@erichll/pi-sandbox 0.18.1 → 0.19.0

package/CHANGELOG.md

@@ -1,5 +1,33 @@
 # Changelog
 
+## 0.19.0 - 2026-09-20
+
+- Require Pi `^0.86.0` for both the development and peer dependency of
+  `@earendil-works/pi-coding-agent`, and depend on `@erichll/pi-auto-review`
+  `^0.19.0` so the pair shares the same Pi floor. The `pi-subagents` runtime
+  peer stays `>=0.66.0`.
+- Revalidated against Pi 0.86.0: the package test suite passes (88 pass, 1
+  skipped), the deterministic `gate:pi-subagents` preflight passes, and the
+  model-backed gate passes both phases (native baseline host-readable,
+  protected sandboxed Bash blocked from the host read) with native
+  acknowledgement `@erichll:pi-sandbox`.
+- Recorded the Pi 0.86.0 floor in `README.md`, `docs/compat-notes.md`, and the
+  `pi-subagents-native.ts` compatibility notes: protected mode with
+  pi-subagents 0.68.0+ needs Pi 0.86.0 or newer.
+
+## 0.18.2 - 2026-09-20
+
+- Pin the development `pi-subagents` baseline to `^0.69.0` and Pi to
+  `^0.85.1`. The runtime peer stays `>=0.66.0`.
+- Revalidated protected native mode against published pi-subagents 0.69.0:
+  the `./capability-ceiling` export path, `SUBAGENT_CAPABILITY_CEILING_VERSION`
+  1, `registerSubagentCapabilityCeiling`, discovery/canonical resolution, and
+  the config loader with `scheduledRuns` are unchanged. The deterministic gate
+  and the package test suite pass against 0.67.0 and 0.69.0.
+- Recorded in `docs/compat-notes.md` that protected mode with pi-subagents
+  0.68.0+ needs Pi 0.85.1 or newer: 0.85.0 does not ship
+  `@earendil-works/pi-server`, so background children fail to launch there.
+
 ## 0.18.1 - 2026-09-17
 
 - Trim redundant paths from default `denyWrite` policy (`settings.json`,

package/README.md

@@ -9,7 +9,7 @@ also run complete process-backed subagent trees inside independent sandboxes.
 - [Security model](#security-model)
 - [Linux requirements](#linux-requirements)
 - [Subagent provider](#subagent-provider)
-  - [`pi-subagents` 0.65.0 native-background tool boundary](#pi-subagents-0650-native-background-tool-boundary)
+  - [`pi-subagents` native-background tool boundary](#pi-subagents-native-background-tool-boundary)
 - [Network domain policy](#network-domain-policy)
 - [Optional host IPC fallback](#optional-host-ipc-fallback)
 - [Additional trusted read paths](#additional-trusted-read-paths)
@@ -90,14 +90,16 @@ Supported modes:
 
 - `builtin` (default): register the process-backed `subagent` tool and sandbox
   each complete worker process tree.
-- `pi-subagents`: let `pi-subagents 0.65.0` own orchestration under the required
+- `pi-subagents`: let `pi-subagents >=0.66.0` own orchestration under the required
   native-background tool boundary described below.
 - `off`: protect Bash only.
 
-### `pi-subagents` 0.65.0 native-background tool boundary
+### `pi-subagents` native-background tool boundary
 
-This provider is intentionally locked to exactly `pi-subagents 0.65.0` and
-fails closed if its public ceiling API or internal discovery layout drifts.
+This provider supports the `pi-subagents >=0.66.0` line (validated through
+0.69.0) and fails closed if its public ceiling API or internal discovery layout
+drifts. The peer dependency is a floor with no upper pin; the loader's explicit
+export and layout checks are the real gate.
 Configure both the protection mode and a non-empty canonical whitelist:
 
 ```json
@@ -113,9 +115,9 @@ Configure both the protection mode and a non-empty canonical whitelist:
 The `pi-subagents` config at
 `~/.pi/agent/extensions/subagent/config.json` must also contain
 `"scheduledRuns": { "enabled": false }`. Every launch must explicitly set
-`async: true`. Only direct single-agent launches are supported. In 0.65.0,
-public `workflowScript` / `workflowScriptPath` children disable ambient
-extensions, so both are rejected along with named workflows, schedules,
+`async: true`. Only direct single-agent launches are supported. Public
+`workflowScript` / `workflowScriptPath` children disable ambient
+extensions upstream, so both are rejected along with named workflows, schedules,
 configuration mutations, resume, nested subagents, and external runners.
 
 Every child is constrained by the upstream capability ceiling to `bash`,
@@ -124,7 +126,7 @@ acknowledge `@erichll:pi-sandbox`; writes can therefore occur only through the
 sandboxed Bash tool. `write`, `edit`, MCP, and other extension tools are not
 available.
 
-| Capability | `builtin` | `pi-subagents` 0.65.0 protected mode |
+| Capability | `builtin` | `pi-subagents` protected mode |
 | --- | --- | --- |
 | Outer worker sandbox | Yes | No |
 | Bash sandbox | Yes | Yes |
@@ -276,11 +278,13 @@ npm test
 npm run gate:pi-subagents
 ```
 
