@landstrip/landstrip-api 0.18.42 → 0.19.0

package/README.md

@@ -1,64 +1,49 @@
-# landstrip
+# @landstrip/landstrip-api
 
-`landstrip` runs commands in an OS-level sandbox using Landlock on Linux,
-Seatbelt on macOS, and AppContainer or restricted users on Windows.
+Node.js wrapper, native binaries, and TypeScript types for the Landstrip sandbox.
+Requires Node.js 18 or newer; binaries are provided for Linux, macOS, and Windows
+on x64 and arm64.
 
-## Install
+## Install and run
 
 ```sh
 npm install --save-dev @landstrip/landstrip-api
 npx landstrip run -p policy.json -- cargo test
 ```
 
-The npm package installs a Node.js wrapper and a native binary for the current
-platform.
+See the [quick start](../../README.md#quick-start) for an example policy and
+[landstrip(1)](../landstrip/man/man1/landstrip.1) for CLI options, policy rules,
+and platform limits.
 
-## Usage
+## Node.js API
 
-```sh
-landstrip run -p policy.json -- cargo test
-landstrip policy validate -p policy.json
-landstrip policy resolve -p policy.json
-landstrip doctor
-```
-
-Run `landstrip --help` or see [landstrip(1)](../landstrip/man/man1/landstrip.1) for the full
-command reference.
-
-## Agent extensions
+```js
+const { execFileSync } = require('node:child_process');
+const { binaryPath } = require('@landstrip/landstrip-api');
 
-| Integration | Package                | Documentation                                                        |
-| ----------- | ---------------------- | -------------------------------------------------------------------- |
-| OpenCode    | `opencode-landstrip`   | [OpenCode](packages/opencode-landstrip/README.md)                    |
-| Pi          | `pi-landstrip`         | [Pi](packages/pi-landstrip/README.md)                                |
+execFileSync(binaryPath(), ['run', '-p', 'policy.json', '--', 'cargo', 'test'], {
+  stdio: 'inherit',
+});
+```
 
-## Policy
+`binaryPath()` returns the installed native binary's path and throws if the
+platform is unsupported or its binary package is missing. `packageName()` returns
+the platform's binary package name. Both accept optional `platform` and `arch`
+arguments, defaulting to the current process.
 
-```json
-{
-  "filesystem": {
-    "allowWrite": ["."],
-    "denyWrite": ["**/.env", "**/*.pem"],
-    "denyRead": ["~/.ssh"],
-    "allowRead": ["~/.ssh/config"]
-  },
-  "network": {
-    "allowNetwork": false,
-    "allowLocalBinding": false
-  }
-}
-```
+The package exports [`LandstripTrap` and `LandstripControlResponse`](lib/index.d.ts)
+for structured events and Linux broker replies. Runtime traps and approval
+queries are Linux-only; macOS's `--trap` reports setup and launch failures.
+Descriptor lifetimes and the reply protocol are covered in the manual.
 
-Pass policies with `-p, --policy <FILE>`. Later policies merge over earlier
-ones. Platform behavior and limits are documented in the manual.
+Integration helpers are exported through [`/shared`](lib/shared.d.ts) and
+[`/proxy`](lib/proxy.d.ts).
 
 ## Development
 
-```sh
-make ci
-```
+Run `make ci` from the repository root.
 
-## Licensing
+## License
 
-`@landstrip/landstrip-api` is licensed under the Apache 2.0 license. See
-[LICENSE](LICENSE) for more information.
+[Apache-2.0](LICENSE). The bundled native binary is
+[LGPL-3.0-or-later](../landstrip/LICENSE).

package/lib/index.d.ts

@@ -10,7 +10,7 @@ export type LandstripMechanism =
 /**
  * `query` holds the syscall until the launcher answers with a
  * {@link LandstripControlResponse}; `info` is terminal. Queries need a socket on
- * `--trap-fd`, and only the Linux broker raises them.
+ * `--trap`, and only the Linux broker raises them.
  */
 export type LandstripTrapState = 'query' | 'info';
 
