@erichll/pi-sandbox 0.24.0 → 0.26.0

package/CHANGELOG.md

@@ -1,5 +1,38 @@
 # Changelog
 
+## 0.26.0 - 2026-10-08
+
+- Require `@erichll/pi-auto-review ^0.26.0` so sandbox approvals use the
+  coordinated Pi 1.1.0 reviewer and cancellation fixes.
+- Upgrade Pi development dependencies and the coding-agent peer floor to
+  `^1.1.0`; move pi-subagents to development `^0.76.1` / peer `>=0.76.1` and
+  typebox to development `^1.3.36` / peer `>=1.3.36`. Keep pi-subagents optional
+  and leave the sandbox-runtime and jiti dependency declarations unchanged.
+- Revalidate the deterministic 0.76.1 compatibility gate and isolated Node,
+  Bun, and compiled-Bun host-peer loading on Pi 1.1.0. Fix the copied-package
+  test for dependencies that do not export package.json, including the new
+  Temporal polyfill. Revalidate model-backed acceptance with the native host
+  read baseline and the protected child blocking that read, including the
+  required sandbox runtime acknowledgement.
+- Reject settlement waiters for RPC runs cancelled with Pi 1.1.0
+  `agent_settled.aborted: true`
+  ([#10607](https://github.com/earendil-works/pi/issues/10607)), including
+  waiters registered after the event or after subsequent successful runs.
+  Keep the persistent child idle and available for follow-up instead of
+  reporting a successful result or terminating the session. Legacy events
+  without the field retain their existing behavior.
+- Ignore buffered lifecycle events after an RPC session stops or fails so
+  cancellation and shutdown cannot resurrect a terminal session.
+
+## 0.25.0 - 2026-10-07
+
+- Align the `@erichll/pi-auto-review` dependency with `^0.25.0` so the
+  workspace and sandbox use the same broker implementation and include the
+  permission-system 40.0.2 integration baseline.
+- Revalidate the deterministic and model-backed pi-subagents 0.75.0 gate:
+  the native baseline reads the host probe, while the protected native
+  background child blocks that read and acknowledges the sandbox extension.
+
 ## 0.24.0 - 2026-10-03
 
 - Raise the `@earendil-works/pi-coding-agent` peer floor to `^1.0.0` and the

package/README.md

@@ -91,14 +91,14 @@ Supported modes:
 
 - `builtin` (default): register the process-backed `subagent` tool and sandbox
   each complete worker process tree.
-- `pi-subagents`: let `pi-subagents >=0.66.0` own orchestration under the required
+- `pi-subagents`: let `pi-subagents >=0.76.1` own orchestration under the required
   native-background tool boundary described below.
 - `off`: protect Bash only.
 
 ### `pi-subagents` native-background tool boundary
 
-This provider supports the `pi-subagents >=0.66.0` line (validated through
-0.75.0) and fails closed if its public ceiling API, module layout, or internal
+This provider requires `pi-subagents >=0.76.1` (deterministically validated on
+0.76.1) and fails closed if its public ceiling API, module layout, or internal
 discovery layout drifts. The peer dependency is a floor with no upper pin; the
 loader's explicit export and layout checks are the real gate. On Node, the
 loader aliases the `@earendil-works/pi-tui` host peer to the running Pi package.
@@ -342,9 +342,10 @@ discovery behavior,
 capability ceiling, and protected launch policy in an isolated temporary agent
 directory. It never reads or updates production Pi configuration. Model-backed
 acceptance requires `PI_SUBAGENTS_GATE_MODEL` and an already-exported matching
-credential; missing prerequisites are reported as `SKIP`. Protected mode with
-pi-subagents 0.68.0 or newer needs Pi 0.86.0 or newer. The development
-baseline is validated against Pi 1.0.0.
+credential; missing prerequisites are reported as `SKIP`. The current peer
+floor and development baseline are Pi 1.1.0, with pi-subagents 0.76.1 and
+`typebox >=1.3.36`. The deterministic and model-backed native-baseline /
+protected-child gates pass on this baseline.
 
 The test suite covers real Linux Sandbox Runtime enforcement when its native
 dependencies are installed, plus deterministic broker, network approval,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@erichll/pi-sandbox",
-  "version": "0.24.0",
+  "version": "0.26.0",
   "description": "Linux (bubblewrap) and macOS (Seatbelt) process sandbox for Pi backed by Anthropic's @anthropic-ai/sandbox-runtime. Fail-closed static filesystem policy plus per-connection network approval from pi-auto-review; sandboxes main-agent Bash and built-in subagent process trees.",
   "type": "module",
   "license": "Apache-2.0",
@@ -51,13 +51,13 @@
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "^0.0.78",
-    "@erichll/pi-auto-review": "^0.24.0",
+    "@erichll/pi-auto-review": "^0.26.0",
     "jiti": "2.7.0"
   },
   "peerDependencies": {
-    "@earendil-works/pi-coding-agent": "^1.0.0",
-    "pi-subagents": ">=0.66.0",
-    "typebox": ">=1.0.0"
+    "@earendil-works/pi-coding-agent": "^1.1.0",
+    "pi-subagents": ">=0.76.1",
+    "typebox": ">=1.3.36"
   },
   "peerDependenciesMeta": {
     "pi-subagents": {
@@ -65,12 +65,12 @@
     }
   },
   "devDependencies": {
-    "@earendil-works/pi-ai": "^1.0.0",
-    "@earendil-works/pi-coding-agent": "^1.0.0",
-    "@earendil-works/pi-server": "^1.0.0",
+    "@earendil-works/pi-ai": "^1.1.0",
+    "@earendil-works/pi-coding-agent": "^1.1.0",
+    "@earendil-works/pi-server": "^1.1.0",
     "@types/node": "^26.6.4",
-    "pi-subagents": "^0.75.0",
-    "typebox": "^1.3.34",
+    "pi-subagents": "^0.76.1",
+    "typebox": "^1.3.36",
     "typescript": "^7.0.2"
   }
 }

