0.5.4 — 2026-08-31
ITSandbox reaches the terminal, fail-open
The pty layer now recognizes an owner-enabled ITSandbox: when the sandbox is on
(or a caller explicitly asks for it), a session's command line is wrapped in
Seatbelt isolation and given its own workdir before it ever spawns — the
shell-guard still runs on the original, unwrapped command first. If the sandbox
module is missing or a wrap fails, the terminal falls straight through to a
normal session: a sandbox fault can never take it down. The permission gate
matches — an agent may read whether the sandbox fence is on, never switch off
its own isolation; that stays the owner's call alone.
Owner slash commands ship to the headless agent
/inft, /show, /sandbox — the owner-facing commands — now load into every
headless RPC session the same way the standing extension does, so they work
whether the owner is typing in CODE or the agent is running unattended in PILOT.
PILOT sessions get names, and BRAIN can clear one at a time
Each PILOT run now carries a run id and a short title derived from what was
actually ordered, so successive autonomous runs fold separately in BRAIN →
Thoughts instead of blurring into one bucket — and CLEAR SELECTED can target a
single run's thoughts by that id without touching the rest of the session.
Self-update reports what's actually newest
Checking for a new pi build now asks the registry directly and reports the
answer either way — "already the newest build" becomes a verifiable claim
instead of a guess — and each resync step (workspace, extension, launcher)
reports its own success instead of one flag for all three.