@landstrip/landstrip 0.18.34 → 0.18.36

package/README.md

@@ -1,13 +1,9 @@
-<!-- SPDX-License-Identifier: LGPL-2.1-or-later -->
-<!-- Copyright (C) Jarkko Sakkinen 2026 -->
-
 # landstrip
 
 `landstrip` runs commands in an OS-level sandbox using Landlock on Linux,
-Seatbelt on macOS, and AppContainer or restricted users on Windows. Policies use
-the supported subset of the Anthropic Sandbox Runtime format.
+Seatbelt on macOS, and AppContainer or restricted users on Windows.
 
-## Installation
+## Install
 
 ```sh
 npm install --save-dev @landstrip/landstrip
@@ -17,7 +13,7 @@ npx landstrip run -p policy.json -- cargo test
 The npm package installs a Node.js wrapper and a native binary for the current
 platform.
 
-## Quick start
+## Usage
 
 ```sh
 landstrip run -p policy.json -- cargo test
@@ -26,21 +22,17 @@ landstrip policy resolve -p policy.json
 landstrip doctor
 ```
 
-Windows builds also provide `windows install`, `windows status`, and
-`windows uninstall`. Full command reference: `landstrip --help` and the
-[manual page](man/man1/landstrip.1).
-
-### Agent extensions
+Run `landstrip --help` or see [landstrip(1)](man/man1/landstrip.1) for the full
+command reference.
 
-```sh
-pi install npm:pi-landstrip
-opencode plugin install opencode-landstrip
-```
+## Agent extensions
 
-See [pi-landstrip](packages/pi-landstrip/README.md) and
-[opencode-landstrip](packages/opencode-landstrip/README.md).
+| Integration | Package                | Documentation                                                        |
+| ----------- | ---------------------- | -------------------------------------------------------------------- |
+| OpenCode    | `opencode-landstrip`   | [OpenCode](packages/opencode-landstrip/README.md)                    |
+| Pi          | `pi-landstrip`         | [Pi](packages/pi-landstrip/README.md)                                |
 
-## Policy sketch
+## Policy
 
 ```json
 {
@@ -52,49 +44,23 @@ See [pi-landstrip](packages/pi-landstrip/README.md) and
   },
   "network": {
     "allowNetwork": false,
-    "httpProxyPort": 8080,
-    "allowLocalBinding": false,
-    "allowUnixSockets": []
+    "allowLocalBinding": false
   }
 }
 ```
 
-Pass policies with `-p, --policy <FILE>` (repeatable). Semantics, platform
-limits, traps, and exit status are in the manual page.
+Pass policies with `-p, --policy <FILE>`. Later policies merge over earlier
+ones. Platform behavior and limits are documented in the manual.
 
 ## Development
 
-### Package
-
-Artifacts land in `npm/*/bin` and `artifacts/`. Staging writes platform tarballs
-and matching `<file>.sha256` sidecars under `artifacts/`.
-
-Non-host targets use [`cargo-zigbuild`](https://github.com/rust-cross/cargo-zigbuild)
-(Zig as linker). Requires `cargo-zigbuild`, `zig`, and the matching `rustup`
-targets (`x86_64-unknown-linux-musl`, `aarch64-unknown-linux-musl`,
-`x86_64-pc-windows-gnu`, `aarch64-pc-windows-gnullvm`, `aarch64-apple-darwin`,
-`x86_64-apple-darwin`). Host-native triples use plain `cargo`. Darwin links
-`libsandbox`; from Linux set `SDKROOT` to a macOS SDK (Apple SDK; not
-redistributed).
-
-```sh
-make package
-make package PLATFORMS='linux-x64 win32-x64'
-PACKAGE_STRICT=1 make package
-```
-
-`make publish` uploads each GitHub release tarball with its `<file>.sha256`
-sidecar. Verify a download with:
-
 ```sh
-sha256sum -c landstrip-<version>-<platform>.tar.gz.sha256
+make ci
 ```
 
-## License
+## Licensing
 
-`landstrip` is free software under the GNU Lesser General Public License
-version 2.1 or later (LGPL-2.1+). See [LICENSE-LGPL-2.1](LICENSE-LGPL-2.1).
+`landstrip` uses [LGPL-2.1+](LICENSE-LGPL-2.1).
 
-The JavaScript npm wrapper is under the Apache License 2.0. See
-[LICENSE-APACHE-2.0](LICENSE-APACHE-2.0). Corresponding source for each native
-package is available from the matching repository tag.
