make xhigh the sandbox's thinking, and stop settings.json freezing

Two changes, one bug found through the other.

Thinking is policy now: defaultThinkingLevel is xhigh unless you say otherwise
(thinking / --thinking / AISB_THINKING, with pi's levels plus 'host' to decline
and 'off' meaning pi's own no-reasoning level). It is written into the bridged
settings and re-applied by the entrypoint on every run, so a run cannot set its
own reasoning down for the runs after it. Unknown levels are refused with the
list to pick from. Nothing is written for codex, claude or a command after --,
and --no-pi-config declines it along with the bridge, because pi's own defaults
are what that flag asks for.

The reason xhigh had never reached a sandbox is worse than a missing default:
settings.json was managed as one whole file, and pi rewrites its own settings
(a theme change, "seen the changelog"), so the first such write matched nothing
and froze every host preference out permanently -- provider, model, thinking
budgets and level included, a real session left holding just
{"lastChangelogVersion": "1.4.0"}. It is merged per key instead, against a copy
of what we last wrote: a key edited in the sandbox stays edited, a key never
touched follows the host again, an untouched key the host dropped is dropped, a
key pi invented survives, and a file with no base copy takes the host values --
which repairs the volumes already frozen. Unparseable JSON is re-seeded with a
warning since pi cannot use it either; a file the container cannot read is
reported with the fix, because nothing inside the sandbox can repair one.

One trap worth remembering: the seeding script is passed to bash -c in single
quotes, so a single quote inside it closes the argument early and the rest runs
in the outer shell -- valid bash, wrong program, clean bash -n and clean
shellcheck. tests/unit/06_entrypoint.sh extracts the seeding script and asserts
it is quote-free, and extracts the merge program to test its semantics without
a container; tests/e2e/12_sandbox.sh does the same in a real run, including
forcing the level back after the sandbox sets it to off.

LLM-Generated: true

tests/unit/08_pi_config.sh

@@ -37,12 +37,15 @@ cat > "$AGENT/models.json" <<EOF
 EOF
 # sessionDir points at the *real* host home on purpose: that is the case the bridge
 # has to drop, and HOME must stay the real home for podman's sake.
+# defaultThinkingLevel is deliberately NOT xhigh here: the host has to disagree with the
+# ai-sandbox policy, otherwise "the policy wrote xhigh" cannot be told apart from "the
+# host said xhigh and we copied it".
 cat > "$AGENT/settings.json" <<EOF
 {
   "defaultProvider": "gateway",
   "defaultModel": "turbo",
   "theme": "dark/dark",
-  "defaultThinkingLevel": "xhigh",
+  "defaultThinkingLevel": "medium",
   "enableInstallTelemetry": false,
   "thinkingBudgets": { "xhigh": 65536 },
   "sessionDir": "$HOME/pi-sessions"
@@ -110,13 +113,74 @@ t_name "settings travel, host paths do not"
 S="$(gen_file settings.json)"
 if [[ -n "$S" ]]; then
   for pair in '"defaultProvider": "gateway"' '"defaultModel": "turbo"' '"theme": "dark/dark"' \
-              '"defaultThinkingLevel": "xhigh"' '"xhigh": 65536' '"enableInstallTelemetry": false'; do
+              '"xhigh": 65536' '"enableInstallTelemetry": false'; do   # the thinking level is policy, not a preference that travels
     grep -qF "$pair" "$S" && _ok "kept $pair" || _bad "kept $pair"
   done
   grep -qF 'sessionDir' "$S" && _bad "a value pointing at the host home is dropped" || _ok "a value pointing at the host home is dropped"
 fi
 assert_contains "dropped settings sessionDir" "and it says so"
 
