pi-landstrip 0.18.18 → 0.18.20

package/README.md

@@ -32,12 +32,14 @@ the sandbox is explicitly disabled.
 
 The root Pi process is trusted. Pi filesystem tools and plugin callbacks run
 outside the OS sandbox. Agent permissions still control tool dispatch, but they
-are not an OS isolation boundary.
+are not an OS isolation boundary. On Linux and macOS, primary Bash reads therefore
+use the same host view by default; writes remain sandboxed. Subagent processes
+retain the configured read and write policy.
 
-The default [sandbox policy](./sandbox.json) limits reads and writes to the
-project and a few bootstrap files. Direct network access is blocked. When the
-platform permits loopback, the extension's proxy filters allowed HTTP and HTTPS
-domains.
+The default [sandbox policy](./sandbox.json) limits writes to the project and
+restricts worker reads within the user's home to the project and a few bootstrap
+files. Direct network access is blocked. When the platform permits loopback, the
+extension's proxy filters allowed HTTP and HTTPS domains.
 
 When a command needs more access, Pi can allow it once, for the session, or in
 the project or global policy. Project approvals go to `.pi/sandbox.json` and
@@ -61,6 +63,15 @@ Subagents remain separate processes but lose Landstrip OS isolation. Pi warns
 once per session. Trusted project config overrides global config; `/sandbox`
 updates a project sandbox file when present, otherwise the global file.
 
+### Shell read access
+
+`"shell": { "readAccess": "host" }` keeps primary Bash and `!`/`!!` reads
+consistent with trusted Pi filesystem tools. Set `readAccess` to `"policy"` to
+apply `filesystem.denyRead` and `filesystem.allowRead` to shell commands as an
+intentional stricter boundary. Worker processes always use the filesystem read
+policy. Windows always uses policy reads because its sandbox requires an explicit
+read allowlist.
+
 ### Permission layers
 
