@erichll/pi-auto-review 0.15.3 → 0.17.0

package/CHANGELOG.md

@@ -1,5 +1,30 @@
 # Changelog
 
+## 0.17.0 - 2026-09-05
+
+- Coordinated release for `@erichll/pi-sandbox 0.17.0`; the broker API and
+  approval behavior are unchanged.
+- Align the development pin of `@gotgenes/pi-permission-system` to the 31.1.x
+  runtime line and update the authorizer-integration test to the 31.1.1
+  internal source layout (the 31.1.1 refactor moved `path-normalizer.ts`).
+- Split the 2,778-line `src/index.ts` into a `src/review/` module directory
+  (`types`, `consts`, `config`, `audit`, `prompts`, `guards`, `input`,
+  `provider`, `complete`) with an internal barrel, matching the existing
+  `broker/` and `policy-audit/` conventions; the public export surface of
+  `src/index.ts` is unchanged.
+- Harden TypeScript checking: enable `noUncheckedIndexedAccess` and
+  `noImplicitOverride` across the workspace and fix all 47 newly surfaced
+  unguarded-index sites.
+- Replace the full custom TypeScript test loader with native Node type
+  transformation (`--experimental-transform-types`); a scoped hook now only
+  handles the TypeScript sources shipped inside `node_modules`, which Node
+  refuses to type-strip.
+
+## 0.16.0 - 2026-09-05
+
+- Coordinated release for `@erichll/pi-sandbox 0.16.0`; the broker API and
+  approval behavior are unchanged.
+
 ## 0.15.3 - 2026-09-03
 
 - Tolerate a single enclosing ```` ```json ```` or bare Markdown code fence

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@erichll/pi-auto-review",
-  "version": "0.15.3",
+  "version": "0.17.0",
   "description": "Fail-closed, model-backed approval broker for Pi: deterministically hard-denies dangerous operations, reviews dangerous boundaries with a reviewer model, and issues one-shot expiring grants that OS sandbox adapters must consume before retrying.",
   "type": "module",
   "license": "MIT",
@@ -44,17 +44,18 @@
   },
   "scripts": {
     "check": "tsc -p tsconfig.json --noEmit",
-    "test": "node --disable-warning=ExperimentalWarning --experimental-loader ./test/typescript-loader.mjs --test test/*.test.ts"
+    "test": "node --disable-warning=ExperimentalWarning --experimental-transform-types --import ./test/register-external-ts.mjs --test test/*.test.ts"
   },
   "peerDependencies": {
-    "@earendil-works/pi-ai": "^0.84.4",
-    "@earendil-works/pi-coding-agent": "^0.84.4",
+    "@earendil-works/pi-ai": "^0.85.0",
+    "@earendil-works/pi-coding-agent": "^0.85.0",
     "@gotgenes/pi-permission-system": ">=29.3.0 <32.0.0"
   },
   "devDependencies": {
-    "@earendil-works/pi-ai": "^0.84.4",
-    "@earendil-works/pi-coding-agent": "^0.84.4",
-    "@gotgenes/pi-permission-system": "31.0.0",
+    "@earendil-works/pi-ai": "^0.85.0",
+    "@earendil-works/pi-coding-agent": "^0.85.0",
+    "@earendil-works/pi-server": "^0.85.0",
+    "@gotgenes/pi-permission-system": "31.1.1",
     "@types/node": "^26.2.0",
     "typescript": "^6.0.3"
   }

package/src/broker/overrides.ts

@@ -145,6 +145,7 @@ export class RecentDenialStore {
     );
     if (index < 0) return;
     const denial = this.#denials[index];
+    if (!denial) return;
     const key = this.key(sessionId, denial.requestHash);
     const pending = this.#breakGlassPending.get(key);
     if (pending) {