opencode-landstrip 0.18.25 → 0.18.27

package/README.md

@@ -1,13 +1,9 @@
 # opencode-landstrip
 
-`opencode-landstrip` sandboxes OpenCode AI `bash` calls with
-[`landstrip`](https://github.com/landstrip/landstrip) and the supported Anthropic
-Sandbox Runtime policy fields.
+`opencode-landstrip` runs OpenCode AI `bash` calls through
+[`landstrip`](https://github.com/landstrip/landstrip).
 
-The bundled [policy](./sandbox.json) is merged with global, project, and plugin
-options in that order.
-
-## Installation
+## Install
 
 ```sh
 # Current project
@@ -17,7 +13,8 @@ opencode plugin install opencode-landstrip
 opencode plugin install opencode-landstrip --global
 ```
 
-For a manual install, add the server plugin to `opencode.json`:
+A manual installation needs both plugins. Add the server plugin to
+`opencode.json`:
 
 ```json
 {
@@ -26,7 +23,7 @@ For a manual install, add the server plugin to `opencode.json`:
 }
 ```
 
-Add the TUI plugin to `tui.json`:
+Add the presenter to `tui.json`:
 
 ```json
 {
@@ -35,31 +32,66 @@ Add the TUI plugin to `tui.json`:
 }
 ```
 
-Run `/sandbox` to inspect or toggle the sandbox. The toggle writes to the
-project config if it already defines `enabled`; otherwise it writes to the
-global config.
+## Permissions
+
+OpenCode agent permissions authorize tool dispatch. Landstrip sandbox
+permissions authorize filesystem and network access before a tool or while its
+process runs. Agent approval never bypasses a sandbox hard denial.
+
+The TUI presents one request at a time. OpenCode's native agent prompt has
+priority; Landstrip requests retain FIFO order and are routed to the originating
+root session. Without a live presenter, blocked sandbox requests are denied.
+
+Filesystem approvals may be stored in `.opencode/sandbox.json` for the project
+or `~/.config/opencode/sandbox.json` globally. `/sandbox` displays or toggles the
+policy. It updates the project file when that file defines `enabled`, otherwise
+the global file.
+
+## Configuration
+
+Policy merges in this order:
+
+1. bundled [`sandbox.json`](./sandbox.json);
+2. `~/.config/opencode/sandbox.json`;
+3. `.opencode/sandbox.json`;
+4. plugin options.
+
+Objects merge recursively, arrays combine, and later scalar values replace
+earlier values. The global file is initialized from the bundled policy when it
+does not exist. Programmatic plugin options may be the policy object directly or
+`{ "config": { ... } }`.
+
+| Field                         | Bundled default                                                                                                 |
+| ----------------------------- | --------------------------------------------------------------------------------------------------------------- |
+| `enabled`                     | `true`                                                                                                          |
+| `filesystem.denyRead`         | `["/Users", "/home"]`                                                                                           |
+| `filesystem.allowRead`        | `[".", "~/.gitconfig", "~/.config/git/config", "/dev/null"]`                                                    |
+| `filesystem.allowWrite`       | `[".", "/dev/null"]`                                                                                            |
+| `filesystem.denyWrite`        | `["**/.env", "**/.env.*", "**/*.pem", "**/*.key", ".opencode/sandbox.json", "~/.config/opencode/sandbox.json"]` |
+| `network.allowNetwork`        | `false`                                                                                                         |
+| `network.allowLocalBinding`   | `false`                                                                                                         |
+| `network.allowAllUnixSockets` | `false`                                                                                                         |
+| `network.allowUnixSockets`    | `[]`                                                                                                            |
+| `network.allowedDomains`      | `[]`                                                                                                            |
+| `network.deniedDomains`       | `[]`                                                                                                            |
 
-## Behavior
+Filesystem and core network semantics follow the main
+[Landstrip policy](https://github.com/landstrip/landstrip#policy). `allowedDomains`
+and `deniedDomains` are plugin-only fields enforced by its local HTTP/HTTPS proxy.
 
