nixos/cleo.home.nix

{ config, lib, pkgs, inputs, ... }:
let
  oldPkgs = import inputs.nixpkgs-nodejs {
    system = pkgs.stdenv.hostPlatform.system;
    config.allowUnfree = true;
  };
in
{
  home.username = "matthew.bessette";
  home.homeDirectory = "/Users/matthew.bessette";

  home.packages = with pkgs; [];

  programs.vscode = {
    enable = true;
    mutableExtensionsDir = false;
    profiles.default = {
      userSettings = builtins.fromJSON (builtins.readFile ./config.vscode.settings.json);
      extensions = (
        with pkgs.vscode-marketplace-release; [
          bbenoist.nix
          graphql.vscode-graphql-syntax
          graphql.vscode-graphql
          ms-python.debugpy
          ms-python.python
          ms-python.vscode-pylance
          oxc.oxc-vscode
          vscode-icons-team.vscode-icons
          typescriptteam.native-preview
          waderyan.gitblame
        ]
      ) ++ (
        with pkgs.vscode-marketplace; [
          biomejs.biome
        ]
      );
    };
  };

  # mise runtime manager — installed by nix. Zsh integration is disabled
  # because `mise activate zsh` registers a precmd hook that re-evaluates the
  # environment before every prompt, causing a per-command shell delay.
  # Tools still resolve via shims on PATH (see home.sessionPath below); this
  # trades away mise's per-directory env-var auto-loading for prompt speed.
  programs.mise = {
    enable = true;
    enableZshIntegration = false;
  };

  programs.zsh.shellAliases = {
    laws = "aws --endpoint=http://localhost:4566";
    assume = "source $(brew --prefix)/bin/assume";
  };

  home.sessionVariables = {
    CLAUDE_CONFIG_DIR = "${config.home.homeDirectory}/.config/claude";
    # Points to the Homebrew location mentioned in your caveat
    JAVA_HOME = "/Library/Java/JavaVirtualMachines/zulu-17.jdk/Contents/Home";
    NPM_CONFIG_PREFIX = "${config.home.homeDirectory}/.npm-global";
    GRANTED_ALIAS_CONFIGURED = "true";
    # Stub SDK root so tools that require ANDROID_HOME/platform-tools/adb work
    # even though adb is managed by Homebrew (android-platform-tools cask).
    ANDROID_HOME = "${config.home.homeDirectory}/android-sdk";
    # Runtime lookup from Apple Keychain — only the command, not the token, is in the store.
    JIRA_API_TOKEN = ''$(security find-generic-password -a "$USER" -s jira-token -w 2>/dev/null)'';

    # Parity with the ANSIBLE MANAGED BLOCKs the playbook writes to ~/.zshrc.
    DOCKER_CLI_HINTS = "false";
    GRANTED_ENABLE_AUTO_REASSUME = "true";
    COPILOT_OTEL_ENABLED = "true";
    COPILOT_OTEL_EXPORTER_TYPE = "file";
    # Timestamped per session, like the ansible line (command substitution is intentional).
    COPILOT_OTEL_FILE_EXPORTER_PATH = ''$HOME/.copilot/otel/copilot-otel-$(date +%Y%m%d-%H%M%S).jsonl'';
  };

  home.sessionPath = [
    "${config.home.homeDirectory}/.npm-global/bin"
    "${config.home.homeDirectory}/.local/share/mise/shims"
  ];

  # git credential.helper=osxkeychain (parity with tasks/git.yml). Darwin-only, so
  # it lives here rather than in the cross-platform home.shared.nix.
  programs.git.settings.credential.helper = "osxkeychain";

  home.file.".npmrc".text = ''
    prefix=${config.home.homeDirectory}/.npm-global
  '' ;

  # Stub Android SDK directory so ANDROID_HOME/platform-tools/adb resolves to
  # the adb binary installed by the android-platform-tools Homebrew cask.
  home.file."android-sdk/platform-tools/adb".source = config.lib.file.mkOutOfStoreSymlink "/opt/homebrew/bin/adb";
  home.file."android-sdk/cmdline-tools/latest/bin/sdkmanager".source = config.lib.file.mkOutOfStoreSymlink "/opt/homebrew/bin/sdkmanager";
  xdg.configFile."oxlint/oxlintrc.json".source = config.lib.file.mkOutOfStoreSymlink "/Users/matthew.bessette/nixos/config.oxlintrc.json";
  xdg.configFile."biome/biome.json".source = config.lib.file.mkOutOfStoreSymlink "/Users/matthew.bessette/nixos/config.biome.json";

  # --- Tool config parity with local-dev-ansible (tasks/config/*) ---
  # Note: ~/.aws/config is intentionally NOT managed here — `aws-sso-util configure
  # populate` must rewrite it at runtime, which a read-only nix symlink would block.
  # Run once after switch:
  #   aws-sso-util configure populate \
  #     --sso-start-url https://d-9067516d20.awsapps.com/start \
  #     --sso-region us-east-1 --region us-east-1 --config-default output=json

  # GitHub Copilot CLI (tasks/config/copilot.yml)
  home.file.".copilot/settings.json".text = builtins.toJSON {
    footer = {
      showModelEffort = true;
      showBranch = true;
      showDirectory = true;
      showContextWindow = true;
      showQuota = true;
      showAgent = true;
    };
  };

  # opencode (tasks/config/opencode.yml)
  xdg.configFile."opencode/opencode.json".text = builtins.toJSON {
    "$schema" = "https://opencode.ai/config.json";
    model = "github-copilot/gpt-5.4";
    plugin = [ "@slkiser/opencode-quota" ];
    autoupdate = false;
  };
  xdg.configFile."opencode/tui.json".text = builtins.toJSON {
    "$schema" = "https://opencode.ai/tui.json";
    plugin = [ "@slkiser/opencode-quota" ];
  };
  xdg.configFile."opencode/opencode-quota/quota-toast.json".text = builtins.toJSON {
    enabledProviders = "auto";
    percentDisplayMode = "used";
    enableToast = false;
    tuiCompactStatus.enabled = false;
    tuiSidebarPanel.enabled = true;
    maintainerAnnouncements = { enabled = false; home = false; };
  };

  # Claude Code settings (tasks/config/claude-code.yml) — cleo-scoped override of the
  # shared config.claude.json, since claude-statusline is only installed on cleo.
  # mkForce wins over home.shared.nix's `.source = ./config.claude.json`.
  xdg.configFile."claude/settings.json".source = lib.mkForce (pkgs.writeText "claude-settings.json" (builtins.toJSON {
    "$schema" = "https://json.schemastore.org/claude-code-settings.json";
    theme = "dark";
    agent = "plan";
    denyCommands = [ "code --install-extension*" ];
    additionalDirectories = [ "/tmp" ];
    autoMemoryEnabled = false;
    effortLevel = "medium";
    fastModePerSessionOptIn = true;
    feedbackSurveyRate = 0;
    model = "opusplan";
    showClearContextOnPlanAccept = false;
    statusLine = { type = "command"; command = "claude-statusline prompt"; };
  }));
  xdg.configFile."claude-statusline/config.toml".text = ''
    format = "$directory | $git_branch | $model | $cost | $context | $usage"
    preset = "default"

    [usage]
    disabled = false
    format = 'S: {{printf "%.0f" .BlockPct}}% ({{.BlockResets}}) | W: {{printf "%.0f" .WeeklyPct}}%'
  '';
}