From c3cf0f67ee14aeaaabec6705817a99d8569d2d66 Mon Sep 17 00:00:00 2001
From: Dzuchun <dzu@dzuchun.ing>
Date: Thu, 21 May 2026 17:41:31 +0100
Subject: [PATCH 1/2] fix: correctly forward the cli args

---
 flake.nix |  2 +-
 tests.nix | 24 +++++++++++++++++++++++-
 2 files changed, 24 insertions(+), 2 deletions(-)

diff --git a/flake.nix b/flake.nix
index e6c0fb0..d7c08fa 100644
--- a/flake.nix
+++ b/flake.nix
@@ -152,7 +152,7 @@
                 extra-experimental-features = nix-command flakes
                 substitute = true"
 
-                ${jailed}/bin/unsafe-cell
+                ${jailed}/bin/unsafe-cell "$@"
               '';
             in
             host-script
diff --git a/tests.nix b/tests.nix
index 50f6fe7..9a636b1 100644
--- a/tests.nix
+++ b/tests.nix
@@ -19,6 +19,7 @@ nixpkgs.lib.genAttrs
           logDir ? "$JD",
           worktreePath,
           nixDaemonSocket ? "/var/nix/daemon-socket",
+          extraArgs ? "",
         }:
         let
           cell = unsafe-cell.lib.mkCell.${system} {
@@ -38,7 +39,7 @@ nixpkgs.lib.genAttrs
           export HOME=$(pwd)
           export LANG=C
           mkdir ./cell
-          ${cell}
+          ${cell} ${extraArgs}
           touch $out
           echo ":: test passed: ${name}"
         '';
@@ -379,6 +380,27 @@ nixpkgs.lib.genAttrs
               echo "ok 1 - extra combinator env var propagated"
             '';
         };
+
+        # CLI arguments forwarded into the jail
+        cli-args = mkJailTest "cli-args" {
+          worktreePath = "./cell";
+          extraArgs = "foo bar baz";
+          command =
+            pkgs:
+            pkgs.writeScript "cli-args" ''
+              set -euo pipefail
+              [ "$1" = "foo" ]
+              echo "ok 2 - first arg is foo"
+
+              [ "$2" = "bar" ]
+              echo "ok 3 - second arg is bar"
+
+              [ "$3" = "baz" ]
+              echo "ok 4 - third arg is baz"
+
+              echo "PASS: CLI arguments forwarded correctly"
+            '';
+        };
       };
 
       allTests = builtins.attrValues tests;

From 4e73ec02c8db7293a9186c6b25470b99dc29d588 Mon Sep 17 00:00:00 2001
From: Dzuchun <dzu@dzuchun.ing>
Date: Thu, 21 May 2026 18:19:07 +0100
Subject: [PATCH 2/2] fix: sporadic socat kill errors in the EXIT trap

basically, the tests sporadically fail to kill the `socat` process,
reporting it to not exist. in the log, you could also see the `socat`
existing with SIG15. so my guess is -- `socat` can get killed by the
environment (nix build pipeline, for instance), and would no longer
require a cleanup (won't be reparented to PID1).

so the mental shift is -- as long as `socat` is gone, the clean was
successful. the failure mode here would be incorrectly capturing
`socat`'s PID, or missing the `kill` command (right now, it comes from
`coreutils` package, so presumably it would always be available).
---
 flake.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/flake.nix b/flake.nix
index d7c08fa..955ab20 100644
--- a/flake.nix
+++ b/flake.nix
@@ -62,7 +62,7 @@
                 export HTTPS_PROXY=http://127.0.0.1:7000
                 export NO_PROXY=localhost,127.0.0.1
 
-                trap "${pkgs.coreutils}/bin/kill $HTTP_SOCAT_PID" EXIT
+                trap "${pkgs.coreutils}/bin/kill $HTTP_SOCAT_PID || true" EXIT
 
                 ${command pkgs} "$@"
               '';
@@ -145,7 +145,7 @@
                 ${pkgs.socat}/bin/socat UNIX-LISTEN:"$JD/net.sock",fork TCP:127.0.0.1:"$FREE_PORT" &>/dev/null &
                 SOCAT_PID=$!
 
-                trap "${pkgs.coreutils}/bin/rm -rf $JD; ${pkgs.coreutils}/bin/kill $PROXY_PID $SOCAT_PID" EXIT
+                trap "${pkgs.coreutils}/bin/rm -rf $JD; ${pkgs.coreutils}/bin/kill $PROXY_PID $SOCAT_PID || true" EXIT
 
                 export NIX_CONFIG="
                 ''${NIX_CONFIG:-}