@landstrip/landstrip-api 0.18.39

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,64 @@
+# landstrip
+
+`landstrip` runs commands in an OS-level sandbox using Landlock on Linux,
+Seatbelt on macOS, and AppContainer or restricted users on Windows.
+
+## Install
+
+```sh
+npm install --save-dev @landstrip/landstrip-api
+npx landstrip run -p policy.json -- cargo test
+```
+
+The npm package installs a Node.js wrapper and a native binary for the current
+platform.
+
+## Usage
+
+```sh
+landstrip run -p policy.json -- cargo test
+landstrip policy validate -p policy.json
+landstrip policy resolve -p policy.json
+landstrip doctor
+```
+
+Run `landstrip --help` or see [landstrip(1)](../landstrip/man/man1/landstrip.1) for the full
+command reference.
+
+## Agent extensions
+
+| Integration | Package                | Documentation                                                        |
+| ----------- | ---------------------- | -------------------------------------------------------------------- |
+| OpenCode    | `opencode-landstrip`   | [OpenCode](packages/opencode-landstrip/README.md)                    |
+| Pi          | `pi-landstrip`         | [Pi](packages/pi-landstrip/README.md)                                |
+
+## Policy
+
+```json
+{
+  "filesystem": {
+    "allowWrite": ["."],
+    "denyWrite": ["**/.env", "**/*.pem"],
+    "denyRead": ["~/.ssh"],
+    "allowRead": ["~/.ssh/config"]
+  },
+  "network": {
+    "allowNetwork": false,
+    "allowLocalBinding": false
+  }
+}
+```
+
+Pass policies with `-p, --policy <FILE>`. Later policies merge over earlier
+ones. Platform behavior and limits are documented in the manual.
+
+## Development
+
+```sh
+make ci
+```
+
+## Licensing
+
+`@landstrip/landstrip-api` is licensed under the Apache 2.0 license. See
+[LICENSE](LICENSE) for more information.

package/bin/landstrip.js

@@ -0,0 +1,33 @@
+#!/usr/bin/env node
+// SPDX-License-Identifier: Apache-2.0
+'use strict';
+
+const { spawn } = require('node:child_process');
+const { binaryPath } = require('../lib');
+
+let child;
+
+try {
+  child = spawn(binaryPath(), process.argv.slice(2), { stdio: 'inherit' });
+} catch (error) {
+  console.error(error.message);
+  process.exit(1);
+}
+
+child.on('error', (error) => {
+  console.error(error.message);
+  process.exit(1);
+});
+
+child.on('exit', (code, signal) => {
+  if (signal) {
+    if (process.platform === 'win32') {
+      process.exit(1);
+    }
+
+    process.kill(process.pid, signal);
+    return;
+  }
+
+  process.exit(code === null ? 1 : code);
+});

