{ inputs, config, lib, ... }:

let
  # Both pi and opencode talk to Langdock on work machines and expect the API
  # key in the environment, so the secret is managed here rather than in the
  # individual agent modules.
  needsLangdock = config.dot.llm.pi.workMode || config.dot.llm.opencode.workMode;
in
{
  imports = [
    inputs.sops-nix.homeManagerModules.sops
  ];

  sops = {
    defaultSopsFile = ../../secrets/secrets.yaml;
    defaultSopsFormat = "yaml";

    age = {
      keyFile = "${config.home.homeDirectory}/.config/sops/age/keys.txt";
    };

    secrets = lib.mkIf needsLangdock {
      langdock_api_key = {
        # Uses defaultSopsFile from secrets.nix
      };
    };
  };

  home.sessionVariables = {
    SOPS_AGE_KEY_FILE = config.sops.age.keyFile;
  };

  # Export the decrypted langdock API key as an env var. The secret lives in a
  # runtime file, so it is read at shell startup rather than baked into the Nix
  # store via home.sessionVariables.
  programs.zsh.initContent = lib.mkIf needsLangdock ''
    if [ -r "${config.sops.secrets.langdock_api_key.path}" ]; then
      export LANGDOCK_API_KEY="$(cat "${config.sops.secrets.langdock_api_key.path}")"
    fi
  '';
}