eh: eliminated unnecessary string allocations in retry

Signed-off-by: NotAShelf <raf@notashelf.dev>
Change-Id: I50f693ec70719a2e23c7f355be3d2c446a6a6964

.rustfmt.toml

@@ -1 +1,27 @@
+condense_wildcard_suffixes = true
+doc_comment_code_block_width = 80
+edition = "2024"                      # Keep in sync with Cargo.toml.
+enum_discrim_align_threshold = 60
+force_explicit_abi = false
+force_multiline_blocks = true
+format_code_in_doc_comments = true
+format_macro_matchers = true
+format_strings = true
+group_imports = "StdExternalCrate"
+hex_literal_case = "Upper"
+imports_granularity = "Crate"
+imports_layout = "HorizontalVertical"
+inline_attribute_width = 60
+match_block_trailing_comma = true
+max_width = 80
+newline_style = "Unix"
+normalize_comments = true
+normalize_doc_attributes = true
+overflow_delimited_expr = true
+struct_field_align_threshold = 60
+tab_spaces = 2
+unstable_features = true
+use_field_init_shorthand = true
+use_try_shorthand = true
+wrap_comments = true
 

Cargo.lock

@@ -17,6 +17,12 @@ version = "1.0.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "862ed96ca487e809f1c8e5a8447f6ee2cf102f846893800b20cebdf541fc6bbd"
 
+[[package]]
+name = "bitflags"
+version = "2.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "812e12b5285cc515a9c72a5c1d3b6d46a19dac5acfef5265968c166106e31dd3"
+
 [[package]]
 name = "cfg-if"
 version = "1.0.1"
@@ -76,6 +82,7 @@ version = "0.1.2"
 dependencies = [
  "clap",
  "regex",
+ "tempfile",
  "thiserror",
  "tracing",
  "tracing-subscriber",
@@ -83,6 +90,34 @@ dependencies = [
  "yansi",
 ]
 
+[[package]]
+name = "errno"
+version = "0.3.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
+dependencies = [
+ "libc",
+ "windows-sys",
+]
+
+[[package]]
+name = "fastrand"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "37909eebbb50d72f9059c3b6d82c0463f2ff062c9e95845c43a6c9c0355411be"
+
+[[package]]
+name = "getrandom"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi",
+ "wasip2",
+]
+
 [[package]]
 name = "heck"
 version = "0.5.0"
@@ -95,6 +130,18 @@ version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
 
+[[package]]
+name = "libc"
+version = "0.2.177"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2874a2af47a2325c2001a6e6fad9b16a53b802102b528163885171cf92b15976"
+
+[[package]]
+name = "linux-raw-sys"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df1d3c3b53da64cf5760482273a98e575c651a67eec7f77df96b5b642de8f039"
+
 [[package]]
 name = "log"
 version = "0.4.27"
@@ -146,6 +193,12 @@ dependencies = [
  "proc-macro2",
 ]
 
+[[package]]
+name = "r-efi"
+version = "5.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
+
 [[package]]
 name = "regex"
 version = "1.12.2"
@@ -175,6 +228,19 @@ version = "0.8.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2b15c43186be67a4fd63bee50d0303afffcef381492ebe2c5d87f324e1b8815c"
 
+[[package]]
+name = "rustix"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd15f8a2c5551a84d56efdc1cd049089e409ac19a3072d5037a17fd70719ff3e"
+dependencies = [
+ "bitflags",
+ "errno",
+ "libc",
+ "linux-raw-sys",
+ "windows-sys",
+]
+
 [[package]]
 name = "same-file"
 version = "1.0.6"
@@ -210,6 +276,19 @@ dependencies = [
  "unicode-ident",
 ]
 
+[[package]]
+name = "tempfile"
+version = "3.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2d31c77bdf42a745371d260a26ca7163f1e0924b64afa0b688e61b5a9fa02f16"
+dependencies = [
+ "fastrand",
+ "getrandom",
+ "once_cell",
+ "rustix",
+ "windows-sys",
+]
+
 [[package]]
 name = "thiserror"
 version = "2.0.17"
@@ -318,6 +397,15 @@ dependencies = [
  "winapi-util",
 ]
 
+[[package]]
+name = "wasip2"
+version = "1.0.1+wasi-0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0562428422c63773dad2c345a1882263bbf4d65cf3f42e90921f787ef5ad58e7"
+dependencies = [
+ "wit-bindgen",
+]
+
 [[package]]
 name = "winapi-util"
 version = "0.1.11"
@@ -342,6 +430,12 @@ dependencies = [
  "windows-link",
 ]
 
