@erichll/pi-auto-review 0.1.2 → 0.3.1

package/CHANGELOG.md

@@ -0,0 +1,12 @@
+# Changelog
+
+## 0.3.1 - 2026-07-29
+
+- Bind one-shot approval grants to matched policy evidence as well as the
+  command, working directory, destination, paths, and other request fields.
+- Prevent a grant issued for one Host-IPC trigger from authorizing a request
+  with different trigger evidence.
+
+## 0.3.0 - 2026-07-28
+
+- Initial public release.

package/README.md

@@ -114,8 +114,8 @@ import {
 } from "@erichll/pi-auto-review";
 
 const request: BoundaryRequest = {
-  id: "landstrip-query-id",
-  source: "landstrip",
+  id: "sandbox-runtime-query-id",
+  source: "sandbox-runtime",
   surface: "network",
   operation: "connect",
   cwd: "/workspace/project",
@@ -158,7 +158,7 @@ may additionally receive only these bounded result classes:
   a pending deletion target.
 - `git remote`, branch, status, revision, and remote configuration results for
   a pending Git push.
-- The current structured Landstrip trap.
+- The current structured Sandbox Runtime trap.
 
 Unrelated tool results and assistant prose remain excluded. Selected results
 have a separate `maxRelevantResultTokens` budget, common secret/token forms are
@@ -166,19 +166,18 @@ redacted, and markup characters are escaped before the evidence is sent to the
 reviewer. Results remain explicitly labeled as untrusted and possibly
 incomplete.
 
-## Landstrip status
+## Sandbox adapter status
 
 The broker-facing contract is implemented, but this package does not intercept
-Landstrip prompts by itself. A Landstrip adapter must translate its structured
-filesystem/network trap into `BoundaryRequest`, consume the exact grant, and
-then use a supported Landstrip retry or dynamic-grant mechanism.
-
-This monorepo also contains `pi-sandbox`, a Linux Landstrip and macOS Seatbelt
-integration that owns Bash and process-backed subagent execution, provides
-domain-based proxy approval, and consumes this broker service directly. Its
-Linux native paths are tested. The macOS implementation has deterministic
-orchestration and policy tests, but still awaits native smoke coverage on real
-x64/arm64 hosts. Do not load `pi-sandbox` and `pi-landstrip` together.
+OS sandbox events by itself. Adapters translate a concrete boundary into a
+`BoundaryRequest` and must consume the exact grant before allowing the
+operation.
+
+This monorepo's `pi-sandbox` uses Anthropic Sandbox Runtime. Filesystem policy
+is static and fails closed; unmatched public network destinations use the
+broker for per-connection approval. Each Bash command or built-in subagent
+session owns an independent Sandbox Runtime broker process. Adapters should use
+the `./sandbox` export.
 
 Do not implement the adapter by writing broad permanent rules to
 `.pi/sandbox.json`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@erichll/pi-auto-review",
-  "version": "0.1.2",
+  "version": "0.3.1",
   "description": "Model-backed boundary approval broker for Pi",
   "type": "module",
   "license": "MIT",
@@ -29,13 +29,14 @@
   "files": [
     "src",
     "config/config.example.json",
+    "CHANGELOG.md",
     "README.md",
     "LICENSE"
   ],
   "exports": {
     ".": "./src/index.ts",
     "./broker": "./src/broker/index.ts",
-    "./landstrip": "./src/integrations/landstrip.ts"
+    "./sandbox": "./src/integrations/sandbox.ts"
   },
   "pi": {
     "extensions": [

package/src/broker/grants.ts

@@ -27,6 +27,7 @@ export function boundaryRequestHash(request: BoundaryRequest): string {
     skillName: request.skillName,
     toolInputPreview: request.toolInputPreview,
     agentName: request.agentName,
+    matchedPolicy: request.matchedPolicy,
   };
   return createHash("sha256")
     .update(JSON.stringify(stableValue(material)))

