@trim21/personal-pi-extensions 0.0.425 → 0.0.427

package/README.md

@@ -80,8 +80,8 @@ bash 工具（opencode 风格 `bash`、Claude Code 风格 `Bash`）注册了 `da
   "writablePaths": [".", "/tmp", "~/my-projects"],
   // 额外可写路径，与默认值合并（ro-bind）
   "extraWritablePaths": ["~/.config"],
-  // tmpfs 挂载路径（避免写入磁盘）
-  "tmpfsPaths": [],
+  // 沙箱内隐藏的路径：以 / 结尾的视为目录（挂空 tmpfs），否则按文件处理（--ro-bind-try /dev/null）
+  "denyPaths": [],
   // 额外 bwrap 参数
   "extraArgs": ["--die-with-parent"],
   // 全权限执行的自动审批规则：命中规则的命令不弹确认框

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trim21/personal-pi-extensions",
-  "version": "0.0.425",
+  "version": "0.0.427",
   "type": "module",
   "description": "Custom pi coding-agent extensions: bwrap sandbox, workspace guard, opencode edit, and more",
   "keywords": [

package/src/bwrap/core.ts

@@ -31,9 +31,16 @@ const bwrapConfigProperties = {
   bwrapPath: Type.Optional(Type.String()),
   writablePaths: Type.Array(Type.String()),
   extraWritablePaths: Type.Array(Type.String()),
-  tmpfsPaths: Type.Array(Type.String()),
+  denyPaths: Type.Array(
+    Type.String({
+      description:
+        "沙箱内隐藏的路径：以 / 结尾为目录（挂空 tmpfs），否则为文件（--ro-bind-try /dev/null）",
+    }),
+  ),
   extraArgs: Type.Array(Type.String()),
-  networkAllowlist: Type.Array(Type.String()),
+  networkAllowlist: Type.Array(
+    Type.String({ description: "允许直连的域名 / IP / CIDR，可带 :port" }),
+  ),
   singBoxPath: Type.Optional(Type.String()),
   slirp4netnsPath: Type.Optional(Type.String()),
   approvalRules: Type.Optional(
@@ -69,9 +76,10 @@ export interface ResolvedBwrap {
   bwrapPath?: string;
   writablePaths: string[];
   extraWritablePaths: string[];
-  tmpfsPaths: string[];
+  /** 沙箱内隐藏的路径：以 / 结尾为目录（挂空 tmpfs），否则为文件（--ro-bind-try /dev/null）。 */
+  denyPaths: string[];
   extraArgs: string[];
-  /** per-domain 过滤的允许域名（非空 = 启用 sing-box 网络过滤）。 */
+  /** 允许直连的域名 / IP / IP:port 白名单（非空 = 启用 sing-box 网络过滤）。 */
   networkAllowlist: string[];
   singBoxPath?: string;
   slirp4netnsPath?: string;
@@ -83,7 +91,7 @@ const DEFAULT_CONFIG: BwrapConfig = {
   mode: "workspace-write",
   writablePaths: [".", "/tmp"],
   extraWritablePaths: [],
-  tmpfsPaths: [],
+  denyPaths: [],
   extraArgs: [],
   networkAllowlist: [],
 };
@@ -94,7 +102,7 @@ export function resolveBwrap(config: BwrapConfig): ResolvedBwrap {
     bwrapPath: config.bwrapPath,
     writablePaths: config.writablePaths ?? [".", "/tmp"],
     extraWritablePaths: config.extraWritablePaths,
-    tmpfsPaths: config.tmpfsPaths ?? [],
+    denyPaths: config.denyPaths ?? [],
     extraArgs: config.extraArgs ?? [],
     networkAllowlist: config.networkAllowlist ?? [],
     singBoxPath: config.singBoxPath,
@@ -126,7 +134,7 @@ export function resolveHeadlessBwrap(config: BwrapConfig): ResolvedBwrap {
     mode: "readonly",
     writablePaths: [],
     extraWritablePaths: [],
-    tmpfsPaths: [],
+    denyPaths: [],
     extraArgs: [],
   });
 }
@@ -137,7 +145,7 @@ function deepMerge(base: BwrapConfig, overrides: Partial<BwrapConfig>): BwrapCon
     bwrapPath: overrides.bwrapPath ?? base.bwrapPath,
     writablePaths: overrides.writablePaths ?? base.writablePaths,
     extraWritablePaths: [...base.extraWritablePaths, ...(overrides.extraWritablePaths ?? [])],
-    tmpfsPaths: overrides.tmpfsPaths ?? base.tmpfsPaths,
+    denyPaths: overrides.denyPaths ?? base.denyPaths,
     extraArgs: overrides.extraArgs ?? base.extraArgs,
     networkAllowlist: overrides.networkAllowlist ?? base.networkAllowlist,
     singBoxPath: overrides.singBoxPath ?? base.singBoxPath,
@@ -321,8 +329,14 @@ export async function buildBwrapArgs(resolved: ResolvedBwrap, cwd: string): Prom
     const absolutePath = resolveBwrapPath(path, cwd);
     args.push("--bind-try", absolutePath, absolutePath);
   }
-  for (const path of resolved.tmpfsPaths) {
-    args.push("--tmpfs", resolveBwrapPath(path, cwd));
+  // denyPaths：以 / 结尾的条目视为目录（挂空 tmpfs），否则视为文件（--ro-bind-try /dev/null 覆盖）
+  for (const path of resolved.denyPaths) {
+    const target = resolveBwrapPath(path, cwd);
+    if (path.endsWith("/")) {
+      args.push("--tmpfs", target);
+    } else {
+      args.push("--ro-bind-try", "/dev/null", target);
+    }
   }
   if (!resolved.network) args.push("--unshare-net");
   // --ro-bind-try：目录不存在（或已被删除）时自动忽略