+[[package]]
+name = "wit-bindgen"
+version = "0.46.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f17a85883d4e6d00e8a97c586de764dabcc06133f7f1d55dce5cdc070ad7fe59"
+
 [[package]]
 name = "xtask"
 version = "0.1.2"

eh/Cargo.toml

@@ -18,3 +18,6 @@ tracing.workspace            = true
 tracing-subscriber.workspace = true
 walkdir.workspace            = true
 yansi.workspace              = true
+
+[dev-dependencies]
+tempfile = "3.0"

eh/src/build.rs

@@ -1,5 +1,12 @@
-use crate::error::Result;
-use crate::util::{HashExtractor, NixErrorClassifier, NixFileFixer, handle_nix_with_retry};
+use crate::{
+  error::Result,
+  util::{
+    HashExtractor,
+    NixErrorClassifier,
+    NixFileFixer,
+    handle_nix_with_retry,
+  },
+};
 
 pub fn handle_nix_build(
   args: &[String],

eh/src/command.rs

@@ -1,7 +1,10 @@
+use std::{
+  collections::VecDeque,
+  io::{self, Read, Write},
+  process::{Command, ExitStatus, Output, Stdio},
+};
+
 use crate::error::{EhError, Result};
-use std::collections::VecDeque;
-use std::io::{self, Read, Write};
-use std::process::{Command, ExitStatus, Output, Stdio};
 
 /// Trait for log interception and output handling.
 pub trait LogInterceptor: Send {
@@ -60,7 +63,16 @@ impl NixCommand {
     self
   }
 
-    pub fn env<K: Into<String>, V: Into<String>>(mut self, key: K, value: V) -> Self {
+  pub fn args_ref(mut self, args: &[String]) -> Self {
+    self.args.extend(args.iter().cloned());
+    self
+  }
+
+  pub fn env<K: Into<String>, V: Into<String>>(
+    mut self,
+    key: K,
+    value: V,
+  ) -> Self {
     self.env.push((key.into(), value.into()));
     self
   }
@@ -91,7 +103,9 @@ impl NixCommand {
     let mut cmd = Command::new("nix");
     cmd.arg(&self.subcommand);
 
-        if self.print_build_logs && !self.args.iter().any(|a| a == "--no-build-output") {
+    if self.print_build_logs
+      && !self.args.iter().any(|a| a == "--no-build-output")
+    {
       cmd.arg("--print-build-logs");
     }
     if self.impure {
@@ -113,11 +127,15 @@ impl NixCommand {
     cmd.stderr(Stdio::piped());
 
     let mut child = cmd.spawn()?;
-        let child_stdout = child.stdout.take().ok_or_else(|| EhError::CommandFailed {
+    let child_stdout = child.stdout.take().ok_or_else(|| {
+      EhError::CommandFailed {
         command: format!("nix {}", self.subcommand),
+      }
     })?;
-        let child_stderr = child.stderr.take().ok_or_else(|| EhError::CommandFailed {
+    let child_stderr = child.stderr.take().ok_or_else(|| {
+      EhError::CommandFailed {
         command: format!("nix {}", self.subcommand),
+      }
     })?;
     let mut stdout = child_stdout;
     let mut stderr = child_stderr;
@@ -132,24 +150,24 @@ impl NixCommand {
       let mut did_something = false;
 
       match stdout.read(&mut out_buf) {
-                Ok(0) => {}
+        Ok(0) => {},
         Ok(n) => {
           interceptor.on_stdout(&out_buf[..n]);
           out_queue.push_back(Vec::from(&out_buf[..n]));
           did_something = true;
-                }
-                Err(ref e) if e.kind() == io::ErrorKind::WouldBlock => {}
+        },
+        Err(ref e) if e.kind() == io::ErrorKind::WouldBlock => {},
         Err(e) => return Err(EhError::Io(e)),
       }
 
       match stderr.read(&mut err_buf) {
-                Ok(0) => {}
+        Ok(0) => {},
         Ok(n) => {
           interceptor.on_stderr(&err_buf[..n]);
           err_queue.push_back(Vec::from(&err_buf[..n]));
           did_something = true;
-                }
-                Err(ref e) if e.kind() == io::ErrorKind::WouldBlock => {}
+        },
+        Err(ref e) if e.kind() == io::ErrorKind::WouldBlock => {},
         Err(e) => return Err(EhError::Io(e)),
       }
 
@@ -167,7 +185,9 @@ impl NixCommand {
     let mut cmd = Command::new("nix");
     cmd.arg(&self.subcommand);
 
