@landstrip/landstrip 0.18.27 → 0.18.28

package/README.md

@@ -1,50 +1,46 @@
-<!-- SPDX-License-Identifier: GPL-3.0-or-later -->
+<!-- SPDX-License-Identifier: LGPL-2.1-or-later -->
 <!-- Copyright (C) Jarkko Sakkinen 2026 -->
 
 # landstrip
 
-`landstrip` runs a command inside an OS sandbox: Landlock on Linux, Seatbelt on
-macOS, and AppContainer or a restricted user on Windows. Its policy format is
+`landstrip` runs commands in an OS-level sandbox using Landlock on Linux,
+Seatbelt on macOS, and AppContainer or restricted users on Windows. Policies use
 the supported subset of the Anthropic Sandbox Runtime format.
 
-## Install
+## Installation
 
 ```sh
 npm install --save-dev @landstrip/landstrip
 npx landstrip run -p policy.json -- cargo test
 ```
 
-The npm package selects the native binary for the current platform.
+The npm package installs a Node.js wrapper and a native binary for the current
+platform.
 
-## Commands
+## Quick start
 
-```text
-landstrip run [OPTIONS] -- <PROGRAM> [ARGS...]
-landstrip policy validate [OPTIONS]
-landstrip policy resolve [OPTIONS]
+```sh
+landstrip run -p policy.json -- cargo test
+landstrip policy validate -p policy.json
+landstrip policy resolve -p policy.json
 landstrip doctor
-landstrip windows install [OPTIONS]
-landstrip windows status
-landstrip windows uninstall
 ```
 
-The `windows` commands are available only in Windows builds. `doctor` checks
-whether the platform sandbox is usable. Inspection commands print one JSON
-document. `run` returns the program's exit status; usage errors return 2 and
-other Landstrip failures return 1.
+Windows builds also provide `windows install`, `windows status`, and
+`windows uninstall`. Full command reference: `landstrip --help` and the
+[manual page](man/man1/landstrip.1).
+
+### Agent extensions
 
-Pass a policy with `-p, --policy <FILE>`. Repeat the option to merge policies
-from left to right: objects merge recursively, arrays combine without duplicate
-entries, and later scalar values replace earlier values. JSON is the default;
-use `--policy-format yaml` for YAML and always specify a format with `-p -`.
+```sh
+pi install npm:pi-landstrip
+opencode plugin install opencode-landstrip
+```
 
-`policy validate` parses and resolves the policy and checks platform support.
-`policy resolve` prints the normalized result; `--tool <PROGRAM>` also merges
-policy attached to that executable. Executable policy is applied last from the
-`user.landstrip.policy` extended attribute on Unix or the `landstrip.policy`
-NTFS alternate data stream on Windows.
+See [pi-landstrip](packages/pi-landstrip/README.md) and
+[opencode-landstrip](packages/opencode-landstrip/README.md).
 
-## Policy
+## Policy sketch
 
