@erichll/pi-sandbox 0.5.0 → 0.6.1

package/CHANGELOG.md

@@ -1,5 +1,37 @@
 # Changelog
 
+## 0.6.1 - 2026-08-09
+
+- Upgrade `@anthropic-ai/sandbox-runtime` from `0.0.67` to `0.0.71` (path
+  normalization, proxy abort and query-string redaction hardening, per-command
+  violation attribution, network domain `:port` suffixes and per-entry deny
+  reasons, compacted macOS Seatbelt profiles). No breaking contract changes.
+- Give every sandboxed command (main-agent Bash and builtin subagents) a
+  **private, writable temp directory**: each invocation creates an isolated
+  `pi-sandbox-tmp-*` subdirectory of the host temp tree, adds it to the
+  sandbox's read/write allowlists, and points the command's `TMPDIR`, `TMP`,
+  and `TEMP` at it. The shared host temp root stays read-only to the sandbox;
+  the directory is removed when the command exits. If the host temp directory
+  is unavailable (e.g. a read-only `/tmp`), the command degrades to the
+  previous denied-temp behaviour instead of failing. This mirrors the outer
+  external-worker isolation and unifies the broker temp-dir env under
+  `PI_SANDBOX_TMPDIR`.
+- Add an injectable `createTempDir` test seam plus a broker probe fixture and
+  runner coverage for the private-temp success and degrade paths.
+
+- Retarget the development compatibility target from `pi-subagents 0.42.1` to
+  `pi-subagents 0.44.0` and update the coexistence assertions, capability
+  boundary, and compatibility gate. The 0.44.0 line lands internal
+  workflow/mission/schedule fixes that do not change pi-sandbox's contract
+  (tool-ownership detection, `PI_SUBAGENT_PI_BINARY` worker bootstrap).
+- Adapt the compatibility gate's "direct child" probe to the `workflowScript`
+  single-run form: pi-subagents 0.43.0 removed public top-level `agent`/`task`
+  direct execution, so the external provider's direct single-child launch is
+  now `subagent({ workflowScript: "return runs.run('main', { agent, task })" })`.
+  This unblocks the `subagents.externalWorkerIsolation: "enforce"` gate, which
+  previously timed out when the isolated worker could not reconcile the removed
+  direct signature with the newer `workflowScript`-only contract.
+
 ## 0.5.0 - 2026-08-08
 
 - Pin the development compatibility target to `pi-subagents 0.42.1` and add

package/README.md

@@ -18,6 +18,14 @@ also run complete process-backed subagent trees inside independent sandboxes.
 - Every Bash command and persistent subagent session owns a separate broker
   process and Sandbox Runtime manager. Concurrent workers therefore keep
   independent policy, proxy, approval, and cleanup lifecycles.
+- Each sandboxed command is given a **private, writable temp directory**: a
+  fresh `pi-sandbox-tmp-*` subdirectory of the host temp tree that is added to
+  the sandbox's read/write allowlists, with the command's `TMPDIR`, `TMP`, and
+  `TEMP` pointed at it. Only that isolated directory is writable — the shared
+  host temp root (e.g. `/tmp` itself) stays read-only to the sandbox — and it
+  is removed when the command exits. If the host temp directory is unavailable
+  (e.g. a read-only `/tmp`) the command degrades to the previous denied-temp
+  behaviour rather than failing.
 - Project and global Pi security configuration, the trusted extensions tree,
   the installed package, Git hooks, and other Sandbox Runtime mandatory paths
   remain write-protected.
@@ -74,12 +82,12 @@ Supported modes:
   itself is not wrapped while `externalWorkerIsolation` is `off`.
 - `off`: protect Bash only.
 
