菜单
Use when installing or choosing CLI tools in a Nix flake repo, editing flake.nix or home-manager config, or when tempted to pip/pipx/uv/brew/npm install anything. Tools come from the dev shell or nix shell — never ad-hoc package managers.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | nix-tool-policy |
| description | Use when installing or choosing CLI tools in a Nix flake repo, editing flake.nix or home-manager config, or when tempted to pip/pipx/uv/brew/npm install anything. Tools come from the dev shell or nix shell — never ad-hoc package managers. |
Scope: All repositories with flake.nix + .envrc (Nix dev shell pattern)
pipx install <tool> / pipx reinstall <tool> — pipx virtualenvs reference Nix store Python; breaks after GCpip install <tool> / pip3 install <tool> — same problem, also pollutes global Pythonuv pip install <tool> — same Nix store Python problemuv run <tool> — generally unnecessary in Nix dev shells; prefer bare commands from the dev shell PATH.
Last-resort package runner (with confirmation) only when the dev shell does not provide the tool.brew install <tool> for tools already in the dev shell — creates version conflictsTools are on PATH: When a repo has flake.nix + .envrc, all project tools are provided by the Nix dev shell. Run them as bare commands.
If a tool is not found: Use direnv exec . <command> to run within the dev shell environment. This works even when direnv shell hooks haven't fired.
If direnv exec fails: Use nix develop --command <command> as a fallback. This is slower but always works.
If the tool truly isn't in the flake: Prefer adding the tool to flake.nix so it becomes part of the dev shell.
For one-off usage, run it via nix shell -p <tool> rather than installing with pipx/pip/uv.
Never install globally: Do not respond to a missing tool by installing it system-wide with pipx/pip/uv/brew;
use the dev shell or a temporary Nix invocation, and update flake.nix when the tool is needed long term.
| Task | Use This | Not This |
|---|---|---|
| Config generation | Nix functions (lib.mkIf, lib.generators.*) | Shell/Python generator |
| Nix data processing | builtins.fromJSON, builtins.readFile, lib.strings.* | Python wrapper |
When a Nix script IS needed (committed artifact):
writeShellApplication with runtimeInputs, reference via ${./<relative-path>}exec patterns in writeShellScriptBin are acceptableNix manages Python interpreters in the Nix store (/nix/store/...).
Tools installed via pipx/pip create virtual environments that hardcode paths to these interpreters.
When nix-collect-garbage runs or a flake update changes the Python version,
those paths become invalid and every pipx/pip-installed tool breaks silently.
The Nix dev shell pattern avoids this by providing tools through the flake lockfile, ensuring consistent, reproducible environments that survive garbage collection.
All JacobPEvans repositories with flake.nix + .envrc, including:
Use when creating PRs, linking issues, managing PR comments, or creating GitHub issues
Use when creating or editing GitHub Actions workflows that call reusable workflows (uses: OWNER/repo/.github/workflows/...) — org owner references must be the literal current org, and shared-CI homes are under dryvist.
Emit a paste-ready two-part handoff for a fresh session: a `## Goal statement` hard-capped under 4000 characters (measured with wc -c, never estimated) that pastes straight into Claude Code's /goal Stop hook, plus an unbounded `## Full prompt` carrying cwd, ordered reading list, hard rules, pitfalls, and deliverables. Use when forking work to a new session, spinning up an orchestrator, or when wrap-up needs a next-session prompt with a real goal and not just a task list.
Analyzes current session state and repository status without any cleanup. Full mode (default): resolves the active plan file, reads plan checklist + TaskList, gathers unfinished work/issues from conversation history, checks git status, and emits a /handoff-built next-session prompt. Mid-session mode (`/session-status mid`): a fast plain-language 'done vs remaining' snapshot for mid-flight orientation, skipping the history scan, triage, and handoff.
End-of-session handler that first checks whether the current session's plan is actually complete. If complete: refresh repo, run quick retrospective, clean gone branches, and emit a forward-looking follow-up prompt. If incomplete: skip cleanup and emit one or more `cd`-into-worktree blocks paired with ready-to-paste resume prompts so the unfinished work can be picked up cold in a new session.
Automatically finalize pull requests for merge by resolving CodeQL violations, review threads, merge conflicts, and CI failures. Handles single PR (current branch or by number), all open PRs in the repo, or all open PRs across the org. Includes bot-authored PRs in all modes.