pi-forge 1.4.5 → 1.4.6

package/dist/server/sandbox-permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-permissions.js","sourceRoot":"","sources":["../src/sandbox-permissions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAClE,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAC/B,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAChC,MAAM,eAAe,GAAG,KAAK,CAAC;AAE9B,MAAM,UAAU,yBAAyB;IACvC,OAAO,MAAM,CAAC,gBAAgB,CAAC,OAAO,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,OAAO,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,yBAAyB;IACvC,OAAO,GAAG,MAAM,CAAC,gBAAgB,CAAC,GAAG,IAAI,gBAAgB,EAAE,EAAE,CAAC;AAChE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,IAAY;IACxD,IAAI,CAAC,yBAAyB,EAAE;QAAE,OAAO;IACzC,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,GAAG,GAAG,MAAM,CAAC,gBAAgB,CAAC,GAAI,CAAC;IACzC,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;IAC/B,IAAI,EAAE,CAAC,cAAc,EAAE,EAAE,CAAC;QACxB,IAAI,EAAE,CAAC,GAAG,KAAK,GAAG,IAAI,EAAE,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;YACrC,MAAM,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QAC/B,CAAC;QACD,OAAO;IACT,CAAC;IAED,MAAM,WAAW,GAAG,EAAE,CAAC,IAAI,GAAG,KAAK,CAAC;IACpC,MAAM,WAAW,GAAG,EAAE,CAAC,WAAW,EAAE;QAClC,CAAC,CAAC,WAAW,GAAG,iBAAiB;QACjC,CAAC,CAAC,WAAW,GAAG,gBAAgB,GAAG,CAAC,CAAC,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEzF,wEAAwE;IACxE,yEAAyE;IACzE,2EAA2E;IAC3E,4EAA4E;IAC5E,MAAM,SAAS,GAAG,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACtF,IAAI,SAAS,KAAK,SAAS,IAAI,EAAE,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QACpD,MAAM,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;IACrC,CAAC;SAAM,IAAI,EAAE,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;QAC1B,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAClC,CAAC;IAED,IAAI,WAAW,KAAK,WAAW,EAAE,CAAC;QAChC,MAAM,KAAK,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACjC,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,cAAc,CAAC,GAAG,KAAK,GAAG,IAAI,cAAc,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;QAC7D,MAAM,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,IAAY;IACxD,IAAI,CAAC,yBAAyB,EAAE;QAAE,OAAO;IACzC,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;QACrB,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;QACpC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,uBAAuB,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IACD,MAAM,uBAAuB,CAAC,IAAI,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,IAAY,EAAE,GAAW;IAC/E,IAAI,CAAC,yBAAyB,EAAE;QAAE,OAAO;IACzC,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,GAAG,GAAG,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IAChD,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,GAAG,EAAE,CAAC,EAAE,CAAC;QACrD,MAAM,uBAAuB,CAAC,WAAW,CAAC,CAAC;QAC3C,OAAO;IACT,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,OAAO,GAAG,YAAY,CAAC;IAC3B,MAAM,+BAA+B,CAAC,OAAO,CAAC,CAAC;IAC/C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC9B,MAAM,+BAA+B,CAAC,OAAO,CAAC,CAAC;IACjD,CAAC;AACH,CAAC;AAED,KAAK,UAAU,+BAA+B,CAAC,IAAY;IACzD,MAAM,uBAAuB,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAA0B,EAAE,EAAE;QACvE,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,GAAG,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,IAAY,EAAE,IAAY;IAC7E,MAAM,iCAAiC,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/D,CAAC"}

package/dist/server/sandbox-startup-permissions.js

@@ -1,6 +1,7 @@
-import { lchown, lstat, readdir } from "node:fs/promises";
+import { lstat, readdir } from "node:fs/promises";
 import { relative, resolve, sep } from "node:path";
 import { config } from "./config.js";
+import { applySandboxPathHandoff, sandboxHandoffDescription } from "./sandbox-permissions.js";
 const PI_CONFIG_RESOURCE_DIRS = ["skills", "npm", "git", "extensions", "prompts", "themes"];
 function isSameOrInside(parent, candidate) {
     const rel = relative(parent, candidate);
@@ -22,33 +23,29 @@ function assertAllowedSandboxChownPath(path) {
     throw new Error(`sandbox startup chown path ${abs} is outside allowed roots. ` +
         `Allowed roots: ${describeAllowedSandboxChownPaths()}`);
 }
-async function chownRecursiveNoFollow(path, uid, gid) {
+async function chownRecursiveNoFollow(path) {
     const st = await lstat(path);
     if (st.isDirectory()) {
         const entries = await readdir(path);
         for (const entry of entries) {
-            await chownRecursiveNoFollow(resolve(path, entry), uid, gid);
+            await chownRecursiveNoFollow(resolve(path, entry));
         }
     }
-    if (st.uid === uid && st.gid === gid)
-        return;
-    await lchown(path, uid, gid);
+    await applySandboxPathHandoff(path);
 }
 export async function applySandboxStartupChowns() {
-    const paths = config.agentToolSandbox.chownPaths;
-    if (paths.length === 0)
-        return;
     if (!config.agentToolSandbox.enabled) {
-        console.warn("[sandbox-startup] AGENT_TOOL_SANDBOX_CHOWN_PATHS is set but sandbox mode is disabled; skipping chown");
+        if (config.agentToolSandbox.chownPaths.length > 0) {
+            console.warn("[sandbox-startup] AGENT_TOOL_SANDBOX_CHOWN_PATHS is set but sandbox mode is disabled; skipping chown");
+        }
         return;
     }
-    const uid = config.agentToolSandbox.uid;
-    const gid = config.agentToolSandbox.gid;
+    const paths = [...new Set([config.workspacePath, ...config.agentToolSandbox.chownPaths])];
     for (const path of paths) {
         const abs = resolve(path);
         assertAllowedSandboxChownPath(abs);
-        await chownRecursiveNoFollow(abs, uid, gid);
-        console.log(`[sandbox-startup] chowned ${abs} to ${uid}:${gid}`);
+        await chownRecursiveNoFollow(abs);
+        console.log(`[sandbox-startup] prepared ${abs} for sandbox handoff ${sandboxHandoffDescription()}`);
     }
 }
 export const sandboxStartupPermissionsInternals = Object.freeze({

