Run any Skill in Manus with one click

nix-agent-configs

Stars1

Forks0

UpdatedJuly 3, 2026 at 16:59

Hard-won lessons for working on the Nix-managed AI agent configs in modules/home-manager/ai/ (the Bedrock-backed agents pi, claude, maki, hermes, codex, plus kiro-cli, and the LiteLLM proxy). Use this skill ONLY when editing files under modules/home-manager/ai/ or debugging agent auth/telemetry/model routing. Covers: telemetry-off enforcement, thinking-effort ceilings, the two Bedrock auth paths (bearer vs SigV4), model-reachability verification, patching pipx/venv tools, and the CI expectations for this repo. Triggers on: editing modules/home-manager/ai, "LiteLLM proxy", "Bedrock auth", "agent telemetry", "thinking effort", "kiro-cli config".

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Run Skill in Manus

Source

gburd

gburd/nix-config

View GitHub Repository View Creator Repositories

Download

Run Skill in Manus

Related occupationsSOC

Based on SOC occupation classification

Software DevelopersComputer and Mathematical Occupations·SOC 15-1252

SKILL.md

readonly

name

nix-agent-configs

description

Lessons: Nix-managed AI Agent Configs

When working on modules/home-manager/ai/ (Bedrock-backed agents: pi, claude, maki, hermes, codex; plus kiro-cli):

Telemetry ships ON by default. Disable it declaratively, don't assume: kiro-cli (telemetry.enabled = false in ~/.kiro/settings/cli.json), Claude Code (CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=true + DISABLE_TELEMETRY/ERROR_REPORTING/BUG_COMMAND), pi (enableInstallTelemetry=false and PI_TELEMETRY=0). For tools whose state file is mutable, enforce via a home.activation jq patch (create-if-missing).
"Ultra" thinking == pi's xhigh (off/minimal/low/medium/high/xhigh). The env-var efforts (CLAUDE_THINKING_EFFORT, codex model_reasoning_effort, hermes reasoning_effort) top out at high — don't invent higher values.
Bedrock auth has two paths. The bearer token (AWS_BEARER_TOKEN_BEDROCK) works for InvokeModel/Converse and Bedrock's HTTPS endpoint accepts Authorization: Bearer <token> directly. The Anthropic SDK's AnthropicBedrock client is SigV4-only and fails with "could not resolve credentials from session" on a bearer-only host. kiro-cli does not use Bedrock at all — it authenticates with its own subscription/credits.
Unset leaked AWS_PROFILE. botocore prefers AWS_PROFILE over the bearer token; a stale/undefined profile leaked from the login session makes every Bedrock call 500 with ProfileNotFound. The LiteLLM start script unsets AWS_PROFILE/static creds so the bearer token is the sole auth path.
Verify model reachability before claiming it works. A direct InvokeModel probe (or curl to /model/<id>/invoke) proving HTTP 200 does not prove a given agent's code path works — agents route through different SDKs.
Patching pipx/venv tools: ship an idempotent Python patcher in-repo and run it from home.activation after the pipx install/upgrade (pipx upgrade can overwrite the venv). Guard with a sentinel marker, and locate code by parsing (e.g. balance parens to find a signature end) rather than matching exact lines, so the patch survives upstream version drift. Wrap the agent binary in a writeShellScriptBin shim that exports the bearer token, mirroring pi/maki.
Flakes only see git-tracked files. A new file referenced by a module won't build until git add-ed.

CI Expectations (this repo)

deadnix --fail . and statix check . are blocking in the Lint workflow — no unused bindings/args (prefix intentionally-unused lambda args with _). nix fmt -- --check . (nix-formatter-pack) is what CI's Lint job runs — run it locally before pushing.
Tag-only workflows must skip gracefully when a referenced flake attribute doesn't exist (e.g. the ISO build checks nix eval ...drvPath first), so a missing optional output never fails a release.

More from this repository

same repository

aws-benchmark

gburd/nix-config

Run performance benchmarks on AWS EC2 (bare-metal or regular instances) with a reproducible launch → tune → measure → terminate workflow. Use for ANY AWS benchmarking — CPU/memory/IO/database/application, NUMA-related or not: choosing + launching an instance, one-time key-pair/security-group setup, OS kernel tuning (hugepages, governor, THP, NUMA balancing), EBS provisioning, A/B methodology, collecting results, and (critically) terminating the instance when done so it stops costing money. Triggers on: "benchmark on AWS/EC2", "bare-metal EC2", "launch an instance to test", "A/B benchmark", "clock sweep / NUMA benchmark", "pgbench/HammerDB on EC2". For the PostgreSQL-buffer-manager clock-sweep specifics, this pairs with the pg-numa-benchmark skill (which uses this one for the AWS substrate).