 ```json
 {
@@ -57,133 +53,20 @@ NTFS alternate data stream on Windows.
   "network": {
     "allowNetwork": false,
     "httpProxyPort": 8080,
-    "socksProxyPort": 1080,
     "allowLocalBinding": false,
-    "allowAllUnixSockets": false,
     "allowUnixSockets": []
-  },
-  "windows": {
-    "appContainerMode": "lpac",
-    "allowLoopback": false
   }
 }
 ```
 
-Paths may be absolute, relative to the command's starting directory, or start
-with `~`. Path fields accept arrays or newline-separated strings. Entries accept
-`*`, `**`, `?`, and character-class globs.
-
-### Filesystem
-
-| Field | Default | Effect |
-| --- | --- | --- |
-| `allowWrite` | `[]` | Writable roots |
-| `denyWrite` | `[]` | Hard write denials; takes precedence over `allowWrite` |
-| `denyRead` | `[]` | Read restrictions; empty means unrestricted reads |
-| `allowRead` | `[]` | Exceptions to `denyRead` |
-
-When read rules overlap, the most specific rule wins. Concrete `denyWrite` paths
-work on every platform. Linux and macOS also enforce glob denials at access time,
-including for newly created files; Windows does not enforce glob `denyWrite`.
-
-### Network
-
-| Field | Default | Effect |
-| --- | --- | --- |
-| `allowNetwork` | `false` | Disables network enforcement when `true` |
-| `httpProxyPort` | unset | Allows loopback connection to this port |
-| `socksProxyPort` | unset | Allows loopback connection to this port |
-| `allowLocalBinding` | `false` | Allows local TCP binding and loopback connections |
-| `allowAllUnixSockets` | `false` | Allows every Unix socket |
-| `allowUnixSockets` | `[]` | Allows listed pathname Unix sockets |
-
-Landstrip does not start a proxy or filter domains. Direct TCP and new Unix
-sockets are denied unless allowed by these fields.
-
-### Windows
-
-`windows.appContainerMode` is `"lpac"` by default; `"standard"` is weaker
-because it can read resources granted to `ALL APPLICATION PACKAGES`.
-`windows.allowLoopback` exposes every local loopback service in AppContainer;
-without it, proxy ports are blocked. The removed `windows.backend` field is an
-error.
-
-Windows requires explicit read roots. ACL allow roots must exist when policy is
-resolved; missing `allowRead` and `allowWrite` targets are omitted and remain
-inaccessible. Windows does not support `allowLocalBinding` or Unix socket
-policy.
-
-Use `landstrip windows install` when software such as Git Bash cannot start in
-AppContainer. It provisions restricted local users and activates that mode.
-`windows uninstall` removes it. An unhealthy installation fails closed; inspect
-it with `windows status`. Restricted-user mode permits proxy ports only from the
-range selected at installation and does not support `windows.allowLoopback`.
-
-## Platform enforcement
-
-| Platform | Filesystem | Network |
-| --- | --- | --- |
-| Linux | Landlock and seccomp | TCP and Unix socket rules |
-| macOS | Seatbelt | TCP and Unix socket rules |
-| Windows | AppContainer or restricted user | AppContainer capabilities or account-scoped WFP |
-
-## Agent extensions
-
-[pi-landstrip](packages/pi-landstrip/README.md) and
-[opencode-landstrip](packages/opencode-landstrip/README.md) integrate Landstrip
-with coding agents.
-
-- **Agent permissions** authorize tool dispatch.
-- **Sandbox permissions** authorize filesystem and network access.
-
-An agent approval does not bypass the sandbox. Each plugin documents its prompt
-order, approval scopes, and configuration files.
-
-```sh
-pi install npm:pi-landstrip
-opencode plugin install opencode-landstrip
-```
-
-## Traps
-
-Landstrip failures and broker-reported denials are JSON objects with stable
-`kind` and `code` fields. Completed records go to standard error.
-
-On Unix, `--trap-fd FD` writes structured events to an already-open descriptor
-numbered 3 or higher. On Linux, a socket trap descriptor can receive a
-filesystem or network event with `state: "query"`; the operation waits for its
-host to answer. Kernel-only and static-profile denials do not always emit a
-per-access event. Trap kinds are `filesystem`, `network`, `launch`, `usage`, and
-`internal`.
-
-## Development
-
-```sh
-make ci
-CI_MSRV=1 make ci
-make package
-make package PLATFORMS='linux-x64 win32-x64'
-PACKAGE_STRICT=1 make package
-```
-
-`scripts/ci.sh` checks Rust and every agent-extension workspace, stages the host
-binary, and smoke-tests the npm wrapper. Packaging uses `cross` and Docker for
-cross targets. macOS targets build natively on macOS; Linux hosts require local
-osxcross images. Windows Arm64 requires the local
-`ghcr.io/cross-rs/aarch64-pc-windows-msvc-cross:local` image.
-
-After `scripts/release.sh <version>` and pushing the tag:
-
-```sh
-make ci
-PACKAGE_STRICT=1 make package
-make publish
-```
+Pass policies with `-p, --policy <FILE>` (repeatable). Semantics, platform
+limits, traps, and exit status are in the manual page.
 
-`make publish` publishes the crates.io and npm packages and uploads release
-archives from locally packaged artifacts.
+## License
 
-## Licensing
+`landstrip` is free software under the GNU Lesser General Public License
+version 2.1 or later (LGPL-2.1+). See [LICENSE-LGPL-2.1](LICENSE-LGPL-2.1).
 
-The JavaScript wrapper is `Apache-2.0`. Rust source and native binaries are
-`LGPL-2.1-or-later`; corresponding source is available from the matching tag.
+The JavaScript npm wrapper is under the Apache License 2.0. See
+[LICENSE-APACHE-2.0](LICENSE-APACHE-2.0). Corresponding source for each native
+package is available from the matching repository tag.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@landstrip/landstrip",
-  "version": "0.18.27",
+  "version": "0.18.28",
   "description": "Sandbox runner using Landlock, Seatbelt, and AppContainer",
   "license": "Apache-2.0 AND LGPL-2.1-or-later",
   "homepage": "https://github.com/landstrip/landstrip#readme",
@@ -30,12 +30,12 @@
     "LICENSE-LGPL-2.1"
   ],
   "optionalDependencies": {
-    "@landstrip/landstrip-darwin-arm64": "0.18.27",
-    "@landstrip/landstrip-darwin-x64": "0.18.27",
-    "@landstrip/landstrip-linux-x64": "0.18.27",
-    "@landstrip/landstrip-linux-arm64": "0.18.27",
-    "@landstrip/landstrip-win32-x64": "0.18.27",
-    "@landstrip/landstrip-win32-arm64": "0.18.27"
+    "@landstrip/landstrip-darwin-arm64": "0.18.28",
+    "@landstrip/landstrip-darwin-x64": "0.18.28",
+    "@landstrip/landstrip-linux-x64": "0.18.28",
+    "@landstrip/landstrip-linux-arm64": "0.18.28",
+    "@landstrip/landstrip-win32-x64": "0.18.28",
+    "@landstrip/landstrip-win32-arm64": "0.18.28"
   },
   "publishConfig": {
     "access": "public"