pi-landstrip 0.11.3 → 0.11.4

package/index.ts

@@ -116,28 +116,14 @@ const DEFAULT_CONFIG: SandboxConfig = {
     allowLocalBinding: false,
     allowAllUnixSockets: false,
     allowUnixSockets: [],
-    allowedDomains: [
-      'npmjs.org',
-      '*.npmjs.org',
-      'registry.npmjs.org',
-      'registry.yarnpkg.com',
-      'pypi.org',
-      '*.pypi.org',
-      'github.com',
-      '*.github.com',
-      'api.github.com',
-      'raw.githubusercontent.com',
-      'crates.io',
-      '*.crates.io',
-      'static.crates.io',
-    ],
+    allowedDomains: [],
     deniedDomains: [],
   },
   filesystem: {
     denyRead: ['/Users', '/home'],
-    allowRead: ['.', '~/.config', '~/.gitconfig', '~/.local', '~/.cargo', '/dev/null'],
-    allowWrite: ['.', '/tmp', '/dev/null'],
-    denyWrite: ['.env', '.env.*', '*.pem', '*.key'],
+    allowRead: ['.', '~/.gitconfig', '/dev/null'],
+    allowWrite: ['.', '/dev/null'],
+    denyWrite: ['**/.env', '**/.env.*', '**/*.pem', '**/*.key'],
   },
 };
 
@@ -196,16 +182,30 @@ function loadConfig(cwd: string): SandboxConfig {
   return deepMerge(deepMerge(DEFAULT_CONFIG, globalConfig), projectConfig);
 }
 
+function mergeArray(base: string[], override?: string[]): string[] {
+  if (!override) return base;
+  return [...new Set([...base, ...override])];
+}
+
 function deepMerge(base: SandboxConfig, overrides: Partial<SandboxConfig>): SandboxConfig {
+  const network = overrides.network;
+  const filesystem = overrides.filesystem;
+
   return {
     enabled: overrides.enabled ?? base.enabled,
     network: {
-      ...base.network,
-      ...overrides.network,
+      allowNetwork: network?.allowNetwork ?? base.network.allowNetwork,
+      allowLocalBinding: network?.allowLocalBinding ?? base.network.allowLocalBinding,
+      allowAllUnixSockets: network?.allowAllUnixSockets ?? base.network.allowAllUnixSockets,
+      allowUnixSockets: mergeArray(base.network.allowUnixSockets, network?.allowUnixSockets),
+      allowedDomains: mergeArray(base.network.allowedDomains, network?.allowedDomains),
+      deniedDomains: mergeArray(base.network.deniedDomains, network?.deniedDomains),
     },
     filesystem: {
-      ...base.filesystem,
-      ...overrides.filesystem,
+      denyRead: mergeArray(base.filesystem.denyRead, filesystem?.denyRead),
+      allowRead: mergeArray(base.filesystem.allowRead, filesystem?.allowRead),
+      allowWrite: mergeArray(base.filesystem.allowWrite, filesystem?.allowWrite),
+      denyWrite: mergeArray(base.filesystem.denyWrite, filesystem?.denyWrite),
     },
   };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-landstrip",
-  "version": "0.11.3",
+  "version": "0.11.4",
   "description": "Landlock-based sandboxing for pi with interactive permission prompts",
   "keywords": [
     "landstrip",

package/sandbox.json

@@ -2,56 +2,16 @@
   "enabled": true,
   "network": {
     "allowNetwork": false,
-    "allowLocalBinding": true,
+    "allowLocalBinding": false,
     "allowAllUnixSockets": false,
     "allowUnixSockets": [],
-    "allowedDomains": [
-      "github.com",
-      "*.github.com",
-      "api.github.com",
-      "raw.githubusercontent.com",
-      "objects.githubusercontent.com",
-      "codeload.github.com",
-      "registry.npmjs.org",
-      "npmjs.org",
-      "*.npmjs.org",
-      "nodejs.org",
-      "*.nodejs.org",
-      "crates.io",
-      "*.crates.io",
-      "static.crates.io"
-    ],
+    "allowedDomains": [],
     "deniedDomains": []
   },
   "filesystem": {
-    "denyRead": ["/home"],
-    "allowRead": [
-      ".",
-      "/tmp",
-      "/var/tmp",
-      "/dev/null",
-      "~/.config",
-      "~/.gitconfig",
-      "~/.local",
-      "~/.cargo",
-      "~/.rustup",
-      "~/.npm",
-      "~/.cache",
-      "~/.bun",
-      "~/.node-gyp"
-    ],
-    "allowWrite": [
-      ".",
-      "/tmp",
-      "/var/tmp",
-      "/dev/null",
-      "~/.cargo",
-      "~/.rustup",
-      "~/.npm",
-      "~/.cache",
-      "~/.bun",
-      "~/.node-gyp"
-    ],
-    "denyWrite": [".env", ".env.*", "*.pem", "*.key"]
+    "denyRead": ["/Users", "/home"],
+    "allowRead": [".", "~/.gitconfig", "/dev/null"],
+    "allowWrite": [".", "/dev/null"],
+    "denyWrite": ["**/.env", "**/.env.*", "**/*.pem", "**/*.key"]
   }
 }