package/src/pi-subagents-native.ts

@@ -7,7 +7,8 @@ import * as hostPiTui from "@earendil-works/pi-tui";
 import * as hostTypebox from "typebox";
 
 /**
- * Compatible pi-subagents line: 0.66.0 and above (no upper pin). Any new minor
+ * Structural loader compatibility: 0.66.0 and above; the package peer floor
+ * is >=0.76.1 (no upper pin). Any new minor
  * is accepted, so the exports/ceiling checks below are the real compatibility
  * gate; this range only rejects old lines and guards against blind
  * accept-on-drift. Revalidated against 0.70.0: ceiling registry
@@ -35,7 +36,13 @@ import * as hostTypebox from "typebox";
  * mode needs Pi 0.86.0 or newer
  * (the pi-subagents 0.68.0+ floor): 0.85.0 does not ship
  * `@earendil-works/pi-server`, so background children fail to launch there.
- * This package's own peer floor is Pi 1.0.0 (validated 2026-10-02).
+ * Revalidated 2026-10-08 against 0.76.1 / Pi 1.1.0: capability-ceiling and
+ * config modules are byte-identical to 0.75.0; discovery changes add settings
+ * write leases without changing the loader seams. The deterministic gate and
+ * isolated Node/Bun/compiled-Bun host-peer tests pass. Model-backed native
+ * baseline / protected child acceptance also passes, with the host read
+ * blocked by sandboxed Bash and the runtime acknowledgement verified. This
+ * package's own peer floor is Pi 1.1.0.
  */
 export const PI_SUBAGENTS_COMPAT_RANGE = ">=0.66.0";
 export const NATIVE_CHILD_TOOLS = ["bash", "read", "grep", "find", "ls"] as const;

package/src/subagent.ts

@@ -294,6 +294,9 @@ export class ProcessBackedSubagentSession {
   private stdin: Writable | undefined;
   private rpcSequence = 0;
   private settledCount = 0;
+  // Keep cancellation tied to its run even when settlement beats the RPC
+  // response/waiter registration or later follow-ups complete successfully.
+  private readonly abortedSettlements = new Set<number>();
   private requestedSettlements = 0;
   private activePrompt:
     | {
@@ -421,6 +424,8 @@ export class ProcessBackedSubagentSession {
     if (this.stateValue === "stopped") {
       return Promise.reject(new Error(`subagent session ${this.id} is stopped`));
     }
+    const aborted = this.settlementAbortError(target);
+    if (aborted) return Promise.reject(aborted);
     if (this.settledCount >= target) {
       return Promise.resolve(sessionResult(this.textValue, this.rawOutput));
     }
@@ -531,12 +536,20 @@ export class ProcessBackedSubagentSession {
     this.startReady = undefined;
   }
 
+  private settlementAbortError(target: number): Error | undefined {
+    return this.abortedSettlements.has(target)
+      ? new Error(`subagent session ${this.id} run ${target} aborted`)
+      : undefined;
+  }
+
   private resolveSettledWaiters(): void {
     const result = sessionResult(this.textValue, this.rawOutput);
     for (const waiter of [...this.waiters]) {
       if (waiter.target <= this.settledCount) {
         waiter.cleanup();
-        waiter.resolve(result);
+        const aborted = this.settlementAbortError(waiter.target);
+        if (aborted) waiter.reject(aborted);
+        else waiter.resolve(result);
       }
     }
   }
@@ -573,6 +586,9 @@ export class ProcessBackedSubagentSession {
       pending.resolve(event as RpcResponse);
       return;
     }
+    // Buffered lifecycle records after shutdown/failure must not resurrect a
+    // terminal session or resolve a waiter already rejected by that path.
+    if (this.stateValue === "stopped" || this.stateValue === "failed") return;
     const text = rpcAssistantText(event);
     if (text) {
       this.textValue = text;
@@ -584,6 +600,9 @@ export class ProcessBackedSubagentSession {
     if (event.type === "agent_settled") {
       this.stateValue = "idle";
       this.settledCount++;
+      // Pi 1.1.0 distinguishes an aborted run from a completed one. The child
+      // process is still alive/idle; cancel its result, not the whole session.
+      if (event.aborted === true) this.abortedSettlements.add(this.settledCount);
       if (
         this.activePrompt &&
         this.activePrompt.target <= this.settledCount