@erichll/pi-sandbox 0.23.0 → 0.24.0

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # Changelog
 
+## 0.24.0 - 2026-10-03
+
+- Raise the `@earendil-works/pi-coding-agent` peer floor to `^1.0.0` and the
+  development baselines for `pi-ai`, `pi-coding-agent`, and `pi-server` to
+  `^1.0.0`, plus `@types/node` to `^26.6.4`. Validated against Pi 1.0.0 via
+  `tsc --noEmit` and the full test suite: no behavior changes were required.
+- Raise the `pi-subagents` development pin to `^0.75.0` and revalidate the
+  protected loader against it. 0.75.0 is the first release that starts
+  background children on Pi 1.0.0 again (through 0.74.0 they failed with "does
+  not provide @earendil-works/pi-agent-core/node", which pi-agent-core 1.0.0
+  dropped). The deterministic preflight passes on 0.75.0 — package exports,
+  discovery, and the capability-ceiling seams are unchanged from 0.72.1, and
+  the loader comment records the audit. The credential-backed model phases also
+  pass on 0.75.0 — native baseline (`native-host-readable`) and the protected
+  native-background whitelist (`sandboxed-bash-blocked-host-read`) — so the
+  release gate is closed for this pin.
+- Raise the `@anthropic-ai/sandbox-runtime` dependency to `^0.0.78` and the
+  `@erichll/pi-auto-review` dependency to `^0.24.0`.
+- Update the compatibility notes for pi-subagents 0.73.0, which replaced
+  `workflowScript`/`workflowScriptPath` with a single `workflow` field: the
+  loader already rejects every call that sets it (inline, path, or named), so
+  protected mode still permits direct agent launches only.
+
 ## 0.23.0 - 2026-10-02
 
 - Add opt-in `network.strictAllowlist` (default `false`) to deny unmatched

package/README.md

@@ -98,7 +98,7 @@ Supported modes:
 ### `pi-subagents` native-background tool boundary
 
 This provider supports the `pi-subagents >=0.66.0` line (validated through
-0.72.1) and fails closed if its public ceiling API, module layout, or internal
+0.75.0) and fails closed if its public ceiling API, module layout, or internal
 discovery layout drifts. The peer dependency is a floor with no upper pin; the
 loader's explicit export and layout checks are the real gate. On Node, the
 loader aliases the `@earendil-works/pi-tui` host peer to the running Pi package.
@@ -344,7 +344,7 @@ directory. It never reads or updates production Pi configuration. Model-backed
 acceptance requires `PI_SUBAGENTS_GATE_MODEL` and an already-exported matching
 credential; missing prerequisites are reported as `SKIP`. Protected mode with
 pi-subagents 0.68.0 or newer needs Pi 0.86.0 or newer. The development
-baseline is validated against Pi 0.99.1.
+baseline is validated against Pi 1.0.0.
 
 The test suite covers real Linux Sandbox Runtime enforcement when its native
 dependencies are installed, plus deterministic broker, network approval,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@erichll/pi-sandbox",
-  "version": "0.23.0",
+  "version": "0.24.0",
   "description": "Linux (bubblewrap) and macOS (Seatbelt) process sandbox for Pi backed by Anthropic's @anthropic-ai/sandbox-runtime. Fail-closed static filesystem policy plus per-connection network approval from pi-auto-review; sandboxes main-agent Bash and built-in subagent process trees.",
   "type": "module",
   "license": "Apache-2.0",
@@ -50,12 +50,12 @@
     "test": "node --experimental-strip-types --test test/*.test.ts"
   },
   "dependencies": {
-    "@anthropic-ai/sandbox-runtime": "^0.0.77",
-    "@erichll/pi-auto-review": "^0.23.0",
+    "@anthropic-ai/sandbox-runtime": "^0.0.78",
+    "@erichll/pi-auto-review": "^0.24.0",
     "jiti": "2.7.0"
   },
   "peerDependencies": {
-    "@earendil-works/pi-coding-agent": "^0.99.1",
+    "@earendil-works/pi-coding-agent": "^1.0.0",
     "pi-subagents": ">=0.66.0",
     "typebox": ">=1.0.0"
   },
@@ -65,11 +65,11 @@
     }
   },
   "devDependencies": {
-    "@earendil-works/pi-ai": "^0.99.1",
-    "@earendil-works/pi-coding-agent": "^0.99.1",
-    "@earendil-works/pi-server": "^0.99.1",
-    "@types/node": "^26.6.2",
-    "pi-subagents": "^0.72.1",
+    "@earendil-works/pi-ai": "^1.0.0",
+    "@earendil-works/pi-coding-agent": "^1.0.0",
+    "@earendil-works/pi-server": "^1.0.0",
+    "@types/node": "^26.6.4",
+    "pi-subagents": "^0.75.0",
     "typebox": "^1.3.34",
     "typescript": "^7.0.2"
   }

package/src/pi-subagents-native.ts

@@ -24,10 +24,18 @@ import * as hostTypebox from "typebox";
  * keep their signatures, `src/agents/agents` only gains an optional
  * `options.globalNpmRoot` argument, `typebox` moved from a hard dependency to
  * an optional host peer, and the `./capability-ceiling` export still resolves
- * to `.js`). Protected mode needs Pi 0.86.0 or newer
+ * to `.js`), and revalidated 2026-10-03 against the published 0.75.0 package:
+ * the capability-ceiling implementation is still byte-identical to 0.70.0 with
+ * `SUBAGENT_CAPABILITY_CEILING_VERSION` 1, the `exports` map and the
+ * dependency/peer sets are unchanged from 0.72.1, `discoverAgents` and
+ * `resolveAgentName` keep their signatures, `src/extension/config` only adds
+ * fail-closed field validation (including `scheduledRuns.enabled`), and
+ * `src/agents/agents` changes stay in settings persistence and
+ * builtin-override handling away from the seams the loader reads. Protected
+ * mode needs Pi 0.86.0 or newer
  * (the pi-subagents 0.68.0+ floor): 0.85.0 does not ship
  * `@earendil-works/pi-server`, so background children fail to launch there.
- * This package's own peer floor is Pi 0.99.1 (validated 2026-09-30).
+ * This package's own peer floor is Pi 1.0.0 (validated 2026-10-02).
  */
 export const PI_SUBAGENTS_COMPAT_RANGE = ">=0.66.0";
 export const NATIVE_CHILD_TOOLS = ["bash", "read", "grep", "find", "ls"] as const;