@erichll/pi-sandbox 0.21.0 → 0.22.0

package/CHANGELOG.md

@@ -1,5 +1,46 @@
 # Changelog
 
+## 0.22.0 - 2026-09-30
+
+- Raise the `@earendil-works/pi-coding-agent` peer floor to `^0.99.1` and the
+  development baseline to `^0.99.1`. Validated against Pi 0.99.1 with
+  `tsc --noEmit` and the test suite (92 pass, 1 macOS-only skip); the shipped
+  `src/` uses no API that changed between 0.87 and 0.99.
+- Adapt two test fixtures to the 0.99 extension surface: `ToolInfo` now requires
+  `exposure`, and tool handlers receive `ExtensionToolContext` (`tools`,
+  `executeTool`). The shipped extension uses neither field, so runtime behavior
+  is unchanged.
+- Raise the `pi-subagents` development dependency to `^0.72.1` and revalidate
+  the native-background loader against the published 0.72.1 package:
+  `discoverAgents` and `resolveAgentName` keep their signatures,
+  `src/agents/agents` only gains an optional `options.globalNpmRoot` argument,
+  `typebox` moved from a hard dependency to an optional host peer, and the
+  `./capability-ceiling` export still resolves to `.js`.
+- Depend on `@erichll/pi-auto-review` `^0.22.0`.
+- Document the three-way `subagents.provider` choice (`builtin` / `off` /
+  `pi-subagents`) with copy-ready example configs, including the duplicate
+  `subagent` tool that makes `builtin` unavailable whenever the pi-subagents
+  extension is loaded, and the scheduled-runs-disabled pi-subagents config that
+  protected mode requires.
+- Bump the development `typescript` baseline to `^7.0.2`.
+
+## 0.21.1 - 2026-09-26
+
+- Alias `@earendil-works/pi-tui` for the `jiti` instance that loads the
+  `pi-subagents` internals. `pi-subagents` imports that host peer from its
+  internal modules but does not ship it, and Pi's own extension loader aliases
+  it to the copy inside the running Pi package. The protected-mode loader
+  created its own `jiti` instance without that alias, so installs where the peer
+  is not hoisted next to the extension (for example the global
+  `~/.pi/agent/npm` tree) failed to load as soon as `subagents.provider` was
+  `pi-subagents` with `pi-subagents compatibility failure: Cannot find module
+  '@earendil-works/pi-tui'`. The alias is computed host-first from the running Pi
+  package (`process.argv[1]`, `PI_PACKAGE_DIR`) and falls back to plain
+  resolution from the extension tree; an unresolvable host peer still fails
+  closed with that explicit error.
+- Add regression coverage for host alias resolution, including a `jiti` load in
+  a tree where `@earendil-works/pi-tui` is unreachable without the alias.
+
 ## 0.21.0 - 2026-09-25
 
 - Support project-level configuration at `.pi/extensions/pi-sandbox/config.json`.

package/README.md

@@ -92,9 +92,12 @@ Supported modes:
 ### `pi-subagents` native-background tool boundary
 