@@ -83,6 +83,7 @@ export type LandstripPolicyErrorCode =
   | 'POLICY_PARSE_FAILED'
   | 'POLICY_IO_FAILED'
   | 'POLICY_UNRESTRICTED_READ'
+  | 'POLICY_DENY_READ_ALWAYS_UNSUPPORTED'
   | 'POLICY_TCP_BIND_UNSUPPORTED'
   | 'POLICY_UNIX_SOCKET_UNSUPPORTED'
   | 'POLICY_UNIX_SOCKET_PATH'
@@ -118,7 +119,7 @@ export type LandstripInternalTrap =
 
 /**
  * One landstrip event. Failure and completed-denial events are written to
- * stderr; pending Linux query events are written only to `--trap-fd`.
+ * stderr; pending Linux query events are written only to `--trap`.
  */
 export type LandstripTrap =
   | LandstripFilesystemTrap

package/lib/proxy.d.ts

@@ -19,6 +19,4 @@ export interface FilterProxyHandle {
   stop(): Promise<void>;
 }
 
-export function isPublicProxyAddress(address: string, family?: number): boolean;
-
 export function startFilterProxy(options: FilterProxyOptions): Promise<FilterProxyHandle>;

package/lib/proxy.js

@@ -2,34 +2,11 @@
 'use strict';
 
 const { lookup } = require('node:dns/promises');
-const { BlockList, connect, createServer, isIP } = require('node:net');
-
-const prohibitedProxyAddresses = new BlockList();
-
-for (const [network, prefix] of [
-  ['0.0.0.0', 8],
-  ['10.0.0.0', 8],
-  ['100.64.0.0', 10],
-  ['127.0.0.0', 8],
-  ['169.254.0.0', 16],
-  ['172.16.0.0', 12],
-  ['192.0.0.0', 24],
-  ['192.168.0.0', 16],
-  ['198.18.0.0', 15],
-  ['224.0.0.0', 4],
-  ['240.0.0.0', 4],
-]) {
-  prohibitedProxyAddresses.addSubnet(network, prefix, 'ipv4');
-}
-for (const [network, prefix] of [
-  ['::', 128],
-  ['::1', 128],
-  ['fc00::', 7],
-  ['fe80::', 10],
-  ['ff00::', 8],
-]) {
-  prohibitedProxyAddresses.addSubnet(network, prefix, 'ipv6');
-}
+const { Agent, createServer: createHttpServer, request: requestHttp } = require('node:http');
+const { connect, isIP } = require('node:net');
+const { pipeline } = require('node:stream');
+
+const { canonicalizeHost } = require('./shared');
 
 function parseProxyPort(value, defaultPort) {
   const rawPort = value ?? String(defaultPort);
@@ -39,56 +16,58 @@ function parseProxyPort(value, defaultPort) {
   return port >= 1 && port <= 65535 ? port : null;
 }
 
-function splitHostPort(target, defaultPort) {
-  const bracketMatch = target.match(/^\[([^\]]+)\](?::(.*))?$/);
-  const host = bracketMatch?.[1];
-  if (host) {
-    const port = parseProxyPort(bracketMatch[2], defaultPort);
-    return port === null ? null : { host, port };
+function splitHostPort(target) {
+  if (/\s|[\u0000-\u001f\u007f]/.test(target) || /[/?#\\]/.test(target)) return null;
+
+  let url;
+  try {
+    url = new URL(`connect://${target}`);
+  } catch {
+    return null;
   }
 
-  const lastColon = target.lastIndexOf(':');
-  if (lastColon > -1 && target.indexOf(':') === lastColon) {
-    const port = parseProxyPort(target.slice(lastColon + 1), defaultPort);
-    return port === null ? null : { host: target.slice(0, lastColon), port };
+  if (url.username || url.password || url.pathname || url.search || url.hash || !url.port) {
+    return null;
   }
 
-  return { host: target, port: defaultPort };
+  const host = canonicalizeHost(url.hostname);
+  const port = parseProxyPort(url.port, 0);
+  if (!host || port === null) return null;
+  return { host, port };
 }
 
