final: prev:
let
  # XXX: codex and claude-code are now provided by dedicated flakes in nix.nix:
  #   - inputs.codex-cli-nix (github:sadjow/codex-cli-nix)
  #   - inputs.claude-code-nix (github:sadjow/claude-code-nix)
  # These use cachix caches for pre-built binaries.
  # The old manual version override code is preserved below for reference.

  # # Enable/disable version overrides (set to false to use nixpkgs versions)
  # enableCodexOverride = true; # Override to get 0.93.0
  # enableClaudeCodeOverride = false; # Disabled - needs proper buildNpmPackage override

  # # Codex version override - update these values to bump the version
  # codexVersion = {
  #   version = "0.93.0";
  #   hash = "sha256-JwCwFPa4+BAMUSp567s9l2QdanL7XEhtGSR8mvlws6Q=";
  #   # Using importCargoLock requires outputHashes for git dependencies
  #   outputHashes = {
  #     "crossterm-0.28.1" = "sha256-6qCtfSMuXACKFb9ATID39XyFDIEMFDmbx6SSmNe+728=";
  #     "nucleo-0.5.0" = "sha256-Hm4SxtTSBrcWpXrtSqeO0TACbUxq3gizg1zD/6Yw/sI=";
  #     "nucleo-matcher-0.3.1" = "sha256-Hm4SxtTSBrcWpXrtSqeO0TACbUxq3gizg1zD/6Yw/sI=";
  #     "ratatui-0.29.0" = "sha256-HBvT5c8GsiCxMffNjJGLmHnvG77A6cqEL+1ARurBXho=";
  #     "runfiles-0.1.0" = "sha256-uJpVLcQh8wWZA3GPv9D8Nt43EOirajfDJ7eq/FB+tek=";
  #     "tokio-tungstenite-0.28.0" = "sha256-vJZ3S41gHtRt4UAODsjAoSCaTksgzCALiBmbWgyDCi8=";
  #     "tungstenite-0.28.0" = "sha256-CyXZp58zGlUhEor7WItjQoS499IoSP55uWqr++ia+0A=";
  #   };
  # };
  # claudeCodeVersion = {
  #   version = "2.1.22";
  #   hash = "sha256-OqvLiwB5TwZaxDvyN/+/+eueBdWNaYxd81cd5AZK/mA=";
  #   npmDepsHash = "sha256-vy7osk3UAOEgsJx9jdcGe2wICOk5Urzxh1WLAHyHM+U=";
  # };
  # Chrome 136+ ignores remote debugging switches on the default profile.
  # Keep the wrapper in place, but do not inject remote debugging flags into
  # the normal Chrome launcher. The supported path for a real profile is the
  # Chrome remote debugging permission flow used by chrome-devtools-mcp
  # --auto-connect.
  chromeRemoteDebuggingFlags = [];
  placeholder = null; # Dummy binding to keep let block valid
in
{
  google-chrome = prev.symlinkJoin {
    name = prev.google-chrome.name;
    paths = [ prev.google-chrome ];
    nativeBuildInputs = [ final.makeWrapper ];
    postBuild = ''
      rm "$out/bin/google-chrome" "$out/bin/google-chrome-stable"

      makeWrapper ${prev.google-chrome}/bin/google-chrome "$out/bin/google-chrome" \
        ${final.lib.concatMapStringsSep " " (flag: "--add-flags ${final.lib.escapeShellArg flag}") chromeRemoteDebuggingFlags}

      makeWrapper ${prev.google-chrome}/bin/google-chrome-stable "$out/bin/google-chrome-stable" \
        ${final.lib.concatMapStringsSep " " (flag: "--add-flags ${final.lib.escapeShellArg flag}") chromeRemoteDebuggingFlags}

      for desktopName in google-chrome.desktop com.google.Chrome.desktop; do
        desktopFile="$out/share/applications/$desktopName"
        if [ -f "$desktopFile" ]; then
          rm "$desktopFile"
          cp "${prev.google-chrome}/share/applications/$desktopName" "$desktopFile"
          substituteInPlace "$desktopFile" \
            --replace-fail "${prev.google-chrome}/bin/google-chrome-stable" "$out/bin/google-chrome-stable"
          substituteInPlace "$desktopFile" \
            --replace-fail "image/gif;" "" \
            --replace-fail "image/jpeg;" "" \
            --replace-fail "image/png;" "" \
            --replace-fail "image/webp;" ""
        fi
      done
    '';
    meta = prev.google-chrome.meta;
  };

