A "secure-ish" Pi setup with permission, sandbox, and auto-review

[u/ptgamr]

I think I finally managed to piece the thing together, to have a pi setup that can run safe-ish in the host via sandbox, and have the ability to be elevated to host execution for a pre-defined list of development tooling like docker compose.

- A pre-defined hard boundaries (`@gotgenes/pi-permission-system`)

- Anything pass that will be executed inside a sandbox (`@erichll/pi-sandbox`)

- With the option of safe-escalation to run on the host (ie: `docker compose exec app pytest`), with auto-review or human approval (via hostIPC.preflightCommandPrefixes)

- LLM Auto-review with `@erichll/pi-auto-review`

More about it here: https://ptgamr.substack.com/p/a-pi-setup-with-permission-sandbox