pi-landstrip 0.19.4 → 0.19.7

package/README.md

@@ -49,6 +49,9 @@ Worker read boundaries:
   or shell host reads. Private workers protect parent auth-file and lock roots
   with this policy and `denyWrite`. Non-empty `denyReadAlways` and private worker
   auth are unsupported on Windows.
+- `filesystem.denyWriteAlways` cannot be overridden by equal/nested write grants
+  or interactive prompts; write attempts are silently rejected. Non-empty
+  `denyWriteAlways` is unsupported on Windows.
 - External skill, prompt, and theme directories may need explicit discovery
   access. Prefer resource file paths: resolved-file grants do not cover enclosing
   directories.

package/dist/index.ts

@@ -1,6 +1,5 @@
 // index.ts
 import { spawn as spawn2, spawnSync } from "node:child_process";
-import { randomBytes } from "node:crypto";
 import {
   existsSync as existsSync6,
   mkdirSync as mkdirSync4,
@@ -27,15 +26,22 @@ import {
   binaryPath
 } from "@landstrip/landstrip-api";
 import {
+  buildLandstripPolicy as assembleLandstripPolicy,
   allowsAllDomains,
   controlResponseLine,
+  deepMergeSandboxConfig as deepMerge,
   domainMatchesAny,
+  evaluateDomainAccess,
   formatLandstripTraps,
   isDenialTrap,
   isFilesystemTrap,
+  isPathReadAllowed,
   isRecord as isRecord3,
   isQueryTrap,
+  matchesPathPattern,
+  mergeArray,
   parseLandstripTraps,
+  parseSandboxConfig,
   canonicalizeGlobPattern,
   canonicalizePath as canonicalizePath2,
   expandPath,
@@ -43,9 +49,20 @@ import {
   normalizePathSeparators,
   parseTrapLine,
   pathUnderDirectory,
-  sessionScopeFor
+  sessionScopeFor,
+  serializeLandstripPolicy,
+  shouldPromptForWrite as sharedShouldPromptForWrite,
+  normalizeBlockedPath,
+  extractNativeDeniedPath,
+  extractNativeWriteDeniedPath,
+  extractDeniedPath,
+  extractTrapBlockedPath
 } from "@landstrip/landstrip-api/shared";
-import { startFilterProxy } from "@landstrip/landstrip-api/proxy";
+import {
+  createProxyCredentials,
+  createProxyEnvironment,
+  startFilterProxy
+} from "@landstrip/landstrip-api/proxy";
 
 // api.ts
 import { isRecord } from "@landstrip/landstrip-api/shared";
@@ -5519,72 +5536,6 @@ function registerSubagents(pi, integration, permissionPrompts = new PermissionPr
 }
 
 // index.ts
-function requireSandboxObject(value, field) {
-  if (!isRecord3(value))
-    throw new Error(`${field} must be an object`);
-}
-function rejectUnknownSandboxFields(value, fields, prefix = "") {
-  for (const field of Object.keys(value)) {
-    if (!fields.includes(field))
-      throw new Error(`unknown sandbox field ${prefix}${field}`);
-  }
-}
-function validateBooleanFields(value, fields, prefix = "") {
-  for (const field of fields) {
-    if (value[field] !== undefined && typeof value[field] !== "boolean") {
-      throw new Error(`${prefix}${field} must be a boolean`);
-    }
-  }
-}
-function validateStringArrayFields(value, fields, prefix) {
-  for (const field of fields) {
-    const entry = value[field];
-    if (entry === undefined)
-      continue;
-    if (!Array.isArray(entry) || [...entry].some((item) => typeof item !== "string")) {
-      throw new Error(`${prefix}${field} must be an array of strings`);
-    }
-  }
-}
-function parseSandboxConfig(value) {
-  requireSandboxObject(value, "sandbox config");
-  rejectUnknownSandboxFields(value, ["enabled", "shell", "network", "filesystem", "windows"]);
-  validateBooleanFields(value, ["enabled"]);
-  if (value.shell !== undefined) {
-    requireSandboxObject(value.shell, "shell");
-    rejectUnknownSandboxFields(value.shell, ["readAccess"], "shell.");
