{
  config,
  lib,
  pkgs,
  ...
}:

let
  authReady = config.secrets.templatePath ? "opencode/auth.json";
in
{
  config = lib.mkIf config.ai-tools.opencode.enable {
    secrets.files.opencode = [ "api-key" ];

    secrets.templates."opencode/auth.json" = {
      path = ".local/share/opencode/auth.json";
      content = builtins.toJSON {
        zai-coding-plan = {
          type = "api";
          key = config.sops.placeholder."opencode/api-key";
        };
      };
    };

    warnings =
      lib.optional (!authReady)
        "opencode is enabled but its auth template is unavailable. the opencode API key will not be configured.";

    home.packages = [ pkgs.opencode ];
    home.file.".config/opencode/opencode.json".text = builtins.toJSON {
      "$schema" = "https://opencode.ai/config.json";
      permission = {
        external_directory = {
          "/run/secrets/" = "deny";
          "~/.config/sops/age/keys.txt" = "deny";
          "~/.ssh/id_rsa" = "deny";
          "~/.ssh/id_ed25519" = "deny";
          "~/.ssh/id_ecdsa" = "deny";
          "~/.ssh/id_dsa" = "deny";
          "/etc/ssh/ssh_host_rsa_key" = "deny";
          "/etc/ssh/ssh_host_ed25519_key" = "deny";
          "/etc/ssh/ssh_host_ecdsa_key" = "deny";
          "/etc/ssh/ssh_host_dsa_key" = "deny";
        };
        command = {
          sops = "deny";
        };
      };
      plugin = [ "@mohak34/opencode-notifier@latest" ];
    };
  };
}