opencode-landstrip 0.16.8 → 0.16.10

package/index.ts

@@ -164,10 +164,6 @@ function matchDepth(filePath: string, patterns: string[], baseDirectory: string)
   return depth;
 }
 
-function matchesPattern(filePath: string, patterns: string[], baseDirectory: string): boolean {
-  return matchDepth(filePath, patterns, baseDirectory) >= 0;
-}
-
 function resolveFilesystemPatterns(patterns: string[], baseDirectory: string): string[] {
   return patterns.map((pattern) =>
     pattern.includes('*')
@@ -188,10 +184,6 @@ function resolveFilesystemConfig(
   };
 }
 
-function shouldPromptForWrite(path: string, allowWrite: string[], baseDirectory: string): boolean {
-  return allowWrite.length === 0 || !matchesPattern(path, allowWrite, baseDirectory);
-}
-
 function domainMatchesPattern(domain: string, pattern: string): boolean {
   const normalizedDomain = domain.toLowerCase();
   const normalizedPattern = pattern.toLowerCase();
@@ -321,17 +313,19 @@ function evaluateWritePermission(
   effectiveAllowWrite: string[],
 ): SandboxPermissionDecision {
   const filePath = canonicalizePath(path, baseDirectory);
+  const allowDepth = matchDepth(filePath, effectiveAllowWrite, baseDirectory);
+  const denyDepth = matchDepth(filePath, config.filesystem.denyWrite, baseDirectory);
 
-  if (matchesPattern(filePath, config.filesystem.denyWrite, baseDirectory)) {
+  if (denyDepth > allowDepth) {
     return {
       status: 'deny',
       kind: 'write',
       resource: filePath,
-      message: `Sandbox: write access denied for "${filePath}" (in filesystem.denyWrite).`,
+      message: `Sandbox: write access denied for "${filePath}" (denyWrite overrides allowWrite).`,
     };
   }
 
-  if (!shouldPromptForWrite(filePath, effectiveAllowWrite, baseDirectory)) {
+  if (allowDepth >= 0) {
     return { status: 'allow', kind: 'write', resource: filePath, message: '' };
   }
 
@@ -665,12 +659,17 @@ function buildWrappedCommand(
   if (trapPort === null) return plain;
 
   // Connect fd 3 to the TUI's query-response socket BEFORE landstrip applies the
-  // sandbox, so a denied write can be approved live instead of forcing a re-run.
-  // The `&&`/`||` guard falls back to the plain (no --trap-fd) invocation when the
-  // redirect fails — a dead port, a non-bash outer shell without /dev/tcp, or an
-  // outer `set -e` — so a failed connect never hands the broker a dead fd 3.
+  // sandbox, so a denied filesystem access can be approved live instead of
+  // forcing a re-run.
+  //
+  // /dev/tcp is a bash/ksh built-in — it does not work in zsh, dash, or fish.
+  // We try the native redirect first (fast path when the host shell supports it)
+  // and fall back to an explicit bash invocation that always speaks /dev/tcp.
+  // If both fail (no bash, dead port, set -e in the outer shell) landstrip runs
+  // without --trap-fd so the toast-notify path still works.
   const trapped = [landstripBinaryPath(), '--trap-fd', '3', ...baseArgs].map(shellQuote).join(' ');
-  return `{ exec 3<>/dev/tcp/127.0.0.1/${trapPort} ; } 2>/dev/null && ${trapped} || ${plain}`;
+  const bashTrap = `bash -c ${shellQuote(`exec 3<>/dev/tcp/127.0.0.1/${trapPort} && exec "$@"`)} bash ${trapped}`;
+  return `{ exec 3<>/dev/tcp/127.0.0.1/${trapPort} ; } 2>/dev/null && ${trapped} || ${bashTrap} 2>/dev/null || ${plain}`;
 }
 
 function isGeneratedWrappedCommand(command: string): boolean {
@@ -696,11 +695,19 @@ function splitShellQuotedArgs(command: string): string[] {
     if (command[i] === "'") {
       i++;
       let arg = '';
-      while (i < command.length && command[i] !== "'") {
+      while (i < command.length) {
+        if (command[i] === "'") {
+          if (command[i + 1] === '\\' && command[i + 2] === "'" && command[i + 3] === "'") {
+            arg += "'";
+            i += 4;
+            continue;
+          }
+          i++;
+          break;
+        }
         arg += command[i];
         i++;
       }
-      if (i < command.length) i++;
       args.push(arg);
     } else {
       let arg = '';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-landstrip",
-  "version": "0.16.8",
+  "version": "0.16.10",
   "description": "Landlock-based sandboxing for opencode with landstrip",
   "keywords": [
     "landlock",