Q&A

Pi has no sandbox of its own and no permission prompts, so its tools read, write and run shell commands with the permissions of whatever account started it. Its own containerisation guidance names one thing not to do with any container: never mount the host ~/.pi/agent into it, because that folder holds auth.json and every past session. A turn here runs in a machine created for that message and destroyed after it, so there is no host folder to mount and the keys a run needs arrive as environment variables for that run alone.