-    if (value.shell.readAccess !== undefined && value.shell.readAccess !== "host" && value.shell.readAccess !== "policy") {
-      throw new Error("shell.readAccess must be host or policy");
-    }
-  }
-  if (value.network !== undefined) {
-    requireSandboxObject(value.network, "network");
-    rejectUnknownSandboxFields(value.network, [
-      "allowNetwork",
-      "allowLocalBinding",
-      "allowAllUnixSockets",
-      "allowUnixSockets",
-      "allowedDomains",
-      "deniedDomains"
-    ], "network.");
-    validateBooleanFields(value.network, ["allowNetwork", "allowLocalBinding", "allowAllUnixSockets"], "network.");
-    validateStringArrayFields(value.network, ["allowUnixSockets", "allowedDomains", "deniedDomains"], "network.");
-  }
-  if (value.filesystem !== undefined) {
-    requireSandboxObject(value.filesystem, "filesystem");
-    rejectUnknownSandboxFields(value.filesystem, ["denyRead", "denyReadAlways", "allowRead", "allowWrite", "denyWrite"], "filesystem.");
-    validateStringArrayFields(value.filesystem, ["denyRead", "denyReadAlways", "allowRead", "allowWrite", "denyWrite"], "filesystem.");
-  }
-  if (value.windows !== undefined) {
-    requireSandboxObject(value.windows, "windows");
-    rejectUnknownSandboxFields(value.windows, ["appContainerMode", "allowLoopback"], "windows.");
-    validateBooleanFields(value.windows, ["allowLoopback"], "windows.");
-    if (value.windows.appContainerMode !== undefined && value.windows.appContainerMode !== "lpac" && value.windows.appContainerMode !== "standard") {
-      throw new Error("windows.appContainerMode must be lpac or standard");
-    }
-  }
-  return value;
-}
 function enforcesShellReadPolicy(shellReadAccess, platform = process.platform) {
   return shellReadAccess !== "host" || platform === "win32";
 }
@@ -5596,14 +5547,6 @@ function resolveProcessReadPolicy(audience, shellReadAccess, denyRead, allowRead
 }
 var SUPPORTED_PLATFORMS = new Set(["linux", "darwin", "win32"]);
 var EXIT_STDIO_GRACE_MS = 100;
-var PROXY_ENVIRONMENT_VARIABLES = [
-  "HTTP_PROXY",
-  "HTTPS_PROXY",
-  "ALL_PROXY",
-  "http_proxy",
-  "https_proxy",
-  "all_proxy"
-];
 var packageDir2 = dirname5(fileURLToPath2(import.meta.url));
 var PERMISSION_OPTIONS = [
   { label: "Allow once", action: "once" },
@@ -5643,42 +5586,6 @@ function loadSandboxConfig(cwd, includeProject) {
     explicitDenyRead: mergeArray(globalOverrides.filesystem?.denyRead ?? [], projectOverrides.filesystem?.denyRead)
   };
 }
-function mergeArray(base, override) {
-  if (!override)
-    return base;
-  return [...new Set([...base, ...override])];
-}
-function deepMerge(base, overrides) {
-  const shell = overrides.shell;
-  const network = overrides.network;
-  const filesystem = overrides.filesystem;
-  const windows = overrides.windows;
-  return {
-    enabled: overrides.enabled ?? base.enabled,
-    shell: {
-      readAccess: shell?.readAccess ?? base.shell.readAccess
-    },
-    network: {
-      allowNetwork: network?.allowNetwork ?? base.network.allowNetwork,
-      allowLocalBinding: network?.allowLocalBinding ?? base.network.allowLocalBinding,
-      allowAllUnixSockets: network?.allowAllUnixSockets ?? base.network.allowAllUnixSockets,
-      allowUnixSockets: mergeArray(base.network.allowUnixSockets, network?.allowUnixSockets),
-      allowedDomains: mergeArray(base.network.allowedDomains, network?.allowedDomains),
-      deniedDomains: mergeArray(base.network.deniedDomains, network?.deniedDomains)
-    },
-    filesystem: {
-      denyRead: mergeArray(base.filesystem.denyRead, filesystem?.denyRead),