package/src/bwrap/holder.js

@@ -49,7 +49,6 @@ async function main() {
       return false;
     }
   });
-  await sleep(4e3);
   await writeFile(readyFile, "");
   await new Promise((resolve) => singbox.once("exit", () => resolve()));
 }

package/src/bwrap/holder.ts

@@ -55,8 +55,7 @@ async function main(): Promise<void> {
     process.exit(0);
   });
 
-  // tun0 设备在 sing-box 启动早期就创建，但 gvisor 栈初始化仍需时间；
-  // 以 "sing-box started" 日志作为进程就绪标志，再等待栈初始化完成
+  // 以 "sing-box started" 日志作为就绪标志（TUN 与 gvisor 数据面此时已可用）
   await waitFor(200, 100, async () => {
     try {
       const log = await readFile(logPath, "utf8");
@@ -65,7 +64,6 @@ async function main(): Promise<void> {
       return false;
     }
   });
-  await sleep(4000);
   await writeFile(readyFile, "");
 
   await new Promise<void>((resolve) => singbox.once("exit", () => resolve()));

package/src/bwrap/network-stack.ts

@@ -7,7 +7,7 @@ import { fileURLToPath } from "node:url";
 import { generateSingboxConfig } from "./singbox-config.js";
 
 export interface NetworkStackOptions {
-  /** 允许直连的域名列表（session 启动时固定，reload 才会重新加载）。 */
+  /** 允许直连的域名 / IP:port 列表（session 启动时固定，reload 才会重新加载）。 */
   readonly allowlist: readonly string[];
   /** 真实 DNS 服务器列表，按顺序 fallback。 */
   readonly dnsServers: readonly string[];

package/src/bwrap/runtime.ts

@@ -232,7 +232,7 @@ function notifyMode(
     "allow-all": "allow-all: sandbox off, network on",
     "workspace-write": "workspace-write: sandbox on, network off",
     "allow-net": "allow-net: sandbox on, network on, workspace writable",
-    "net-allowlist": "net-allowlist: sandbox on, network filtered by domain allowlist",
+    "net-allowlist": "net-allowlist: sandbox on, network filtered by allowlist",
     readonly: "readonly: sandbox on, network off, read-only fs",
   };
   ctx.ui.notify(labels[mode], "info");
@@ -672,7 +672,7 @@ export class BwrapRuntime {
       "bwrap-net-allowlist": {
         name: "bwrap-net-allowlist",
         usage: "",
-        description: "Sandbox on, network filtered by domain allowlist, workspace writable",
+        description: "Sandbox on, network filtered by allowlist, workspace writable",
         flags: Type.Object({}),
       },
       "bwrap-readonly": {
@@ -708,9 +708,9 @@ export class BwrapRuntime {
           const writable = runtime.writablePaths.map((path) =>
             resolveBwrapPath(path, commandCtx.cwd),
           );
-          const tmpfs = runtime.tmpfsPaths.map((path) => resolveBwrapPath(path, commandCtx.cwd));
+          const deny = runtime.denyPaths.map((path) => resolveBwrapPath(path, commandCtx.cwd));
           commandCtx.ui.notify(
-            `bwrap ${runtime.mode} ${runtime.network ? "net" : "no-net"} write:[${writable.join(", ")}] tmpfs:[${tmpfs.join(", ") || "-"}]`,
+            `bwrap ${runtime.mode} ${runtime.network ? "net" : "no-net"} write:[${writable.join(", ")}] deny:[${deny.join(", ") || "-"}]`,
             "info",
           );
         }),

package/src/bwrap/singbox-config.ts

@@ -3,12 +3,99 @@ const TUN_ADDRESS = "198.18.0.1/16";
 const EGRESS_INTERFACE = "tap0";
 
 export interface SingboxConfigOptions {
-  /** 允许直连的域名列表（空列表 = 默认拒绝一切出网）。 */
+  /** 允许直连的条目列表（域名 / IP / CIDR，可带 :port；空列表 = 默认拒绝一切出网）。 */
   readonly allowlist: readonly string[];
   /** 真实 DNS 服务器地址列表（IPv4，UDP 53），按顺序 fallback，至少一个。 */
   readonly dnsServers: readonly string[];
 }
 
