{
  "extends": "default",
  "meta": {
    "name": "pi-core-personal",
    "description": "Restrictive personal Pi baseline without repository or provider access"
  },
  "groups": {
    "exclude": [
      "homebrew_linux",
      "homebrew_macos",
      "system_write_linux",
      "system_write_macos",
      "user_tools"
    ]
  },
  "security": {
    "signal_mode": "isolated",
    "capability_elevation": false
  },
  "workdir": {
    "access": "none"
  },
  "filesystem": {
    "allow": [
      "$XDG_CACHE_HOME/pi-sbx/personal",
      "$XDG_STATE_HOME/pi-sbx/personal/agent",
      "$XDG_STATE_HOME/pi-sbx/personal/sessions"
    ],
    "read": [
      "/home/jb/.bun/install/global/node_modules/@earendil-works/pi-coding-agent",
      "/home/jb/.bun/install/global/node_modules/jiti"
    ],
    "allow_file": [
      "/dev/null",
      "/dev/stderr",
      "/dev/stdout",
      "/dev/tty"
    ],
    "read_file": [
      "/home/jb/.pi/agent/AGENTS.md",
      "/usr/bin/node"
    ]
  },
  "linux": {
    "af_unix_mediation": "pathname"
  },
  "network": {
    "block": true
  },
  "environment": {
    "allow_vars": [
      "COLORTERM",
      "HOME",
      "LANG",
      "LC_ALL",
      "NO_COLOR",
      "PATH",
      "PI_SBX_PROVIDER",
      "SHELL",
      "TERM",
      "TMPDIR",
      "XDG_CACHE_HOME",
      "XDG_CONFIG_HOME",
      "XDG_RUNTIME_DIR",
      "XDG_STATE_HOME"
    ],
    "deny_vars": [
      "ANTHROPIC_API_KEY",
      "GH_TOKEN",
      "GITHUB_TOKEN",
      "MORPH_API_KEY",
      "OPENAI_API_KEY",
      "SSH_AUTH_SOCK"
    ],
    "set_vars": {
      "PI_CODING_AGENT_DIR": "$XDG_STATE_HOME/pi-sbx/personal/agent",
      "PI_CODING_AGENT_SESSION_DIR": "$XDG_STATE_HOME/pi-sbx/personal/sessions",
      "PI_SKIP_VERSION_CHECK": "1",
      "PI_TELEMETRY": "0"
    }
  },
  "open_urls": {
    "allow_origins": [],
    "allow_localhost": false
  },
  "allow_launch_services": false
}