fix(nix): honor NIXPKGS_ALLOW_UNFREE/INSECURE in print-dev-env

[mikeland73]

Summary

Fixes #2196.

devbox shell computes its environment with nix print-dev-env, which runs in pure mode by default. Pure mode ignores the NIXPKGS_ALLOW_UNFREE and NIXPKGS_ALLOW_INSECURE environment variables, so unfree (or insecure) flake inputs fail to evaluate inside a devbox shell — even when the user runs NIXPKGS_ALLOW_UNFREE=1 devbox shell or sets it in devbox.json's env.

This is inconsistent with the rest of devbox: building and installing packages (internal/nix/build.go, profiles.go, cache.go, store.go) already pass --impure together with the allow-unfree/insecure env, so those flows work. Only print-dev-env was left pure — gated behind the IMPURE_PRINT_DEV_ENV feature flag, which is disabled by default because --impure disables Nix's evaluation caching and makes the command slower.

Fix

Run print-dev-env with --impure (and the corresponding allow-unfree / allow-insecure environment) when the user has actually opted into unfree or insecure packages via NIXPKGS_ALLOW_UNFREE / NIXPKGS_ALLOW_INSECURE. Pure mode — and its caching benefit — is preserved for everyone else, so there is no performance regression for the common case. The existing IMPURE_PRINT_DEV_ENV feature flag still forces impure mode unconditionally.

• internal/nix/eval.go: add IsUnfreeAllowed(), mirroring the existing IsInsecureAllowed().
• internal/nix/nix.go: extract the impure decision into usePrintDevEnvImpure() (feature flag OR unfree opt-in OR insecure opt-in) and, when impure, set cmd.Env with the allow-unfree/insecure vars, matching the other Nix call sites.
• internal/nix/nix_test.go: unit tests for IsUnfreeAllowed and usePrintDevEnvImpure across the env-var combinations.

How was it tested?

• go test ./internal/nix/ -run 'TestIsUnfreeAllowed|TestUsePrintDevEnvImpure' — passes.
• go build ./... and go vet ./internal/nix/ — clean.
• (The only failing tests in the package, TestConfigIsUserTrusted, require a real nix binary that isn't present in the CI sandbox and are unrelated to this change.)

Community Contribution License

All community contributions in this pull request are licensed to the project
maintainers under the terms of the
Apache 2 License.

By creating this pull request, I represent that I have the right to license the
contributions to the project maintainers under the Apache 2 License as stated in
the
Community Contribution License.

---

cc @eyevanovich (issue reporter)

🤖 Generated with Claude Code

https://claude.ai/code/session_01KJZ8U5cYG5xLc4caCHt9jg

---

Generated by Claude Code

[Copilot]

Pull request overview

This PR aims to make devbox shell honor NIXPKGS_ALLOW_UNFREE and NIXPKGS_ALLOW_INSECURE when computing the shell environment via nix print-dev-env, by switching to --impure only when the user opts into unfree/insecure evaluation (or when the existing feature flag forces impure mode).

Changes:

• Add IsUnfreeAllowed() alongside the existing IsInsecureAllowed() env parsing.
• Introduce usePrintDevEnvImpure() and use it to decide whether to run nix print-dev-env with --impure.
• Add unit tests for IsUnfreeAllowed() and usePrintDevEnvImpure().

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
internal/nix/nix.go	Adds usePrintDevEnvImpure() and conditionally runs nix print-dev-env with --impure and an explicit environment.
internal/nix/eval.go	Adds IsUnfreeAllowed() to detect opt-in via NIXPKGS_ALLOW_UNFREE.
internal/nix/nix_test.go	Adds tests validating env-var parsing and the impure decision logic.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[mikeland73]

Thanks for the review — addressed all three points in 3ac083d:

1. Forcing both allow- vars / feature-flag safety:* now only the variable the user actually opted into is injected (unfree → NIXPKGS_ALLOW_UNFREE, insecure → NIXPKGS_ALLOW_INSECURE), evaluated independently. When impure mode is enabled solely via the IMPURE_PRINT_DEV_ENV feature flag, cmd.Env is left inheriting the parent environment, so no allow-* vars are added.
2. devbox.json env not honored: correct — config env is merged after execPrintDevEnv. The two flags are now read from d.cfg.Env() in execPrintDevEnv and threaded through PrintDevEnvArgs.AllowUnfree/AllowInsecure, so opting in via devbox.json's env block also triggers --impure (and injects the value, since it isn't in the process env yet).
3. Non-hermetic test: the impure-decision test now pins DEVBOX_FEATURE_IMPURE_PRINT_DEV_ENV=0, and a separate test covers the feature-flag-forces-impure path.

---

Generated by Claude Code