@erichll/pi-sandbox 0.5.0 → 0.6.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +15 -0
- package/README.md +8 -2
- package/package.json +2 -2
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,20 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## 0.6.0 - 2026-08-09
|
|
4
|
+
|
|
5
|
+
- Retarget the development compatibility target from `pi-subagents 0.42.1` to
|
|
6
|
+
`pi-subagents 0.44.0` and update the coexistence assertions, capability
|
|
7
|
+
boundary, and compatibility gate. The 0.44.0 line lands internal
|
|
8
|
+
workflow/mission/schedule fixes that do not change pi-sandbox's contract
|
|
9
|
+
(tool-ownership detection, `PI_SUBAGENT_PI_BINARY` worker bootstrap).
|
|
10
|
+
- Adapt the compatibility gate's "direct child" probe to the `workflowScript`
|
|
11
|
+
single-run form: pi-subagents 0.43.0 removed public top-level `agent`/`task`
|
|
12
|
+
direct execution, so the external provider's direct single-child launch is
|
|
13
|
+
now `subagent({ workflowScript: "return runs.run('main', { agent, task })" })`.
|
|
14
|
+
This unblocks the `subagents.externalWorkerIsolation: "enforce"` gate, which
|
|
15
|
+
previously timed out when the isolated worker could not reconcile the removed
|
|
16
|
+
direct signature with the newer `workflowScript`-only contract.
|
|
17
|
+
|
|
3
18
|
## 0.5.0 - 2026-08-08
|
|
4
19
|
|
|
5
20
|
- Pin the development compatibility target to `pi-subagents 0.42.1` and add
|
package/README.md
CHANGED
|
@@ -74,12 +74,12 @@ Supported modes:
|
|
|
74
74
|
itself is not wrapped while `externalWorkerIsolation` is `off`.
|
|
75
75
|
- `off`: protect Bash only.
|
|
76
76
|
|
|
77
|
-
### `pi-subagents` 0.
|
|
77
|
+
### `pi-subagents` 0.44.0 capability boundary
|
|
78
78
|
|
|
79
79
|
`pi-sandbox` verifies the following combination in its test suite and release
|
|
80
80
|
gate:
|
|
81
81
|
|
|
82
|
-
| Capability | `builtin` | `pi-subagents` 0.
|
|
82
|
+
| Capability | `builtin` | `pi-subagents` 0.44.0 |
|
|
83
83
|
| --- | --- | --- |
|
|
84
84
|
| Outer worker sandbox | Yes | Opt-in (`externalWorkerIsolation: "enforce"`) |
|
|
85
85
|
| Bash sandbox | Yes | Yes |
|
|
@@ -92,6 +92,12 @@ Sandbox Runtime boundary. Do not treat inherited Bash sandboxing as complete
|
|
|
92
92
|
worker isolation unless the trusted global configuration explicitly enables
|
|
93
93
|
`enforce`.
|
|
94
94
|
|
|
95
|
+
Note on the external provider's public execution surface: pi-subagents 0.43.0
|
|
96
|
+
removed top-level `agent`/`task` direct execution. Every public `subagent`
|
|
97
|
+
launch — including a minimal single child — is expressed as a `workflowScript`
|
|
98
|
+
such as `return runs.run('main', { agent, task })`. The compatibility gate's
|
|
99
|
+
"direct single child" probe uses that single-run form.
|
|
100
|
+
|
|
95
101
|
The configuration parser rejects malformed JSON, unknown fields, and unknown
|
|
96
102
|
providers instead of silently weakening isolation.
|
|
97
103
|
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@erichll/pi-sandbox",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.6.0",
|
|
4
4
|
"description": "Sandbox Runtime-backed Linux and macOS sandbox with pi-auto-review approval",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"license": "Apache-2.0",
|
|
@@ -60,7 +60,7 @@
|
|
|
60
60
|
"devDependencies": {
|
|
61
61
|
"@earendil-works/pi-coding-agent": "0.83.0",
|
|
62
62
|
"@types/node": "^22.15.3",
|
|
63
|
-
"pi-subagents": "0.
|
|
63
|
+
"pi-subagents": "0.44.0",
|
|
64
64
|
"typescript": "^6.0.3"
|
|
65
65
|
}
|
|
66
66
|
}
|