+The JavaScript wrapper and agent extensions use
+[Apache 2.0](LICENSE-APACHE-2.0).

package/lib/proxy.d.ts

@@ -0,0 +1,24 @@
+// SPDX-License-Identifier: Apache-2.0
+
+export interface ProxyPortRange {
+  low: number;
+  high: number;
+}
+
+export interface FilterProxyOptions {
+  /** Gate for every proxied domain; may prompt interactively. */
+  isDomainAllowed(domain: string): boolean | Promise<boolean>;
+  /** Exact `Proxy-Authorization` header value required from clients. */
+  authorization?: string;
+  /** Inclusive listen port range; defaults to an ephemeral port. */
+  portRange?: ProxyPortRange;
+}
+
+export interface FilterProxyHandle {
+  port: number;
+  stop(): Promise<void>;
+}
+
+export function isPublicProxyAddress(address: string, family?: number): boolean;
+
+export function startFilterProxy(options: FilterProxyOptions): Promise<FilterProxyHandle>;

package/lib/proxy.js

@@ -0,0 +1,304 @@
+// SPDX-License-Identifier: Apache-2.0
+'use strict';
+
+const { lookup } = require('node:dns/promises');
+const { BlockList, connect, createServer, isIP } = require('node:net');
+
+const prohibitedProxyAddresses = new BlockList();
+
+for (const [network, prefix] of [
+  ['0.0.0.0', 8],
+  ['10.0.0.0', 8],
+  ['100.64.0.0', 10],
+  ['127.0.0.0', 8],
+  ['169.254.0.0', 16],
+  ['172.16.0.0', 12],
+  ['192.0.0.0', 24],
+  ['192.168.0.0', 16],
+  ['198.18.0.0', 15],
+  ['224.0.0.0', 4],
+  ['240.0.0.0', 4],
+]) {
+  prohibitedProxyAddresses.addSubnet(network, prefix, 'ipv4');
+}
+for (const [network, prefix] of [
+  ['::', 128],
+  ['::1', 128],
+  ['fc00::', 7],
+  ['fe80::', 10],
+  ['ff00::', 8],
+]) {
+  prohibitedProxyAddresses.addSubnet(network, prefix, 'ipv6');
+}
+
+function parseProxyPort(value, defaultPort) {
+  const rawPort = value ?? String(defaultPort);
+  if (!/^\d+$/.test(rawPort)) return null;
+
+  const port = Number(rawPort);
+  return port >= 1 && port <= 65535 ? port : null;
+}
+
+function splitHostPort(target, defaultPort) {
+  const bracketMatch = target.match(/^\[([^\]]+)\](?::(.*))?$/);
+  const host = bracketMatch?.[1];
+  if (host) {
+    const port = parseProxyPort(bracketMatch[2], defaultPort);
+    return port === null ? null : { host, port };
+  }
+
+  const lastColon = target.lastIndexOf(':');
+  if (lastColon > -1 && target.indexOf(':') === lastColon) {
+    const port = parseProxyPort(target.slice(lastColon + 1), defaultPort);
+    return port === null ? null : { host: target.slice(0, lastColon), port };
+  }
+
+  return { host: target, port: defaultPort };
+}
+
+function denyProxyRequest(client, status = '403 Forbidden') {
+  client.write(`HTTP/1.1 ${status}\r\nContent-Length: 0\r\n\r\n`);
+  client.end();
+}
+
+function isPublicProxyAddress(address, family = isIP(address)) {
+  if (family === 4) return !prohibitedProxyAddresses.check(address, 'ipv4');
+  if (family === 6) return !prohibitedProxyAddresses.check(address, 'ipv6');
+  return false;
+}
+
+async function resolveProxyEndpoint(host) {
+  const literalFamily = isIP(host);
+  if (literalFamily === 4 || literalFamily === 6) {
+    if (!isPublicProxyAddress(host, literalFamily)) {
+      throw new Error(`Proxy destination is not public: ${host}`);
+    }
+    return { address: host, family: literalFamily };
+  }
+
+  const addresses = await lookup(host, { all: true, verbatim: true });
+  if (
+    addresses.length === 0 ||
+    addresses.some(({ address, family }) => !isPublicProxyAddress(address, family))
+  ) {
+    throw new Error(`Proxy destination resolves to a non-public address: ${host}`);
+  }
+
+  const endpoint = addresses[0];
+  if (endpoint.family !== 4 && endpoint.family !== 6) {
+    throw new Error(`Proxy could not resolve destination: ${host}`);
+  }
+  return { address: endpoint.address, family: endpoint.family };
+}
+
+function pipeSockets(client, upstream, initialData) {
+  upstream.on('error', () => client.destroy());
+  client.on('error', () => upstream.destroy());
+
+  if (initialData?.length) upstream.write(initialData);
+
+  client.pipe(upstream);
+  upstream.pipe(client);
+}
+
+function startFilterProxy(options) {
+  const { isDomainAllowed, authorization, portRange } = options;
+  const sockets = new Set();
+
+  // Track the upstream socket so stop() tears it down, and abandon a still-
+  // connecting upstream when its client goes away — otherwise a connect to a
+  // black-holed host lingers in SYN-retry (~2 min), leaking an fd per request.
