Repository navigation
fix(pi): disable user extensions in sandboxed runs - #443
Conversation
In read_only and allowed mode DevSpace loads a sandbox extension that replaces Pi's read/bash/edit/write/grep tools to enforce the workspace boundary. A user extension that overrides the same tools (for example pi-foldable-tools) made Pi exit on startup, and one that won would have bypassed the sandbox. Launch sandboxed runs with --no-extensions; the explicit --extension sandbox path still loads. full_access has no sandbox and keeps the user's extensions. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
Build and validate launch arguments src/local-agent-pi.ts, src/local-agent-pi.test.ts, test/agents-replay/transcripts/pi/*.jsonl |
piLaunchArgs preserves extensions for full_access and adds RPC and approval arguments. Sandboxed modes require a sandbox extension path, disable other extensions, and select their tool lists. The RPC factory delegates argument construction to the helper. Tests and replay transcripts cover the arguments. |
Priority:
Estimated code review effort: 2 (Simple) | ~10 minutes
Change: Bug fix
Merge Risk: 
17c71
-
Sandboxed Pi runs disable user extensions while explicitly loading the sandbox extension; full-access runs retain user extensions. No merge-blocking issue is identified in the supplied evidence.
Pre-merge checks: 
-
Check name Status Explanation Resolution Docstring Coverage Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documenta… Write docstrings for the functions missing them to satisfy the coverage threshold. -
Check name Status Explanation Description Check Check skipped - CodeRabbit’s high-level summary is enabled. Title check The title clearly and concisely describes the main change: disabling user extensions in sandboxed Pi runs. Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request.
Full details: Docstring Coverage
-
Explanation
Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 2 functions across 2 files. (5 skipped: 5 unsupported.)
Resolution
Write docstrings for the functions missing them to satisfy the coverage threshold.
-
Finishing Touches: 💡 1
-
📝 Generate docstrings: 💡
-
- Commit to this branch
- Create a new PR
🧪 Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
A rabbit checks the launch args twice
The sandbox path is tucked in nice
Read-only tools stay in their lane
Allowed tools follow the same chain
User extensions sit this run out
The replay logs record the route
Comment @coderabbitai help to get the list of available commands.
🚀 Deploying Preview to Cloudflare 🚀Preview URL: https://fix-pi-extension-conflict-devspace-site.waishnav.workers.dev (commit 17c71ad)This URL reflects your latest Preview deploymentPreview Deployments by commit
|
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
In
read_onlyandallowedmode DevSpace loads a sandbox extension that replaces Pi'sread,bash,edit,write, andgreptools to keep the agent inside the workspace. When the user has an extension that overrides the same tools, such aspi-foldable-tools, Pi refuses to start (Tool "read" conflicts with …/devspace-sandbox.ts), so every sandboxed Pi run failed. If Pi ever let the user's extension win instead, it would silently bypass the sandbox, so the sandbox has to be the only thing providing those tools.Sandboxed runs now launch Pi with
--no-extensions. Pi still loads paths passed explicitly with--extension, so DevSpace's sandbox stays in place.full_accessruns have no sandbox and keep the user's extensions. The trade-off matches what T3 Code does for its unattended Pi runs: models or tools that only come from a user extension aren't available to sandboxed DevSpace runs. The launch arguments moved intopiLaunchArgsso they're covered by a test for the first time.Verified on a machine with
pi-foldable-toolsinstalled: a read-only run withxai/grok-4.5now completes, and a read-only run asked to edit a file reports it only hasread,grep,find, andlsand leaves the checkout unchanged.Stacked on #442.
🤖 Generated with Claude Code
Summary by CodeRabbit