+# `--print-policy --keep` renders the bridge into the session directory and stops there:
+# a unit file never starts a container, and --keep keeps the rendered files to look at.
+rendered_level() { # rendered_level <level-or-default>
+  clear_sessions
+  sb --keep --print-policy --net none ${1:+--thinking "$1"}
+  local f; f="$(gen_file settings.json)"
+  [[ -n "$f" ]] || { printf 'none'; return; }
+  jq -r '.defaultThinkingLevel // "absent"' "$f" 2>/dev/null || printf 'invalid'
+}
+
+t_name "the thinking level is policy, written over the settings that travel"
+sb --keep --print-policy --net none
+assert_contains "thinking=xhigh (enforced on every run)" "xhigh is the default, not pi's medium"
+assert_contains "pi config: thinking -> xhigh" "and it is announced"
+# the fixture says medium, so an xhigh here can only have come from the policy
+assert_eq "xhigh" "$(rendered_level '')" "the policy beats the host file's medium"
+# the level is a preference, so it belongs to settings.json and nowhere else
+clear_sessions
+sb --keep --print-policy --net none
+if grep -q 'defaultThinkingLevel' "${M:-/nonexistent}" 2>/dev/null; then
+  _bad "models.json is untouched by it" "the key appeared in the model catalog"
+else
+  _ok "models.json is untouched by it"
+fi
+S="$(gen_file settings.json)"
+grep -qF '"defaultProvider": "gateway"' "${S:-/nonexistent}" \
+  && _ok "the rest of the settings still travel" || _bad "the rest of the settings still travel"
+grep -qF '"xhigh": 65536' "${S:-/nonexistent}" \
+  && _ok "including the host's thinking budgets" || _bad "the host's thinking budgets"
+grep -qF 'sessionDir' "${S:-/nonexistent}" \
+  && _bad "and a host path is still dropped while the level is added" || _ok "and a host path is still dropped while the level is added"
+
+t_name "every level, including 'host' and 'off', and nothing in between"
+assert_eq "low"    "$(rendered_level low)" "a level of your choosing"
+assert_eq "max"    "$(rendered_level max)" "and the top of pi's range"
+assert_eq "off"    "$(rendered_level off)" "off is pi's own level, not 'do not manage it'"
+assert_eq "medium" "$(rendered_level host)" "host leaves the key to settings.json (medium there)"
+rendered_level host >/dev/null
+assert_contains "thinking=host (not applied: the config decides)" "and says so"
+rendered_level bogus >/dev/null
+assert_rc 1 "an unknown level is refused"
+assert_contains "must be off, minimal, low, medium, high, xhigh, max or host" "with the list to pick from"
+sb_env AISB_THINKING=medium --print-policy --net none
+assert_contains "thinking=medium" "AISB_THINKING works"
+sb_env AISB_THINKING=medium --thinking max --print-policy --net none
+assert_contains "thinking=max" "the flag beats the environment"
+
+t_name "a host with no settings.json still gets the policy"
+mv "$AGENT/settings.json" "$WORK/settings-away.json"
+assert_eq "xhigh" "$(rendered_level '')" "the level does not depend on the host having the file"
+clear_sessions
+sb --keep --print-policy --net none
+assert_contains "pi_endpoints" "the model bridge still happened alongside it"
+mv "$WORK/settings-away.json" "$AGENT/settings.json"
+
+t_name "no bridge means no policy either, and it says so"
+clear_sessions
+sb --keep --no-pi-config --print-policy --net none
+assert_contains "thinking=xhigh (not applied: pi config bridging is off)" "--no-pi-config declines the thinking policy too"
+if [[ -n "$(gen_file settings.json)" ]]; then _bad "nothing is rendered for pi at all"; else _ok "nothing is rendered for pi at all"; fi
+
 t_name "auth.json and the credential store are never bridged"
 if find "$AISB_STATE_DIR/sessions" \( -name auth.json -o -name models-store.json \) | grep -q .; then
   _bad "only models.json and settings.json are bridged"
@@ -130,6 +194,7 @@ else
 fi
 
 t_name "the token is passed by name, once, and announced"
+sb --keep --print-policy --net none
 assert_contains "passing \$AI_API_TOKEN from the host" "the auto-pass is announced"
 assert_eq "env_names=AI_API_TOKEN" "$(printf '%s' "$OUT" | grep '^env_names=' || true)" "exactly one variable is passed"
 assert_absent "$AI_API_TOKEN" "and only its name is reported"