package/lib/index.d.ts

@@ -0,0 +1,151 @@
+// SPDX-License-Identifier: Apache-2.0
+
+/** The kernel layer an event is attributed to. */
+export type LandstripMechanism =
+  | 'landlock'
+  | 'seccomp'
+  | 'seatbelt'
+  | 'appcontainer';
+
+/**
+ * `query` holds the syscall until the launcher answers with a
+ * {@link LandstripControlResponse}; `info` is terminal. Queries need a socket on
+ * `--trap-fd`, and only the Linux broker raises them.
+ */
+export type LandstripTrapState = 'query' | 'info';
+
+/** Why a filesystem access was mediated. */
+export type LandstripTrapReason = 'allow_miss' | 'deny_match';
+
+export interface LandstripProcess {
+  pid: number;
+  exe: string | null;
+  cwd: string | null;
+}
+
+/** A filesystem access the policy denies. */
+export interface LandstripFilesystemTrap {
+  kind: 'filesystem';
+  code: 'FILESYSTEM_DENIED';
+  state: LandstripTrapState;
+  /** Decimal `u64`; `"0"` marks a terminal `info` event. */
+  query_id: string;
+  operation: 'read' | 'write';
+  /** The resolved path. */
+  path: string;
+  /** The path the tool asked for, before resolution. */
+  requested_path: string;
+  syscall: string;
+  errno: string;
+  flags: string[];
+  reason: LandstripTrapReason;
+  /** The policy edit that would permit this access. */
+  suggested_grant: { allowRead?: string; allowWrite?: string };
+  process: LandstripProcess;
+  mechanism: 'seccomp';
+}
+
+/** A network access the policy denies. */
+export interface LandstripNetworkTrap {
+  kind: 'network';
+  code: 'NETWORK_DENIED';
+  state: LandstripTrapState;
+  /** Decimal `u64`; `"0"` marks a terminal `info` event. */
+  query_id: string;
+  operation: 'connect' | 'bind';
+  /** `address:port`. */
+  target: string;
+  syscall: string;
+  errno: string;
+  mechanism: 'seccomp';
+  process: LandstripProcess;
+}
+
+/** The sandbox was installed but the tool did not start. */
+export interface LandstripLaunchTrap {
+  kind: 'launch';
+  code: 'LAUNCH_FAILED';
+  program: string;
+  /** Absent where the platform has no POSIX errno for the failure. */
+  errno?: string;
+  message: string;
+}
+
+/** The command line was rejected. Reaches stderr only; landstrip exits 2. */
+export interface LandstripUsageTrap {
+  kind: 'usage';
+  code: 'USAGE_ERROR';
+  message: string;
+}
+
+/** A policy the platform sandbox cannot enforce, rejected before launch. */
+export type LandstripPolicyErrorCode =
+  | 'POLICY_PARSE_FAILED'
+  | 'POLICY_IO_FAILED'
+  | 'POLICY_UNRESTRICTED_READ'
+  | 'POLICY_TCP_BIND_UNSUPPORTED'
+  | 'POLICY_UNIX_SOCKET_UNSUPPORTED'
+  | 'POLICY_UNIX_SOCKET_PATH'
+  | 'POLICY_DENY_WRITE_SYMLINK_ANCESTOR'
+  | 'POLICY_INVALID_PORT'
+  | 'POLICY_EMPTY_PATH'
+  | 'POLICY_HOME_UNAVAILABLE'
+  | 'POLICY_TRAVERSAL_DEPTH';
+
+/** The stage that failed before the tool ran. */
+export type LandstripInternalCode =
+  | LandstripPolicyErrorCode
+  | 'SANDBOX_SETUP_FAILED'
+  | 'SUPERVISE_FAILED'
+  | 'PLATFORM_UNSUPPORTED'
+  | 'INTEGER_TOO_LARGE'
+  | 'INTERNAL_ERROR';
+
+/** Everything that fails before the tool runs. */
+export type LandstripInternalTrap =
+  | {
+      kind: 'internal';
+      code: 'SANDBOX_SETUP_FAILED';
+      mechanism: LandstripMechanism;
+      message: string;
+    }
+  | {
+      kind: 'internal';
+      code: Exclude<LandstripInternalCode, 'SANDBOX_SETUP_FAILED'>;
+      mechanism?: never;
+      message: string;
+    };
+
+/**
+ * One landstrip event. Failure and completed-denial events are written to
+ * stderr; pending Linux query events are written only to `--trap-fd`.
+ */
+export type LandstripTrap =
+  | LandstripFilesystemTrap
+  | LandstripNetworkTrap
+  | LandstripLaunchTrap
+  | LandstripUsageTrap
+  | LandstripInternalTrap;
+
+/** Every code landstrip reports, across all trap kinds. */
+export type LandstripCode = LandstripTrap['code'];
+
+/**
+ * The answer to a `state: "query"` trap, written back to the trap socket as one
+ * JSON line. `query_id` is an opaque decimal `u64` copied verbatim from the
+ * trap. An unanswered query holds the sandboxed syscall.
+ */
+export interface LandstripControlResponse {
+  query_id: string;
+  action: 'allow' | 'deny';
+}
+
+/**
+ * Path to the native landstrip binary for the running platform.
+ *
+ * @throws if the platform is unsupported, or the binary package is not installed.
+ */
+export function binaryPath(platform?: string, arch?: string): string;
+
+/** Name of the binary package for the given platform. */
+export function packageName(platform?: string, arch?: string): string;

