@pleach/sandbox changelog

This page collects the site-content changelog entries that materially touched the @pleach/sandbox docs surface or named a @pleach/sandbox symbol. It is not the runtime changelog — the canonical record of @pleach/sandbox runtime behavior lives in the upstream package CHANGELOG.md and on npmjs.org/package/@pleach/sandbox.

See the combined site changelog at /docs/changelog/combined for the chronological unified view across every SKU.

Unreleased

Added

• The SandboxProvider contract block added to /docs/sandbox. The page previously deferred the whole method set to npm; it now shows the interface on-site — acquire / execute / readFile / writeFile / listFiles / release / isAlive / capabilities, each capability-gated, with acquire idempotent on (sessionId × chatId) — so a host implementing a Docker / E2B / Modal adapter has the shape without leaving the page. The npm README stays the source of truth for the option shapes. Upstream trunk, not yet published to npm.

Changed

• Four SKU placement pages — /docs/sandbox is one of four thin orientation pages added/normalized in this pass: what the SKU is for, where it slots in the substrate, which contract page it implements, and a pointer to the package's npm README as the canonical source for constructor signature and option shape. Authored to retire audit failures for SKUs already on SKU_PUBLISHED. The repo's audit:docs-vs-contract script now reports 0 missing pages.
• Sidebar — sandbox slots into Bundled packages after base-tools.
• Per-recipe deep-dive page additions — instrumentedCodingAgent composes @pleach/coding-agent + @pleach/sandbox + @pleach/observe.

Fixed

• Adapter packaging corrected: adapters ship inside @pleach/sandbox. The page said vendor adapters publish as separate @pleach/sandbox-<vendor> packages; the four endpoint-shape adapters (createHttpStreamSandboxProvider, createHttpPollSandboxProvider, createChildProcessSandboxProvider, createFargateSandboxProvider) ship inside the package. Added an Endpoint-shape adapters table.
• "Where it fits" orientation corrected to the real contract (devharness FINDING 103). The page claimed coding-agent tools call a sandbox through ctx.sandbox.readFile / .writeFile / .exec / .list. There is no ctx.sandbox — core's ToolContext is sandbox-agnostic. The low-level SandboxProvider contract (packages/sandbox/src/types.ts) is execute / readFile / writeFile / listFiles, and @pleach/coding-agent ships a thin SandboxClient facade (exec / readFile / writeFile, no list; packages/coding-agent/src/sandbox/SandboxProvider.ts) that the tool handlers close over. Prose rewritten to that seam.

2026-06-08

Added

• @pleach/sandbox row in Packages (Phase A contract + in-memory fixture, version 0.1.0).

Changed

• Plugin contract → Sibling SKUs as plugins section retitled and rewritten with per-row real Phase A status — includes @pleach/sandbox.