jb/harness-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Generalize Pi sandbox launcher

Browse Source
This commit is contained in:
jb
2026-08-25 15:38:17 -04:00
parent 31c9363dbb
commit bab3c4589f
17 changed files with 637 additions and 391 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/nono.md
+27 -18
View File
@@ -37,30 +37,39 @@ nono why --self --path /resolved/path --op readwrite
A profile change affects the next sandbox launch. It cannot expand the permissions of the current process.
## Orca Pi runner routing
## Directory-based Pi sandbox routing
Orca launches Pi through [`scripts/pi-orca.fish`](../scripts/pi-orca.fish). The runner resolves the canonical Git project through [`scripts/orca-nono-profile.py`](../scripts/orca-nono-profile.py), then selects the nono profile from [`profiles/orca/project-nono-profiles.json`](../profiles/orca/project-nono-profiles.json).
[`pi-sbx`](../scripts/pi-sbx.fish) launches Pi with a nono profile and runtime selected from the current directory. It works from Orca or any terminal. [`pi-sbx-profile`](../scripts/pi-sbx-profile.py) manages the trusted user configuration at `~/.config/pi-sbx/config.json`. Set `PI_SBX_CONFIG` to an absolute path to use a different configuration file. Both commands resolve `nono` from `PATH`.
The runner treats the runtime, sandbox, and Pi agent directory as one configuration:
| Route | Nono profile | Node runtime | Pi agent directory |
| --- | --- | --- | --- |
| Default | `pi-orca-local` | system Node 26 | `~/.pi/agent` |
| `/srv/work` descendants | `pi-work` | fnm Node 22.23.2 | `~/.pi/profiles/cyone` |
The separate Pi agent directories are required because native extension dependencies such as `better-sqlite3` are compiled for one Node ABI. Never point Node 22 and Node 26 runners at the same `PI_CODING_AGENT_DIR`.
Exact canonical-project mappings override root mappings. Root mappings use the longest matching ancestor of either the canonical Git root or the actual launch path. This keeps linked worktrees launched below `/srv/work` on the work stack even when their main checkout lives elsewhere, while `/srv/work-other` does not match `/srv/work`.
One-time setup links the commands and systemd slice, then copies the example configuration:
```bash
orca-nono-profile show /srv/work/code/example
orca-nono-profile set pi-work /srv/work/code/example
orca-nono-profile unset /srv/work/code/example
orca-nono-profile set-root pi-work /srv/work
orca-nono-profile unset-root /srv/work
mkdir -p ~/.local/bin ~/.config/pi-sbx ~/.config/systemd/user
ln -s /absolute/path/to/harness-tools/scripts/pi-sbx.fish ~/.local/bin/pi-sbx
ln -s /absolute/path/to/harness-tools/scripts/pi-sbx-profile.py ~/.local/bin/pi-sbx-profile
ln -s /absolute/path/to/harness-tools/systemd/user/pi-agents.slice ~/.config/systemd/user/pi-agents.slice
cp /absolute/path/to/harness-tools/config/pi-sbx.example.json ~/.config/pi-sbx/config.json
chmod 600 ~/.config/pi-sbx/config.json
systemctl --user daemon-reload
```
After changing a route, Node runtime, or Pi profile, restart the Orca terminal. Existing Pi processes cannot switch runtimes or agent directories. The runner fails closed when its trusted resolver or resolved nono profile is unavailable; it never falls back from a work route to the default Node 26 state.
Directory keys must be canonical absolute physical paths. Directory mappings apply to the configured directory and all descendants. The longest matching directory wins; otherwise `defaultProfile` is used. Resolution uses the physical launch path and does not inspect Git metadata. A linked worktree therefore inherits the route for the directory where the worktree is located.
```bash
pi-sbx-profile show # explain the route for CWD
pi-sbx-profile set pi-work # assign CWD and descendants
pi-sbx-profile set pi-work /srv/work # assign an explicit directory
pi-sbx-profile unset # remove the CWD assignment
pi-sbx-profile resolve /srv/work/example # print the selected profile
pi-sbx-profile list # print the configuration
pi-sbx # launch Pi using the selected route
```
The configuration keeps the sandbox, Node runtime, Pi executable, and Pi agent directory together. Start from [`config/pi-sbx.example.json`](../config/pi-sbx.example.json). `defaultRuntime` applies to every profile; an entry in `profileRuntimes` overrides only the fields that differ for that profile.
Separate Pi agent directories are required when runtimes use different Node ABIs. Native dependencies such as `better-sqlite3` must not be shared between the Node 22 and Node 26 agent directories.
The launcher exports `PI_SBX_PROFILE` and, for Orca compatibility, `ORCA_NONO_PROFILE`. Existing `pi-orca` and `orca-nono-profile` commands remain compatibility entry points. Restart an existing terminal after changing its route, runtime, or agent directory because a running Pi process cannot switch them.
## Edit profiles with the skill