{
  "//": "Read sandbox for the model-picker agent (scripts/ci/pick-model.sh). The",
  "//2": "picker runs in --permission-mode plan (verified to block the Write tool;",
  "//3": "an empty --allowedTools does NOT), so it cannot modify anything. Its",
  "//4": "process still carries CLAUDE_CODE_OAUTH_TOKEN, so this Read deny-list is",
  "//5": "defence in depth on top of plan mode, keeping any read tool away from the",
  "//6": "credential-bearing paths. Mirrors ci/agents/pr-review/settings.json.",
  "permissions": {
    "deny": [
      "Read(//proc/**)",
      "Read(//root/**)",
      "Read(//home/**)",
      "Read(//etc/**)",
      "Read(.git/**)"
    ]
  }
}