[eersnington]

Add pipboy hygiene. It runs cargo deny and cargo shear in sandbox-agent/ on the merge base and the PR, then diffs the findings. Neither tool compiles anything.

• Fail only on new findings in advisories, licenses, and sources. Bans and unused dependencies are reported only. Existing findings never fail a PR.
• Finding keys leave out the crate version, so a routine bump of an already flagged crate is not new.
• Add sandbox-agent/deny.toml with the license allow-list from rivet-dev/rivet.
• Run only when Rust files, Cargo.*, or deny.toml under sandbox-agent/ change.

pnpm --filter pipboy pipboy hygiene --base-root ../base --out hygiene.json

---

This is part 2 of 4 in a stack:

•  4  ci(pipboy): add per-commit CI trace command #362
•  3  ci(pipboy): add native binary sizes #361
•  2  ci(pipboy): add rust dependency hygiene #360 👈
•  1  ci(pipboy): add package footprint #359

[github-actions]

📟 Pip-Boy · 58664cc

📦 Packages · fresh npm install resolve, no lockfile · this PR vs base

🔴 Registry drift: @rivet-dev/pi@latest is already over budget for anyone installing it today. This PR didn't cause it.

package (linux-x64-gnu)	@latest	base	this PR	Δ vs base	packages
@rivet-dev/pi	2.43 GB	2.43 GB	2.43 GB	0 · over 640.0 MB budget	604 (0)

`@rivet-dev/pi` details

platform	base	this PR	Δ
linux-x64-gnu	2.43 GB	2.43 GB	0
linux-arm64-gnu	2.41 GB	2.41 GB	0
darwin-arm64	1.69 GB	1.69 GB	0
darwin-x64	1.71 GB	1.71 GB	0
win32-x64	1.12 GB	1.12 GB	0

Largest dependencies

package	size	via
@rivet-dev/agentos-sidecar-linux-x64-gnu@0.2.22	594.6 MB	@rivet-dev/pi › rivetkit › @rivet-dev/agent-os-core › secure-exec › @rivet-dev/agentos-core › @rivet-dev/agentos-sidecar › @rivet-dev/agentos-sidecar-linux-x64-gnu
@rivet-dev/agentos-runtime-sidecar-linux-x64-gnu@0.2.22	567.4 MB	@rivet-dev/pi › rivetkit › @rivet-dev/agent-os-core › secure-exec › @rivet-dev/agentos-core › @rivet-dev/agentos-runtime-core › @rivet-dev/agentos-runtime-sidecar › @rivet-dev/agentos-runtime-sidecar-linux-x64-gnu
@rivet-dev/services-linux-x64-gnu@0.2.2	138.4 MB	@rivet-dev/pi › rivetkit › @rivet-dev/services › @rivet-dev/services-linux-x64-gnu
@agentos-software/pi@0.2.7	133.0 MB	@rivet-dev/pi › rivetkit › @rivet-dev/agent-os-core › secure-exec › @rivet-dev/agentos-core › @agentos-software/pi
googleapis@144.0.0	110.1 MB	@rivet-dev/pi › rivetkit › @rivet-dev/agent-os-core › secure-exec › @rivet-dev/agentos-core › googleapis

Floating 0.x ranges (resolve above their floor today)

range	declared by	resolves to	subtree
secure-exec@^0.2.1	@rivet-dev/agent-os-core@0.1.1	0.2.22	1.96 GB
@rivet-dev/services@^0.2.0	rivetkit@2.3.27	0.2.2	138.4 MB
@img/sharp-linux-x64@^0.34.2	@anthropic-ai/claude-agent-sdk@0.2.87	0.34.5	16.3 MB
esbuild@^0.27.1	@secure-exec/nodejs@0.2.1	0.27.7	10.7 MB
@sinclair/typebox@^0.34.41	@mariozechner/pi-ai@0.60.0	0.34.52	1.8 MB

All 10 packages · linux-x64-gnu

package (linux-x64-gnu)	@latest	base	this PR	Δ vs base	packages
@rivet-dev/pi	2.43 GB	2.43 GB	2.43 GB	0 · over 640.0 MB budget	604 (0)
@rivet-dev/sandbox-adapter	75.0 MB	75.0 MB	75.0 MB	0	92 (0)
@sandbox-agent/cli-shared	27.2 KB	27.2 KB	27.2 KB	0	1 (0)
@sandbox-agent/persist-indexeddb	12.4 KB	12.4 KB	12.4 KB	0	1 (0)
@sandbox-agent/persist-postgres	12.3 KB	12.3 KB	12.3 KB	0	1 (0)
@sandbox-agent/persist-rivet	12.2 KB	12.2 KB	12.2 KB	0	1 (0)
@sandbox-agent/persist-sqlite	12.3 KB	12.3 KB	12.3 KB	0	1 (0)
@sandbox-agent/react	41.5 MB	41.8 MB	41.8 MB	0	15 (0)
acp-http-client	6.7 MB	6.7 MB	6.7 MB	0	3 (0)
sandbox-agent	30.9 MB	31.0 MB	31.0 MB	0	8 (0)

🧹 Rust dependencies · cargo deny + cargo shear

check	new in this PR	fixed	existing on base
advisories	✅ 0	0	11
licenses	✅ 0	318	0
sources	✅ 0	0	0
bans	✅ 0	0	0
unused	✅ 0	0	13

⏱ Timing

job	wall time	slowest step
zizmor	15s	checkout · 9s
changes	19s	checkout · 13s
self-test	48s	setup-node · 18s
hygiene	1m00s	setup-node · 21s
footprint	2m33s	Measure · 35s
report	51s	setup-node · 29s