{ config, lib, ... }:
{
  config = lib.mkIf (config.networking.hostName == "blunix") {
    environment.etc."codex/rules/herdr-self-close.rules".text = ''
      prefix_rule(
          pattern = ["/etc/scripts/close-my-pane.sh"],
          decision = "allow",
          justification = "Allow a completed Herdr specialist to close only its own pane via HERDR_PANE_ID",
          match = [
              "/etc/scripts/close-my-pane.sh",
              "/etc/scripts/close-my-pane.sh ignored-argument",
          ],
      )
    '';

    environment.etc."scripts/close-my-pane.sh" = {
      mode = "0755";
      text = ''
        #!/usr/bin/env bash
        set -euo pipefail

        : "''${HERDR_PANE_ID:?HERDR_PANE_ID must be set}"
        exec herdr pane close "$HERDR_PANE_ID"
      '';
    };

  };
}