 | Layer            | Checked            | Controls                       |

package/dist/index.ts

@@ -3909,6 +3909,15 @@ function registerSubagents(pi, integration) {
 }
 
 // index.ts
+function enforcesShellReadPolicy(shellReadAccess, platform = process.platform) {
+  return shellReadAccess !== "host" || platform === "win32";
+}
+function resolveProcessReadPolicy(audience, shellReadAccess, denyRead, allowRead, platform = process.platform) {
+  if (audience === "shell" && !enforcesShellReadPolicy(shellReadAccess, platform)) {
+    return { denyRead: [], allowRead: [] };
+  }
+  return { denyRead, allowRead };
+}
 var SUPPORTED_PLATFORMS = new Set(["linux", "darwin", "win32"]);
 var prohibitedProxyAddresses = new BlockList;
 for (const [network, prefix] of [
@@ -3998,11 +4007,15 @@ function mergeArray(base, override) {
   return [...new Set([...base, ...override])];
 }
 function deepMerge(base, overrides) {
+  const shell = overrides.shell;
   const network = overrides.network;
   const filesystem = overrides.filesystem;
   const windows = overrides.windows;
   return {
     enabled: overrides.enabled ?? base.enabled,
+    shell: {
+      readAccess: shell?.readAccess ?? base.shell.readAccess
+    },
     network: {
       allowNetwork: network?.allowNetwork ?? base.network.allowNetwork,
       allowLocalBinding: network?.allowLocalBinding ?? base.network.allowLocalBinding,
@@ -4247,10 +4260,10 @@ function longestPrefixMatch(path, patterns, cwd) {
   return best;
 }
 function readAllowed(path, allowRead, denyRead, cwd) {
-  const allow = longestPrefixMatch(path, allowRead, cwd);
-  if (allow < 0)
-    return false;
-  return allow >= longestPrefixMatch(path, denyRead, cwd);
+  const deny = longestPrefixMatch(path, denyRead, cwd);
+  if (deny < 0)
+    return true;
+  return longestPrefixMatch(path, allowRead, cwd) >= deny;
 }
 function isPathLike(value) {
   const trimmed = value.trim();
@@ -4288,6 +4301,10 @@ function extractNativeDeniedPath(output, cwd) {
     return normalizePathMatch(match[1], cwd);
   return null;
 }
+function extractRetryableNativeReadDeniedPath(output, cwd, allowRead, denyRead) {
+  const path = extractNativeDeniedPath(output, cwd);
+  return path && !readAllowed(path, allowRead, denyRead, cwd) ? path : null;
+}
 function extractNativeWriteDeniedPath(output, cwd) {
   const denial = String.raw`(?:Access is denied\.?|Operation not permitted|Permission denied)`;
   let match = output.match(new RegExp(String.raw`(?:[Uu]nable to create|failed to create(?: directory)?|cannot (?:create|touch|mkdir|remove|unlink|rename)|for writing)[^'"\x60\r\n]*['"\x60]([^'"\x60\r\n]+)['"\x60](?:[^\r\n]*\r?\n){0,3}[^\r\n]{0,120}${denial}`, "im"));
@@ -4845,8 +4862,9 @@ function createLandstripIntegration(options = {}) {
       return true;
     }, signal);
   }
-  function buildLandstripPolicy(cwd, proxyPort, allowances) {
+  function buildLandstripPolicy(cwd, proxyPort, audience, allowances) {
     const config = loadConfig(cwd);
+    const readPolicy = resolveProcessReadPolicy(audience, config.shell.readAccess, getEffectiveDenyRead(config, cwd), getEffectiveAllowRead(config, cwd, allowances));
     return {
       network: {
         allowNetwork: config.network.allowNetwork,
@@ -4856,18 +4874,17 @@ function createLandstripIntegration(options = {}) {
         ...proxyPort !== null ? { httpProxyPort: proxyPort } : {}
       },
       filesystem: {
-        denyRead: getEffectiveDenyRead(config, cwd),
-        allowRead: getEffectiveAllowRead(config, cwd, allowances),
+        ...readPolicy,
         allowWrite: getEffectiveAllowWrite(config, allowances),
         denyWrite: config.filesystem.denyWrite
       },
       windows: config.windows
     };
   }
-  function writePolicyFile(cwd, proxyPort, allowances) {
+  function writePolicyFile(cwd, proxyPort, audience, allowances) {
     const dir = mkdtempSync2(join7(tmpdir2(), "pi-landstrip-"));
     const path = join7(dir, "policy.json");
-    writeFileSync4(path, JSON.stringify(buildLandstripPolicy(cwd, proxyPort, allowances), null, 2) + `
+    writeFileSync4(path, JSON.stringify(buildLandstripPolicy(cwd, proxyPort, audience, allowances), null, 2) + `
 `, "utf-8");
     return { dir, path };
   }
@@ -5078,7 +5095,7 @@ function createLandstripIntegration(options = {}) {
       if (trap.operation === "write" && matchesPattern(path, config.filesystem.denyWrite, cwd)) {
         return { action: "deny", reason: "hard-deny" };
       }
-      const allowed = trap.operation === "read" ? readAllowed(path, getEffectiveAllowRead(config, cwd, allowances), config.filesystem.denyRead, cwd) : !shouldPromptForWrite(path, getEffectiveAllowWrite(config, allowances), cwd);
+      const allowed = trap.operation === "read" ? readAllowed(path, getEffectiveAllowRead(config, cwd, allowances), getEffectiveDenyRead(config, cwd), cwd) : !shouldPromptForWrite(path, getEffectiveAllowWrite(config, allowances), cwd);
       return allowed ? { action: "allow" } : undefined;
     };
     const existing = current();
