一键在 Manus 中运行任何 Skill

nix-agent-configs

星标1

分支0

更新时间2026年7月3日 16:59

Hard-won lessons for working on the Nix-managed AI agent configs in modules/home-manager/ai/ (the Bedrock-backed agents pi, claude, maki, hermes, codex, plus kiro-cli, and the LiteLLM proxy). Use this skill ONLY when editing files under modules/home-manager/ai/ or debugging agent auth/telemetry/model routing. Covers: telemetry-off enforcement, thinking-effort ceilings, the two Bedrock auth paths (bearer vs SigV4), model-reachability verification, patching pipx/venv tools, and the CI expectations for this repo. Triggers on: editing modules/home-manager/ai, "LiteLLM proxy", "Bedrock auth", "agent telemetry", "thinking effort", "kiro-cli config".

安装

用 Codex 或 Claude 帮你安装复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。

在 Manus 中运行

来源

gburd

gburd/nix-config

打开 GitHub 仓库查看创作者相关仓库

下载

在 Manus 中运行

Lessons: Nix-managed AI Agent Configs

When working on modules/home-manager/ai/ (Bedrock-backed agents: pi, claude, maki, hermes, codex; plus kiro-cli):

Telemetry ships ON by default. Disable it declaratively, don't assume: kiro-cli (telemetry.enabled = false in ~/.kiro/settings/cli.json), Claude Code (CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=true + DISABLE_TELEMETRY/ERROR_REPORTING/BUG_COMMAND), pi (enableInstallTelemetry=false and PI_TELEMETRY=0). For tools whose state file is mutable, enforce via a home.activation jq patch (create-if-missing).
"Ultra" thinking == pi's xhigh (off/minimal/low/medium/high/xhigh). The env-var efforts (CLAUDE_THINKING_EFFORT, codex model_reasoning_effort, hermes reasoning_effort) top out at high — don't invent higher values.
Bedrock auth has two paths. The bearer token (AWS_BEARER_TOKEN_BEDROCK) works for InvokeModel/Converse and Bedrock's HTTPS endpoint accepts Authorization: Bearer <token> directly. The Anthropic SDK's AnthropicBedrock client is SigV4-only and fails with "could not resolve credentials from session" on a bearer-only host. kiro-cli does not use Bedrock at all — it authenticates with its own subscription/credits.
Unset leaked AWS_PROFILE. botocore prefers AWS_PROFILE over the bearer token; a stale/undefined profile leaked from the login session makes every Bedrock call 500 with ProfileNotFound. The LiteLLM start script unsets AWS_PROFILE/static creds so the bearer token is the sole auth path.
Verify model reachability before claiming it works. A direct InvokeModel probe (or curl to /model/<id>/invoke) proving HTTP 200 does not prove a given agent's code path works — agents route through different SDKs.
Patching pipx/venv tools: ship an idempotent Python patcher in-repo and run it from home.activation after the pipx install/upgrade (pipx upgrade can overwrite the venv). Guard with a sentinel marker, and locate code by parsing (e.g. balance parens to find a signature end) rather than matching exact lines, so the patch survives upstream version drift. Wrap the agent binary in a writeShellScriptBin shim that exports the bearer token, mirroring pi/maki.
Flakes only see git-tracked files. A new file referenced by a module won't build until git add-ed.

CI Expectations (this repo)

deadnix --fail . and statix check . are blocking in the Lint workflow — no unused bindings/args (prefix intentionally-unused lambda args with _). nix fmt -- --check . (nix-formatter-pack) is what CI's Lint job runs — run it locally before pushing.
Tag-only workflows must skip gracefully when a referenced flake attribute doesn't exist (e.g. the ISO build checks nix eval ...drvPath first), so a missing optional output never fails a release.

同仓库更多 Skills

同仓库

aws-benchmark

gburd/nix-config

Run performance benchmarks on AWS EC2 (bare-metal or regular instances) with a reproducible launch → tune → measure → terminate workflow. Use for ANY AWS benchmarking — CPU/memory/IO/database/application, NUMA-related or not: choosing + launching an instance, one-time key-pair/security-group setup, OS kernel tuning (hugepages, governor, THP, NUMA balancing), EBS provisioning, A/B methodology, collecting results, and (critically) terminating the instance when done so it stops costing money. Triggers on: "benchmark on AWS/EC2", "bare-metal EC2", "launch an instance to test", "A/B benchmark", "clock sweep / NUMA benchmark", "pgbench/HammerDB on EC2". For the PostgreSQL-buffer-manager clock-sweep specifics, this pairs with the pg-numa-benchmark skill (which uses this one for the AWS substrate).

