style(3p/nix): Add braces around single-line for-loops r/772

These were not caught by the previous clang-tidy invocation, but were
instead sorted out using amber[0] as such:

    ambr --regex 'for (\(.+\))\s([a-z].*;)' 'for $1 { $2 }'

[0]: https://github.com/dalance/amber

45 files changed, 426 insertions, 142 deletions

diff --git a/third_party/nix/src/libexpr/attr-set.hh b/third_party/nix/src/libexpr/attr-set.hh
index 74a41a7e5d..c62c3c690d 100644
--- a/third_party/nix/src/libexpr/attr-set.hh
+++ b/third_party/nix/src/libexpr/attr-set.hh
@@ -70,7 +70,9 @@ class Bindings {
   std::vector<const Attr*> lexicographicOrder() const {
     std::vector<const Attr*> res;
     res.reserve(size_);
-    for (size_t n = 0; n < size_; n++) res.emplace_back(&attrs[n]);
+    for (size_t n = 0; n < size_; n++) {
+      res.emplace_back(&attrs[n]);
+    }
     std::sort(res.begin(), res.end(), [](const Attr* a, const Attr* b) {
       return (const string&)a->name < (const string&)b->name;
     });
diff --git a/third_party/nix/src/libexpr/eval.cc b/third_party/nix/src/libexpr/eval.cc
index a1965e0805..0ceb4d750b 100644
--- a/third_party/nix/src/libexpr/eval.cc
+++ b/third_party/nix/src/libexpr/eval.cc
@@ -334,8 +334,12 @@ EvalState::EvalState(const Strings& _searchPath, ref<Store> store)
   /* Initialise the Nix expression search path. */
   if (!evalSettings.pureEval) {
     Strings paths = parseNixPath(getEnv("NIX_PATH", ""));
-    for (auto& i : _searchPath) addToSearchPath(i);
-    for (auto& i : paths) addToSearchPath(i);
+    for (auto& i : _searchPath) {
+      addToSearchPath(i);
+    }
+    for (auto& i : paths) {
+      addToSearchPath(i);
+    }
   }
   addToSearchPath("nix=" +
                   canonPath(settings.nixDataDir + "/nix/corepkgs", true));
@@ -354,7 +358,9 @@ EvalState::EvalState(const Strings& _searchPath, ref<Store> store)
       if (store->isInStore(r.second)) {
         PathSet closure;
         store->computeFSClosure(store->toStorePath(r.second), closure);
-        for (auto& path : closure) allowedPaths->insert(path);
+        for (auto& path : closure) {
+          allowedPaths->insert(path);
+        }
       } else
         allowedPaths->insert(r.second);
     }
@@ -558,7 +564,9 @@ Value& mkString(Value& v, const string& s, const PathSet& context) {
     size_t n = 0;
     v.string.context =
         (const char**)allocBytes((context.size() + 1) * sizeof(char*));
-    for (auto& i : context) v.string.context[n++] = dupString(i.c_str());
+    for (auto& i : context) {
+      v.string.context[n++] = dupString(i.c_str());
+    }
     v.string.context[n] = 0;
   }
   return v;
@@ -1415,7 +1423,9 @@ void EvalState::forceValueDeep(Value& v) {
           throw;
         }
     } else if (v.isList()) {
-      for (size_t n = 0; n < v.listSize(); ++n) recurse(*v.listElems()[n]);
+      for (size_t n = 0; n < v.listSize(); ++n) {
+        recurse(*v.listElems()[n]);
+      }
     }
   };
 
@@ -1477,7 +1487,9 @@ string EvalState::forceString(Value& v, const Pos& pos) {
 
 void copyContext(const Value& v, PathSet& context) {
   if (v.string.context)
-    for (const char** p = v.string.context; *p; ++p) context.insert(*p);
+    for (const char** p = v.string.context; *p; ++p) {
+      context.insert(*p);
+    }
 }
 
 string EvalState::forceString(Value& v, PathSet& context, const Pos& pos) {
@@ -1807,7 +1819,9 @@ void EvalState::printStats() {
     if (countCalls) {
       {
         auto obj = topObj.object("primops");
-        for (auto& i : primOpCalls) obj.attr(i.first, i.second);
+        for (auto& i : primOpCalls) {
+          obj.attr(i.first, i.second);
+        }
       }
       {
         auto list = topObj.list("functions");
@@ -1872,7 +1886,9 @@ size_t valueSize(Value& v) {
       case tString:
         sz += doString(v.string.s);
         if (v.string.context)
-          for (const char** p = v.string.context; *p; ++p) sz += doString(*p);
+          for (const char** p = v.string.context; *p; ++p) {
+            sz += doString(*p);
+          }
         break;
       case tPath:
         sz += doString(v.path);
@@ -1881,7 +1897,9 @@ size_t valueSize(Value& v) {
         if (seen.find(v.attrs) == seen.end()) {
           seen.insert(v.attrs);
           sz += sizeof(Bindings) + sizeof(Attr) * v.attrs->capacity();
-          for (auto& i : *v.attrs) sz += doValue(*i.value);
+          for (auto& i : *v.attrs) {
+            sz += doValue(*i.value);
+          }
         }
         break;
       case tList1:
diff --git a/third_party/nix/src/libexpr/get-drvs.cc b/third_party/nix/src/libexpr/get-drvs.cc
index ccbb09951f..8897db4be9 100644
--- a/third_party/nix/src/libexpr/get-drvs.cc
+++ b/third_party/nix/src/libexpr/get-drvs.cc
@@ -171,7 +171,9 @@ StringSet DrvInfo::queryMetaNames() {
   if (!getMeta()) {
     return res;
   }
-  for (auto& i : *meta) res.insert(i.name);
+  for (auto& i : *meta) {
+    res.insert(i.name);
+  }
   return res;
 }
 
diff --git a/third_party/nix/src/libexpr/json-to-value.cc b/third_party/nix/src/libexpr/json-to-value.cc
index a7d9c4904c..51d001d8a5 100644
--- a/third_party/nix/src/libexpr/json-to-value.cc
+++ b/third_party/nix/src/libexpr/json-to-value.cc
@@ -82,7 +82,9 @@ static void parseJSON(EvalState& state, const char*& s, Value& v) {
     }
     s++;
     state.mkList(v, values.size());
-    for (size_t n = 0; n < values.size(); ++n) v.listElems()[n] = values[n];
+    for (size_t n = 0; n < values.size(); ++n) {
+      v.listElems()[n] = values[n];
+    }
   }
 
   else if (*s == '{') {
@@ -111,7 +113,9 @@ static void parseJSON(EvalState& state, const char*& s, Value& v) {
       s++;
     }
     state.mkAttrs(v, attrs.size());
-    for (auto& i : attrs) v.attrs->push_back(Attr(i.first, i.second));
+    for (auto& i : attrs) {
+      v.attrs->push_back(Attr(i.first, i.second));
+    }
     v.attrs->sort();
     s++;
   }
diff --git a/third_party/nix/src/libexpr/names.cc b/third_party/nix/src/libexpr/names.cc
index 92bd06308c..f83ed9fe64 100644
--- a/third_party/nix/src/libexpr/names.cc
+++ b/third_party/nix/src/libexpr/names.cc
@@ -99,7 +99,9 @@ int compareVersions(const string& v1, const string& v2) {
 
 DrvNames drvNamesFromArgs(const Strings& opArgs) {
   DrvNames result;
-  for (auto& i : opArgs) result.push_back(DrvName(i));
+  for (auto& i : opArgs) {
+    result.push_back(DrvName(i));
+  }
   return result;
 }
 
diff --git a/third_party/nix/src/libexpr/nixexpr.cc b/third_party/nix/src/libexpr/nixexpr.cc
index 4c0536f35c..bd171f8166 100644
--- a/third_party/nix/src/libexpr/nixexpr.cc
+++ b/third_party/nix/src/libexpr/nixexpr.cc
@@ -97,7 +97,9 @@ void ExprAttrs::show(std::ostream& str) const {
 
 void ExprList::show(std::ostream& str) const {
   str << "[ ";
-  for (auto& i : elems) str << "(" << *i << ") ";
+  for (auto& i : elems) {
+    str << "(" << *i << ") ";
+  }
   str << "]";
 }
 