@@ -5213,7 +5230,7 @@ function createLandstripIntegration(options = {}) {
     try {
       if (options2.signal?.aborted)
         throw new Error("Task cancelled");
-      policy = writePolicyFile(options2.cwd, proxy?.port ?? null, processAllowances);
+      policy = writePolicyFile(options2.cwd, proxy?.port ?? null, "worker", processAllowances);
       if (process.platform !== "win32") {
         [trapSocket, childEnd] = await createSocketPair();
         if (options2.signal?.aborted)
@@ -5347,7 +5364,7 @@ function createLandstripIntegration(options = {}) {
             readPaths: [...allowances.readPaths, ...invocation.readPaths ?? []]
           };
           processAllowances = withWindowsProcessReadAccess(processAllowances, invocation.executable, cwd);
-          policy = writePolicyFile(cwd, proxy?.port ?? null, processAllowances);
+          policy = writePolicyFile(cwd, proxy?.port ?? null, "shell", processAllowances);
           landstripArgs = [
             "run",
             "-p",
@@ -5565,6 +5582,15 @@ function createLandstripIntegration(options = {}) {
       shellPath: SettingsManager.create(ctx.cwd).getShellPath()
     });
     const run = () => sandboxedBash.execute(id, params, signal, onUpdate, ctx);
+    const blockedReadPathForRetry = (nativeOutput) => {
+      const config = loadConfig(ctx.cwd);
+      if (!enforcesShellReadPolicy(config.shell.readAccess))
+        return null;
+      const trappedPath = extractTrapBlockedPath(landstripErrorOutput, ctx.cwd, "read");
+      if (trappedPath)
+        return trappedPath;
+      return extractRetryableNativeReadDeniedPath(nativeOutput, ctx.cwd, getEffectiveAllowRead(config, ctx.cwd, allowances), getEffectiveDenyRead(config, ctx.cwd));
+    };
     const retryWithAccess = async (operation, blockedPath) => {
       if (!ctx.hasUI)
         return null;
@@ -5574,7 +5600,7 @@ function createLandstripIntegration(options = {}) {
         if (operation === "write" && matchesPattern(blockedPath, config2.filesystem.denyWrite, ctx.cwd)) {
           return false;
         }
-        const needsPrompt = operation === "read" ? !matchesPattern(blockedPath, getEffectiveAllowRead(config2, ctx.cwd, allowances), ctx.cwd) : shouldPromptForWrite(blockedPath, getEffectiveAllowWrite(config2, allowances), ctx.cwd);
+        const needsPrompt = operation === "read" ? !readAllowed(blockedPath, getEffectiveAllowRead(config2, ctx.cwd, allowances), getEffectiveDenyRead(config2, ctx.cwd), ctx.cwd) : shouldPromptForWrite(blockedPath, getEffectiveAllowWrite(config2, allowances), ctx.cwd);
         return needsPrompt ? undefined : true;
       };
       const access = await permissionPrompts.resolve(current, async () => {
@@ -5633,7 +5659,7 @@ ${errorText}`;
         if (retryResult2)
           return retryResult2;
       }
-      const blockedReadPath2 = extractTrapBlockedPath(landstripErrorOutput, ctx.cwd, "read") ?? extractNativeDeniedPath(fallbackOutput, ctx.cwd);
+      const blockedReadPath2 = blockedReadPathForRetry(fallbackOutput);
       if (blockedReadPath2) {
         const retryResult2 = await retryWithAccess("read", blockedReadPath2);
         if (retryResult2)
@@ -5658,7 +5684,7 @@ ${message}
       if (retryResult2)
         return retryResult2;
     }
-    const blockedReadPath = extractTrapBlockedPath(landstripErrorOutput, ctx.cwd, "read") ?? extractNativeDeniedPath(stderrOutput, ctx.cwd);
+    const blockedReadPath = blockedReadPathForRetry(stderrOutput);
     if (!blockedReadPath)
       return result;
     const retryResult = await retryWithAccess("read", blockedReadPath);
@@ -5871,6 +5897,8 @@ ${message}
             return { color: "success", label: "Active" };
           };
           const networkMode = config.network.allowNetwork ? "Unrestricted" : windowsImplementation === "appContainer" && !config.windows.allowLoopback ? "Blocked" : "Proxied";
+          const shellReadMode = process.platform === "win32" ? "Policy (required)" : config.shell.readAccess === "host" ? "Host-aligned" : "Policy";
+          const readRuleScope = enforcesShellReadPolicy(config.shell.readAccess) ? "Workers and shell" : "Workers only";
           return {
             render(width) {
               const innerWidth = Math.max(1, width - 4);
@@ -5888,12 +5916,12 @@ ${message}
               ]);
               const content = [tabs, ""];
               if (tab === "Overview") {
-                content.push(`${theme.fg(status.color, "●")} ${text(status.label)}`, item("Configured", config.enabled ? text("Enabled") : theme.fg("warning", "Disabled")), item("Runtime", sandboxEnabled && sandboxReady ? theme.fg("success", "Running") : muted("Not running")), "", accent("Protection"), item("Network", text(networkMode)), item("Filesystem", text(`${config.filesystem.denyRead.length + config.filesystem.allowRead.length} read rules, ${config.filesystem.allowWrite.length + config.filesystem.denyWrite.length} write rules`)), item("Session grants", text(String(sessionAllowedDomains.length + sessionAllowedReadPaths.length + sessionAllowedWritePaths.length))), "", accent("Configuration"), item("Change scope", text(target.scope === "project" ? "Project" : "Global")), item("Change file", text(truncateToWidth3(target.path, Math.max(10, innerWidth - 20)))), item("Project file", text(truncateToWidth3(projectPath, Math.max(10, innerWidth - 20)))), item("Global file", text(truncateToWidth3(globalPath, Math.max(10, innerWidth - 20)))), item("Landstrip binary", text(truncateToWidth3(landstripDisplayPath(), Math.max(10, innerWidth - 20)))));