 This provider supports the `pi-subagents >=0.66.0` line (validated through
-0.71.0) and fails closed if its public ceiling API, module layout, or internal
+0.72.1) and fails closed if its public ceiling API, module layout, or internal
 discovery layout drifts. The peer dependency is a floor with no upper pin; the
-loader's explicit export and layout checks are the real gate.
+loader's explicit export and layout checks are the real gate. The loader also
+aliases `@earendil-works/pi-tui`, a host peer that the `pi-subagents` internals
+import but do not ship, to the copy inside the running Pi package, so installs
+where it is not hoisted next to the extension still load.
 Configure both the protection mode and a non-empty canonical whitelist:
 
 ```json
@@ -293,7 +296,7 @@ directory. It never reads or updates production Pi configuration. Model-backed
 acceptance requires `PI_SUBAGENTS_GATE_MODEL` and an already-exported matching
 credential; missing prerequisites are reported as `SKIP`. Protected mode with
 pi-subagents 0.68.0 or newer needs Pi 0.86.0 or newer. The development
-baseline is validated against Pi 0.87.1.
+baseline is validated against Pi 0.99.1.
 
 The test suite covers real Linux Sandbox Runtime enforcement when its native
 dependencies are installed, plus deterministic broker, network approval,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@erichll/pi-sandbox",
-  "version": "0.21.0",
+  "version": "0.22.0",
   "description": "Linux (bubblewrap) and macOS (Seatbelt) process sandbox for Pi backed by Anthropic's @anthropic-ai/sandbox-runtime. Fail-closed static filesystem policy plus per-connection network approval from pi-auto-review; sandboxes main-agent Bash and built-in subagent process trees.",
   "type": "module",
   "license": "Apache-2.0",
@@ -51,11 +51,11 @@
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "^0.0.77",
-    "@erichll/pi-auto-review": "^0.21.0",
+    "@erichll/pi-auto-review": "^0.22.0",
     "jiti": "2.7.0"
   },
   "peerDependencies": {
-    "@earendil-works/pi-coding-agent": "^0.87.1",
+    "@earendil-works/pi-coding-agent": "^0.99.1",
     "pi-subagents": ">=0.66.0",
     "typebox": ">=1.0.0"
   },
@@ -65,12 +65,12 @@
     }
   },
   "devDependencies": {
-    "@earendil-works/pi-ai": "^0.87.1",
-    "@earendil-works/pi-coding-agent": "^0.87.1",
-    "@earendil-works/pi-server": "^0.87.1",
+    "@earendil-works/pi-ai": "^0.99.1",
+    "@earendil-works/pi-coding-agent": "^0.99.1",
+    "@earendil-works/pi-server": "^0.99.1",
     "@types/node": "^26.6.2",
-    "pi-subagents": "^0.71.0",
+    "pi-subagents": "^0.72.1",
     "typebox": "^1.3.34",
-    "typescript": "^6.0.3"
+    "typescript": "^7.0.2"
   }
 }

package/src/pi-subagents-native.ts

@@ -1,4 +1,5 @@
-import { readFile } from "node:fs/promises";
+import { readFile, realpath } from "node:fs/promises";
+import { createRequire } from "node:module";
 import { dirname, join } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { createJiti } from "jiti";
@@ -15,15 +16,25 @@ import { createJiti } from "jiti";
  * 2026-09-23 against the published 0.71.0 package: the ceiling implementation
  * and the config loader are byte-identical to 0.70.0, `discoverAgents` and
  * `resolveAgentName` keep their signatures, and the `./capability-ceiling`
- * export still resolves to `.js`). Protected mode needs Pi 0.86.0 or newer
+ * export still resolves to `.js`), and revalidated 2026-09-27 against the
+ * published 0.72.1 package: the ceiling implementation and the config loader
+ * are still byte-identical to 0.70.0, `discoverAgents` and `resolveAgentName`
+ * keep their signatures, `src/agents/agents` only gains an optional
+ * `options.globalNpmRoot` argument, `typebox` moved from a hard dependency to
+ * an optional host peer, and the `./capability-ceiling` export still resolves
+ * to `.js`). Protected mode needs Pi 0.86.0 or newer
  * (the pi-subagents 0.68.0+ floor): 0.85.0 does not ship
  * `@earendil-works/pi-server`, so background children fail to launch there.
- * This package's own peer floor is Pi 0.87.1 (validated 2026-09-23).
+ * This package's own peer floor is Pi 0.99.1 (validated 2026-09-30).
  */
 export const PI_SUBAGENTS_COMPAT_RANGE = ">=0.66.0";
 export const NATIVE_CHILD_TOOLS = ["bash", "read", "grep", "find", "ls"] as const;
