ducoterra
b273bfef09
Two features, one shared reason: what the sandbox calls things decides what a run tells you afterwards. The cwd is now mounted at the path it has on the host and that is the working directory, so pwd, an error the agent quotes, a commit message and the window title a harness derives from the cwd all name this project instead of reading the same as every sandbox in the session. The mount is unchanged: same directory, same rw, same :z, still the only writable one. Only the destination changed, and a destination is where a bind mount can do damage -- it hides whatever the image already had there. So mirror_block_of() refuses the paths the image or the sandbox owns (/usr, /etc, /var, /opt, /bin, /sbin, /lib*, /boot, /proc, /sys, /dev, /root, /run, /tmp, /home, /home/sandbox*) and / itself, while /home/<user>/... mirrors: the one standard hierarchy where work lives, and the one whose per-user tree never meets the container's /home/sandbox volume or the read-only .agents share inside it. /tmp is what set the shape, and it was measured rather than assumed: with --tmpfs /tmp and -v /tmp/x:/tmp/x in one run podman puts the tmpfs on top, so pwd prints the right path, writes succeed, and the project is not there. A failure that quiet earns a refusal plus a line of output instead: workdir_note in --print-policy, a comment in --dry-run, one log line on a real run. --workdir DIR still chooses the mount point; onto a refused path it is honoured (it was asked for) and warned about. /project, the one directory baked into the image, is every fallback, so a workdir always exists -- --no-cwd included. ai-sandbox-autophase runs a .agents/phases/ pipeline with the split the sandbox forces: every executor agent and the .agents/validate.sh gate inside, the commits and the pushes outside. The gate is in the writable mount, so running it on the host is running agent-editable bash on the host; the git remote is deliberately unreachable in there, because an agent that can push can ship what you are about to review. It runs your launcher, not a copy of it -- the definition is read out of your rc files and never called, which is what lets --status and --dry-run promise no token fetch, no build, no container. Host git runs with an empty hooks path and no ext:: transport, and delivery is refused if a sandboxed unit rewrote .git/config or planted a hook. Needs --no-interactive to go with --no-tty: an unattended run must not leave stdin open on your keyboard, and the two are now separate choices on both sides. Tests and tooling, most of it forced by what the two changes exposed: mirror_block_of is extracted from the script and asked about /usr and /home/sandbox, which a test cannot create (the 06_entrypoint.sh pattern), and both real branches are driven from a scratch dir under $HOME, since $TMPDIR is always the fallback -- which is why the whole suite had only ever seen /project. e2e/12 holds a real container to the same promise, including that /project, /home/sandbox and a home-volume marker survive a mirrored run. The "nothing was started" checks now compare the set of container ids before and after instead of counting every sandbox on the machine, so a session you have open is not a test failure; the pty cases fall back to python3 where util-linux's script is not installed. shellcheck covers both programs, the completion file and the fixtures, so the completion builds are word-by-word now, and a colon in the project path is refused with the reason instead of podman's "invalid option type". 558 unit assertions, 719 with e2e; lint and bash -n clean. LLM-Generated: true