+                content.push(`${theme.fg(status.color, "●")} ${text(status.label)}`, item("Configured", config.enabled ? text("Enabled") : theme.fg("warning", "Disabled")), item("Runtime", sandboxEnabled && sandboxReady ? theme.fg("success", "Running") : muted("Not running")), "", accent("Protection"), item("Network", text(networkMode)), item("Shell reads", text(shellReadMode)), item("Read rules", text(`${config.filesystem.denyRead.length + config.filesystem.allowRead.length} · ${readRuleScope}`)), item("Write rules", text(String(config.filesystem.allowWrite.length + config.filesystem.denyWrite.length))), item("Session grants", text(String(sessionAllowedDomains.length + sessionAllowedReadPaths.length + sessionAllowedWritePaths.length))), "", accent("Configuration"), item("Change scope", text(target.scope === "project" ? "Project" : "Global")), item("Change file", text(truncateToWidth3(target.path, Math.max(10, innerWidth - 20)))), item("Project file", text(truncateToWidth3(projectPath, Math.max(10, innerWidth - 20)))), item("Global file", text(truncateToWidth3(globalPath, Math.max(10, innerWidth - 20)))), item("Landstrip binary", text(truncateToWidth3(landstripDisplayPath(), Math.max(10, innerWidth - 20)))));
                 if (windowsImplementation !== undefined) {
                   content.push(item("Windows mode", text(windowsImplementation === "restrictedUser" ? "Restricted user" : `AppContainer (${config.windows.appContainerMode})`)));
                 }
               } else {
-                content.push(accent(`Network · ${networkMode}`), item("Allowed domains", listValue(config.network.allowedDomains)), item("Denied domains", listValue(config.network.deniedDomains)), item("Unix sockets", config.network.allowAllUnixSockets ? text("all") : listValue(config.network.allowUnixSockets)), "", accent("Filesystem"), item("Denied reads", listValue(config.filesystem.denyRead)), item("Allowed reads", listValue(config.filesystem.allowRead)), item("Allowed writes", listValue(config.filesystem.allowWrite)), item("Denied writes", listValue(config.filesystem.denyWrite)), "", accent("Session grants"), item("Domains", listValue(sessionAllowedDomains)), item("Read paths", listValue(sessionAllowedReadPaths)), item("Write paths", listValue(sessionAllowedWritePaths)));
+                content.push(accent(`Network · ${networkMode}`), item("Allowed domains", listValue(config.network.allowedDomains)), item("Denied domains", listValue(config.network.deniedDomains)), item("Unix sockets", config.network.allowAllUnixSockets ? text("all") : listValue(config.network.allowUnixSockets)), "", accent("Filesystem"), item("Shell reads", text(shellReadMode)), item("Read rules for", text(readRuleScope)), item("Denied reads", listValue(config.filesystem.denyRead)), item("Allowed reads", listValue(config.filesystem.allowRead)), item("Allowed writes", listValue(config.filesystem.allowWrite)), item("Denied writes", listValue(config.filesystem.denyWrite)), "", accent("Session grants"), item("Domains", listValue(sessionAllowedDomains)), item("Read paths", listValue(sessionAllowedReadPaths)), item("Write paths", listValue(sessionAllowedWritePaths)));
               }
               content.push("", footer);
               return [
@@ -5983,14 +6011,17 @@ export {
   writeEnvFile,
   shouldPromptForWrite,
   sessionScopeFor,
+  resolveProcessReadPolicy,
   readAllowed,
   parseTrapLine,
   matchesPattern,
   isQueryTrap,
   isPublicProxyAddress,
   formatLandstripTraps,
+  extractRetryableNativeReadDeniedPath,
   extractNativeWriteDeniedPath,
   extractNativeDeniedPath,
+  enforcesShellReadPolicy,
   domainMatchesAny,
   pi_landstrip_default as default,
   createWindowsDenyRead,

package/dist/sandbox.json

@@ -1,5 +1,8 @@
 {
   "enabled": true,
+  "shell": {
+    "readAccess": "host"
+  },
   "network": {
     "allowNetwork": false,
     "allowLocalBinding": false,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-landstrip",
-  "version": "0.18.18",
+  "version": "0.18.20",
   "description": "Sandboxed Bash and process-backed agents for Pi",
   "keywords": [
     "landstrip",
@@ -39,7 +39,7 @@
     "ci:test": "npm run test"
   },
   "dependencies": {
-    "@landstrip/landstrip": "^0.18.18",
+    "@landstrip/landstrip": "^0.18.20",
     "jsonc-parser": "^3.3.1",
     "minimatch": "^10.2.5",
     "yaml": "^2.9.0"

package/sandbox.json

@@ -1,5 +1,8 @@
 {
   "enabled": true,
+  "shell": {
+    "readAccess": "host"
+  },
   "network": {
     "allowNetwork": false,
     "allowLocalBinding": false,