Issues

• Secret-file patterns in the default policy do not match: relative globs never reach the runtime, and nothing guards reads

  carderne/pi-sandbox#125 · Filter by author dennisme opened on Nov 1, 2026
  1

• Sandbox violations are collected by the runtime but never reported, and the monitor is never started

  carderne/pi-sandbox#124 · Filter by author dennisme opened on Nov 1, 2026

• The ssh proxy shim consumes the command-identity window, so ignoreViolations per-command rules silently never match

  carderne/pi-sandbox#123 · Filter by author dennisme opened on Nov 1, 2026

• Extension and MCP tool calls are outside the filesystem policy

  carderne/pi-sandbox#122 · Filter by author dennisme opened on Nov 1, 2026

• If you denyRead a parent directory and allowWrite the child project directory, when Pi does any bash commands: bwrap cant create jibberish file: Read Only Filesystem

  carderne/pi-sandbox#117 · Filter by author MattMalone opened on Oct 23, 2026
  7

• Offer session-only access to the shared Git directory in linked worktrees

  enhancement
  carderne/pi-sandbox#108 · Filter by author luca-heltai opened on Oct 15, 2026
  3

• [Feature idea] Different modes with different sandbox settings (eg read-only, read-write)

  enhancement
  carderne/pi-sandbox#56 · Filter by author geoffsmith opened on Jul 17, 2026
  3

• After sandbox shell command fails, ability to run outside of sandbox is desirable

  enhancement
  carderne/pi-sandbox#50 · Filter by author jacktwilliams opened on Jun 17, 2026
  2

• feat: can we have autodenyRead since denyRead is not the hard block

  enhancement
  carderne/pi-sandbox#43 · Filter by author tan-yong-sheng opened on May 10, 2026
  1