ducoterra
a08a69f143
Two changes, one bug found through the other.
Thinking is policy now: defaultThinkingLevel is xhigh unless you say otherwise
(thinking / --thinking / AISB_THINKING, with pi's levels plus 'host' to decline
and 'off' meaning pi's own no-reasoning level). It is written into the bridged
settings and re-applied by the entrypoint on every run, so a run cannot set its
own reasoning down for the runs after it. Unknown levels are refused with the
list to pick from. Nothing is written for codex, claude or a command after --,
and --no-pi-config declines it along with the bridge, because pi's own defaults
are what that flag asks for.
The reason xhigh had never reached a sandbox is worse than a missing default:
settings.json was managed as one whole file, and pi rewrites its own settings
(a theme change, "seen the changelog"), so the first such write matched nothing
and froze every host preference out permanently -- provider, model, thinking
budgets and level included, a real session left holding just
{"lastChangelogVersion": "1.4.0"}. It is merged per key instead, against a copy
of what we last wrote: a key edited in the sandbox stays edited, a key never
touched follows the host again, an untouched key the host dropped is dropped, a
key pi invented survives, and a file with no base copy takes the host values --
which repairs the volumes already frozen. Unparseable JSON is re-seeded with a
warning since pi cannot use it either; a file the container cannot read is
reported with the fix, because nothing inside the sandbox can repair one.
One trap worth remembering: the seeding script is passed to bash -c in single
quotes, so a single quote inside it closes the argument early and the rest runs
in the outer shell -- valid bash, wrong program, clean bash -n and clean
shellcheck. tests/unit/06_entrypoint.sh extracts the seeding script and asserts
it is quote-free, and extracts the merge program to test its semantics without
a container; tests/e2e/12_sandbox.sh does the same in a real run, including
forcing the level back after the sandbox sets it to off.
LLM-Generated: true
118 lines
4.8 KiB
Plaintext
118 lines
4.8 KiB
Plaintext
# config for ai-sandbox -- copy to ~/.config/ai-sandbox/config and edit
|
|
#
|
|
# Format: key = value. '#' starts a comment.
|
|
# Precedence: built-in default < this file (user) < ./.ai-sandbox/config (repo)
|
|
# < AISB_* environment variable < command line flag.
|
|
#
|
|
# Keys listed under "repeatable" accumulate; every other key replaces.
|
|
|
|
# --- network ---------------------------------------------------------------
|
|
# none | allow | full. allow is the safe default and requires an allowlist.
|
|
net = allow
|
|
|
|
# Address that stands for the host's loopback inside the container
|
|
# (--network=pasta:--map-host-loopback,<addr>). Change only if it collides
|
|
# with a real network you need to reach.
|
|
# gate_addr = 100.64.0.1
|
|
|
|
# Preferred first port for the per-session egress gate; the next free port is
|
|
# used if it is busy.
|
|
# gate_port = 18081
|
|
|
|
# --- harness ---------------------------------------------------------------
|
|
# Default in-container command: pi | codex | claude | none | "<your command>"
|
|
# harness = pi
|
|
|
|
# --- mounts and layout -----------------------------------------------------
|
|
# workdir = /project
|
|
|
|
# --- limits ----------------------------------------------------------------
|
|
# cpus = 4
|
|
# memory = 4g
|
|
# pids = 512
|
|
# tmpfs_size = 1g
|
|
|
|
# --- image -----------------------------------------------------------------
|
|
# One base for both images (the gate is squid from this distro's apt, not a
|
|
# third-party image). base_image may itself be pinned: name@sha256:...
|
|
# base_image = docker.io/library/ubuntu:24.04
|
|
# node_version = 22.23.4
|
|
# pi_version = 1.4.0
|
|
#
|
|
# The tag is resolved to a registry digest and that digest becomes part of the
|
|
# image tag, so builds are reproducible and a base patch is visible instead of
|
|
# quietly folding into an existing image. Every base_ttl_days the digest is
|
|
# re-resolved -- a manifest read, not a download. 0 re-resolves on every build,
|
|
# -1 never does.
|
|
# base_ttl_days = 7
|
|
#
|
|
# 0 keeps the recorded digest even past its TTL: nothing reaches the registry
|
|
# unless you say so. An explicit refresh is `ai-sandbox update [--check]`.
|
|
# base_auto_update = 1
|
|
|
|
# --- pi --------------------------------------------------------------------
|
|
# Bridge ~/.pi/agent/{models,settings}.json into the sandbox, with every provider
|
|
# apiKey replaced by an environment reference (nothing secret is written into the
|
|
# container). 0 = pi starts with its own defaults.
|
|
# pi_config = 1
|
|
#
|
|
# The variable the bridged config reads the credential from, and whether ai-sandbox
|
|
# passes that one variable automatically when it is set. If it reaches neither, the
|
|
# run is refused instead of launching a pi that cannot talk to its model.
|
|
# pi_token_env = AI_API_TOKEN
|
|
# pi_token_auto = 1
|
|
#
|
|
# The thinking level a sandboxed pi reasons at: off, minimal, low, medium, high, xhigh
|
|
# or max. pi's own default is medium; ai-sandbox states xhigh and re-applies it on every
|
|
# run, so one run cannot lower the thinking of the next. 'host' stops forcing it and lets
|
|
# settings.json decide. pi only -- other harnesses read their own config.
|
|
# thinking = xhigh
|
|
#
|
|
# Where to read the host config from (default ~/.pi/agent).
|
|
# pi_agent_dir = ~/.pi/agent
|
|
|
|
# --- skills and standing instructions ---------------------------------------
|
|
# Your host ~/.agents is bind-mounted read-only at /home/sandbox/.agents, which is
|
|
# where pi (and the other harnesses) look for user-level skills, prompt templates and
|
|
# standing instructions. Read-only, and there is no way to make it writable: a skill is
|
|
# an instruction the model follows later, on the host, so a sandbox that could write one
|
|
# would have a persistence path out of itself. 0 = your skills stay at home.
|
|
# agents = 1
|
|
#
|
|
# Which directory to share ('~' is expanded). A project's own .agents/ needs no setting
|
|
# here: it comes in with the project mount, alongside this one.
|
|
# agents_dir = ~/.agents
|
|
#
|
|
# Where it lands in the container. Keep it under HOME -- that is the only place a
|
|
# harness looks for user-level skills.
|
|
# agents_dest = /home/sandbox/.agents
|
|
|
|
# --- behaviour -------------------------------------------------------------
|
|
# SELinux bind-mount option: ':z' (shared), ':Z' (private) or empty to disable.
|
|
# Defaults to ':z' when getenforce exists.
|
|
# selinux = :z
|
|
|
|
# Persist /home/sandbox in a named volume so harness logins and tool caches
|
|
# survive between runs. 0 = use a throwaway tmpfs instead.
|
|
# home_cache = 1
|
|
|
|
# Appended verbatim to the podman invocation (power users; word-split).
|
|
# extra_args = --annotation io.k8s.description="agent sandbox"
|
|
|
|
# --- repeatable keys -------------------------------------------------------
|
|
# These may appear more than once, and are merged with --allow / --env / etc.
|
|
#
|
|
# allow = aipi.reeseapps.com
|
|
# allow = registry.npmjs.org:443
|
|
# allow = 10.20.0.5:5432
|
|
#
|
|
# env = AI_API_TOKEN
|
|
# env = CI_JOB_TOKEN
|
|
#
|
|
# mount = ~/.ssh:ro
|
|
# mount = ../docs:/docs:ro
|
|
#
|
|
# install = postgresql-client
|
|
#
|
|
# label = team=platform
|