opencode-landstrip 0.19.4 → 0.19.7

package/README.md

@@ -30,6 +30,13 @@ Arrays combine; later scalar values win. Defaults allow project writes, deny
 sensitive-file writes, and block network access. Enabled sandboxing fails closed
 on unusable binaries/platforms; `enabled: false` explicitly permits unsandboxed Bash.
 
+- `filesystem.denyReadAlways` cannot be overridden by equal/nested read grants
+  and blocks promptable reads on those paths. Non-empty `denyReadAlways` is
+  unsupported on Windows.
+- `filesystem.denyWriteAlways` cannot be overridden by equal/nested write grants
+  and blocks promptable writes on those paths. Non-empty `denyWriteAlways` is
+  unsupported on Windows.
+
 See [landstrip(1)](../landstrip/man/man1/landstrip.1) for native CLI/policy semantics.
 Runtime seccomp traps/query approval are Linux-only. Native macOS `--trap` reports
 setup/launch errors only and closes on successful exec—not runtime violations.

package/index.ts

@@ -10,39 +10,38 @@ import { type AddressInfo, connect as connectNet, createServer } from 'node:net'
 import { tmpdir } from 'node:os';
 import { basename, join } from 'node:path';
 
-import { startFilterProxy } from '@landstrip/landstrip-api/proxy';
+import {
+  createProxyCredentials,
+  createProxyEnvironment,
+  startFilterProxy,
+} from '@landstrip/landstrip-api/proxy';
 
 import {
   type LandstripTrap,
   type SandboxConfig,
-  type SandboxFilesystemConfig,
   allowsAllDomains,
-  canonicalizeGlobPattern,
   canonicalizePath,
   controlResponseLine,
   decodeLandstripTrap,
-  domainMatchesAny,
+  evaluateDomainAccess,
+  evaluateReadAccess,
+  evaluateWriteAccess,
   extractDomainsFromCommand,
+  extractDeniedPath,
   formatLandstripTraps,
   getConfigPaths,
-  globToRegExp,
+  isDomainAllowed,
   isRecord,
+  buildLandstripPolicy,
   landstripBinaryPath,
   loadConfig,
   normalizeOptions,
-  normalizePathSeparators,
   parseLandstripTraps,
   readDiscoveryPort,
+  serializeLandstripPolicy,
   trapSessionHelloLine,
 } from './shared.js';
 
-type LandstripPolicy = {
-  network: Omit<SandboxConfig['network'], 'allowedDomains' | 'deniedDomains'> & {
-    httpProxyPort?: number;
-  };
-  filesystem: SandboxFilesystemConfig;
-};
-
 interface BashSandboxState {
   originalCommand: string;
   wrappedCommand: string;
@@ -72,148 +71,6 @@ const REQUIRED_LANDSTRIP_VERSION = LANDSTRIP_VERSION.join('.');
 const SUPPORTED_PLATFORMS = new Set<NodeJS.Platform>(['linux', 'darwin', 'win32']);
 const DISCOVERY_CONNECT_TIMEOUT_MS = 250;
 