@@ -294,7 +296,9 @@ void ExprAttrs::bindVars(const StaticEnv& env) {
 }
 
 void ExprList::bindVars(const StaticEnv& env) {
-  for (auto& i : elems) i->bindVars(env);
+  for (auto& i : elems) {
+    i->bindVars(env);
+  }
 }
 
 void ExprLambda::bindVars(const StaticEnv& env) {
@@ -324,7 +328,9 @@ void ExprLet::bindVars(const StaticEnv& env) {
   StaticEnv newEnv(false, &env);
 
   unsigned int displ = 0;
-  for (auto& i : attrs->attrs) newEnv.vars[i.first] = i.second.displ = displ++;
+  for (auto& i : attrs->attrs) {
+    newEnv.vars[i.first] = i.second.displ = displ++;
+  }
 
   for (auto& i : attrs->attrs)
     i.second.e->bindVars(i.second.inherited ? env : newEnv);
@@ -365,7 +371,9 @@ void ExprAssert::bindVars(const StaticEnv& env) {
 void ExprOpNot::bindVars(const StaticEnv& env) { e->bindVars(env); }
 
 void ExprConcatStrings::bindVars(const StaticEnv& env) {
-  for (auto& i : *es) i->bindVars(env);
+  for (auto& i : *es) {
+    i->bindVars(env);
+  }
 }
 
 void ExprPos::bindVars(const StaticEnv& env) {}
@@ -389,7 +397,9 @@ string ExprLambda::showNamePos() const {
 
 size_t SymbolTable::totalSize() const {
   size_t n = 0;
-  for (auto& i : symbols) n += i.size();
+  for (auto& i : symbols) {
+    n += i.size();
+  }
   return n;
 }
 
diff --git a/third_party/nix/src/libexpr/primops.cc b/third_party/nix/src/libexpr/primops.cc
index dfcfdeae43..850d17a8f4 100644
--- a/third_party/nix/src/libexpr/primops.cc
+++ b/third_party/nix/src/libexpr/primops.cc
@@ -442,7 +442,9 @@ static void prim_genericClosure(EvalState& state, const Pos& pos, Value** args,
   /* Create the result list. */
   state.mkList(v, res.size());
   unsigned int n = 0;
-  for (auto& i : res) v.listElems()[n++] = i;
+  for (auto& i : res) {
+    v.listElems()[n++] = i;
+  }
 }
 
 static void prim_abort(EvalState& state, const Pos& pos, Value** args,
@@ -2061,7 +2063,9 @@ static void prim_replaceStrings(EvalState& state, const Pos& pos, Value** args,
         } else {
           p += i->size();
         }
-        for (auto& path : j->second) context.insert(path);
+        for (auto& path : j->second) {
+          context.insert(path);
+        }
         j->second.clear();
         break;
       }
diff --git a/third_party/nix/src/libexpr/primops/context.cc b/third_party/nix/src/libexpr/primops/context.cc
index 1ae3219f2c..347b7a0a52 100644
--- a/third_party/nix/src/libexpr/primops/context.cc
+++ b/third_party/nix/src/libexpr/primops/context.cc
@@ -35,7 +35,9 @@ static void prim_unsafeDiscardOutputDependency(EvalState& state, const Pos& pos,
   string s = state.coerceToString(pos, *args[0], context);
 
   PathSet context2;
-  for (auto& p : context) context2.insert(p.at(0) == '=' ? string(p, 1) : p);
+  for (auto& p : context) {
+    context2.insert(p.at(0) == '=' ? string(p, 1) : p);
+  }
 
   mkString(v, s, context2);
 }
diff --git a/third_party/nix/src/libexpr/symbol-table.hh b/third_party/nix/src/libexpr/symbol-table.hh
index 61a43ab978..8c27cf8ec7 100644
--- a/third_party/nix/src/libexpr/symbol-table.hh
+++ b/third_party/nix/src/libexpr/symbol-table.hh
@@ -54,7 +54,9 @@ class SymbolTable {
 
   template <typename T>
   void dump(T callback) {
-    for (auto& s : symbols) callback(s);
+    for (auto& s : symbols) {
+      callback(s);
+    }
   }
 };
 
diff --git a/third_party/nix/src/libexpr/value-to-json.cc b/third_party/nix/src/libexpr/value-to-json.cc
index 3da47dc2f8..e4f1c28537 100644
--- a/third_party/nix/src/libexpr/value-to-json.cc
+++ b/third_party/nix/src/libexpr/value-to-json.cc
@@ -50,7 +50,9 @@ void printValueAsJSON(EvalState& state, bool strict, Value& v,
       if (i == v.attrs->end()) {
         auto obj(out.object());
         StringSet names;
-        for (auto& j : *v.attrs) names.insert(j.name);
+        for (auto& j : *v.attrs) {
+          names.insert(j.name);
+        }
         for (auto& j : names) {
           Attr& a(*v.attrs->find(state.symbols.create(j)));
           auto placeholder(obj.placeholder(j));
diff --git a/third_party/nix/src/libexpr/value-to-xml.cc b/third_party/nix/src/libexpr/value-to-xml.cc
index 0e955c4ce2..a03924aa63 100644
--- a/third_party/nix/src/libexpr/value-to-xml.cc
+++ b/third_party/nix/src/libexpr/value-to-xml.cc
@@ -29,7 +29,9 @@ static void showAttrs(EvalState& state, bool strict, bool location,
                       PathSet& drvsSeen) {
   StringSet names;
 
-  for (auto& i : attrs) names.insert(i.name);
+  for (auto& i : attrs) {
+    names.insert(i.name);
+  }
 
   for (auto& i : names) {
     Attr& a(*attrs.find(state.symbols.create(i)));
diff --git a/third_party/nix/src/libstore/build.cc b/third_party/nix/src/libstore/build.cc
index ff13271e66..7aa44b4755 100644
--- a/third_party/nix/src/libstore/build.cc
+++ b/third_party/nix/src/libstore/build.cc
@@ -1122,7 +1122,9 @@ void DerivationGoal::haveDerivation() {
 
   retrySubstitution = false;
 
-  for (auto& i : drv->outputs) worker.store.addTempRoot(i.second.path);
+  for (auto& i : drv->outputs) {
+    worker.store.addTempRoot(i.second.path);
+  }
 
   /* Check what outputs paths are not already valid. */
   PathSet invalidOutputs = checkPathValidity(false, buildMode == bmRepair);
@@ -1238,7 +1240,9 @@ void DerivationGoal::repairClosure() {
   }
 
   /* Filter out our own outputs (which we have already checked). */
-  for (auto& i : drv->outputs) outputClosure.erase(i.second.path);
+  for (auto& i : drv->outputs) {
+    outputClosure.erase(i.second.path);
+  }
 
   /* Get all dependencies of this derivation so that we know which
      derivation is responsible for which path in the output
@@ -1251,7 +1255,9 @@ void DerivationGoal::repairClosure() {
   for (auto& i : inputClosure)
     if (isDerivation(i)) {
       Derivation drv = worker.store.derivationFromPath(i);
-      for (auto& j : drv.outputs) outputsToDrv[j.second.path] = i;
+      for (auto& j : drv.outputs) {
+        outputsToDrv[j.second.path] = i;
+      }
     }
 
   /* Check each path (slow!). */
@@ -1389,7 +1395,9 @@ void DerivationGoal::tryToBuild() {
 
   missingPaths = drv->outputPaths();
   if (buildMode != bmCheck)
-    for (auto& i : validPaths) missingPaths.erase(i);
+    for (auto& i : validPaths) {
+      missingPaths.erase(i);
+    }
 
   /* If any of the outputs already exist but are not valid, delete
      them. */
@@ -1571,7 +1579,9 @@ MakeError(NotDeterministic, BuildError)
 
       if (!settings.verboseBuild && !logTail.empty()) {
         msg += (format("; last %d log lines:") % logTail.size()).str();
-        for (auto& line : logTail) msg += "\n  " + line;
+        for (auto& line : logTail) {
+          msg += "\n  " + line;
+        }
       }
 
       if (diskFull) {
@@ -1642,7 +1652,9 @@ MakeError(NotDeterministic, BuildError)
     }
 
     /* Delete unused redirected outputs (when doing hash rewriting). */
-    for (auto& i : redirectedOutputs) deletePath(i.second);
+    for (auto& i : redirectedOutputs) {
+      deletePath(i.second);
+    }
 
     /* Delete the chroot (if we were using one). */
     autoDelChroot.reset(); /* this runs the destructor */
@@ -1990,7 +2002,9 @@ void DerivationGoal::startBuilder() {
       } catch (Error& e) {
         throw Error(format("while processing 'sandbox-paths': %s") % e.what());
       }
-    for (auto& i : closure) dirsInChroot[i] = i;
+    for (auto& i : closure) {
+      dirsInChroot[i] = i;
+    }
 
     PathSet allowedPaths = settings.allowedImpureHostPrefixes;
 
@@ -2118,7 +2132,9 @@ void DerivationGoal::startBuilder() {
        rebuilding a path that is in settings.dirsInChroot
        (typically the dependencies of /bin/sh).  Throw them
        out. */
-    for (auto& i : drv->outputs) dirsInChroot.erase(i.second.path);
+    for (auto& i : drv->outputs) {
+      dirsInChroot.erase(i.second.path);
+    }
 