package/lib/index.js

@@ -0,0 +1,72 @@
+// SPDX-License-Identifier: Apache-2.0
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const packages = {
+  'darwin-arm64': {
+    packageName: '@landstrip/landstrip-darwin-arm64',
+    binary: 'bin/landstrip',
+  },
+  'darwin-x64': {
+    packageName: '@landstrip/landstrip-darwin-x64',
+    binary: 'bin/landstrip',
+  },
+  'linux-x64': {
+    packageName: '@landstrip/landstrip-linux-x64',
+    binary: 'bin/landstrip',
+  },
+  'linux-arm64': {
+    packageName: '@landstrip/landstrip-linux-arm64',
+    binary: 'bin/landstrip',
+  },
+  'win32-x64': {
+    packageName: '@landstrip/landstrip-win32-x64',
+    binary: 'bin/landstrip.exe',
+  },
+  'win32-arm64': {
+    packageName: '@landstrip/landstrip-win32-arm64',
+    binary: 'bin/landstrip.exe',
+  },
+};
+
+function target(platform = process.platform, arch = process.arch) {
+  const key = `${platform}-${arch}`;
+  const value = packages[key];
+
+  if (!value) {
+    throw new Error(`Unsupported landstrip platform: ${platform} ${arch}`);
+  }
+
+  return value;
+}
+
+function packageName(platform = process.platform, arch = process.arch) {
+  return target(platform, arch).packageName;
+}
+
+function binaryPath(platform = process.platform, arch = process.arch) {
+  const value = target(platform, arch);
+  let manifest;
+
+  try {
+    manifest = require.resolve(`${value.packageName}/package.json`);
+  } catch (error) {
+    throw new Error(
+      `The landstrip binary package ${value.packageName} is not installed. ` +
+        'Reinstall @landstrip/landstrip-api with optional dependencies enabled.'
+    );
+  }
+
+  const resolved = path.join(path.dirname(manifest), value.binary);
+
+  if (!fs.statSync(resolved).isFile()) {
+    throw new Error(`landstrip binary not found at ${resolved}`);
+  }
+
+  return resolved;
+}
+
+exports.binaryPath = binaryPath;
+exports.packageName = packageName;

package/lib/proxy.d.ts

@@ -0,0 +1,24 @@
+// SPDX-License-Identifier: Apache-2.0
+
+export interface ProxyPortRange {
+  low: number;
+  high: number;
+}
+
+export interface FilterProxyOptions {
+  /** Gate for every proxied domain; may prompt interactively. */
+  isDomainAllowed(domain: string): boolean | Promise<boolean>;
+  /** Exact `Proxy-Authorization` header value required from clients. */
+  authorization?: string;
+  /** Inclusive listen port range; defaults to an ephemeral port. */
+  portRange?: ProxyPortRange;
+}
+
+export interface FilterProxyHandle {
+  port: number;
+  stop(): Promise<void>;
+}
+
+export function isPublicProxyAddress(address: string, family?: number): boolean;
+
+export function startFilterProxy(options: FilterProxyOptions): Promise<FilterProxyHandle>;

