pi-landstrip 0.19.18 → 0.19.19

package/README.md

@@ -32,9 +32,11 @@ and platform limits, including Windows read grants and hard-denial restrictions.
 
 Worker boundaries:
 
-- Bootstrap grants override bundled `denyRead`, never global/trusted-project
-  denies. Denied startup resources prevent launch. Legacy `/home` or `/Users`
-  denies are explicit overrides; remove them only if unintended.
+- Workers can read their startup files despite the bundled `denyRead` defaults.
+  If your own sandbox settings block a needed path with `denyRead`, Pi asks for
+  approval before starting the worker. Declining prevents startup. Existing
+  `allowRead` grants and session approvals are reused. `denyReadAlways` blocks
+  startup without asking.
 - Hard read denials also apply to shell host reads. Private workers protect
   parent auth-file/lock roots with `denyReadAlways` and `denyWrite`;
   private worker authentication is unsupported on Windows.

package/dist/index.ts

@@ -5583,7 +5583,8 @@ function loadSandboxConfig(cwd, includeProject) {
   const globalConfig = deepMerge(JSON.parse(readFileSync7(join8(packageDir2, "sandbox.json"), "utf-8")), globalOverrides);
   return {
     ...deepMerge(globalConfig, projectOverrides),
-    explicitDenyRead: mergeArray(globalOverrides.filesystem?.denyRead ?? [], projectOverrides.filesystem?.denyRead)
+    explicitDenyRead: mergeArray(globalOverrides.filesystem?.denyRead ?? [], projectOverrides.filesystem?.denyRead),
+    explicitAllowRead: mergeArray(globalOverrides.filesystem?.allowRead ?? [], projectOverrides.filesystem?.allowRead)
   };
 }
 function windowsStatus() {
@@ -6135,9 +6136,13 @@ function createLandstripIntegrationWithPrompts(options, permissionPrompts) {
     if (scope !== filePath)
       notify(ctx, `${verb} allowed (${choice}): ${scope}`, "info");
   }
-  async function applyReadChoice(ctx, choice, filePath, cwd, allowances) {
+  async function applyReadChoice(ctx, choice, filePath, cwd, allowances, scope = sessionScopeFor(filePath, cwd)) {
     const { globalPath, projectPath } = getPiConfigPaths(cwd, "sandbox.json");
-    const scope = sessionScopeFor(filePath, cwd);
+    if (allowances?.explicitDenyRead && !readAllowed(filePath, [scope], mergeArray(loadConfig(cwd).filesystem.denyRead, [
+      ...allowances.explicitDenyRead.patterns,
+      ...[...allowances.explicitDenyRead.globRoots.values()].flat()
+    ]), cwd))
+      scope = filePath;
     const configPath = choice === "project" ? projectPath : choice === "global" ? globalPath : undefined;
     if (configPath) {
       await addConfigValue(configPath, scope, (config) => config.filesystem?.allowRead ?? [], (config, allowRead) => {
@@ -6147,6 +6152,7 @@ function createLandstripIntegrationWithPrompts(options, permissionPrompts) {
     const target = choice === "once" ? allowances?.readPaths : sessionAllowedReadPaths;
     if (target && !target.includes(scope))
       target.push(scope);
+    allowances?.explicitDenyRead?.approvedPaths.push(scope);
     noteScope(ctx, "Read", choice, filePath, scope);
   }
   async function applyWriteChoice(ctx, choice, filePath, cwd, allowances) {
@@ -6291,8 +6297,8 @@ ${paths}${note}`, PERMISSION_OPTIONS, promptSignal);
       });
     });
   }
-  async function resolveTrapQuery(trap, ctx, cwd, allowances, promptOnBlock, signal) {
-    if (!isFilesystemTrap(trap)) {
+  async function resolveTrapQuery(trap, ctx, cwd, allowances, promptOnBlock, signal, readScope) {
+    if (trap.kind !== "filesystem") {
       const key = `${trap.operation}\x00${trap.target}`;
       const current = () => sessionAllowedTargets.includes(key) || allowances.targets.includes(key) ? { action: "allow" } : undefined;
       const existing = current();
