Run safe Pi from a per-user copy of its configuration

Pi 1.4.0 creates lock files beside its settings and credentials, so it
cannot start from the root-owned template. The wrapper now copies the
template into the zone's state directory on each start. The model key is
readable only by the operator. Document why host sudo is left unchanged.

Author: krystophny

sandbox/srt/README.md

@@ -64,14 +64,11 @@ require an explicit proxy denial, and direct socket checks require a permission
 error. Synthetic file contents are checked and deleted. The runtime's own
 temporary directory remains writable, as documented upstream.
 
-After **all** shell and Pi checks pass, finish all other root work. Check
-`sudo visudo -c`, back up `/etc/sudoers` to `/etc/sudoers.bak-20261028` without
-overwriting an existing backup, and use `sudo visudo` to change exactly
-`%admin ALL = (ALL) NOPASSWD:ALL` to `%admin ALL = (ALL) ALL`. Leave every included
-sudoers file unchanged. Validate again from the same privileged editing session
-before closing it, invalidate cached credentials with `sudo -K`, then rerun
-the full test with `--after-sudo`. Both host and sandbox `sudo -n true` must fail.
-The installer intentionally leaves sudo policy unchanged.
+The sandbox itself refuses to execute `sudo` ("Operation not permitted"), so
+`safe` does not depend on the host sudo policy. Host sudo stays as it is for
+now: the qwen native adapter runs as the operator and calls `sudo -n` for its
+admission probe, so removing `NOPASSWD` needs a narrow rule for that probe
+first. The installer leaves sudo policy unchanged.
 
 The login-Keychain deny workaround is described in
 [srt issue 755](https://github.com/anthropics/sandbox-runtime/issues/755).

sandbox/srt/install.py

@@ -91,7 +91,9 @@ def template(path):
         raise SystemExit("A literal itpcp key is required")
     models = json.loads((source / "pi-safe/models.json").read_text())
     models["providers"]["itpcp"]["apiKey"] = key
-    install(zone / "pi-safe/models.json", json.dumps(models, indent=2) + "\n")
+    install(zone / "pi-safe/models.json", json.dumps(models, indent=2) + "\n", 0o600)
+    # Only the operator's wrapper may read the key; other local users may not.
+    os.chown(zone / "pi-safe/models.json", owner.pw_uid, 0)
     state = home / ".local/state/pi-safe"
     state.mkdir(parents=True, exist_ok=True)
     os.chown(state, owner.pw_uid, owner.pw_gid)

sandbox/srt/safe

@@ -15,13 +15,17 @@ for arg do
 done
 zone='/Library/Application Support/agent-zones'
 agent_home='@HOME@'
+state="$agent_home/.local/state/pi-safe"
+# Pi writes lock files beside its configuration, so it runs from a copy.
+mkdir -p -m 700 "$state/agent"
+cp -f "$zone/pi-safe/settings.json" "$zone/pi-safe/mcp.json" "$zone/pi-safe/models.json" "$state/agent/"
 cd "$agent_home/Nextcloud"
 # Start srt itself without inherited loaders, proxy overrides, or credentials.
 exec /usr/bin/env -i \
     HOME="$agent_home" USER='@USER@' LOGNAME='@USER@' \
     PATH='/opt/agents/srt/bin:/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin' \
     SHELL=/bin/bash LANG=en_US.UTF-8 TERM="${TERM:-dumb}" MPLBACKEND=Agg \
-    PI_CODING_AGENT_DIR="$zone/pi-safe" \
+    PI_CODING_AGENT_DIR="$state/agent" \
     PI_CODING_AGENT_SESSION_DIR="$agent_home/.local/state/pi-safe/sessions" \
     XDG_CACHE_HOME="$agent_home/.local/state/pi-safe/cache" \
     /opt/agents/srt/bin/node \