-function normalizePathForMatch(filePath: string): string {
-  return process.platform === 'win32' ? normalizePathSeparators(filePath).toLowerCase() : filePath;
-}
-
-// Component count of an absolute path; "/" is 0. Read rules use it to rank
-// matching allow and deny patterns by specificity.
-function pathDepth(absolutePath: string): number {
-  return absolutePath.split('/').filter((segment) => segment.length > 0).length;
-}
-
-// The depth of the most specific pattern that matches `filePath`, or -1 when
-// none match. A glob is anchored to the whole path, so it ranks at the path's
-// own depth; a literal pattern ranks at the depth of the prefix it covers.
-function matchDepth(filePath: string, patterns: string[], baseDirectory: string): number {
-  const abs = normalizePathForMatch(canonicalizePath(filePath, baseDirectory));
-  let depth = -1;
-
-  for (const pattern of patterns) {
-    if (/[*?[\]]/.test(pattern)) {
-      const absPattern = normalizePathForMatch(canonicalizeGlobPattern(pattern, baseDirectory));
-      if (globToRegExp(absPattern).test(abs)) depth = Math.max(depth, pathDepth(abs));
-    } else {
-      const absPattern = normalizePathForMatch(canonicalizePath(pattern, baseDirectory));
-      const separator = absPattern.endsWith('/') ? '' : '/';
-      if (abs === absPattern || abs.startsWith(absPattern + separator)) {
-        depth = Math.max(depth, pathDepth(absPattern));
-      }
-    }
-  }
-
-  return depth;
-}
-
-function resolveFilesystemPatterns(patterns: string[], baseDirectory: string): string[] {
-  return patterns.map((pattern) =>
-    /[*?[\]]/.test(pattern)
-      ? canonicalizeGlobPattern(pattern, baseDirectory)
-      : canonicalizePath(pattern, baseDirectory),
-  );
-}
-
-function resolveFilesystemConfig(
-  config: SandboxFilesystemConfig,
-  baseDirectory: string,
-): SandboxFilesystemConfig {
-  return {
-    denyRead: resolveFilesystemPatterns(config.denyRead, baseDirectory),
-    allowRead: resolveFilesystemPatterns(config.allowRead, baseDirectory),
-    allowWrite: resolveFilesystemPatterns(config.allowWrite, baseDirectory),
-    denyWrite: resolveFilesystemPatterns(config.denyWrite, baseDirectory),
-  };
-}
-
-function isDomainAllowed(domain: string, config: SandboxConfig): boolean {
-  return (
-    config.network.allowNetwork ||
-    (!domainMatchesAny(domain, config.network.deniedDomains) &&
-      domainMatchesAny(domain, config.network.allowedDomains))
-  );
-}
-
-function isReadAllowed(
-  path: string,
-  allowPatterns: string[],
-  denyPatterns: string[],
-  baseDirectory: string,
-): boolean {
-  const allowDepth = matchDepth(path, allowPatterns, baseDirectory);
-  const denyDepth = matchDepth(path, denyPatterns, baseDirectory);
-  return allowDepth >= 0 && allowDepth >= denyDepth;
-}
-
-function writeAccess(
-  path: string,
-  allowPatterns: string[],
-  denyPatterns: string[],
-  baseDirectory: string,
-): 'allow' | 'deny' | 'unlisted' {
-  if (matchDepth(path, denyPatterns, baseDirectory) >= 0) return 'deny';
-  return matchDepth(path, allowPatterns, baseDirectory) >= 0 ? 'allow' : 'unlisted';
-}
-
-function extractCandidatePaths(command: string): string[] {
-  const paths: string[] = [];
-  const tokens = command.match(/[^\s"']+|"[^"]*"|'[^']*'/g) ?? [];
-  for (const token of tokens) {
-    const clean = token.replace(/^["']|["']$/g, '').replace(/[,;]$/, '');
-    if (
-      clean.startsWith('/') ||
-      clean.startsWith('~/') ||
-      clean === '~' ||
-      clean.startsWith('./') ||
-      clean.startsWith('../')
-    ) {
-      paths.push(clean);
-    }
-  }
-  return paths;
-}
-
-function extractBlockedPath(
-  output: string,
-  baseDirectory: string,
-  command?: string,
-): string | null {
-  // bash/sh: line X: /path: Permission denied
-  let match = output.match(
-    /(?:\/bin\/bash|bash|sh): (?:line \d+: )?([^:\n]+): (?:Operation not permitted|Permission denied)/,
-  );
-  if (match?.[1]) return canonicalizePath(match[1], baseDirectory);
-
-  // ls/cat/cp: cannot open/access/stat '/path': Permission denied
-  match = output.match(
-    /^[a-zA-Z0-9_-]+: cannot (?:open|access|stat|create)(?: directory)? '?([^'\n]+?)'?(?: for (?:reading|writing))?: Permission denied$/m,
-  );
-  if (match?.[1]) return canonicalizePath(match[1], baseDirectory);
-
-  // Generic: cmd: /absolute/path: Permission denied or Operation not permitted
-  match = output.match(
-    /^[a-zA-Z0-9_-]+: (\/[^\n:]+): (?:Operation not permitted|Permission denied)$/m,
-  );
-  if (match?.[1]) return canonicalizePath(match[1], baseDirectory);
-
-  // Landstrip structured trap format carrying a denied path
-  const landstripTraps = parseLandstripTraps(output);
-  for (const trap of landstripTraps) {
-    if (trap.kind === 'filesystem') return canonicalizePath(trap.path, baseDirectory);
-  }
-
-  if (
-    landstripTraps.some((trap) => trap.kind === 'filesystem' || trap.kind === 'internal') &&
-    command
-  ) {
-    for (const candidate of extractCandidatePaths(command)) {
-      const resolved = canonicalizePath(candidate, baseDirectory);
-      return resolved;
-    }
-  }
-
-  return null;
-}
-
 function evaluateReadPermission(
   path: string,
   config: SandboxConfig,
@@ -221,13 +78,22 @@ function evaluateReadPermission(
   effectiveAllowRead: string[],
 ): SandboxPermissionDecision {
   const filePath = canonicalizePath(path, baseDirectory);
+  const decision = evaluateReadAccess(filePath, config.filesystem, {
+    baseDirectory,
+    allowReadOverrides: effectiveAllowRead,
+    requireAllowMatch: true,
+  });
+
+  if (decision === 'deny') {
+    return {
+      status: 'deny',
+      kind: 'read',
+      resource: filePath,
+      message: `Sandbox: read access denied for "${filePath}" (denyReadAlways).`,
+    };
+  }
 