-      denyReadAlways: mergeArray(base.filesystem.denyReadAlways, filesystem?.denyReadAlways),
-      allowRead: mergeArray(base.filesystem.allowRead, filesystem?.allowRead),
-      allowWrite: mergeArray(base.filesystem.allowWrite, filesystem?.allowWrite),
-      denyWrite: mergeArray(base.filesystem.denyWrite, filesystem?.denyWrite)
-    },
-    windows: {
-      appContainerMode: windows?.appContainerMode ?? base.windows.appContainerMode,
-      allowLoopback: windows?.allowLoopback ?? base.windows.allowLoopback
-    }
-  };
-}
 function windowsStatus() {
   const result = spawnSync(binaryPath(), ["windows", "status"], {
     encoding: "utf-8",
@@ -5765,9 +5672,12 @@ function mergeAllowances(base, session, execution) {
   return [...base, ...session, ...execution ?? []];
 }
 function shouldPromptForWrite(path, allowWrite, cwd) {
-  return allowWrite.length === 0 || !matchesPattern(path, allowWrite, cwd);
+  return sharedShouldPromptForWrite(path, allowWrite, cwd);
 }
 function matchesPattern(filePath, patterns, cwd, explicitDenyGlobRoots) {
+  if (!explicitDenyGlobRoots) {
+    return matchesPathPattern(filePath, patterns, cwd);
+  }
   const abs = normalizePathSeparators(canonicalizePath2(filePath, cwd));
   return patterns.some((pattern) => {
     const absPattern = normalizePathSeparators(canonicalizeGlobPattern(pattern, cwd));
@@ -5823,53 +5733,8 @@ function matchesPattern(filePath, patterns, cwd, explicitDenyGlobRoots) {
     return abs === absPattern || abs.startsWith(absPattern + sep);
   });
 }
-function normalizeBlockedPath(path, cwd) {
-  const nativePath = process.platform === "win32" && /^\/[a-zA-Z](?:\/|$)/.test(path) ? `${path[1]}:${path.slice(2)}` : path;
-  return canonicalizePath2(isAbsolute4(nativePath) ? nativePath : join8(cwd, nativePath), cwd);
-}
-function longestPrefixMatch(path, patterns, cwd) {
-  let best = -1;
-  for (const pattern of patterns) {
-    if (!matchesPattern(path, [pattern], cwd))
-      continue;
-    const canonical = canonicalizeGlobPattern(pattern, cwd);
-    if (canonical.length > best)
-      best = canonical.length;
-  }
-  return best;
-}
 function readAllowed(path, allowRead, denyRead, cwd) {
-  const deny = longestPrefixMatch(path, denyRead, cwd);
-  if (deny < 0)
-    return true;
-  return longestPrefixMatch(path, allowRead, cwd) >= deny;
-}
-function isPathLike(value) {
-  const trimmed = value.trim();
-  return trimmed === "~" || trimmed.startsWith("/") || trimmed.startsWith("\\\\") || /^[a-zA-Z]:[\\/]/.test(trimmed) || trimmed.startsWith("~/") || trimmed.startsWith("~\\") || trimmed.startsWith("./") || trimmed.startsWith(".\\") || trimmed.startsWith("../") || trimmed.startsWith("..\\") || trimmed.startsWith(".") || trimmed.includes("/") || trimmed.includes("\\");
-}
-function normalizePathMatch(value, cwd) {
-  return isPathLike(value) ? normalizeBlockedPath(value, cwd) : null;
-}
-function extractBlockedPath(trapOutput, cwd) {
-  const landstripErrors = parseLandstripTraps(trapOutput).filter(isFilesystemTrap);
-  if (landstripErrors.length > 0) {
-    return normalizeBlockedPath(landstripErrors[0].path, cwd);
-  }
-  return null;
-}
-function extractNativeDeniedPath(output, cwd) {
-  const denial = String.raw`(?:Access is denied\.?|Operation not permitted|Permission denied)`;
-  let match = output.match(new RegExp(String.raw`['"]([^'"\n]+)['"][^\r\n]{0,120}${denial}`, "i"));
-  if (match)
-    return normalizePathMatch(match[1], cwd);
-  match = output.match(new RegExp(String.raw`(?:^|:\s+)((?:[a-zA-Z]:[\\/]|\\\\|/|\.{1,2}[\\/])[^\r\n]*?):\s+${denial}$`, "im"));
