reduce calls to contentful

cleo.darwin.nix

@@ -1,30 +1,77 @@
-{ pkgs, inputs, ... }: {
-  nixpkgs.config.allowUnfree = true;
-  nixpkgs.overlays = [ 
-    inputs.nix-vscode-extensions.overlays.default
-    # ==== Temp workaround for VSCODE
-    ## https://github.com/nixos/nixpkgs/issues/543690 as of 2026-07-20
-    (final: prev: {
-      vscode = prev.vscode.overrideAttrs (oldAttrs: {
-        postPatch = builtins.replaceStrings
-          [ "Contents/Resources/app/node_modules/@vscode/ripgrep-universal" ]
-          [ "Contents/Resources/app/node_modules.asar.unpacked/@vscode/ripgrep-universal" ]
-          (oldAttrs.postPatch or "");
-      });
-    })
-  ];
+{ pkgs, lib, inputs, ... }:
+let
+  ansibleRequired = {
+    taps = [
+      "fwdcloudsec/granted" # aws sso utility
+      "felipeelias/tap"     # claude-statusline
+      "f1bonacc1/tap"       # process-compose
+      "oven-sh/bun"         # bun
+      "sst/tap"             # opencode
+    ];
+    brews = [
+      "allure"
+      "aws-sso-util"
+      "awscli"
+      "ccusage"
+      "fd"
+      "f1bonacc1/tap/process-compose"
+      "felipeelias/tap/claude-statusline"
+      "oven-sh/bun/bun"
+      "fwdcloudsec/granted/granted"
+      "gdal"
+      "gh"
+      "jq"
+      "maven"
+      "rg"
+      "snyk-cli"
+      "sst/tap/opencode"
+      
+      ## Excluded intentionally
+      # "libpq@17"
+      # "node@22"
+    ];
+    casks = [
+      "1password-cli"
+      "aws-vpn-client"
+      "chromedriver"
+      "claude-code"       # stable channel; playbook can opt into claude-code@latest
+      "copilot-cli"
+      "docker-desktop"
+      "expo-orbit"
+      "zulu@17"
+      "ngrok"
+
+      ## Excluded intentionally
+      # "visual-studio-code" # app installed by brew; home-manager owns settings + extensions
+      # "jetbrains-toolbox"
+    ];
+  };
+in {
   ids.gids.nixbld = 350;
   security.pam.services.sudo_local.touchIdAuth = true;
 
-  # 1Password SSH Socket
-  environment.variables.SSH_AUTH_SOCK = "~/Library/Group Containers/2BU8OCWD5C.com.1password/t/agent.sock";
-
   # Set vim as default editor
   environment.variables.EDITOR = "vim";
   environment.variables.VISUAL = "vim";
   environment.variables.GIT_EDITOR = "vim";
   environment.variables.HOMEBREW_NO_ANALYTICS = "1";
 
+  environment.systemPackages = with pkgs; [
+    vim
+    git
+    wget
+    curl
+    python3
+    postgresql_17
+    home-manager
+    ttyd
+    xcodes
+    xz
+    # node 22 pinned to the exact version cleo-app requires (nixpkgs-nodejs in flake.nix)
+    pinnedNode.nodejs_22
+    pinnedNode.yarn
+  ];
+
   # Add Homebrew to PATH
   environment.systemPath = [ "/opt/homebrew/bin" "/opt/homebrew/sbin" "/Users/matthew.bessette/.local/bin" ];
 
@@ -43,47 +90,45 @@
     onActivation.cleanup = "uninstall";
     onActivation.autoUpdate = true;
     onActivation.upgrade = true;
-    onActivation.extraFlags = [ "--force" ];
     # global.autoUpdate = true;
-    taps = [
-      "f1bonacc1/tap"
-    ];
-    brews = [
+    # Each list is (ansible-managed set) ++ (nix-only extras), deduped. With
+    # cleanup = "uninstall" above, anything NOT listed here gets removed on
+    # activation — so ansibleRequired must be merged in or nix would clobber it.
+    taps = lib.unique (ansibleRequired.taps ++ [
+      # nix-only taps go here
+    ]);
+    brews = lib.unique (ansibleRequired.brews ++ [
       "biome"
-
-      # CLEO APP
-      "ccache"
-      "rbenv"
-      "ruby-build"
-
-      "f1bonacc1/tap/process-compose"
-
-      # DEV
-      "mise"
-    ];
-    casks = [
-
-      # CLEO APP
-      "zulu@17"
+      "jira-cli"
+      "treehouse"
+    ]);
+    # visual-studio-code is installed by Homebrew (in ansibleRequired.casks) so
+    # Homebrew owns the .app; home-manager (cleo.home.nix) owns settings +
+    # extensions only (programs.vscode with package = null) — no second copy.
+    casks = lib.unique (ansibleRequired.casks ++ [
       "android-commandlinetools"
       "android-platform-tools"
-      ###
-
-      "1password-cli"
-      "bruno" 
+      "bruno"
       "claude"
-      "claude-code"
-      "docker-desktop"
+      "figma"
       "super-productivity"
-      "kopiaui" 
-      "libreoffice" 
+      "kopiaui"
+      "libreoffice"
       "obsidian"
       "postico"
       "sublime-text"
       "spotify"
       "yubico-yubikey-manager"
       "zoom"
-    ];
+    ]);
+
+    masApps = {
+      BetterSnapTool = 417375580;
+      HiddenBar = 1452453066;
+      # "Jamf Trust" = 1608041266;
+      MeetingBar = 1518425043;
+      Wireguard = 1451685025;
+    };
   };
 
   nix.settings.experimental-features = "nix-command flakes";