"modules/common/z-ai-key.age".publicKeys = [ yuzu date kiwi ] ++ admins;

{ pkgs, lib, config, ... }:
{

{ pkgs, lib, config, ... }: let
  inherit (lib) mkIf enabled;
in mkIf config.isDesktop {

  environment.systemPackages = lib.optionals config.isDesktop [

  environment.systemPackages = [

  age.secrets.key = {
    file = ./z-ai-key.age;
    owner = "jam";
    group = "users";
    mode = "0400";
  };
  home-manager.sharedModules = [{
    programs.claude-code = enabled {
      package = pkgs.symlinkJoin {
        name = "claude-code-wrapped";
        paths = [ pkgs.claude-code ];
        buildInputs = [ pkgs.makeWrapper ];
        postBuild = ''
          wrapProgram $out/bin/claude \
            --run 'export ANTHROPIC_AUTH_TOKEN=$(cat ${config.age.secrets.key.path})'
        '';
      };

  # There is a HM program from claude-code but unfree doesn't work the same
  # need to check it before I can enable it this way.
  # home-manager.sharedModules = [{
  #   programs.claude-code = mkIf config.isDesktop enabled;
  # }];

      settings = {
        cleanupPeriodDays     = 1000;
        alwaysThinkingEnabled = false;
        includeCoAuthoredBy   = false;
        env = {
          ANTHROPIC_BASE_URL   = "https://api.z.ai/api/anthropic";
          API_TIMEOUT_MS       = "3000000";
          ANTHROPIC_DEFAULT_HAIKU_MODEL  = "glm-4.5-air";
          ANTHROPIC_DEFAULT_SONNET_MODEL = "glm-4.6";
          ANTHROPIC_DEFAULT_OPUS_MODEL   = "glm-4.6";
          CLAUDE_BASH_MAINTAIN_PROJECT_WORKING_DIR = 1;
          CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC = 1;
          DISABLE_NON_ESSENTIAL_MODEL_CALLS        = 1;
        };
        deny = [
          "Read(*.env)"
          "Read(*.envrc)"
          "Bash(git push:*)"
          "Bash(git commit:*)"
        ];
      };
    };
  }];

		admins = [ keys.jam keys.pear keys.yuzu keys.date ];

		admins = [ keys.jam ];