-  if (match)
-    return normalizePathMatch(match[1], cwd);
-  match = output.match(new RegExp(String.raw`^[a-zA-Z0-9_-]+: cannot (?:open|access|stat|create)(?: directory)? '?([^'\n]+?)'?(?: for (?:reading|writing))?: ${denial}$`, "im"));
-  if (match)
-    return normalizePathMatch(match[1], cwd);
-  return null;
+  return isPathReadAllowed(path, allowRead, denyRead, cwd);
 }
 function extractDeniedPathMention(output, cwd, denied) {
   const start = /(?<=^|['"`\s=:(])(?=\/|[a-zA-Z]:[\\/])/g;
@@ -5898,27 +5763,6 @@ function extractRetryableNativeReadDeniedPath(output, cwd, allowRead, denyRead)
     return denied(path) ? path : null;
   return extractDeniedPathMention(output, cwd, denied);
 }
-function extractNativeWriteDeniedPath(output, cwd) {
-  const denial = String.raw`(?:Access is denied\.?|Operation not permitted|Permission denied)`;
-  let match = output.match(new RegExp(String.raw`(?:[Uu]nable to create|failed to create(?: directory)?|cannot (?:create|touch|mkdir|remove|unlink|rename)|for writing)[^'"\x60\r\n]*['"\x60]([^'"\x60\r\n]+)['"\x60](?:[^\r\n]*\r?\n){0,3}[^\r\n]{0,120}${denial}`, "im"));
-  if (match)
-    return normalizePathMatch(match[1], cwd);
-  match = output.match(new RegExp(String.raw`^[a-zA-Z0-9_-]+: cannot create(?: directory)? '?([^'\n]+?)'?(?: for writing)?: ${denial}$`, "im"));
-  if (match)
-    return normalizePathMatch(match[1], cwd);
-  match = output.match(new RegExp(String.raw`^[a-zA-Z0-9_-]+: couldn't open temporary file ((?:[a-zA-Z]:[\\/]|\\\\|/)[^\r\n]*?): ${denial}$`, "im"));
-  if (match)
-    return normalizePathMatch(match[1], cwd);
-  return null;
-}
-function extractTrapBlockedPath(trapOutput, cwd, operation) {
-  for (const error of parseLandstripTraps(trapOutput).filter(isFilesystemTrap)) {
-    if (error.operation === operation) {
-      return normalizeBlockedPath(error.path, cwd);
-    }
-  }
-  return null;
-}
 function notify(ctx, message, level) {
   if (!ctx.hasUI)
     return;
@@ -6011,13 +5855,10 @@ function writeEnvFile(env, proxyPort, proxyToken) {
     lines.push(`export ${key}='${escaped}'`);
   }
   if (proxyPort !== null) {
-    const credentials = proxyToken === undefined ? "" : `landstrip:${proxyToken}@`;
-    const url = `http://${credentials}127.0.0.1:${proxyPort}`;
-    for (const name of PROXY_ENVIRONMENT_VARIABLES) {
-      lines.push(`export ${name}='${url}'`);
+    const proxyVars = createProxyEnvironment(proxyPort, proxyToken);
+    for (const [name, value] of Object.entries(proxyVars)) {
+      lines.push(`export ${name}='${value}'`);
     }
-    lines.push("export NO_PROXY=''");
-    lines.push("export no_proxy=''");
   }
   const dir = mkdtempSync2(join8(tmpdir2(), "pi-landstrip-env-"));
   const path = join8(dir, "env.sh");
@@ -6052,15 +5893,7 @@ function createPosixShellProvider() {
 }
 function shellEnvironment(env, cwd, proxyPort, proxyToken) {
   const result = { ...process.env, ...env, PWD: resolve4(cwd) };
-  if (proxyPort === null)
-    return result;
-  const credentials = proxyToken === undefined ? "" : `landstrip:${proxyToken}@`;
-  const url = `http://${credentials}127.0.0.1:${proxyPort}`;
-  for (const name of PROXY_ENVIRONMENT_VARIABLES)
-    result[name] = url;
-  result.NO_PROXY = "";
-  result.no_proxy = "";
-  return result;
+  return createProxyEnvironment(proxyPort, proxyToken, result);
 }
 function createLandstripLauncherEnvironment(providerEnv, hostEnv = process.env, platform = process.platform) {
   if (platform !== "win32" || hostEnv.ProgramData === undefined)
