From 8c2f84404c68b65f13ec50fb01eec89d820d57d0 Mon Sep 17 00:00:00 2001
From: Ryan Yin <xiaoyin_c@qq.com>
Date: Fri, 6 Nov 2026 16:16:36 +0800
Subject: [PATCH] fix(nixpak): let mpv read the musicfox playback cache

Assisted-by: DeepSeek Harness (deepseek-flash)
---
 hardening/nixpaks/modules/mpv-policy.nix | 4 ++++
 hardening/tests/policy/mpv.nix           | 3 +++
 2 files changed, 7 insertions(+)

diff --git a/hardening/nixpaks/modules/mpv-policy.nix b/hardening/nixpaks/modules/mpv-policy.nix
index bd47c8dd..40d5bce6 100644
--- a/hardening/nixpaks/modules/mpv-policy.nix
+++ b/hardening/nixpaks/modules/mpv-policy.nix
@@ -32,6 +32,10 @@
       sloth.xdgPicturesDir
       sloth.xdgVideosDir
       (sloth.concat' sloth.homeDir "/.config/yt-dlp")
+      # go-musicfox hands cached songs to mpv as file:// paths. Nixpak's flatpak
+      # shim mounts the app's ~/.var/app cache over ~/.cache, so without this
+      # bind every replay fails to load while the first (streamed) play works.
+      (sloth.concat' sloth.homeDir "/.cache/go-musicfox")
     ];
   };
 }
diff --git a/hardening/tests/policy/mpv.nix b/hardening/tests/policy/mpv.nix
index 03fd53ec..b13fc350 100644
--- a/hardening/tests/policy/mpv.nix
+++ b/hardening/tests/policy/mpv.nix
@@ -1,6 +1,7 @@
 {
   load,
   mkAppPolicy,
+  renderBind,
   ...
 }:
 let
@@ -16,5 +17,7 @@ mkAppPolicy "mpv" {
   extraChecks = {
     fileChooser = app.portalGroups.fileChooser;
     openUri = app.portalGroups.openUri;
+    # The flatpak shim hides ~/.cache, so the musicfox cache must be bound back.
+    musicfoxCache = builtins.elem "$HOME/.cache/go-musicfox" (map renderBind app.bubblewrap.bind.ro);
   };
 }