@@ -6320,7 +6326,13 @@ ${paths}${note}`, PERMISSION_OPTIONS, promptSignal);
         return { action: "deny", reason: "hard-deny" };
       }
       if (trap.operation === "read" && allowances.explicitDenyRead && matchesPattern(path, mergeArray(allowances.explicitDenyRead.patterns, config.explicitDenyRead), cwd, allowances.explicitDenyRead.globRoots)) {
-        return { action: "deny", reason: "hard-deny" };
+        return isPathReadAllowed(path, mergeArray(config.explicitAllowRead, [
+          ...sessionAllowedReadPaths,
+          ...allowances.explicitDenyRead.approvedPaths
+        ]), mergeArray(config.explicitDenyRead, [
+          ...allowances.explicitDenyRead.patterns,
+          ...[...allowances.explicitDenyRead.globRoots.values()].flat()
+        ]), cwd, { requireAllowMatch: true }) ? { action: "allow" } : undefined;
       }
       if (trap.operation === "write" && (matchesPattern(path, config.filesystem.denyWriteAlways, cwd) || matchesPattern(path, config.filesystem.denyWrite, cwd))) {
         return { action: "deny", reason: "hard-deny" };
@@ -6339,7 +6351,7 @@ ${paths}${note}`, PERMISSION_OPTIONS, promptSignal);
       if (choice === "abort" || promptSignal.aborted)
         return { action: "deny", reason: "rejected" };
       if (trap.operation === "read") {
-        await applyReadChoice(ctx, choice, path, cwd, allowances);
+        await applyReadChoice(ctx, choice, path, cwd, allowances, readScope);
       } else {
         await applyWriteChoice(ctx, choice, path, cwd, allowances);
       }
@@ -6461,15 +6473,24 @@ ${paths}${note}`, PERMISSION_OPTIONS, promptSignal);
     const explicitDenyGlobRoots = new Map;
     processAllowances.explicitDenyRead = {
       patterns: config.explicitDenyRead,
-      globRoots: explicitDenyGlobRoots
+      globRoots: explicitDenyGlobRoots,
+      approvedPaths: []
     };
-    for (const path of [options.cwd, options.command, ...processAllowances.readPaths]) {
+    const startupPaths = [
+      ...new Set([options.cwd, options.command, ...processAllowances.readPaths])
+    ];
+    for (const path of startupPaths) {
       if (/[*?[\]]/.test(path)) {
         throw new Error(`Worker startup read path "${path}" must be a concrete path, not a glob`);
       }
-      const deny = config.explicitDenyRead.find((pattern) => matchesPattern(path, [pattern], options.cwd, explicitDenyGlobRoots));
-      if (deny !== undefined) {
-        throw new Error(`Worker startup read path "${path}" conflicts with explicit filesystem.denyRead "${deny}"; change the configured deny or the worker startup paths`);
+      if (matchesPattern(path, mergeArray(config.filesystem.denyReadAlways, processAllowances.protectedPaths), options.cwd)) {
+        throw new Error(`Worker startup read path "${path}" is denied by sandbox policy`);
+      }
+    }
+    for (const path of startupPaths) {
+      const result = await resolveTrapQuery({ kind: "filesystem", operation: "read", path }, options.ctx, options.cwd, processAllowances, true, options.signal, normalizeBlockedPath(path, options.cwd));
+      if (result.action !== "allow") {
+        throw new Error(`Worker startup read access denied: ${path} (${result.reason})`);
       }
     }
     const { token: proxyToken, authorization: proxyAuthorization } = createProxyCredentials();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-landstrip",
-  "version": "0.19.18",
+  "version": "0.19.19",
   "description": "Sandboxed Bash and process-backed agents for Pi",
   "keywords": [
     "landstrip",
@@ -39,7 +39,7 @@
     "ci:test": "npm run test"
   },
   "dependencies": {
-    "@landstrip/landstrip-api": "^0.19.18",
+    "@landstrip/landstrip-api": "^0.19.19",
     "jsonc-parser": "^3.3.1",
     "minimatch": "^10.2.5",
     "undici": "^8.9.0",