Generalize Pi sandbox launcher

2026-08-25 15:38:17 -04:00
parent 31c9363dbb
commit bab3c4589f
17 changed files with 637 additions and 391 deletions
@@ -0,0 +1,69 @@
+#!/usr/bin/env fish
+
+# Select a trusted nono profile and matching Pi runtime from the current
+# directory, then launch Pi in a bounded systemd scope.
+set -l resolver
+if set -q PI_SBX_PROFILE_COMMAND
+    set resolver "$PI_SBX_PROFILE_COMMAND"
+else
+    set resolver (command -s pi-sbx-profile)
+end
+
+if test -z "$resolver"; or not test -x "$resolver"
+    printf 'pi-sbx: profile resolver is unavailable: %s\n' "$resolver" >&2
+    exit 1
+end
+
+set -l resolved ("$resolver" resolve "$PWD" --format launcher 2>/dev/null)
+if test $status -ne 0; or test (count $resolved) -ne 4
+    printf 'pi-sbx: could not resolve a valid configuration for %s\n' "$PWD" >&2
+    exit 1
+end
+
+set -l profile "$resolved[1]"
+set -l node_executable "$resolved[2]"
+set -l pi_executable "$resolved[3]"
+set -l pi_agent_dir "$resolved[4]"
+set -l nono_executable (command -s nono)
+
+if test -z "$nono_executable"; or not test -x "$nono_executable"
+    printf 'pi-sbx: nono is unavailable on PATH\n' >&2
+    exit 1
+end
+if not "$nono_executable" profile show "$profile" >/dev/null 2>&1
+    printf 'pi-sbx: resolved nono profile is unavailable: %s\n' "$profile" >&2
+    exit 1
+end
+if not test -x "$node_executable"
+    printf 'pi-sbx: Node runtime is unavailable: %s\n' "$node_executable" >&2
+    exit 1
+end
+if not test -f "$pi_executable"
+    printf 'pi-sbx: Pi executable is unavailable: %s\n' "$pi_executable" >&2
+    exit 1
+end
+if not test -d "$pi_agent_dir"
+    printf 'pi-sbx: Pi agent directory is unavailable: %s\n' "$pi_agent_dir" >&2
+    exit 1
+end
+
+set -l node_bin (path dirname "$node_executable")
+set -gx PATH "$node_bin" $PATH
+set -lx PI_SBX_PROFILE "$profile"
+set -lx PI_CODING_AGENT_DIR "$pi_agent_dir"
+# Keep Orca hook integrations working while callers migrate to PI_SBX_PROFILE.
+set -lx ORCA_NONO_PROFILE "$profile"
+
+exec /usr/bin/systemd-run \
+    --user \
+    --scope \
+    --collect \
+    --quiet \
+    --slice=pi-agents.slice \
+    --property=CPUQuota=1600% \
+    --property=MemoryHigh=48G \
+    --property=MemoryMax=64G \
+    --property=MemorySwapMax=8G \
+    --property=TasksMax=8192 \
+    --property=OOMPolicy=stop \
+    -- "$nono_executable" run --profile "$profile" -- "$node_executable" "$pi_executable" $argv