@erichll/pi-sandbox 0.8.3 → 0.8.5

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 0.8.5 - 2026-08-21
+
+- Update the exact `@erichll/pi-auto-review` dependency to `0.8.0`, inheriting
+  the break-glass recovery feature: deny results now carry a `denialSource` and
+  a `recoveryCommand` naming `/auto-review-approve` or
+  `/auto-review-break-glass`, or stating that a local hard deny cannot be
+  overridden.
+
+## 0.8.4 - 2026-08-20
+
+- Update the dev-only `pi-subagents` compatibility baseline to `0.53.0`.
+- Extend the external-isolation compatibility gate to require and report the
+  `0.53.0`-or-newer baseline. No pi-sandbox runtime or public API changes.
+
 ## 0.8.3 - 2026-08-20
 
 - Update the exact `@erichll/pi-auto-review` dependency to `0.6.0`, inheriting

package/README.md

@@ -83,16 +83,18 @@ Supported modes:
   itself is not wrapped while `externalWorkerIsolation` is `off`.
 - `off`: protect Bash only.
 
-### `pi-subagents` 0.50.0 capability boundary
+### `pi-subagents` 0.53.0 capability boundary
 
 `pi-sandbox` verifies the following combination in its test suite and release
 gate. This version boundary is pinned exactly (see the package
 `devDependencies`) and additionally exercised against the latest published
 `pi-subagents` on a nightly CI schedule. The `PI_SUBAGENT_PI_BINARY` seam
 (`externalWorkerIsolation: "enforce"`) is re-checked deterministically by the
-`gate:external-isolation` probe on the pinned and latest dependency.
+`gate:external-isolation` probe on the pinned and latest dependency. The
+published peer range remains `>=0.50.0`; this documents the current tested
+development baseline, not a runtime minimum.
 
-| Capability | `builtin` | `pi-subagents` 0.50.0 |
+| Capability | `builtin` | `pi-subagents` 0.53.0 |
 | --- | --- | --- |
 | Outer worker sandbox | Yes | Opt-in (`externalWorkerIsolation: "enforce"`) |
 | Bash sandbox | Yes | Yes |
@@ -100,10 +102,11 @@ gate. This version boundary is pinned exactly (see the package
 | `workflowScript`, missions, schedules | No | Yes |
 | permission-system parent forwarding | Not required | Verified by compatibility gate |
 
-Upgrading across a capability boundary (for example `0.49.0` → `0.50.0`)
-requires re-running `npm run gate:external-isolation` and, before a release,
-the model-backed `npm run gate:pi-subagents`. See `docs/compat-notes.md` for
-the recorded compatibility seams and how each is verified on upgrade.
+Upgrading across a capability boundary (for example `0.49.0` → `0.50.0`, or
+moving the tested baseline to `0.53.0`) requires re-running
+`npm run gate:external-isolation` and, before a release, the model-backed
+`npm run gate:pi-subagents`. See `docs/compat-notes.md` for the recorded
+compatibility seams and how each is verified on upgrade.
 
 For the external provider, `off` leaves the worker process outside the outer
 Sandbox Runtime boundary. Do not treat inherited Bash sandboxing as complete

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@erichll/pi-sandbox",
-  "version": "0.8.3",
+  "version": "0.8.5",
   "description": "Sandbox Runtime-backed Linux and macOS sandbox with pi-auto-review approval",
   "type": "module",
   "license": "Apache-2.0",
@@ -51,7 +51,7 @@
   },
   "dependencies": {
     "@anthropic-ai/sandbox-runtime": "0.0.73",
-    "@erichll/pi-auto-review": "0.6.0"
+    "@erichll/pi-auto-review": "0.8.0"
   },
   "peerDependencies": {
     "@earendil-works/pi-coding-agent": "^0.84.1",
@@ -66,7 +66,7 @@
   "devDependencies": {
     "@earendil-works/pi-coding-agent": "^0.84.1",
     "@types/node": "^26.2.0",
-    "pi-subagents": "0.52.0",
+    "pi-subagents": "0.53.0",
     "typescript": "^6.0.3"
   }
 }

package/src/approval.ts

@@ -124,10 +124,17 @@ async function approveBoundaryRequest(
   }
 
   if (decision.kind === "deny") {
+    const recoveryCommand =
+      decision.recoveryCommand ?? "/auto-review-approve";
+    const recovery =
+      recoveryCommand === false
+        ? " This local safety denial cannot be overridden."
+        : ` Use ${recoveryCommand} for one exact retry.`;
     return {
       action: "deny",
-      source: "reviewer",
-      reason: decision.review.rationale,
+      source:
+        decision.denialSource === "hard-deny" ? "hard-deny" : "reviewer",
+      reason: `${decision.review.rationale}${recovery}`,
     };
   }
   if (decision.kind === "defer") {