@landstrip/landstrip 0.18.38 → 0.20.11

package/README.md

@@ -1,66 +1,21 @@
-# landstrip
+# @landstrip/landstrip
 
-`landstrip` runs commands in an OS-level sandbox using Landlock on Linux,
-Seatbelt on macOS, and AppContainer or restricted users on Windows.
-
-## Install
+The Landstrip command-line executable for Linux, macOS, and Windows on x64/arm64.
+Requires Node.js ≥18. Installs the matching native platform package automatically.
 
 ```sh
 npm install --save-dev @landstrip/landstrip
 npx landstrip run -p policy.json -- cargo test
+npx landstrip doctor
 ```
 
-The npm package installs a Node.js wrapper and a native binary for the current
-platform.
-
-## Usage
-
-```sh
-landstrip run -p policy.json -- cargo test
-landstrip policy validate -p policy.json
-landstrip policy resolve -p policy.json
-landstrip doctor
-```
-
-Run `landstrip --help` or see [landstrip(1)](man/man1/landstrip.1) for the full
-command reference.
-
-## Agent extensions
-
-| Integration | Package                | Documentation                                                        |
-| ----------- | ---------------------- | -------------------------------------------------------------------- |
-| OpenCode    | `opencode-landstrip`   | [OpenCode](packages/opencode-landstrip/README.md)                    |
-| Pi          | `pi-landstrip`         | [Pi](packages/pi-landstrip/README.md)                                |
+See the [quick start](../../README.md#quick-start) for a policy example and
+[landstrip(1)](../landstrip/man/man1/landstrip.1) for CLI options and platform limits.
 
-## Policy
-
-```json
-{
-  "filesystem": {
-    "allowWrite": ["."],
-    "denyWrite": ["**/.env", "**/*.pem"],
-    "denyRead": ["~/.ssh"],
-    "allowRead": ["~/.ssh/config"]
-  },
-  "network": {
-    "allowNetwork": false,
-    "allowLocalBinding": false
-  }
-}
-```
-
-Pass policies with `-p, --policy <FILE>`. Later policies merge over earlier
-ones. Platform behavior and limits are documented in the manual.
-
-## Development
-
-```sh
-make ci
-```
+For TypeScript APIs, use [`@landstrip/landstrip-api`](../landstrip-api/README.md),
+which depends on this package. This CLI package does not depend on the API package.
 
-## Licensing
+## License
 
-`@landstrip/landstrip` is licensed under the Apache 2.0 license and the GNU
-Lesser General Public License version 2.1 or later. See
-[LICENSE-APACHE-2.0](LICENSE-APACHE-2.0) and [LICENSE-LGPL-2.1](LICENSE-LGPL-2.1)
-for more information.
+[Apache-2.0](LICENSE); native binaries are
+[LGPL-2.1-or-later](../landstrip/LICENSE).

package/bin/landstrip.js

@@ -8,7 +8,11 @@ const { binaryPath } = require('../lib');
 let child;
 
 try {
-  child = spawn(binaryPath(), process.argv.slice(2), { stdio: 'inherit' });
+  const options = { stdio: 'inherit' };
+  if (process.platform === 'linux') {
+    options.env = { ...process.env, APPIMAGE_EXTRACT_AND_RUN: '1' };
+  }
+  child = spawn(binaryPath(), process.argv.slice(2), options);
 } catch (error) {
   console.error(error.message);
   process.exit(1);

package/lib/index.js

@@ -31,6 +31,11 @@ const packages = {
   },
 };
 
+const officialPackageNames = new Set([
+  '@landstrip/landstrip',
+  ...Object.values(packages).map((value) => value.packageName),
+]);
+
 function target(platform = process.platform, arch = process.arch) {
   const key = `${platform}-${arch}`;
   const value = packages[key];
@@ -65,7 +70,30 @@ function binaryPath(platform = process.platform, arch = process.arch) {
     throw new Error(`landstrip binary not found at ${resolved}`);
   }
 
-  return resolved;
+  const filePath = fs.realpathSync.native(resolved);
+  let probe = path.dirname(filePath);
+  while (true) {
+    let owner;
+    try {
+      owner = JSON.parse(fs.readFileSync(path.join(probe, 'package.json'), 'utf8'));
+    } catch (error) {
+      if (error.code !== 'ENOENT' && !(error instanceof SyntaxError)) throw error;
+    }
+    if (
+      owner !== null &&
+      typeof owner === 'object' &&
+      !Array.isArray(owner) &&
+      officialPackageNames.has(owner.name)
+    ) {
+      return filePath;
+    }
+    const parent = path.dirname(probe);
+    if (parent === probe) break;
+    probe = parent;
+  }
+  throw new Error(
+    `Refusing to use landstrip binary outside official @landstrip/landstrip packages: ${filePath}`,
+  );
 }
 
 exports.binaryPath = binaryPath;

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@landstrip/landstrip",
-  "version": "0.18.38",
-  "description": "Sandbox runner using Landlock, Seatbelt, and AppContainer",
-  "license": "Apache-2.0 AND LGPL-2.1-or-later",
+  "version": "0.20.11",
+  "description": "Landstrip sandbox command-line executable",
+  "license": "Apache-2.0",
   "homepage": "https://github.com/landstrip/landstrip#readme",
   "repository": {
     "type": "git",
@@ -12,21 +12,6 @@
     "url": "https://github.com/landstrip/landstrip/issues"
   },
   "main": "lib/index.js",
-  "types": "lib/index.d.ts",
-  "exports": {
-    ".": {
-      "types": "./lib/index.d.ts",
-      "default": "./lib/index.js"
-    },
-    "./shared": {
-      "types": "./lib/shared.d.ts",
-      "default": "./lib/shared.js"
-    },
-    "./proxy": {
-      "types": "./lib/proxy.d.ts",
-      "default": "./lib/proxy.js"
-    }
-  },
   "bin": {
     "landstrip": "bin/landstrip.js"
   },
@@ -34,16 +19,15 @@
     "bin",
     "lib",
     "README.md",
-    "LICENSE-APACHE-2.0",
-    "LICENSE-LGPL-2.1"
+    "LICENSE"
   ],
   "optionalDependencies": {
-    "@landstrip/landstrip-darwin-arm64": "0.18.38",
-    "@landstrip/landstrip-darwin-x64": "0.18.38",
-    "@landstrip/landstrip-linux-x64": "0.18.38",
-    "@landstrip/landstrip-linux-arm64": "0.18.38",
-    "@landstrip/landstrip-win32-x64": "0.18.38",
-    "@landstrip/landstrip-win32-arm64": "0.18.38"
+    "@landstrip/landstrip-darwin-arm64": "0.20.11",
+    "@landstrip/landstrip-darwin-x64": "0.20.11",
+    "@landstrip/landstrip-linux-x64": "0.20.11",
+    "@landstrip/landstrip-linux-arm64": "0.20.11",
+    "@landstrip/landstrip-win32-x64": "0.20.11",
+    "@landstrip/landstrip-win32-arm64": "0.20.11"
   },
   "publishConfig": {
     "access": "public"