From 4012cc02728e8ee9d4060f3529e6a08d46439044 Mon Sep 17 00:00:00 2001
From: austinried <4966622+austinried@users.noreply.github.com>
Date: Fri, 9 Oct 2026 07:48:00 +0000
Subject: [PATCH] build: harden the gradle guard wrapper

- cap workers via GRADLE_OPTS instead of a CLI flag, so a caller passing
  --max-workers no longer collides and fails the build
- keep the lock under $XDG_RUNTIME_DIR (falling back to ~/.cache) rather
  than a world-writable /tmp path
- let --stop/--status/--version bypass the lock, and announce when a build
  is waiting for it
- drop the redundant GITHUB_ACTIONS check; the CI runners all set CI
---
 AGENTS.md |  2 +-
 flake.nix | 20 +++++++++++++++++---
 2 files changed, 18 insertions(+), 4 deletions(-)

diff --git a/AGENTS.md b/AGENTS.md
index 241af7bf..99274e8a 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -14,7 +14,7 @@ Everything comes from the Nix flake devshell; do not install toolchains by hand.
 - The default devshell provides JDK 21, Gradle 9, the Android SDK (platform 37, build-tools 37.0.0, platform-tools 37.0.1) and nushell.
 - The integration harness needs real servers, so it lives in a separate `nix develop .#integration` shell (navidrome, gonic, lms, php, Nextcloud with the Music app, sqlite). Keeping them out of the default shell avoids pulling that closure into everyday builds.
 - Build with the devshell `gradle`, not `./gradlew`. CI uses the nix Gradle pinned by `flake.lock`; the wrapper is kept only for people without Nix.
-- The devshell `gradle` is a wrapper: outside CI it takes a lock (`flock /tmp/subtracks-gradle.lock`) and runs under `nice` with capped workers, so several agents building at once queue instead of exhausting the box. With `CI`/`GITHUB_ACTIONS` set (i.e. CI) it execs Gradle directly, unchanged.
+- The devshell `gradle` is a wrapper: outside CI it takes a lock (under `$XDG_RUNTIME_DIR`, falling back to `~/.cache`) and runs under `nice` with a capped worker count, so several agents building at once queue instead of exhausting the box. `--stop`/`--status`/`--version` bypass the lock; with `CI` set it execs Gradle directly, unchanged.
 
 ## Commands
 
diff --git a/flake.nix b/flake.nix
index 2a465840..391b6c41 100644
--- a/flake.nix
+++ b/flake.nix
@@ -41,11 +41,25 @@
           androidSdk = android.androidsdk;
 
           gradle_wrapper = pkgs.writeShellScriptBin "gradle" ''
-            if [ -n "''${CI:-}''${GITHUB_ACTIONS:-}" ]; then
+            if [ -n "''${CI:-}" ]; then
               exec ${pkgs.gradle_9}/bin/gradle "$@"
             fi
-            exec ${pkgs.util-linux}/bin/flock /tmp/subtracks-gradle.lock \
-              ${pkgs.coreutils}/bin/nice -n 10 ${pkgs.gradle_9}/bin/gradle --max-workers=4 "$@"
+            for arg in "$@"; do
+              case "$arg" in
+                -v | --version | --status | --stop)
+                  exec ${pkgs.gradle_9}/bin/gradle "$@"
+                  ;;
+              esac
+            done
+            runtime_dir="''${XDG_RUNTIME_DIR:-''${HOME:-/tmp}/.cache}"
+            mkdir -p "$runtime_dir"
+            lock="$runtime_dir/subtracks-gradle.lock"
+            if ! ${pkgs.util-linux}/bin/flock -n "$lock" ${pkgs.coreutils}/bin/true 2>/dev/null; then
+              echo "gradle: waiting for the build lock at $lock" >&2
+            fi
+            export GRADLE_OPTS="''${GRADLE_OPTS:-} -Dorg.gradle.workers.max=4"
+            exec ${pkgs.util-linux}/bin/flock "$lock" \
+              ${pkgs.coreutils}/bin/nice -n 10 ${pkgs.gradle_9}/bin/gradle "$@"
           '';
 
           basePackages = [