commit - d015e13193c3f9fbaf95927d9ad99d206a4ce2e2
commit + 5b6aa68ca958e97270918091fe97d79509e0dbf0
blob - 63da1b855da6d8a2b9be5d572dfced0d0cb68ee6
blob + 02b2e3b98611be14fa0f53f80d5647f81aa32e41
--- config/pisol/init
+++ config/pisol/init
@@ -1,41 +1,36 @@
 #!/usr/bin/env bash
 # Default global init for pisol.
 # Sourced before the project-specific .isolate file. Put shared grants here
-# and keep per-project additions in $PWD/.isolate.
+# and keep per-project additions in `.isolate`.
 
-# Remove --unrestricted-network below to deny outbound TCP by default,
-
 args+=(--unrestricted-network)
 
 for p in \
-    /bin \
-    /lib \
-    /lib64 \
-    /usr/bin \
-    /usr/lib \
-    /etc \
-    /nix \
-    "$HOME/bin" \
-    "$HOME/.zvm" \
-    "$HOME/.cargo" \
-    "$HOME/.config" \
-    "$HOME/.gitconfig" \
-    "$HOME/.local/bin" \
-    "$HOME/.cache/zig" \
-    "$HOME/.rustup" \
-    "$HOME/.nix-profile"; do
-    args+=(--rox "$p")
+	/usr/local/bin \
+	/bin \
+	/lib \
+	/lib64 \
+	/usr/bin \
+	/usr/lib \
+	/etc \
+	/nix \
+	"$HOME/bin" \
+	"$HOME/.zvm" \
+	"$HOME/.cargo" \
+	"$HOME/.config" \
+	"$HOME/.gitconfig" \
+	"$HOME/.local/bin" \
+	"$HOME/.cache/zig" \
+	"$HOME/.rustup" \
+	"$HOME/.nix-profile"; do
+	args+=(--rox "$p")
 done
 
 for p in \
-    "$HOME/.codex" \
-    "$HOME/.pi" \
-    "$HOME/.config/goose" \
-    "$HOME/.cache/opencode" \
-    "$HOME/.config/opencode" \
-    "$HOME/.local/share/opencode" \
-    "$HOME/.local/state/opencode" \
-    "$HOME/.local/share/goose" \
-    "$HOME/.local/state/goose"; do
-    args+=(--rwx "$p")
+	"$HOME/.codex" \
+	"$HOME/.pi" \
+	"$HOME/.config/goose" \
+	"$HOME/.local/share/goose" \
+	"$HOME/.local/state/goose"; do
+	args+=(--rwx "$p")
 done