 #elif __APPLE__
     /* We don't really have any parent prep work to do (yet?)
@@ -2142,7 +2158,9 @@ void DerivationGoal::startBuilder() {
        contents of the new outputs to replace the dummy strings
        with the actual hashes. */
     if (validPaths.size() > 0)
-      for (auto& i : validPaths) addHashRewrite(i);
+      for (auto& i : validPaths) {
+        addHashRewrite(i);
+      }
 
     /* If we're repairing, then we don't want to delete the
        corrupt outputs in advance.  So rewrite them as well. */
@@ -2537,7 +2555,9 @@ void DerivationGoal::writeStructuredAttrs() {
       {
         JSONPlaceholder jsonRoot(str, true);
         PathSet storePaths;
-        for (auto& p : *i) storePaths.insert(p.get<std::string>());
+        for (auto& p : *i) {
+          storePaths.insert(p.get<std::string>());
+        }
         worker.store.pathInfoToJSON(jsonRoot, exportReferences(storePaths),
                                     false, true);
       }
@@ -2828,7 +2848,9 @@ void DerivationGoal::runChild() {
           ss.push_back("/var/run/nscd/socket");
       }
 
-      for (auto& i : ss) dirsInChroot.emplace(i, i);
+      for (auto& i : ss) {
+        dirsInChroot.emplace(i, i);
+      }
 
       /* Bind-mount all the directories from the "host"
          filesystem that we want in the chroot
@@ -3046,7 +3068,9 @@ void DerivationGoal::runChild() {
         }
 
         /* Add all our input paths to the chroot */
-        for (auto& i : inputPaths) dirsInChroot[i] = i;
+        for (auto& i : inputPaths) {
+          dirsInChroot[i] = i;
+        }
 
         /* Violations will go to the syslog if you set this. Unfortunately the
          * destination does not appear to be configurable */
@@ -3155,7 +3179,9 @@ void DerivationGoal::runChild() {
       args.push_back(builderBasename);
     }
 
-    for (auto& i : drv->args) args.push_back(rewriteStrings(i, inputRewrites));
+    for (auto& i : drv->args) {
+      args.push_back(rewriteStrings(i, inputRewrites));
+    }
 
     /* Indicate that we managed to set up the build environment. */
     writeFull(STDERR_FILENO, string("\1\n"));
@@ -3532,7 +3558,9 @@ void DerivationGoal::registerOutputs() {
      outputs, this will fail. */
   {
     ValidPathInfos infos2;
-    for (auto& i : infos) infos2.push_back(i.second);
+    for (auto& i : infos) {
+      infos2.push_back(i.second);
+    }
     worker.store.registerValidPaths(infos2);
   }
 
@@ -3579,11 +3607,15 @@ void DerivationGoal::checkOutputs(
         auto i = outputsByPath.find(path);
         if (i != outputsByPath.end()) {
           closureSize += i->second.narSize;
-          for (auto& ref : i->second.references) pathsLeft.push(ref);
+          for (auto& ref : i->second.references) {
+            pathsLeft.push(ref);
+          }
         } else {
           auto info = worker.store.queryPathInfo(path);
           closureSize += info->narSize;
-          for (auto& ref : info->references) pathsLeft.push(ref);
+          for (auto& ref : info->references) {
+            pathsLeft.push(ref);
+          }
         }
       }
 
@@ -4373,7 +4405,9 @@ void Worker::waitForAWhile(GoalPtr goal) {
 }
 
 void Worker::run(const Goals& _topGoals) {
-  for (auto& i : _topGoals) topGoals.insert(i);
+  for (auto& i : _topGoals) {
+    topGoals.insert(i);
+  }
 
   DLOG(INFO) << "entered goal loop";
 
diff --git a/third_party/nix/src/libstore/builtins/buildenv.cc b/third_party/nix/src/libstore/builtins/buildenv.cc
index e9a96a8cca..77ad722fab 100644
--- a/third_party/nix/src/libstore/builtins/buildenv.cc
+++ b/third_party/nix/src/libstore/builtins/buildenv.cc
@@ -210,7 +210,9 @@ void builtinBuildenv(const BasicDerivation& drv) {
   while (!postponed.empty()) {
     auto pkgDirs = postponed;
     postponed = FileProp{};
-    for (const auto& pkgDir : pkgDirs) addPkg(pkgDir, priorityCounter++);
+    for (const auto& pkgDir : pkgDirs) {
+      addPkg(pkgDir, priorityCounter++);
+    }
   }
 
   LOG(INFO) << "created " << symlinks << " symlinks in user environment";
diff --git a/third_party/nix/src/libstore/derivations.cc b/third_party/nix/src/libstore/derivations.cc
index 454f483d16..7a0de8f066 100644
--- a/third_party/nix/src/libstore/derivations.cc
+++ b/third_party/nix/src/libstore/derivations.cc
@@ -40,7 +40,9 @@ Path writeDerivation(ref<Store> store, const Derivation& drv,
                      const string& name, RepairFlag repair) {
   PathSet references;
   references.insert(drv.inputSrcs.begin(), drv.inputSrcs.end());
-  for (auto& i : drv.inputDrvs) references.insert(i.first);
+  for (auto& i : drv.inputDrvs) {
+    references.insert(i.first);
+  }
   /* Note that the outputs of a derivation are *not* references
      (that can be missing (of course) and should not necessarily be
      held during a garbage collection). */
@@ -359,7 +361,9 @@ bool wantOutput(const string& output, const std::set<string>& wanted) {
 
 PathSet BasicDerivation::outputPaths() const {
   PathSet paths;
-  for (auto& i : outputs) paths.insert(i.second.path);
+  for (auto& i : outputs) {
+    paths.insert(i.second.path);
+  }
   return paths;
 }
 
@@ -394,7 +398,9 @@ Sink& operator<<(Sink& out, const BasicDerivation& drv) {
     out << i.first << i.second.path << i.second.hashAlgo << i.second.hash;
   out << drv.inputSrcs << drv.platform << drv.builder << drv.args;
   out << drv.env.size();
-  for (auto& i : drv.env) out << i.first << i.second;
+  for (auto& i : drv.env) {
+    out << i.first << i.second;
+  }
   return out;
 }
 
diff --git a/third_party/nix/src/libstore/gc.cc b/third_party/nix/src/libstore/gc.cc
index 8e092f4814..c7f2a507d3 100644
--- a/third_party/nix/src/libstore/gc.cc
+++ b/third_party/nix/src/libstore/gc.cc
@@ -615,7 +615,9 @@ bool LocalStore::canReachRoot(GCState& state, PathSet& visited,
      are derivers of this path that are not garbage. */
   if (state.gcKeepOutputs) {
     PathSet derivers = queryValidDerivers(path);
-    for (auto& i : derivers) incoming.insert(i);
+    for (auto& i : derivers) {
+      incoming.insert(i);
+    }
   }
 
   for (auto& i : incoming)
@@ -775,7 +777,9 @@ void LocalStore::collectGarbage(const GCOptions& options, GCResults& results) {
   FDs fds;
   Roots tempRoots;
   findTempRoots(fds, tempRoots, true);
-  for (auto& root : tempRoots) state.tempRoots.insert(root.first);
+  for (auto& root : tempRoots) {
+    state.tempRoots.insert(root.first);
+  }
   state.roots.insert(state.tempRoots.begin(), state.tempRoots.end());
 
   /* After this point the set of roots or temporary roots cannot
@@ -852,7 +856,9 @@ void LocalStore::collectGarbage(const GCOptions& options, GCResults& results) {
       std::mt19937 gen(1);
       std::shuffle(entries_.begin(), entries_.end(), gen);
 
-      for (auto& i : entries_) tryToDelete(state, i);
+      for (auto& i : entries_) {
+        tryToDelete(state, i);
+      }
 
     } catch (GCLimitReached& e) {
     }
diff --git a/third_party/nix/src/libstore/globals.cc b/third_party/nix/src/libstore/globals.cc
index 4d502c0ade..19a0cde1ed 100644
--- a/third_party/nix/src/libstore/globals.cc
+++ b/third_party/nix/src/libstore/globals.cc
@@ -60,7 +60,9 @@ Settings::Settings()
   auto s = getEnv("NIX_REMOTE_SYSTEMS");
   if (s != "") {
     Strings ss;
-    for (auto& p : tokenizeString<Strings>(s, ":")) ss.push_back("@" + p);
+    for (auto& p : tokenizeString<Strings>(s, ":")) {
+      ss.push_back("@" + p);
+    }
     builders = concatStringsSep(" ", ss);
   }
 
diff --git a/third_party/nix/src/libstore/local-fs-store.cc b/third_party/nix/src/libstore/local-fs-store.cc
index c1efbb76d8..d9eaea2e93 100644
--- a/third_party/nix/src/libstore/local-fs-store.cc
+++ b/third_party/nix/src/libstore/local-fs-store.cc
@@ -48,7 +48,9 @@ struct LocalStoreAccessor : public FSAccessor {
     auto entries = nix::readDirectory(realPath);
 
