@erichll/pi-sandbox 0.9.0 → 0.11.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +21 -0
- package/README.md +13 -0
- package/package.json +4 -4
- package/src/approval.ts +7 -0
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,26 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## 0.11.0 - 2026-08-24
|
|
4
|
+
|
|
5
|
+
- **Tag unmatched network domains.** When a domain does not match any static
|
|
6
|
+
allow or deny rule, the approval request now explicitly records this as
|
|
7
|
+
"network-unmatched" so that audit logs, reviewer context, and grants clearly
|
|
8
|
+
distinguish static-policy misses from other review triggers.
|
|
9
|
+
- **Structured network destination.** Domain approval requests now include
|
|
10
|
+
separate host, port, and protocol fields in addition to the combined
|
|
11
|
+
destination string. Grants bind each component independently, preventing a
|
|
12
|
+
grant for one host-port-protocol combination from being reused for another.
|
|
13
|
+
- Update the dev-only `pi-subagents` compatibility baseline from `0.54.0` to
|
|
14
|
+
`0.56.0`. No runtime or public API changes.
|
|
15
|
+
|
|
16
|
+
## 0.10.0 - 2026-08-22
|
|
17
|
+
|
|
18
|
+
- Align the package version with `@erichll/pi-auto-review` `0.10.0` and update
|
|
19
|
+
the exact dependency. This inherits the new single above-editor review widget,
|
|
20
|
+
its stale-concurrency guard, and the removal of tool-call grouping and
|
|
21
|
+
transcript auto-append; the sandbox's network, filesystem, grant, and
|
|
22
|
+
external-worker security behavior is unchanged.
|
|
23
|
+
|
|
3
24
|
## 0.9.0 - 2026-08-22
|
|
4
25
|
|
|
5
26
|
- Align the planned package version with `@erichll/pi-auto-review` `0.9.0` and
|
package/README.md
CHANGED
|
@@ -4,6 +4,19 @@
|
|
|
4
4
|
`@anthropic-ai/sandbox-runtime`. It protects main-agent Bash commands and can
|
|
5
5
|
also run complete process-backed subagent trees inside independent sandboxes.
|
|
6
6
|
|
|
7
|
+
## Contents
|
|
8
|
+
|
|
9
|
+
- [Security model](#security-model)
|
|
10
|
+
- [Linux requirements](#linux-requirements)
|
|
11
|
+
- [Subagent provider](#subagent-provider)
|
|
12
|
+
- [`pi-subagents` 0.53.0 capability boundary](#pi-subagents-0530-capability-boundary)
|
|
13
|
+
- [Network domain policy](#network-domain-policy)
|
|
14
|
+
- [Optional host IPC fallback](#optional-host-ipc-fallback)
|
|
15
|
+
- [Additional trusted read paths](#additional-trusted-read-paths)
|
|
16
|
+
- [Installation](#installation)
|
|
17
|
+
- [Development](#development)
|
|
18
|
+
- [Upstream](#upstream)
|
|
19
|
+
|
|
7
20
|
## Security model
|
|
8
21
|
|
|
9
22
|
- Linux uses bubblewrap mount/network namespaces and seccomp.
|
package/package.json
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@erichll/pi-sandbox",
|
|
3
|
-
"version": "0.
|
|
4
|
-
"description": "
|
|
3
|
+
"version": "0.11.0",
|
|
4
|
+
"description": "Linux (bubblewrap) and macOS (Seatbelt) process sandbox for Pi backed by Anthropic's @anthropic-ai/sandbox-runtime. Fail-closed static filesystem policy plus per-connection network approval from pi-auto-review; sandboxes main-agent Bash and built-in subagent process trees.",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"license": "Apache-2.0",
|
|
7
7
|
"keywords": [
|
|
@@ -51,7 +51,7 @@
|
|
|
51
51
|
},
|
|
52
52
|
"dependencies": {
|
|
53
53
|
"@anthropic-ai/sandbox-runtime": "0.0.73",
|
|
54
|
-
"@erichll/pi-auto-review": "0.
|
|
54
|
+
"@erichll/pi-auto-review": "0.11.0"
|
|
55
55
|
},
|
|
56
56
|
"peerDependencies": {
|
|
57
57
|
"@earendil-works/pi-coding-agent": "^0.84.1",
|
|
@@ -66,7 +66,7 @@
|
|
|
66
66
|
"devDependencies": {
|
|
67
67
|
"@earendil-works/pi-coding-agent": "^0.84.1",
|
|
68
68
|
"@types/node": "^26.2.0",
|
|
69
|
-
"pi-subagents": "0.
|
|
69
|
+
"pi-subagents": "0.56.0",
|
|
70
70
|
"typescript": "^6.0.3"
|
|
71
71
|
}
|
|
72
72
|
}
|
package/src/approval.ts
CHANGED
|
@@ -52,7 +52,14 @@ export async function approveDomainEndpoint(
|
|
|
52
52
|
cwd: context.cwd,
|
|
53
53
|
command: context.command,
|
|
54
54
|
destination: `${endpoint.hostname}:${endpoint.port}`,
|
|
55
|
+
destinationHost: endpoint.hostname,
|
|
56
|
+
destinationPort: endpoint.port,
|
|
57
|
+
destinationProtocol: endpoint.protocol,
|
|
55
58
|
agentName: context.agentName,
|
|
59
|
+
matchedPolicy: {
|
|
60
|
+
decision: "ask",
|
|
61
|
+
rule: "network-unmatched",
|
|
62
|
+
},
|
|
56
63
|
};
|
|
57
64
|
return approveBoundaryRequest(request, context);
|
|
58
65
|
}
|