{ pkgs, config, ... }:
let
  userName = config.hyperhive.user.name;
in
{
  imports = [ ./harness-base.nix ];

  # Manager auto-unsubscribes from repo watches and skips the subscription/
  # participation firehose — only direct mentions, reviews, and assignments
  # land in the inbox. Sub-agents default to keepSubscriptions=true and
  # skipNotifyReasons=[].
  hyperhive.forge.keepSubscriptions = false;
  hyperhive.forge.skipNotifyReasons = [
    "subscribed"
    "participating"
  ];

  # HIVE_PORT/HIVE_LABEL/gitconfig are also injected by the generated
  # `applied/hm1nd/flake.nix` (see `lifecycle::setup_applied`); the values
  # here are the base config so the container stays sensible if anyone
  # ever evaluates `nixosConfigurations.manager` standalone.
  systemd.services.hive-m1nd = {
    description = "hive-m1nd manager harness";
    wantedBy = [ "multi-user.target" ];
    after = [ "network.target" ];
    environment = {
      HIVE_PORT = "8000";
      HIVE_LABEL = "hm1nd";
      SHELL = "${pkgs.bashInteractive}/bin/bash";
      # `HOME` set explicitly so claude finds `~/.claude/` at the
      # bind-mounted location after #658 (User= drop from root).
      HOME = "/home/${userName}";
      # Manager runs the same hive-m1nd harness binary that serves
      # the per-agent web UI; point it at the merged agent static dist
      # (same shape as for sub-agents).
      HIVE_STATIC_DIR = "${config.hyperhive.frontend.mergedDist}";
      # Static runtime assets (branding + claude prompts). Set on the
      # unit directly — `environment.variables` in harness-base.nix only
      # populates /etc/profile, which systemd services don't inherit.
      HIVE_ASSETS_DIR = "${pkgs.hyperhive-assets}/share/hyperhive";
    };
    # See note in agent-base.nix for the rationale on both entries —
    # `/run/wrappers/bin` so the setuid sudo shim resolves before the
    # bare nix-store binary (#658 fixup), `/run/current-system/sw`
    # so the harness PATH tracks `environment.systemPackages`.
    path = [
      "/run/wrappers/bin"
      "/run/current-system/sw"
    ];
    serviceConfig = {
      ExecStart = "${pkgs.hyperhive}/bin/hive-m1nd serve";
      Restart = "on-failure";
      RestartSec = 2;
      # `/run/hive-config/` is a per-service runtime dir owned by
      # the agent user (`User=` below), auto-cleared by systemd on
      # stop. The harness writes its regenerated
      # claude-{mcp-config,settings,system-prompt} files there
      # (see `paths::config_dir`). Kept separate from `/run/hive`
      # — that bind comes in root-owned from the host and holds
      # hive-c0re's `mcp.sock` we only connect to (#658 fixup).
      RuntimeDirectory = "hive-config";
      # Same drop-from-root as agent-base.nix (#658). Manager
      # interactions with the host (rebuild approvals, config
      # writes) still happen via the dedicated unix sockets
      # bind-mounted from hive-c0re — those don't need root
      # inside the container.
      User = userName;
      Group = userName;
    };
  };
}