Turn off Winboat container and do some sandboxing

configure.d/50-ai-servers.sh

@@ -14,6 +14,7 @@ SANDBOX_CONF="$HOME/.config/coredesktop/sandbox/base.json"
 CLAUDE_SETTINGS="$HOME/.claude/settings.json"
 OPENCODE_CONF="$HOME/.config/opencode/opencode.json"
 source "$COREDESKTOP/configure.d/lib/mdns.sh"
+source "$COREDESKTOP/configure.d/lib/json.sh"
 
 # Ports LLM servers listen on by default, and who uses each. All of them answer
 # OpenAI's API at /v1, which is how every agent here talks to them.
@@ -62,23 +63,6 @@ find_servers() {
   rm -rf "$dir"
 }
 
-# Edit a JSON file in place with jq, creating it from $2 if it's missing.
-# Leaves the file alone if it isn't valid JSON or jq fails.
-edit_json() {
-  local file="$1" empty="$2" tmp
-  shift 2
-  mkdir -p "$(dirname "$file")" || return 1
-  [ -f "$file" ] || echo "$empty" > "$file"
-  tmp="$(mktemp "$file.XXXXXX")" || return 1
-  if jq "$@" "$file" > "$tmp"; then
-    mv -f "$tmp" "$file"
-  else
-    echo "Couldn't change $file; is it valid JSON?"
-    rm -f "$tmp"
-    return 1
-  fi
-}
-
 # Let every sandboxed agent (opencode, Hermes, Cline) reach host:port, and
 # only that port
 sandbox_allow() {