pi-better-background-tasks 0.6.0 → 0.6.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-better-background-tasks",
-  "version": "0.6.0",
+  "version": "0.6.2",
   "description": "Pi extension for durable background shell tasks, watchers, logs, and status inspection.",
   "license": "MIT",
   "type": "module",

package/src/shared-sandbox-core.ts

@@ -228,10 +228,7 @@ const CREDENTIAL_LOCATIONS = [
     ".docker/config.json", ".npmrc", ".netrc", ".git-credentials", ".pi/agent/auth.json",
 ] as const;
 
-/**
- * Credential stores added by the broad-write profile. They are never readable
- * or writable there, whatever the Stored credentials row says.
- */
+/** Credential stores added to the Stored credentials row by the broad-write profile. */
 const BROAD_CREDENTIAL_LOCATIONS = [
     "Library/Keychains", ".claude/.credentials.json", ".claude.json", ".gnupg",
     ".codex/auth.json", ".cargo/credentials.toml", ".cargo/credentials", ".pgpass", ".config/rclone",
@@ -386,10 +383,7 @@ function compile(
     return {
         writableRoot, denyWrite, home: policy.home,
         ...(policy.permissions && {
-            // The broad-write profile's credential deny list is not optional.
-            permissions: broadMode
-                ? { ...policy.permissions, storedCredentials: "off" as const }
-                : { ...policy.permissions },
+            permissions: { ...policy.permissions },
             credentialPaths: broadMode ? broadCredentialPaths(policy.home, seams) : credentialFilePaths(policy.home, seams),
             compatibilityWrite,
             runtimeWrite,
@@ -552,50 +546,18 @@ function contains(root: string, target: string): boolean {
     return target.startsWith(root.endsWith(sep) ? root : `${root}${sep}`);
 }
 
-/** Per-device answer to "does this volume fold case?" (APFS/HFS+ default). */
-const caseFoldingByDevice = new Map<number, boolean>();
-
-/**
- * Whether the volume holding `path` (its nearest existing ancestor) ignores
- * case: an existing component whose case-swapped spelling names the same
- * inode proves it. macOS only; false whenever it cannot be shown.
- */
-function caseInsensitiveVolume(path: string): boolean {
-    if (process.platform !== "darwin") return false;
-    let current = path;
-    while (!existsSync(current) && dirname(current) !== current) current = dirname(current);
-    let device: number;
-    try { device = statSync(current).dev; } catch { return false; }
-    const known = caseFoldingByDevice.get(device);
-    if (known !== undefined) return known;
-    for (let probe = current; dirname(probe) !== probe; probe = dirname(probe)) {
-        const name = basename(probe);
-        const swapped = [...name].map((c) => c === c.toLowerCase() ? c.toUpperCase() : c.toLowerCase()).join("");
-        if (swapped === name) continue;
-        try {
-            const original = statSync(probe);
-            if (original.dev !== device) break;
-            let folded = false;
-            try {
-                const other = statSync(join(dirname(probe), swapped));
-                folded = other.dev === original.dev && other.ino === original.ino;
-            } catch { /* The swapped name is absent: case-sensitive. */ }
-            caseFoldingByDevice.set(device, folded);
-            return folded;
-        } catch { return false; }
-    }
-    return false;
-}
-
 /**
- * Spell `path` the way the policy spells it when they differ only in case on a
- * case-insensitive volume. `canonicalizePath` fixes the case of every existing
- * component, but a missing tail (`~/.NPMRC` while `~/.npmrc` is absent) keeps
- * the caller's case, and the kernel still treats it as the protected name. The
- * longest policy path that matches case-insensitively wins, so the pre-check
- * decides as the kernel does (#354).
+ * Spell `path` the way the policy spells it when they differ only in case, on
+ * macOS. `canonicalizePath` fixes the case of every existing component on a
+ * case-insensitive volume, but a missing tail (`~/.NPMRC` while `~/.npmrc` is
+ * absent) keeps the caller's case, and the kernel still treats it as the
+ * protected name. Seatbelt matches paths case-insensitively on every volume,
+ * case-sensitive APFS included, so this folds on darwin without probing the
+ * volume: the pre-check decides as the kernel does (#354, #358). The longest
+ * policy path that matches case-insensitively wins. Other platforms never fold.
  */
-function alignCaseToPolicy(path: string, policy: CompiledSandboxWritePolicy): string {
+function alignCaseToPolicy(path: string, policy: CompiledSandboxWritePolicy, seams: SandboxSeams): string {
+    if (currentPlatform(seams) !== "darwin") return path;
     const broad = policy.broad;
     const candidates = [policy.writableRoot, ...policy.denyWrite, ...(policy.credentialPaths ?? []),
         ...(policy.runtimeWrite ?? []), ...(policy.compatibilityWrite ?? []),
@@ -608,8 +570,7 @@ function alignCaseToPolicy(path: string, policy: CompiledSandboxWritePolicy): st
         if (folded.length !== candidate.length || !contains(folded, lower)) continue;
         if (!best || candidate.length > best.length) best = candidate;
     }
-    // Already spelled as the policy spells it: nothing to probe.
-    if (!best || path.startsWith(best) || !caseInsensitiveVolume(path)) return path;
+    if (!best || path.startsWith(best)) return path;
     return `${best}${path.slice(best.length)}`;
 }
 