@@ -6324,7 +6157,7 @@ function createLandstripIntegrationWithPrompts(options, permissionPrompts) {
     const current = () => {
       const config = loadConfig(ctx.cwd);
       for (const access of normalized) {
-        if (matchesPattern(access.path, access.operation === "read" ? config.filesystem.denyReadAlways : config.filesystem.denyWrite, ctx.cwd)) {
+        if (matchesPattern(access.path, access.operation === "read" ? config.filesystem.denyReadAlways : mergeArray(config.filesystem.denyWriteAlways, config.filesystem.denyWrite), ctx.cwd)) {
           return {
             allowed: false,
             prompted: false,
@@ -6367,10 +6200,13 @@ ${paths}${note}`, PERMISSION_OPTIONS, promptSignal);
   async function ensureDomainAllowed(ctx, domain, cwd, allowances, signal) {
     const current = () => {
       const config = loadConfig(cwd);
-      if (domainMatchesAny(domain, config.network.deniedDomains))
+      const decision = evaluateDomainAccess(domain, config.network, [
+        ...sessionAllowedDomains,
+        ...allowances?.domains ?? []
+      ]);
+      if (decision === "deny")
         return false;
-      const allowedDomains = mergeAllowances(config.network.allowedDomains, sessionAllowedDomains, allowances?.domains);
-      if (domainMatchesAny(domain, allowedDomains))
+      if (decision === "allow")
         return true;
       return;
     };
@@ -6390,28 +6226,23 @@ ${paths}${note}`, PERMISSION_OPTIONS, promptSignal);
       ...allowances?.explicitDenyRead?.patterns ?? [],
       ...[...allowances?.explicitDenyRead?.globRoots.values() ?? []].flat()
     ]), getEffectiveAllowRead(config, cwd, allowances));
-    return {
-      network: {
-        allowNetwork: config.network.allowNetwork,
-        allowLocalBinding: config.network.allowLocalBinding,
-        allowAllUnixSockets: config.network.allowAllUnixSockets,
-        allowUnixSockets: config.network.allowUnixSockets,
-        ...proxyPort !== null ? { httpProxyPort: proxyPort } : {}
-      },
+    return assembleLandstripPolicy({
+      network: config.network,
       filesystem: {
         ...readPolicy,
         denyReadAlways: mergeArray(config.filesystem.denyReadAlways, allowances?.protectedPaths),
         allowWrite: getEffectiveAllowWrite(config, allowances),
-        denyWrite: mergeArray(config.filesystem.denyWrite, allowances?.protectedPaths)
+        denyWrite: mergeArray(config.filesystem.denyWrite, allowances?.protectedPaths),
+        denyWriteAlways: mergeArray(config.filesystem.denyWriteAlways, allowances?.protectedPaths)
       },
-      windows: config.windows
-    };
+      windows: config.windows,
+      httpProxyPort: proxyPort
+    });
   }
   function writePolicyFile(cwd, proxyPort, audience, allowances) {
     const dir = mkdtempSync2(join8(tmpdir2(), "pi-landstrip-"));
     const path = join8(dir, "policy.json");
-    writeFileSync4(path, JSON.stringify(buildLandstripPolicy(cwd, proxyPort, audience, allowances), null, 2) + `
-`, "utf-8");
+    writeFileSync4(path, serializeLandstripPolicy(buildLandstripPolicy(cwd, proxyPort, audience, allowances)), "utf-8");
     return { dir, path };
   }
   function startProxy(ctx, cwd, allowances, signal, authorization, portRange) {
@@ -6478,7 +6309,7 @@ ${paths}${note}`, PERMISSION_OPTIONS, promptSignal);
       if (trap.operation === "read" && allowances.explicitDenyRead && matchesPattern(path, mergeArray(allowances.explicitDenyRead.patterns, config.explicitDenyRead), cwd, allowances.explicitDenyRead.globRoots)) {
         return { action: "deny", reason: "hard-deny" };
       }
