/earlyoom.service -> vm/units/earlyoom.service
diff --git a/tests/golden/vm/etc/agent-box/units/agent.env b/tests/golden/vm/etc/agent-box/units/agent.env
@@ -0,0 +1,5 @@
+AGENT_BOX_SESSIONS_SEED=/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-agent-box-agent-sessions.json
+AGENT_BOX_AGENT_BINS=claude=/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-claude-code-2.1.206/bin/claude codex=/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-codex-0.144.1/bin/codex shell=/run/current-system/sw/bin/bash
+AGENT_BOX_MARK_STOPPED=/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-agent-box-agent-mark-stopped
+AGENT_BOX_AGENTS_POINTER=/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-agent-box-agent-agents-pointer.md
+AGENT_BOX_GUIDE_TARGET=/etc/agent-box-guides/AGENTS.agent.md
diff --git a/tests/golden/vm/payloads/agent-box-spot-monitor b/tests/golden/vm/payloads/agent-box-spot-monitor
@@ -98,7 +98,7 @@ while true; do
     sleep "$GRACE"
     echo "spot-monitor: stopping agent units (no respawn)" >&2
     for u in $USERS; do
-      $SYSTEMCTL stop "agent-box-$u.service" || true
+      $SYSTEMCTL stop "agent-box@$u.service" || true
     done
     $SYNC
     echo "spot-monitor: prepared; leaving the stop to AWS (preserves persistent-Spot auto-restart)" >&2

diff --git a/...s/golden/vm/payloads/agent-box-supervisor → ...t-box-supervisor/bin/agent-box-supervisor b/...s/golden/vm/payloads/agent-box-supervisor → ...t-box-supervisor/bin/agent-box-supervisor
diff --git a/tests/golden/vm/units/agent-box-agent.service b/tests/golden/vm/units/agent-box-agent.service