-AI `bash` calls run through Landstrip. Direct network access is blocked by
-default; the plugin's local HTTP and HTTPS proxy enforces `allowedDomains` and
-`deniedDomains`.
-The domain lists are plugin policy fields, not core Landstrip fields.
+If `enabled` is true but the Landstrip binary, version, or platform is unusable,
+AI Bash fails closed rather than running without isolation. Set `enabled` to
+false explicitly to allow unsandboxed AI Bash.
 
-OpenCode handles normal tool permissions before dispatch. On Linux, Landstrip
-can also pause a blocked filesystem or network operation and show an inline
-approval prompt. Filesystem approvals may be saved to
-`.opencode/sandbox.json` or `~/.config/opencode/sandbox.json`.
+## Limits
 
-Shell-mode commands typed by the user are not process-sandboxed because
-OpenCode's plugin API cannot replace their execution. They may inherit proxy
-settings and receive policy checks, but they do not have an OS sandbox.
+Only AI `bash` calls are process-sandboxed. Shell-mode commands entered directly
+by the user cannot be replaced through OpenCode's plugin API. They may inherit
+proxy settings and receive policy checks, but they do not have OS isolation.
 
-See the main [Landstrip documentation](https://github.com/landstrip/landstrip#readme)
-for policy semantics and platform limits.
+See the main [Landstrip documentation](https://github.com/landstrip/landstrip#readme) for platform limits.
 
 ## License
 
-`opencode-landstrip` is licensed under `Apache-2.0`. See [LICENSE](LICENSE).
-The bundled `@landstrip/landstrip` package is licensed separately as
-`Apache-2.0 AND LGPL-2.1-or-later`.
+`opencode-landstrip` is licensed under `Apache-2.0`. The bundled Landstrip
+package is licensed separately as `Apache-2.0 AND LGPL-2.1-or-later`.

package/index.ts

@@ -37,7 +37,7 @@ import {
   permissionType,
   sandboxSummary,
   readDiscoveryPort,
-  sessionScopeFor,
+  trapSessionHelloLine,
 } from './shared.js';
 
 type LandstripPolicy = {
@@ -50,6 +50,7 @@ type LandstripPolicy = {
 interface BashSandboxState {
   originalCommand: string;
   wrappedCommand: string;
+  sessionID: string | undefined;
   policyDir: string;
   port: number | null;
   proxyToken: string | null;
@@ -794,9 +795,6 @@ function startTrapServer(
   denyRead: string[],
   denyWrite: string[],
   baseDirectory: string,
-  sessionAllowedReadPaths: Set<string>,
-  sessionAllowedWritePaths: Set<string>,
-  sessionAllowedTargets: Set<string>,
 ): Promise<{ server: ReturnType<typeof createServer>; port: number; trapLines: string[] }> {
   const trapLines: string[] = [];
   const server = createServer((trapSocket) => {
@@ -831,11 +829,6 @@ function startTrapServer(
             if (allowed) {
               trapSocket.write(controlResponseLine(queryId, 'allow'));
             } else {
-              // Remember the scope for later commands, but deny this syscall so
-              // a command that may already have side effects is never retried.
-              const scope = sessionScopeFor(path, baseDirectory);
-              if (operation === 'read') sessionAllowedReadPaths.add(scope);
-              else sessionAllowedWritePaths.add(scope);
               trapSocket.write(controlResponseLine(queryId, 'deny'));
               trapLines.push(line);
             }
@@ -843,17 +836,8 @@ function startTrapServer(
             trap.kind === 'network' &&
             (trap.operation === 'connect' || trap.operation === 'bind')
           ) {
-            // No policy field expresses "allow this address:port" (allowedDomains
-            // is hostname-based and enforced by the HTTP(S) proxy, not the broker),
-            // so — matching the filesystem branch above — auto-grant, remember it
-            // for the rest of the session, and surface it afterward rather than
-            // hanging or hard-denying an already-approved command.
-            const target = trap.target;
-            if (!sessionAllowedTargets.has(target)) {
-              sessionAllowedTargets.add(target);
-              trapLines.push(line);
-            }
-            trapSocket.write(controlResponseLine(queryId, 'allow'));
+            trapSocket.write(controlResponseLine(queryId, 'deny'));
+            trapLines.push(line);
           } else {
             trapLines.push(line);
           }
@@ -905,6 +889,7 @@ function buildWrappedCommand(
   shell: string,
   command: string,
   trapPort: number | null,
+  sessionID?: string,
 ): string {
   const baseArgs = ['run', '-p', policyPath, '--', ...shellArgs(shell, command)];
   const plain = [landstripBinaryPath(), ...baseArgs].map(shellQuote).join(' ');
@@ -926,7 +911,10 @@ function buildWrappedCommand(
   ]
     .map(shellQuote)
     .join(' ');
-  const openTrap = `exec 3<>/dev/tcp/127.0.0.1/${trapPort} && exec "$@"`;
+  const identifySession = sessionID
+    ? ` && printf '%s' ${shellQuote(trapSessionHelloLine(sessionID))} >&3`
+    : '';
+  const openTrap = `exec 3<>/dev/tcp/127.0.0.1/${trapPort}${identifySession} && exec "$@"`;
   return `bash -c ${shellQuote(openTrap)} bash ${trapped}`;
 }
 
