Unfree license error should suggest `allow_unfree: true` in devenv.yaml

[domenkozar]

Context

Surfaced by a comment on #2820: enabling an unfree package (e.g. pkgs.terraform) without allow_unfree: true produces a Nixpkgs-generic error that lists Nix and NixOS mitigations but not the devenv way to fix it.

#2849 makes the message visible at the top of the diagnostic instead of buried under the trace, but the message content itself doesn't mention devenv.

Reproduction

devenv.nix:

{ pkgs, lib, config, inputs, ... }:
{
  packages = [ pkgs.terraform ];
}

devenv shell prints:

× Failed to get drvPath from shell derivation: error: Refusing to evaluate package 'terraform-1.15.2' in /nix/store/.../terraform/default.nix:85 because it has an unfree license ('bsl11')
  a) To temporarily allow unfree packages, you can use an environment variable
     for a single invocation of the nix tools.

       $ export NIXPKGS_ALLOW_UNFREE=1

     Note: When using `nix shell`, `nix build`, `nix develop`, etc with a flake,
           then pass `--impure` in order to allow use of environment variables.

  b) For `nixos-rebuild` you can set
    { nixpkgs.config.allowUnfree = true; }
  in configuration.nix to override this.

  Alternatively you can configure a predicate to allow specific packages: …

What's missing

For a devenv user, the canonical fix is one of:

• allow_unfree: true in devenv.yaml
• permitted_unfree_packages: ["terraform"] (if supported as predicate equivalent)

Neither appears in the message. The reporter on #2820 had to add themselves to trusted-users (a NixOS-level workaround) to even see the error, then figure out the devenv option separately.

Proposed direction

Two plausible approaches, both worth weighing:

1. Catch the unfree throw at the nixpkgs config layer. Set nixpkgs.config.allowUnfreePredicate (or extend whatever devenv already wires) to a predicate that throws a devenv-shaped message naming allow_unfree: true and the package's pname. Stays in Nix, runs before the standard error fires.
2. Post-process the error text in devenv-nix-backend. Detect the Refusing to evaluate package … because it has an unfree license pattern in the error: … paragraph and append a help: hint pointing at allow_unfree. Stays in Rust, but couples to Nixpkgs' error wording.

(1) is more durable. (2) is faster to ship and could land first if (1) needs more design.

Out of scope

Rendering. #2849 already moved the actionable text from line ~120 to line 2.

Related

• unhelpful error message on syntax error #2820 (issue this surfaced through)
• Surface actionable Nix error above show-trace frames #2849 (PR fixing the rendering side)