     StringSet res;
-    for (auto& entry : entries) res.insert(entry.name);
+    for (auto& entry : entries) {
+      res.insert(entry.name);
+    }
 
     return res;
   }
diff --git a/third_party/nix/src/libstore/local-store.cc b/third_party/nix/src/libstore/local-store.cc
index 057bafd6f6..4c431b6b38 100644
--- a/third_party/nix/src/libstore/local-store.cc
+++ b/third_party/nix/src/libstore/local-store.cc
@@ -1227,7 +1227,9 @@ bool LocalStore::verifyStore(bool checkContents, RepairFlag repair) {
   AutoCloseFD fdGCLock = openGCLock(ltWrite);
 
   PathSet store;
-  for (auto& i : readDirectory(realStoreDir)) store.insert(i.name);
+  for (auto& i : readDirectory(realStoreDir)) {
+    store.insert(i.name);
+  }
 
   /* Check whether all valid paths actually exist. */
   LOG(INFO) << "checking path existence...";
@@ -1375,7 +1377,9 @@ static void makeMutable(const Path& path) {
   }
 
   if (S_ISDIR(st.st_mode)) {
-    for (auto& i : readDirectory(path)) makeMutable(path + "/" + i.name);
+    for (auto& i : readDirectory(path)) {
+      makeMutable(path + "/" + i.name);
+    }
   }
 
   /* The O_NOFOLLOW is important to prevent us from changing the
diff --git a/third_party/nix/src/libstore/misc.cc b/third_party/nix/src/libstore/misc.cc
index a907bcac97..daed88cdc9 100644
--- a/third_party/nix/src/libstore/misc.cc
+++ b/third_party/nix/src/libstore/misc.cc
@@ -53,7 +53,9 @@ void Store::computeFSClosure(const PathSet& startPaths, PathSet& paths_,
                 }
 
               if (includeOutputs)
-                for (auto& i : queryValidDerivers(path)) enqueue(i);
+                for (auto& i : queryValidDerivers(path)) {
+                  enqueue(i);
+                }
 
               if (includeDerivers && isDerivation(path))
                 for (auto& i : queryDerivationOutputs(path))
@@ -97,7 +99,9 @@ void Store::computeFSClosure(const PathSet& startPaths, PathSet& paths_,
         }});
   };
 
-  for (auto& startPath : startPaths) enqueue(startPath);
+  for (auto& startPath : startPaths) {
+    enqueue(startPath);
+  }
 
   {
     auto state(state_.lock());
@@ -251,7 +255,9 @@ void Store::queryMissing(const PathSet& targets, PathSet& willBuild_,
     }
   };
 
-  for (auto& path : targets) pool.enqueue(std::bind(doPath, path));
+  for (auto& path : targets) {
+    pool.enqueue(std::bind(doPath, path));
+  }
 
   pool.process();
 }
@@ -291,7 +297,9 @@ Paths Store::topoSortPaths(const PathSet& paths) {
     parents.erase(path);
   };
 
-  for (auto& i : paths) dfsVisit(i, nullptr);
+  for (auto& i : paths) {
+    dfsVisit(i, nullptr);
+  }
 
   return sorted;
 }
diff --git a/third_party/nix/src/libstore/nar-accessor.cc b/third_party/nix/src/libstore/nar-accessor.cc
index 0214561da4..8a57179ab3 100644
--- a/third_party/nix/src/libstore/nar-accessor.cc
+++ b/third_party/nix/src/libstore/nar-accessor.cc
@@ -178,7 +178,9 @@ struct NarAccessor : public FSAccessor {
                   path);
 
     StringSet res;
-    for (auto& child : i.children) res.insert(child.first);
+    for (auto& child : i.children) {
+      res.insert(child.first);
+    }
 
     return res;
   }
diff --git a/third_party/nix/src/libstore/nar-info.cc b/third_party/nix/src/libstore/nar-info.cc
index cbc922a7da..fa7d72c8ae 100644
--- a/third_party/nix/src/libstore/nar-info.cc
+++ b/third_party/nix/src/libstore/nar-info.cc
@@ -122,7 +122,9 @@ std::string NarInfo::to_string() const {
     res += "System: " + system + "\n";
   }
 
-  for (auto sig : sigs) res += "Sig: " + sig + "\n";
+  for (auto sig : sigs) {
+    res += "Sig: " + sig + "\n";
+  }
 
   if (!ca.empty()) {
     res += "CA: " + ca + "\n";
diff --git a/third_party/nix/src/libstore/optimise-store.cc b/third_party/nix/src/libstore/optimise-store.cc
index 450f31c59f..ad37190236 100644
--- a/third_party/nix/src/libstore/optimise-store.cc
+++ b/third_party/nix/src/libstore/optimise-store.cc
@@ -115,7 +115,9 @@ void LocalStore::optimisePath_(OptimiseStats& stats, const Path& path,
 
   if (S_ISDIR(st.st_mode)) {
     Strings names = readDirectoryIgnoringInodes(path, inodeHash);
-    for (auto& i : names) optimisePath_(stats, path + "/" + i, inodeHash);
+    for (auto& i : names) {
+      optimisePath_(stats, path + "/" + i, inodeHash);
+    }
     return;
   }
 
diff --git a/third_party/nix/src/libstore/remote-store.cc b/third_party/nix/src/libstore/remote-store.cc
index e53720b37d..e6849cb160 100644
--- a/third_party/nix/src/libstore/remote-store.cc
+++ b/third_party/nix/src/libstore/remote-store.cc
@@ -189,7 +189,9 @@ void RemoteStore::setOptions(Connection& conn) {
     overrides.erase(settings.useSubstitutes.name);
     overrides.erase(settings.showTrace.name);
     conn.to << overrides.size();
-    for (auto& i : overrides) conn.to << i.first << i.second.value;
+    for (auto& i : overrides) {
+      conn.to << i.first << i.second.value;
+    }
   }
 
   auto ex = conn.processStderr();
@@ -522,7 +524,9 @@ void RemoteStore::buildPaths(const PathSet& drvPaths, BuildMode buildMode) {
     /* For backwards compatibility with old daemons, strip output
        identifiers. */
     PathSet drvPaths2;
-    for (auto& i : drvPaths) drvPaths2.insert(string(i, 0, i.find('!')));
+    for (auto& i : drvPaths) {
+      drvPaths2.insert(string(i, 0, i.find('!')));
+    }
     conn->to << drvPaths2;
   }
   conn.processStderr();
diff --git a/third_party/nix/src/libstore/store-api.cc b/third_party/nix/src/libstore/store-api.cc
index 41eb84a812..2a7b6a1ac4 100644
--- a/third_party/nix/src/libstore/store-api.cc
+++ b/third_party/nix/src/libstore/store-api.cc
@@ -396,7 +396,9 @@ PathSet Store::queryValidPaths(const PathSet& paths,
         }});
   };
 
-  for (auto& path : paths) pool.enqueue(std::bind(doQuery, path));
+  for (auto& path : paths) {
+    pool.enqueue(std::bind(doQuery, path));
+  }
 
   pool.process();
 
@@ -434,7 +436,9 @@ string Store::makeValidityRegistration(const PathSet& paths, bool showDerivers,
 
     s += (format("%1%\n") % info->references.size()).str();
 
-    for (auto& j : info->references) s += j + "\n";
+    for (auto& j : info->references) {
+      s += j + "\n";
+    }
   }
 
   return s;
@@ -458,7 +462,9 @@ void Store::pathInfoToJSON(JSONPlaceholder& jsonOut, const PathSet& storePaths,
 
       {
         auto jsonRefs = jsonPath.list("references");
-        for (auto& ref : info->references) jsonRefs.elem(ref);
+        for (auto& ref : info->references) {
+          jsonRefs.elem(ref);
+        }
       }
 
       if (info->ca != "") {
@@ -486,7 +492,9 @@ void Store::pathInfoToJSON(JSONPlaceholder& jsonOut, const PathSet& storePaths,
 
         if (!info->sigs.empty()) {
           auto jsonSigs = jsonPath.list("signatures");
-          for (auto& sig : info->sigs) jsonSigs.elem(sig);
+          for (auto& sig : info->sigs) {
+            jsonSigs.elem(sig);
+          }
         }
 
         auto narInfo = std::dynamic_pointer_cast<const NarInfo>(
@@ -782,7 +790,9 @@ bool ValidPathInfo::checkSignature(const PublicKeys& publicKeys,
 
 Strings ValidPathInfo::shortRefs() const {
   Strings refs;
-  for (auto& r : references) refs.push_back(baseNameOf(r));
+  for (auto& r : references) {
+    refs.push_back(baseNameOf(r));
+  }
   return refs;
 }
 
@@ -918,9 +928,13 @@ std::list<ref<Store>> getDefaultSubstituters() {
       }
     };
 
-    for (auto uri : settings.substituters.get()) addStore(uri);
+    for (auto uri : settings.substituters.get()) {
+      addStore(uri);
+    }
 