-  // Reads are interactive, so the read tool never hard-denies: a path covered by
-  // allowRead at least as specifically as any denyRead is allowed silently;
-  // everything else asks for approval (allow once/session/persist or reject)
-  // rather than being blocked outright. denyRead still hard-applies to bash
-  // through the landstrip binary policy, which has no way to prompt.
-  if (isReadAllowed(filePath, effectiveAllowRead, config.filesystem.denyRead, baseDirectory)) {
+  if (decision === 'allow') {
     return { status: 'allow', kind: 'read', resource: filePath, message: '' };
   }
 
@@ -246,14 +112,21 @@ function evaluateWritePermission(
   effectiveAllowWrite: string[],
 ): SandboxPermissionDecision {
   const filePath = canonicalizePath(path, baseDirectory);
-  const access = writeAccess(
-    filePath,
-    effectiveAllowWrite,
-    config.filesystem.denyWrite,
+  const decision = evaluateWriteAccess(filePath, config.filesystem, {
     baseDirectory,
-  );
+    allowWriteOverrides: effectiveAllowWrite,
+  });
 
-  if (access === 'deny') {
+  if (decision === 'denyAlways') {
+    return {
+      status: 'deny',
+      kind: 'write',
+      resource: filePath,
+      message: `Sandbox: write access denied for "${filePath}" (denyWriteAlways).`,
+    };
+  }
+
+  if (decision === 'deny') {
     return {
       status: 'deny',
       kind: 'write',
@@ -262,7 +135,7 @@ function evaluateWritePermission(
     };
   }
 
-  if (access === 'allow') {
+  if (decision === 'allow') {
     return { status: 'allow', kind: 'write', resource: filePath, message: '' };
   }
 
@@ -278,11 +151,9 @@ function evaluateDomainPermission(
   domain: string,
   config: SandboxConfig,
 ): SandboxPermissionDecision {
-  if (config.network.allowNetwork) {
-    return { status: 'allow', kind: 'domain', resource: domain, message: '' };
-  }
+  const decision = evaluateDomainAccess(domain, config.network);
 