2026-07-081

pg-numa-benchmark

gburd/nix-config

Run PostgreSQL clock sweep benchmarks on bare-metal EC2 instances. Covers AWS setup, instance launch (r8i.metal-96xl / m6i.metal), OS tuning, PG build (stock + patched), pgbench A/B testing, HammerDB TPC-C, and result collection. Use when benchmarking PostgreSQL buffer manager changes on NUMA hardware. The generic AWS benchmarking substrate (launch/tune/A-B/terminate) is in the aws-benchmark skill; this layers the PostgreSQL specifics on top.

2026-07-081

release-tagging

gburd/nix-config

Date-based release tagging conventions for this maintainer's personal repos (nix-config and other single-author repos). Use this skill ONLY when actually cutting a release or creating/pushing a git tag — the commit→push→tag→push-tag flow, the vYYYY.MM.DD[.N] format, and the deliberate maintainer exceptions to the "never push to main / never force-push" rules. Triggers on: "tag a release", "cut a release", "ship this", "create a tag", "vYYYY.MM.DD".

2026-07-031

subagent-teams

gburd/nix-config

How to run coordinated sub-agent teams (worker → reviewer → re-reviewer) and the Bedrock model-dispatch rules for sub-agents. Use this skill ONLY when spawning/dispatching sub-agents (e.g. Pi's Agent tool, parallel task fan-out) or debugging a sub-agent that dies instantly. Triggers on: "sub-agent", "subagent", "dispatch agents", "parallel agents", "Agent tool", "sub-agent finished in <2s / 0 tool uses".

2026-07-031

postgresq

gburd/nix-config

Research the PostgreSQL community via the agora MCP server (https://pg.ddx.io/mcp/). Use when investigating PostgreSQL internals or extension development, reviewing or writing patches, understanding historical design decisions, finding related prior art, or tracing a feature through 76k+ pgsql-hackers messages and the upstream/master git history.

2026-05-261

coccinelle

gburd/nix-config

Run semantic patches on C/C++ via spatch. Use for AST-level refactoring, finding API usage patterns, enforcing coding standards structurally, migrating deprecated APIs, and finding null-deref / resource-leak patterns across large codebases. Pairs with the Pi `coccinelle` extension's pre-defined patterns (null-checks, error-handling, memory-leaks, resource-leaks, dead-code, simplify-conditionals, const-correctness).

2026-05-261

name

nix-agent-configs

description

Lessons: Nix-managed AI Agent Configs

When working on modules/home-manager/ai/ (Bedrock-backed agents: pi, claude, maki, hermes, codex; plus kiro-cli):

Telemetry ships ON by default. Disable it declaratively, don't assume: kiro-cli (telemetry.enabled = false in ~/.kiro/settings/cli.json), Claude Code (CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=true + DISABLE_TELEMETRY/ERROR_REPORTING/BUG_COMMAND), pi (enableInstallTelemetry=false and PI_TELEMETRY=0). For tools whose state file is mutable, enforce via a home.activation jq patch (create-if-missing).
"Ultra" thinking == pi's xhigh (off/minimal/low/medium/high/xhigh). The env-var efforts (CLAUDE_THINKING_EFFORT, codex model_reasoning_effort, hermes reasoning_effort) top out at high — don't invent higher values.
Bedrock auth has two paths. The bearer token (AWS_BEARER_TOKEN_BEDROCK) works for InvokeModel/Converse and Bedrock's HTTPS endpoint accepts Authorization: Bearer <token> directly. The Anthropic SDK's AnthropicBedrock client is SigV4-only and fails with "could not resolve credentials from session" on a bearer-only host. kiro-cli does not use Bedrock at all — it authenticates with its own subscription/credits.
Unset leaked AWS_PROFILE. botocore prefers AWS_PROFILE over the bearer token; a stale/undefined profile leaked from the login session makes every Bedrock call 500 with ProfileNotFound. The LiteLLM start script unsets AWS_PROFILE/static creds so the bearer token is the sole auth path.
Verify model reachability before claiming it works. A direct InvokeModel probe (or curl to /model/<id>/invoke) proving HTTP 200 does not prove a given agent's code path works — agents route through different SDKs.
Patching pipx/venv tools: ship an idempotent Python patcher in-repo and run it from home.activation after the pipx install/upgrade (pipx upgrade can overwrite the venv). Guard with a sentinel marker, and locate code by parsing (e.g. balance parens to find a signature end) rather than matching exact lines, so the patch survives upstream version drift. Wrap the agent binary in a writeShellScriptBin shim that exports the bearer token, mirroring pi/maki.
Flakes only see git-tracked files. A new file referenced by a module won't build until git add-ed.

CI Expectations (this repo)

deadnix --fail . and statix check . are blocking in the Lint workflow — no unused bindings/args (prefix intentionally-unused lambda args with _). nix fmt -- --check . (nix-formatter-pack) is what CI's Lint job runs — run it locally before pushing.
Tag-only workflows must skip gracefully when a referenced flake attribute doesn't exist (e.g. the ISO build checks nix eval ...drvPath first), so a missing optional output never fails a release.