Pi setup adds permission rules, OS sandboxing, and auto-review for host execution

The setup layers three Pi extensions to create a security boundary around a host-based Pi agent. The permission system defines deterministic allow/deny rules for file paths, external directories, and Bash commands. It blocks access to files like .env.pem, and .ssh keys, and denies sudo. These rules are hard-coded in a JSON configuration file, so they apply regardless of user context or reviewer availability.

The sandbox extension isolates ordinary shell commands at the OS level. Commands that do not match a configured hostIPC prefix run inside a bubblewrap sandbox, preventing them from reaching the Docker socket or other host services. Only commands that match a specific prefix, like 'docker compose up -d', are eligible for host execution. Even then, they still require review before running outside the sandbox.

The auto-review extension handles contextual decisions for requests that the permission system cannot resolve deterministically. It uses an LLM to evaluate network connections, permission requests, and host-execution commands. The reviewer never overrides hard-coded deny rules, but it can approve or reject requests that fall into the 'ask' category. If the reviewer fails or times out, the setup defers the request rather than allowing it by default.

The trade-off is between security and availability. The setup adds friction for operations that cross security boundaries, but it does not require moving the entire Pi agent into a container. This makes it compatible with workflows that rely on host-only services like Docker Compose or the host Docker daemon. However, the setup stops working when the reviewer is unavailable, and it does not protect against malicious extensions or misconfigured rules.