chore(config): add filesystem permissions for skills, models, and permission config

Reorder rust formatters (rustfmt primary), switch python from
isort/black to ruff/dprint, and enable format_on_save with lsp_fallback.

config/hypr/hyprland.lua

@@ -282,48 +282,35 @@ function toggle_master()
     hl.dispatch(hl.dsp.layout("mfact exact " .. mfact))
 end
 
--- hl.bind(LEADER .. "return", function()
---     focus_or_launch({
---         match = "terminal-tmux",
---         field = "class",
---         cmd = "gtk-launch tmux.desktop",
---     })
--- end, { description = "Open tmux terminal" })
-
--- hl.bind(LEADER .. "SHIFT + return", function()
---     focus_or_launch({
---         match = "terminal-herdr",
---         field = "class",
---         cmd = "gtk-launch herdr.desktop",
---     })
--- end, { description = "Open herdr terminal" })
-
 hl.bind(LEADER .. "SHIFT + return", hl.dsp.exec_cmd("gtk-launch herdr.desktop"), { description = "Open herdr terminal" })
 hl.bind(LEADER .. "return", hl.dsp.exec_cmd("gtk-launch tmux.desktop"), { description = "Open tmux terminal" })
 
 hl.bind(LEADER .. "B", hl.dsp.exec_raw(browser), { description = "Open browser" })
 hl.bind(LEADER .. "T", hl.dsp.exec_raw(terminal .. " -e btop"), { description = "Open system monitor" })
 hl.bind(LEADER .. "S", hl.dsp.exec_raw("ostt launch --paste"), { description = "Open ostt" })
--- hl.bind(LEADER .. "I", hl.dsp.exec_cmd(notify_cmd .. " $(~/.local/bin/sysinfo)"), { description = "Show system info" })
-hl.bind(LEADER .. "I", function()
-    sysinfo()
-end, { description = "Show system info" })
+hl.bind(LEADER .. "I", function() sysinfo() end, { description = "Show system info" })
 
 -- Open rofi on first press, closes it on second
 hl.bind(LEADER .. "Space", hl.dsp.exec_raw("rofi -show combi --modes combi"), { release = true, description = "Open Application Menu" })
 hl.bind(LEADER .. "SHIFT + SPACE", hl.dsp.exec_cmd("~/.local/bin/hyprland-fetch-client"),
     { release = true, description = "Fetch client" })
-hl.bind(LEADER .. "CONTROL + SPACE", hl.dsp.exec_cmd("~/.local/bin/hyprland-focus-client"),
-    { release = true, description = "Focus client" })
-hl.bind(LEADER .. "CONTROL + return", hl.dsp.exec_cmd("~/.local/bin/hyprland-tmux-session"),
-    { release = true, description = "Tmux session switcher" })
-
+hl.bind(LEADER .. "CONTROL + SPACE", 
+    hl.dsp.exec_cmd("~/.local/bin/hyprland-focus-client"),
+    { release = true, description = "Focus client" }
+)
+hl.bind(LEADER .. "slash",
+    hl.dsp.exec_cmd("ROFI_PASS_BACKEND=wtype ROFI_PASS_CLIPBOARD_BACKEND=wl-clipboard ~/.local/bin/rofi-pass"),
+    { release = true, description = "Open rofi-pass" }
+)
 
 hl.bind(HYPR .. "V", hl.dsp.exec_cmd("pavucontrol"), { description = "Volume control" })
 hl.bind(HYPR .. "B", hl.dsp.exec_cmd("blueberry"), { description = "Bluetooth manager" })
 
 hl.bind(HYPR .. "semicolon", hl.dsp.exec_cmd("~/.local/bin/set-wallpaper.sh categories/quotes"), { description = "get new wallpaper" })
 
+hl.bind("Print", hl.dsp.exec_cmd("hyprshot -m window"), { description = "Take screenshot" })
+hl.bind("SHIFT + Print", hl.dsp.exec_cmd("hyprshot -m region"), { description = "Take screenshot" })
+
 hl.bind(HYPR .. "A", dispatch_focus_or_launch({
     match = "Goose",
     field = "class",
@@ -380,9 +367,6 @@ hl.bind(HYPR .. "F", dispatch_focus_or_launch({
     cmd = "pcmanfm",
 }), { description = "File Manager" })
 
-hl.bind(LEADER .. "slash",
-    hl.dsp.exec_cmd("ROFI_PASS_BACKEND=wtype ROFI_PASS_CLIPBOARD_BACKEND=wl-clipboard ~/.local/bin/rofi-pass"))
-
 hl.bind("XF86AudioLowerVolume", hl.dsp.exec_cmd("wpctl set-volume @DEFAULT_AUDIO_SINK@ 5%-"), { repeating = true, description = "Volume down" })
 hl.bind("XF86AudioRaiseVolume", hl.dsp.exec_cmd("wpctl set-volume @DEFAULT_AUDIO_SINK@ 5%+"), { repeating = true, description = "Volume up" })
 hl.bind("XF86AudioMute", hl.dsp.exec_cmd("wpctl set-mute @DEFAULT_AUDIO_SINK@ toggle"), { description = "Toggle mute" })