@@ -627,11 +588,11 @@ export function evaluateReadAccess(
     policy: CompiledSandboxWritePolicy,
     seams: SandboxSeams = {},
 ): ReadAccessDecision {
-    const path = alignCaseToPolicy(canonicalizePath(target, seams), policy);
+    const path = alignCaseToPolicy(canonicalizePath(target, seams), policy, seams);
     const permissions = policy.permissions;
     if (!permissions) return { allowed: true, path };
     if (policy.broad) {
-        const denied = isCredential(path, policy) ||
+        const denied = (isCredential(path, policy) && permissions.storedCredentials === "off") ||
             (permissions.projectFiles === "off" && contains(policy.writableRoot, path));
         return denied ? { allowed: false, path, reason: "read-denied" } : { allowed: true, path };
     }
@@ -654,7 +615,7 @@ export function evaluateWriteAccess(
     policy: CompiledSandboxWritePolicy,
     seams: SandboxSeams = {},
 ): WriteAccessDecision {
-    const path = alignCaseToPolicy(canonicalizePath(target, seams), policy);
+    const path = alignCaseToPolicy(canonicalizePath(target, seams), policy, seams);
     if (policy.broad) return evaluateBroadWrite(path, policy, policy.broad, seams);
     if (!policy.permissions && !contains(policy.writableRoot, path)) {
         return { allowed: false, path, reason: "outside-writable-root" };
@@ -685,7 +646,8 @@ function evaluateBroadWrite(
     for (const denied of [...policy.denyWrite, ...broad.codePaths]) {
         if (contains(denied, path)) return { allowed: false, path, reason: "write-denied", deniedBy: denied };
     }
-    if (isCredential(path, policy)) return { allowed: false, path, reason: "permission-denied" };
+    if (isCredential(path, policy)) return canWrite(policy.permissions!.storedCredentials)
+        ? { allowed: true, path } : { allowed: false, path, reason: "permission-denied" };
     if (policy.runtimeWrite?.some((root) => contains(root, path))) return { allowed: true, path };
     if (contains(policy.writableRoot, path)) {
         return canWrite(policy.permissions!.projectFiles)
@@ -841,7 +803,8 @@ export function resetRecoverySnapshotClock(): void {
 }
 
 function broadProtectedPaths(policy: CompiledSandboxWritePolicy, broad: CompiledBroadWrite): string[] {
-    return [...policy.denyWrite, ...(policy.credentialPaths ?? []), ...broad.codePaths,
+    return [...policy.denyWrite,
+        ...(policy.permissions?.storedCredentials === "read-write" ? [] : policy.credentialPaths ?? []), ...broad.codePaths,
         ...(!canWrite(policy.permissions?.projectFiles) ? [policy.writableRoot] : [])];
 }
 