-        if self.print_build_logs && !self.args.iter().any(|a| a == "--no-build-output") {
+    if self.print_build_logs
+      && !self.args.iter().any(|a| a == "--no-build-output")
+    {
       cmd.arg("--print-build-logs");
     }
     if self.impure {

eh/src/lib.rs

@@ -11,6 +11,7 @@ pub use error::{EhError, Result};
 #[derive(Parser)]
 #[command(name = "eh")]
 #[command(about = "Ergonomic Nix helper", long_about = None)]
+#[command(version)]
 pub struct Cli {
   #[command(subcommand)]
   pub command: Option<Command>,

eh/src/main.rs

@@ -1,7 +1,7 @@
+use std::{env, path::Path};
+
 use eh::{Cli, Command, CommandFactory, Parser};
 use error::Result;
-use std::env;
-use std::path::Path;
 
 mod build;
 mod command;
@@ -26,36 +26,45 @@ fn main() {
     Err(e) => {
       eprintln!("Error: {e}");
       std::process::exit(e.exit_code());
-        }
+    },
   }
 }
 
 // Design partially taken from Stash
-fn dispatch_multicall(app_name: &str, args: std::env::Args) -> Option<Result<i32>> {
+fn dispatch_multicall(
+  app_name: &str,
+  args: std::env::Args,
+) -> Option<Result<i32>> {
   let rest: Vec<String> = args.collect();
   let hash_extractor = util::RegexHashExtractor;
   let fixer = util::DefaultNixFileFixer;
   let classifier = util::DefaultNixErrorClassifier;
 
   match app_name {
-        "nr" => Some(run::handle_nix_run(
+    "nr" => {
+      Some(run::handle_nix_run(
         &rest,
         &hash_extractor,
         &fixer,
         &classifier,
-        )),
-        "ns" => Some(shell::handle_nix_shell(
+      ))
+    },
+    "ns" => {
+      Some(shell::handle_nix_shell(
         &rest,
         &hash_extractor,
         &fixer,
         &classifier,
-        )),
-        "nb" => Some(build::handle_nix_build(
+      ))
+    },
+    "nb" => {
+      Some(build::handle_nix_build(
         &rest,
         &hash_extractor,
         &fixer,
         &classifier,
-        )),
+      ))
+    },
     _ => None,
   }
 }
@@ -82,20 +91,20 @@ fn run_app() -> Result<i32> {
   match cli.command {
     Some(Command::Run { args }) => {
       run::handle_nix_run(&args, &hash_extractor, &fixer, &classifier)
-        }
+    },
 
     Some(Command::Shell { args }) => {
       shell::handle_nix_shell(&args, &hash_extractor, &fixer, &classifier)
-        }
+    },
 
     Some(Command::Build { args }) => {
       build::handle_nix_build(&args, &hash_extractor, &fixer, &classifier)
-        }
+    },
 
     _ => {
       Cli::command().print_help()?;
       println!();
       Ok(0)
-        }
+    },
   }
 }

eh/src/run.rs

@@ -1,5 +1,12 @@
-use crate::error::Result;
-use crate::util::{HashExtractor, NixErrorClassifier, NixFileFixer, handle_nix_with_retry};
+use crate::{
+  error::Result,
+  util::{
+    HashExtractor,
+    NixErrorClassifier,
+    NixFileFixer,
+    handle_nix_with_retry,
+  },
+};
 
 pub fn handle_nix_run(
   args: &[String],

eh/src/shell.rs

@@ -1,5 +1,12 @@
-use crate::error::Result;
-use crate::util::{HashExtractor, NixErrorClassifier, NixFileFixer, handle_nix_with_retry};
+use crate::{
+  error::Result,
+  util::{
+    HashExtractor,
+    NixErrorClassifier,
+    NixFileFixer,
+    handle_nix_with_retry,
+  },
+};
 
 pub fn handle_nix_shell(
   args: &[String],

eh/src/util.rs

@@ -1,13 +1,19 @@
-use crate::command::{NixCommand, StdIoInterceptor};
-use crate::error::{EhError, Result};
+use std::{
+  fs,
+  io::Write,
+  path::{Path, PathBuf},
+};
+
 use regex::Regex;
-use std::fs;
-use std::io::Write;
-use std::path::{Path, PathBuf};
 use tracing::{info, warn};
 use walkdir::WalkDir;
 use yansi::Paint;
 