2026-07-081

pg-numa-benchmark

gburd/nix-config

Run PostgreSQL clock sweep benchmarks on bare-metal EC2 instances. Covers AWS setup, instance launch (r8i.metal-96xl / m6i.metal), OS tuning, PG build (stock + patched), pgbench A/B testing, HammerDB TPC-C, and result collection. Use when benchmarking PostgreSQL buffer manager changes on NUMA hardware. The generic AWS benchmarking substrate (launch/tune/A-B/terminate) is in the aws-benchmark skill; this layers the PostgreSQL specifics on top.

2026-07-081

release-tagging

gburd/nix-config

Date-based release tagging conventions for this maintainer's personal repos (nix-config and other single-author repos). Use this skill ONLY when actually cutting a release or creating/pushing a git tag — the commit→push→tag→push-tag flow, the vYYYY.MM.DD[.N] format, and the deliberate maintainer exceptions to the "never push to main / never force-push" rules. Triggers on: "tag a release", "cut a release", "ship this", "create a tag", "vYYYY.MM.DD".

2026-07-031

subagent-teams

gburd/nix-config

How to run coordinated sub-agent teams (worker → reviewer → re-reviewer) and the Bedrock model-dispatch rules for sub-agents. Use this skill ONLY when spawning/dispatching sub-agents (e.g. Pi's Agent tool, parallel task fan-out) or debugging a sub-agent that dies instantly. Triggers on: "sub-agent", "subagent", "dispatch agents", "parallel agents", "Agent tool", "sub-agent finished in <2s / 0 tool uses".

2026-07-031

postgresq

gburd/nix-config

Research the PostgreSQL community via the agora MCP server (https://pg.ddx.io/mcp/). Use when investigating PostgreSQL internals or extension development, reviewing or writing patches, understanding historical design decisions, finding related prior art, or tracing a feature through 76k+ pgsql-hackers messages and the upstream/master git history.

2026-05-261

coccinelle

gburd/nix-config

Run semantic patches on C/C++ via spatch. Use for AST-level refactoring, finding API usage patterns, enforcing coding standards structurally, migrating deprecated APIs, and finding null-deref / resource-leak patterns across large codebases. Pairs with the Pi `coccinelle` extension's pre-defined patterns (null-checks, error-handling, memory-leaks, resource-leaks, dead-code, simplify-conditionals, const-correctness).

2026-05-261

name

nix-agent-configs

description

Lessons: Nix-managed AI Agent Configs

When working on modules/home-manager/ai/ (Bedrock-backed agents: pi, claude, maki, hermes, codex; plus kiro-cli):

Telemetry ships ON by default. Disable it declaratively, don't assume: kiro-cli (telemetry.enabled = false in ~/.kiro/settings/cli.json), Claude Code (CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=true + DISABLE_TELEMETRY/ERROR_REPORTING/BUG_COMMAND), pi (enableInstallTelemetry=false and PI_TELEMETRY=0). For tools whose state file is mutable, enforce via a home.activation jq patch (create-if-missing).
"Ultra" thinking == pi's xhigh (off/minimal/low/medium/high/xhigh). The env-var efforts (CLAUDE_THINKING_EFFORT, codex model_reasoning_effort, hermes reasoning_effort) top out at high — don't invent higher values.
Bedrock auth has two paths. The bearer token (AWS_BEARER_TOKEN_BEDROCK) works for InvokeModel/Converse and Bedrock's HTTPS endpoint accepts Authorization: Bearer <token> directly. The Anthropic SDK's AnthropicBedrock client is SigV4-only and fails with "could not resolve credentials from session" on a bearer-only host. kiro-cli does not use Bedrock at all — it authenticates with its own subscription/credits.
Unset leaked AWS_PROFILE. botocore prefers AWS_PROFILE over the bearer token; a stale/undefined profile leaked from the login session makes every Bedrock call 500 with ProfileNotFound. The LiteLLM start script unsets AWS_PROFILE/static creds so the bearer token is the sole auth path.
Verify model reachability before claiming it works. A direct InvokeModel probe (or curl to /model/<id>/invoke) proving HTTP 200 does not prove a given agent's code path works — agents route through different SDKs.
Patching pipx/venv tools: ship an idempotent Python patcher in-repo and run it from home.activation after the pipx install/upgrade (pipx upgrade can overwrite the venv). Guard with a sentinel marker, and locate code by parsing (e.g. balance parens to find a signature end) rather than matching exact lines, so the patch survives upstream version drift. Wrap the agent binary in a writeShellScriptBin shim that exports the bearer token, mirroring pi/maki.
Flakes only see git-tracked files. A new file referenced by a module won't build until git add-ed.

CI Expectations (this repo)

deadnix --fail . and statix check . are blocking in the Lint workflow — no unused bindings/args (prefix intentionally-unused lambda args with _). nix fmt -- --check . (nix-formatter-pack) is what CI's Lint job runs — run it locally before pushing.
Tag-only workflows must skip gracefully when a referenced flake attribute doesn't exist (e.g. the ISO build checks nix eval ...drvPath first), so a missing optional output never fails a release.