{
  config,
  lib,
  pkgs,
  ...
}:
let
  agentProfile = pkgs.writeText "agent.profile" ''
    whitelist /nix/store
    whitelist /nix/var
    read-only /nix/store
    whitelist ''${HOME}/.cache/nix
    whitelist ''${HOME}/.local/state/nix
    whitelist /etc/nix
    whitelist /etc/nixos
    whitelist /nix/var/nix/daemon-socket
    whitelist ''${HOME}/dev
    whitelist ''${HOME}/work
    whitelist ''${HOME}/.config

    blacklist ''${HOME}
    blacklist /etc/nixos/secrets
    blacklist /etc/shadow
    blacklist /etc/sudoers
    blacklist /etc/sudoers.d
    blacklist /root

    caps.drop all
    nonewprivs
    noroot
    seccomp

    no3d
    nodvd
    notv
    nou2f
    novideo


    ignore net none

    machine-id
    disable-mnt
    private-dev
    private-tmp
    private-cache
  '';
in
{
  programs.firejail = {
    enable = true;
    wrappedBinaries = {
      claude = {
        executable = "${pkgs.claude-code}/bin/claude";
        profile = agentProfile;
        extraArgs = [
          "--private=~/.local/state/claude-home"
        ];
      };
      opencode = {
        executable = "${pkgs.opencode}/bin/opencode";
        profile = agentProfile;
        extraArgs = [
          "--private=/home/user/.local/state/opencode-home"
        ];
      };
      chromium-sandbox = {
        executable = "${pkgs.chromium}/bin/chromium";
        profile = "${pkgs.firejail}/etc/firejail/chromium-browser.profile";
        extraArgs = [
          "--netns=wg0ns"
          "--whitelist=~/downloads"
          "--env=TGK_THEME=Adwaita:dark"
          "--dns=10.2.0.1"
          "--private=/home/user/.local/state/chromium-home"
        ];
      };
      google-chrome-stable = {
        # executable = "${chrome-argumented}/bin/google-chrome-stable";
        executable = "${pkgs.google-chrome}/bin/google-chrome-stable";
        profile = "${pkgs.firejail}/etc/firejail/google-chrome-stable.profile";
        extraArgs = [
          "--env=GTK_THEME=Adwaita:dark"
          "--netns=wg-br0ns"
          "--dns=10.2.0.1"
          "--whitelist=/home/user/downloads"
          "--whitelist=/home/user/pictures"
        ];
      };
      tor-browser = {
        executable = "${pkgs.tor-browser}/bin/tor-browser";
        profile = "${pkgs.firejail}/etc/firejail/tor-browser-en-us.profile";
        extraArgs = [
          "--netns=wg0ns"
          "--dns=1.1.1.1"
        ];
      };
      freetube = {
        executable = "${pkgs.freetube}/bin/freetube";
        profile = "${pkgs.firejail}/etc/firejail/freetube.profile";
        extraArgs = [
          "--netns=wg0ns"
          "--dns=1.1.1.1"
        ];
      };
    };
  };
}