-function denyProxyRequest(client, status = '403 Forbidden') {
-  client.write(`HTTP/1.1 ${status}\r\nContent-Length: 0\r\n\r\n`);
+const proxyAuthenticateChallenge = 'Basic realm="landstrip"';
+
+function denyProxyRequest(client, status = '403 Forbidden', headers = {}) {
+  let response = `HTTP/1.1 ${status}\r\nContent-Length: 0\r\n`;
+  for (const [name, value] of Object.entries(headers)) response += `${name}: ${value}\r\n`;
+  client.write(`${response}\r\n`);
   client.end();
 }
 
-function isPublicProxyAddress(address, family = isIP(address)) {
-  if (family === 4) return !prohibitedProxyAddresses.check(address, 'ipv4');
-  if (family === 6) return !prohibitedProxyAddresses.check(address, 'ipv6');
-  return false;
-}
+async function resolveProxyEndpoints(host) {
+  const canonicalHost = canonicalizeHost(host);
+  if (!canonicalHost) throw new Error('Proxy destination has an invalid host');
 
-async function resolveProxyEndpoint(host) {
-  const literalFamily = isIP(host);
+  const literalFamily = isIP(canonicalHost);
   if (literalFamily === 4 || literalFamily === 6) {
-    if (!isPublicProxyAddress(host, literalFamily)) {
-      throw new Error(`Proxy destination is not public: ${host}`);
-    }
-    return { address: host, family: literalFamily };
+    return [{ address: canonicalHost, family: literalFamily }];
   }
 
-  const addresses = await lookup(host, { all: true, verbatim: true });
-  if (
-    addresses.length === 0 ||
-    addresses.some(({ address, family }) => !isPublicProxyAddress(address, family))
-  ) {
-    throw new Error(`Proxy destination resolves to a non-public address: ${host}`);
+  const addresses = await lookup(canonicalHost, { all: true, verbatim: true });
+  const endpoints = [];
+  const seen = new Set();
+  for (const { address } of addresses) {
+    const canonicalAddress = canonicalizeHost(address);
+    const family = canonicalAddress ? isIP(canonicalAddress) : 0;
+    if ((family !== 4 && family !== 6) || seen.has(canonicalAddress)) continue;
+    seen.add(canonicalAddress);
+    endpoints.push({ address: canonicalAddress, family });
   }
-
-  const endpoint = addresses[0];
-  if (endpoint.family !== 4 && endpoint.family !== 6) {
-    throw new Error(`Proxy could not resolve destination: ${host}`);
+  if (endpoints.length === 0) {
+    throw new Error(`Proxy could not resolve destination: ${canonicalHost}`);
   }
-  return { address: endpoint.address, family: endpoint.family };
+  return endpoints;
 }
 
 function pipeSockets(client, upstream, initialData) {
@@ -104,166 +83,231 @@ function pipeSockets(client, upstream, initialData) {
 function startFilterProxy(options) {
   const { isDomainAllowed, authorization, portRange } = options;
   const sockets = new Set();
+  const hopByHopHeaders = [
+    'connection',
+    'keep-alive',
+    'proxy-authenticate',
+    'proxy-authorization',
+    'proxy-connection',
+    'te',
+    'trailer',
+    'transfer-encoding',
+    'upgrade',
+  ];
+
+  function trackSocket(socket) {
+    sockets.add(socket);
+    socket.once('close', () => sockets.delete(socket));
+  }
 