@@ -960,7 +923,7 @@ function buildBroadProfile(policy: CompiledSandboxWritePolicy, seams: SandboxSea
         `(allow file-write-unlink (regex #"^${home}/(.+/)?[.]worktrees/."))`,
         `(allow file-write-unlink (regex #"^${home}/(.+/)?[^/]+-worktrees/."))`,
     );
-    // The fixed deny list overrides every grant above. A rule naming
+    // Write-denied controls and credentials override every broad grant above. A rule naming
     // `file-write-unlink` outranks a `file-write*` wildcard whatever their
     // order (verified on the real kernel), so each protected path also gets an
     // explicit unlink denial; otherwise the removal grants above would reopen it.
@@ -969,8 +932,8 @@ function buildBroadProfile(policy: CompiledSandboxWritePolicy, seams: SandboxSea
     if (!canWrite(permissions.projectFiles)) denyWrite(project);
     for (const path of broad.codePaths) denyWrite(path);
     for (const path of policy.credentialPaths ?? []) {
-        rules.push(`(deny file-read* (subpath ${sbpl(path)}))`);
-        denyWrite(path);
+        if (permissions.storedCredentials === "off") rules.push(`(deny file-read* (subpath ${sbpl(path)}))`);
+        if (permissions.storedCredentials !== "read-write") denyWrite(path);
     }
     for (const path of policy.denyWrite) denyWrite(path);
     // Renaming an ancestor would move a protected subtree to an unprotected path,
@@ -1383,9 +1346,11 @@ function maskSources(profilePath: string): { directory: string; file: string } {
  * the root is read-only; temp, the workspace, hidden home entries and worktree
  * folders are writable (removal included); ordinary top-level home folders and
  * home itself stay read-only, so sibling repositories cannot even be edited in
- * place there. Credentials are masked by empty mode-000 mounts; code that runs
- * later and caller-denied paths are read-only binds. Every writable bind and
- * protected leaf is a mount point, which Linux refuses to rename. A protected
+ * place there. Off credentials are masked by empty mode-000 mounts, Read
+ * credentials are read-only binds, and Read / write credentials follow the
+ * surrounding broad-write rules. Code that runs later and caller-denied paths
+ * are read-only binds. Every writable bind and protected leaf is a mount point,
+ * which Linux refuses to rename. A protected
  * symlink inside a writable directory (a stow link in `~/.config`) makes that
  * directory read-only with each existing entry bound writable again, so only
  * new top-level entries there are refused.
@@ -1406,14 +1371,15 @@ function buildLinuxBroadCommand(
         throw new Error("Linux bubblewrap cannot separate removal from writing for Project files; use Write & delete or Read.");
     }
     const credentials = policy.credentialPaths ?? [];
+    const protectedCredentials = permissions.storedCredentials === "read-write" ? [] : credentials;
     const writeDenied = [...broad.codePaths, ...policy.denyWrite];
     if (permissions.projectFiles === "read-write" &&
-        [...credentials, ...writeDenied].some((path) => path !== project && contains(path, project))) {
+        [...protectedCredentials, ...writeDenied].some((path) => path !== project && contains(path, project))) {
         throw new Error("Linux bubblewrap cannot make a project writable inside a protected directory.");
     }
     const list = seams.listDirectory ?? systemListDirectory;
     const exists = (path: string) => (seams.pathExists ?? existsSync)(path);
-    const protectedPaths = [...credentials, ...writeDenied];
+    const protectedPaths = [...protectedCredentials, ...writeDenied];
     const insideProtected = (path: string) => protectedPaths.some((guard) => contains(guard, path));
 
     const writable = new Set<string>();
@@ -1531,7 +1497,10 @@ function buildLinuxBroadCommand(
             readOnly.add(path);
         }
     };
-    for (const path of credentials) guard(path, true);
+    for (const path of credentials) {
+        if (permissions.storedCredentials === "off") guard(path, true);
+        else if (permissions.storedCredentials === "read") guard(path, false);
+    }
     for (const path of writeDenied) guard(path, false);
     if (permissions.projectFiles === "read") readOnly.add(project);
 
@@ -1582,7 +1551,7 @@ function buildLinuxBroadCommand(
         fileArgs: [...fileArgs, ...(!permissions.network ? ["--unshare-net"] : []),
             "--", args.execPath, ...args.execArgs],
         ...(created.length && { notices: [
-            `Sandbox: created an empty read-only placeholder where a protected symlink points at nothing, and left it in place: ${created.join(", ")}`,
+            `Sandbox: created an empty read-only placeholder where a protected symlink points at nothing, and left it in place (remove it before creating the real target): ${created.join(", ")}`,
         ] }),
     };
 }