+interface AllowlistEntry {
+  readonly host: string;
+  readonly port?: number;
+}
+
+interface AllowlistRule {
+  readonly domain?: readonly string[];
+  readonly ip_cidr?: readonly string[];
+  readonly port?: readonly number[];
+  readonly outbound: "direct";
+}
+
+const IPV4_PATTERN = /^\d{1,3}(?:\.\d{1,3}){3}(?:\/\d{1,2})?$/;
+
+function isIp(host: string): boolean {
+  return IPV4_PATTERN.test(host) || host.includes(":");
+}
+
+/** 单 IP 补掩码为 CIDR（IPv4 /32、IPv6 /128），带掩码原样返回。 */
+function toCidr(host: string): string {
+  if (host.includes("/")) return host;
+  return host.includes(":") ? `${host}/128` : `${host}/32`;
+}
+
+function parsePort(value: string): number {
+  const port = Number(value);
+  if (!Number.isSafeInteger(port) || port < 1 || port > 65535) {
+    throw new Error(`Invalid port "${value}"`);
+  }
+  return port;
+}
+
+/**
+ * 解析 allowlist 条目：域名 / IPv4 / CIDR，可带 :port；IPv6 必须用 [] 包裹
+ * （如 `[::1]:80`），裸 IPv6 会报错提示补方括号。
+ */
+function parseAllowlistEntry(entry: string): AllowlistEntry {
+  if (entry.startsWith("[")) {
+    const match = /^\[(.+)\](?::(\d+))?$/.exec(entry);
+    if (match?.[1] === undefined) throw new Error(`Invalid allowlist entry "${entry}"`);
+    return { host: match[1], port: match[2] === undefined ? undefined : parsePort(match[2]) };
+  }
+  const colon = entry.lastIndexOf(":");
+  if (colon === -1) {
+    if (entry.length === 0) throw new Error(`Invalid allowlist entry ""`);
+    return { host: entry };
+  }
+  const portPart = entry.slice(colon + 1);
+  if (!/^\d+$/.test(portPart)) throw new Error(`Invalid allowlist entry "${entry}"`);
+  const host = entry.slice(0, colon);
+  if (host.length === 0) throw new Error(`Invalid allowlist entry "${entry}"`);
+  if (host.includes(":")) {
+    throw new Error(`IPv6 addresses must be wrapped in brackets, e.g. "[${host}]:${portPart}"`);
+  }
+  return { host, port: parsePort(portPart) };
+}
+
+function buildAllowlistRules(allowlist: readonly string[]): AllowlistRule[] {
+  const noPortDomains: string[] = [];
+  const noPortIps: string[] = [];
+  const byPort = new Map<number, { domains: string[]; ips: string[] }>();
+  for (const entry of allowlist) {
+    const { host, port } = parseAllowlistEntry(entry);
+    if (port === undefined) {
+      (isIp(host) ? noPortIps : noPortDomains).push(host);
+    } else {
+      const bucket = byPort.get(port) ?? { domains: [], ips: [] };
+      (isIp(host) ? bucket.ips : bucket.domains).push(host);
+      byPort.set(port, bucket);
+    }
+  }
+  const rules: AllowlistRule[] = [];
+  if (noPortDomains.length > 0) rules.push({ domain: noPortDomains, outbound: "direct" });
+  if (noPortIps.length > 0) {
+    rules.push({ ip_cidr: noPortIps.map((host) => toCidr(host)), outbound: "direct" });
+  }
+  for (const [port, bucket] of byPort) {
+    rules.push({
+      outbound: "direct",
+      port: [port],
+      ...(bucket.domains.length > 0 && { domain: bucket.domains }),
+      ...(bucket.ips.length > 0 && { ip_cidr: bucket.ips.map((host) => toCidr(host)) }),
+    });
+  }
+  return rules;
+}
+
 /**
  * 生成 sing-box 1.13 配置：TUN + fakeip + deny-by-default allowlist。
  *
@@ -69,7 +156,7 @@ export function generateSingboxConfig(options: SingboxConfigOptions): string {
       rules: [
         { action: "sniff" },
         { protocol: "dns", action: "hijack-dns" },
-        ...(allowlist.length > 0 ? [{ domain: [...allowlist], outbound: "direct" }] : []),
+        ...buildAllowlistRules(allowlist),
       ],
     },
   };