-  if (domainMatchesAny(domain, config.network.deniedDomains)) {
+  if (decision === 'deny') {
     return {
       status: 'deny',
       kind: 'domain',
@@ -291,7 +162,7 @@ function evaluateDomainPermission(
     };
   }
 
-  if (isDomainAllowed(domain, config)) {
+  if (decision === 'allow') {
     return { status: 'allow', kind: 'domain', resource: domain, message: '' };
   }
 
@@ -334,23 +205,6 @@ function hasMinimumVersion(version: string, minimum: readonly [number, number, n
   return true;
 }
 
-function buildLandstripPolicy(
-  config: SandboxConfig,
-  baseDirectory: string,
-  proxyPort: number | null,
-): LandstripPolicy {
-  return {
-    network: {
-      allowNetwork: config.network.allowNetwork,
-      allowLocalBinding: config.network.allowLocalBinding,
-      allowAllUnixSockets: config.network.allowAllUnixSockets,
-      allowUnixSockets: config.network.allowUnixSockets,
-      ...(proxyPort !== null ? { httpProxyPort: proxyPort } : {}),
-    },
-    filesystem: resolveFilesystemConfig(config.filesystem, baseDirectory),
-  };
-}
-
 function writePolicyFile(
   config: SandboxConfig,
   baseDirectory: string,
@@ -360,7 +214,14 @@ function writePolicyFile(
   const path = join(dir, 'policy.json');
   writeFileSync(
     path,
-    JSON.stringify(buildLandstripPolicy(config, baseDirectory, proxyPort), null, 2) + '\n',
+    serializeLandstripPolicy(
+      buildLandstripPolicy({
+        network: config.network,
+        filesystem: config.filesystem,
+        baseDirectory,
+        httpProxyPort: proxyPort,
+      }),
+    ),
   );
 
   return { dir, path };
@@ -371,19 +232,7 @@ function proxyEnv(
   proxyToken?: string | null,
 ): Record<string, string> | undefined {
   if (port === null) return undefined;
-  const credentials = proxyToken ? `landstrip:${proxyToken}@` : '';
-  const url = `http://${credentials}127.0.0.1:${port}`;
-
-  return {
-    HTTP_PROXY: url,
-    HTTPS_PROXY: url,
-    ALL_PROXY: url,
-    http_proxy: url,
-    https_proxy: url,
-    all_proxy: url,
-    NO_PROXY: '',
-    no_proxy: '',
-  };
+  return createProxyEnvironment(port, proxyToken) as Record<string, string>;
 }
 
 function shellQuote(value: string): string {
@@ -406,6 +255,8 @@ function startTrapServer(
   denyRead: string[],
   denyWrite: string[],
   baseDirectory: string,
+  denyReadAlways: string[] = [],
+  denyWriteAlways: string[] = [],
 ): Promise<{ server: ReturnType<typeof createServer>; port: number; trapLines: string[] }> {
   const trapLines: string[] = [];
   const server = createServer((trapSocket) => {
@@ -435,8 +286,16 @@ function startTrapServer(
             const operation = trap.operation;
             const allowed =
               operation === 'read'
-                ? isReadAllowed(path, effectiveAllowRead, denyRead, baseDirectory)
-                : writeAccess(path, effectiveAllowWrite, denyWrite, baseDirectory) === 'allow';
+                ? evaluateReadAccess(
+                    path,
+                    { allowRead: effectiveAllowRead, denyRead, denyReadAlways },
+                    { baseDirectory, requireAllowMatch: true },
+                  ) === 'allow'
+                : evaluateWriteAccess(
+                    path,
+                    { allowWrite: effectiveAllowWrite, denyWrite, denyWriteAlways },
+                    { baseDirectory },
+                  ) === 'allow';
             if (allowed) {
               trapSocket.write(controlResponseLine(queryId, 'allow'));
             } else {
@@ -826,16 +685,13 @@ const plugin: Plugin.Plugin = {
         }
       }
 