-      if (trap.operation === "write" && matchesPattern(path, config.filesystem.denyWrite, cwd)) {
+      if (trap.operation === "write" && (matchesPattern(path, config.filesystem.denyWriteAlways, cwd) || matchesPattern(path, config.filesystem.denyWrite, cwd))) {
         return { action: "deny", reason: "hard-deny" };
       }
       const allowed = trap.operation === "read" ? readAllowed(path, getEffectiveAllowRead(config, cwd, allowances), getEffectiveDenyRead(config, cwd), cwd) : !shouldPromptForWrite(path, getEffectiveAllowWrite(config, allowances), cwd);
@@ -6628,8 +6459,7 @@ ${paths}${note}`, PERMISSION_OPTIONS, promptSignal);
         throw new Error(`Worker startup read path "${path}" conflicts with explicit filesystem.denyRead "${deny}"; change the configured deny or the worker startup paths`);
       }
     }
-    const proxyToken = randomBytes(32).toString("base64url");
-    const proxyAuthorization = `Basic ${Buffer.from(`landstrip:${proxyToken}`).toString("base64")}`;
+    const { token: proxyToken, authorization: proxyAuthorization } = createProxyCredentials();
     const proxy = shouldStartProxy(config) ? await startProxy(options.ctx, options.cwd, processAllowances, options.signal, proxyAuthorization, restrictedUserProxyPortRange()) : null;
     let policy;
     let trapSocket;
@@ -6656,15 +6486,7 @@ ${paths}${note}`, PERMISSION_OPTIONS, promptSignal);
     const workerPolicy = policy;
     const workerTrapSocket = trapSocket;
     const workerChildEnd = childEnd;
-    const workerEnv = { ...options.env };
-    if (proxy) {
-      const url = `http://landstrip:${proxyToken}@127.0.0.1:${proxy.port}`;
-      for (const name of PROXY_ENVIRONMENT_VARIABLES) {
-        workerEnv[name] = url;
-      }
-      workerEnv.NO_PROXY = "";
-      workerEnv.no_proxy = "";
-    }
+    const workerEnv = createProxyEnvironment(proxy?.port ?? null, proxyToken, options.env ?? {});
     let spawned = false;
     let disposePromise;
     let preparedChild;
@@ -6856,8 +6678,7 @@ ${paths}${note}`, PERMISSION_OPTIONS, promptSignal);
           throw new Error(`Working directory does not exist: ${cwd}`);
         const provider = activeShellProvider();
         const config = loadConfig(cwd);
-        const proxyToken = randomBytes(32).toString("base64url");
-        const proxyAuthorization = `Basic ${Buffer.from(`landstrip:${proxyToken}`).toString("base64")}`;
+        const { token: proxyToken, authorization: proxyAuthorization } = createProxyCredentials();
         const proxy = shouldStartProxy(config) ? await startProxy(ctx, cwd, allowances, signal, proxyAuthorization, restrictedUserProxyPortRange()) : null;
         let policy;
         let invocation;
@@ -6984,7 +6805,7 @@ ${paths}${note}`, PERMISSION_OPTIONS, promptSignal);
                   reject(new Error(`timeout:${timeout}`));
                   return;
                 }
-                const blockedPath = extractBlockedPath(errorFdAcc, cwd) ?? extractNativeDeniedPath(stderrAcc, cwd);
+                const blockedPath = extractTrapBlockedPath(errorFdAcc, cwd) ?? extractNativeDeniedPath(stderrAcc, cwd);
                 if (!blockedPath && ctx.hasUI) {
                   const traps = parseLandstripTraps(errorFdAcc);
                   const denials = traps.filter(isDenialTrap);
@@ -7127,7 +6948,7 @@ ${paths}${note}`, PERMISSION_OPTIONS, promptSignal);
       const { globalPath, projectPath } = getPiConfigPaths(ctx.cwd, "sandbox.json");
       const current = () => {
         const config = loadConfig(ctx.cwd);