123 lines
5.2 KiB
Plaintext
123 lines
5.2 KiB
Plaintext
# config for ai-sandbox -- copy to ~/.config/ai-sandbox/config and edit
|
|
#
|
|
# Format: key = value. '#' starts a comment.
|
|
# Precedence: built-in default < this file (user) < ./.ai-sandbox/config (repo)
|
|
# < AISB_* environment variable < command line flag.
|
|
#
|
|
# Keys listed under "repeatable" accumulate; every other key replaces.
|
|
|
|
# --- network ---------------------------------------------------------------
|
|
# none | allow | full. allow is the safe default and requires an allowlist.
|
|
net = allow
|
|
|
|
# Address that stands for the host's loopback inside the container
|
|
# (--network=pasta:--map-host-loopback,<addr>). Change only if it collides
|
|
# with a real network you need to reach.
|
|
# gate_addr = 100.64.0.1
|
|
|
|
# Preferred first port for the per-session egress gate; the next free port is
|
|
# used if it is busy.
|
|
# gate_port = 18081
|
|
|
|
# --- harness ---------------------------------------------------------------
|
|
# Default in-container command: pi | codex | claude | none | "<your command>"
|
|
# harness = pi
|
|
|
|
# --- mounts and layout -----------------------------------------------------
|
|
# Where the current directory is mounted inside the container, which is also the
|
|
# working directory. 'auto' (the default) uses the path it has on the host, so the
|
|
# agent's pwd and the paths it prints are the ones you act on afterwards. It falls
|
|
# back to /project when the host path would cover something the image or the sandbox
|
|
# owns (/usr, /etc, /var, /opt, /tmp, /run, /home/sandbox) and announces the fallback.
|
|
# workdir = auto
|
|
|
|
# --- limits ----------------------------------------------------------------
|
|
# cpus = 4
|
|
# memory = 4g
|
|
# pids = 512
|
|
# tmpfs_size = 1g
|
|
|
|
# --- image -----------------------------------------------------------------
|
|
# One base for both images (the gate is squid from this distro's apt, not a
|
|
# third-party image). base_image may itself be pinned: name@sha256:...
|
|
# base_image = docker.io/library/ubuntu:24.04
|
|
# node_version = 22.23.4
|
|
# pi_version = 1.4.0
|
|
#
|
|
# The tag is resolved to a registry digest and that digest becomes part of the
|
|
# image tag, so builds are reproducible and a base patch is visible instead of
|
|
# quietly folding into an existing image. Every base_ttl_days the digest is
|
|
# re-resolved -- a manifest read, not a download. 0 re-resolves on every build,
|
|
# -1 never does.
|
|
# base_ttl_days = 7
|
|
#
|
|
# 0 keeps the recorded digest even past its TTL: nothing reaches the registry
|
|
# unless you say so. An explicit refresh is `ai-sandbox update [--check]`.
|
|
# base_auto_update = 1
|
|
|
|
# --- pi --------------------------------------------------------------------
|
|
# Bridge ~/.pi/agent/{models,settings}.json into the sandbox, with every provider
|
|
# apiKey replaced by an environment reference (nothing secret is written into the
|
|
# container). 0 = pi starts with its own defaults.
|
|
# pi_config = 1
|
|
#
|
|
# The variable the bridged config reads the credential from, and whether ai-sandbox
|
|
# passes that one variable automatically when it is set. If it reaches neither, the
|
|
# run is refused instead of launching a pi that cannot talk to its model.
|
|
# pi_token_env = AI_API_TOKEN
|
|
# pi_token_auto = 1
|
|
#
|
|
# The thinking level a sandboxed pi reasons at: off, minimal, low, medium, high, xhigh
|
|
# or max. pi's own default is medium; ai-sandbox states xhigh and re-applies it on every
|
|
# run, so one run cannot lower the thinking of the next. 'host' stops forcing it and lets
|
|
# settings.json decide. pi only -- other harnesses read their own config.
|
|
# thinking = xhigh
|
|
#
|
|
# Where to read the host config from (default ~/.pi/agent).
|
|
# pi_agent_dir = ~/.pi/agent
|
|
|
|
# --- skills and standing instructions ---------------------------------------
|
|
# Your host ~/.agents is bind-mounted read-only at /home/sandbox/.agents, which is
|
|
# where pi (and the other harnesses) look for user-level skills, prompt templates and
|
|
# standing instructions. Read-only, and there is no way to make it writable: a skill is
|
|
# an instruction the model follows later, on the host, so a sandbox that could write one
|
|
# would have a persistence path out of itself. 0 = your skills stay at home.
|
|
# agents = 1
|
|
#
|
|
# Which directory to share ('~' is expanded). A project's own .agents/ needs no setting
|
|
# here: it comes in with the project mount, alongside this one.
|
|
# agents_dir = ~/.agents
|
|
#
|
|
# Where it lands in the container. Keep it under HOME -- that is the only place a
|
|
# harness looks for user-level skills.
|
|
# agents_dest = /home/sandbox/.agents
|
|
|
|
# --- behaviour -------------------------------------------------------------
|
|
# SELinux bind-mount option: ':z' (shared), ':Z' (private) or empty to disable.
|
|
# Defaults to ':z' when getenforce exists.
|
|
# selinux = :z
|
|
|
|
# Persist /home/sandbox in a named volume so harness logins and tool caches
|
|
# survive between runs. 0 = use a throwaway tmpfs instead.
|
|
# home_cache = 1
|
|
|
|
# Appended verbatim to the podman invocation (power users; word-split).
|
|
# extra_args = --annotation io.k8s.description="agent sandbox"
|
|
|
|
# --- repeatable keys -------------------------------------------------------
|
|
# These may appear more than once, and are merged with --allow / --env / etc.
|
|
#
|
|
# allow = aipi.reeseapps.com
|
|
# allow = registry.npmjs.org:443
|
|
# allow = 10.20.0.5:5432
|
|
#
|
|
# env = AI_API_TOKEN
|
|
# env = CI_JOB_TOKEN
|
|
#
|
|
# mount = ~/.ssh:ro
|
|
# mount = ../docs:/docs:ro
|
|
#
|
|
# install = postgresql-client
|
|
#
|
|
# label = team=platform
|