-      const proxyToken = allowNetwork ? null : randomBytes(32).toString('base64url');
-      const proxyAuthorization =
-        proxyToken === null
-          ? undefined
-          : `Basic ${Buffer.from(`landstrip:${proxyToken}`).toString('base64')}`;
+      const proxyCredentials = allowNetwork ? null : createProxyCredentials();
+      const proxyToken = proxyCredentials ? proxyCredentials.token : null;
       const proxy = allowNetwork
         ? null
         : await startFilterProxy({
             isDomainAllowed: (domain) => isDomainAllowed(domain, config),
-            ...(proxyAuthorization === undefined ? {} : { authorization: proxyAuthorization }),
+            ...(proxyCredentials ? { authorization: proxyCredentials.authorization } : {}),
           });
       const proxyPort = proxy ? proxy.port : null;
       let policy: { dir: string; path: string };
@@ -866,6 +722,8 @@ const plugin: Plugin.Plugin = {
               config.filesystem.denyRead,
               config.filesystem.denyWrite,
               directory,
+              config.filesystem.denyReadAlways,
+              config.filesystem.denyWriteAlways,
             )
           : null;
       const trapPort = tuiTrapPort ?? trapServer?.port ?? null;
@@ -910,11 +768,13 @@ const plugin: Plugin.Plugin = {
       const effectiveAllowWrite = config.filesystem.allowWrite;
       const args: Record<string, unknown> = { ...evaluation.metadata };
       if (action === 'read' || action === 'external_directory') args.paths = patterns;
-      if (action === 'edit') {
+      if (action === 'write' || action === 'edit') {
         args.paths =
           patterns.length > 0
             ? patterns
-            : [args.filepath].filter((path): path is string => typeof path === 'string');
+            : [args.filepath ?? args.path].filter(
+                (path): path is string => typeof path === 'string',
+              );
       }
       if ((action === 'shell' || action === 'bash') && typeof args.command !== 'string') {
         args.command = patterns[0];
@@ -1037,7 +897,7 @@ const plugin: Plugin.Plugin = {
       );
       const blockedPath = blockedTrap
         ? canonicalizePath(blockedTrap.path, directory)
-        : extractBlockedPath(outputText, directory, state.originalCommand);
+        : extractDeniedPath(outputText, { cwd: directory, command: state.originalCommand });
       if (blockedPath) {
         const blockedOperation = blockedTrap?.operation ?? 'read';
         await notifyOnce(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-landstrip",
-  "version": "0.19.4",
+  "version": "0.19.7",
   "description": "OS-level AI command sandboxing for OpenCode with Landstrip",
   "keywords": [
     "landlock",
@@ -48,7 +48,7 @@
     "ci:test": "npm test"
   },
   "dependencies": {
-    "@landstrip/landstrip-api": "^0.19.4",
+    "@landstrip/landstrip-api": "^0.19.7",
     "@opentui/core": ">=0.5.12",
     "@opentui/solid": ">=0.5.12",
     "solid-js": "1.9.12"
@@ -57,7 +57,7 @@
     "@opencode/plugin": "^2.0.18",
     "@opencode/theme": "^2.0.18",
     "@types/node": "^26.1.1",
-    "oxfmt": "^0.68.0",
+    "oxfmt": "^0.71.0",
     "oxlint": "^1.68.0",
     "typescript": "^5.9.3"
   },

package/sandbox.json

@@ -10,6 +10,7 @@
   },
   "filesystem": {
     "denyRead": ["/Users", "/home"],
+    "denyReadAlways": [],
     "allowRead": [".", "~/.gitconfig", "~/.config/git/config", "/dev/null"],
     "allowWrite": [".", "/dev/null"],
     "denyWrite": [
@@ -19,6 +20,7 @@
       "**/*.key",
       ".opencode/sandbox.json",
       "~/.config/opencode/sandbox.json"
-    ]
+    ],
+    "denyWriteAlways": []
   }
 }

