fix(nix): honor NIXPKGS_ALLOW_UNFREE/INSECURE in print-dev-env

internal/nix/eval.go

@@ -59,3 +59,10 @@ func IsInsecureAllowed() bool {
 	allowed, _ := strconv.ParseBool(os.Getenv("NIXPKGS_ALLOW_INSECURE"))
 	return allowed
 }
+
+// IsUnfreeAllowed reports whether the user has opted into unfree packages by
+// setting the NIXPKGS_ALLOW_UNFREE environment variable to a truthy value.
+func IsUnfreeAllowed() bool {
+	allowed, _ := strconv.ParseBool(os.Getenv("NIXPKGS_ALLOW_UNFREE"))
+	return allowed
+}

internal/nix/nix.go

@@ -76,8 +76,9 @@ func (*NixInstance) PrintDevEnv(ctx context.Context, args *PrintDevEnvArgs) (*Pr
 
 	if len(data) == 0 {
 		cmd := Command("print-dev-env", "--json")
-		if featureflag.ImpurePrintDevEnv.Enabled() {
+		if usePrintDevEnvImpure() {
 			cmd.Args = append(cmd.Args, "--impure")
+			cmd.Env = allowUnfreeEnv(allowInsecureEnv(os.Environ()))
 		}
 		cmd.Args = append(cmd.Args, ref)
 		slog.Debug("running print-dev-env cmd", "cmd", cmd)
@@ -100,6 +101,20 @@ func (*NixInstance) PrintDevEnv(ctx context.Context, args *PrintDevEnvArgs) (*Pr
 	return &out, nil
 }
 
+// usePrintDevEnvImpure reports whether `nix print-dev-env` should be run with
+// the --impure flag. By default print-dev-env runs in pure mode, which ignores
+// the NIXPKGS_ALLOW_UNFREE and NIXPKGS_ALLOW_INSECURE environment variables.
+// When the user has opted into unfree or insecure packages, we run with
+// --impure so those variables take effect, matching what devbox already does
+// when building and installing packages. Pure mode is kept otherwise because
+// --impure disables Nix's evaluation caching, which makes the command slower.
+// See https://github.com/jetify-com/devbox/issues/2196.
+func usePrintDevEnvImpure() bool {
+	return featureflag.ImpurePrintDevEnv.Enabled() ||
+		IsUnfreeAllowed() ||
+		IsInsecureAllowed()
+}
+
 func savePrintDevEnvCache(path string, out PrintDevEnvOut) error {
 	data, err := json.Marshal(out)
 	if err != nil {

internal/nix/nix_test.go

@@ -4,6 +4,52 @@ import (
 	"testing"
 )
 
+func TestIsUnfreeAllowed(t *testing.T) {
+	cases := map[string]bool{
+		"":      false,
+		"0":     false,
+		"false": false,
+		"1":     true,
+		"true":  true,
+	}
+	for value, want := range cases {
+		t.Run(value, func(t *testing.T) {
+			t.Setenv("NIXPKGS_ALLOW_UNFREE", value)
+			if got := IsUnfreeAllowed(); got != want {
+				t.Errorf("IsUnfreeAllowed() with NIXPKGS_ALLOW_UNFREE=%q = %v, want %v", value, got, want)
+			}
+		})
+	}
+}
+
+// TestUsePrintDevEnvImpure verifies the fix for
+// https://github.com/jetify-com/devbox/issues/2196: print-dev-env must run
+// with --impure whenever the user opts into unfree or insecure packages so
+// those environment variables are honored.
+func TestUsePrintDevEnvImpure(t *testing.T) {
+	cases := []struct {
+		name   string
+		unfree string
+		insec  string
+		want   bool
+	}{
+		{name: "neither set", want: false},
+		{name: "unfree disabled", unfree: "0", want: false},
+		{name: "unfree allowed", unfree: "1", want: true},
+		{name: "insecure allowed", insec: "true", want: true},
+		{name: "both allowed", unfree: "1", insec: "1", want: true},
+	}
+	for _, tt := range cases {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Setenv("NIXPKGS_ALLOW_UNFREE", tt.unfree)
+			t.Setenv("NIXPKGS_ALLOW_INSECURE", tt.insec)
+			if got := usePrintDevEnvImpure(); got != tt.want {
+				t.Errorf("usePrintDevEnvImpure() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
 func TestParseInsecurePackagesFromExitError(t *testing.T) {
 	errorText := `
   at /nix/store/xwl0am98klc8mz074jdyvpnyc6vwzlla-source/lib/customisation.nix:267:17: