@erichll/pi-sandbox 0.21.1 → 0.22.1

package/CHANGELOG.md

@@ -1,5 +1,51 @@
 # Changelog
 
+## 0.22.1 - 2026-10-01
+
+- Fix sandboxed Bash on Bun-compiled Pi: launching the Sandbox Runtime broker
+  could instead start another unsandboxed Pi session with the broker path as
+  its prompt, leaving the requested command unexecuted
+  ([#7](https://github.com/erichll/pi-packages/issues/7)). The broker now runs
+  through a separate Node executable and communicates over JSON IPC.
+- **Bun-compiled Pi requires Node.js >=22.19.0 on PATH**, with its directory
+  listed as an absolute path. If Node cannot be found, commands fail explicitly
+  before execution. Aliases back to the Pi executable are rejected.
+- Fix built-in subagent startup for standalone Pi and resolve the host CLI
+  symlink for Node-based Pi. Derive filesystem permissions from the actual
+  runtime so a binary such as `/tmp/pi-bun` does not grant root reads or deny
+  writes to the entire host temp directory.
+- Fix protected `pi-subagents` loading on Bun when `pi-tui` and `typebox` are
+  provided by Pi. Reuse the host modules in the internal loader so compiled
+  Pi does not need separate copies beside the extension.
+- Clean up command temp directories when broker startup fails. Add isolated
+  Node, plain Bun, and compiled Bun regression tests for broker startup,
+  capability-ceiling registration, and rejection of enabled schedules.
+- Require `@erichll/pi-auto-review` `^0.22.1` to include the Bun SQLite audit fix.
+
+## 0.22.0 - 2026-09-30
+
+- Raise the `@earendil-works/pi-coding-agent` peer floor to `^0.99.1` and the
+  development baseline to `^0.99.1`. Validated against Pi 0.99.1 with
+  `tsc --noEmit` and the test suite (92 pass, 1 macOS-only skip); the shipped
+  `src/` uses no API that changed between 0.87 and 0.99.
+- Adapt two test fixtures to the 0.99 extension surface: `ToolInfo` now requires
+  `exposure`, and tool handlers receive `ExtensionToolContext` (`tools`,
+  `executeTool`). The shipped extension uses neither field, so runtime behavior
+  is unchanged.
+- Raise the `pi-subagents` development dependency to `^0.72.1` and revalidate
+  the native-background loader against the published 0.72.1 package:
+  `discoverAgents` and `resolveAgentName` keep their signatures,
+  `src/agents/agents` only gains an optional `options.globalNpmRoot` argument,
+  `typebox` moved from a hard dependency to an optional host peer, and the
+  `./capability-ceiling` export still resolves to `.js`.
+- Depend on `@erichll/pi-auto-review` `^0.22.0`.
+- Document the three-way `subagents.provider` choice (`builtin` / `off` /
+  `pi-subagents`) with copy-ready example configs, including the duplicate
+  `subagent` tool that makes `builtin` unavailable whenever the pi-subagents
+  extension is loaded, and the scheduled-runs-disabled pi-subagents config that
+  protected mode requires.
+- Bump the development `typescript` baseline to `^7.0.2`.
+
 ## 0.21.1 - 2026-09-26
 
 - Alias `@earendil-works/pi-tui` for the `jiti` instance that loads the

package/README.md

@@ -69,6 +69,12 @@ configure an AppArmor profile for bubblewrap or disable
 
 macOS uses built-in Seatbelt support but still requires `ripgrep`.
 
+For Bun-compiled standalone Pi, install **Node.js >=22.19.0** and include its
+`bin` directory as an absolute entry on `PATH`. The sandbox broker runs in that
+separate Node process; built-in subagents launch the Pi executable directly.
+If no usable `node` is found, the command fails before execution. Node-based Pi
+and ordinary `bun cli.js` launches use their existing JavaScript runtime.
+
 ## Subagent provider
 
 The provider is selected from the configuration (`~/.pi/agent/extensions/pi-sandbox/config.json` globally or `.pi/extensions/pi-sandbox/config.json` project-locally):
@@ -92,12 +98,13 @@ Supported modes:
 ### `pi-subagents` native-background tool boundary
 
 This provider supports the `pi-subagents >=0.66.0` line (validated through
-0.71.0) and fails closed if its public ceiling API, module layout, or internal
+0.72.1) and fails closed if its public ceiling API, module layout, or internal
 discovery layout drifts. The peer dependency is a floor with no upper pin; the
-loader's explicit export and layout checks are the real gate. The loader also
-aliases `@earendil-works/pi-tui`, a host peer that the `pi-subagents` internals
-import but do not ship, to the copy inside the running Pi package, so installs
-where it is not hoisted next to the extension still load.
+loader's explicit export and layout checks are the real gate. On Node, the
+loader aliases the `@earendil-works/pi-tui` host peer to the running Pi package.
+On Bun, including compiled Pi, it passes Pi's `pi-tui` and `typebox` module
+objects into its internal loader, so those peers can be embedded in Pi instead
+of installed beside `pi-subagents`.
 Configure both the protection mode and a non-empty canonical whitelist:
 
 ```json
@@ -296,7 +303,7 @@ directory. It never reads or updates production Pi configuration. Model-backed
 acceptance requires `PI_SUBAGENTS_GATE_MODEL` and an already-exported matching
 credential; missing prerequisites are reported as `SKIP`. Protected mode with
 pi-subagents 0.68.0 or newer needs Pi 0.86.0 or newer. The development
-baseline is validated against Pi 0.87.1.
+baseline is validated against Pi 0.99.1.
 
 The test suite covers real Linux Sandbox Runtime enforcement when its native
 dependencies are installed, plus deterministic broker, network approval,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@erichll/pi-sandbox",
-  "version": "0.21.1",
+  "version": "0.22.1",
   "description": "Linux (bubblewrap) and macOS (Seatbelt) process sandbox for Pi backed by Anthropic's @anthropic-ai/sandbox-runtime. Fail-closed static filesystem policy plus per-connection network approval from pi-auto-review; sandboxes main-agent Bash and built-in subagent process trees.",
   "type": "module",
   "license": "Apache-2.0",
@@ -51,11 +51,11 @@
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "^0.0.77",
-    "@erichll/pi-auto-review": "^0.21.0",
+    "@erichll/pi-auto-review": "^0.22.1",
     "jiti": "2.7.0"
   },
   "peerDependencies": {
-    "@earendil-works/pi-coding-agent": "^0.87.1",
+    "@earendil-works/pi-coding-agent": "^0.99.1",
     "pi-subagents": ">=0.66.0",
     "typebox": ">=1.0.0"
   },
@@ -65,12 +65,12 @@
     }
   },
   "devDependencies": {
-    "@earendil-works/pi-ai": "^0.87.1",
-    "@earendil-works/pi-coding-agent": "^0.87.1",
-    "@earendil-works/pi-server": "^0.87.1",
+    "@earendil-works/pi-ai": "^0.99.1",
+    "@earendil-works/pi-coding-agent": "^0.99.1",
+    "@earendil-works/pi-server": "^0.99.1",
     "@types/node": "^26.6.2",
-    "pi-subagents": "^0.71.0",
+    "pi-subagents": "^0.72.1",
     "typebox": "^1.3.34",
-    "typescript": "^6.0.3"
+    "typescript": "^7.0.2"
   }
 }

package/src/pi-subagents-native.ts

@@ -3,6 +3,8 @@ import { createRequire } from "node:module";
 import { dirname, join } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { createJiti } from "jiti";
+import * as hostPiTui from "@earendil-works/pi-tui";
+import * as hostTypebox from "typebox";
 
 /**
  * Compatible pi-subagents line: 0.66.0 and above (no upper pin). Any new minor
@@ -16,10 +18,16 @@ import { createJiti } from "jiti";
  * 2026-09-23 against the published 0.71.0 package: the ceiling implementation
  * and the config loader are byte-identical to 0.70.0, `discoverAgents` and
  * `resolveAgentName` keep their signatures, and the `./capability-ceiling`
- * export still resolves to `.js`). Protected mode needs Pi 0.86.0 or newer
+ * export still resolves to `.js`), and revalidated 2026-09-27 against the
+ * published 0.72.1 package: the ceiling implementation and the config loader
+ * are still byte-identical to 0.70.0, `discoverAgents` and `resolveAgentName`
+ * keep their signatures, `src/agents/agents` only gains an optional
+ * `options.globalNpmRoot` argument, `typebox` moved from a hard dependency to
+ * an optional host peer, and the `./capability-ceiling` export still resolves
+ * to `.js`). Protected mode needs Pi 0.86.0 or newer
  * (the pi-subagents 0.68.0+ floor): 0.85.0 does not ship
  * `@earendil-works/pi-server`, so background children fail to launch there.
- * This package's own peer floor is Pi 0.87.1 (validated 2026-09-23).
+ * This package's own peer floor is Pi 0.99.1 (validated 2026-09-30).
  */
 export const PI_SUBAGENTS_COMPAT_RANGE = ">=0.66.0";
 export const NATIVE_CHILD_TOOLS = ["bash", "read", "grep", "find", "ls"] as const;
@@ -248,10 +256,23 @@ export async function loadPiSubagentsNativeRuntime(
   }
   const extension = resolvePiSubagentsModuleExtension(packageJson.exports);
 
+  // Pi's outer extension loader supplies these host modules, including embedded
+  // copies in compiled Bun builds. Static imports above keep host resolution in
+  // that outer loader even under plain `bun cli.js`. Filesystem aliases cannot
+  // locate modules that only exist inside Pi.
+  const resolutionOptions = process.versions.bun
+    ? {
+        tryNative: false,
+        virtualModules: {
+          [HOST_PI_TUI_PACKAGE]: hostPiTui,
+          typebox: hostTypebox,
+        },
+      }
+    : { alias: await resolvePiSubagentsHostAliases() };
   const jiti = createJiti(import.meta.url, {
     interopDefault: false,
     fsCache: false,
-    alias: await resolvePiSubagentsHostAliases(),
+    ...resolutionOptions,
   });
   const internal = (relative: string): string =>
     pathToFileURL(join(root, piSubagentsInternalModulePath(relative, extension))).href;

package/src/policy.ts

@@ -10,13 +10,13 @@ import {
 } from "node:path";
 import { fileURLToPath } from "node:url";
 import type { SandboxRuntimeConfig } from "@anthropic-ai/sandbox-runtime";
+import { runtimeFilesystemPaths } from "./runtime.ts";
 import {
   PROJECT_PI_SANDBOX_CONFIG_PATH,
   type NetworkConfig,
 } from "./config.ts";
 
 const PACKAGE_ROOT = dirname(dirname(fileURLToPath(import.meta.url)));
-const NODE_INSTALL_ROOT = dirname(dirname(process.execPath));
 const SANDBOX_RUNTIME_ROOT = dirname(
   dirname(
     fileURLToPath(import.meta.resolve("@anthropic-ai/sandbox-runtime")),
@@ -231,6 +231,7 @@ export function createDefaultPolicy(
 ): SandboxPolicy {
   const workspace = resolve(cwd);
   const home = resolve(homedir());
+  const runtimePaths = runtimeFilesystemPaths();
   const denyRead = home === parse(home).root ? [] : [home];
   const packageRelative = relative(workspace, PACKAGE_ROOT);
   const packageIsInWorkspace =
@@ -241,7 +242,7 @@ export function createDefaultPolicy(
       denyRead,
       allowRead: [
         workspace,
-        NODE_INSTALL_ROOT,
+        ...runtimePaths.allowRead,
         SANDBOX_RUNTIME_ROOT,
         join(home, ".gitconfig"),
         join(home, ".config", "git", "config"),
@@ -265,7 +266,7 @@ export function createDefaultPolicy(
           "config.json",
