{
  "mode": "enforce",
  "traceDir": ".pi/runtime",
  "trace": {
    "maxFileBytes": 5242880,
    "maxFiles": 3
  },
  "protectPaths": [
    ".env",
    ".git/",
    "node_modules/",
    "*.pem",
    "*.key"
  ],
  "approval": {
    "highRiskBash": true,
    "writesOutsideWorkspace": true,
    "sessionFork": false
  },
  "limits": {
    "maxToolCallsPerTurn": 30,
    "maxHighRiskCallsPerTurn": 3,
    "maxRepairAttemptsPerError": 2
  },
  "toolRouting": {
    "enabled": true,
    "maxCandidates": 5
  }
}