+use crate::{
+  command::{NixCommand, StdIoInterceptor},
+  error::{EhError, Result},
+};
+
 pub trait HashExtractor {
   fn extract_hash(&self, stderr: &str) -> Option<String>;
 }
@@ -70,10 +76,9 @@ impl NixFileFixer for DefaultNixFileFixer {
       .collect();
 
     if files.is_empty() {
-            Err(EhError::NoNixFilesFound)
-        } else {
-            Ok(files)
+      return Err(EhError::NoNixFilesFound);
     }
+    Ok(files)
   }
 
   fn fix_hash_in_file(&self, file_path: &Path, new_hash: &str) -> Result<bool> {
@@ -101,8 +106,10 @@ impl NixFileFixer for DefaultNixFileFixer {
       }
     }
     if replaced {
-            fs::write(file_path, new_content).map_err(|_| EhError::HashFixFailed {
+      fs::write(file_path, new_content).map_err(|_| {
+        EhError::HashFixFailed {
           path: file_path.to_string_lossy().to_string(),
+        }
       })?;
       Ok(true)
     } else {
@@ -167,13 +174,11 @@ pub fn handle_nix_with_retry(
 
   // For run commands, try interactive first to avoid breaking terminal
   if subcommand == "run" && interactive {
-        let mut cmd = NixCommand::new(subcommand)
+    let status = NixCommand::new(subcommand)
       .print_build_logs(true)
-            .interactive(true);
-        for arg in args {
-            cmd = cmd.arg(arg);
-        }
-        let status = cmd.run_with_logs(StdIoInterceptor)?;
+      .interactive(true)
+      .args_ref(args)
+      .run_with_logs(StdIoInterceptor)?;
     if status.success() {
       return Ok(0);
     }
@@ -182,7 +187,7 @@ pub fn handle_nix_with_retry(
   // First, always capture output to check for errors that need retry
   let output_cmd = NixCommand::new(subcommand)
     .print_build_logs(true)
-        .args(args.iter().cloned());
+    .args_ref(args);
   let output = output_cmd.output()?;
   let stderr = String::from_utf8_lossy(&output.stderr);
 
@@ -193,26 +198,27 @@ pub fn handle_nix_with_retry(
         info!("{}", Paint::green("✔ Fixed hash mismatch, retrying..."));
         let mut retry_cmd = NixCommand::new(subcommand)
           .print_build_logs(true)
-                    .args(args.iter().cloned());
+          .args_ref(args);
         if interactive {
           retry_cmd = retry_cmd.interactive(true);
         }
         let retry_status = retry_cmd.run_with_logs(StdIoInterceptor)?;
         return Ok(retry_status.code().unwrap_or(1));
-            }
+      },
       Ok(false) => {
         // No files were fixed, continue with normal error handling
-            }
+      },
       Err(EhError::NoNixFilesFound) => {
         warn!("No .nix files found to fix hash in");
         // Continue with normal error handling
-            }
+      },
       Err(e) => {
         return Err(e);
-            }
+      },
     }
   } else if stderr.contains("hash") || stderr.contains("sha256") {
-        // If there's a hash-related error but we couldn't extract it, that's a failure
+    // If there's a hash-related error but we couldn't extract it, that's a
+    // failure
     return Err(EhError::HashExtractionFailed);
   }
 
@@ -220,11 +226,13 @@ pub fn handle_nix_with_retry(
     if stderr.contains("has an unfree license") && stderr.contains("refusing") {
       warn!(
         "{}",
-                Paint::yellow("⚠ Unfree package detected, retrying with NIXPKGS_ALLOW_UNFREE=1...")
+        Paint::yellow(
+          "⚠ Unfree package detected, retrying with NIXPKGS_ALLOW_UNFREE=1..."
+        )
       );
       let mut retry_cmd = NixCommand::new(subcommand)
         .print_build_logs(true)
-                .args(args.iter().cloned())
+        .args_ref(args)
         .env("NIXPKGS_ALLOW_UNFREE", "1")
         .impure(true);
       if interactive {
@@ -233,16 +241,19 @@ pub fn handle_nix_with_retry(
       let retry_status = retry_cmd.run_with_logs(StdIoInterceptor)?;
       return Ok(retry_status.code().unwrap_or(1));
     }
-        if stderr.contains("has been marked as insecure") && stderr.contains("refusing") {
+    if stderr.contains("has been marked as insecure")
+      && stderr.contains("refusing")
+    {
       warn!(
         "{}",
         Paint::yellow(
-                    "⚠ Insecure package detected, retrying with NIXPKGS_ALLOW_INSECURE=1..."
+          "⚠ Insecure package detected, retrying with \
+           NIXPKGS_ALLOW_INSECURE=1..."
         )
       );
       let mut retry_cmd = NixCommand::new(subcommand)
         .print_build_logs(true)
-                .args(args.iter().cloned())
+        .args_ref(args)
         .env("NIXPKGS_ALLOW_INSECURE", "1")
         .impure(true);
       if interactive {
@@ -251,14 +262,18 @@ pub fn handle_nix_with_retry(
       let retry_status = retry_cmd.run_with_logs(StdIoInterceptor)?;
       return Ok(retry_status.code().unwrap_or(1));
     }
-        if stderr.contains("has been marked as broken") && stderr.contains("refusing") {
+    if stderr.contains("has been marked as broken")
+      && stderr.contains("refusing")
+    {
       warn!(
         "{}",
-                Paint::yellow("⚠ Broken package detected, retrying with NIXPKGS_ALLOW_BROKEN=1...")
+        Paint::yellow(
+          "⚠ Broken package detected, retrying with NIXPKGS_ALLOW_BROKEN=1..."
+        )
       );
       let mut retry_cmd = NixCommand::new(subcommand)
         .print_build_logs(true)
-                .args(args.iter().cloned())
+        .args_ref(args)
         .env("NIXPKGS_ALLOW_BROKEN", "1")
         .impure(true);
       if interactive {
@@ -275,7 +290,9 @@ pub fn handle_nix_with_retry(
   }
 