 export const PI_SANDBOX_ACKNOWLEDGEMENT = "@erichll:pi-sandbox";
 
+const HOST_PI_PACKAGE = "@earendil-works/pi-coding-agent";
+/** Host peer that pi-subagents' internal modules import but that is not installed next to it. */
+const HOST_PI_TUI_PACKAGE = "@earendil-works/pi-tui";
+
 /**
  * Module extension of the installed pi-subagents layout. Source checkouts (and
  * the 0.66.0-0.69.0 npm line) ship `.ts` modules that need a TypeScript loader;
@@ -142,6 +153,89 @@ export function piSubagentsInternalModulePath(
   return `${relativePath.replace(/\.(?:ts|js)$/u, "")}${extension}`;
 }
 
+async function readPackageName(dir: string): Promise<string | undefined> {
+  try {
+    const manifest = JSON.parse(
+      await readFile(join(dir, "package.json"), "utf8"),
+    ) as { name?: unknown };
+    return typeof manifest?.name === "string" ? manifest.name : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * Walk up from a Pi entry script (or a Pi package directory) to the running
+ * `@earendil-works/pi-coding-agent` root. Returns undefined for launchers whose
+ * entry is not a real file (compiled binaries, embedded SDK hosts).
+ */
+export async function findPiPackageRootFromEntry(
+  entryPath: string,
+): Promise<string | undefined> {
+  let dir = entryPath;
+  for (;;) {
+    if ((await readPackageName(dir)) === HOST_PI_PACKAGE) return dir;
+    const parent = dirname(dir);
+    if (parent === dir) return undefined;
+    dir = parent;
+  }
+}
+
+function resolveFrom(base: string, specifier: string): string | undefined {
+  try {
+    return createRequire(base).resolve(specifier);
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * Alias map for the jiti instance that loads pi-subagents internals.
+ *
+ * pi-subagents imports `@earendil-works/pi-tui` from its internal modules but,
+ * as a peer dependency, does not ship it. Pi's own extension loader aliases that
+ * specifier to the copy inside the running Pi package (`getAliases()` in the
+ * host loader), so extensions loaded by Pi resolve it; our jiti instance is a
+ * separate resolver and would otherwise fall back to plain Node resolution,
+ * which fails for installs where pi-tui is neither hoisted next to the
+ * extension nor installed beside `@earendil-works/pi-subagents`.
+ *
+ * The alias is computed host-first so the loaded modules share the host's
+ * pi-tui instance, and degrades to an empty map when no copy is reachable: the
+ * hard failure then stays the explicit compatibility error raised on load.
+ */
+export async function resolvePiSubagentsHostAliases(
+  options: { entry?: string; moduleUrl?: string; env?: Record<string, string | undefined> } = {},
+): Promise<Record<string, string>> {
+  const bases: string[] = [];
+  const entry = options.entry ?? process.argv[1];
+  if (entry) {
+    const realEntry = await realpath(entry).catch(() => undefined);
+    const root = realEntry
+      ? await findPiPackageRootFromEntry(realEntry)
+      : undefined;
+    if (root) bases.push(join(root, "package.json"));
+  }
+  const packageDir = (options.env ?? process.env).PI_PACKAGE_DIR?.trim();
+  if (packageDir && (await readPackageName(packageDir)) === HOST_PI_PACKAGE) {
+    bases.push(join(packageDir, "package.json"));
+  }
+  // Extension-local resolution: the development checkout and installs that
+  // provide pi-tui beside the extension or beside pi-subagents.
+  bases.push(options.moduleUrl ?? import.meta.url);
+
+  const seen = new Set<string>();
+  for (const base of bases) {
+    if (seen.has(base)) continue;
+    seen.add(base);
+    const resolved = resolveFrom(base, HOST_PI_TUI_PACKAGE);
+    if (!resolved) continue;
+    const target = await realpath(resolved).catch(() => resolved);
+    return { [HOST_PI_TUI_PACKAGE]: target };
+  }
+  return {};
+}
+
 /** Load the public ceiling API and the discovery/config internals.
  * This intentionally fails closed on package version, export, or layout drift.
  */
@@ -163,6 +257,7 @@ export async function loadPiSubagentsNativeRuntime(
   const jiti = createJiti(import.meta.url, {
     interopDefault: false,
     fsCache: false,
+    alias: await resolvePiSubagentsHostAliases(),
   });
   const internal = (relative: string): string =>
     pathToFileURL(join(root, piSubagentsInternalModulePath(relative, extension))).href;