package/lib/proxy.js

@@ -0,0 +1,304 @@
+// SPDX-License-Identifier: Apache-2.0
+'use strict';
+
+const { lookup } = require('node:dns/promises');
+const { BlockList, connect, createServer, isIP } = require('node:net');
+
+const prohibitedProxyAddresses = new BlockList();
+
+for (const [network, prefix] of [
+  ['0.0.0.0', 8],
+  ['10.0.0.0', 8],
+  ['100.64.0.0', 10],
+  ['127.0.0.0', 8],
+  ['169.254.0.0', 16],
+  ['172.16.0.0', 12],
+  ['192.0.0.0', 24],
+  ['192.168.0.0', 16],
+  ['198.18.0.0', 15],
+  ['224.0.0.0', 4],
+  ['240.0.0.0', 4],
+]) {
+  prohibitedProxyAddresses.addSubnet(network, prefix, 'ipv4');
+}
+for (const [network, prefix] of [
+  ['::', 128],
+  ['::1', 128],
+  ['fc00::', 7],
+  ['fe80::', 10],
+  ['ff00::', 8],
+]) {
+  prohibitedProxyAddresses.addSubnet(network, prefix, 'ipv6');
+}
+
+function parseProxyPort(value, defaultPort) {
+  const rawPort = value ?? String(defaultPort);
+  if (!/^\d+$/.test(rawPort)) return null;
+
+  const port = Number(rawPort);
+  return port >= 1 && port <= 65535 ? port : null;
+}
+
+function splitHostPort(target, defaultPort) {
+  const bracketMatch = target.match(/^\[([^\]]+)\](?::(.*))?$/);
+  const host = bracketMatch?.[1];
+  if (host) {
+    const port = parseProxyPort(bracketMatch[2], defaultPort);
+    return port === null ? null : { host, port };
+  }
+
+  const lastColon = target.lastIndexOf(':');
+  if (lastColon > -1 && target.indexOf(':') === lastColon) {
+    const port = parseProxyPort(target.slice(lastColon + 1), defaultPort);
+    return port === null ? null : { host: target.slice(0, lastColon), port };
+  }
+
+  return { host: target, port: defaultPort };
+}
+
+function denyProxyRequest(client, status = '403 Forbidden') {
+  client.write(`HTTP/1.1 ${status}\r\nContent-Length: 0\r\n\r\n`);
+  client.end();
+}
+
+function isPublicProxyAddress(address, family = isIP(address)) {
+  if (family === 4) return !prohibitedProxyAddresses.check(address, 'ipv4');
+  if (family === 6) return !prohibitedProxyAddresses.check(address, 'ipv6');
+  return false;
+}
+
+async function resolveProxyEndpoint(host) {
+  const literalFamily = isIP(host);
+  if (literalFamily === 4 || literalFamily === 6) {
+    if (!isPublicProxyAddress(host, literalFamily)) {
+      throw new Error(`Proxy destination is not public: ${host}`);
+    }
+    return { address: host, family: literalFamily };
+  }
+
+  const addresses = await lookup(host, { all: true, verbatim: true });
+  if (
+    addresses.length === 0 ||
+    addresses.some(({ address, family }) => !isPublicProxyAddress(address, family))
+  ) {
+    throw new Error(`Proxy destination resolves to a non-public address: ${host}`);
+  }
+
+  const endpoint = addresses[0];
+  if (endpoint.family !== 4 && endpoint.family !== 6) {
+    throw new Error(`Proxy could not resolve destination: ${host}`);
+  }
+  return { address: endpoint.address, family: endpoint.family };
+}
+
+function pipeSockets(client, upstream, initialData) {
+  upstream.on('error', () => client.destroy());
+  client.on('error', () => upstream.destroy());
+
+  if (initialData?.length) upstream.write(initialData);
+
+  client.pipe(upstream);
+  upstream.pipe(client);
+}
+
+function startFilterProxy(options) {
+  const { isDomainAllowed, authorization, portRange } = options;
+  const sockets = new Set();
+
+  // Track the upstream socket so stop() tears it down, and abandon a still-
+  // connecting upstream when its client goes away — otherwise a connect to a
+  // black-holed host lingers in SYN-retry (~2 min), leaking an fd per request.
+  function trackUpstream(upstream, client, settled) {
+    sockets.add(upstream);
+    upstream.once('close', () => sockets.delete(upstream));
+    client.once('close', () => {
+      if (!settled()) upstream.destroy();
+    });
+  }
+
+  async function handleConnect(client, target, rest) {
+    const endpoint = splitHostPort(target, 443);
+    if (!endpoint) {
+      denyProxyRequest(client, '400 Bad Request');
+      return;
+    }
+
+    if (!(await isDomainAllowed(endpoint.host))) {
+      denyProxyRequest(client);
+      return;
+    }
+
+    const resolved = await resolveProxyEndpoint(endpoint.host);
+    let settled = false;
+    const upstream = connect(
+      { host: resolved.address, port: endpoint.port, family: resolved.family },
+      () => {
+        settled = true;
+        client.write('HTTP/1.1 200 Connection Established\r\n\r\n');
+        pipeSockets(client, upstream, rest);
+      },
+    );
+    trackUpstream(upstream, client, () => settled);
+    upstream.once('error', () => {
+      if (settled) return;
+      settled = true;
+      denyProxyRequest(client, '502 Bad Gateway');
+    });
+  }
+
+  async function handleHttp(client, headerText, rest) {
+    const lines = headerText.split(/\r?\n/);
+    const requestLine = lines[0];
+    if (!requestLine) {
+      denyProxyRequest(client, '400 Bad Request');
+      return;
+    }
+
+    const [method, rawTarget, version] = requestLine.split(' ');
+    if (!method || !rawTarget || !version) {
+      denyProxyRequest(client, '400 Bad Request');
+      return;
+    }
+
+    let url;
+    try {
+      url = new URL(rawTarget);
+    } catch {
+      const host = lines
+        .find((line) => line.toLowerCase().startsWith('host:'))
+        ?.slice(5)
+        .trim();
+      if (!host) {
+        denyProxyRequest(client, '400 Bad Request');
+        return;
+      }
+
+      try {
+        url = new URL(`http://${host}${rawTarget}`);
+      } catch {
+        denyProxyRequest(client, '400 Bad Request');
+        return;
+      }
+    }
+
+    if (!(await isDomainAllowed(url.hostname))) {
+      denyProxyRequest(client);
+      return;
+    }
+
+    const port = parseProxyPort(url.port || undefined, url.protocol === 'https:' ? 443 : 80);
+    if (port === null) {
+      denyProxyRequest(client, '400 Bad Request');
+      return;
+    }
+
+    const path = `${url.pathname}${url.search}` || '/';
+    lines[0] = `${method} ${path} ${version}`;
+
+    const rewrittenHeader = lines
+      .filter(
+        (line) =>
+          !line.toLowerCase().startsWith('proxy-connection:') &&
+          !line.toLowerCase().startsWith('proxy-authorization:'),
+      )
+      .map((line) => (line.toLowerCase().startsWith('host:') ? `Host: ${url.host}` : line))
+      .join('\r\n');
+    const resolved = await resolveProxyEndpoint(url.hostname);
+    let settled = false;
+    const upstream = connect({ host: resolved.address, port, family: resolved.family }, () => {
+      settled = true;
+      upstream.write(`${rewrittenHeader}\r\n\r\n`);
+      pipeSockets(client, upstream, rest);
+    });
+    trackUpstream(upstream, client, () => settled);
+    upstream.once('error', () => {
+      if (settled) return;
+      settled = true;
+      denyProxyRequest(client, '502 Bad Gateway');
+    });
+  }
+
+  function handleClient(client) {
+    sockets.add(client);
+    client.on('close', () => sockets.delete(client));
+    client.on('error', () => sockets.delete(client));
+
+    let buffered = Buffer.alloc(0);
+
+    client.on('data', (chunk) => {
+      buffered = Buffer.concat([buffered, chunk]);
+      const headerEnd = buffered.indexOf('\r\n\r\n');
+      if (headerEnd === -1) {
+        if (buffered.length > 65536) {
+          client.removeAllListeners('data');
+          client.pause();
+          denyProxyRequest(client, '431 Request Header Fields Too Large');
+        }
+        return;
+      }
+
+      client.pause();
+      client.removeAllListeners('data');
+
+      const header = buffered.subarray(0, headerEnd).toString('utf-8');
+      const rest = buffered.subarray(headerEnd + 4);
+      if (authorization) {
+        const supplied = header
+          .split(/\r?\n/)
+          .find((line) => line.toLowerCase().startsWith('proxy-authorization:'))
+          ?.slice('proxy-authorization:'.length)
+          .trim();
+        if (supplied !== authorization) {
+          denyProxyRequest(client, '407 Proxy Authentication Required');
+          return;
+        }
+      }
+      const [method, target] = header.split(/\r?\n/, 1)[0].split(' ');
+
+      const task =
+        method?.toUpperCase() === 'CONNECT' && target
+          ? handleConnect(client, target, rest)
+          : handleHttp(client, header, rest);
+      task.catch(() => denyProxyRequest(client, '502 Bad Gateway'));
+    });
+  }
+
+  const server = createServer(handleClient);
+  let stopped = false;
+
+  return new Promise((resolve, reject) => {
+    const listen = (port) => {
+      server.once('error', (error) => {
+        if (error.code === 'EADDRINUSE' && portRange && port < portRange.high) {
+          listen(port + 1);
+          return;
+        }
+        reject(error);
+      });
+      server.listen(port, '127.0.0.1', () => {
+        server.removeAllListeners('error');
+        const address = server.address();
+
+        resolve({
+          port: address.port,
+          stop: () =>
+            new Promise((done) => {
+              if (stopped) {
+                done();
+                return;
+              }
+              stopped = true;
+              for (const socket of sockets) socket.destroy();
+              server.close(() => done());
+            }),
+        });
+      });
+    };
+    listen(portRange ? portRange.low : 0);
+  });
+}
+
+module.exports = {
+  isPublicProxyAddress,
+  startFilterProxy,
+};

