{ config, pkgs, inputs, ... }:
{
  imports = [
    ./programs.vscode.nix
  ];

  home.packages = with pkgs; [ ];

  programs.mise = {
    enable = true;
    enableZshIntegration = false;
  };

  programs.zsh.shellAliases = {
    laws = "aws --endpoint=http://localhost:4566";
    assume = "source $(brew --prefix)/bin/assume";
  };

  programs.zsh.initContent = ''
    # Update tab title dynamically based on state
    update_starship_tab_title() {
      # 1. Respect Claude Code active sessions
      if [[ -n "$CLAUDE_CODE_ENTRYPOINT" || -n "$IN_CLAUDE_CODE" ]]; then
        return
      fi

      # 2. Extract git branch if available
      local branch
      branch=$(git branch --show-current 2>/dev/null)

      # 3. Output OSC escape sequence (Branch name or directory fallback)
      if [[ -n "$branch" ]]; then
        printf "\033]2;%s\007" "$branch"
      else
        printf "\033]2;%s\007" "''${PWD:t}"
      fi
    }

    # Hook into Starship's user function lifecycle
    starship_precmd_user_func="update_starship_tab_title"
  '';

  home.sessionVariables = {
    CLAUDE_CONFIG_DIR = "${config.home.homeDirectory}/.config/claude";
    # Points to the Homebrew location mentioned in your caveat
    JAVA_HOME = "/Library/Java/JavaVirtualMachines/zulu-17.jdk/Contents/Home";
    NPM_CONFIG_PREFIX = "${config.home.homeDirectory}/.npm-global";
    GRANTED_ALIAS_CONFIGURED = "true";
    # Stub SDK root so tools that require ANDROID_HOME/platform-tools/adb work
    # even though adb is managed by Homebrew (android-platform-tools cask).
    ANDROID_HOME = "${config.home.homeDirectory}/android-sdk";
    # Runtime lookup from Apple Keychain — only the command, not the token, is in the store.
    JIRA_API_TOKEN = ''$(security find-generic-password -a "$USER" -s jira-token -w 2>/dev/null)'';

    # Parity with the ANSIBLE MANAGED BLOCKs the playbook writes to ~/.zshrc.
    DOCKER_CLI_HINTS = "false";
    GRANTED_ENABLE_AUTO_REASSUME = "true";
    COPILOT_OTEL_ENABLED = "true";
    COPILOT_OTEL_EXPORTER_TYPE = "file";
    # Timestamped per session, like the ansible line (command substitution is intentional).
    COPILOT_OTEL_FILE_EXPORTER_PATH = ''$HOME/.copilot/otel/copilot-otel-$(date +%Y%m%d-%H%M%S).jsonl'';
  };

  home.sessionPath = [
    "${config.home.homeDirectory}/.npm-global/bin"
    "${config.home.homeDirectory}/.local/share/mise/shims"
  ];

  # git credential.helper=osxkeychain (parity with tasks/git.yml). Darwin-only, so
  # it lives here rather than in the cross-platform home.shared.nix.
  programs.git.settings.credential.helper = "osxkeychain";

  home.file.".npmrc".text = ''
    prefix=${config.home.homeDirectory}/.npm-global
  '';

  home.file."android-sdk/platform-tools/adb".source = config.lib.file.mkOutOfStoreSymlink "/opt/homebrew/bin/adb";
  home.file."android-sdk/cmdline-tools/latest/bin/sdkmanager".source = config.lib.file.mkOutOfStoreSymlink "/opt/homebrew/bin/sdkmanager";

  home.file.".copilot/settings.json".text = builtins.toJSON {
    footer = {
      showModelEffort = true;
      showBranch = true;
      showDirectory = true;
      showContextWindow = true;
      showQuota = true;
      showAgent = true;
    };
  };

  # opencode (tasks/config/opencode.yml)
  xdg.configFile."opencode/opencode.json".text = builtins.toJSON {
    "$schema" = "https://opencode.ai/config.json";
    model = "github-copilot/gpt-5.4";
    plugin = [ "@slkiser/opencode-quota" ];
    autoupdate = false;
  };
  xdg.configFile."opencode/tui.json".text = builtins.toJSON {
    "$schema" = "https://opencode.ai/tui.json";
    plugin = [ "@slkiser/opencode-quota" ];
  };
  xdg.configFile."opencode/opencode-quota/quota-toast.json".text = builtins.toJSON {
    enabledProviders = "auto";
    percentDisplayMode = "used";
    enableToast = false;
    tuiCompactStatus.enabled = false;
    tuiSidebarPanel.enabled = true;
    maintainerAnnouncements = { enabled = false; home = false; };
  };
}