build(nix): add Nix flake for reproducible builds and dev shell

.envrc

@@ -0,0 +1 @@
+use flake

.gitignore

@@ -87,3 +87,8 @@ onwatch-test
 .omc/
 .omx/
 .playwright-mcp/
+
+# Nix
+/result
+/result-*
+.direnv/

CLAUDE.md

@@ -42,6 +42,16 @@ internal/
 go test -race ./... && go vet ./...   # Pre-commit (mandatory)
 ```
 
+**Nix (alternative to app.sh, for build + dev shell):**
+
+```bash
+nix build .#onwatch         # Pure-Go static binary -> ./result/bin/onwatch
+nix run .#onwatch           # Build + run
+nix develop                 # Shell with go/gopls/gotools/gofumpt (or `direnv allow`)
+```
+
+On `go.sum` changes, update `vendorHash` in `flake.nix` (run `nix build .#onwatch`, paste the `got: sha256-...` from the error). Flake tracks `nixos-unstable` because `go.mod` requires Go >= 1.25.7.
+
 ## Guardrails
 
 | Rule | Reason |

README.md

@@ -578,6 +578,20 @@ See [DEVELOPMENT.md](docs/DEVELOPMENT.md) for build instructions, cross-compilat
 ./app.sh --release     # Cross-compile all platforms (or: make release-local)
 ```
 
+### Nix
+
+If you have Nix (flakes enabled), you can build, run, and develop without touching `app.sh`:
+
+```bash
+nix build .#onwatch            # Build -> ./result/bin/onwatch (pure-Go, static)
+nix run .#onwatch -- --debug   # Build + run
+nix develop                    # Enter a shell with go, gopls, gotools, gofumpt
+```
+
+With [direnv](https://direnv.net/) installed, run `direnv allow` once and the devShell loads automatically on `cd`.
+
+The flake tracks `nixos-unstable` (pinned via `flake.lock`) because `go.mod` requires Go >= 1.25.7 and the `nixos-25.05` branch only ships Go 1.24. When you change `go.sum`, update the `vendorHash` in `flake.nix` by running `nix build .#onwatch` and pasting the `got: sha256-...` value from the mismatch error.
+
 ---
 
 ## Contributing

flake.nix

@@ -0,0 +1,51 @@
+{
+  description = "onWatch - Go CLI for AI quota tracking";
+
+  inputs = {
+    # nixos-25.05 ships Go 1.24 (and go_1_25 = 1.25.5); go.mod requires
+    # >= 1.25.7, so we track nixos-unstable which defaults to Go 1.26.x.
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    flake-utils.url = "github:numtide/flake-utils";
+  };
+
+  outputs = { self, nixpkgs, flake-utils }:
+    flake-utils.lib.eachDefaultSystem (system:
+      let
+        pkgs = import nixpkgs { inherit system; };
+        lib = pkgs.lib;
+        version = builtins.readFile ./VERSION;
+        onwatch = pkgs.buildGoModule {
+          pname = "onwatch";
+          inherit version;
+          src = ./.;
+          subPackages = [ "." ];
+          vendorHash = "sha256-zagPclPZItTTUaMh+8Ph7k5ESqc3vETPNkhMQ493MoY=";
+          ldflags = [
+            "-s"
+            "-w"
+            "-X main.version=${version}"
+          ];
+          env.CGO_ENABLED = 0;
+        };
+      in
+      {
+        packages = {
+          inherit onwatch;
+          default = onwatch;
+        };
+
+        apps.default = {
+          type = "app";
+          program = "${onwatch}/bin/onwatch";
+        };
+
+        devShells.default = pkgs.mkShell {
+          packages = with pkgs; [
+            go
+            gopls
+            gotools
+            gofumpt
+          ];
+        };
+      });
+}