# REA ("Reverse Engineer Anything") for the agent: `services.hyperhive.agent.rea.enable`
# puts the `rea` CLI, Ghidra 12.1 (with its JDK) and procps in the container and
# registers `rea mcp` as `extraMcpServers.rea` with every tool auto-approved.
#
# - Ghidra is the pinned nixpkgs' `ghidra-bin` recipe at 12.1.x (see
#   ../packages/ghidra-12-1.nix); REA rejects the pinned 12.0.4. Both packages
#   come in through `services.hyperhive.agent.packages` only when this is on, so an
#   agent without it keeps the shared closure.
# - REA's headless Ghidra needs a procps-compatible `ps` on PATH.
# - The Ghidra project lives under the agent's state dir. REA needs the `.rep`
#   directory next to the `.gpr` path to exist, so tmpfiles creates both as the
#   agent user.
# - The JVM heap (`GHIDRA_HEADLESS_MAXMEM`) shares the agent's memory cap
#   (`agentMemoryMax`); nothing here raises it.
{
  pkgs,
  lib,
  config,
  ...
}:
let
  cfg = config.services.hyperhive.agent;
  userName = cfg.user.name;
  projectDir = "/agents/${userName}/state/rea";
  ghidra = cfg.packages.ghidra-12-1;
  env = {
    GHIDRA_INSTALL_DIR = "${ghidra}/lib/ghidra";
    JAVA_HOME = "${pkgs.openjdk21}";
    REA_GHIDRA_PROJECT_PATH = "${projectDir}/analysis.gpr";
    GHIDRA_HEADLESS_MAXMEM = "2G";
  };
in
{
  options.services.hyperhive.agent.rea.enable = lib.mkEnableOption ''
    REA (Reverse Engineer Anything) with Ghidra in the container. Installs `rea`,
    Ghidra 12.1 and procps, sets `GHIDRA_INSTALL_DIR`, `JAVA_HOME`,
    `REA_GHIDRA_PROJECT_PATH` (under the agent's state dir) and
    `GHIDRA_HEADLESS_MAXMEM`, and registers `rea mcp` as
    `extraMcpServers.rea` with all its tools allowed. Ghidra's 2G heap counts
    against the agent's normal memory cap
  '';

  config = lib.mkIf cfg.rea.enable {
    services.hyperhive.agent.extraMcpServers.rea = {
      command = "${cfg.packages.rea}/bin/rea";
      args = [ "mcp" ];
      inherit env;
      allowedTools = [ "*" ];
    };

    environment.systemPackages = [
      cfg.packages.rea
      ghidra
      pkgs.procps
    ];
    environment.variables = env;

    systemd.tmpfiles.rules = [
      "d ${projectDir} 0700 ${userName} ${userName} -"
      "d ${projectDir}/analysis.rep 0700 ${userName} ${userName} -"
    ];
  };
}