@erichll/pi-sandbox 0.10.0 → 0.11.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +21 -0
- package/README.md +13 -0
- package/package.json +4 -4
- package/src/approval.ts +7 -0
- package/src/runner.ts +9 -1
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,26 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## 0.11.1 - 2026-08-25
|
|
4
|
+
|
|
5
|
+
- Keep Sandbox Runtime's `CLAUDE_CODE_TMPDIR` aligned with each command's
|
|
6
|
+
private `pi-sandbox-tmp-*` directory. This prevents Sandbox Runtime from
|
|
7
|
+
overriding `TMPDIR` with its missing `/tmp/claude` fallback, notably fixing
|
|
8
|
+
`TMPDIR`-dependent tools on macOS.
|
|
9
|
+
- Align the exact `@erichll/pi-auto-review` dependency with `0.11.1`.
|
|
10
|
+
|
|
11
|
+
## 0.11.0 - 2026-08-24
|
|
12
|
+
|
|
13
|
+
- **Tag unmatched network domains.** When a domain does not match any static
|
|
14
|
+
allow or deny rule, the approval request now explicitly records this as
|
|
15
|
+
"network-unmatched" so that audit logs, reviewer context, and grants clearly
|
|
16
|
+
distinguish static-policy misses from other review triggers.
|
|
17
|
+
- **Structured network destination.** Domain approval requests now include
|
|
18
|
+
separate host, port, and protocol fields in addition to the combined
|
|
19
|
+
destination string. Grants bind each component independently, preventing a
|
|
20
|
+
grant for one host-port-protocol combination from being reused for another.
|
|
21
|
+
- Update the dev-only `pi-subagents` compatibility baseline from `0.54.0` to
|
|
22
|
+
`0.56.0`. No runtime or public API changes.
|
|
23
|
+
|
|
3
24
|
## 0.10.0 - 2026-08-22
|
|
4
25
|
|
|
5
26
|
- Align the package version with `@erichll/pi-auto-review` `0.10.0` and update
|
package/README.md
CHANGED
|
@@ -4,6 +4,19 @@
|
|
|
4
4
|
`@anthropic-ai/sandbox-runtime`. It protects main-agent Bash commands and can
|
|
5
5
|
also run complete process-backed subagent trees inside independent sandboxes.
|
|
6
6
|
|
|
7
|
+
## Contents
|
|
8
|
+
|
|
9
|
+
- [Security model](#security-model)
|
|
10
|
+
- [Linux requirements](#linux-requirements)
|
|
11
|
+
- [Subagent provider](#subagent-provider)
|
|
12
|
+
- [`pi-subagents` 0.53.0 capability boundary](#pi-subagents-0530-capability-boundary)
|
|
13
|
+
- [Network domain policy](#network-domain-policy)
|
|
14
|
+
- [Optional host IPC fallback](#optional-host-ipc-fallback)
|
|
15
|
+
- [Additional trusted read paths](#additional-trusted-read-paths)
|
|
16
|
+
- [Installation](#installation)
|
|
17
|
+
- [Development](#development)
|
|
18
|
+
- [Upstream](#upstream)
|
|
19
|
+
|
|
7
20
|
## Security model
|
|
8
21
|
|
|
9
22
|
- Linux uses bubblewrap mount/network namespaces and seccomp.
|
package/package.json
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@erichll/pi-sandbox",
|
|
3
|
-
"version": "0.
|
|
4
|
-
"description": "
|
|
3
|
+
"version": "0.11.1",
|
|
4
|
+
"description": "Linux (bubblewrap) and macOS (Seatbelt) process sandbox for Pi backed by Anthropic's @anthropic-ai/sandbox-runtime. Fail-closed static filesystem policy plus per-connection network approval from pi-auto-review; sandboxes main-agent Bash and built-in subagent process trees.",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"license": "Apache-2.0",
|
|
7
7
|
"keywords": [
|
|
@@ -51,7 +51,7 @@
|
|
|
51
51
|
},
|
|
52
52
|
"dependencies": {
|
|
53
53
|
"@anthropic-ai/sandbox-runtime": "0.0.73",
|
|
54
|
-
"@erichll/pi-auto-review": "0.
|
|
54
|
+
"@erichll/pi-auto-review": "0.11.1"
|
|
55
55
|
},
|
|
56
56
|
"peerDependencies": {
|
|
57
57
|
"@earendil-works/pi-coding-agent": "^0.84.1",
|
|
@@ -66,7 +66,7 @@
|
|
|
66
66
|
"devDependencies": {
|
|
67
67
|
"@earendil-works/pi-coding-agent": "^0.84.1",
|
|
68
68
|
"@types/node": "^26.2.0",
|
|
69
|
-
"pi-subagents": "0.
|
|
69
|
+
"pi-subagents": "0.56.0",
|
|
70
70
|
"typescript": "^6.0.3"
|
|
71
71
|
}
|
|
72
72
|
}
|
package/src/approval.ts
CHANGED
|
@@ -52,7 +52,14 @@ export async function approveDomainEndpoint(
|
|
|
52
52
|
cwd: context.cwd,
|
|
53
53
|
command: context.command,
|
|
54
54
|
destination: `${endpoint.hostname}:${endpoint.port}`,
|
|
55
|
+
destinationHost: endpoint.hostname,
|
|
56
|
+
destinationPort: endpoint.port,
|
|
57
|
+
destinationProtocol: endpoint.protocol,
|
|
55
58
|
agentName: context.agentName,
|
|
59
|
+
matchedPolicy: {
|
|
60
|
+
decision: "ask",
|
|
61
|
+
rule: "network-unmatched",
|
|
62
|
+
},
|
|
56
63
|
};
|
|
57
64
|
return approveBoundaryRequest(request, context);
|
|
58
65
|
}
|
package/src/runner.ts
CHANGED
|
@@ -92,6 +92,10 @@ const BROKER_MODULE = fileURLToPath(
|
|
|
92
92
|
* external worker launcher, which creates the same per-worker temp dir.
|
|
93
93
|
*/
|
|
94
94
|
const SANDBOX_TMPDIR_ENV = "PI_SANDBOX_TMPDIR";
|
|
95
|
+
// Sandbox Runtime injects TMPDIR into its wrapped command from this variable.
|
|
96
|
+
// Keep it aligned with SANDBOX_TMPDIR_ENV so that injection does not replace
|
|
97
|
+
// the private command temp directory with its /tmp/claude fallback.
|
|
98
|
+
const SANDBOX_RUNTIME_TMPDIR_ENV = "CLAUDE_CODE_TMPDIR";
|
|
95
99
|
const COMMAND_TMPDIR_PREFIX = "pi-sandbox-tmp-";
|
|
96
100
|
|
|
97
101
|
/**
|
|
@@ -196,7 +200,11 @@ export async function runSandboxedCommand(
|
|
|
196
200
|
: createCommandTempDir();
|
|
197
201
|
if (tempDir) {
|
|
198
202
|
policy = withWritableTempDir(policy, tempDir);
|
|
199
|
-
brokerEnv = {
|
|
203
|
+
brokerEnv = {
|
|
204
|
+
...brokerEnv,
|
|
205
|
+
[SANDBOX_TMPDIR_ENV]: tempDir,
|
|
206
|
+
[SANDBOX_RUNTIME_TMPDIR_ENV]: tempDir,
|
|
207
|
+
};
|
|
200
208
|
}
|
|
201
209
|
const broker = spawnBroker(options, brokerEnv);
|
|
202
210
|
let timeoutHandle: NodeJS.Timeout | undefined;
|