+  function trackUpstream(upstream, client, settled) {
+    sockets.add(upstream);
+    upstream.once('close', () => sockets.delete(upstream));
+    client.once('close', () => {
+      if (!settled()) upstream.destroy();
+    });
+  }
+
+  async function handleConnect(client, target, rest) {
+    const endpoint = splitHostPort(target, 443);
+    if (!endpoint) {
+      denyProxyRequest(client, '400 Bad Request');
+      return;
+    }
+
+    if (!(await isDomainAllowed(endpoint.host))) {
+      denyProxyRequest(client);
+      return;
+    }
+
+    const resolved = await resolveProxyEndpoint(endpoint.host);
+    let settled = false;
+    const upstream = connect(
+      { host: resolved.address, port: endpoint.port, family: resolved.family },
+      () => {
+        settled = true;
+        client.write('HTTP/1.1 200 Connection Established\r\n\r\n');
+        pipeSockets(client, upstream, rest);
+      },
+    );
+    trackUpstream(upstream, client, () => settled);
+    upstream.once('error', () => {
+      if (settled) return;
+      settled = true;
+      denyProxyRequest(client, '502 Bad Gateway');
+    });
+  }
+
+  async function handleHttp(client, headerText, rest) {
+    const lines = headerText.split(/\r?\n/);
+    const requestLine = lines[0];
+    if (!requestLine) {
+      denyProxyRequest(client, '400 Bad Request');
+      return;
+    }
+
+    const [method, rawTarget, version] = requestLine.split(' ');
+    if (!method || !rawTarget || !version) {
+      denyProxyRequest(client, '400 Bad Request');
+      return;
+    }
+
+    let url;
+    try {
+      url = new URL(rawTarget);
+    } catch {
+      const host = lines
+        .find((line) => line.toLowerCase().startsWith('host:'))
+        ?.slice(5)
+        .trim();
+      if (!host) {
+        denyProxyRequest(client, '400 Bad Request');
+        return;
+      }
+
+      try {
+        url = new URL(`http://${host}${rawTarget}`);
+      } catch {
+        denyProxyRequest(client, '400 Bad Request');
+        return;
+      }
+    }
+
+    if (!(await isDomainAllowed(url.hostname))) {
+      denyProxyRequest(client);
+      return;
+    }
+
+    const port = parseProxyPort(url.port || undefined, url.protocol === 'https:' ? 443 : 80);
+    if (port === null) {
+      denyProxyRequest(client, '400 Bad Request');
+      return;
+    }
+
+    const path = `${url.pathname}${url.search}` || '/';
+    lines[0] = `${method} ${path} ${version}`;
+
+    const rewrittenHeader = lines
+      .filter(
+        (line) =>
+          !line.toLowerCase().startsWith('proxy-connection:') &&
+          !line.toLowerCase().startsWith('proxy-authorization:'),
+      )
+      .map((line) => (line.toLowerCase().startsWith('host:') ? `Host: ${url.host}` : line))
+      .join('\r\n');
+    const resolved = await resolveProxyEndpoint(url.hostname);
+    let settled = false;
+    const upstream = connect({ host: resolved.address, port, family: resolved.family }, () => {
+      settled = true;
+      upstream.write(`${rewrittenHeader}\r\n\r\n`);
+      pipeSockets(client, upstream, rest);
+    });
+    trackUpstream(upstream, client, () => settled);
+    upstream.once('error', () => {
+      if (settled) return;
+      settled = true;
+      denyProxyRequest(client, '502 Bad Gateway');
+    });
+  }
+
+  function handleClient(client) {
+    sockets.add(client);
+    client.on('close', () => sockets.delete(client));
+    client.on('error', () => sockets.delete(client));
+
+    let buffered = Buffer.alloc(0);
+
+    client.on('data', (chunk) => {
+      buffered = Buffer.concat([buffered, chunk]);
+      const headerEnd = buffered.indexOf('\r\n\r\n');
+      if (headerEnd === -1) {
+        if (buffered.length > 65536) {