package/shared.ts

@@ -2,10 +2,23 @@
 // Copyright (C) Jarkko Sakkinen 2026
 
 import { binaryPath } from '@landstrip/landstrip-api';
-import { isRecord } from '@landstrip/landstrip-api/shared';
-
-export type { LandstripControlResponse, LandstripTrap } from '@landstrip/landstrip-api';
+import {
+  deepMergeSandboxConfig,
+  extractDomainsFromCommand,
+  isRecord,
+  parseSandboxConfig,
+} from '@landstrip/landstrip-api/shared';
+import type { SandboxConfig, SandboxConfigOverrides } from '@landstrip/landstrip-api/shared';
+
+export type {
+  LandstripControlResponse,
+  LandstripFilesystemPolicy,
+  LandstripNetworkPolicy,
+  LandstripPolicy,
+  LandstripTrap,
+} from '@landstrip/landstrip-api';
 export {
+  buildLandstripPolicy,
   allowsAllDomains,
   canonicalizeGlobPattern,
   canonicalizePath,
@@ -22,8 +35,39 @@ export {
   normalizePathSeparators,
   parseLandstripTraps,
   pathUnderDirectory,
+  resolveFilesystemPatterns,
+  resolveFilesystemPolicy,
   sessionAllows,
   sessionScopeFor,
+  serializeLandstripPolicy,
+  deepMergeSandboxConfig,
+  mergeArray,
+  parseSandboxConfig,
+  matchesPathPattern,
+  matchPathSpecificity,
+  isPathReadAllowed,
+  isPathWriteAllowed,
+  shouldPromptForWrite,
+  evaluateReadAccess,
+  evaluateWriteAccess,
+  isDomainAllowed,
+  evaluateDomainAccess,
+  extractDomainsFromCommand,
+  extractCandidatePaths,
+  extractNativeDeniedPath,
+  extractDeniedPath,
+  type PathAccessDecision,
+  type DomainAccessDecision,
+  type EvaluateReadOptions,
+  type EvaluateWriteOptions,
+  type EvaluateDomainOptions,
+  type SandboxConfig,
+  type SandboxConfigFile,
+  type SandboxConfigOverrides,
+  type SandboxFilesystemConfig,
+  type SandboxNetworkConfig,
+  type SandboxShellConfig,
+  type SandboxWindowsConfig,
 } from '@landstrip/landstrip-api/shared';
 
 import { createHash } from 'node:crypto';
@@ -32,34 +76,6 @@ import { homedir, tmpdir } from 'node:os';
 import { fileURLToPath } from 'node:url';
 import { dirname, join } from 'node:path';
 
-export interface SandboxFilesystemConfig {
-  denyRead: string[];
-  allowRead: string[];
-  allowWrite: string[];
-  denyWrite: string[];
-}
-
-export interface SandboxNetworkConfig {
-  allowNetwork: boolean;
-  allowLocalBinding: boolean;
-  allowAllUnixSockets: boolean;
-  allowUnixSockets: string[];
-  allowedDomains: string[];
-  deniedDomains: string[];
-}
-
-export interface SandboxConfig {
-  enabled: boolean;
-  network: SandboxNetworkConfig;
-  filesystem: SandboxFilesystemConfig;
-}
-
-export interface SandboxConfigOverrides {
-  enabled?: boolean;
-  network?: Partial<SandboxNetworkConfig>;
-  filesystem?: Partial<SandboxFilesystemConfig>;
-}
-
 const packageDir = dirname(fileURLToPath(import.meta.url));
 
 const LANDSTRIP_PACKAGE_NAMES = new Set([
@@ -72,105 +88,8 @@ const LANDSTRIP_PACKAGE_NAMES = new Set([
   '@landstrip/landstrip-win32-arm64',
 ]);
 
