@erichll/pi-sandbox 0.25.0 → 0.26.1

package/CHANGELOG.md

@@ -1,5 +1,47 @@
 # Changelog
 
+## 0.26.1 - 2026-10-13
+
+- Upgrade the Pi 1.2.0 development baseline (`pi-coding-agent`, `pi-ai`,
+  typebox `>=1.3.37`) and drop the unused
+  `@earendil-works/pi-server` development dependency: nothing in this package
+  imports it and pi-subagents 0.77.0 no longer references it, while upstream
+  removed the package in 1.2.0.
+- Revalidate the compatibility gate against pi-subagents 0.78.0 on Pi 1.2.0.
+  pi-subagents 0.77.0 required chord for every host from Pi 0.85 onward,
+  which broke background children on Pi 1.2.0 (chord removed upstream);
+  0.78.0 requires chord only when the host manifest declares it, so the
+  package needs no workaround. The deterministic gate and the model-backed
+  native baseline / protected child acceptance pass. Raise the pi-subagents
+  peer floor to `>=0.78.0` because 0.77.x background children fail on
+  Pi 1.2.0; 0.78.0 also works on Pi 1.1.0.
+- Keep the pi-coding-agent peer floor at `>=1.1.0`: both 1.1.0 and 1.2.0 are
+  verified, so 1.1.0 users are not forced onto the newer Pi.
+
+## 0.26.0 - 2026-10-08
+
+- Require `@erichll/pi-auto-review ^0.26.0` so sandbox approvals use the
+  coordinated Pi 1.1.0 reviewer and cancellation fixes.
+- Upgrade Pi development dependencies and the coding-agent peer floor to
+  `^1.1.0`; move pi-subagents to development `^0.76.1` / peer `>=0.76.1` and
+  typebox to development `^1.3.36` / peer `>=1.3.36`. Keep pi-subagents optional
+  and leave the sandbox-runtime and jiti dependency declarations unchanged.
+- Revalidate the deterministic 0.76.1 compatibility gate and isolated Node,
+  Bun, and compiled-Bun host-peer loading on Pi 1.1.0. Fix the copied-package
+  test for dependencies that do not export package.json, including the new
+  Temporal polyfill. Revalidate model-backed acceptance with the native host
+  read baseline and the protected child blocking that read, including the
+  required sandbox runtime acknowledgement.
+- Reject settlement waiters for RPC runs cancelled with Pi 1.1.0
+  `agent_settled.aborted: true`
+  ([#10607](https://github.com/earendil-works/pi/issues/10607)), including
+  waiters registered after the event or after subsequent successful runs.
+  Keep the persistent child idle and available for follow-up instead of
+  reporting a successful result or terminating the session. Legacy events
+  without the field retain their existing behavior.
+- Ignore buffered lifecycle events after an RPC session stops or fails so
+  cancellation and shutdown cannot resurrect a terminal session.
+
 ## 0.25.0 - 2026-10-07
 
 - Align the `@erichll/pi-auto-review` dependency with `^0.25.0` so the

package/README.md

@@ -91,14 +91,14 @@ Supported modes:
 
 - `builtin` (default): register the process-backed `subagent` tool and sandbox
   each complete worker process tree.
-- `pi-subagents`: let `pi-subagents >=0.66.0` own orchestration under the required
+- `pi-subagents`: let `pi-subagents >=0.76.1` own orchestration under the required
   native-background tool boundary described below.
 - `off`: protect Bash only.
 