+          client.removeAllListeners('data');
+          client.pause();
+          denyProxyRequest(client, '431 Request Header Fields Too Large');
+        }
+        return;
+      }
+
+      client.pause();
+      client.removeAllListeners('data');
+
+      const header = buffered.subarray(0, headerEnd).toString('utf-8');
+      const rest = buffered.subarray(headerEnd + 4);
+      if (authorization) {
+        const supplied = header
+          .split(/\r?\n/)
+          .find((line) => line.toLowerCase().startsWith('proxy-authorization:'))
+          ?.slice('proxy-authorization:'.length)
+          .trim();
+        if (supplied !== authorization) {
+          denyProxyRequest(client, '407 Proxy Authentication Required');
+          return;
+        }
+      }
+      const [method, target] = header.split(/\r?\n/, 1)[0].split(' ');
+
+      const task =
+        method?.toUpperCase() === 'CONNECT' && target
+          ? handleConnect(client, target, rest)
+          : handleHttp(client, header, rest);
+      task.catch(() => denyProxyRequest(client, '502 Bad Gateway'));
+    });
+  }
+
+  const server = createServer(handleClient);
+  let stopped = false;
+
+  return new Promise((resolve, reject) => {
+    const listen = (port) => {
+      server.once('error', (error) => {
+        if (error.code === 'EADDRINUSE' && portRange && port < portRange.high) {
+          listen(port + 1);
+          return;
+        }
+        reject(error);
+      });
+      server.listen(port, '127.0.0.1', () => {
+        server.removeAllListeners('error');
+        const address = server.address();
+
+        resolve({
+          port: address.port,
+          stop: () =>
+            new Promise((done) => {
+              if (stopped) {
+                done();
+                return;
+              }
+              stopped = true;
+              for (const socket of sockets) socket.destroy();
+              server.close(() => done());
+            }),
+        });
+      });
+    };
+    listen(portRange ? portRange.low : 0);
+  });
+}
+
+module.exports = {
+  isPublicProxyAddress,
+  startFilterProxy,
+};

package/lib/shared.d.ts

@@ -13,6 +13,16 @@ export function isRecord(value: unknown): value is Record<string, unknown>;
 
 export function expandHomePath(path: string): string;
 
+export function expandPath(filePath: string, baseDirectory: string): string;
+
+export function canonicalizePath(filePath: string, baseDirectory: string): string;
+
+export function canonicalizeGlobPattern(pattern: string, baseDirectory: string): string;
+
+export function normalizePathSeparators(path: string): string;
+
+export function globToRegExp(globPattern: string): RegExp;
+
 export function pathUnderDirectory(filePath: string, dir: string): boolean;
 
 export function sessionAllows(prefixes: Set<string>, filePath: string): boolean;

package/lib/shared.js

@@ -1,9 +1,9 @@
 // SPDX-License-Identifier: Apache-2.0
 'use strict';
 
-const { realpathSync } = require('node:fs');
+const { lstatSync, readlinkSync, realpathSync } = require('node:fs');
 const { homedir } = require('node:os');
-const { dirname, isAbsolute, join, relative, sep } = require('node:path');
+const { basename, dirname, isAbsolute, join, relative, resolve, sep } = require('node:path');
 
 function isRecord(value) {
   return typeof value === 'object' && value !== null && !Array.isArray(value);
@@ -191,6 +191,81 @@ function formatLandstripTraps(traps) {
   return traps.map(formatLandstripTrap).join('\n');
 }
 
+// Relative entries (notably ".") resolve against the caller-supplied base
+// directory — the command's working directory that landstrip itself uses as
+// its policy base — never the host process's own cwd.
