it's already read only outside of project directories (except for Bash tool); your only further option is to wrap it in a sandbox, `bwrap` is perfect for this

it's already read only outside of project directories (except for Bash tool); your only further option is to wrap it in a sandbox, `bwrap` is perfect for this "don't even think" is in the default system prompt, but it's inherently indeterministic and can be overridden with a direct instruction as you have seen