make xhigh the sandbox's thinking, and stop settings.json freezing

Two changes, one bug found through the other.

Thinking is policy now: defaultThinkingLevel is xhigh unless you say otherwise
(thinking / --thinking / AISB_THINKING, with pi's levels plus 'host' to decline
and 'off' meaning pi's own no-reasoning level). It is written into the bridged
settings and re-applied by the entrypoint on every run, so a run cannot set its
own reasoning down for the runs after it. Unknown levels are refused with the
list to pick from. Nothing is written for codex, claude or a command after --,
and --no-pi-config declines it along with the bridge, because pi's own defaults
are what that flag asks for.

The reason xhigh had never reached a sandbox is worse than a missing default:
settings.json was managed as one whole file, and pi rewrites its own settings
(a theme change, "seen the changelog"), so the first such write matched nothing
and froze every host preference out permanently -- provider, model, thinking
budgets and level included, a real session left holding just
{"lastChangelogVersion": "1.4.0"}. It is merged per key instead, against a copy
of what we last wrote: a key edited in the sandbox stays edited, a key never
touched follows the host again, an untouched key the host dropped is dropped, a
key pi invented survives, and a file with no base copy takes the host values --
which repairs the volumes already frozen. Unparseable JSON is re-seeded with a
warning since pi cannot use it either; a file the container cannot read is
reported with the fix, because nothing inside the sandbox can repair one.

One trap worth remembering: the seeding script is passed to bash -c in single
quotes, so a single quote inside it closes the argument early and the rest runs
in the outer shell -- valid bash, wrong program, clean bash -n and clean
shellcheck. tests/unit/06_entrypoint.sh extracts the seeding script and asserts
it is quote-free, and extracts the merge program to test its semantics without
a container; tests/e2e/12_sandbox.sh does the same in a real run, including
forcing the level back after the sandbox sets it to off.

LLM-Generated: true

tests/e2e/12_sandbox.sh

@@ -245,6 +245,55 @@ sb $DARK --harness pi -- bash -c 'rm -f "$HOME/.pi/agent/models.json"; echo rese
 sb $DARK --harness pi -- bash -lc 'grep -q 524288 "$HOME/.pi/agent/models.json" && echo reseeded || echo not_reseeded'
 assert_contains "reseeded" "deleting it inside the sandbox takes the host version again"
 
+t_name "settings.json follows the host per key, and the thinking level is policy"
+# The host file says medium and no ai-sandbox policy is in it: anything that arrives as
+# xhigh can only have been written by the policy.
+printf '{ "defaultProvider": "gateway", "defaultModel": "turbo", "theme": "dark/dark",\n  "defaultThinkingLevel": "medium", "thinkingBudgets": { "xhigh": 65536 } }\n' > "$AGENT/settings.json"
+sb $DARK --harness pi -- bash -lc 'jq -c . "$HOME/.pi/agent/settings.json"'
+assert_contains '"defaultThinkingLevel":"xhigh"' "xhigh is enforced over the host file's medium"
+assert_contains '"thinkingBudgets":{"xhigh":65536}' "and the rest of the preferences come along"
+
+# What pi does to its own settings: rewrites the file, adding a key of its own. That used
+# to freeze every host preference out of the sandbox for good.
+sb $DARK --harness pi -- bash -c '
+  f="$HOME/.pi/agent/settings.json"
+  jq ".theme=\"light/light\" | .defaultThinkingLevel=\"off\" | .lastChangelogVersion=\"9.9.9\"" "$f" > "$f.n" && mv "$f.n" "$f"
+  echo edited' >/dev/null
+# the host then moves the model and the budgets, drops the provider entirely, and says
+# medium itself -- so a later --thinking host run has something to hand over
+printf '{ "defaultModel": "deepthink", "theme": "sepia/sepia",\n  "defaultThinkingLevel": "medium", "thinkingBudgets": { "xhigh": 131072 } }\n' > "$AGENT/settings.json"
+sb $DARK --harness pi -- bash -lc 'jq -c . "$HOME/.pi/agent/settings.json"'
+MERGED="$OUT"
+printf '%s' "$MERGED" | grep -qF '"theme":"light/light"' && _ok "the theme edited in the sandbox survives" \
+  || _bad "the theme edited in the sandbox survives" "$MERGED"
+printf '%s' "$MERGED" | grep -qF '"lastChangelogVersion":"9.9.9"' && _ok "a key only pi wrote survives" \
+  || _bad "a key only pi wrote survives" "$MERGED"
+printf '%s' "$MERGED" | grep -qF '"defaultModel":"deepthink"' && _ok "an untouched model follows the host again" \
+  || _bad "an untouched model follows the host again" "$MERGED"
+printf '%s' "$MERGED" | grep -qF '"xhigh":131072' && _ok "and so do the thinking budgets" \
+  || _bad "and so do the thinking budgets" "$MERGED"
+printf '%s' "$MERGED" | grep -qF 'defaultProvider' && _bad "an untouched key the host dropped is dropped" \
+  || _ok "an untouched key the host dropped is dropped"
+printf '%s' "$MERGED" | grep -qF '"defaultThinkingLevel":"xhigh"' && _ok "thinking is forced back to xhigh after the sandbox set off" \
+  || _bad "thinking is forced back to xhigh after the sandbox set off" "$MERGED"
+
+# (the jq programs below avoid `{a, b}` object construction: bash brace-expands an
+# unquoted word containing a comma before jq ever sees it)
+sb $DARK --harness pi --thinking host -- bash -lc 'jq -r .defaultThinkingLevel "$HOME/.pi/agent/settings.json"'
+assert_eq "medium" "$(printf '%s' "$OUT" | tail -1)" "with --thinking host the host's own medium is handed over"
+
+sb $DARK --harness pi -- bash -c 'printf "{oops" > "$HOME/.pi/agent/settings.json"' >/dev/null
+sb $DARK --harness pi -- bash -lc 'jq -c . "$HOME/.pi/agent/settings.json"'
+assert_contains "deepthink" "a settings.json that is not JSON is re-seeded rather than left broken"
+assert_contains '"defaultThinkingLevel":"xhigh"' "with the policy still applied"
+sb $DARK --harness pi -- bash -lc 'jq -r .defaultThinkingLevel "$HOME/.pi/agent/settings.json"'
+assert_eq "xhigh" "$(printf '%s' "$OUT" | tail -1)" "and it stays xhigh, not the medium that came back"
+
+sb $DARK --harness pi -- bash -c 'chmod 000 "$HOME/.pi/agent/settings.json"' >/dev/null
+sb $DARK --harness pi -- bash -lc 'echo ran'
+assert_contains "cannot read settings.json" "a file this container cannot read is reported, not blamed on JSON"
+assert_contains "--ephemeral-home" "and the report names a way out"
+
 unset AI_API_TOKEN
 sb_timeout 90 $DARK --harness pi
 assert_rc 1 "a run without the credential is refused before anything starts"