-function rejectUnknownFields(
-  value: Record<string, unknown>,
-  fields: readonly string[],
-  prefix = '',
-): void {
-  for (const field of Object.keys(value)) {
-    if (!fields.includes(field)) throw new Error(`unknown sandbox field ${prefix}${field}`);
-  }
-}
-
-function booleanValue(value: unknown, field: string): boolean | undefined {
-  if (value === undefined) return undefined;
-  if (typeof value !== 'boolean') throw new Error(`${field} must be a boolean`);
-  return value;
-}
-
-function stringArray(value: unknown, field: string): string[] | undefined {
-  if (value === undefined) return undefined;
-  if (!Array.isArray(value) || [...value].some((item) => typeof item !== 'string')) {
-    throw new Error(`${field} must be an array of strings`);
-  }
-  return [...value];
-}
-
-function normalizeNetworkConfig(value: unknown): Partial<SandboxNetworkConfig> | undefined {
-  if (value === undefined) return undefined;
-  if (!isRecord(value)) throw new Error('network must be an object');
-  rejectUnknownFields(
-    value,
-    [
-      'allowNetwork',
-      'allowLocalBinding',
-      'allowAllUnixSockets',
-      'allowUnixSockets',
-      'allowedDomains',
-      'deniedDomains',
-    ],
-    'network.',
-  );
-
-  const config: Partial<SandboxNetworkConfig> = {};
-  const allowNetwork = booleanValue(value.allowNetwork, 'network.allowNetwork');
-  if (allowNetwork !== undefined) config.allowNetwork = allowNetwork;
-  const allowLocalBinding = booleanValue(value.allowLocalBinding, 'network.allowLocalBinding');
-  if (allowLocalBinding !== undefined) config.allowLocalBinding = allowLocalBinding;
-  const allowAllUnixSockets = booleanValue(
-    value.allowAllUnixSockets,
-    'network.allowAllUnixSockets',
-  );
-  if (allowAllUnixSockets !== undefined) config.allowAllUnixSockets = allowAllUnixSockets;
-
-  const allowUnixSockets = stringArray(value.allowUnixSockets, 'network.allowUnixSockets');
-  if (allowUnixSockets) config.allowUnixSockets = allowUnixSockets;
-
-  const allowedDomains = stringArray(value.allowedDomains, 'network.allowedDomains');
-  if (allowedDomains) config.allowedDomains = allowedDomains;
-
-  const deniedDomains = stringArray(value.deniedDomains, 'network.deniedDomains');
-  if (deniedDomains) config.deniedDomains = deniedDomains;
-
-  return config;
-}
-
-function normalizeFilesystemConfig(value: unknown): Partial<SandboxFilesystemConfig> | undefined {
-  if (value === undefined) return undefined;
-  if (!isRecord(value)) throw new Error('filesystem must be an object');
-  rejectUnknownFields(value, ['denyRead', 'allowRead', 'allowWrite', 'denyWrite'], 'filesystem.');
-
-  const config: Partial<SandboxFilesystemConfig> = {};
-  const denyRead = stringArray(value.denyRead, 'filesystem.denyRead');
-  if (denyRead) config.denyRead = denyRead;
-
-  const allowRead = stringArray(value.allowRead, 'filesystem.allowRead');
-  if (allowRead) config.allowRead = allowRead;
-
-  const allowWrite = stringArray(value.allowWrite, 'filesystem.allowWrite');
-  if (allowWrite) config.allowWrite = allowWrite;
-
-  const denyWrite = stringArray(value.denyWrite, 'filesystem.denyWrite');
-  if (denyWrite) config.denyWrite = denyWrite;
-
-  return config;
-}
-
 export function normalizeConfig(value: unknown): SandboxConfigOverrides {
-  if (!isRecord(value)) throw new Error('sandbox config must be an object');
-  rejectUnknownFields(value, ['enabled', 'network', 'filesystem']);
-
-  const config: SandboxConfigOverrides = {};
-  const enabled = booleanValue(value.enabled, 'enabled');
-  if (enabled !== undefined) config.enabled = enabled;
-
-  const network = normalizeNetworkConfig(value.network);
-  if (network) config.network = network;
-
-  const filesystem = normalizeFilesystemConfig(value.filesystem);
-  if (filesystem) config.filesystem = filesystem;
-
-  return config;
+  return parseSandboxConfig(value);
 }
 