-`gate:pi-subagents` verifies the pinned package layout, discovery behavior,
+`gate:pi-subagents` verifies the pinned development dependency's package layout,
+discovery behavior,
 capability ceiling, and protected launch policy in an isolated temporary agent
 directory. It never reads or updates production Pi configuration. Model-backed
 acceptance requires `PI_SUBAGENTS_GATE_MODEL` and an already-exported matching
-credential; missing prerequisites are reported as `SKIP`.
+credential; missing prerequisites are reported as `SKIP`. Protected mode with
+pi-subagents 0.68.0 or newer needs Pi 0.86.0 or newer.
 
 The test suite covers real Linux Sandbox Runtime enforcement when its native
 dependencies are installed, plus deterministic broker, network approval,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@erichll/pi-sandbox",
-  "version": "0.18.1",
+  "version": "0.19.0",
   "description": "Linux (bubblewrap) and macOS (Seatbelt) process sandbox for Pi backed by Anthropic's @anthropic-ai/sandbox-runtime. Fail-closed static filesystem policy plus per-connection network approval from pi-auto-review; sandboxes main-agent Bash and built-in subagent process trees.",
   "type": "module",
   "license": "Apache-2.0",
@@ -51,11 +51,11 @@
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "0.0.75",
-    "@erichll/pi-auto-review": "^0.18.0",
+    "@erichll/pi-auto-review": "^0.19.0",
     "jiti": "2.7.0"
   },
   "peerDependencies": {
-    "@earendil-works/pi-coding-agent": "^0.85.0",
+    "@earendil-works/pi-coding-agent": "^0.86.0",
     "pi-subagents": ">=0.66.0",
     "typebox": ">=1.0.0"
   },
@@ -65,10 +65,10 @@
     }
   },
   "devDependencies": {
-    "@earendil-works/pi-coding-agent": "^0.85.0",
-    "@earendil-works/pi-server": "^0.85.0",
+    "@earendil-works/pi-coding-agent": "^0.86.0",
+    "@earendil-works/pi-server": "^0.86.0",
     "@types/node": "^26.2.0",
-    "pi-subagents": "^0.67.0",
+    "pi-subagents": "^0.69.0",
     "typescript": "^6.0.3"
   }
 }

package/src/pi-subagents-native.ts

@@ -7,9 +7,13 @@ import { createJiti } from "jiti";
  * Compatible pi-subagents line: 0.66.0 and above (no upper pin). Any new minor
  * is accepted, so the exports/ceiling checks below are the real compatibility
  * gate; this range only rejects old lines and guards against blind
- * accept-on-drift. Revalidated against 0.66.0: ceiling registry, discovery,
- * and config internals unchanged (verified 2026-09-06 against the published
- * 0.66.0 package).
+ * accept-on-drift. Revalidated against 0.69.0: ceiling registry
+ * (`SUBAGENT_CAPABILITY_CEILING_VERSION` 1), the `./capability-ceiling` export
+ * path, discovery/canonical resolution, and the config loader with
+ * `scheduledRuns` are unchanged since 0.66.0 (verified 2026-09-19 against the
+ * published 0.69.0 package). Protected mode needs Pi 0.86.0 or newer (the
+ * package peer floor) with pi-subagents 0.68.0+: 0.85.0 does not ship
+ * `@earendil-works/pi-server`, so background children fail to launch there.
  */
 export const PI_SUBAGENTS_COMPAT_RANGE = ">=0.66.0";
 export const NATIVE_CHILD_TOOLS = ["bash", "read", "grep", "find", "ls"] as const;