-        if (matchesPattern(blockedPath, operation === "read" ? config.filesystem.denyReadAlways : config.filesystem.denyWrite, ctx.cwd)) {
+        if (matchesPattern(blockedPath, operation === "read" ? config.filesystem.denyReadAlways : mergeArray(config.filesystem.denyWriteAlways, config.filesystem.denyWrite), ctx.cwd)) {
           return false;
         }
         const needsPrompt = operation === "read" ? !readAllowed(blockedPath, getEffectiveAllowRead(config, ctx.cwd, allowances), getEffectiveDenyRead(config, ctx.cwd), ctx.cwd) : shouldPromptForWrite(blockedPath, getEffectiveAllowWrite(config, allowances), ctx.cwd);
@@ -7147,16 +6968,18 @@ ${paths}${note}`, PERMISSION_OPTIONS, promptSignal);
       }, signal);
       if (!access) {
         const config = loadConfig(ctx.cwd);
-        if (operation === "write" && matchesPattern(blockedPath, config.filesystem.denyWrite, ctx.cwd)) {
-          notify(ctx, `"${blockedPath}" is blocked by denyWrite. Check:
+        if (operation === "write" && (matchesPattern(blockedPath, config.filesystem.denyWriteAlways, ctx.cwd) || matchesPattern(blockedPath, config.filesystem.denyWrite, ctx.cwd))) {
+          const tier = matchesPattern(blockedPath, config.filesystem.denyWriteAlways, ctx.cwd) ? "denyWriteAlways" : "denyWrite";
+          notify(ctx, `"${blockedPath}" is blocked by ${tier}. Check:
   ${projectPath}
   ${globalPath}`, "warning");
         }
         return null;
       }
       let config = loadConfig(ctx.cwd);
-      if (operation === "write" && matchesPattern(blockedPath, config.filesystem.denyWrite, ctx.cwd)) {
-        notify(ctx, `"${blockedPath}" was added to allowWrite, but denyWrite still blocks it. Check:
+      if (operation === "write" && (matchesPattern(blockedPath, config.filesystem.denyWriteAlways, ctx.cwd) || matchesPattern(blockedPath, config.filesystem.denyWrite, ctx.cwd))) {
+        const tier = matchesPattern(blockedPath, config.filesystem.denyWriteAlways, ctx.cwd) ? "denyWriteAlways" : "denyWrite";
+        notify(ctx, `"${blockedPath}" was added to allowWrite, but ${tier} still blocks it. Check:
   ${projectPath}
   ${globalPath}`, "warning");
         return null;
@@ -7480,6 +7303,7 @@ export {
   pi_landstrip_default as default,
   domainMatchesAny,
   enforcesShellReadPolicy,
+  extractDeniedPath,
   extractNativeDeniedPath,
   extractNativeWriteDeniedPath,
   extractRetryableNativeReadDeniedPath,

package/dist/sandbox.json

@@ -23,7 +23,8 @@
       "**/*.key",
       ".pi/sandbox.json",
       "~/.pi/agent/sandbox.json"
-    ]
+    ],
+    "denyWriteAlways": []
   },
   "windows": {
     "appContainerMode": "standard",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-landstrip",
-  "version": "0.19.4",
+  "version": "0.19.7",
   "description": "Sandboxed Bash and process-backed agents for Pi",
   "keywords": [
     "landstrip",
@@ -39,7 +39,7 @@
     "ci:test": "npm run test"
   },
   "dependencies": {
-    "@landstrip/landstrip-api": "^0.19.4",
+    "@landstrip/landstrip-api": "^0.19.7",
     "jsonc-parser": "^3.3.1",
     "minimatch": "^10.2.5",
     "undici": "^8.9.0",
@@ -47,7 +47,7 @@
   },
   "devDependencies": {
     "@earendil-works/pi-ai": "^0.85.1",
-    "@earendil-works/pi-coding-agent": "^0.85.1",
+    "@earendil-works/pi-coding-agent": "^0.87.1",
     "@earendil-works/pi-tui": "^0.85.1",
     "@types/node": "^26.4.1",
     "oxfmt": "^0.67.0",

package/sandbox.json

@@ -23,7 +23,8 @@
       "**/*.key",
       ".pi/sandbox.json",
       "~/.pi/agent/sandbox.json"
-    ]
+    ],
+    "denyWriteAlways": []
   },
   "windows": {
     "appContainerMode": "standard",