  # Fix poetry pbs-installer version constraint issue
  poetry = prev.poetry.overrideAttrs (oldAttrs: {
    dontCheckRuntimeDeps = true;
  });

  magma = prev.magma.overrideAttrs (oldAttrs: {
    # The CUDA codegen step in magma 2.9.0 can segfault when `make generate`
    # fans out across all cores. Keep the rest of the build parallel.
    preConfigure = builtins.replaceStrings
      [ "make -j$NIX_BUILD_CORES generate" ]
      [ "make -j1 generate" ]
      oldAttrs.preConfigure;
  });

  # XXX: codex and claude-code are now provided by flakes in nix.nix
  # See the overlay at the end of nixpkgs.overlays in nix.nix

  # # XXX: Don't remove this code - use enableCodexOverride flag instead.
  # # nixpkgs often lags behind and codex moves extremely quickly
  # codex = if enableCodexOverride then prev.codex.overrideAttrs (oldAttrs: rec {
  #   inherit (codexVersion) version;
  #   src = prev.fetchFromGitHub {
  #     owner = "openai";
  #     repo = "codex";
  #     tag = "rust-v${codexVersion.version}";
  #     inherit (codexVersion) hash;
  #   };
  #   # Use importCargoLock instead of fetchCargoVendor to avoid workspace parsing issues
  #   cargoDeps = prev.rustPlatform.importCargoLock {
  #     lockFile = "${src}/codex-rs/Cargo.lock";
  #     outputHashes = codexVersion.outputHashes or {};
  #   };
  #   cargoHash = null; # Not used with importCargoLock
  # }) else prev.codex;

  # # XXX: Don't remove this code - use enableClaudeCodeOverride flag instead.
  # # nixpkgs often lags behind and claude-code moves extremely quickly
  # claude-code = if enableClaudeCodeOverride then prev.claude-code.overrideAttrs (oldAttrs: {
  #   inherit (claudeCodeVersion) version npmDepsHash;
  #   src = prev.fetchurl {
  #     url = "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-${claudeCodeVersion.version}.tgz";
  #     inherit (claudeCodeVersion) hash;
  #   };
  # }) else prev.claude-code;

  # nvidia-container-toolkit = prev.nvidia-container-toolkit.overrideAttrs(old: {
  #   postInstall = ''
  #     ${old.postInstall or ""}
  #     mv $tools/bin/nvidia-cdi-hook $tools/bin/.nvidia-cdi-hook-wrapped
  #     cat > $tools/bin/nvidia-cdi-hook <<EOF
  #     #!${final.bash}/bin/bash
  #     # Trap any errors, including crashes
  #     trap 'exit 0' ERR
  #     set +e
  #     $tools/bin/.nvidia-cdi-hook-wrapped "\$@" || true
  #     EOF
  #     chmod +x $tools/bin/nvidia-cdi-hook
  #   '';
  # });
  runc = final.stdenv.mkDerivation {
    pname = "runc-with-logging";
    version = builtins.getAttr "version" prev.runc or "unknown";

    # No sources; we're only wrapping
    src = null;
    dontUnpack = true;
    dontPatchShell = true;
    dontBuild = true;
    dontConfigure = true;

    nativeBuildInputs = [final.installShellFiles];
    buildInputs = [];
    outputs = ["out" "man"];

    installPhase = ''
      mkdir -p "$out/bin"

      cat > "$out/bin/runc" <<EOF
      #!${final.stdenv.shell}

      # If we're running as root, ensure the /var/log/debug/runc directory exists
      # with the desired permissions.
      if [ "\$(id -u)" -eq 0 ]; then
      mkdir -p /var/log/debug/runc
      chown root:users /var/log/debug/runc
      chmod 2777 /var/log/debug/runc
      fi

      # Log this invocation to /var/log/debug/runc/invocations.log
      echo "\$(date) - runc invoked with: \$@" >> /var/log/debug/runc/invocations.log

      # Hand off control to the original runc from prev.runc.
      ${prev.runc}/bin/runc --debug "\$@" > \
      >(tee -a /var/log/debug/runc/stdout.log) \
      2> >(tee -a /var/log/debug/runc/stderr.log >&2)
      EOF

      chmod +x "$out/bin/runc"

      installManPage ${prev.runc.man}/*/*.[1-9]
      mkdir -p $man
      touch $man/afile
    '';

