@namzu/sandbox 27.0.0 → 29.0.0

package/CHANGELOG.md

@@ -1,5 +1,27 @@
 # @namzu/sandbox
 
+## 29.0.0
+
+### Patch Changes
+
+- Updated dependencies [bb67398]
+- Updated dependencies [38d62f7]
+- Updated dependencies [38d62f7]
+- Updated dependencies [38d62f7]
+- Updated dependencies [38d62f7]
+- Updated dependencies [38d62f7]
+- Updated dependencies [38d62f7]
+  - @namzu/sdk@54.0.0
+
+## 28.0.0
+
+### Patch Changes
+
+- Updated dependencies [7608640]
+- Updated dependencies [7608640]
+- Updated dependencies [7608640]
+  - @namzu/sdk@53.0.0
+
 ## 27.0.0
 
 ### Minor Changes
@@ -1024,7 +1046,7 @@ terminator`, reporting no `peerCloseMs` at all — the close in that case is the
   host set one, fails with `ENOSPC` or is OOM-killed, where writing it to disk used
   to succeed. Any workload that spills more than its memory budget into `/tmp`,
   `/var/tmp` or `/workspace` is in that group.
-  Everything the reference image does keeps working: `/tmp` stays executable
+  Everything the base image does keeps working: `/tmp` stays executable
   (docker's own `--tmpfs` default is `noexec`, which would have turned
   `gcc -o /tmp/a.out … && /tmp/a.out` into `Permission denied`), and `HOME` stays
   writable, which is what LibreOffice, matplotlib and npm need.
@@ -2722,7 +2744,7 @@ progress in <a local notes directory>/...` — a runtime error
     returns 404, to explain the doctor's protocol/runtime split. The split is now
     explained in the sentence itself.
   - `@namzu/sdk` source comments cited design documents by path. They cite the
-    session by name instead, which is what the reference was ever worth.
+    session by name instead, which is all such a citation was ever worth.
 
   No API, type, or behaviour change. The `@namzu/sandbox` message text is the
   only runtime string affected, and nothing asserts on it.
@@ -3222,7 +3244,7 @@ mkdir '/Users'` crash that hit sibling-container deployments.
     branched on the env, only logged it; size grew with the skill
     list). Only `NAMZU_SANDBOX_WORKSPACE` is forwarded today.
 
-  The reference Dockerfile pre-creates **only the parent directories**
+  The image pre-creates **only the parent directories**
   `/mnt`, `/mnt/user-data`, `/mnt/skills` — root-owned, mode 0555.
   Leaf paths (`outputs/`, `uploads/`, `tool_results/`, `transcripts/`,
   `<skill-id>/`) are intentionally NOT pre-created. When a bind is
@@ -3327,7 +3349,7 @@ test:smoke`) runs an opt-in docker integration test exercising the
   four-tier taxonomy that mirrors how production agent platforms
   actually deploy code-execution sandboxes:
 
-  - `process` — Claude Code-style host-process isolation
+  - `process` — host-process isolation
     (bubblewrap on Linux, Seatbelt on macOS, via Anthropic's
     `@anthropic-ai/sandbox-runtime`). For agents that run on the
     developer's own machine.
@@ -3354,10 +3376,9 @@ test:smoke`) runs an opt-in docker integration test exercising the
     "Sandboxing and Workload Isolation" post and the original
     Firecracker NSDI '20 paper are the canonical refs).
   - Trusted-tenant → gVisor (GKE Sandbox, Modal, OpenAI Code
-    Interpreter — `gvisor.dev/docs/architecture_guide/security` is
-    the reference).
+    Interpreter).
   - Single-user developer machine → bubblewrap / Seatbelt
-    (Anthropic Claude Code — `anthropic-experimental/sandbox-runtime`).
+    (`anthropic-experimental/sandbox-runtime`).
   - Single-tenant or co-trusted → plain Docker + seccomp default
     profile.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@namzu/sandbox",
-  "version": "27.0.0",
+  "version": "29.0.0",
   "description": "Pluggable sandbox provider for @namzu/sdk. Process-level isolation (bubblewrap on Linux, Seatbelt on macOS, via @anthropic-ai/sandbox-runtime) for developer dev loops; container-level isolation (HTTP worker + a loopback-bound egress proxy that allows by resolved address and brokers outbound credentials so they never enter the sandbox) for multi-tenant production. Backend selected at construction time; the SDK consumes both through the same SandboxProvider interface.",
   "license": "FSL-1.1-MIT",
   "engines": {
@@ -52,7 +52,7 @@
     "provenance": true
   },
   "peerDependencies": {
-    "@namzu/sdk": "^52.0.0"
+    "@namzu/sdk": "^54.0.0"
   },
   "dependencies": {
     "ws": "8.21.3"
@@ -63,7 +63,7 @@
     "typescript": "^5.5.0",
     "vitest": "^4.1.11",
     "yaml": "^2.9.0",
-    "@namzu/sdk": "^52.0.0"
+    "@namzu/sdk": "^54.0.0"
   },
   "scripts": {
     "build": "tsc --build",