bx-mac 1.3.0 → 1.4.0

package/README.md

@@ -243,6 +243,8 @@ ro:reference/docs
 ro:shared/toolchain
 ```
 
+`rw:` and `ro:` entries also **override** the built-in protected lists - e.g. `ro:.npmrc` makes the otherwise-blocked `~/.npmrc` readable, `rw:.aws` opens the AWS credentials directory. Files (not just directories) are accepted as targets. Use this with care - you are explicitly weakening the default protection.
+
 Deny rules are applied **in addition** to the built-in protected lists:
 
 > 🔒 **Dotdirs:** `.ssh` `.gnupg` `.docker` `.zsh_sessions` `.cargo` `.gradle` `.gem`
@@ -397,6 +399,7 @@ These are great when available, but they only protect within their own tool. bx
 ## 🔗 Alternatives
 
 - [Agent Safehouse](https://agent-safehouse.dev/) — macOS kernel-level sandboxing for LLM coding agents via `sandbox-exec`. Uses a **deny-first model**: everything is blocked by default and only explicitly listed paths are opened up. This gives you theoretically stricter control (e.g. `~/Library` is fully blocked and only specific subdirs are allowed), but requires more configuration — tools and runtimes that need paths you haven't whitelisted will break silently. If you need that level of precision and are willing to tune profiles per tool, Agent Safehouse may be the better fit. bx uses the opposite **allow-first model** (only sensitive paths are blocked), which works out of the box for VSCode, shells, Claude Code, and other tools without any per-tool configuration.
+- [Docker AI Sandboxes](https://docs.docker.com/ai/sandboxes/) — Docker's built-in sandbox environment for AI coding agents. Runs tools in isolated containers with controlled filesystem and network access. Stronger isolation than kernel-level sandboxing, but requires Docker Desktop and adds container overhead.
 - **Docker / VMs** — for stronger isolation, run AI tools in a virtualized environment (containers, VMs). Full process and network isolation at the cost of setup overhead.
 - **Web sandboxes** — browser-based approaches for running AI agents. See Simon Willison's [Living dangerously with Claude](https://simonwillison.net/2025/Oct/22/living-dangerously-with-claude/) for an overview.
 

package/dist/bx.js

@@ -1091,7 +1091,7 @@ function parseHomeConfig(home, workDirs) {
 		if (!match) continue;
 		const [, prefix, rawPath] = match;
 		const absolute = resolve(home, rawPath.trim());
-		if (!existsSync(absolute) || !statSync(absolute).isDirectory()) continue;
+		if (!existsSync(absolute)) continue;
 		if (prefix.toUpperCase() === "RW") allowed.add(absolute);
 		else readOnly.add(absolute);
 	}
@@ -1143,20 +1143,20 @@ function collectProtectedContainers(home) {
 	}
 	return matched;
 }
-function collectReadOnlyDotfiles(home) {
-	return PROTECTED_HOME_DOTFILES_RO.map((f) => join(home, f));
+function collectReadOnlyDotfiles(home, overrides = /* @__PURE__ */ new Set()) {
+	return PROTECTED_HOME_DOTFILES_RO.map((f) => join(home, f)).filter((p) => !overrides.has(p));
 }
-function collectIgnoredPaths(home, workDirs) {
+function collectIgnoredPaths(home, workDirs, overrides = /* @__PURE__ */ new Set()) {
 	const ignored = [
 		...PROTECTED_DOTDIRS.map((d) => join(home, d)),
 		...PROTECTED_HOME_DOTFILES.map((f) => join(home, f)),
 		...PROTECTED_LIBRARY_DIRS.map((d) => join(home, "Library", d)),
 		...new Set(collectProtectedContainers(home))
-	];
+	].filter((p) => !overrides.has(p));
 	const globalIgnore = join(home, ".bxignore");
 	if (existsSync(globalIgnore)) {
 		const denyLines = parseLines(globalIgnore).filter((l) => !ACCESS_PREFIX_RE.test(l));