   // Otherwise, show the error and return error
-    std::io::stderr().write_all(&output.stderr)?;
+  std::io::stderr()
+    .write_all(&output.stderr)
+    .map_err(EhError::Io)?;
   Err(EhError::ProcessExit {
     code: output.status.code().unwrap_or(1),
   })
@@ -285,8 +302,11 @@ pub struct DefaultNixErrorClassifier;
 impl NixErrorClassifier for DefaultNixErrorClassifier {
   fn should_retry(&self, stderr: &str) -> bool {
     RegexHashExtractor.extract_hash(stderr).is_some()
-            || (stderr.contains("has an unfree license") && stderr.contains("refusing"))
-            || (stderr.contains("has been marked as insecure") && stderr.contains("refusing"))
-            || (stderr.contains("has been marked as broken") && stderr.contains("refusing"))
+      || (stderr.contains("has an unfree license")
+        && stderr.contains("refusing"))
+      || (stderr.contains("has been marked as insecure")
+        && stderr.contains("refusing"))
+      || (stderr.contains("has been marked as broken")
+        && stderr.contains("refusing"))
   }
 }

eh/tests/basic.rs

@@ -1,178 +1,234 @@
-//! I hate writing tests, and I hate writing integration tests. This is the best
-//! that you are getting, deal with it.
-use std::process::{Command, Stdio};
+use std::{fs, process::Command};
+
+use eh::util::{
+  DefaultNixErrorClassifier,
+  DefaultNixFileFixer,
+  HashExtractor,
+  NixErrorClassifier,
+  NixFileFixer,
+  RegexHashExtractor,
+};
+use tempfile::TempDir;
 
 #[test]
-fn nix_eval_validation() {
-    // Test that invalid expressions are caught early for all commands
-    let commands = ["build", "run", "shell"];
+fn test_hash_extraction_from_real_nix_errors() {
+  // Test hash extraction from actual Nix error messages
+  let extractor = RegexHashExtractor;
 
-    for cmd in &commands {
-        let output = Command::new("timeout")
-            .args([
-                "10",
-                "cargo",
-                "run",
-                "--bin",
-                "eh",
-                "--",
-                cmd,
-                "invalid-flake-ref",
-            ])
-            .output()
-            .expect("Failed to execute command");
+  let test_cases = [
+    (
+      r#"error: hash mismatch in fixed-output derivation '/nix/store/xxx-foo.drv':
+  specified: sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
+       got:    sha256-BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB="#,
+      Some("sha256-BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB=".to_string()),
+    ),
+    (
+      "actual: sha256-abc123def456",
+      Some("sha256-abc123def456".to_string()),
+    ),
+    ("have: sha256-xyz789", Some("sha256-xyz789".to_string())),
+    ("no hash here", None),
+  ];
 
-        // Should fail fast with eval error
-        let stderr = String::from_utf8_lossy(&output.stderr);
-        assert!(stderr.contains("Error: Expression evaluation failed") || !output.status.success());
+  for (input, expected) in test_cases {
+    assert_eq!(extractor.extract_hash(input), expected);
   }
 }
 