package/dist/server/sandbox-startup-permissions.js.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox-startup-permissions.js","sourceRoot":"","sources":["../src/sandbox-startup-permissions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC,MAAM,uBAAuB,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;AAE5F,SAAS,cAAc,CAAC,MAAc,EAAE,SAAiB;IACvD,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACxC,OAAO,GAAG,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC;AAC9F,CAAC;AAED,SAAS,gCAAgC;IACvC,MAAM,aAAa,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC;IAC7F,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,gBAAgB,CAAC,IAAI,EAAE,GAAG,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC3F,CAAC;AAED,SAAS,6BAA6B,CAAC,IAAY;IACjD,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,YAAY,GAAG;QACnB,MAAM,CAAC,aAAa;QACpB,MAAM,CAAC,gBAAgB,CAAC,IAAI;QAC5B,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;KAC1E,CAAC;IACF,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAAE,OAAO;IACnE,MAAM,IAAI,KAAK,CACb,8BAA8B,GAAG,6BAA6B;QAC5D,kBAAkB,gCAAgC,EAAE,EAAE,CACzD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,IAAY,EAAE,GAAW,EAAE,GAAW;IAC1E,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;QACrB,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;QACpC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,sBAAsB,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IACD,IAAI,EAAE,CAAC,GAAG,KAAK,GAAG,IAAI,EAAE,CAAC,GAAG,KAAK,GAAG;QAAE,OAAO;IAC7C,MAAM,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB;IAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,gBAAgB,CAAC,UAAU,CAAC;IACjD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAC/B,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC;QACrC,OAAO,CAAC,IAAI,CACV,sGAAsG,CACvG,CAAC;QACF,OAAO;IACT,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,CAAC,gBAAgB,CAAC,GAAI,CAAC;IACzC,MAAM,GAAG,GAAG,MAAM,CAAC,gBAAgB,CAAC,GAAI,CAAC;IACzC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1B,6BAA6B,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,6BAA6B,GAAG,OAAO,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC;IACnE,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,kCAAkC,GAAG,MAAM,CAAC,MAAM,CAAC;IAC9D,uBAAuB;IACvB,cAAc;IACd,6BAA6B;CAC9B,CAAC,CAAC"}
+{"version":3,"file":"sandbox-startup-permissions.js","sourceRoot":"","sources":["../src/sandbox-startup-permissions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,uBAAuB,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AAE9F,MAAM,uBAAuB,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;AAE5F,SAAS,cAAc,CAAC,MAAc,EAAE,SAAiB;IACvD,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACxC,OAAO,GAAG,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC;AAC9F,CAAC;AAED,SAAS,gCAAgC;IACvC,MAAM,aAAa,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC;IAC7F,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,gBAAgB,CAAC,IAAI,EAAE,GAAG,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC3F,CAAC;AAED,SAAS,6BAA6B,CAAC,IAAY;IACjD,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,YAAY,GAAG;QACnB,MAAM,CAAC,aAAa;QACpB,MAAM,CAAC,gBAAgB,CAAC,IAAI;QAC5B,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;KAC1E,CAAC;IACF,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAAE,OAAO;IACnE,MAAM,IAAI,KAAK,CACb,8BAA8B,GAAG,6BAA6B;QAC5D,kBAAkB,gCAAgC,EAAE,EAAE,CACzD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,IAAY;IAChD,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;QACrB,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;QACpC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,sBAAsB,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IACD,MAAM,uBAAuB,CAAC,IAAI,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB;IAC7C,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC;QACrC,IAAI,MAAM,CAAC,gBAAgB,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClD,OAAO,CAAC,IAAI,CACV,sGAAsG,CACvG,CAAC;QACJ,CAAC;QACD,OAAO;IACT,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,GAAG,MAAM,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC1F,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1B,6BAA6B,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAClC,OAAO,CAAC,GAAG,CACT,8BAA8B,GAAG,wBAAwB,yBAAyB,EAAE,EAAE,CACvF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,kCAAkC,GAAG,MAAM,CAAC,MAAM,CAAC;IAC9D,uBAAuB;IACvB,cAAc;IACd,6BAA6B;CAC9B,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-forge",
-  "version": "1.4.5",
+  "version": "1.4.6",
   "description": "Browser UI for the pi coding agent — embedded HTTP server with a React workbench (chat, file browser, terminal, git, MCP).",
   "keywords": [
     "pi",