{ config, pkgs, lib, ... }:

let
  # Wrapper to launch Chromium on Wayland, scale=1, DevTools debugging on 127.0.0.1:9222
  chromiumWaylandWrapper = pkgs.writeShellScriptBin "chromium-mcp" ''
    exec ${pkgs.chromium}/bin/chromium \
      --ozone-platform=wayland \
      --enable-features=UseOzonePlatform \
      --force-device-scale-factor=1 \
      --remote-debugging-address=127.0.0.1 \
      --remote-debugging-port=9222 \
      "$@"
  '';

  # Desktop entry that uses our wrapper. The filename will be chromium.desktop
  chromiumDesktopOverride = pkgs.makeDesktopItem {
    name = "chromium";  # ← important: must match stock filename to override
    desktopName = "Chromium";
    genericName  = "Web Browser";
    comment      = "Chromium on Wayland (scale=1) with DevTools remote debugging for MCP";
    icon         = "chromium";
    exec         = "${chromiumWaylandWrapper}/bin/chromium-mcp %U";
    terminal     = false;
    categories   = [ "Network" "WebBrowser" ];
    mimeTypes = [
      "text/html" "text/xml" "application/xhtml+xml"
      "x-scheme-handler/http" "x-scheme-handler/https"
      "x-scheme-handler/ftp"  "x-scheme-handler/chrome"
    ];
    # If you want extra desktop keys, you can add them as a raw block:
  };
in
{
  # Tools: Chromium, Node (for MCP server), our wrapper, and the desktop override
  environment.systemPackages = [
    pkgs.chromium
    pkgs.nodejs_22   # 25.05 ships Node 22 LTS; works great for MCP servers
    chromiumWaylandWrapper
    chromiumDesktopOverride  # ← keep AFTER pkgs.chromium so our .desktop wins
  ];

  # Where Codex CLI reads config; we make it system-wide
  environment.variables.CODEX_HOME = "/etc/codex";

  # Codex CLI MCP config: wires Chrome DevTools MCP to the local DevTools port
  environment.etc."codex/config.toml".text = ''
    [mcp_servers.chrome-devtools]
    command = "npx"
    args = ["-y", "chrome-devtools-mcp@latest", "--browserUrl=http://127.0.0.1:9222"]
    startup_timeout_sec = 30
    tool_timeout_sec = 120
  '';

  # No firewall opening: binding to 127.0.0.1 only
  # networking.firewall.allowedTCPPorts = [ 9222 ];
}