-  // Track the upstream socket so stop() tears it down, and abandon a still-
-  // connecting upstream when its client goes away — otherwise a connect to a
-  // black-holed host lingers in SYN-retry (~2 min), leaking an fd per request.
-  function trackUpstream(upstream, client, settled) {
-    sockets.add(upstream);
-    upstream.once('close', () => sockets.delete(upstream));
-    client.once('close', () => {
-      if (!settled()) upstream.destroy();
-    });
+  async function connectProxyEndpoints(endpoints, port, client) {
+    let lastError;
+    for (const endpoint of endpoints) {
+      if (stopped || client.destroyed) throw new Error('Proxy connection was cancelled');
+
+      try {
+        return await new Promise((resolve, reject) => {
+          const upstream = connect({ host: endpoint.address, port, family: endpoint.family });
+          let connected = false;
+          const destroyUpstream = () => upstream.destroy();
+          trackSocket(upstream);
+          client.once('close', destroyUpstream);
+          upstream.once('connect', () => {
+            connected = true;
+            resolve(upstream);
+          });
+          upstream.once('error', reject);
+          upstream.once('close', () => {
+            client.off('close', destroyUpstream);
+            if (!connected) reject(new Error('Proxy connection closed'));
+          });
+        });
+      } catch (error) {
+        lastError = error;
+      }
+    }
+    throw lastError ?? new Error('Proxy could not connect to destination');
+  }
+
+  function isAuthorized(headers) {
+    return !authorization || headers['proxy-authorization'] === authorization;
+  }
+
+  function stripHopByHopHeaders(headers) {
+    const forwarded = { ...headers };
+    const connection = forwarded.connection;
+    const connectionValue = Array.isArray(connection) ? connection.join(',') : connection;
+    for (const name of connectionValue?.split(',') ?? []) {
+      delete forwarded[name.trim().toLowerCase()];
+    }
+    for (const name of hopByHopHeaders) delete forwarded[name];
+    return forwarded;
+  }
+
+  function denyHttpRequest(response, statusCode, statusMessage, headers = {}) {
+    if (!response.headersSent) {
+      response.writeHead(statusCode, statusMessage, {
+        Connection: 'close',
+        'Content-Length': '0',
+        ...headers,
+      });
+    }
+    response.end();
   }
 
   async function handleConnect(client, target, rest) {
-    const endpoint = splitHostPort(target, 443);
+    const endpoint = splitHostPort(target);
     if (!endpoint) {
       denyProxyRequest(client, '400 Bad Request');
       return;
     }
 
     if (!(await isDomainAllowed(endpoint.host))) {
-      denyProxyRequest(client);
+      if (!client.destroyed) denyProxyRequest(client);
       return;
     }
+    if (stopped || client.destroyed) return;
 
-    const resolved = await resolveProxyEndpoint(endpoint.host);
-    let settled = false;
-    const upstream = connect(
-      { host: resolved.address, port: endpoint.port, family: resolved.family },
-      () => {
-        settled = true;
-        client.write('HTTP/1.1 200 Connection Established\r\n\r\n');
-        pipeSockets(client, upstream, rest);
-      },
-    );
-    trackUpstream(upstream, client, () => settled);
-    upstream.once('error', () => {
-      if (settled) return;
-      settled = true;
-      denyProxyRequest(client, '502 Bad Gateway');
-    });
-  }
+    const endpoints = await resolveProxyEndpoints(endpoint.host);
+    if (stopped || client.destroyed) return;
 
-  async function handleHttp(client, headerText, rest) {
-    const lines = headerText.split(/\r?\n/);
-    const requestLine = lines[0];
-    if (!requestLine) {
-      denyProxyRequest(client, '400 Bad Request');
+    let upstreamSocket;
+    try {
+      upstreamSocket = await connectProxyEndpoints(endpoints, endpoint.port, client);
+    } catch {
+      if (!stopped && !client.destroyed) denyProxyRequest(client, '502 Bad Gateway');
+      return;
+    }
+    if (stopped || client.destroyed) {
+      upstreamSocket.destroy();
       return;
     }
 
-    const [method, rawTarget, version] = requestLine.split(' ');
-    if (!method || !rawTarget || !version) {
-      denyProxyRequest(client, '400 Bad Request');
+    client.write('HTTP/1.1 200 Connection Established\r\n\r\n');
+    pipeSockets(client, upstreamSocket, rest);
+  }
+
+  async function handleHttp(clientRequest, clientResponse) {
+    if (!isAuthorized(clientRequest.headers)) {
+      denyHttpRequest(clientResponse, 407, 'Proxy Authentication Required', {
+        'Proxy-Authenticate': proxyAuthenticateChallenge,
+      });
       return;
     }
 