package/lib/shared.d.ts

@@ -0,0 +1,57 @@
+// SPDX-License-Identifier: Apache-2.0
+
+import type {
+  LandstripControlResponse,
+  LandstripFilesystemTrap,
+  LandstripNetworkTrap,
+  LandstripTrap,
+} from './index.js';
+
+export type LandstripDenialTrap = LandstripFilesystemTrap | LandstripNetworkTrap;
+
+export function isRecord(value: unknown): value is Record<string, unknown>;
+
+export function expandHomePath(path: string): string;
+
+export function expandPath(filePath: string, baseDirectory: string): string;
+
+export function canonicalizePath(filePath: string, baseDirectory: string): string;
+
+export function canonicalizeGlobPattern(pattern: string, baseDirectory: string): string;
+
+export function normalizePathSeparators(path: string): string;
+
+export function globToRegExp(globPattern: string): RegExp;
+
+export function pathUnderDirectory(filePath: string, dir: string): boolean;
+
+export function sessionAllows(prefixes: Set<string>, filePath: string): boolean;
+
+export function sessionScopeFor(filePath: string, baseDirectory: string): string;
+
+export function domainMatchesPattern(domain: string, pattern: string): boolean;
+
+export function domainMatchesAny(domain: string, patterns: string[]): boolean;
+
+export function allowsAllDomains(allowedDomains: string[]): boolean;
+
+export function decodeLandstripTrap(value: unknown): LandstripTrap | null;
+
+export function parseTrapLine(line: string): LandstripTrap | null;
+
+export function parseLandstripTraps(output: string): LandstripTrap[];
+
+export function isFilesystemTrap(trap: LandstripTrap): trap is LandstripFilesystemTrap;
+
+export function isDenialTrap(trap: LandstripTrap): trap is LandstripDenialTrap;
+
+export function isQueryTrap(trap: LandstripTrap): trap is LandstripDenialTrap;
+
+export function formatLandstripTrap(trap: LandstripTrap): string;
+
+export function formatLandstripTraps(traps: LandstripTrap[]): string;
+
+export function controlResponseLine(
+  queryId: string,
+  action: LandstripControlResponse['action'],
+): string;