-    for (auto uri : settings.extraSubstituters.get()) addStore(uri);
+    for (auto uri : settings.extraSubstituters.get()) {
+      addStore(uri);
+    }
 
     stores.sort([](ref<Store>& a, ref<Store>& b) {
       return a->getPriority() < b->getPriority();
diff --git a/third_party/nix/src/libutil/args.cc b/third_party/nix/src/libutil/args.cc
index cfe68ad6a0..be1d915819 100644
--- a/third_party/nix/src/libutil/args.cc
+++ b/third_party/nix/src/libutil/args.cc
@@ -153,7 +153,9 @@ bool Args::processArgs(const Strings& args, bool finish) {
   if ((exp.arity == 0 && finish) ||
       (exp.arity > 0 && args.size() == exp.arity)) {
     std::vector<std::string> ss;
-    for (auto& s : args) ss.push_back(s);
+    for (auto& s : args) {
+      ss.push_back(s);
+    }
     exp.handler(std::move(ss));
     expectedArgs.pop_front();
     res = true;
@@ -189,7 +191,9 @@ Strings argvToStrings(int argc, char** argv) {
 std::string renderLabels(const Strings& labels) {
   std::string res;
   for (auto label : labels) {
-    for (auto& c : label) c = std::toupper(c);
+    for (auto& c : label) {
+      c = std::toupper(c);
+    }
     res += " <" + label + ">";
   }
   return res;
@@ -197,7 +201,9 @@ std::string renderLabels(const Strings& labels) {
 
 void printTable(std::ostream& out, const Table2& table) {
   size_t max = 0;
-  for (auto& row : table) max = std::max(max, row.first.size());
+  for (auto& row : table) {
+    max = std::max(max, row.first.size());
+  }
   for (auto& row : table) {
     out << "  " << row.first << std::string(max - row.first.size() + 2, ' ')
         << row.second << "\n";
diff --git a/third_party/nix/src/libutil/config.cc b/third_party/nix/src/libutil/config.cc
index dbb703750f..0b01f6ae8a 100644
--- a/third_party/nix/src/libutil/config.cc
+++ b/third_party/nix/src/libutil/config.cc
@@ -61,7 +61,9 @@ void AbstractConfig::warnUnknownSettings() {
 
 void AbstractConfig::reapplyUnknownSettings() {
   auto unknownSettings2 = std::move(unknownSettings);
-  for (auto& s : unknownSettings2) set(s.first, s.second);
+  for (auto& s : unknownSettings2) {
+    set(s.first, s.second);
+  }
 }
 
 void Config::getSettings(std::map<std::string, SettingInfo>& res,
@@ -138,7 +140,9 @@ void AbstractConfig::applyConfigFile(const Path& path) {
 }
 
 void Config::resetOverriden() {
-  for (auto& s : _settings) s.second.setting->overriden = false;
+  for (auto& s : _settings) {
+    s.second.setting->overriden = false;
+  }
 }
 
 void Config::toJSON(JSONObject& out) {
@@ -250,7 +254,9 @@ std::string BaseSetting<Strings>::to_string() {
 template <>
 void BaseSetting<Strings>::toJSON(JSONPlaceholder& out) {
   JSONList list(out.list());
-  for (auto& s : value) list.elem(s);
+  for (auto& s : value) {
+    list.elem(s);
+  }
 }
 
 template <>
@@ -266,7 +272,9 @@ std::string BaseSetting<StringSet>::to_string() {
 template <>
 void BaseSetting<StringSet>::toJSON(JSONPlaceholder& out) {
   JSONList list(out.list());
-  for (auto& s : value) list.elem(s);
+  for (auto& s : value) {
+    list.elem(s);
+  }
 }
 
 template class BaseSetting<int>;
@@ -308,11 +316,15 @@ void GlobalConfig::getSettings(std::map<std::string, SettingInfo>& res,
 }
 
 void GlobalConfig::resetOverriden() {
-  for (auto& config : *configRegistrations) config->resetOverriden();
+  for (auto& config : *configRegistrations) {
+    config->resetOverriden();
+  }
 }
 
 void GlobalConfig::toJSON(JSONObject& out) {
-  for (auto& config : *configRegistrations) config->toJSON(out);
+  for (auto& config : *configRegistrations) {
+    config->toJSON(out);
+  }
 }
 
 void GlobalConfig::convertToArgs(Args& args, const std::string& category) {
diff --git a/third_party/nix/src/libutil/thread-pool.hh b/third_party/nix/src/libutil/thread-pool.hh
index 114dae40ee..72837ca1ee 100644
--- a/third_party/nix/src/libutil/thread-pool.hh
+++ b/third_party/nix/src/libutil/thread-pool.hh
@@ -125,7 +125,9 @@ void processGraph(ThreadPool& pool, const std::set<T>& nodes,
     }
   };
 
-  for (auto& node : nodes) pool.enqueue(std::bind(worker, std::ref(node)));
+  for (auto& node : nodes) {
+    pool.enqueue(std::bind(worker, std::ref(node)));
+  }
 
   pool.process();
 
diff --git a/third_party/nix/src/libutil/util.cc b/third_party/nix/src/libutil/util.cc
index 0a2887501c..3cc8563a86 100644
--- a/third_party/nix/src/libutil/util.cc
+++ b/third_party/nix/src/libutil/util.cc
@@ -69,7 +69,9 @@ std::map<std::string, std::string> getEnv() {
 }
 
 void clearEnv() {
-  for (auto& name : getEnv()) unsetenv(name.first.c_str());
+  for (auto& name : getEnv()) {
+    unsetenv(name.first.c_str());
+  }
 }
 
 void replaceEnv(std::map<std::string, std::string> newEnv) {
@@ -903,7 +905,9 @@ pid_t startProcess(std::function<void()> fun, const ProcessOptions& options) {
 
 std::vector<char*> stringsToCharPtrs(const Strings& ss) {
   std::vector<char*> res;
-  for (auto& s : ss) res.push_back((char*)s.c_str());
+  for (auto& s : ss) {
+    res.push_back((char*)s.c_str());
+  }
   res.push_back(0);
   return res;
 }
@@ -1215,7 +1219,9 @@ bool hasSuffix(const string& s, const string& suffix) {
 
 std::string toLower(const std::string& s) {
   std::string r(s);
-  for (auto& c : r) c = std::tolower(c);
+  for (auto& c : r) {
+    c = std::tolower(c);
+  }
   return r;
 }
 
diff --git a/third_party/nix/src/nix-build/nix-build.cc b/third_party/nix/src/nix-build/nix-build.cc
index 8fcfbe78d8..b5368a65db 100644
--- a/third_party/nix/src/nix-build/nix-build.cc
+++ b/third_party/nix/src/nix-build/nix-build.cc
@@ -102,7 +102,9 @@ static void _main(int argc, char** argv) {
       "IN_NIX_SHELL", "TZ",   "PAGER",   "NIX_BUILD_SHELL", "SHLVL"};
 
   Strings args;
-  for (int i = 1; i < argc; ++i) args.push_back(argv[i]);
+  for (int i = 1; i < argc; ++i) {
+    args.push_back(argv[i]);
+  }
 
   // Heuristic to see if we're invoked as a shebang script, namely,
   // if we have at least one argument, it's the name of an
@@ -115,7 +117,9 @@ static void _main(int argc, char** argv) {
       if (std::regex_search(lines.front(), std::regex("^#!"))) {
         lines.pop_front();
         inShebang = true;
-        for (int i = 2; i < argc; ++i) savedArgs.push_back(argv[i]);
+        for (int i = 2; i < argc; ++i) {
+          savedArgs.push_back(argv[i]);
+        }
         args.clear();
         for (auto line : lines) {
           line = chomp(line);
@@ -210,7 +214,9 @@ static void _main(int argc, char** argv) {
             execArgs = "-a PERL";
 
           std::ostringstream joined;
-          for (const auto& i : savedArgs) joined << shellEscape(i) << ' ';
+          for (const auto& i : savedArgs) {
+            joined << shellEscape(i) << ' ';
+          }
 
           if (std::regex_search(interpreter, std::regex("ruby"))) {
             // Hack for Ruby. Ruby also examines the shebang. It tries to
@@ -260,7 +266,9 @@ static void _main(int argc, char** argv) {
     std::ostringstream joined;
     joined << "with import <nixpkgs> { }; (pkgs.runCommandCC or "
               "pkgs.runCommand) \"shell\" { buildInputs = [ ";
-    for (const auto& i : left) joined << '(' << i << ") ";
+    for (const auto& i : left) {
+      joined << '(' << i << ") ";
+    }
     joined << "]; } \"\"";
     fromArgs = true;
     left = {joined.str()};
@@ -389,7 +397,9 @@ static void _main(int argc, char** argv) {
                                                   std::regex(exclude));
                       }))
         pathsToBuild.insert(makeDrvPathWithOutputs(input.first, input.second));
-    for (const auto& src : drv.inputSrcs) pathsToBuild.insert(src);
+    for (const auto& src : drv.inputSrcs) {
+      pathsToBuild.insert(src);
+    }
 
     buildPaths(pathsToBuild);
 