 #[test]
-fn unfree_package_handling() {
-    // Test that unfree packages are detected and handled correctly
+fn test_error_classification_for_retry_logic() {
+  // Test that the classifier correctly identifies errors that should be retried
+  let classifier = DefaultNixErrorClassifier;
+
+  // These should trigger retries
+  let retry_cases = [
+    "Package 'discord-1.0.0' has an unfree license ('unfree'), refusing to \
+     evaluate.",
+    "Package 'openssl-1.1.1' has been marked as insecure, refusing to \
+     evaluate.",
+    "Package 'broken-1.0' has been marked as broken, refusing to evaluate.",
+    "hash mismatch in fixed-output derivation\ngot: sha256-newhash",
+  ];
+
+  for error in retry_cases {
+    assert!(classifier.should_retry(error), "Should retry: {}", error);
+  }
+
+  // These should NOT trigger retries
+  let no_retry_cases = [
+    "build failed",
+    "random error",
+    "permission denied",
+    "network error",
+  ];
+
+  for error in no_retry_cases {
+    assert!(
+      !classifier.should_retry(error),
+      "Should not retry: {}",
+      error
+    );
+  }
+}
+
+#[test]
+fn test_hash_fixing_in_nix_files() {
+  // Test that hash fixing actually works on real Nix files
+  let temp_dir = TempDir::new().expect("Failed to create temp dir");
+  let fixer = DefaultNixFileFixer;
+
+  // Create a mock Nix file with various hash formats
+  let nix_content = r#"
+stdenv.mkDerivation {
+  name = "test-package";
+  src = fetchurl {
+    url = "https://example.com.tar.gz";
+    hash = "sha256-oldhash123";
+  };
+
+  buildInputs = [ fetchurl {
+    url = "https://deps.com.tar.gz";
+    sha256 = "sha256-oldhash456";
+  }];
+
+  outputHash = "sha256-oldhash789";
+}
+"#;
+
+  let file_path = temp_dir.path().join("test.nix");
+  fs::write(&file_path, nix_content).expect("Failed to write test file");
+
+  // Test hash replacement
+  let new_hash = "sha256-newhashabc";
+  let was_fixed = fixer
+    .fix_hash_in_file(&file_path, new_hash)
+    .expect("Failed to fix hash");
+
+  assert!(was_fixed, "File should have been modified");
+
+  let updated_content =
+    fs::read_to_string(&file_path).expect("Failed to read updated file");
+
+  // All hash formats should be updated
+  assert!(updated_content.contains(&format!(r#"hash = "{}""#, new_hash)));
+  assert!(updated_content.contains(&format!(r#"sha256 = "{}""#, new_hash)));
+  assert!(updated_content.contains(&format!(r#"outputHash = "{}""#, new_hash)));
+
+  // Old hashes should be gone
+  assert!(!updated_content.contains("oldhash123"));
+  assert!(!updated_content.contains("oldhash456"));
+  assert!(!updated_content.contains("oldhash789"));
+}
+
+#[test]
+fn test_multicall_binary_dispatch() {
+  // Test that multicall binaries work without needing actual Nix evaluation
+  let commands = [("nb", "build"), ("nr", "run"), ("ns", "shell")];
+
+  for (binary_name, _expected_command) in &commands {
+    // Test that the binary starts and handles invalid arguments gracefully
+    let output = Command::new("timeout")
+      .args(["5", "cargo", "run", "--bin", "eh", "--"])
+      .env("CARGO_BIN_NAME", binary_name)
+      .arg("invalid-package-ref")
+      .output()
+      .expect("Failed to execute command");
+
+    // Should fail gracefully (not panic or hang)
+    assert!(
+      output.status.code().is_some(),
+      "{} should exit with a code",
+      binary_name
+    );
+
+    // Should show an error message, not crash
+    let stderr = String::from_utf8_lossy(&output.stderr);
+    assert!(
+      stderr.contains("Error:")
+        || stderr.contains("error:")
+        || stderr.contains("failed"),
+      "{} should show error for invalid package",
+      binary_name
+    );
+  }
+}
+
+#[test]
+fn test_invalid_expression_handling() {
+  // Test that invalid Nix expressions fail fast with proper error messages
+  let invalid_refs = [
+    "invalid-flake-ref",
+    "nonexistent-package",
+    "file:///nonexistent/path",
+  ];
+
+  for invalid_ref in invalid_refs {
     let output = Command::new("timeout")
       .args([
-            "30",
+        "10",
         "cargo",
         "run",
         "--bin",
         "eh",
         "--",
         "build",
-            "nixpkgs#discord",
+        invalid_ref,
       ])
       .output()
       .expect("Failed to execute command");
 