    # Optionally inherit original metadata
    meta = prev.runc.meta // {};
  };

  rofi-systemd = prev.rofi-systemd.overrideAttrs (_: {
    src = prev.fetchFromGitHub {
      repo = "rofi-systemd";
      owner = "IvanMalison";
      rev = "078bdb833a32cc84538d329085fbfe00c7d4d1b6";
      sha256 = "sha256-ikwIc8vR2VV3bHXEtLrGgKklpz1NSRUJoJny0iRNViQ=";
    };
  });

  rofi-pass = prev.rofi-pass.overrideAttrs (_: {
    version = "git-0fb508a";
    src = prev.fetchFromGitHub {
      owner = "colonelpanic8";
      repo = "rofi-pass";
      rev = "0fb508a93ab5f653b63d68ce569e79c8bb27e87b";
      sha256 = "sha256-49kdaqCp6O4RrZMbAKYJKDJaAzHBUqYZT2O7OjtQ8W0=";
    };
    fixupPhase = ''
      runHook preFixup

      patchShebangs $out/bin

      wrapProgram $out/bin/rofi-pass \
        --prefix PATH : "${prev.lib.makeBinPath [
          prev.coreutils
          prev.findutils
          prev.gawk
          prev.gnugrep
          prev.gnused
          prev.libnotify
          prev.pwgen
          prev.rofi
          prev."util-linuxMinimal"
          (prev.pass.withExtensions (ext: [ ext.pass-otp ]))
          prev.xclip
          prev.xdotool
          (prev."pass-wayland".withExtensions (ext: [ ext.pass-otp ]))
          prev."wl-clipboard"
          prev.wtype
        ]}"

      runHook postFixup
    '';
  });

  wyoming-satellite = prev.wyoming-satellite.overridePythonAttrs (oldAttrs: {
    src = prev.fetchFromGitHub {
      owner = "colonelpanic8";
      repo = "wyoming-satellite";
      rev = "509628a9be2cf61116b6d0475e19c0b92a855e0b";
      hash = "sha256-ewSxVv+8r2VGYNOoj8jiMogXtp1GPApcRc2BH3Q+8W8=";
    };
    build-system = with final.python3.pkgs; [ poetry-core setuptools ];
    pythonImportsCheck = [
      "wyoming_satellite"
    ];
    propagatedBuildInputs = [];
  });

  git-sync = prev.git-sync.overrideAttrs (_: {
    src = prev.fetchFromGitHub {
      repo = "git-sync";
      owner = "IvanMalison";
      rev = "92544e76553c25da2d40d06a230ecd0a6e13c114";
      sha256 = "sha256-hBtdvxAtFUMtLqGmy1wbDk796LQcYCth29fv8L0WQyQ=";
    };
  });

  # Using mainline picom with spring physics + animation fixes
  # Branch: my-picom on colonelpanic8/picom
  # Includes: spring physics curve, adaptive settling threshold, position detection fix
  picom = prev.picom.overrideAttrs (old: {
    version = "13";
    src = prev.fetchFromGitHub {
      repo = "picom";
      owner = "colonelpanic8";
      rev = "my-picom";
      sha256 = "sha256-XeciIK5q6WE9wirWEHdevfGiNzRANudFcRcRhouWTFE=";
    };
    doCheck = false;
    dontCheck = true;
  });

  expressvpn = prev.expressvpn.overrideAttrs (_: {
    src = prev.fetchurl {
      url = "https://www.expressvpn.works/clients/linux/expressvpn_3.46.0.7-1_amd64.deb";
      hash = "sha256-v0rr1s32jj79A8IGfJgSGJVlz7rSnZYn4ealOpqee0w=";
    };
  });

  tts = prev.tts.overrideAttrs (old:
    let
      compatAccelerate = final.python3Packages.accelerate.override {
        huggingface-hub = final.python3Packages.huggingface-hub_0;
      };
      compatKDiffusion = final.python3Packages.k-diffusion.override {
        accelerate = compatAccelerate;
      };
      compatTokenizers = final.python3Packages.tokenizers.override {
        huggingface-hub = final.python3Packages.huggingface-hub_0;
      };
      compatTransformers = final.python3Packages.transformers_4.override {
        huggingface-hub = final.python3Packages.huggingface-hub_0;
        tokenizers = compatTokenizers;
      };
      replacePythonDeps = pkg:
        let
          pkgName = pkg.pname or (prev.lib.getName pkg);
        in
        if pkgName == "transformers" then compatTransformers
        else if pkgName == "k-diffusion" then compatKDiffusion
        else pkg;
    in
    {
      propagatedBuildInputs = map replacePythonDeps old.propagatedBuildInputs;
      postPatch = (old.postPatch or "") + ''
        substituteInPlace TTS/tts/layers/tortoise/autoregressive.py \
          --replace-fail \
          'if Version(transformers.__version__) >= Version("4.45"):' \
          'if Version(transformers.__version__) >= Version("4.45") and hasattr(transformers.pytorch_utils, "isin_mps_friendly"):'