+function expandPath(filePath, baseDirectory) {
+  return resolve(baseDirectory, expandHomePath(filePath));
+}
+
+function canonicalizePath(filePath, baseDirectory, seen = new Set()) {
+  const abs = expandPath(filePath, baseDirectory);
+  const missing = [];
+  let existing = abs;
+
+  for (;;) {
+    try {
+      const stat = lstatSync(existing);
+      if (stat.isSymbolicLink()) {
+        if (seen.has(existing)) return abs;
+        seen.add(existing);
+        const target = resolve(dirname(existing), readlinkSync(existing), ...missing);
+        return canonicalizePath(target, baseDirectory, seen);
+      }
+      break;
+    } catch {
+      const parent = dirname(existing);
+      if (parent === existing) return abs;
+      missing.unshift(basename(existing));
+      existing = parent;
+    }
+  }
+
+  try {
+    return resolve(realpathSync.native(existing), ...missing);
+  } catch {
+    return abs;
+  }
+}
+
+function canonicalizeGlobPattern(pattern, baseDirectory) {
+  const expanded = expandPath(pattern, baseDirectory);
+  const wildcard = expanded.indexOf('*');
+  if (wildcard < 0) return canonicalizePath(expanded, baseDirectory);
+
+  const prefix = expanded.slice(0, wildcard);
+  const base = prefix.endsWith(sep) ? prefix : dirname(prefix);
+  const suffixOffset = base.endsWith(sep) ? base.length - 1 : base.length;
+  const canonicalBase = canonicalizePath(base, baseDirectory);
+  const suffix = expanded.slice(suffixOffset);
+  return canonicalBase.endsWith(sep) && suffix.startsWith(sep)
+    ? `${canonicalBase}${suffix.slice(1)}`
+    : `${canonicalBase}${suffix}`;
+}
+
+function normalizePathSeparators(path) {
+  return process.platform === 'win32' ? path.replaceAll('\\', '/') : path;
+}
+
+const globRegExpCache = new Map();
+
+// Translates an absolute glob pattern to a regular expression using standard
+// path semantics: `**` crosses directory boundaries (and `**/` may match zero
+// segments), while a single `*` is confined to one path segment.
+function globToRegExp(globPattern) {
+  const cached = globRegExpCache.get(globPattern);
+  if (cached) return cached;
+
+  const escaped = globPattern
+    .replace(/[.+^${}()|[\]\\]/g, '\\$&')
+    .replace(/\*\*\/|\*\*|\*/g, (token) =>
+      token === '**/' ? '(?:.*/)?' : token === '**' ? '.*' : '[^/]*',
+    );
+  const result = new RegExp(`^${escaped}$`);
+  globRegExpCache.set(globPattern, result);
+  return result;
+}
+
 // The broker matches an answer to its query by the exact decimal `query_id`
 // string the trap carried. A numeric id fails its deserializer, the line is
 // dropped, and the child's syscall stays suspended.
@@ -201,6 +276,11 @@ function controlResponseLine(queryId, action) {
 module.exports = {
   isRecord,
   expandHomePath,
+  expandPath,
+  canonicalizePath,
+  canonicalizeGlobPattern,
+  normalizePathSeparators,
+  globToRegExp,
   pathUnderDirectory,
   sessionAllows,
   sessionScopeFor,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@landstrip/landstrip",
-  "version": "0.18.34",
+  "version": "0.18.36",
   "description": "Sandbox runner using Landlock, Seatbelt, and AppContainer",
   "license": "Apache-2.0 AND LGPL-2.1-or-later",
   "homepage": "https://github.com/landstrip/landstrip#readme",
@@ -21,6 +21,10 @@
     "./shared": {
       "types": "./lib/shared.d.ts",
       "default": "./lib/shared.js"
+    },
+    "./proxy": {
+      "types": "./lib/proxy.d.ts",
+      "default": "./lib/proxy.js"
     }
   },
   "bin": {
@@ -34,24 +38,17 @@
     "LICENSE-LGPL-2.1"
   ],
   "optionalDependencies": {
-    "@landstrip/landstrip-darwin-arm64": "0.18.34",
-    "@landstrip/landstrip-darwin-x64": "0.18.34",
-    "@landstrip/landstrip-linux-x64": "0.18.34",
-    "@landstrip/landstrip-linux-arm64": "0.18.34",
-    "@landstrip/landstrip-win32-x64": "0.18.34",
-    "@landstrip/landstrip-win32-arm64": "0.18.34"
+    "@landstrip/landstrip-darwin-arm64": "0.18.36",
+    "@landstrip/landstrip-darwin-x64": "0.18.36",
+    "@landstrip/landstrip-linux-x64": "0.18.36",
+    "@landstrip/landstrip-linux-arm64": "0.18.36",
+    "@landstrip/landstrip-win32-x64": "0.18.36",
+    "@landstrip/landstrip-win32-arm64": "0.18.36"
   },
   "publishConfig": {
     "access": "public"
   },
   "engines": {
     "node": ">=18"
-  },
-  "workspaces": [
-    "packages/*"
-  ],
-  "scripts": {
-    "ci:extensions": "bash scripts/test-extensions.sh",
-    "ci:extensions:local": "bash scripts/test-extensions.sh --local-root"
   }
 }