package/lib/shared.js

@@ -0,0 +1,299 @@
+// SPDX-License-Identifier: Apache-2.0
+'use strict';
+
+const { lstatSync, readlinkSync, realpathSync } = require('node:fs');
+const { homedir } = require('node:os');
+const { basename, dirname, isAbsolute, join, relative, resolve, sep } = require('node:path');
+
+function isRecord(value) {
+  return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+
+function expandHomePath(value) {
+  if (value === '~' || value === '$HOME') return homedir();
+  if (value.startsWith('~/')) return join(homedir(), value.slice(2));
+  if (value.startsWith('$HOME/')) return join(homedir(), value.slice(6));
+  return value;
+}
+
+function pathUnderDirectory(filePath, dir) {
+  const child = relative(dir, filePath);
+  return child === '' || (!isAbsolute(child) && child !== '..' && !child.startsWith(`..${sep}`));
+}
+
+function sessionAllows(prefixes, filePath) {
+  for (const prefix of prefixes) {
+    if (pathUnderDirectory(filePath, prefix)) return true;
+  }
+  return false;
+}
+
+// The broadest ancestor worth approving in one action: the immediate child of
+// `$HOME` (e.g. `~/.cargo`) for paths under the user's home, the project root
+// for paths under it, otherwise the containing directory. A file sitting
+// directly on a boundary falls back to the exact file so nothing widens
+// silently.
+function sessionScopeFor(filePath, baseDirectory) {
+  const dir = dirname(filePath);
+  const homeBoundaries = new Set([homedir()]);
+  try {
+    homeBoundaries.add(realpathSync.native(homedir()));
+  } catch {
+    // $HOME not resolvable — fall back to the raw value only.
+  }
+
+  for (const boundary of homeBoundaries) {
+    if (pathUnderDirectory(dir, boundary)) {
+      const first = relative(boundary, dir).split(sep)[0];
+      if (!first) return filePath;
+      return join(boundary, first);
+    }
+  }
+
+  const projectBoundaries = new Set([baseDirectory]);
+  try {
+    projectBoundaries.add(realpathSync.native(baseDirectory));
+  } catch {
+    // Project directory not resolvable — fall back to the raw value only.
+  }
+
+  for (const boundary of projectBoundaries) {
+    if (pathUnderDirectory(dir, boundary)) return boundary;
+  }
+
+  return dir;
+}
+
+function domainMatchesPattern(domain, pattern) {
+  // A trailing dot ("pastebin.com.") is the same host to DNS but would slip
+  // past a literal deny entry; strip it from both sides before matching.
+  const normalizedDomain = domain.toLowerCase().replace(/\.+$/, '');
+  const normalizedPattern = pattern.toLowerCase().replace(/\.+$/, '');
+
+  if (normalizedPattern === '*') return true;
+  if (normalizedPattern.startsWith('*.')) {
+    const base = normalizedPattern.slice(2);
+    return normalizedDomain === base || normalizedDomain.endsWith(`.${base}`);
+  }
+
+  return normalizedDomain === normalizedPattern;
+}
+
+function domainMatchesAny(domain, patterns) {
+  return patterns.some((pattern) => domainMatchesPattern(domain, pattern));
+}
+
+function allowsAllDomains(allowedDomains) {
+  return allowedDomains.includes('*');
+}
+
+// landstrip emits each trap as a flat JSON record tagged by a `kind`
+// discriminant (`filesystem`, `network`, `launch`, `usage`, `internal`)
+// alongside a stable `code` and variant-specific fields. The declarations it
+// ships are erased at compile time, so validate the fields callers read
+// before trusting a decoded line. `state` is deliberately not validated: a
+// missing or unknown state degrades to "informational", the safe direction.
+// `query_id` must be a string — landstrip < 0.17 sent a number, and a
+// numeric id fails its own deserializer when echoed back.
+const LANDSTRIP_OPERATIONS = new Set(['read', 'write']);
+
+function isLandstripTrap(value) {
+  if (!isRecord(value)) return false;
+
+  switch (value.kind) {
+    case 'filesystem':
+      return (
+        LANDSTRIP_OPERATIONS.has(value.operation) &&
+        typeof value.path === 'string' &&
+        typeof value.query_id === 'string'
+      );
+    case 'network':
+      return (
+        typeof value.operation === 'string' &&
+        typeof value.target === 'string' &&
+        typeof value.query_id === 'string'
+      );
+    case 'launch':
+      return typeof value.program === 'string' && typeof value.message === 'string';
+    case 'usage':
+      return typeof value.message === 'string';
+    case 'internal':
+      return typeof value.code === 'string' && typeof value.message === 'string';
+    default:
+      return false;
+  }
+}
+
+function decodeLandstripTrap(value) {
+  return isLandstripTrap(value) ? value : null;
+}
+
+function parseTrapLine(line) {
+  try {
+    const parsed = JSON.parse(line);
+    return isLandstripTrap(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+
+function parseLandstripTraps(output) {
+  const traps = [];
+
+  for (const line of output.split('\n')) {
+    const trimmed = line.trim();
+    if (trimmed.length === 0 || trimmed[0] !== '{') continue;
