auto-permission-system 3.0.0 → 3.0.1

package/README.md

@@ -123,7 +123,7 @@ Never asked about: the project itself, your `allowWrite` roots, pi's own package
 
 ### Ask-tier prompt
 
-`no — block` is pre-selected, so Enter alone blocks. Besides `yes — this once` and the persistent `always` options there is `yes — for this session` (this file, its folder, or this domain), kept in memory until the session ends and never saved (ADR-010). For a bash write that the sandbox refused after the command already ran, `yes — this once` re-runs the command once with that folder allowed for the one invocation only (never saved), and `denyWrite` still wins.
+`no — block` is pre-selected, so Enter alone blocks. Besides `yes — this once` and the persistent `always` options there is `yes — for this session` (this file, its folder, or this domain), kept in memory until the session ends and never saved (ADR-010). For a bash write that the sandbox refused after the command already ran, `yes — this once` re-runs the command once with that folder allowed for the one invocation only (never saved), and `denyWrite` still wins. The refusal is read from the command's own error text — `EPERM` / `Operation not permitted` on macOS, `EROFS` / `Read-only file system` on Linux (ADR-022) — so a Linux EROFS gets the same prompt instead of a silent read-only failure; a refused write is never mistaken for an outside-project read.
 
 Every prompt waits **10 seconds** by default. If you do not answer, it resolves to the safe default: **block / deny**.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auto-permission-system",
-  "version": "3.0.0",
+  "version": "3.0.1",
   "description": "Security sandbox, permission system and tool guard for the Pi coding agent (pi): enforce filesystem allow/deny lists and network domain allowlists on read, write, edit, bash, grep, find, ls, fetch_content and web_search, with interactive ask prompts, secret detection and an audit log.",
   "type": "module",
   "author": "Navin Kumar",

package/skills/auto-permission-system/SKILL.md

@@ -83,7 +83,7 @@ When a normal (non-absolute-deny) call is blocked:
 - **always for ALL projects** — whitelist in `~/.pi/agent/extensions/sandbox.json`
 - **always for ALL projects (folder)** — whitelist parent directory globally
 
-For a Layer 1 bash **write** blocked after the command already ran, `yes — this once` re-runs the command once with the offending path's parent folder allowed for that invocation only (never saved); the same folder is not offered again within that invocation, and `denyWrite` still wins over the grant.
+For a Layer 1 bash **write** blocked after the command already ran, `yes — this once` re-runs the command once with the offending path's parent folder allowed for that invocation only (never saved); the same folder is not offered again within that invocation, and `denyWrite` still wins over the grant. The block is recognized from the error output either way it is reported — `EPERM`/`Operation not permitted` on macOS, `EROFS`/`Read-only file system` on Linux (ADR-022) — and a refused write is never offered as a read grant. If the output never names the operand, there is nothing to attribute and no prompt, so the command is simply refused.
 
 Every prompt waits **10 seconds** by default; no answer means the safe default: **block / deny**. Esc on any screen also blocks.
 

package/src/core/policy/patterns.ts

@@ -4,27 +4,63 @@
 
 // ---------- Layer 1 violation attribution ----------
 
-const EPERM_RE = /operation not permitted|EPERM|EACCES/i;
+/**
+ * Filesystem-refusal evidence in a sandboxed command's output. Linux
+ * bubblewrap reports a write outside `allowWrite` as `EROFS: read-only file
+ * system`; macOS sandbox-exec reports the same fence as `Operation not
+ * permitted`; EACCES covers a permission-denied variant either can print.
+ */
+const FS_BLOCKED_RE = /operation not permitted|EPERM|EACCES|EROFS|read-only file system/i;
+
+/**
+ * `EROFS` can only come from a modification, so it proves the refused access
+ * was a write even when the target path also matches a read-deny pattern.
+ * EPERM/EACCES are ambiguous about direction.
+ */
+const WRITE_BLOCK_RE = /EROFS|read-only file system/i;
+
+/** True when the output shows the OS sandbox refused a filesystem access. */
+export function isBlockedAccessError(output: string): boolean {
+	return FS_BLOCKED_RE.test(output);
+}
+
+/** True when the refused access was a write (EROFS only happens on a modification). */
+export function isWriteBlockError(output: string): boolean {
+	return WRITE_BLOCK_RE.test(output);
+}
+
+/** A shell-name/empty token is not a path; everything else resolves against cwd unless absolute. */
+function toAbsPath(raw: string, cwd: string, home: string): string | undefined {
+	let token = raw.trim().replace(/[.,;]+$/, "");
+	if (!token || /^(bash|sh|zsh)$/.test(token)) return undefined;
+	if (token === "~" || token.startsWith("~/")) token = home + token.slice(1);
+	const abs = token.startsWith("/") ? token : `${cwd.replace(/\/+$/, "")}/${token}`;
+	return normalizeAbs(abs);
+}
 
