chore: add sandboxec sandbox config for pi

config/mise/config.toml

@@ -12,6 +12,7 @@ copilot-cli = "latest"
 "github:danielmiessler/fabric" = "latest"
 "github:mrusme/reader" = "latest"
 "github:rimio-ai/rimz" = "latest"
+"github:sandboxec/sandboxec" = "latest"
 "github:ulyssa/iamb" = "latest"
 "github:zed-industries/codex-acp" = "latest"
 herdr = "latest"

config/sandboxec/pi.yaml

@@ -0,0 +1,39 @@
+abi: 6
+ignore-if-missing: true
+unsafe-host-runtime: true
+# Pi stores configuration, extensions, skills, and sessions under ~/.pi/agent.
+# The current workspace is writable so agent edits remain confined to the repo
+# from which Pi is launched. Network access is limited to model/API HTTPS.
+fs:
+  - rwx:$HOME/.pi/agent/
+  - rwx:$HOME/.pi-lens/
+  - rwx:$HOME/.pi/context-mode/
+  - rw:$HOME/.pi/agent/settings.json
+  - r:$HOME/.pi/agent/AGENTS.md
+  - rx:$HOME/.local/share/mise/installs/npm-earendil-works-pi-coding-agent/
+  - rw:$PWD
+  - rw:/tmp
+  - r:/dev/random
+  - r:/dev/urandom
+  - r:/etc/hosts
+  - r:/etc/ld.so.cache
+  - r:/etc/localtime
+  - r:/etc/nsswitch.conf
+  - r:/etc/resolv.conf
+  - r:/etc/ssl/certs
+  - r:/etc/ssl/certs/ca-certificates.crt
+  - r:/etc/ssl/openssl.cnf
+  - r:/home/linuxbrew/.linuxbrew/etc/openssl@3/openssl.cnf
+  - r:/proc/
+  - r:/proc/meminfo
+  - r:/proc/self/cgroup
+  - r:/proc/self/groups
+  - r:/proc/self/maps
+  - r:/proc/stat
+  - r:/sys/devices/system/cpu/online
+  - r:/usr/lib/locale/locale-archive
+  - r:/usr/lib/ssl/openssl.cnf
+  - r:/usr/share/locale/locale.alias
+  - rw:/dev/null
+net:
+  - c:443

mise.toml

@@ -59,6 +59,7 @@ dotfiles.default_mode = "symlink-each"
 "~/.profile" = { source = "config/bash/profile", mode = "symlink" }
 "~/.bash_aliases" = { source = "config/bash/aliases", mode = "symlink" }
 "~/.config/zero" = "config/zero"
+"~/.sandboxec" = "config/sandboxec"
 
 "~/.local/share/fonts/" = { source = "fonts", mode = "copy" }