config/mise/config.toml

@@ -12,6 +12,7 @@ copilot-cli = "latest"
 "github:danielmiessler/fabric" = "latest"
 "github:mrusme/reader" = "latest"
 "github:rimio-ai/rimz" = "latest"
+"github:sandboxec/sandboxec" = "latest"
 "github:ulyssa/iamb" = "latest"
 "github:zed-industries/codex-acp" = "latest"
 herdr = "latest"

config/nvim/plugin/conform.lua

@@ -21,8 +21,8 @@ conform.setup({
         cpp = { "clang_format" },
         lua = { 'stylua' },
         go = { "goimports", "gofmt" },
-        rust = { "dprint", "rustfmt", lsp_format = "fallback" },
-        python = { "isort", "black", stop_after_first = true },
+        rust = { "rustfmt", "dprint", lsp_format = "fallback" },
+        python = { "ruff", "dprint", stop_after_first = true },
         javascript = { "dprint", "prettier", stop_after_first = true },
         markdown = { "dprint", "prettier", stop_after_first = true },
         javascriptreact = { "dprint", "prettier", stop_after_first = true },
@@ -31,12 +31,13 @@ conform.setup({
         svelte = { "dprint", "prettier", stop_after_first = true },
         html = { "dprint", "prettier", stop_after_first = true },
     },
+    format_on_save = {
+        lsp_fallback = true,
+    },
 })
 
 vim.keymap.set({ 'n', 'v' }, '<leader>bf',
-function()
-    conform.format { async = true, lsp_format = 'fallback' }
-end,
-{ desc = 'Format buffer' })
-
-
+    function()
+        conform.format { async = true }
+    end,
+    { desc = 'Format buffer' })

config/pi/agent/extensions/pi-permission-system/config.json

@@ -7,7 +7,8 @@
       "~/.ssh/*": "deny",
       "*.env": "deny",
       "*.env.*": "deny",
-      "*.env.example": "allow"
+      "*.env.example": "allow",
+      "/tmp/*": "ask"
     },
     "bash": {
       "*": "ask",
@@ -15,7 +16,7 @@
       "sudo *": "ask"
     },
     "external_directory": {
-      "*": "deny",
+      "*": "ask",
       "~/Documents/sjb-brain/*": "allow"
     }
   },

config/sandboxec/pi.yaml

@@ -0,0 +1,43 @@
+abi: 6
+ignore-if-missing: true
+unsafe-host-runtime: true
+# Pi stores configuration, extensions, skills, and sessions under ~/.pi/agent.
+# The current workspace is writable so agent edits remain confined to the repo
+# from which Pi is launched. Network access is limited to model/API HTTPS.
+fs:
+  - rwx:$HOME/.pi/agent/
+  - rwx:$HOME/.pi-lens/
+  - rwx:$HOME/.pi/context-mode/
+  - rw:$HOME/.pi/agent/settings.json
+  - rw:$HOME/.pi/agent/models.json
+  - r:$HOME/.pi/agent/AGENTS.md
+  - r:$HOME/.pi/skills/
+  - r:$HOME/.agents/skills/
+  - r:$HOME/.pi/agent/extensions/pi-permission-system/config.json
+  - rx:$HOME/.local/share/mise/installs/npm-earendil-works-pi-coding-agent/
+  - rw:$PWD
+  - rw:/tmp
+  - r:/dev/random
+  - r:/dev/urandom
+  - r:/etc/hosts
+  - r:/etc/ld.so.cache
+  - r:/etc/localtime
+  - r:/etc/nsswitch.conf
+  - r:/etc/resolv.conf
+  - r:/etc/ssl/certs
+  - r:/etc/ssl/certs/ca-certificates.crt
+  - r:/etc/ssl/openssl.cnf
+  - r:/home/linuxbrew/.linuxbrew/etc/openssl@3/openssl.cnf
+  - r:/proc/
+  - r:/proc/meminfo
+  - r:/proc/self/cgroup
+  - r:/proc/self/groups
+  - r:/proc/self/maps
+  - r:/proc/stat
+  - r:/sys/devices/system/cpu/online
+  - r:/usr/lib/locale/locale-archive
+  - r:/usr/lib/ssl/openssl.cnf
+  - r:/usr/share/locale/locale.alias
+  - rw:/dev/null
+net:
+  - c:443

mise.toml

@@ -59,6 +59,7 @@ dotfiles.default_mode = "symlink-each"
 "~/.profile" = { source = "config/bash/profile", mode = "symlink" }
 "~/.bash_aliases" = { source = "config/bash/aliases", mode = "symlink" }
 "~/.config/zero" = "config/zero"
+"~/.sandboxec" = "config/sandboxec"
 
 "~/.local/share/fonts/" = { source = "fonts", mode = "copy" }
 

script/hyprland-fetch-client

@@ -1,7 +1,5 @@
 #!/bin/sh
-#chooser="walker -d"
 chooser="rofi -i -dmenu -display-columns 1"
-workspace=$(hyprctl activeworkspace -j | jq  -r '.id')
 selected=$(hyprctl clients -j | jq -r 'to_entries | .[] | select(.value.hidden == false) | "\(.value.title)\t\(.value.class)::\(.value.address)"' | $chooser -p 'Client to Fetch')
 address=$(echo "$selected" | awk -F '::' '{print $NF}')
 if [ -z "$address" ]; then