@@ -1065,21 +1053,6 @@ const plugin: Plugin = async ({ client, directory }: PluginInput, options?: Plug
   const activeBash = new Map<string, BashSandboxState>();
   const notified = new Set<string>();
   const callAllowances = new Set<string>();
-  const sessionAllowedReadPaths = new Set<string>();
-  const sessionAllowedWritePaths = new Set<string>();
-  const sessionAllowedTargets = new Set<string>();
-
-  function mergeAllowances(configured: string[], session: Set<string>): string[] {
-    return [...configured, ...session];
-  }
-
-  function getEffectiveAllowRead(config: SandboxConfig): string[] {
-    return mergeAllowances(config.filesystem.allowRead, sessionAllowedReadPaths);
-  }
-
-  function getEffectiveAllowWrite(config: SandboxConfig): string[] {
-    return mergeAllowances(config.filesystem.allowWrite, sessionAllowedWritePaths);
-  }
   let enabledNotified = false;
   let configuredShell: string | undefined;
   let landstripCheck: { ok: true; version: string } | { ok: false; reason: string } | undefined;
@@ -1250,12 +1223,9 @@ const plugin: Plugin = async ({ client, directory }: PluginInput, options?: Plug
 
     const check = checkLandstrip();
     if (!check?.ok) {
-      await notifyOnce(
-        `disabled:${check?.reason ?? 'unknown'}`,
-        check?.reason ?? 'Sandbox disabled',
-        'error',
-      );
-      return null;
+      const reason = check?.reason ?? 'Unknown Landstrip installation error';
+      await notifyOnce(`broken-installation:${reason}`, reason, 'error');
+      throw new Error(`Broken @landstrip/landstrip installation: ${reason}`);
     }
 
     if (!enabledNotified) {
@@ -1308,10 +1278,12 @@ const plugin: Plugin = async ({ client, directory }: PluginInput, options?: Plug
 
   async function prepareBash(
     callID: string,
+    sessionID: string | undefined,
     args: Record<string, unknown>,
     config: SandboxConfig,
   ): Promise<void> {
     if (typeof args.command !== 'string') return;
+    const normalizedSessionID = sessionID?.trim() || undefined;
 
     const rewriteDescription = (): void => {
       if (typeof args.description === 'string')
@@ -1320,7 +1292,10 @@ const plugin: Plugin = async ({ client, directory }: PluginInput, options?: Plug
 
     const existing = activeBash.get(callID);
     if (existing) {
-      if (args.command === existing.originalCommand || args.command === existing.wrappedCommand) {
+      if (
+        existing.sessionID === normalizedSessionID &&
+        (args.command === existing.originalCommand || args.command === existing.wrappedCommand)
+      ) {
         args.command = existing.wrappedCommand;
         rewriteDescription();
         return;
@@ -1330,16 +1305,9 @@ const plugin: Plugin = async ({ client, directory }: PluginInput, options?: Plug
     }
 