+    const trap = parseTrapLine(trimmed);
+    if (trap) traps.push(trap);
+  }
+
+  return traps;
+}
+
+function isFilesystemTrap(trap) {
+  return trap.kind === 'filesystem';
+}
+
+// filesystem and network traps report an access the policy denied; launch,
+// usage and internal traps report that landstrip itself failed.
+function isDenialTrap(trap) {
+  return trap.kind === 'filesystem' || trap.kind === 'network';
+}
+
+// A `state: "query"` trap suspends the child's syscall until the host answers
+// it on the trap socket. An `info` trap is terminal.
+function isQueryTrap(trap) {
+  return isDenialTrap(trap) && trap.state === 'query';
+}
+
+function formatLandstripTrap(trap) {
+  switch (trap.kind) {
+    case 'filesystem':
+      return `landstrip: filesystem ${trap.operation} denied (${trap.path})${
+        trap.mechanism ? ` [${trap.mechanism}]` : ''
+      }`;
+    case 'network':
+      return `landstrip: network ${trap.operation} denied (${trap.target})${
+        trap.mechanism ? ` [${trap.mechanism}]` : ''
+      }`;
+    case 'launch':
+      return `landstrip: launch failed (${trap.program})${trap.message ? `: ${trap.message}` : ''}`;
+    case 'usage':
+      return `landstrip: usage error: ${trap.message}`;
+    case 'internal': {
+      const mechanism = trap.mechanism ? ` [${trap.mechanism}]` : '';
+      return `landstrip: ${trap.code}${mechanism}: ${trap.message}`;
+    }
+  }
+}
+
+function formatLandstripTraps(traps) {
+  return traps.map(formatLandstripTrap).join('\n');
+}
+
+// Relative entries (notably ".") resolve against the caller-supplied base
+// directory — the command's working directory that landstrip itself uses as
+// its policy base — never the host process's own cwd.
+function expandPath(filePath, baseDirectory) {
+  return resolve(baseDirectory, expandHomePath(filePath));
+}
+
+function canonicalizePath(filePath, baseDirectory, seen = new Set()) {
+  const abs = expandPath(filePath, baseDirectory);
+  const missing = [];
+  let existing = abs;
+
+  for (;;) {
+    try {
+      const stat = lstatSync(existing);
+      if (stat.isSymbolicLink()) {
+        if (seen.has(existing)) return abs;
+        seen.add(existing);
+        const target = resolve(dirname(existing), readlinkSync(existing), ...missing);
+        return canonicalizePath(target, baseDirectory, seen);
+      }
+      break;
+    } catch {
+      const parent = dirname(existing);
+      if (parent === existing) return abs;
+      missing.unshift(basename(existing));
+      existing = parent;
+    }
+  }
+
+  try {
+    return resolve(realpathSync.native(existing), ...missing);
+  } catch {
+    return abs;
+  }
+}
+
+function canonicalizeGlobPattern(pattern, baseDirectory) {
+  const expanded = expandPath(pattern, baseDirectory);
+  const wildcard = expanded.indexOf('*');
+  if (wildcard < 0) return canonicalizePath(expanded, baseDirectory);
+
+  const prefix = expanded.slice(0, wildcard);
+  const base = prefix.endsWith(sep) ? prefix : dirname(prefix);
+  const suffixOffset = base.endsWith(sep) ? base.length - 1 : base.length;
+  const canonicalBase = canonicalizePath(base, baseDirectory);
+  const suffix = expanded.slice(suffixOffset);
+  return canonicalBase.endsWith(sep) && suffix.startsWith(sep)
+    ? `${canonicalBase}${suffix.slice(1)}`
+    : `${canonicalBase}${suffix}`;
+}
+
+function normalizePathSeparators(path) {
+  return process.platform === 'win32' ? path.replaceAll('\\', '/') : path;
+}
+
+const globRegExpCache = new Map();
+
+// Translates an absolute glob pattern to a regular expression using standard
+// path semantics: `**` crosses directory boundaries (and `**/` may match zero
+// segments), while a single `*` is confined to one path segment.
+function globToRegExp(globPattern) {
+  const cached = globRegExpCache.get(globPattern);
+  if (cached) return cached;
+
+  const escaped = globPattern
+    .replace(/[.+^${}()|[\]\\]/g, '\\$&')
+    .replace(/\*\*\/|\*\*|\*/g, (token) =>
+      token === '**/' ? '(?:.*/)?' : token === '**' ? '.*' : '[^/]*',
+    );
+  const result = new RegExp(`^${escaped}$`);
+  globRegExpCache.set(globPattern, result);
+  return result;
+}
+
+// The broker matches an answer to its query by the exact decimal `query_id`
+// string the trap carried. A numeric id fails its deserializer, the line is
+// dropped, and the child's syscall stays suspended.
+function controlResponseLine(queryId, action) {
+  return JSON.stringify({ query_id: queryId, action }) + '\n';
+}
+
+module.exports = {
+  isRecord,
+  expandHomePath,
+  expandPath,
+  canonicalizePath,
+  canonicalizeGlobPattern,
+  normalizePathSeparators,
+  globToRegExp,
+  pathUnderDirectory,
+  sessionAllows,
+  sessionScopeFor,
+  domainMatchesPattern,
+  domainMatchesAny,
+  allowsAllDomains,
+  decodeLandstripTrap,
+  parseTrapLine,
+  parseLandstripTraps,
+  isFilesystemTrap,
+  isDenialTrap,
+  isQueryTrap,
+  formatLandstripTrap,
+  formatLandstripTraps,
+  controlResponseLine,
+};

