pi-landstrip 0.20.11 → 0.20.13

package/dist/index.ts

@@ -40,6 +40,7 @@ import {
   isRecord as isRecord3,
   isQueryTrap,
   matchesPathPattern,
+  matchesWriteDenyPattern,
   mergeArray,
   parseLandstripTraps,
   parseSandboxConfig,
@@ -6947,7 +6948,8 @@ function createLandstripIntegrationWithPrompts(options, permissionPrompts) {
       if (!config.enabled)
         return { allowed: true, prompted: false };
       for (const access of normalized) {
-        if (matchesPattern(access.path, access.operation === "read" ? config.filesystem.denyReadAlways : mergeArray(config.filesystem.denyWriteAlways, config.filesystem.denyWrite), ctx.cwd)) {
+        const denied = access.operation === "read" ? matchesPattern(access.path, config.filesystem.denyReadAlways, ctx.cwd) : matchesWriteDenyPattern(access.path, mergeArray(config.filesystem.denyWriteAlways, config.filesystem.denyWrite), ctx.cwd, getEffectiveAllowWrite(config));
+        if (denied) {
           return {
             allowed: false,
             prompted: false,
@@ -7101,7 +7103,7 @@ ${paths}${note}`, PERMISSION_OPTIONS, promptSignal);
           ...[...allowances.explicitDenyRead.globRoots.values()].flat()
         ]), cwd, { requireAllowMatch: true }) ? { action: "allow" } : undefined;
       }
-      if (trap.operation === "write" && (matchesPattern(path, config.filesystem.denyWriteAlways, cwd) || matchesPattern(path, config.filesystem.denyWrite, cwd))) {
+      if (trap.operation === "write" && (matchesWriteDenyPattern(path, config.filesystem.denyWriteAlways, cwd, getEffectiveAllowWrite(config, allowances)) || matchesWriteDenyPattern(path, config.filesystem.denyWrite, cwd, getEffectiveAllowWrite(config, allowances)))) {
         return { action: "deny", reason: "hard-deny" };
       }
       const allowed = trap.operation === "read" ? readAllowed(path, getEffectiveAllowRead(config, cwd, allowances), getEffectiveDenyRead(config, cwd), cwd) : !shouldPromptForWrite(path, getEffectiveAllowWrite(config, allowances), cwd);
@@ -7764,9 +7766,19 @@ ${paths}${note}`, PERMISSION_OPTIONS, promptSignal);
       if (!ctx.hasUI)
         return null;
       const { globalPath, projectPath } = getPiConfigPaths(ctx.cwd, "sandbox.json");
+      const writeDeniedBy = (config) => {
+        const writeRoots = getEffectiveAllowWrite(config, allowances);
+        if (matchesWriteDenyPattern(blockedPath, config.filesystem.denyWriteAlways, ctx.cwd, writeRoots)) {
+          return "denyWriteAlways";
+        }
+        if (matchesWriteDenyPattern(blockedPath, config.filesystem.denyWrite, ctx.cwd, writeRoots)) {
+          return "denyWrite";
+        }
+        return null;
+      };
       const current = () => {
         const config = loadConfig(ctx.cwd);
-        if (matchesPattern(blockedPath, operation === "read" ? config.filesystem.denyReadAlways : mergeArray(config.filesystem.denyWriteAlways, config.filesystem.denyWrite), ctx.cwd)) {
+        if (operation === "read" ? matchesPattern(blockedPath, config.filesystem.denyReadAlways, ctx.cwd) : writeDeniedBy(config) !== null) {
           return false;
         }
         const needsPrompt = operation === "read" ? !readAllowed(blockedPath, getEffectiveAllowRead(config, ctx.cwd, allowances), getEffectiveDenyRead(config, ctx.cwd), ctx.cwd) : shouldPromptForWrite(blockedPath, getEffectiveAllowWrite(config, allowances), ctx.cwd);
@@ -7786,21 +7798,25 @@ ${paths}${note}`, PERMISSION_OPTIONS, promptSignal);
       }, signal);
       if (!access) {
         const config = loadConfig(ctx.cwd);
-        if (operation === "write" && (matchesPattern(blockedPath, config.filesystem.denyWriteAlways, ctx.cwd) || matchesPattern(blockedPath, config.filesystem.denyWrite, ctx.cwd))) {
-          const tier = matchesPattern(blockedPath, config.filesystem.denyWriteAlways, ctx.cwd) ? "denyWriteAlways" : "denyWrite";
-          notify(ctx, `"${blockedPath}" is blocked by ${tier}. Check:
+        if (operation === "write") {
+          const tier = writeDeniedBy(config);
+          if (tier) {
+            notify(ctx, `"${blockedPath}" is blocked by ${tier}. Check:
   ${projectPath}
   ${globalPath}`, "warning");
+          }
         }
         return null;
       }
       let config = loadConfig(ctx.cwd);
-      if (operation === "write" && (matchesPattern(blockedPath, config.filesystem.denyWriteAlways, ctx.cwd) || matchesPattern(blockedPath, config.filesystem.denyWrite, ctx.cwd))) {
-        const tier = matchesPattern(blockedPath, config.filesystem.denyWriteAlways, ctx.cwd) ? "denyWriteAlways" : "denyWrite";
-        notify(ctx, `"${blockedPath}" was added to allowWrite, but ${tier} still blocks it. Check:
+      if (operation === "write") {
+        const tier = writeDeniedBy(config);
+        if (tier) {
+          notify(ctx, `"${blockedPath}" was added to allowWrite, but ${tier} still blocks it. Check:
   ${projectPath}
   ${globalPath}`, "warning");
-        return null;
+          return null;
+        }
       }
       onUpdate?.({
         content: [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-landstrip",
-  "version": "0.20.11",
+  "version": "0.20.13",
   "description": "Sandboxed Bash and process-backed agents for Pi",
   "keywords": [
     "landstrip",
@@ -39,7 +39,7 @@
     "ci:test": "npm run test"
   },
   "dependencies": {
-    "@landstrip/landstrip-api": "^0.20.11",
+    "@landstrip/landstrip-api": "^0.20.13",
     "jsonc-parser": "^3.3.1",
     "minimatch": "^10.2.5",
     "undici": "^8.9.0",