-### `pi-subagents` 0.42.1 capability boundary
+### `pi-subagents` 0.44.0 capability boundary
 
 `pi-sandbox` verifies the following combination in its test suite and release
 gate:
 
-| Capability | `builtin` | `pi-subagents` 0.42.1 |
+| Capability | `builtin` | `pi-subagents` 0.44.0 |
 | --- | --- | --- |
 | Outer worker sandbox | Yes | Opt-in (`externalWorkerIsolation: "enforce"`) |
 | Bash sandbox | Yes | Yes |
@@ -92,6 +100,12 @@ Sandbox Runtime boundary. Do not treat inherited Bash sandboxing as complete
 worker isolation unless the trusted global configuration explicitly enables
 `enforce`.
 
+Note on the external provider's public execution surface: pi-subagents 0.43.0
+removed top-level `agent`/`task` direct execution. Every public `subagent`
+launch — including a minimal single child — is expressed as a `workflowScript`
+such as `return runs.run('main', { agent, task })`. The compatibility gate's
+"direct single child" probe uses that single-run form.
+
 The configuration parser rejects malformed JSON, unknown fields, and unknown
 providers instead of silently weakening isolation.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@erichll/pi-sandbox",
-  "version": "0.5.0",
+  "version": "0.6.1",
   "description": "Sandbox Runtime-backed Linux and macOS sandbox with pi-auto-review approval",
   "type": "module",
   "license": "Apache-2.0",
@@ -50,7 +50,7 @@
     "test": "node --experimental-strip-types --test test/*.test.ts"
   },
   "dependencies": {
-    "@anthropic-ai/sandbox-runtime": "0.0.67",
+    "@anthropic-ai/sandbox-runtime": "0.0.71",
     "@erichll/pi-auto-review": "0.3.4"
   },
   "peerDependencies": {
@@ -60,7 +60,7 @@
   "devDependencies": {
     "@earendil-works/pi-coding-agent": "0.83.0",
     "@types/node": "^22.15.3",
-    "pi-subagents": "0.42.1",
+    "pi-subagents": "0.44.0",
     "typescript": "^6.0.3"
   }
 }

package/src/external-worker-launcher.mjs

@@ -215,7 +215,7 @@ if (!realPi) {
     detached: true,
     env: {
       ...process.env,
-      PI_SANDBOX_EXTERNAL_WORKER_TMPDIR: workerTempDir,
+      PI_SANDBOX_TMPDIR: workerTempDir,
       CLAUDE_CODE_TMPDIR: workerTempDir,
       TMPDIR: workerTempDir,
       TMP: workerTempDir,

package/src/runner.ts

@@ -3,6 +3,9 @@ import {
   type ChildProcess,
   type ForkOptions,
 } from "node:child_process";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
 import { fileURLToPath } from "node:url";
 import type { Writable } from "node:stream";
 import { getShellConfig } from "@earendil-works/pi-coding-agent";
@@ -38,6 +41,13 @@ export type SandboxCommandOptions = {
   ): Promise<SandboxApprovalAction>;
   policy?: SandboxPolicy;
   shellPath?: string;
+  /**
+   * Test seam. Production callers leave unset (uses a fresh private temp dir
+   * under the host temp dir). Returning undefined simulates a read-only or
+   * otherwise unavailable temp directory, in which case the command degrades
+   * to the previous (denied-temp) behaviour.
+   */
+  createTempDir?(): string | undefined;
   directInvocation?: {
     command: string;
     args: string[];
@@ -76,6 +86,45 @@ const BROKER_MODULE = fileURLToPath(
   new URL("./srt-broker.mjs", import.meta.url),
 );
 