package/package.json

@@ -0,0 +1,53 @@
+{
+  "name": "@landstrip/landstrip-api",
+  "version": "0.18.39",
+  "description": "Sandbox runner using Landlock, Seatbelt, and AppContainer",
+  "license": "Apache-2.0",
+  "homepage": "https://github.com/landstrip/landstrip#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/landstrip/landstrip.git"
+  },
+  "bugs": {
+    "url": "https://github.com/landstrip/landstrip/issues"
+  },
+  "main": "lib/index.js",
+  "types": "lib/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./shared": {
+      "types": "./lib/shared.d.ts",
+      "default": "./lib/shared.js"
+    },
+    "./proxy": {
+      "types": "./lib/proxy.d.ts",
+      "default": "./lib/proxy.js"
+    }
+  },
+  "bin": {
+    "landstrip": "bin/landstrip.js"
+  },
+  "files": [
+    "bin",
+    "lib",
+    "README.md",
+    "LICENSE"
+  ],
+  "optionalDependencies": {
+    "@landstrip/landstrip-darwin-arm64": "0.18.39",
+    "@landstrip/landstrip-darwin-x64": "0.18.39",
+    "@landstrip/landstrip-linux-x64": "0.18.39",
+    "@landstrip/landstrip-linux-arm64": "0.18.39",
+    "@landstrip/landstrip-win32-x64": "0.18.39",
+    "@landstrip/landstrip-win32-arm64": "0.18.39"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "engines": {
+    "node": ">=18"
+  }
+}