 ### `pi-subagents` native-background tool boundary
 
-This provider supports the `pi-subagents >=0.66.0` line (validated through
-0.75.0) and fails closed if its public ceiling API, module layout, or internal
+This provider requires `pi-subagents >=0.76.1` (deterministically validated on
+0.76.1) and fails closed if its public ceiling API, module layout, or internal
 discovery layout drifts. The peer dependency is a floor with no upper pin; the
 loader's explicit export and layout checks are the real gate. On Node, the
 loader aliases the `@earendil-works/pi-tui` host peer to the running Pi package.
@@ -342,9 +342,10 @@ discovery behavior,
 capability ceiling, and protected launch policy in an isolated temporary agent
 directory. It never reads or updates production Pi configuration. Model-backed
 acceptance requires `PI_SUBAGENTS_GATE_MODEL` and an already-exported matching
-credential; missing prerequisites are reported as `SKIP`. Protected mode with
-pi-subagents 0.68.0 or newer needs Pi 0.86.0 or newer. The development
-baseline is validated against Pi 1.0.0.
+credential; missing prerequisites are reported as `SKIP`. The current peer
+floor and development baseline are Pi 1.1.0, with pi-subagents 0.76.1 and
+`typebox >=1.3.36`. The deterministic and model-backed native-baseline /
+protected-child gates pass on this baseline.
 
 The test suite covers real Linux Sandbox Runtime enforcement when its native
 dependencies are installed, plus deterministic broker, network approval,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@erichll/pi-sandbox",
-  "version": "0.25.0",
+  "version": "0.26.1",
   "description": "Linux (bubblewrap) and macOS (Seatbelt) process sandbox for Pi backed by Anthropic's @anthropic-ai/sandbox-runtime. Fail-closed static filesystem policy plus per-connection network approval from pi-auto-review; sandboxes main-agent Bash and built-in subagent process trees.",
   "type": "module",
   "license": "Apache-2.0",
@@ -51,13 +51,13 @@
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "^0.0.78",
-    "@erichll/pi-auto-review": "^0.25.0",
+    "@erichll/pi-auto-review": "^0.26.0",
     "jiti": "2.7.0"
   },
   "peerDependencies": {
-    "@earendil-works/pi-coding-agent": "^1.0.0",
-    "pi-subagents": ">=0.66.0",
-    "typebox": ">=1.0.0"
+    "@earendil-works/pi-coding-agent": ">=1.1.0",
+    "pi-subagents": ">=0.78.0",
+    "typebox": ">=1.3.37"
   },
   "peerDependenciesMeta": {
     "pi-subagents": {
@@ -65,12 +65,11 @@
     }
   },
   "devDependencies": {
-    "@earendil-works/pi-ai": "^1.0.0",
-    "@earendil-works/pi-coding-agent": "^1.0.0",
-    "@earendil-works/pi-server": "^1.0.0",
-    "@types/node": "^26.6.4",
-    "pi-subagents": "^0.75.0",
-    "typebox": "^1.3.34",
+    "@earendil-works/pi-ai": "^1.2.0",
+    "@earendil-works/pi-coding-agent": "^1.2.0",
+    "@types/node": "^26.6.5",
+    "pi-subagents": "^0.78.0",
+    "typebox": "^1.3.37",
     "typescript": "^7.0.2"
   }
 }

package/src/pi-subagents-native.ts

@@ -7,7 +7,8 @@ import * as hostPiTui from "@earendil-works/pi-tui";
 import * as hostTypebox from "typebox";
 