package/src/broker/types.ts

@@ -9,7 +9,7 @@ export type BoundarySurface =
 
 export type BoundarySource =
   | "permission-system"
-  | "landstrip"
+  | "sandbox-runtime"
   | (string & {});
 
 export type BoundaryRequest = {

package/src/index.ts

@@ -38,12 +38,12 @@ import { PermissionUiAutoConfirmer } from "./ui-auto-confirm.ts";
 export { parseDecision } from "./policy.ts";
 export * from "./broker/index.ts";
 export {
-  landstripTrapToBoundaryRequest,
-  type LandstripBoundaryTrap,
-  type LandstripFilesystemTrap,
-  type LandstripNetworkTrap,
-  type LandstripRequestContext,
-} from "./integrations/landstrip.ts";
+  sandboxTrapToBoundaryRequest,
+  type SandboxBoundaryTrap,
+  type SandboxFilesystemTrap,
+  type SandboxNetworkTrap,
+  type SandboxRequestContext,
+} from "./integrations/sandbox.ts";
 
 type ReasoningLevel =
   | "off"

package/src/integrations/{landstrip.ts → sandbox.ts}

@@ -1,13 +1,12 @@
 import type { BoundaryRequest } from "../broker/types.ts";
 
-export type LandstripFilesystemTrap = {
+export type SandboxFilesystemTrap = {
   kind: "filesystem";
-  code: "FILESYSTEM_DENIED";
-  query_id?: string;
   operation: "read" | "write";
   path: string;
   requested_path?: string;
   reason?: string;
+  query_id?: string;
   process?: {
     pid?: number;
     exe?: string | null;
@@ -15,12 +14,11 @@ export type LandstripFilesystemTrap = {
   };
 };
 
-export type LandstripNetworkTrap = {
+export type SandboxNetworkTrap = {
   kind: "network";
-  code: "NETWORK_DENIED";
-  query_id?: string;
   operation: "connect" | "bind";
   target: string;
+  query_id?: string;
   process?: {
     pid?: number;
     exe?: string | null;
@@ -28,29 +26,29 @@ export type LandstripNetworkTrap = {
   };
 };
 
-export type LandstripBoundaryTrap =
-  | LandstripFilesystemTrap
-  | LandstripNetworkTrap;
+export type SandboxBoundaryTrap =
+  | SandboxFilesystemTrap
+  | SandboxNetworkTrap;
 
-export type LandstripRequestContext = {
+export type SandboxRequestContext = {
   command?: string;
   cwd: string;
   agentName?: string;
 };
 
-export function landstripTrapToBoundaryRequest(
-  trap: LandstripBoundaryTrap,
-  context: LandstripRequestContext,
+export function sandboxTrapToBoundaryRequest(
+  trap: SandboxBoundaryTrap,
+  context: SandboxRequestContext,
 ): BoundaryRequest {
   const processSuffix =
     trap.process?.pid === undefined ? "" : `:${trap.process.pid}`;
   const id = trap.query_id
-    ? `landstrip:${trap.query_id}`
-    : `landstrip:${trap.kind}:${trap.operation}${processSuffix}`;
+    ? `sandbox-runtime:${trap.query_id}`
+    : `sandbox-runtime:${trap.kind}:${trap.operation}${processSuffix}`;
   if (trap.kind === "filesystem") {
     return {
       id,
-      source: "landstrip",
+      source: "sandbox-runtime",
       surface:
         trap.operation === "read"
           ? "filesystem-read"
@@ -70,7 +68,7 @@ export function landstripTrapToBoundaryRequest(
   }
   return {
     id,
-    source: "landstrip",
+    source: "sandbox-runtime",
     surface: "network",
     operation: trap.operation,
     cwd: trap.process?.cwd || context.cwd,

package/src/policy.ts

@@ -582,7 +582,7 @@ function relevantResultEvidence(
 function sandboxTrapEvidence(
   request: RelevantBoundaryRequest,
 ): string | undefined {
-  if (request.source !== "landstrip") return;
+  if (request.source !== "sandbox-runtime") return;
   return `<sandbox-trap>
 ${boundedString({
     surface: request.surface,