@erichll/pi-sandbox 0.18.2 → 0.19.1

package/CHANGELOG.md

@@ -1,5 +1,44 @@
 # Changelog
 
+## 0.19.1 - 2026-09-20
+
+- Pin the development `pi-subagents` baseline to `^0.70.0`. The runtime peer
+  stays `>=0.66.0`.
+- Accept the compiled module layout introduced in 0.70.0: the npm package now
+  ships `src/**/*.js` plus `.d.ts` and publishes `./capability-ceiling` as a
+  `{ types, default }` condition map instead of the 0.69.0 bare
+  `./src/api/capability-ceiling.ts` string. The loader derives the module
+  extension and internal module paths from that export, so the source
+  (0.66.0-0.69.0) and compiled (0.70.0+) layouts share one validated code path;
+  unknown export targets still fail closed.
+- Revalidated protected native mode against published pi-subagents 0.70.0:
+  `SUBAGENT_CAPABILITY_CEILING_VERSION` 1, `registerSubagentCapabilityCeiling`,
+  discovery/canonical resolution, and the config loader with `scheduledRuns`
+  are unchanged. The package test suite passes (89 pass, 1 skipped) and the
+  deterministic `gate:pi-subagents` preflight passes with
+  `piSubagentsModuleExtension: ".js"`. The model-backed gate phase was skipped
+  locally because no model credential was exported.
+- Record in `docs/compat-notes.md` that 0.70.0 makes the root
+  `PI_SUBAGENT_PARENT_SESSION` marker self-deleting while detached runners keep
+  receiving it from their exact launch. Protected mode requires `async: true`
+  children, so forwarded-permission routing is unaffected; the gate's
+  parent-forwarding adapter is now a no-op shim for 0.69.0 and earlier.
+
+## 0.19.0 - 2026-09-20
+
+- Require Pi `^0.86.0` for both the development and peer dependency of
+  `@earendil-works/pi-coding-agent`, and depend on `@erichll/pi-auto-review`
+  `^0.19.0` so the pair shares the same Pi floor. The `pi-subagents` runtime
+  peer stays `>=0.66.0`.
+- Revalidated against Pi 0.86.0: the package test suite passes (88 pass, 1
+  skipped), the deterministic `gate:pi-subagents` preflight passes, and the
+  model-backed gate passes both phases (native baseline host-readable,
+  protected sandboxed Bash blocked from the host read) with native
+  acknowledgement `@erichll:pi-sandbox`.
+- Recorded the Pi 0.86.0 floor in `README.md`, `docs/compat-notes.md`, and the
+  `pi-subagents-native.ts` compatibility notes: protected mode with
+  pi-subagents 0.68.0+ needs Pi 0.86.0 or newer.
+
 ## 0.18.2 - 2026-09-20
 
 - Pin the development `pi-subagents` baseline to `^0.69.0` and Pi to

package/README.md

@@ -97,9 +97,9 @@ Supported modes:
 ### `pi-subagents` native-background tool boundary
 
