nix: source cc-proxy, chrome-cdp and portless from their own flakes

Each of the three repos now exposes a buildGoModule package, so the CLIs
come from nix instead of the sanketsudake/tap Homebrew casks. They land in
home.packages and the cask entries go away in the same generation, which
matters because cleanup = "uninstall" would otherwise leave both copies
on PATH for a switch.

The inputs track each repo's default branch rather than its release tags,
because the existing tags predate the flakes. Note that a repo's vendorHash
has to be refreshed whenever its go.sum moves, so a dependency bump there
can break the build here until that lands.

cines stays a cask: it is a Qt .app shipped as a universal DMG, and nix on
darwin would put it in ~/Applications/Home Manager Apps, which Spotlight
indexes poorly. The tap stays for it.

Author: sanketsudake

flake.lock

@@ -11,6 +11,22 @@
       url = "github:nix-community/home-manager";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+
+    # Own CLIs, packaged as flakes in their own repos (they used to come from
+    # the sanketsudake/tap Homebrew casks). Each follows this flake's nixpkgs
+    # so there is exactly one nixpkgs in the closure.
+    cc-proxy = {
+      url = "github:sanketsudake/cc-proxy";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    chrome-cdp-cli = {
+      url = "github:sanketsudake/chrome-cdp-cli";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    go-portless = {
+      url = "github:sanketsudake/go-portless";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
   outputs =
@@ -29,6 +45,7 @@
               home-manager = {
                 useGlobalPkgs = true;
                 useUserPackages = true;
+                extraSpecialArgs = { inherit inputs; };
                 backupFileExtension = "hm-backup";
                 users.sanketsudake = import ./nix/home;
               };

flake.nix

@@ -44,10 +44,15 @@
       "slack"
       "visual-studio-code"
       "zoom"
-      { name = "sanketsudake/tap/cc-proxy"; trusted = true; }
-      { name = "sanketsudake/tap/chrome-cdp"; trusted = true; }
-      { name = "sanketsudake/tap/portless"; trusted = true; }
-      { name = "sanketsudake/tap/cines"; trusted = true; }
+      # cc-proxy, chrome-cdp and portless moved to nix — each repo exposes a
+      # flake, wired as an input in flake.nix and installed from
+      # nix/home/packages.nix. cines stays a cask: it is a Qt .app from a
+      # universal DMG, and nix on darwin would land it in
+      # ~/Applications/Home Manager Apps, which Spotlight indexes poorly.
+      {
+        name = "sanketsudake/tap/cines";
+        trusted = true;
+      }
     ];
 
     # App Store apps (need App Store sign-in on a new Mac).

nix/darwin/homebrew.nix

@@ -1,8 +1,22 @@
 # CLI packages from nixpkgs (was homebrew brews), migrated in batches —
 # see the Nix migration plan. Grouped to mirror the old Brewfile sections.
-{ pkgs, ... }:
+{ pkgs, inputs, ... }:
+let
+  system = pkgs.stdenv.hostPlatform.system;
+in
 {
-  home.packages = with pkgs; [
+  # Own CLIs, built from the flake each repo now exposes. They used to be
+  # sanketsudake/tap Homebrew casks (goreleaser-published binaries); nix builds
+  # them from the pinned source instead. The inputs track each repo's default
+  # branch, not its release tags, so `nix flake update <input>` moves to main
+  # HEAD — which may sit ahead of the last tag. Pinning an input to a tag
+  # becomes possible once a release carries flake.nix.
+  home.packages = [
+    inputs.cc-proxy.packages.${system}.default
+    inputs.chrome-cdp-cli.packages.${system}.default
+    inputs.go-portless.packages.${system}.default
+  ]
+  ++ (with pkgs; [
     # --- core CLI (batch 1) ---
     # GNU tools install unprefixed here (brew kept them g-prefixed/off-PATH
     # except grep/make), so sed/find/ls flip to GNU-by-default — deliberate,
@@ -109,5 +123,5 @@
     go-licenses
     protoc-gen-go
     protoc-gen-go-grpc
-  ];
+  ]);
 }