@@ -465,7 +475,9 @@ static void _main(int argc, char** argv) {
             envCommand));
 
     Strings envStrs;
-    for (auto& i : env) envStrs.push_back(i.first + "=" + i.second);
+    for (auto& i : env) {
+      envStrs.push_back(i.first + "=" + i.second);
+    }
 
     auto args = interactive ? Strings{"bash", "--rcfile", rcfile}
                             : Strings{"bash", rcfile};
@@ -531,7 +543,9 @@ static void _main(int argc, char** argv) {
       if (auto store2 = store.dynamic_pointer_cast<LocalFSStore>())
         store2->addPermRoot(symlink.second, absPath(symlink.first), true);
 
-    for (auto& path : outPaths) std::cout << path << '\n';
+    for (auto& path : outPaths) {
+      std::cout << path << '\n';
+    }
   }
 }
 
diff --git a/third_party/nix/src/nix-channel/nix-channel.cc b/third_party/nix/src/nix-channel/nix-channel.cc
index eca31a5338..ec72258b10 100644
--- a/third_party/nix/src/nix-channel/nix-channel.cc
+++ b/third_party/nix/src/nix-channel/nix-channel.cc
@@ -148,7 +148,9 @@ static void update(const StringSet& channelNames) {
   Strings envArgs{"--profile", profile,
                   "--file",    "<nix/unpack-channel.nix>",
                   "--install", "--from-expression"};
-  for (auto& expr : exprs) envArgs.push_back(std::move(expr));
+  for (auto& expr : exprs) {
+    envArgs.push_back(std::move(expr));
+  }
   envArgs.push_back("--quiet");
   runProgram(settings.nixBinDir + "/nix-env", false, envArgs);
 
diff --git a/third_party/nix/src/nix-daemon/nix-daemon.cc b/third_party/nix/src/nix-daemon/nix-daemon.cc
index e416cbcd7e..34ea932fe9 100644
--- a/third_party/nix/src/nix-daemon/nix-daemon.cc
+++ b/third_party/nix/src/nix-daemon/nix-daemon.cc
@@ -106,7 +106,9 @@ struct TunnelLogger {
     auto state(state_.lock());
     state->canSendStderr = true;
 
-    for (auto& msg : state->pendingMsgs) to(msg);
+    for (auto& msg : state->pendingMsgs) {
+      to(msg);
+    }
 
     state->pendingMsgs.clear();
 
@@ -443,12 +445,16 @@ static void performOp(TunnelLogger* logger, ref<Store> store, bool trusted,
       logger->stopWork();
 
       size_t size = 0;
-      for (auto& i : roots) size += i.second.size();
+      for (auto& i : roots) {
+        size += i.second.size();
+      }
 
       to << size;
 
       for (auto& [target, links] : roots)
-        for (auto& link : links) to << link << target;
+        for (auto& link : links) {
+          to << link << target;
+        }
 
       break;
     }
@@ -511,7 +517,9 @@ static void performOp(TunnelLogger* logger, ref<Store> store, bool trusted,
             return false;
           }
           StringSet trusted = settings.trustedSubstituters;
-          for (auto& s : settings.substituters.get()) trusted.insert(s);
+          for (auto& s : settings.substituters.get()) {
+            trusted.insert(s);
+          }
           Strings subs;
           auto ss = tokenizeString<Strings>(value);
           for (auto& s : ss)
diff --git a/third_party/nix/src/nix-env/nix-env.cc b/third_party/nix/src/nix-env/nix-env.cc
index c7f044aaa5..5aa0a7d57e 100644
--- a/third_party/nix/src/nix-env/nix-env.cc
+++ b/third_party/nix/src/nix-env/nix-env.cc
@@ -87,7 +87,9 @@ static bool isNixExpr(const Path& path, struct stat& st) {
 static void getAllExprs(EvalState& state, const Path& path, StringSet& attrs,
                         Value& v) {
   StringSet namesSorted;
-  for (auto& i : readDirectory(path)) namesSorted.insert(i.name);
+  for (auto& i : readDirectory(path)) {
+    namesSorted.insert(i.name);
+  }
 
   for (auto& i : namesSorted) {
     /* Ignore the manifest.nix used by profiles.  This is
@@ -927,7 +929,9 @@ static void opQuery(Globals& globals, Strings opFlags, Strings opArgs) {
   /* Sort them by name. */
   /* !!! */
   vector<DrvInfo> elems;
-  for (auto& i : elems_) elems.push_back(i);
+  for (auto& i : elems_) {
+    elems.push_back(i);
+  }
   sort(elems.begin(), elems.end(), cmpElemByName);
 
   /* We only need to know the installed paths when we are querying
@@ -935,7 +939,9 @@ static void opQuery(Globals& globals, Strings opFlags, Strings opArgs) {
   PathSet installed; /* installed paths */
 
   if (printStatus) {
-    for (auto& i : installedElems) installed.insert(i.queryOutPath());
+    for (auto& i : installedElems) {
+      installed.insert(i.queryOutPath());
+    }
   }
 
   /* Query which paths have substitutes. */
diff --git a/third_party/nix/src/nix-store/nix-store.cc b/third_party/nix/src/nix-store/nix-store.cc
index 3de536a6c4..1df4b451e7 100644
--- a/third_party/nix/src/nix-store/nix-store.cc
+++ b/third_party/nix/src/nix-store/nix-store.cc
@@ -68,7 +68,9 @@ static PathSet realisePath(Path path, bool build = true) {
     rootNr++;
 
     if (p.second.empty())
-      for (auto& i : drv.outputs) p.second.insert(i.first);
+      for (auto& i : drv.outputs) {
+        p.second.insert(i.first);
+      }
 
     PathSet outputs;
     for (auto& j : p.second) {
@@ -174,7 +176,9 @@ static void opRealise(Strings opFlags, Strings opArgs) {
     for (auto& i : paths) {
       PathSet paths = realisePath(i, false);
       if (!noOutput)
-        for (auto& j : paths) cout << format("%1%\n") % j;
+        for (auto& j : paths) {
+          cout << format("%1%\n") % j;
+        }
     }
 }
 
@@ -241,7 +245,9 @@ static PathSet maybeUseOutputs(const Path& storePath, bool useOutput,
   if (useOutput && isDerivation(storePath)) {
     Derivation drv = store->derivationFromPath(storePath);
     PathSet outputs;
-    for (auto& i : drv.outputs) outputs.insert(i.second.path);
+    for (auto& i : drv.outputs) {
+      outputs.insert(i.second.path);
+    }
     return outputs;
   } else
     return {storePath};
@@ -370,7 +376,9 @@ static void opQuery(Strings opFlags, Strings opArgs) {
           realisePath(i);
         }
         Derivation drv = store->derivationFromPath(i);
-        for (auto& j : drv.outputs) cout << format("%1%\n") % j.second.path;
+        for (auto& j : drv.outputs) {
+          cout << format("%1%\n") % j.second.path;
+        }
       }
       break;
     }
@@ -387,7 +395,9 @@ static void opQuery(Strings opFlags, Strings opArgs) {
           if (query == qRequisites)
             store->computeFSClosure(j, paths, false, includeOutputs);
           else if (query == qReferences) {
-            for (auto& p : store->queryPathInfo(j)->references) paths.insert(p);
+            for (auto& p : store->queryPathInfo(j)->references) {
+              paths.insert(p);
+            }
           } else if (query == qReferrers)
             store->queryReferrers(j, paths);
           else if (query == qReferrersClosure)
@@ -545,7 +555,9 @@ static void opDumpDB(Strings opFlags, Strings opArgs) {
     throw UsageError("unknown flag");
   }
   if (!opArgs.empty()) {
-    for (auto& i : opArgs) i = store->followLinksToStorePath(i);
+    for (auto& i : opArgs) {
+      i = store->followLinksToStorePath(i);
+    }
     for (auto& i : opArgs)
       cout << store->makeValidityRegistration({i}, true, true);
   } else {
@@ -662,7 +674,9 @@ static void opGC(Strings opFlags, Strings opArgs) {
     std::set<std::pair<Path, Path>> roots2;
     // Transpose and sort the roots.
     for (auto& [target, links] : roots)
-      for (auto& link : links) roots2.emplace(link, target);
+      for (auto& link : links) {
+        roots2.emplace(link, target);
+      }
     for (auto& [link, target] : roots2)
       std::cout << link << " -> " << target << "\n";
   }
@@ -672,7 +686,9 @@ static void opGC(Strings opFlags, Strings opArgs) {
     store->collectGarbage(options, results);
 
     if (options.action != GCOptions::gcDeleteDead)
-      for (auto& i : results.paths) cout << i << std::endl;
+      for (auto& i : results.paths) {
+        cout << i << std::endl;
+      }
   }
 }
 