 This provider supports the `pi-subagents >=0.66.0` line (validated through
-0.69.0) and fails closed if its public ceiling API or internal discovery layout
-drifts. The peer dependency is a floor with no upper pin; the loader's explicit
-export and layout checks are the real gate.
+0.70.0) and fails closed if its public ceiling API, module layout, or internal
+discovery layout drifts. The peer dependency is a floor with no upper pin; the
+loader's explicit export and layout checks are the real gate.
 Configure both the protection mode and a non-empty canonical whitelist:
 
 ```json
@@ -284,7 +284,7 @@ capability ceiling, and protected launch policy in an isolated temporary agent
 directory. It never reads or updates production Pi configuration. Model-backed
 acceptance requires `PI_SUBAGENTS_GATE_MODEL` and an already-exported matching
 credential; missing prerequisites are reported as `SKIP`. Protected mode with
-pi-subagents 0.68.0 or newer needs Pi 0.85.1 or newer.
+pi-subagents 0.68.0 or newer needs Pi 0.86.0 or newer.
 
 The test suite covers real Linux Sandbox Runtime enforcement when its native
 dependencies are installed, plus deterministic broker, network approval,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@erichll/pi-sandbox",
-  "version": "0.18.2",
+  "version": "0.19.1",
   "description": "Linux (bubblewrap) and macOS (Seatbelt) process sandbox for Pi backed by Anthropic's @anthropic-ai/sandbox-runtime. Fail-closed static filesystem policy plus per-connection network approval from pi-auto-review; sandboxes main-agent Bash and built-in subagent process trees.",
   "type": "module",
   "license": "Apache-2.0",
@@ -51,11 +51,11 @@
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "0.0.75",
-    "@erichll/pi-auto-review": "^0.18.0",
+    "@erichll/pi-auto-review": "^0.19.0",
     "jiti": "2.7.0"
   },
   "peerDependencies": {
-    "@earendil-works/pi-coding-agent": "^0.85.0",
+    "@earendil-works/pi-coding-agent": "^0.86.0",
     "pi-subagents": ">=0.66.0",
     "typebox": ">=1.0.0"
   },
@@ -65,10 +65,10 @@
     }
   },
   "devDependencies": {
-    "@earendil-works/pi-coding-agent": "^0.85.1",
-    "@earendil-works/pi-server": "^0.85.1",
+    "@earendil-works/pi-coding-agent": "^0.86.0",
+    "@earendil-works/pi-server": "^0.86.0",
     "@types/node": "^26.2.0",
-    "pi-subagents": "^0.69.0",
+    "pi-subagents": "^0.70.0",
     "typescript": "^6.0.3"
   }
 }

package/src/pi-subagents-native.ts

@@ -7,18 +7,28 @@ import { createJiti } from "jiti";
  * Compatible pi-subagents line: 0.66.0 and above (no upper pin). Any new minor
  * is accepted, so the exports/ceiling checks below are the real compatibility
  * gate; this range only rejects old lines and guards against blind
- * accept-on-drift. Revalidated against 0.69.0: ceiling registry
- * (`SUBAGENT_CAPABILITY_CEILING_VERSION` 1), the `./capability-ceiling` export
- * path, discovery/canonical resolution, and the config loader with
- * `scheduledRuns` are unchanged since 0.66.0 (verified 2026-09-19 against the
- * published 0.69.0 package). Protected mode needs Pi 0.85.1 or newer with
- * pi-subagents 0.68.0+: 0.85.0 does not ship `@earendil-works/pi-server`, so
- * background children fail to launch there.
+ * accept-on-drift. Revalidated against 0.70.0: ceiling registry
+ * (`SUBAGENT_CAPABILITY_CEILING_VERSION` 1), the `./capability-ceiling` export,
+ * discovery/canonical resolution, and the config loader with `scheduledRuns`
+ * are unchanged since 0.66.0, and the published package now ships compiled
+ * `.js`/`.d.ts` modules instead of the TypeScript source layout (verified
+ * 2026-09-20 against the published 0.70.0 package). Protected mode needs Pi
+ * 0.86.0 or newer (the package peer floor) with pi-subagents 0.68.0+: 0.85.0
+ * does not ship `@earendil-works/pi-server`, so background children fail to
+ * launch there.
  */
 export const PI_SUBAGENTS_COMPAT_RANGE = ">=0.66.0";
 export const NATIVE_CHILD_TOOLS = ["bash", "read", "grep", "find", "ls"] as const;
