Cannot build on macOS when using `nativeMessagingHost`

[shinishiho]

• I've updated the flake input to the latest version
• I tried using nixpkgs-unstable to ensure compatibility with the latest Firefox version
• I already searched the zen-browser's github issues

Describe the bug

Building on macOS yields an error if programs.zen-browser.nativeMessagingHosts has something:

error: output '/nix/store/b0qyxdx77pbqiiqa0p50bpjwixm1ms3r-zen-twilight-1.20t' is not allowed to refer to the following paths:
         /nix/store/vl936sd1vj8s008akm3gibkgyqk30qhz-clang-wrapper-21.1.8

I'm not sure if it's specific to passff-host, but I don't use any other messaging host to test.
Standalone Home Manager and NixOS are normal.

To Reproduce

programs.zen-browser.nativeMessagingHosts = with pkgs; [
    passff-host
];

System Information

nixpkgs branch/version: unstable

Operating system:

• NixOS
• macOS
• Other Linux distro → specify:

Zen browser

• Version: 1.20t

• Variant:

  • beta
  • twilight
  • twilight official

• NixOS config: (link or snippet)

[luisnquin]

Can you add it to home.packages(only) just to check it?

[shinishiho]

Good idea.

It built normally though:

┣━ Dependency Graph:
┃    ┌─ ✔ user-environment
┃ ┌─ ✔ etc
┃ │     ┌─ ✔ home-manager-path
┃ │     │  ┌─ ✔ home-manager-applications
┃ │     ├─ ✔ activation-script
┃ │     │     ┌─ ✔ passff-host-1.2.4-fish-completions
┃ │     │  ┌─ ✔ w-fish-completions
┃ │     │  │  ┌─ ✔ home-manager-fonts
┃ │     │  ├─ ✔ hm_LibraryFonts.homemanagerfontsversion
┃ │     ├─ ✔ home-manager-files
┃ │  ┌─ ✔ home-manager-generation
┃ ├─ ✔ activation-w
┃ ✔ darwin-system-26.05.3bfa436 ⏱ 1s
┣━━━ Builds
┗━ ∑ ⏵ 0 │ ✔ 13 │ ⏸ 0 │ ⚠ Finished with 2 traces reported by nix at 10:02:20 after 3m37s
<<< /run/current-system
>>> /nix/store/c0pg1fzby7fq1p86116hm2gpq2sx2l1s-darwin-system-26.05.3bfa436

ADDED
[A.] passff-host 1.2.4, 1.2.4-fish-completions

SIZE: 8.44 GiB -> 8.44 GiB
DIFF: 10.9 KiB

[luisnquin]

I suspect this is an upstream issue with wrapFirefox.

Could you try reproducing it using programs.firefox as well, just to confirm whether it breaks there too?

May be related:
NixOS/nixpkgs#374882

[shinishiho]

Here's the config for firefox:

{
  pkgs,
  ...
}:

{
  programs.firefox = {
    enable = true;
    nativeMessagingHosts = [
      pkgs.passff-host
    ];
  };
}

And it built:

┣━ Dependency Graph:
┃    ┌─ ✔ user-environment
┃ ┌─ ✔ etc
┃ │     ┌─ ✔ home-manager-path
┃ │     │  ┌─ ✔ home-manager-applications
┃ │     ├─ ✔ activation-script
┃ │     │  ┌─ ✔ ff-native-messaging-hosts
┃ │     │  │  ┌─ ✔ home-manager-fonts
┃ │     │  ├─ ✔ hm_LibraryFonts.homemanagerfontsversion
┃ │     │  │        ┌─ ✔ policies.json
┃ │     │  │        ├─ ✔ firefox.desktop
┃ │     │  │     ┌─ ✔ firefox-148.0 ⏱ 4s
┃ │     │  │  ┌─ ✔ firefox-148.0-fish-completions
┃ │     │  ├─ ✔ w-fish-completions
┃ │     ├─ ✔ home-manager-files
┃ │  ┌─ ✔ home-manager-generation
┃ ├─ ✔ activation-w
┃ ✔ darwin-system-26.05.3bfa436 ⏱ 1s
┣━━━ Builds           │ Downloads       │ Host
┃        │ ✔ 20 │     │     │     │     │ localhost
┃        │      │     │     │ ↓ 1 │     │ https://cache.nixos.org
┗━ ∑ ⏵ 0 │ ✔ 20 │ ⏸ 0 │ ↓ 0 │ ↓ 1 │ ⏸ 0 │ ⚠ Finished with 1 traces reported by nix at 10:38:05 after 3m43s
<<< /run/current-system
>>> /nix/store/w7w35h352q52fm7gjfwsj3va3azafdsc-darwin-system-26.05.3bfa436

ADDED
[A.] ff-native-messaging-hosts       <none>
[A.] firefox                         148.0, 148.0-fish-completions
[A.] firefox-unwrapped               148.0
[A.] keep                            <none>
[A.] org.mozilla.firefox.plist.plist <none>
[A.] passff-host                     1.2.4

SIZE: 8.74 GiB -> 9.36 GiB
DIFF: 635 MiB

[shinishiho]

I'm not sure what this all means, but I used AI to try doing something. Here's what it came up with:

  # On Linux, pass through wrapFirefox (the only supported mechanism for zen on Linux).
  # On Darwin, wrapFirefox embeds store paths as strings into the wrapper binary which
  # triggers disallowedRequisites = [ stdenv.cc ] because passff-host's closure includes
  # clang-wrapper. Use the shared Mozilla NativeMessagingHosts path instead, which is
  # what the standard firefox HM module does and what all gecko browsers read on macOS.
  programs.zen-browser.nativeMessagingHosts = lib.optionals pkgs.stdenv.isLinux [
    pkgs.passff-host
  ];

  mozilla.firefoxNativeMessagingHosts = lib.optionals pkgs.stdenv.isDarwin [
    pkgs.passff-host
  ];

And this works well.