     let url;
     try {
-      url = new URL(rawTarget);
+      url = new URL(clientRequest.url);
     } catch {
-      const host = lines
-        .find((line) => line.toLowerCase().startsWith('host:'))
-        ?.slice(5)
-        .trim();
-      if (!host) {
-        denyProxyRequest(client, '400 Bad Request');
+      const authority = clientRequest.headers.host;
+      if (!authority) {
+        denyHttpRequest(clientResponse, 400, 'Bad Request');
         return;
       }
 
       try {
-        url = new URL(`http://${host}${rawTarget}`);
+        url = new URL(`http://${authority}${clientRequest.url}`);
       } catch {
-        denyProxyRequest(client, '400 Bad Request');
+        denyHttpRequest(clientResponse, 400, 'Bad Request');
         return;
       }
     }
 
-    if (!(await isDomainAllowed(url.hostname))) {
-      denyProxyRequest(client);
+    if (url.protocol !== 'http:' || url.username || url.password) {
+      denyHttpRequest(clientResponse, 400, 'Bad Request');
+      return;
+    }
+
+    const host = canonicalizeHost(url.hostname);
+    if (!host) {
+      denyHttpRequest(clientResponse, 400, 'Bad Request');
+      return;
+    }
+    if (!(await isDomainAllowed(host))) {
+      if (!clientResponse.destroyed) denyHttpRequest(clientResponse, 403, 'Forbidden');
       return;
     }
+    const clientSocket = clientRequest.socket;
+    if (stopped || clientSocket.destroyed || clientResponse.destroyed) return;
 
-    const port = parseProxyPort(url.port || undefined, url.protocol === 'https:' ? 443 : 80);
+    const port = parseProxyPort(url.port || undefined, 80);
     if (port === null) {
-      denyProxyRequest(client, '400 Bad Request');
+      denyHttpRequest(clientResponse, 400, 'Bad Request');
       return;
     }
 
-    const path = `${url.pathname}${url.search}` || '/';
-    lines[0] = `${method} ${path} ${version}`;
-
-    const rewrittenHeader = lines
-      .filter(
-        (line) =>
-          !line.toLowerCase().startsWith('proxy-connection:') &&
-          !line.toLowerCase().startsWith('proxy-authorization:'),
-      )
-      .map((line) => (line.toLowerCase().startsWith('host:') ? `Host: ${url.host}` : line))
-      .join('\r\n');
-    const resolved = await resolveProxyEndpoint(url.hostname);
-    let settled = false;
-    const upstream = connect({ host: resolved.address, port, family: resolved.family }, () => {
-      settled = true;
-      upstream.write(`${rewrittenHeader}\r\n\r\n`);
-      pipeSockets(client, upstream, rest);
-    });
-    trackUpstream(upstream, client, () => settled);
-    upstream.once('error', () => {
-      if (settled) return;
-      settled = true;
-      denyProxyRequest(client, '502 Bad Gateway');
-    });
-  }
+    const endpoints = await resolveProxyEndpoints(host);
+    if (stopped || clientSocket.destroyed || clientResponse.destroyed) return;
 
-  function handleClient(client) {
-    sockets.add(client);
-    client.on('close', () => sockets.delete(client));
-    client.on('error', () => sockets.delete(client));
-
-    let buffered = Buffer.alloc(0);
-
-    client.on('data', (chunk) => {
-      buffered = Buffer.concat([buffered, chunk]);
-      const headerEnd = buffered.indexOf('\r\n\r\n');
-      if (headerEnd === -1) {
-        if (buffered.length > 65536) {
-          client.removeAllListeners('data');
-          client.pause();
-          denyProxyRequest(client, '431 Request Header Fields Too Large');
-        }
-        return;
-      }
+    const forwardedHeaders = stripHopByHopHeaders(clientRequest.headers);
+    forwardedHeaders.host = url.host;
 
