[ronleizrowice-ant]

Version bump to 0.0.78 (version fields only). Draft release notes: #584 and #615 are required, together; every other line applies only if that pull request is merged first.

Do not release #584 without #615. #615 settles where the manifests live, so that no released version ever writes them elsewhere, and closes a case #584 leaves open: two hosts that share the manifest directory and the project can remove each other's mount points under a running sandbox.

Release notes

• linux: a placeholder is removed only when no running sandbox relies on it #584 (Linux): a host mount point for an absent denyWrite path is removed only when no running sandbox relies on it; the user's own empty read-only file there is kept. New export liveMountPoints().
• linux: keep the mount point manifests where the user id says, first under /var/tmp #615 (Linux): the manifests live in /var/tmp/srt-mount-points-<uid> (then /run/user/<uid>, then /tmp), worked out from the user id, so processes with different XDG_RUNTIME_DIR or TMPDIR see each other and a logout or a reboot leaves nothing behind for good.
• Mandatory denies: submodule git dirs, .git pointer files, nested hooks, gitignored paths #569 (Linux): the mandatory-deny scan fails closed (deny_scan_failed) and cannot be hidden from through .gitignore; .git pointer files and .git/modules are covered. With a symlinked .git/hooks or .git/config, sandboxed git add and commit fail.
• Glob walk: a drive root is a base, and two ways a directory could be taken for absent #575 (Windows): a glob whose first wildcard sits right after a drive or share root is enforced again, not silently dropped.
• Glob [!x] and [^x] now negate (such allow rules widen); a set is written as both regex engines read it #573: [!x] and [^x] are now negated. Review rules containing them: an allow written that way matches far more.
• linux: a sandboxed command stays in the namespaces made for it #588 (Linux): a sandboxed command cannot create user namespaces (breaks Chromium's namespace sandbox, rootless podman, nested srt) unless allowNestedUserNamespaces is set. An embedder's compiled-in helper must be rebuilt.
• linux: with no seccomp helper, have bubblewrap disable user namespaces #617 (Linux): the same with no seccomp helper in the chain, through bubblewrap's --disable-userns (0.8.0 or later).
• ci: pin ripgrep and the type packages, enforce the lockfile, and run the Node tests on 22 and 24 #589: engines is node >=22.
• linux: exit status under zsh, and import zod/v3 #590 (Linux): under zsh a failing command's status is reported, not 0. (merged)
• linux: bind a deny path that another sandbox makes while the wrap is looking #618 (Linux): a deny path that another sandbox makes while the wrap is looking is bound, not left writable. (merged)
• Per-command network allow lists, and deny reasons from the ask callback #591: the ask callback allows only on true. New: registerCommandNetworkLists.
• windows: apply the mandatory write denies, and keep the directories above a kept deny in place #579 (Windows): applies the mandatory write denies to the names that already exist; one the command creates for the first time is not blocked, unlike on Linux and macOS (list it under denyWrite). initialize() and reset() take longer in large directories.
• linux: the read-deny glob walk has a budget #607 (Linux): denyRead expansion has a budget (20,000,000 entries, 60 s; filesystem.denyReadGlobBudget); past it the wrap rejects with deny_glob_too_large.
• Glob walk: an anchor option, a directory taken as the name it is #620, Let a caller mark a path entry literal: { path, literal: true } #621, Read a path entry as the path it spells, where that exists #622: an entry with [, ], * or ? that exists on disk is also read as a path, so denies inside a folder named [WIP] project hold; lists take { path, literal: true }.
• Take host-side helpers only from where the sandboxed command cannot write #594 (Linux, macOS): bwrap, socat and rg are never taken from a directory the command may write (host_helper_unavailable). With a writable home directory and the tools installed only under it (~/.local/bin, ~/.cargo/bin, a ~/.nix-profile link) every command is refused, where it used to run: install them elsewhere or name them (bwrapPath, socatPath, ripgrep.command).
• Warn when the library is installed where a sandboxed command can write it #595 (Linux, macOS): checkDependencies() warns when the package is installed where a sandboxed command may write.
• linux: one mount per destination, so bubblewrap 0.4 starts #580 (Linux): one mount per destination, so bubblewrap 0.4 starts.
• No note: linux: a deny set's mounts do not depend on the order it was written in #585, Document what a --control-fd line changes, and the config keys the reference left out #578, ci: run the package as an embedder ships it, on musl and on macOS 26 #592, and Make nine tests able to fail, and cover globToRegex and the public export list #570, Correct five false statements, and remove dead and duplicated code #571, test: fix the typecheck of the seccomp suite that broke main #583, Write limits are judged by where a write lands: say so, and test it #614 (on main, no behaviour change).

Merge order

Right after #584 and #615, never before both; the rest if merged by then, else in the next release.

Publishing

Publish a GitHub release on tag v0.0.78 at a commit on main; release.yml builds and publishes to npm.
The tag must match package.json and be an ancestor of main.

Testing

npm run typecheck clean; no source file changes.

[ronleizrowice-ant]

/approve 9ff6a89