@@ -728,9 +744,13 @@ static void opRestore(Strings opFlags, Strings opArgs) {
 }
 
 static void opExport(Strings opFlags, Strings opArgs) {
-  for (auto& i : opFlags) throw UsageError(format("unknown flag '%1%'") % i);
+  for (auto& i : opFlags) {
+    throw UsageError(format("unknown flag '%1%'") % i);
+  }
 
-  for (auto& i : opArgs) i = store->followLinksToStorePath(i);
+  for (auto& i : opArgs) {
+    i = store->followLinksToStorePath(i);
+  }
 
   FdSink sink(STDOUT_FILENO);
   store->exportPaths(opArgs, sink);
@@ -738,7 +758,9 @@ static void opExport(Strings opFlags, Strings opArgs) {
 }
 
 static void opImport(Strings opFlags, Strings opArgs) {
-  for (auto& i : opFlags) throw UsageError(format("unknown flag '%1%'") % i);
+  for (auto& i : opFlags) {
+    throw UsageError(format("unknown flag '%1%'") % i);
+  }
 
   if (!opArgs.empty()) {
     throw UsageError("no arguments expected");
@@ -747,7 +769,9 @@ static void opImport(Strings opFlags, Strings opArgs) {
   FdSource source(STDIN_FILENO);
   Paths paths = store->importPaths(source, nullptr, NoCheckSigs);
 
-  for (auto& i : paths) cout << format("%1%\n") % i << std::flush;
+  for (auto& i : paths) {
+    cout << format("%1%\n") % i << std::flush;
+  }
 }
 
 /* Initialise the Nix databases. */
@@ -889,7 +913,9 @@ static void opServe(Strings opFlags, Strings opArgs) {
         bool substitute = readInt(in);
         PathSet paths = readStorePaths<PathSet>(*store, in);
         if (lock && writeAllowed)
-          for (auto& path : paths) store->addTempRoot(path);
+          for (auto& path : paths) {
+            store->addTempRoot(path);
+          }
 
         /* If requested, substitute missing paths. This
            implements nix-copy-closure's --use-substitutes
@@ -1052,7 +1078,9 @@ static void opServe(Strings opFlags, Strings opArgs) {
 }
 
 static void opGenerateBinaryCacheKey(Strings opFlags, Strings opArgs) {
-  for (auto& i : opFlags) throw UsageError(format("unknown flag '%1%'") % i);
+  for (auto& i : opFlags) {
+    throw UsageError(format("unknown flag '%1%'") % i);
+  }
 
   if (opArgs.size() != 3) {
     throw UsageError("three arguments expected");
diff --git a/third_party/nix/src/nix/command.cc b/third_party/nix/src/nix/command.cc
index 1825bb6136..4c1220668c 100644
--- a/third_party/nix/src/nix/command.cc
+++ b/third_party/nix/src/nix/command.cc
@@ -111,7 +111,9 @@ void StorePathsCommand::run(ref<Store> store) {
   if (all) {
     if (installables.size())
       throw UsageError("'--all' does not expect arguments");
-    for (auto& p : store->queryAllValidPaths()) storePaths.push_back(p);
+    for (auto& p : store->queryAllValidPaths()) {
+      storePaths.push_back(p);
+    }
   }
 
   else {
diff --git a/third_party/nix/src/nix/doctor.cc b/third_party/nix/src/nix/doctor.cc
index e4138f28d8..cf59aabdbd 100644
--- a/third_party/nix/src/nix/doctor.cc
+++ b/third_party/nix/src/nix/doctor.cc
@@ -52,7 +52,9 @@ struct CmdDoctor : StoreCommand {
       std::cout << "Warning: multiple versions of nix found in PATH."
                 << std::endl;
       std::cout << std::endl;
-      for (auto& dir : dirs) std::cout << "  " << dir << std::endl;
+      for (auto& dir : dirs) {
+        std::cout << "  " << dir << std::endl;
+      }
       std::cout << std::endl;
       return false;
     }
@@ -90,7 +92,9 @@ struct CmdDoctor : StoreCommand {
       std::cout << "garbage collected, resulting in broken symlinks."
                 << std::endl;
       std::cout << std::endl;
-      for (auto& dir : dirs) std::cout << "  " << dir << std::endl;
+      for (auto& dir : dirs) {
+        std::cout << "  " << dir << std::endl;
+      }
       std::cout << std::endl;
       return false;
     }
diff --git a/third_party/nix/src/nix/installables.cc b/third_party/nix/src/nix/installables.cc
index 7ba916f4a6..f400841b7c 100644
--- a/third_party/nix/src/nix/installables.cc
+++ b/third_party/nix/src/nix/installables.cc
@@ -243,11 +243,15 @@ Buildables build(ref<Store> store, RealiseMode mode,
     for (auto& b : i->toBuildables()) {
       if (b.drvPath != "") {
         StringSet outputNames;
-        for (auto& output : b.outputs) outputNames.insert(output.first);
+        for (auto& output : b.outputs) {
+          outputNames.insert(output.first);
+        }
         pathsToBuild.insert(b.drvPath + "!" +
                             concatStringsSep(",", outputNames));
       } else
-        for (auto& output : b.outputs) pathsToBuild.insert(output.second);
+        for (auto& output : b.outputs) {
+          pathsToBuild.insert(output.second);
+        }
       buildables.push_back(std::move(b));
     }
   }
@@ -266,7 +270,9 @@ PathSet toStorePaths(ref<Store> store, RealiseMode mode,
   PathSet outPaths;
 
   for (auto& b : build(store, mode, installables))
-    for (auto& output : b.outputs) outPaths.insert(output.second);
+    for (auto& output : b.outputs) {
+      outPaths.insert(output.second);
+    }
 
   return outPaths;
 }
diff --git a/third_party/nix/src/nix/path-info.cc b/third_party/nix/src/nix/path-info.cc
index 4920a8c4d7..9f155231d4 100644
--- a/third_party/nix/src/nix/path-info.cc
+++ b/third_party/nix/src/nix/path-info.cc
@@ -114,7 +114,9 @@ struct CmdPathInfo : StorePathsCommand, MixJSON {
           if (info->ca != "") {
             ss.push_back("ca:" + info->ca);
           }
-          for (auto& sig : info->sigs) ss.push_back(sig);
+          for (auto& sig : info->sigs) {
+            ss.push_back(sig);
+          }
           std::cout << concatStringsSep(" ", ss);
         }
 
diff --git a/third_party/nix/src/nix/repl.cc b/third_party/nix/src/nix/repl.cc
index 0297cca848..f6b62d0ca2 100644
--- a/third_party/nix/src/nix/repl.cc
+++ b/third_party/nix/src/nix/repl.cc
@@ -200,7 +200,9 @@ static int listPossibleCallback(char* s, char*** avp) {
 
   vp = check((char**)malloc(possible.size() * sizeof(char*)));
 
-  for (auto& p : possible) vp[ac++] = check(strdup(p.c_str()));
+  for (auto& p : possible) {
+    vp[ac++] = check(strdup(p.c_str()));
+  }
 
   *avp = vp;
 
@@ -221,7 +223,9 @@ void NixRepl::mainLoop(const std::vector<std::string>& files) {
             << std::endl
             << std::endl;
 
-  for (auto& i : files) loadedFiles.push_back(i);
+  for (auto& i : files) {
+    loadedFiles.push_back(i);
+  }
 
   reloadFiles();
   if (!loadedFiles.empty()) {
@@ -576,7 +580,9 @@ void NixRepl::initEnv() {
   staticEnv.vars.clear();
 
   varNames.clear();
-  for (auto& i : state.staticBaseEnv.vars) varNames.insert(i.first);
+  for (auto& i : state.staticBaseEnv.vars) {
+    varNames.insert(i.first);
+  }
 }
 
 void NixRepl::reloadFiles() {
@@ -598,7 +604,9 @@ void NixRepl::reloadFiles() {
 
 void NixRepl::addAttrsToScope(Value& attrs) {
   state.forceAttrs(attrs);
-  for (auto& i : *attrs.attrs) addVarToScope(i.name, *i.value);
+  for (auto& i : *attrs.attrs) {
+    addVarToScope(i.name, *i.value);
+  }
   std::cout << format("Added %1% variables.") % attrs.attrs->size()
             << std::endl;
 }
@@ -696,7 +704,9 @@ std::ostream& NixRepl::printValue(std::ostream& str, Value& v,
 
         typedef std::map<string, Value*> Sorted;
         Sorted sorted;
-        for (auto& i : *v.attrs) sorted[i.name] = i.value;
+        for (auto& i : *v.attrs) {
+          sorted[i.name] = i.value;
+        }
 
         for (auto& i : sorted) {
           if (isVarName(i.first))
diff --git a/third_party/nix/src/nix/run.cc b/third_party/nix/src/nix/run.cc
index c246767ced..64b883b9a3 100644
--- a/third_party/nix/src/nix/run.cc
+++ b/third_party/nix/src/nix/run.cc
@@ -101,19 +101,25 @@ struct CmdRun : InstallablesCommand {
 
       clearEnv();
 