-    let stderr = String::from_utf8_lossy(&output.stderr);
-    let stdout = String::from_utf8_lossy(&output.stdout);
-    let combined = format!("{}{}", stdout, stderr);
-
-    // Should detect unfree package and show appropriate message
+    // Should fail with a proper error, not hang or crash
     assert!(
-        combined.contains("has an unfree license")
-            || combined.contains("NIXPKGS_ALLOW_UNFREE")
-            || combined.contains("⚠ Unfree package detected")
+      !output.status.success(),
+      "Invalid ref '{}' should fail",
+      invalid_ref
     );
-}
 
-#[test]
-fn insecure_package_handling() {
-    // Test that error classification works for insecure packages
-    use eh::util::{DefaultNixErrorClassifier, NixErrorClassifier};
-
-    let classifier = DefaultNixErrorClassifier;
-    let stderr_insecure =
-        "Package 'example-1.0' has been marked as insecure, refusing to evaluate.";
-
-    assert!(classifier.should_retry(stderr_insecure));
-}
-
-#[test]
-fn broken_package_handling() {
-    // Test that error classification works for broken packages
-    use eh::util::{DefaultNixErrorClassifier, NixErrorClassifier};
-
-    let classifier = DefaultNixErrorClassifier;
-    let stderr_broken = "Package 'example-1.0' has been marked as broken, refusing to evaluate.";
-
-    assert!(classifier.should_retry(stderr_broken));
-}
-
-#[test]
-fn multicall_binary_dispatch() {
-    // Test that nb/nr/ns dispatch correctly based on binary name
-    let commands = [("nb", "build"), ("nr", "run"), ("ns", "shell")];
-
-    for (binary_name, _expected_cmd) in &commands {
-        let output = Command::new("timeout")
-            .args(["10", "cargo", "run", "--bin", "eh"])
-            .env("CARGO_BIN_NAME", binary_name)
-            .arg("nixpkgs#hello")
-            .arg("--help") // Use help to avoid actually building
-            .output()
-            .expect("Failed to execute command");
-
-        // Should execute without panicking (status code may vary)
-        assert!(output.status.code().is_some());
+    let stderr = String::from_utf8_lossy(&output.stderr);
+    assert!(
+      stderr.contains("Error:")
+        || stderr.contains("error:")
+        || stderr.contains("failed"),
+      "Should show error message for invalid ref '{}': {}",
+      invalid_ref,
+      stderr
+    );
   }
 }
 
 #[test]
-fn interactive_mode_inheritance() {
-    // Test that run commands inherit stdio properly
-    let mut child = Command::new("timeout")
-        .args([
-            "10",
-            "cargo",
-            "run",
-            "--bin",
-            "eh",
-            "--",
-            "run",
-            "nixpkgs#echo",
-            "test",
-        ])
-        .stdin(Stdio::piped())
-        .stdout(Stdio::piped())
-        .stderr(Stdio::piped())
-        .spawn()
-        .expect("Failed to spawn command");
+fn test_nix_file_discovery() {
+  // Test that the fixer can find Nix files in a directory structure
+  let temp_dir = TempDir::new().expect("Failed to create temp dir");
+  let fixer = DefaultNixFileFixer;
 
-    let status = child.wait().expect("Failed to wait for child");
+  // Create directory structure with Nix files
+  fs::create_dir_all(temp_dir.path().join("subdir"))
+    .expect("Failed to create subdir");
 
