{
  "sandbox": {
    "network": true,
    "capabilities": [],
    "read_only": [
      "/usr", "/bin", "/sbin", "/lib", "/lib64",
      "/etc/resolv.conf", "/etc/hosts", "/etc/nsswitch.conf", "/etc/ssl/certs",
      "/root/.local/bin/claude"
    ],
    "homes": ["/root/.claude", "/root/.claude.json", "/root/.codex"]
  },
  "limits": {"wall": "6h", "processes": 4096}
}