+/**
+ * Env var the broker honors to point the sandboxed child's temp directories
+ * at a private, writable directory (see srt-broker.mjs). Shared with the
+ * external worker launcher, which creates the same per-worker temp dir.
+ */
+const SANDBOX_TMPDIR_ENV = "PI_SANDBOX_TMPDIR";
+const COMMAND_TMPDIR_PREFIX = "pi-sandbox-tmp-";
+
+/**
+ * Create a private writable temp directory for one sandboxed command. The
+ * writable temp is per-command and isolated (a fresh subdirectory of the host
+ * temp dir, never the shared /tmp itself), so tools that honour TMPDIR keep
+ * working without opening the host's world-writable temp to the sandbox. When
+ * the host temp directory is unavailable (e.g. read-only /tmp) we degrade to
+ * the previous behaviour rather than fail the command.
+ */
+function createCommandTempDir(): string | undefined {
+  try {
+    return mkdtempSync(join(tmpdir(), COMMAND_TMPDIR_PREFIX));
+  } catch {
+    return undefined;
+  }
+}
+
+/** Add a private temp dir to the sandbox's read/write allowlists (non-mutating). */
+function withWritableTempDir(
+  policy: SandboxPolicy,
+  tempDir: string,
+): SandboxPolicy {
+  return {
+    ...policy,
+    filesystem: {
+      ...policy.filesystem,
+      allowRead: [...policy.filesystem.allowRead, tempDir],
+      allowWrite: [...policy.filesystem.allowWrite, tempDir],
+    },
+  };
+}
+
 function killProcessTree(child: ChildProcess): void {
   if (child.pid === undefined) return;
   try {
@@ -108,7 +157,10 @@ function commandInvocation(options: SandboxCommandOptions): {
   };
 }
 
-function spawnBroker(options: SandboxCommandOptions): ChildProcess {
+function spawnBroker(
+  options: SandboxCommandOptions,
+  env: NodeJS.ProcessEnv,
+): ChildProcess {
   const broker = options.broker ?? {
     modulePath: BROKER_MODULE,
     execArgv: [],
@@ -116,7 +168,7 @@ function spawnBroker(options: SandboxCommandOptions): ChildProcess {
   const forkOptions: ForkOptions = {
     cwd: options.cwd,
     detached: true,
-    env: options.env ?? process.env,
+    env,
     execArgv: broker.execArgv ?? [],
     stdio: ["pipe", "pipe", "pipe", "ipc"],
   };
@@ -133,8 +185,20 @@ export async function runSandboxedCommand(
   if (options.signal?.aborted) throw new Error("aborted");
 
   const invocation = commandInvocation(options);
-  const policy = options.policy ?? createDefaultPolicy(options.cwd);
-  const broker = spawnBroker(options);
+  let policy = options.policy ?? createDefaultPolicy(options.cwd);
+  let brokerEnv = options.env ?? process.env;
+  // Give every sandboxed command a private, writable temp dir (see
+  // createCommandTempDir). The broker receives SANDBOX_TMPDIR_ENV and redirects
+  // the child's TMPDIR/TMP/TEMP there. The test seam, when provided, is
+  // authoritative (returning undefined simulates an unavailable temp dir).
+  const tempDir = options.createTempDir
+    ? options.createTempDir()
+    : createCommandTempDir();
+  if (tempDir) {
+    policy = withWritableTempDir(policy, tempDir);
+    brokerEnv = { ...brokerEnv, [SANDBOX_TMPDIR_ENV]: tempDir };
+  }
+  const broker = spawnBroker(options, brokerEnv);
   let timeoutHandle: NodeJS.Timeout | undefined;
   let timedOut = false;
   let onAbort: (() => void) | undefined;
@@ -192,6 +256,13 @@ export async function runSandboxedCommand(
     if (broker.exitCode === null && broker.signalCode === null) {
       killProcessTree(broker);
     }
+    if (tempDir) {
+      try {
+        rmSync(tempDir, { recursive: true, force: true });
+      } catch {
+        // Best-effort cleanup; the temp dir is beneath the host temp tree.
+      }
+    }
   }
 }
 

package/src/srt-broker.mjs

@@ -88,7 +88,7 @@ async function main() {
     undefined,
     process.cwd(),
   );
-  const workerTempDir = process.env.PI_SANDBOX_EXTERNAL_WORKER_TMPDIR;
+  const workerTempDir = process.env.PI_SANDBOX_TMPDIR;
   target = spawn(wrapped.argv[0], wrapped.argv.slice(1), {
     cwd: process.cwd(),
     env: workerTempDir