        sed -i \
          -e 's/^from transformers import ($/from transformers.generation.beam_search import BeamSearchScorer\
from transformers import (/' \
          -e '/^    BeamSearchScorer,$/d' \
          TTS/tts/layers/xtts/stream_generator.py
      '';
    });

  happy-coder = final.callPackage ./packages/happy-coder { };
  playwright-cli = final.callPackage ./packages/playwright-cli { };
  t3code = final.callPackage ./packages/t3code { };
  # Custom Waybar fork for workspace taskbar support + external SNI watcher option.
  waybar = prev.waybar.overrideAttrs (old: {
    src = prev.fetchFromGitHub {
      owner = "colonelpanic8";
      repo = "Waybar";
      rev = "b17f2f6ec8635bf2a83eea29f75c67d3f1324d36";
      hash = "sha256-VIJyuhzyRnPK/uE+laZ6SBJUMXM/n+CsZHyllHH+zCQ=";
    };
    version = old.version;
    mesonFlags = (old.mesonFlags or []) ++ [ "-Dcava=disabled" ];
  });

  gnupg_2_4_0 = prev.gnupg.overrideAttrs (_: rec {
    pname = "gnupg";
    # 2.4.1 breaks emacs
    version = "2.4.0";
    src = prev.fetchurl {
      url = "mirror://gnupg/gnupg/${pname}-${version}.tar.bz2";
      hash = "sha256-HXkVjdAdmSQx3S4/rLif2slxJ/iXhOosthDGAPsMFIM=";
    };
  });

  pykefcontrol = final.python3Packages.pykefcontrol;

  python-with-my-packages = let
    my-python-packages = python-packages:
    with python-packages; [
      # universal-silabs-flasher
      argcomplete
      appdirs
      ipdb
      ipython
      numpy
      openpyxl
      pip
      pykefcontrol
      requests
    ];
  in
  final.python3.withPackages my-python-packages;

  pythonPackagesExtensions = prev.pythonPackagesExtensions ++ [
    (
      python-final: python-prev: {
        pykefcontrol = python-prev.buildPythonPackage rec {
          pname = "pykefcontrol";
          version = "0.9";
          pyproject = true;

          src = final.fetchFromGitHub {
            owner = "N0ciple";
            repo = "pykefcontrol";
            rev = "530a7d15cf692c35a7c181c8f5e28edc0f1e085a";
            hash = "sha256-V/uYzzUv/PslfZ/zSSAK4j6kI9lLQOXBN1AG0rjRrpg=";
          };

          postPatch = ''
            substituteInPlace pyproject.toml \
              --replace-fail 'version = "0.8"' 'version = "0.9"'
          '';

          build-system = with python-final; [ hatchling ];
          propagatedBuildInputs = with python-final; [
            aiohttp
            requests
          ];

          pythonImportsCheck = [ "pykefcontrol" ];

          meta = with final.lib; {
            description = "Python library for controlling KEF LS50 Wireless II, LSX II, and LS60 speakers";
            homepage = "https://github.com/N0ciple/pykefcontrol";
            license = licenses.mit;
            platforms = platforms.linux ++ platforms.darwin;
          };
        };
        pysilero-vad = python-prev.pysilero-vad.overridePythonAttrs (_: {
          src = final.fetchFromGitHub {
            owner = "colonelpanic8";
            repo = "pysilero-vad";
            rev = "846caf4aa6c5f5319b87d3127dfe0aa9e88b338e";
            hash = "sha256-SjoyiHm2RiLDFbwduKsoPK4/AvQiwZ39ZsPj2etXRV0=";
          };
        });
        home-assistant-chip-wheels = python-prev.home-assistant-chip-wheels.overrideAttrs
        (oldAttrs: rec {
          bypassAttestationVerificationPatch = final.fetchpatch {
            url = "https://raw.githubusercontent.com/tronikos/chip-wheels/8a5ec21d114010723cf428ffe79e244da7562390/8766-Bypass-attestation-verification.patch";
            sha256 = "sha256-RgmlPRSfw1PPMdHBzpoK2Drrb8nEagATY8Y5ngi7x0k=";
          };
          postPatch = (oldAttrs.postPatch or "") + ''
            pushd connectedhomeip
            patch -p1 < ${bypassAttestationVerificationPatch}
            popd
          '';
        });
      }
    )
  ];
}