-    // Should complete without hanging
-    assert!(status.code().is_some());
-}
-
-#[test]
-fn hash_extraction() {
-    use eh::util::{HashExtractor, RegexHashExtractor};
-
-    let extractor = RegexHashExtractor;
-    let stderr = "error: hash mismatch in fixed-output derivation '/nix/store/...':
-         specified: sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-            got:    sha256-BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB=";
-
-    let hash = extractor.extract_hash(stderr);
-    assert!(hash.is_some());
-    assert_eq!(
-        hash.unwrap(),
-        "sha256-BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB="
-    );
-}
-
-#[test]
-fn error_classification() {
-    use eh::util::{DefaultNixErrorClassifier, NixErrorClassifier};
-
-    let classifier = DefaultNixErrorClassifier;
-
-    assert!(classifier.should_retry("has an unfree license ('unfree'), refusing to evaluate"));
-    assert!(classifier.should_retry("has been marked as insecure, refusing to evaluate"));
-    assert!(classifier.should_retry("has been marked as broken, refusing to evaluate"));
-    assert!(!classifier.should_retry("random build error"));
-}
-
-#[test]
-fn hash_mismatch_auto_fix() {
-    // Test that hash mismatches are automatically detected and fixed
-    // This is harder to test without creating actual files, so we test the regex
-    // for the time being. Alternatively I could do this inside a temporary directory
-    // but cba for now.
-    use eh::util::{HashExtractor, RegexHashExtractor};
-
-    let extractor = RegexHashExtractor;
-    let stderr_with_mismatch = r#"
-error: hash mismatch in fixed-output derivation
-  specified: sha256-oldhashaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa=
-       got: sha256-newhashbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb=
-"#;
-
-    let extracted = extractor.extract_hash(stderr_with_mismatch);
-    assert_eq!(
-        extracted,
-        Some("sha256-newhashbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb=".to_string())
-    );
+  let files = [
+    ("test.nix", "stdenv.mkDerivation { name = \"test\"; }"),
+    ("subdir/other.nix", "pkgs.hello"),
+    ("not-nix.txt", "not a nix file"),
+    ("default.nix", "import ./test.nix"),
+  ];
+
+  for (path, content) in files {
+    fs::write(temp_dir.path().join(path), content)
+      .expect("Failed to write file");
+  }
+
+  // Change to temp dir for file discovery
+  let original_dir =
+    std::env::current_dir().expect("Failed to get current dir");
+  std::env::set_current_dir(temp_dir.path())
+    .expect("Failed to change directory");
+
+  let found_files = fixer.find_nix_files().expect("Failed to find Nix files");
+
+  // Should find 3 .nix files (not the .txt file)
+  assert_eq!(found_files.len(), 3, "Should find exactly 3 .nix files");
+
+  // Restore original directory
+  std::env::set_current_dir(original_dir).expect("Failed to restore directory");
 }

nix/shell.nix

@@ -1,22 +1,26 @@
 {
   mkShell,
-  rust-analyzer,
+  rustc,
+  cargo,
   rustfmt,
   clippy,
-  cargo,
   taplo,
+  rust-analyzer-unwrapped,
   rustPlatform,
 }:
 mkShell {
   name = "rust";
+
   packages = [
-    rust-analyzer
-    rustfmt
-    clippy
+    rustc
     cargo
 
+    (rustfmt.override {asNightly = true;})
+    clippy
+    cargo
     taplo
+    rust-analyzer-unwrapped
   ];
 
-  RUST_SRC_PATH = "${rustPlatform.rustLibSrc}";
+  env.RUST_SRC_PATH = "${rustPlatform.rustLibSrc}";
 }

xtask/src/main.rs

@@ -1,5 +1,6 @@
 use std::{
-    error, fs,
+  error,
+  fs,
   path::{Path, PathBuf},
   process,
 };
@@ -65,13 +66,13 @@ fn main() {
         eprintln!("error creating multicall binaries: {error}");
         process::exit(1);
       }
-        }
+    },
     Command::Completions { shell, output_dir } => {
       if let Err(error) = generate_completions(shell, &output_dir) {
         eprintln!("error generating completions: {error}");
         process::exit(1);
       }
-        }
+    },
   }
 }
 
@@ -84,7 +85,9 @@ fn create_multicall_binaries(
   fs::create_dir_all(bin_dir)?;
 
   if !main_binary.exists() {
-        return Err(format!("main binary not found at: {}", main_binary.display()).into());
+    return Err(
+      format!("main binary not found at: {}", main_binary.display()).into(),
+    );
   }
 
   let multicall_binaries = [Binary::Nr, Binary::Ns, Binary::Nb];
@@ -97,15 +100,7 @@ fn create_multicall_binaries(
       fs::remove_file(&target_path)?;
     }
 
-        match fs::hard_link(main_binary, &target_path) {
-            Ok(()) => {
-                println!(
-                    "  created hardlink: {} points to {}",
-                    target_path.display(),
-                    main_binary.display(),
-                );
-            }
-            Err(e) => {
+    if let Err(e) = fs::hard_link(main_binary, &target_path) {
       eprintln!(
         "  warning: could not create hardlink for {}: {e}",
         binary.name(),
@@ -123,7 +118,12 @@ fn create_multicall_binaries(
       }
 
       println!("  created copy: {}", target_path.display());
-            }
+    } else {
+      println!(
+        "  created hardlink: {} points to {}",
+        target_path.display(),
+        main_binary.display(),
+      );
     }
   }
 
@@ -134,7 +134,10 @@ fn create_multicall_binaries(
   Ok(())
 }
 
-fn generate_completions(shell: Shell, output_dir: &Path) -> Result<(), Box<dyn error::Error>> {
+fn generate_completions(
+  shell: Shell,
+  output_dir: &Path,
+) -> Result<(), Box<dyn error::Error>> {
   println!("generating {shell} completions...");
 
   fs::create_dir_all(output_dir)?;