[mikeland73]

Implements Tier 3 items 12, 14, 16 and the first cleanup in item 17 of specs/perf-improvements.md.

Changes

• Item 12: parallel resolve in devbox update. updatePendingPackages now resolves packages in a bounded errgroup (8 at a time), then merges lockfile entries serially in input order. Error handling is unchanged: flake refs warn and continue, versioned packages abort.

• Item 14: --refresh only for changed packages. updatePendingPackages returns the packages whose lockfile entry actually changed, and only those go into packagesBeingUpdated. installNixPackagesToStore groups builds by allow-insecure and refresh, so --refresh applies only to changed packages. Unchanged packages are built only if they're missing from the store.

• Item 16: one recompute in Add / Update. New config-only helpers addToConfig and removeFromConfig. Add replacing a package with the same canonical name no longer calls Remove, which ran its own ensureStateIsUpToDate. Update migrating legacy packages no longer calls Remove + Add per package. Each command now runs ensureStateIsUpToDate once at the end.

• Item 17: remove nix.FlakeUpdate. It isn't needed:

  • Every generated flake input is a locked ref from devbox.lock (Stdenv and each flake's Resolved).
  • makeFlakeFile deletes flake.lock whenever flake.nix changes.
  • The call ran after the environment was already built and computed, and errors were ignored.
  • add/install never ran it.

  internal/nix/flake_update.go is deleted.

Behavior notes

• In Update, a legacy package migration now saves devbox.json only after the whole update succeeds. Before, it was saved per package, before the lockfile update ran.

Testing

• go test ./internal/devbox/... ./internal/lock/... ./internal/nix/... passes. The new tests also pass under -race.
• New unit tests for resolveAndMergePackages: it returns only changed packages, a flake failure warns and continues, a versioned failure aborts, and unversioned packages are skipped.
• Testscripts update, update_flake_local, add, add_replace, add_platforms and global_add pass locally.
• update.test.txt now runs a second devbox update and asserts it reports "Already up-to-date" and installs nothing.

🤖 Generated with Claude Code

[claude]

Code review

No issues found. Checked for bugs and CLAUDE.md compliance.

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; the previous findings are fixed and no new actionable issues were found.

Summary

This PR speeds up package updates:

• Package updates resolve together and refresh only changed lock entries.
• Adding and updating packages now syncs staged config changes together.

All three previous findings are addressed. RunXRegistry now locks initialization. Legacy fallback replacements explicitly drop their old lock entries. Ordinary removal preserves pins still needed by includes. No new actionable issues were found in the changes since the previous review.

_{Reviews (3) · Last reviewed commit: "refactor(update): extract migrateLegacyP..." · Reviewed by Greptile}

[mikeland73]

@greptileai please re-review. Both P1 findings are addressed in 30b254d ("fix(update): guard runx registry init, drop lock entry on config remove"): the runx registry init is now mutex-guarded, and removeFromConfig drops the removed package's lock entry.

---

_{Written by Claude on behalf of / prompted by @mikeland73.}

[mikeland73]

@greptileai please re-review. All CI checks are green on 3e8b648. The removal-pin finding is addressed in d737261: removeFromConfig no longer touches the lockfile, and the entry is forgotten only on a same-name replacement. 3e8b648 extracts migrateLegacyPackages to satisfy the lint complexity limit.

---

_{Written by Claude on behalf of / prompted by @mikeland73.}