         ),
         ...(packageIsInWorkspace ? [] : [PACKAGE_ROOT]),
-        dirname(process.execPath),
+        ...runtimePaths.denyWrite,
         ...createWorkspaceSecretDenyWritePaths(workspace),
       ],
     },

package/src/runner.ts

@@ -11,6 +11,7 @@ import type { Writable } from "node:stream";
 import { getShellConfig } from "@earendil-works/pi-coding-agent";
 import type { SandboxRuntimeConfig } from "@anthropic-ai/sandbox-runtime";
 import type { NetworkEndpoint } from "./approval.ts";
+import { resolveBrokerExecPath } from "./runtime.ts";
 import {
   createDefaultPolicy,
   toSandboxRuntimeConfig,
@@ -173,7 +174,10 @@ function spawnBroker(
     cwd: options.cwd,
     detached: true,
     env,
+    execPath: resolveBrokerExecPath(env),
     execArgv: broker.execArgv ?? [],
+    // Bun's default IPC serialization is incompatible with a Node child.
+    serialization: "json",
     stdio: ["pipe", "pipe", "pipe", "ipc"],
   };
   return fork(broker.modulePath, [], forkOptions);
@@ -206,12 +210,14 @@ export async function runSandboxedCommand(
       [SANDBOX_RUNTIME_TMPDIR_ENV]: tempDir,
     };
   }
-  const broker = spawnBroker(options, brokerEnv);
+  let broker: ChildProcess | undefined;
   let timeoutHandle: NodeJS.Timeout | undefined;
   let timedOut = false;
   let onAbort: (() => void) | undefined;
 
   try {
+    broker = spawnBroker(options, brokerEnv);
+    const child = broker;
     broker.stdout?.on("data", (data: Buffer) => {
       options.onData(data);
       options.onStdout?.(data);
@@ -222,7 +228,7 @@ export async function runSandboxedCommand(
     });
     broker.on("message", (message: unknown) => {
       if (!isNetworkRequest(message)) return;
-      void answerNetworkRequest(broker, message, options);
+      void answerNetworkRequest(child, message, options);
     });
 
     const init: BrokerInitMessage = {
@@ -242,18 +248,18 @@ export async function runSandboxedCommand(
       broker.stdin?.end();
     }
 
-    onAbort = () => killProcessTree(broker);
+    onAbort = () => killProcessTree(child);
     options.signal?.addEventListener("abort", onAbort, { once: true });
     if (options.timeout !== undefined && options.timeout > 0) {
       timeoutHandle = setTimeout(() => {
         timedOut = true;
-        killProcessTree(broker);
+        killProcessTree(child);
       }, options.timeout * 1_000);
     }
 
     const exitCode = await new Promise<number | null>((resolve, reject) => {
-      broker.once("error", reject);
-      broker.once("exit", resolve);
+      child.once("error", reject);
+      child.once("exit", resolve);
     });
     if (options.signal?.aborted) throw new Error("aborted");
     if (timedOut) throw new Error(`timeout:${options.timeout}`);
@@ -261,7 +267,7 @@ export async function runSandboxedCommand(
   } finally {
     if (timeoutHandle) clearTimeout(timeoutHandle);
     if (onAbort) options.signal?.removeEventListener("abort", onAbort);
-    if (broker.exitCode === null && broker.signalCode === null) {
+    if (broker && broker.exitCode === null && broker.signalCode === null) {
       killProcessTree(broker);
     }
     if (tempDir) {

package/src/runtime.ts

@@ -0,0 +1,79 @@
+import { accessSync, constants, realpathSync, statSync } from "node:fs";
+import { homedir } from "node:os";
+import { basename, delimiter, dirname, isAbsolute, join, parse } from "node:path";
+
+export type RuntimeProcess = {
+  execPath: string;
+  argv: readonly string[];
+  versions: Readonly<Record<string, string | undefined>>;
+  features?: { sea?: boolean; inspector?: boolean };
+};
+
+/** The extension's own import.meta.url is on disk even inside compiled Pi. */
+export function isStandaloneExecutable(host: RuntimeProcess = process): boolean {
+  return host.features?.sea === true || (
+    !!host.versions.bun &&
+    /(?:\$bunfs|~BUN|%7EBUN)/i.test(host.argv[1] ?? "")