 export const PI_SANDBOX_ACKNOWLEDGEMENT = "@erichll:pi-sandbox";
 
+/**
+ * Module extension of the installed pi-subagents layout. Source checkouts (and
+ * the 0.66.0-0.69.0 npm line) ship `.ts` modules that need a TypeScript loader;
+ * the 0.70.0+ npm package ships compiled `.js` plus `.d.ts` declarations. Both
+ * layouts keep the same package-relative module paths.
+ */
+export type PiSubagentsModuleExtension = ".ts" | ".js";
+
 type Agent = {
   name: string;
   localName?: string;
@@ -85,6 +95,50 @@ export function isCompatiblePiSubagentsVersion(version: unknown): boolean {
   return Number(match[1] ?? "") === 0 && Number(match[2] ?? "") >= 66;
 }
 
+function capabilityCeilingExportTarget(value: unknown): string | undefined {
+  if (typeof value === "string") return value;
+  if (!value || typeof value !== "object" || Array.isArray(value)) return undefined;
+  const conditions = value as Record<string, unknown>;
+  for (const condition of ["default", "import", "require", "types"]) {
+    const candidate = conditions[condition];
+    if (typeof candidate === "string") return candidate;
+  }
+  return undefined;
+}
+
+/**
+ * Resolve the installed module extension from the `./capability-ceiling`
+ * export, which every supported line publishes: a bare `.ts`/`.js` path before
+ * 0.70.0, a `{ types, default }` condition map from 0.70.0 on. Only the known
+ * `./src/api/capability-ceiling.<ext>` target is accepted; anything else fails
+ * closed instead of guessing a layout.
+ */
+export function resolvePiSubagentsModuleExtension(
+  exportsField: Record<string, unknown> | undefined,
+): PiSubagentsModuleExtension {
+  const target = capabilityCeilingExportTarget(exportsField?.["./capability-ceiling"]);
+  const match = typeof target === "string"
+    ? /^\.\/src\/api\/capability-ceiling(?:\.d)?\.(ts|js)$/u.exec(target)
+    : null;
+  if (!match) {
+    throw new Error(
+      "pi-subagents compatibility failure: capability-ceiling export changed",
+    );
+  }
+  return match[1] === "js" ? ".js" : ".ts";
+}
+
+/**
+ * Resolve a package-relative internal module path for the installed layout,
+ * for example `src/agents/agents` on the compiled 0.70.0 line.
+ */
+export function piSubagentsInternalModulePath(
+  relativePath: string,
+  extension: PiSubagentsModuleExtension,
+): string {
+  return `${relativePath.replace(/\.(?:ts|js)$/u, "")}${extension}`;
+}
+
 /** Load the public ceiling API and the discovery/config internals.
  * This intentionally fails closed on package version, export, or layout drift.
  */
@@ -101,20 +155,18 @@ export async function loadPiSubagentsNativeRuntime(
       `pi-subagents protected mode requires ${PI_SUBAGENTS_COMPAT_RANGE}; found ${String(packageJson.version)}`,
     );
   }
-  if (packageJson.exports?.["./capability-ceiling"] !== "./src/api/capability-ceiling.ts") {
-    throw new Error(
-      "pi-subagents compatibility failure: capability-ceiling export changed",
-    );
-  }
+  const extension = resolvePiSubagentsModuleExtension(packageJson.exports);
 
   const jiti = createJiti(import.meta.url, {
     interopDefault: false,
     fsCache: false,
   });
+  const internal = (relative: string): string =>
+    pathToFileURL(join(root, piSubagentsInternalModulePath(relative, extension))).href;
   const [ceiling, discovery, config] = await Promise.all([
-    jiti.import(pathToFileURL(join(root, "src/api/capability-ceiling.ts")).href) as Promise<CeilingModule>,
-    jiti.import(pathToFileURL(join(root, "src/agents/agents.ts")).href) as Promise<DiscoveryModule>,
-    jiti.import(pathToFileURL(join(root, "src/extension/config.ts")).href) as Promise<ConfigModule>,
+    jiti.import(internal("src/api/capability-ceiling")) as Promise<CeilingModule>,
+    jiti.import(internal("src/agents/agents")) as Promise<DiscoveryModule>,
+    jiti.import(internal("src/extension/config")) as Promise<ConfigModule>,
   ]).catch((error) => {
     throw new Error(
       `pi-subagents compatibility failure: ${error instanceof Error ? error.message : String(error)}`,