fix(platform): surface Nix-managed agent CLI install paths

[xxiaoxiong]

What this PR does

Before this PR:
The packaged macOS (and Linux) Desktop app did not discover agent CLIs installed through nix-darwin environment.systemPackages or per-user nix profile install. After launching the app normally from Finder/Applications and rescanning Local CLI agents, Codex, Claude Code, and Gemini were reported as not found on PATH, even though command -v codex / claude / gemini resolved cleanly from a terminal.

After this PR:
Those same Nix-installed CLIs are detected after the next rescan. No user action beyond the standard rescan flow is required.

Why we need it & why it was done this way

#6121 reports the bug. The root cause is architectural, not a typo: in a GUI-launched Electron process the inherited PATH is minimal (launchd does not source the user's shell rc), so CLI discovery relies on wellKnownUserToolchainBins in packages/platform/src/toolchain.ts to surmise the canonical install locations for every popular package manager.

That helper already covered Homebrew, npm/nvm/fnm/mise/asdf, Deno, Go, pyenv, Scoop, Volta, Vite+, Kimi, Bun, Cargo and the system Homebrew locations — but did not include the standard Nix install roots. Per the Nix manual, the canonical locations for user-installed / system-installed CLIs are:

• /run/current-system/sw/bin — system profile on NixOS / nix-darwin. environment.systemPackages entries land here.
• ~/.nix-profile/bin — per-user Nix profile. nix profile install entries land here.

The fix reuses the existing two-tier structure of wellKnownUserToolchainBins:

• ~/.nix-profile/bin joins the user-level list (alongside ~/.deno/bin, ~/go/bin, ~/.pyenv/shims). It is includeSystemBins-independent, mirroring how those sibling user-managed toolchain dirs are surfaced unconditionally.
• /run/current-system/sw/bin joins the includeSystemBins-gated block, next to /opt/homebrew/bin and /usr/local/bin, because it is a system-installed-binaries location. Same includeSystemBins semantics: still emitted in the default process.platform !== "win32" path, still configurable via the includeSystemBins opt-in flag.

This matches packages/AGENTS.md: platform's toolchain helper is the single source of truth shared by the daemon agent resolver (apps/daemon/src/agents.ts) and the packaged sidecar PATH builder (apps/packaged/src/sidecars.ts). Both consumers automatically pick up the new entries; neither needs its own change.

Tradeoffs

• /nix/var/nix/profiles/default/bin is omitted. This is the system-default profile on multi-user NixOS installs. The reported bug ([Bug]: Desktop app does not discover agent CLIs installed through Nix #6121) only references /run/current-system/sw/bin and ~/.nix-profile/bin, so I kept the diff to the two paths the issue named and that the Nix manual documents as the canonical user/system profile roots. Adding /nix/var/nix/profiles/default/bin is a one-line follow-up if a maintainer wants the explicit full set; the existing list is already a pragmatic subset of well-known locations, not an exhaustive enumeration.
• I did not move /run/current-system/sw/bin ahead of /opt/homebrew/bin. Existing precedence ordering in the system block (homebrew wins for the macOS "first via Homebrew" convention) is preserved; Nix users who also have Homebrew-installed CLIs with the same name will keep seeing the Homebrew shim. A different ordering is a behavior change beyond this issue's scope.
• ~/.nix-profile/bin is added to the user-level CLI list (includeSystemBins: false path), not gated. This is intentional and matches siblings (~/.deno/bin, ~/go/bin, ~/.pyenv/shims) — Nix users should not have to flip a system-bins flag to have their user-installed Nix CLIs discovered.

Breaking changes

None. Additive only — two new entries in the well-known list. Existing entries and ordering unchanged. wellKnownUserToolchainBins returns the same set of paths for all existing inputs, plus the new entries when they exist on disk (best-effort, missing dirs contribute nothing).

How to verify

pnpm --filter @open-design/platform typecheck
pnpm --filter @open-design/platform test

Both pass on this branch. The two existing wellKnownUserToolchainBins tests have been extended by one assertion each (the Deno, Go, pyenv test now also asserts ~/.nix-profile/bin; the includeSystemBins true/false tests now also assert /run/current-system/sw/bin). No new test cases were added to avoid duplication — the two existing tests already cover the code paths being changed.

On a NixOS / nix-darwin machine, install any agent CLI through environment.systemPackages or nix profile install, launch the packaged Desktop app from Finder/Applications, then Settings → Local CLI agents → Rescan. The previously-missing CLI now appears.

Fixes #6121

[lefarcen]

Hey @xxiaoxiong — thanks for tracing this back to the shared toolchain resolver and keeping the fix scoped to the two Nix install roots called out in #6121. I’ve queued the normal triage on our side so this can move through review cleanly.

[lefarcen]

Thanks for the detailed Nix-path analysis — the root-cause write-up makes the scope easy to follow. Could you remap that content into the current PR template with explicit Why, What users will see, Surface area, and Validation sections? Most of the substance is already here, so this should mostly be a quick reshape plus the relevant surface-area checkbox.

[lefarcen]

🧪 Queued for QA validation — this PR has changes that need a manual QA pass before it's merged. Nothing needed from you; we'll update here once it's validated. Thanks for the contribution! 🙏

[PerishCode]

@xxiaoxiong This cleanly extends the shared platform toolchain resolver with the two Nix profile locations while preserving the existing user/system gating and precedence. I verified both changed ranges and their consumers, and ran the platform tests (76/76), platform typecheck, repository guard, and full workspace typecheck successfully. Thanks for the focused fix and the careful regression coverage.

_{🔁 Powered by Looper · runner=reviewer · agent=codex · An autonomous AI dev team for your GitHub repos.}

[lefarcen]

Heads-up: PR #6125 from @Pape45 is also open against the same fix path — both PRs change packages/platform/src/toolchain.ts and packages/platform/tests/index.test.ts to add the Nix profile discovery paths for #6121.

Sharing this so the maintainer team can choose one canonical PR and neither thread ends up doing duplicate work.