+  );
+}
+
+/** fork() must execute a JS runtime, never a compiled Pi application image. */
+export function resolveBrokerExecPath(
+  env: NodeJS.ProcessEnv = process.env,
+  host: RuntimeProcess = process,
+): string {
+  if (!isStandaloneExecutable(host)) return host.execPath;
+
+  for (const directory of (env.PATH ?? "").split(delimiter)) {
+    // Do not discover executable code in the command's working directory.
+    if (!isAbsolute(directory)) continue;
+    try {
+      const candidate = realpathSync(join(directory, "node"));
+      accessSync(candidate, constants.X_OK);
+      const candidateStat = statSync(candidate);
+      const hostStat = statSync(host.execPath);
+      if (!candidateStat.isFile()) continue;
+      // Also reject symlinks/hard links from `node` back to the Pi binary.
+      if (candidateStat.dev === hostStat.dev && candidateStat.ino === hostStat.ino) continue;
+      return candidate;
+    } catch {
+      // Try the next absolute PATH entry.
+    }
+  }
+  throw new Error(
+    "pi-sandbox: standalone Pi requires Node.js >=22.19.0 on PATH to run the Sandbox Runtime broker; no usable node executable was found",
+  );
+}
+
+function runtimeReadPath(execPath: string): string {
+  const bin = dirname(execPath);
+  const root = dirname(bin);
+  // Node installations under nvm/Nix need their libraries as well as bin/node.
+  // Arbitrarily placed executables must not grant a whole home directory or /.
+  return basename(bin) === "bin" && root !== parse(root).root && root !== homedir()
+    ? root
+    : execPath;
+}
+
+function runtimeWritePath(execPath: string): string {
+  const directory = dirname(execPath);
+  return basename(directory) === "bin" ? directory : execPath;
+}
+
+export function runtimeFilesystemPaths(
+  env: NodeJS.ProcessEnv = process.env,
+  host: RuntimeProcess = process,
+): { allowRead: string[]; denyWrite: string[] } {
+  const brokerExecPath = resolveBrokerExecPath(env, host);
+  const standalone = isStandaloneExecutable(host);
+  return {
+    allowRead: [...new Set([
+      standalone ? host.execPath : runtimeReadPath(host.execPath),
+      runtimeReadPath(brokerExecPath),
+    ])],
+    denyWrite: [...new Set([
+      standalone ? host.execPath : runtimeWritePath(host.execPath),
+      runtimeWritePath(brokerExecPath),
+    ])],
+  };
+}

package/src/subagent.ts

@@ -1,8 +1,10 @@
 import { randomUUID } from "node:crypto";
+import { realpathSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import type { Writable } from "node:stream";
 import type { NetworkEndpoint } from "./approval.ts";
+import { isStandaloneExecutable, type RuntimeProcess } from "./runtime.ts";
 import {
   runSandboxedCommand,
   type SandboxCommandOptions,
@@ -201,19 +203,30 @@ export function validateSubagentModel(
   };
 }
 
-export function resolvePiInvocation(): ProcessInvocation {
-  const currentEntry = process.argv[1];
+export function resolvePiInvocation(host: RuntimeProcess = process): ProcessInvocation {
+  if (isStandaloneExecutable(host)) {
+    return { command: host.execPath, args: [] };
+  }
+  let currentEntry = host.argv[1];
+  if (currentEntry) {
+    try {
+      // npm's `pi` executable is usually a symlink to the host's cli.js.
+      currentEntry = realpathSync(currentEntry);
+    } catch {
+      // Preserve source/virtual entries that cannot be canonicalized.
+    }
+  }
   if (
     currentEntry &&
     /(?:^|[/\\])cli\.(?:js|mjs|cjs|ts)$/.test(currentEntry)
   ) {
-    return { command: process.execPath, args: [currentEntry] };
+    return { command: host.execPath, args: [currentEntry] };
   }
   const packageEntry = fileURLToPath(
     import.meta.resolve("@earendil-works/pi-coding-agent"),
   );
   return {
-    command: process.execPath,
+    command: host.execPath,
     args: [join(dirname(packageEntry), "cli.js")],
   };
 }