Release v0.0.79

[ronleizrowice-ant]

Version fields only: package.json and package-lock.json go from 0.0.78 to 0.0.79. release.yml refuses to publish unless the release tag matches package.json, and 0.0.78 is already published.

What 0.0.79 carries over 0.0.78

• linux: make the read-deny glob walk about six times faster #627, linux: the wrap walks its patterns in turns, and stops when its signal is aborted #628 (Linux): expanding a denyRead or allowRead pattern is about six times faster, gives the caller's thread back every 10 ms, and stops when the signal passed to wrapWithSandbox() is aborted.
• linux: deny every dangerous name of a subdirectory, not only those three levels down #629 (Linux): every dangerous name of a subdirectory is denied, one level down, whatever else the tree holds.
• linux: a wrap that starts over keeps what it has walked, and ends #638, linux: a wrap that starts over reads the disk again #644, linux: one wrap, one working directory, and no object taken for the same install #655 (Linux): a wrap goes by one configuration and one working directory. If either changes while it walks it starts over and reads the disk again, and after two restarts it walks without giving the thread back.
• linux: try a directory that cannot be listed once, and give each path once #645 (Linux): a directory that cannot be listed is tried once per wrap, not once per rule, and the read lists hold each path once.
• linux: a command starts once both relays listen #639 (Linux): a command starts once both in-sandbox relays listen, so its first network call is not refused.
• cli: read the version through a static import, so a compiled binary starts #630: a CLI built with bun build --compile starts again.
• Answer 502 when an upstream sends an invalid status code #660: the HTTP proxy answers 502 when an upstream's response head is invalid, where it threw and ended the process.
• linux: one mount per destination, so bubblewrap 0.4 starts #580 (Linux): one mount per destination, so bubblewrap 0.4 starts.
• Glob walk: an anchor option, a directory taken as the name it is #620, Let a caller mark a path entry literal: { path, literal: true } #621, Read a path entry as the path it spells, where that exists #622: a path entry whose characters read as a pattern is also read as the path it spells, where that exists, so a folder named [wip] app keeps its denies. A caller can mark an entry as a name outright: { path, literal: true }.
• Raise the supported Node floor to 22.12, and move CI to Node 22 #636: engines is node >=22.12.0. On Node 20, or on 22 before 22.12, npm install warns, and fails where engine-strict is set.
• Whatever else is merged before the tag.

For whoever upgrades

• Types (Let a caller mark a path entry literal: { path, literal: true } #621): the four path lists of filesystem are FilesystemPathEntry[], that is string | { path: string; literal: true }, where they were string[]. Code that reads a configuration's lists back as strings no longer compiles. A read or write config can carry literal… lists beside the old ones; writeRootsOf() gives every write root, whichever list it came in on.
• Node (Raise the supported Node floor to 22.12, and move CI to Node 22 #636): see above.

Merge order

Last, after the fixes the release is meant to carry. Supersedes #577, which bumped to 0.0.78.

Publishing

Publish a GitHub release on tag v0.0.79 at a commit on main; release.yml builds and publishes to npm.

Testing

main is merged in, so CI runs on what the tag will hold. Built from this branch, srt --version prints 0.0.79, from a compiled binary too; a sandboxed command runs and a ** read deny holds; and npm pack --dry-run names the tarball anthropic-ai-sandbox-runtime-0.0.79.tgz. Against main, no source file changes.

[imichaelmoore]

/stamp