-      client.pause();
-      client.removeAllListeners('data');
-
-      const header = buffered.subarray(0, headerEnd).toString('utf-8');
-      const rest = buffered.subarray(headerEnd + 4);
-      if (authorization) {
-        const supplied = header
-          .split(/\r?\n/)
-          .find((line) => line.toLowerCase().startsWith('proxy-authorization:'))
-          ?.slice('proxy-authorization:'.length)
-          .trim();
-        if (supplied !== authorization) {
-          denyProxyRequest(client, '407 Proxy Authentication Required');
-          return;
-        }
+    const agent = new Agent();
+    agent.createConnection = (_options, callback) => {
+      connectProxyEndpoints(endpoints, port, clientSocket).then(
+        (socket) => callback(null, socket),
+        (error) => callback(error),
+      );
+    };
+    const upstreamRequest = requestHttp({
+      host,
+      port,
+      method: clientRequest.method,
+      path: `${url.pathname}${url.search}` || '/',
+      headers: forwardedHeaders,
+      agent,
+    });
+    upstreamRequest.once('response', (upstreamResponse) => {
+      clientResponse.writeHead(
+        upstreamResponse.statusCode ?? 502,
+        upstreamResponse.statusMessage,
+        stripHopByHopHeaders(upstreamResponse.headers),
+      );
+      pipeline(upstreamResponse, clientResponse, (error) => {
+        if (error) upstreamRequest.destroy();
+      });
+    });
+    upstreamRequest.once('error', () => {
+      if (!clientResponse.headersSent) {
+        denyHttpRequest(clientResponse, 502, 'Bad Gateway');
+      } else {
+        clientResponse.destroy();
       }
-      const [method, target] = header.split(/\r?\n/, 1)[0].split(' ');
-
-      const task =
-        method?.toUpperCase() === 'CONNECT' && target
-          ? handleConnect(client, target, rest)
-          : handleHttp(client, header, rest);
-      task.catch(() => denyProxyRequest(client, '502 Bad Gateway'));
     });
+    clientRequest.once('aborted', () => upstreamRequest.destroy());
+    clientRequest.once('error', () => upstreamRequest.destroy());
+    clientResponse.once('error', () => upstreamRequest.destroy());
+    clientResponse.once('close', () => {
+      clientRequest.unpipe(upstreamRequest);
+      upstreamRequest.destroy();
+      agent.destroy();
+    });
+    clientRequest.pipe(upstreamRequest);
   }
 
-  const server = createServer(handleClient);
+  const server = createHttpServer({ maxHeaderSize: 65536 }, (request, response) => {
+    handleHttp(request, response).catch(() => denyHttpRequest(response, 502, 'Bad Gateway'));
+  });
+  server.on('connection', trackSocket);
+  server.on('connect', (request, client, head) => {
+    if (!isAuthorized(request.headers)) {
+      denyProxyRequest(client, '407 Proxy Authentication Required', {
+        'Proxy-Authenticate': proxyAuthenticateChallenge,
+      });
+      return;
+    }
+    handleConnect(client, request.url, head).catch(() =>
+      denyProxyRequest(client, '502 Bad Gateway'),
+    );
+  });
+  server.on('clientError', (error, client) => {
+    const status =
+      error.code === 'HPE_HEADER_OVERFLOW'
+        ? '431 Request Header Fields Too Large'
+        : '400 Bad Request';
+    denyProxyRequest(client, status);
+  });
+
   let stopped = false;
 
   return new Promise((resolve, reject) => {
@@ -299,6 +343,5 @@ function startFilterProxy(options) {
 }
 
 module.exports = {
-  isPublicProxyAddress,
   startFilterProxy,
 };

package/lib/shared.d.ts

@@ -29,6 +29,8 @@ export function sessionAllows(prefixes: Set<string>, filePath: string): boolean;
 
 export function sessionScopeFor(filePath: string, baseDirectory: string): string;
 
+export function canonicalizeHost(host: string): string | null;
+
 export function domainMatchesPattern(domain: string, pattern: string): boolean;
 
 export function domainMatchesAny(domain: string, patterns: string[]): boolean;

package/lib/shared.js

@@ -4,6 +4,9 @@
 const { lstatSync, readlinkSync, realpathSync } = require('node:fs');
 const { homedir } = require('node:os');
 const { basename, dirname, isAbsolute, join, relative, resolve, sep } = require('node:path');
+const { domainToASCII } = require('node:url');
+
+const ipaddr = require('ipaddr.js');
 
 function isRecord(value) {
   return typeof value === 'object' && value !== null && !Array.isArray(value);
@@ -64,18 +67,43 @@ function sessionScopeFor(filePath, baseDirectory) {
   return dir;
 }
 