 /**
- * Compatible pi-subagents line: 0.66.0 and above (no upper pin). Any new minor
+ * Structural loader compatibility: 0.66.0 and above; the package peer floor
+ * is >=0.76.1 (no upper pin). Any new minor
  * is accepted, so the exports/ceiling checks below are the real compatibility
  * gate; this range only rejects old lines and guards against blind
  * accept-on-drift. Revalidated against 0.70.0: ceiling registry
@@ -35,7 +36,21 @@ import * as hostTypebox from "typebox";
  * mode needs Pi 0.86.0 or newer
  * (the pi-subagents 0.68.0+ floor): 0.85.0 does not ship
  * `@earendil-works/pi-server`, so background children fail to launch there.
- * This package's own peer floor is Pi 1.0.0 (validated 2026-10-02).
+ * Revalidated 2026-10-08 against 0.76.1 / Pi 1.1.0: capability-ceiling and
+ * config modules are byte-identical to 0.75.0; discovery changes add settings
+ * write leases without changing the loader seams. The deterministic gate and
+ * isolated Node/Bun/compiled-Bun host-peer tests pass. Model-backed native
+ * baseline / protected child acceptance also passes, with the host read
+ * blocked by sandboxed Bash and the runtime acknowledgement verified. This
+ * package's own peer floor is Pi 1.1.0.
+ * Revalidated 2026-10-13 against 0.78.0 / Pi 1.2.0: pi-subagents 0.77.0
+ * required chord aliases for every host from Pi 0.85 onward, which broke
+ * background children on Pi 1.2.0 (chord removed upstream); 0.78.0 requires
+ * chord only when the host manifest declares it, so no host-side workaround
+ * is needed. The subagent tool schema moved management fields into `options`
+ * in 0.77.0 (top-level aliases keep working) and the loader seams are
+ * unchanged. The deterministic gate and model-backed native baseline /
+ * protected child acceptance pass.
  */
 export const PI_SUBAGENTS_COMPAT_RANGE = ">=0.66.0";
 export const NATIVE_CHILD_TOOLS = ["bash", "read", "grep", "find", "ls"] as const;

package/src/subagent.ts

@@ -294,6 +294,9 @@ export class ProcessBackedSubagentSession {
   private stdin: Writable | undefined;
   private rpcSequence = 0;
   private settledCount = 0;
+  // Keep cancellation tied to its run even when settlement beats the RPC
+  // response/waiter registration or later follow-ups complete successfully.
+  private readonly abortedSettlements = new Set<number>();
   private requestedSettlements = 0;
   private activePrompt:
     | {
@@ -421,6 +424,8 @@ export class ProcessBackedSubagentSession {
     if (this.stateValue === "stopped") {
       return Promise.reject(new Error(`subagent session ${this.id} is stopped`));
     }
+    const aborted = this.settlementAbortError(target);
+    if (aborted) return Promise.reject(aborted);
     if (this.settledCount >= target) {
       return Promise.resolve(sessionResult(this.textValue, this.rawOutput));
     }
@@ -531,12 +536,20 @@ export class ProcessBackedSubagentSession {
     this.startReady = undefined;
   }
 
+  private settlementAbortError(target: number): Error | undefined {
+    return this.abortedSettlements.has(target)
+      ? new Error(`subagent session ${this.id} run ${target} aborted`)
+      : undefined;
+  }
+
   private resolveSettledWaiters(): void {
     const result = sessionResult(this.textValue, this.rawOutput);
     for (const waiter of [...this.waiters]) {
       if (waiter.target <= this.settledCount) {
         waiter.cleanup();
-        waiter.resolve(result);
+        const aborted = this.settlementAbortError(waiter.target);
+        if (aborted) waiter.reject(aborted);
+        else waiter.resolve(result);
       }
     }
   }
@@ -573,6 +586,9 @@ export class ProcessBackedSubagentSession {
       pending.resolve(event as RpcResponse);
       return;
     }
+    // Buffered lifecycle records after shutdown/failure must not resurrect a
+    // terminal session or resolve a waiter already rejected by that path.
+    if (this.stateValue === "stopped" || this.stateValue === "failed") return;
     const text = rpcAssistantText(event);
     if (text) {
       this.textValue = text;
@@ -584,6 +600,9 @@ export class ProcessBackedSubagentSession {
     if (event.type === "agent_settled") {
       this.stateValue = "idle";
       this.settledCount++;
+      // Pi 1.1.0 distinguishes an aborted run from a completed one. The child
+      // process is still alive/idle; cancel its result, not the whole session.
+      if (event.aborted === true) this.abortedSettlements.add(this.settledCount);
       if (
         this.activePrompt &&
         this.activePrompt.target <= this.settledCount