nono profile for pi

pi.jsonc

{
  "extends": "always-further/pi",
  "meta": {
    "name": "pi"
  },
  "groups": {
    "include": [],
    "exclude": []
  },
  "commands": {
    "allow": [],
    "deny": []
  },
  "workdir": {
    "access": "readwrite"
  },
  "filesystem": {        
    "allow": [
      "$HOME/Library/Developer/Xcode/DerivedData/",
      "$HOME/.cache/browser-tools",
      "$HOME/Library/Application Support/Google/Chrome for Testing/Crashpad"
    ],
    "read": [
      "$HOME/Library/Developer"
    ],
    "write": [
      "$HOME/Library/Developer/Xcode/DerivedData/"
    ],
    "allow_file": [],
    "read_file": [],
    "write_file": [],
    "deny": [".env"],
    "bypass_protection": [],
    "suppress_save_prompt": []
  },
  "network": {
    "block": false,
    "allow_domain": [],
    "credentials": [],
    "open_port": [],
    "listen_port": [],
    "custom_credentials": {}
  },
  "env_credentials": {},
  "hooks": {},
  "rollback": {
    "exclude_patterns": [],
    "exclude_globs": []
  },
  "unsafe_macos_seatbelt_rules": [
    // allow chrome to be executed inside nono sandbox process tree
    "(allow mach-register (global-name-regex \"^org.chromium.crashpad.\"))",
    "(allow mach-register (global-name-regex \"^com.google.chrome.for.testing.\"))",
    "(allow mach-lookup (global-name-regex \"^org.chromium.crashpad.\"))",
    "(allow iokit-open)",
  ]
}