-function domainMatchesPattern(domain, pattern) {
+function canonicalizeHost(host) {
+  if (/[\s\p{Cc}/\\@?#]/u.test(host)) return null;
+
+  const bracketed = host.startsWith('[');
+  if (bracketed !== host.endsWith(']')) return null;
+  const value = bracketed ? host.slice(1, -1) : host;
+
+  if (ipaddr.isValid(value)) {
+    if (bracketed && ipaddr.parse(value).kind() !== 'ipv6') return null;
+    return ipaddr.process(value).toString();
+  }
+  if (bracketed || /[:%]/.test(value)) return null;
+
   // A trailing dot ("pastebin.com.") is the same host to DNS but would slip
-  // past a literal deny entry; strip it from both sides before matching.
-  const normalizedDomain = domain.toLowerCase().replace(/\.+$/, '');
-  const normalizedPattern = pattern.toLowerCase().replace(/\.+$/, '');
-
-  if (normalizedPattern === '*') return true;
-  if (normalizedPattern.startsWith('*.')) {
-    const base = normalizedPattern.slice(2);
-    return normalizedDomain === base || normalizedDomain.endsWith(`.${base}`);
+  // past a literal deny entry; strip a single trailing dot and reject the rest.
+  const ascii = domainToASCII(value).replace(/\.$/, '');
+  if (!ascii || ascii.endsWith('.')) return null;
+
+  try {
+    const parsed = new URL(`http://${ascii}/`);
+    return parsed.hostname === ascii.toLowerCase() ? parsed.hostname : null;
+  } catch {
+    return null;
+  }
+}
+
+function domainMatchesPattern(domain, pattern) {
+  const normalizedDomain = canonicalizeHost(domain);
+  if (!normalizedDomain) return false;
+  if (pattern === '*') return true;
+
+  if (pattern.startsWith('*.')) {
+    const base = canonicalizeHost(pattern.slice(2));
+    return base !== null && (normalizedDomain === base || normalizedDomain.endsWith(`.${base}`));
   }
 
+  const normalizedPattern = canonicalizeHost(pattern);
   return normalizedDomain === normalizedPattern;
 }
 
@@ -330,6 +358,7 @@ module.exports = {
   pathUnderDirectory,
   sessionAllows,
   sessionScopeFor,
+  canonicalizeHost,
   domainMatchesPattern,
   domainMatchesAny,
   allowsAllDomains,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@landstrip/landstrip-api",
-  "version": "0.18.42",
+  "version": "0.19.0",
   "description": "Sandbox runner using Landlock, Seatbelt, and AppContainer",
   "license": "Apache-2.0",
   "homepage": "https://github.com/landstrip/landstrip#readme",
@@ -36,13 +36,16 @@
     "README.md",
     "LICENSE"
   ],
+  "dependencies": {
+    "ipaddr.js": "^2.5.0"
+  },
   "optionalDependencies": {
-    "@landstrip/landstrip-darwin-arm64": "0.18.42",
-    "@landstrip/landstrip-darwin-x64": "0.18.42",
-    "@landstrip/landstrip-linux-x64": "0.18.42",
-    "@landstrip/landstrip-linux-arm64": "0.18.42",
-    "@landstrip/landstrip-win32-x64": "0.18.42",
-    "@landstrip/landstrip-win32-arm64": "0.18.42"
+    "@landstrip/landstrip-darwin-arm64": "0.19.0",
+    "@landstrip/landstrip-darwin-x64": "0.19.0",
+    "@landstrip/landstrip-linux-x64": "0.19.0",
+    "@landstrip/landstrip-linux-arm64": "0.19.0",
+    "@landstrip/landstrip-win32-x64": "0.19.0",
+    "@landstrip/landstrip-win32-arm64": "0.19.0"
   },
   "publishConfig": {
     "access": "public"