wally-cli: sandbox

hosts/common/programs/wally-cli.nix

@@ -1,5 +1,14 @@
 # wally-cli: allows flashing firmware to keyboards like ZSA Ergodox.
 { ... }:
 {
-  sane.programs.wally-cli = {};
+  sane.programs.wally-cli = {
+    # sandboxing causes it to not discover devices post-launch.
+    # so you have to start wally AFTER pressing the 'flash' button.
+    sandbox.method = "bwrap";
+    sandbox.extraPaths = [
+      "/dev/bus/usb"
+      "/sys/bus/usb"
+      "/sys/devices"
+    ];
+  };
 }