Add Pi agent support to sandboxy

[AntApper]

Resolves #801

Overview

Adds built-in agent support for Pi (@earendil-works/pi-coding-agent) to sandboxy. This serves as a second built-in agent definition alongside Claude Code, validating the multi-agent application architecture.

Changes

• Adds AgentDefinition.pi configured with:
  • Base image docker.io/library/node:22
  • NPM installation of @earendil-works/pi-coding-agent with --ignore-scripts
  • Mount for ~/.pi/agent to /root/.pi/agent
  • Automatic forwarding for provider credentials (ANTHROPIC_API_KEY, OPENAI_API_KEY, GEMINI_API_KEY, GOOGLE_API_KEY, OPENROUTER_API_KEY, XAI_API_KEY, ANTHROPIC_OAUTH_TOKEN)
  • Allowed host domains for provider endpoints and npm
• Conditions global-agent proxy bootstrapping in RunAgentCommand so it is only applied when global-agent is present in the agent's install commands.
• Cleans up sigwinchStream on exit in runContainerSession.
• Updates sandboxy README documentation and usage examples.

Verification

• Built sandboxy binary and verified clean compilation (make -C examples/sandboxy).
• Ran code formatting (make fmt) and license/linter checks (make check).
• Ran the full test suite (swift test, 593 tests passed).
• Verified sandboxy config list --agents and interactive launch with PTY relay.

[jglogan]

@AntApper I don't have a deep understanding of what's necessary when embedding agents in containers but having all this mostly-nodes-related stuff conditionalized here feels somewhat arbitrary.

Can you think of any way to do this declaratively as part of the agent definition, such that it's secure (for example, doesn't allow an agent setup to perform arbitrary operations on the host or access user data)?

[jglogan]

Let's use the conversation here to discuss approaches before making any code changes.

[AntApper]

completely agree, sniffing the install commands was a bit of a hack and having node paths hardcoded in the runner is messy.

the only reason it's there is claude code doesn't respect standard HTTP_PROXY env vars without global-agent, whereas pi doesn't need it (and node crashes if it tries to require a file that isn't installed).

to make it declarative and safe from arbitrary user JSONs, we could do a simple enum like proxyBootstrap: .standard | .nodeGlobalAgent so it's strictly bounded, or something like a proxyEnv dictionary on the agent definition with a {PROXY_URL} token so sandboxy doesn't need any node-specific logic at all. since it's just setting container env vars either way, host files/execution wouldn't be exposed.

let me know if either of those sounds good to you or if you were picturing something different!