{ pkgs, pkgs-unstable, ... }:

let
  sbox = pkgs.writeShellScriptBin "sbox" ''
    set -euo pipefail

    ${pkgs.coreutils}/bin/mkdir -p /tmp/pi "$HOME/.local/share/cargo-pi"

    bwrap_args=(
      --die-with-parent
      --tmpfs /
      --dev /dev
      --proc /proc
      --bind /tmp/pi /tmp
      --ro-bind /etc /etc
      --bind /nix/store /nix/store
      --ro-bind /usr/bin/env /usr/bin/env
      --setenv NIX_REMOTE daemon
      --bind-try /nix/var/nix/daemon-socket /nix/var/nix/daemon-socket
      --dir /run
      --ro-bind-try /run/current-system /run/current-system
      --ro-bind /doc /doc
      # mount git and jj config
      --ro-bind "$HOME/.config" "$HOME/.config"
      --ro-bind "$HOME/repos/config" "$HOME/repos/config"
      # jj must be able to write to ~/.config/jj/repos: https://github.com/jj-vcs/jj/issues/8841
      --overlay-src "$HOME/.config/jj" --tmp-overlay "$HOME/.config/jj"
      --setenv CARGO_HOME "$HOME/.local/share/cargo-pi"
      --bind "$HOME/.local/share/cargo-pi" "$HOME/.local/share/cargo-pi"
    )

    exec ${pkgs.bubblewrap}/bin/bwrap "''${bwrap_args[@]}" "$@"
  '';

  pi = pkgs.writeShellScriptBin "pi" ''
    set -euo pipefail

    exec ${sbox}/bin/sbox \
      --setenv PI_CODING_AGENT_DIR "$HOME/.config/pi" \
      --bind "$HOME/.config/pi" "$HOME/.config/pi" \
      --bind "$PWD" "$PWD" \
      --chdir "$PWD" \
      ${pkgs-unstable.pi-coding-agent}/bin/pi "$@"
  '';

  pit = pkgs.writeShellScriptBin "pit" ''
    set -euo pipefail

    tmp_cwd="$(${pkgs.coreutils}/bin/mktemp -d /tmp/pit.XXXXXX)"
    cleanup() {
      ${pkgs.coreutils}/bin/rmdir "$tmp_cwd" 2>/dev/null || true
    }
    trap cleanup EXIT

    cd "$tmp_cwd"
    exec ${pi}/bin/pi "$@"
  '';
in
{
  environment.systemPackages = [
    sbox
    pi
    pit
  ];
}