 /**
  * The path a sandboxed bash command was refused, from its error output, as
- * an absolute path. Handles `tool: ./rel: Operation not permitted`,
- * quoted paths (`cannot touch 'x.pem'`), `~/…` and absolute paths. Relative
- * paths resolve against the command's working directory, never against `/`.
+ * an absolute path. Handles `tool: ./rel: Operation not permitted`, quoted
+ * paths (`cannot touch 'x.pem'`), `~/…` and absolute paths, plus the
+ * errno-style forms that put the path *after* the error text
+ * (`EROFS: read-only file system, open '/abs/path'`,
+ * `[Errno 30] Read-only file system: '/abs/path'`). Relative paths resolve
+ * against the command's working directory, never against `/`.
  */
 export function extractBlockedPath(output: string, cwd: string, home: string): string | undefined {
 	for (const line of output.split("\n").reverse()) {
-		const m = EPERM_RE.exec(line);
+		const m = FS_BLOCKED_RE.exec(line);
 		if (!m) continue;
+		// errno-style messages (Node, Python, coreutils) put the operand in
+		// quotes, usually after the error token: take the last quoted token.
+		const quoted = [...line.matchAll(/['"“‘`]([^'"”’`]+)['"”’`]/g)].map((q) => q[1] as string);
+		const quotedPath = quoted.length ? toAbsPath(quoted[quoted.length - 1] as string, cwd, home) : undefined;
+		if (quotedPath) return quotedPath;
 		// The segment right before the error text, e.g. "grep: ./.env: Operation…" → "./.env".
 		const before = line.slice(0, m.index).replace(/[\s:]+$/, "");
 		const segment = before.split(/:\s+/).pop() ?? "";
-		const quoted = /['"“‘`]([^'"”’`]+)['"”’`]\s*$/.exec(segment);
-		let token = (quoted?.[1] ?? segment.split(/\s+/).pop() ?? "").trim();
-		if (!token || /^(bash|sh|zsh)$/.test(token)) continue;
-		if (token === "~" || token.startsWith("~/")) token = home + token.slice(1);
-		const abs = token.startsWith("/") ? token : `${cwd.replace(/\/+$/, "")}/${token}`;
-		return normalizeAbs(abs);
+		const token = toAbsPath(segment.split(/\s+/).pop() ?? "", cwd, home);
+		if (token) return token;
 	}
 	return undefined;
 }

package/src/l1-sandbox/bash-ops.ts

@@ -9,7 +9,7 @@ import { homedir } from "node:os";
 import { dirname } from "node:path";
 import { SandboxManager, type SandboxRuntimeConfig } from "@anthropic-ai/sandbox-runtime";
 import { type BashOperations } from "@earendil-works/pi-coding-agent";
-import { askReadCandidates, extractBlockedPath, isSafeFolderGrant, matchedAskCommands, matchesPolicyPattern, outsideProjectMode, outsideProjectReadCandidates, outsideProjectReadDenied, sandboxFilesystem } from "../core/index";
+import { askReadCandidates, extractBlockedPath, isBlockedAccessError, isSafeFolderGrant, isWriteBlockError, matchedAskCommands, matchesPolicyPattern, outsideProjectMode, outsideProjectReadCandidates, outsideProjectReadDenied, sandboxFilesystem } from "../core/index";
 import { audit } from "../shared/audit";
 import { askMain, askRememberFile, type AskCtx } from "../ui/ask-flow";
 import { loadConfig } from "./config";
@@ -239,13 +239,15 @@ export function createSandboxedBashOps(opts?: SandboxedBashOpts): BashOperations
 