 export function normalizeOptions(options: unknown): SandboxConfigOverrides {
@@ -180,32 +99,8 @@ export function normalizeOptions(options: unknown): SandboxConfigOverrides {
   return normalizeConfig(options.config);
 }
 
-function mergeArray(base: string[], override?: string[]): string[] {
-  if (!override) return base;
-  return [...new Set([...base, ...override])];
-}
-
 export function deepMerge(base: SandboxConfig, overrides: SandboxConfigOverrides): SandboxConfig {
-  const network = overrides.network;
-  const filesystem = overrides.filesystem;
-
-  return {
-    enabled: overrides.enabled ?? base.enabled,
-    network: {
-      allowNetwork: network?.allowNetwork ?? base.network.allowNetwork,
-      allowLocalBinding: network?.allowLocalBinding ?? base.network.allowLocalBinding,
-      allowAllUnixSockets: network?.allowAllUnixSockets ?? base.network.allowAllUnixSockets,
-      allowUnixSockets: mergeArray(base.network.allowUnixSockets, network?.allowUnixSockets),
-      allowedDomains: mergeArray(base.network.allowedDomains, network?.allowedDomains),
-      deniedDomains: mergeArray(base.network.deniedDomains, network?.deniedDomains),
-    },
-    filesystem: {
-      denyRead: mergeArray(base.filesystem.denyRead, filesystem?.denyRead),
-      allowRead: mergeArray(base.filesystem.allowRead, filesystem?.allowRead),
-      allowWrite: mergeArray(base.filesystem.allowWrite, filesystem?.allowWrite),
-      denyWrite: mergeArray(base.filesystem.denyWrite, filesystem?.denyWrite),
-    },
-  };
+  return deepMergeSandboxConfig(base, overrides);
 }
 
 export function getConfigPaths(baseDirectory: string): { globalPath: string; projectPath: string } {
@@ -298,18 +193,6 @@ export function landstripBinaryPath(): string {
   }
 }
 
-export function extractDomainsFromCommand(command: string): string[] {
-  const urlRegex = /https?:\/\/([^\s/:?#'"]+)(?::\d+)?(?:[/?#]|\s|$)/g;
-  const domains = new Set<string>();
-  let match: RegExpExecArray | null;
-
-  while ((match = urlRegex.exec(command)) !== null) {
-    if (match[1]) domains.add(match[1]);
-  }
-
-  return [...domains];
-}
-
 // Permission requests reach the plugin in slightly different shapes across the
 // server hook and the TUI event bus, so the field-fallback parsing below is the
 // single source of truth both entrypoints share.

package/tui.ts

@@ -797,8 +797,10 @@ const tui: TuiPlugin.Definition = {
               row('Denied Domains', values(config.network.deniedDomains)),
               row('Allowed Reads', values(config.filesystem.allowRead)),
               row('Denied Reads', values(config.filesystem.denyRead)),
+              row('Always Denied Reads', values(config.filesystem.denyReadAlways)),
               row('Allowed Writes', values(config.filesystem.allowWrite)),
               row('Denied Writes', values(config.filesystem.denyWrite)),
+              row('Always Denied Writes', values(config.filesystem.denyWriteAlways)),
               row(
                 'Configuration Scope',
                 enabledManagedByOptions