-      for (auto& var : kept) setenv(var.first.c_str(), var.second.c_str(), 1);
+      for (auto& var : kept) {
+        setenv(var.first.c_str(), var.second.c_str(), 1);
+      }
 
     } else {
       if (!keep.empty())
         throw UsageError(
             "--keep does not make sense without --ignore-environment");
 
-      for (auto& var : unset) unsetenv(var.c_str());
+      for (auto& var : unset) {
+        unsetenv(var.c_str());
+      }
     }
 
     std::unordered_set<Path> done;
     std::queue<Path> todo;
-    for (auto& path : outPaths) todo.push(path);
+    for (auto& path : outPaths) {
+      todo.push(path);
+    }
 
     auto unixPath = tokenizeString<Strings>(getEnv("PATH"), ":");
 
@@ -130,7 +136,9 @@ struct CmdRun : InstallablesCommand {
 
       auto propPath = path + "/nix-support/propagated-user-env-packages";
       if (accessor->stat(propPath).type == FSAccessor::tRegular) {
-        for (auto& p : tokenizeString<Paths>(readFile(propPath))) todo.push(p);
+        for (auto& p : tokenizeString<Paths>(readFile(propPath))) {
+          todo.push(p);
+        }
       }
     }
 
@@ -138,7 +146,9 @@ struct CmdRun : InstallablesCommand {
 
     std::string cmd = *command.begin();
     Strings args;
-    for (auto& arg : command) args.push_back(arg);
+    for (auto& arg : command) {
+      args.push_back(arg);
+    }
 
     restoreSignals();
 
@@ -157,7 +167,9 @@ struct CmdRun : InstallablesCommand {
     if (store2 && store->storeDir != store2->realStoreDir) {
       Strings helperArgs = {chrootHelperName, store->storeDir,
                             store2->realStoreDir, cmd};
-      for (auto& arg : args) helperArgs.push_back(arg);
+      for (auto& arg : args) {
+        helperArgs.push_back(arg);
+      }
 
       execv(readLink("/proc/self/exe").c_str(),
             stringsToCharPtrs(helperArgs).data());
diff --git a/third_party/nix/src/nix/search.cc b/third_party/nix/src/nix/search.cc
index f44269eee5..994fccd564 100644
--- a/third_party/nix/src/nix/search.cc
+++ b/third_party/nix/src/nix/search.cc
@@ -260,7 +260,9 @@ struct CmdSearch : SourceExprCommand, MixJSON {
       throw Error("no results for the given search term(s)!");
 
     RunPager pager;
-    for (auto el : results) std::cout << el.second << "\n";
+    for (auto el : results) {
+      std::cout << el.second << "\n";
+    }
   }
 };
 
diff --git a/third_party/nix/src/nix/show-derivation.cc b/third_party/nix/src/nix/show-derivation.cc
index c7722b6428..4a604c2c22 100644
--- a/third_party/nix/src/nix/show-derivation.cc
+++ b/third_party/nix/src/nix/show-derivation.cc
@@ -72,14 +72,18 @@ struct CmdShowDerivation : InstallablesCommand {
 
         {
           auto inputsList(drvObj.list("inputSrcs"));
-          for (auto& input : drv.inputSrcs) inputsList.elem(input);
+          for (auto& input : drv.inputSrcs) {
+            inputsList.elem(input);
+          }
         }
 
         {
           auto inputDrvsObj(drvObj.object("inputDrvs"));
           for (auto& input : drv.inputDrvs) {
             auto inputList(inputDrvsObj.list(input.first));
-            for (auto& outputId : input.second) inputList.elem(outputId);
+            for (auto& outputId : input.second) {
+              inputList.elem(outputId);
+            }
           }
         }
 
@@ -88,12 +92,16 @@ struct CmdShowDerivation : InstallablesCommand {
 
         {
           auto argsList(drvObj.list("args"));
-          for (auto& arg : drv.args) argsList.elem(arg);
+          for (auto& arg : drv.args) {
+            argsList.elem(arg);
+          }
         }
 
         {
           auto envObj(drvObj.object("env"));
-          for (auto& var : drv.env) envObj.attr(var.first, var.second);
+          for (auto& var : drv.env) {
+            envObj.attr(var.first, var.second);
+          }
         }
       }
     }
diff --git a/third_party/nix/src/nix/sigs.cc b/third_party/nix/src/nix/sigs.cc
index d548f5445f..0eb16b6829 100644
--- a/third_party/nix/src/nix/sigs.cc
+++ b/third_party/nix/src/nix/sigs.cc
@@ -36,7 +36,9 @@ struct CmdCopySigs : StorePathsCommand {
 
     // FIXME: factor out commonality with MixVerify.
     std::vector<ref<Store>> substituters;
-    for (auto& s : substituterUris) substituters.push_back(openStore(s));
+    for (auto& s : substituterUris) {
+      substituters.push_back(openStore(s));
+    }
 
     ThreadPool pool;
 
diff --git a/third_party/nix/src/nix/verify.cc b/third_party/nix/src/nix/verify.cc
index 5cac3c9802..3585176ed3 100644
--- a/third_party/nix/src/nix/verify.cc
+++ b/third_party/nix/src/nix/verify.cc
@@ -52,7 +52,9 @@ struct CmdVerify : StorePathsCommand {
 
   void run(ref<Store> store, Paths storePaths) override {
     std::vector<ref<Store>> substituters;
-    for (auto& s : substituterUris) substituters.push_back(openStore(s));
+    for (auto& s : substituterUris) {
+      substituters.push_back(openStore(s));
+    }
 
     auto publicKeys = getDefaultPublicKeys();
 
diff --git a/third_party/nix/src/nix/why-depends.cc b/third_party/nix/src/nix/why-depends.cc
index b0271d4199..3744f4802a 100644
--- a/third_party/nix/src/nix/why-depends.cc
+++ b/third_party/nix/src/nix/why-depends.cc
@@ -17,7 +17,9 @@ static std::string hilite(const std::string& s, size_t pos, size_t len,
 
 static std::string filterPrintable(const std::string& s) {
   std::string res;
-  for (char c : s) res += isprint(c) ? c : '.';
+  for (char c : s) {
+    res += isprint(c) ? c : '.';
+  }
   return res;
 }
 
@@ -95,7 +97,9 @@ struct CmdWhyDepends : SourceExprCommand {
 
     // Transpose the graph.
     for (auto& node : graph)
-      for (auto& ref : node.second.refs) graph[ref].rrefs.insert(node.first);
+      for (auto& ref : node.second.refs) {
+        graph[ref].rrefs.insert(node.first);
+      }
 
     /* Run Dijkstra's shortest path algorithm to get the distance
        of every path in the closure to 'dependency'. */
@@ -184,7 +188,9 @@ struct CmdWhyDepends : SourceExprCommand {
 
         if (st.type == FSAccessor::Type::tDirectory) {
           auto names = accessor->readDirectory(p);
-          for (auto& name : names) visitPath(p + "/" + name);
+          for (auto& name : names) {
+            visitPath(p + "/" + name);
+          }
         }
 
         else if (st.type == FSAccessor::Type::tRegular) {
diff --git a/third_party/nix/src/resolve-system-dependencies/resolve-system-dependencies.cc b/third_party/nix/src/resolve-system-dependencies/resolve-system-dependencies.cc
index 7bdb417f62..7fc405faae 100644
--- a/third_party/nix/src/resolve-system-dependencies/resolve-system-dependencies.cc
+++ b/third_party/nix/src/resolve-system-dependencies/resolve-system-dependencies.cc
@@ -153,7 +153,9 @@ std::set<string> getPath(const Path& path) {
     paths.insert(nextPath);
   }
 
-  for (auto& t : resolveTree(nextPath, deps)) paths.insert(t);
+  for (auto& t : resolveTree(nextPath, deps)) {
+    paths.insert(t);
+  }
 
   writeFile(cacheFile, concatStringsSep("\n", paths));
 
@@ -193,10 +195,14 @@ int main(int argc, char** argv) {
     std::set<string> allPaths;
 
     for (auto& path : impurePaths)
-      for (auto& p : getPath(path)) allPaths.insert(p);
+      for (auto& p : getPath(path)) {
+        allPaths.insert(p);
+      }
 
     std::cout << "extra-chroot-dirs" << std::endl;
-    for (auto& path : allPaths) std::cout << path << std::endl;
+    for (auto& path : allPaths) {
+      std::cout << path << std::endl;
+    }
     std::cout << std::endl;
   });
 }