-		for (const line of denyLines) ignored.push(...resolveGlobMatches(line, home));
+		for (const line of denyLines) for (const m of resolveGlobMatches(line, home)) if (!overrides.has(m)) ignored.push(m);
 	}
 	for (const workDir of workDirs) collectIgnoreFilesRecursive(workDir, ignored);
 	return ignored;
@@ -1199,7 +1199,7 @@ function collectSystemDenyPaths(home) {
 function generateProfile(workDirs, blockedDirs, ignoredPaths, readOnlyDirs = [], home = "", readOnlyFiles = []) {
 	const blockedRules = sbplDenyBlock("Blocked paths (auto-generated from $HOME contents)", "file*", blockedDirs.map(sbplPathRule));
 	const ignoredRules = sbplDenyBlock("Hidden paths from .bxignore", "file*", ignoredPaths.map(sbplPathRule));
-	const readOnlyRules = sbplDenyBlock("Read-only directories", "file-write*", readOnlyDirs.map(sbplSubpath));
+	const readOnlyRules = sbplDenyBlock("Read-only paths", "file-write*", readOnlyDirs.map(sbplPathRule));
 	const readOnlyFileRules = sbplDenyBlock("Read-only home dotfiles (shell init - write-protected against injection)", "file-write*", readOnlyFiles.map(sbplLiteral));
 	const systemRules = home ? sbplDenyBlock("System-level restrictions", "file*", collectSystemDenyPaths(home).map(sbplSubpath)) : "";
 	return `; Auto-generated sandbox profile
@@ -1623,8 +1623,8 @@ Configuration:
                        built-in apps (code, xcode) can be overridden
   ~/.bxignore          sandbox rules (one per line):
                          path         block access (deny)
-                         rw:path      allow read-write access
-                         ro:path      allow read-only access
+                         rw:path      allow read-write access (overrides built-in protection)
+                         ro:path      allow read-only access (overrides built-in protection)
   <workdir>/.bxignore  blocked paths in project (.gitignore-style matching)
                          / or .         self-protect: block entire directory
   <dir>/.bxprotect     marker file: block the containing directory
@@ -1699,7 +1699,7 @@ function printDryRunTree({ home, blockedDirs, ignoredPaths, readOnlyDirs, workDi
 }
 //#endregion
 //#region src/index.ts
-const VERSION = "1.3.0";
+const VERSION = "1.4.0";
 const __dirname = dirname(fileURLToPath(import.meta.url));
 if (process$1.argv.includes("--version") || process$1.argv.includes("-v")) {
 	console.log(`bx ${VERSION}`);
@@ -1748,9 +1748,10 @@ async function main() {
 	const profileSandbox = vscodeUserFlag !== false ? vscodeUserFlag : app?.profile ?? false;
 	if (profileSandbox) await setupVSCodeProfile(HOME, profileSandbox);
 	const { allowed, readOnly } = parseHomeConfig(HOME, workDirs);
-	const blockedDirs = collectBlockedDirs(HOME, HOME, __dirname, new Set([...allowed, ...readOnly]));
-	const ignoredPaths = collectIgnoredPaths(HOME, workDirs);
-	const readOnlyDotfiles = collectReadOnlyDotfiles(HOME);
+	const allAccessible = new Set([...allowed, ...readOnly]);
+	const blockedDirs = collectBlockedDirs(HOME, HOME, __dirname, allAccessible);
+	const ignoredPaths = collectIgnoredPaths(HOME, workDirs, allAccessible);
+	const readOnlyDotfiles = collectReadOnlyDotfiles(HOME, allAccessible);
 	printPolicySummary(mode, workDirs, blockedDirs, ignoredPaths, readOnly);
 	const profile = generateProfile(workDirs, blockedDirs, ignoredPaths, [...readOnly], HOME, readOnlyDotfiles);
 	if (verbose) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bx-mac",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "description": "Sandbox any macOS app — only your project directory stays accessible",
   "type": "module",
   "bin": {