@erichll/pi-sandbox 0.15.2 → 0.15.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +11 -0
- package/README.md +10 -7
- package/package.json +3 -3
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,16 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## 0.15.3 - 2026-09-03
|
|
4
|
+
|
|
5
|
+
- Reviewer decisions on sandbox network boundaries inherit the fenced-JSON
|
|
6
|
+
tolerance fix through the `@erichll/pi-auto-review` 0.15.3 dependency
|
|
7
|
+
(strict decision-schema validation unchanged).
|
|
8
|
+
- Move the tested `pi-subagents` baseline to 0.64.0.
|
|
9
|
+
- Verify watchdog launch blocking occurs before worker spawn and leaves no child
|
|
10
|
+
transcript in the model-backed gate.
|
|
11
|
+
- Exercise `watchdog_diff` against read-only Git worktree metadata through the
|
|
12
|
+
real outer-sandbox launcher.
|
|
13
|
+
|
|
3
14
|
## 0.15.2 - 2026-09-02
|
|
4
15
|
|
|
5
16
|
- No user-facing changes. Compatibility-verification release only: the
|
package/README.md
CHANGED
|
@@ -9,7 +9,7 @@ also run complete process-backed subagent trees inside independent sandboxes.
|
|
|
9
9
|
- [Security model](#security-model)
|
|
10
10
|
- [Linux requirements](#linux-requirements)
|
|
11
11
|
- [Subagent provider](#subagent-provider)
|
|
12
|
-
- [`pi-subagents` 0.
|
|
12
|
+
- [`pi-subagents` 0.64.0 capability boundary](#pi-subagents-0640-capability-boundary)
|
|
13
13
|
- [Network domain policy](#network-domain-policy)
|
|
14
14
|
- [Optional host IPC fallback](#optional-host-ipc-fallback)
|
|
15
15
|
- [Additional trusted read paths](#additional-trusted-read-paths)
|
|
@@ -96,7 +96,7 @@ Supported modes:
|
|
|
96
96
|
itself is not wrapped while `externalWorkerIsolation` is `off`.
|
|
97
97
|
- `off`: protect Bash only.
|
|
98
98
|
|
|
99
|
-
### `pi-subagents` 0.
|
|
99
|
+
### `pi-subagents` 0.64.0 capability boundary
|
|
100
100
|
|
|
101
101
|
`pi-sandbox` verifies the following combination in its test suite and release
|
|
102
102
|
gate. This version boundary is pinned exactly (see the package
|
|
@@ -107,7 +107,7 @@ gate. This version boundary is pinned exactly (see the package
|
|
|
107
107
|
published peer range remains `>=0.50.0`; this documents the current tested
|
|
108
108
|
development baseline, not a runtime minimum.
|
|
109
109
|
|
|
110
|
-
| Capability | `builtin` | `pi-subagents` 0.
|
|
110
|
+
| Capability | `builtin` | `pi-subagents` 0.64.0 |
|
|
111
111
|
| --- | --- | --- |
|
|
112
112
|
| Outer worker sandbox | Yes | Opt-in (`externalWorkerIsolation: "enforce"`) |
|
|
113
113
|
| Bash sandbox | Yes | Yes |
|
|
@@ -121,10 +121,13 @@ and, before a release, the model-backed `npm run gate:pi-subagents`. See
|
|
|
121
121
|
`docs/compat-notes.md` for the recorded compatibility seams and how each is
|
|
122
122
|
verified on upgrade.
|
|
123
123
|
|
|
124
|
-
The 0.
|
|
125
|
-
standard Git worktree metadata (`.git` pointer plus `commondir`)
|
|
126
|
-
real outer-sandbox launcher.
|
|
127
|
-
|
|
124
|
+
The 0.64.0 baseline also exercises tasks passed as an `@task.md` argument,
|
|
125
|
+
standard Git worktree metadata (`.git` pointer plus `commondir`), and the
|
|
126
|
+
read-only `watchdog_diff` tool through the real outer-sandbox launcher. Its
|
|
127
|
+
watchdog `action: "block"` launch rule is checked before worker spawn planning,
|
|
128
|
+
and the model-backed gate verifies that a blocked child creates no transcript
|
|
129
|
+
before running the normal isolated-worker probes. Worktrunk itself is not a
|
|
130
|
+
dependency; provider selection remains upstream behavior.
|
|
128
131
|
|
|
129
132
|
For the external provider, `off` leaves the worker process outside the outer
|
|
130
133
|
Sandbox Runtime boundary. Do not treat inherited Bash sandboxing as complete
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@erichll/pi-sandbox",
|
|
3
|
-
"version": "0.15.
|
|
3
|
+
"version": "0.15.3",
|
|
4
4
|
"description": "Linux (bubblewrap) and macOS (Seatbelt) process sandbox for Pi backed by Anthropic's @anthropic-ai/sandbox-runtime. Fail-closed static filesystem policy plus per-connection network approval from pi-auto-review; sandboxes main-agent Bash and built-in subagent process trees.",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"license": "Apache-2.0",
|
|
@@ -51,7 +51,7 @@
|
|
|
51
51
|
},
|
|
52
52
|
"dependencies": {
|
|
53
53
|
"@anthropic-ai/sandbox-runtime": "0.0.75",
|
|
54
|
-
"@erichll/pi-auto-review": "0.15.
|
|
54
|
+
"@erichll/pi-auto-review": "0.15.3"
|
|
55
55
|
},
|
|
56
56
|
"peerDependencies": {
|
|
57
57
|
"@earendil-works/pi-coding-agent": "^0.84.1",
|
|
@@ -66,7 +66,7 @@
|
|
|
66
66
|
"devDependencies": {
|
|
67
67
|
"@earendil-works/pi-coding-agent": "^0.84.1",
|
|
68
68
|
"@types/node": "^26.2.0",
|
|
69
|
-
"pi-subagents": "0.
|
|
69
|
+
"pi-subagents": "0.64.0",
|
|
70
70
|
"typescript": "^6.0.3"
|
|
71
71
|
}
|
|
72
72
|
}
|