 						let offending: string | undefined;
 						let readDenied = false;
+						let writeDenied = false;
 						let hardDenied = false;
 						let hardWhy = "";
 						let outsideDenied = false;
 						let outsideMode: "allow" | "ask" | "deny" = "allow";
-						if (/operation not permitted|EPERM|EACCES/i.test(outputTail)) {
+						if (isBlockedAccessError(outputTail)) {
 							// Relative paths resolve against the command's cwd: "./.env" is not "/.env".
 							offending = extractBlockedPath(outputTail, cwd, homedir());
+							writeDenied = isWriteBlockError(outputTail);
 							// A hard denyRead path (secret material): a write grant would not help,
 							// and "always" is not offered. The outside-project fence (ADR-014) is
 							// ask-able, so keep the two reasons apart.
@@ -255,7 +257,7 @@ export function createSandboxedBashOps(opts?: SandboxedBashOpts): BashOperations
 									const hardPat = fsCfg.denyRead.find((pat) => matchesPolicyPattern(offending as string, pat, cwd, homedir()));
 									hardDenied = hardPat !== undefined;
 									hardWhy = hardPat ? `denyRead matched "${hardPat}"` : "denyRead";
-									outsideDenied = outsideProjectReadDenied(offending, cwd, homedir(), fsCfg);
+									outsideDenied = !writeDenied && outsideProjectReadDenied(offending, cwd, homedir(), fsCfg);
 									outsideMode = outsideProjectMode(fsCfg);
 								}
 								readDenied = hardDenied || outsideDenied;
@@ -265,7 +267,8 @@ export function createSandboxedBashOps(opts?: SandboxedBashOpts): BashOperations
 							let hint = `\n💡 pi-sandbox: filesystem access blocked.\n`;
 							if (offending) {
 								let why = "";
-								if (hardDenied) why = " (denyRead: reading it is blocked by policy)";
+								if (writeDenied && !hardDenied) why = " (not under an allowWrite root: writes outside it are read-only)";
+								else if (hardDenied) why = " (denyRead: reading it is blocked by policy)";
 								else if (outsideDenied) why = " (outside the project: reading it is gated by policy)";
 								hint += `   Path: ${offending}${why}\n`;
 							}
@@ -327,9 +330,11 @@ export function createSandboxedBashOps(opts?: SandboxedBashOpts): BashOperations
 							onData(Buffer.from(decisionHint));
 						} else if (offending && readDenied) {
 							const why = hardDenied ? hardWhy : "outside the project";
-							auditL1({ subject: offending, decision: "read-denied", reason: why, cwd });
-							opts?.ctx?.ui?.notify?.(`pi-sandbox: bash was refused a read of ${offending} (${why}). Edit sandbox.json if that is wrong.`, "warning");
-							decisionHint = `\n${blockedLine("Read", why, "read")}\n`;
+							const action: "Read" | "Write" = writeDenied ? "Write" : "Read";
+							const outcome = action === "Write" ? "written" : "read";
+							auditL1({ subject: offending, decision: readDenied && !writeDenied ? "read-denied" : "write-denied", reason: why, cwd });
+							opts?.ctx?.ui?.notify?.(`pi-sandbox: bash was refused a ${action.toLowerCase()} of ${offending} (${why}). Edit sandbox.json if that is wrong.`, "warning");
+							decisionHint = `\n${blockedLine(action, why, outcome)}\n`;
 							onData(Buffer.from(decisionHint));
 						} else if (offending && opts?.ctx?.hasUI && opts.ctx.ui?.select && opts.onAlways) {
 							const absPath = offending;
@@ -370,6 +375,11 @@ export function createSandboxedBashOps(opts?: SandboxedBashOpts): BashOperations
 								decisionHint = `\n${blockedLine("Write", "user denied", "written")}\n`;
 							}
 							onData(Buffer.from(decisionHint));
+						} else if (offending && writeDenied) {
+							// No UI to prompt with: report the fence and the path to the model.
+							auditL1({ subject: offending, decision: "write-denied", reason: "not under any allowWrite root", cwd });
+							opts?.ctx?.ui?.notify?.(`pi-sandbox: bash was refused a write of ${offending} (not under any allowWrite root).`, "warning");
+							onData(Buffer.from(`\n${blockedLine("Write", "not under any allowWrite root", "written")}\n`));
 						}
 
 						if (signal?.aborted) {