     if (isGeneratedWrappedCommand(args.command as string)) {
-      const policyMatch = (args.command as string).match(/\s'-p'\s+'([^']+)'/);
-      if (policyMatch?.[1] && existsSync(policyMatch[1])) {
-        rewriteDescription();
-        return;
-      }
       if (activeBash.has(callID)) await cleanupBash(callID);
       const original = extractOriginalCommand(args.command as string);
-      if (original) {
-        args.command = original;
-      }
+      if (original) args.command = original;
     }
 
     const allowNetwork = config.network.allowNetwork;
@@ -1347,11 +1315,7 @@ const plugin: Plugin = async ({ client, directory }: PluginInput, options?: Plug
     const effectiveConfig = {
       ...config,
       network: { ...config.network },
-      filesystem: {
-        ...config.filesystem,
-        allowRead: getEffectiveAllowRead(config),
-        allowWrite: getEffectiveAllowWrite(config),
-      },
+      filesystem: config.filesystem,
     };
 
     if (!allowNetwork) {
@@ -1391,9 +1355,12 @@ const plugin: Plugin = async ({ client, directory }: PluginInput, options?: Plug
     const originalCommand = args.command as string;
 
     // The TUI owns interactive query handling. Fall back to an in-process
-    // broker when no TUI endpoint is available (for example, in headless mode).
+    // broker when no TUI endpoint or session identity is available.
+    const interactiveSessionID = normalizedSessionID ?? '';
     const tuiTrapPort =
-      process.platform === 'linux' ? await readLiveDiscoveryPort(directory) : null;
+      process.platform === 'linux' && interactiveSessionID
+        ? await readLiveDiscoveryPort(directory)
+        : null;
     const trapServer =
       tuiTrapPort === null
         ? await startTrapServer(
@@ -1402,9 +1369,6 @@ const plugin: Plugin = async ({ client, directory }: PluginInput, options?: Plug
             effectiveConfig.filesystem.denyRead,
             effectiveConfig.filesystem.denyWrite,
             directory,
-            sessionAllowedReadPaths,
-            sessionAllowedWritePaths,
-            sessionAllowedTargets,
           )
         : null;
     const trapPort = tuiTrapPort ?? trapServer?.port ?? null;
@@ -1414,11 +1378,13 @@ const plugin: Plugin = async ({ client, directory }: PluginInput, options?: Plug
       configuredShell ?? process.env.SHELL ?? '/bin/sh',
       originalCommand,
       trapPort,
+      tuiTrapPort === null ? undefined : interactiveSessionID,
     );
 
     activeBash.set(callID, {
       originalCommand,
       wrappedCommand,
+      sessionID: normalizedSessionID,
       policyDir: policy.dir,
       port: proxyPort,
       proxyToken,
@@ -1456,8 +1422,8 @@ const plugin: Plugin = async ({ client, directory }: PluginInput, options?: Plug
             : undefined;
       const patterns = permissionPatterns(request);
 
-      const effectiveAllowRead = getEffectiveAllowRead(config);
-      const effectiveAllowWrite = getEffectiveAllowWrite(config);
+      const effectiveAllowRead = config.filesystem.allowRead;
+      const effectiveAllowWrite = config.filesystem.allowWrite;
       const args: Record<string, unknown> = { ...metadata };
       if (permission === 'read') args.paths = patterns;
       if (permission === 'edit') {
@@ -1489,7 +1455,7 @@ const plugin: Plugin = async ({ client, directory }: PluginInput, options?: Plug
       if (!config) return;
 
       if (input.tool === 'bash') {
-        await prepareBash(input.callID, output.args, config);
+        await prepareBash(input.callID, input.sessionID, output.args, config);
         return;
       }
 
@@ -1498,8 +1464,8 @@ const plugin: Plugin = async ({ client, directory }: PluginInput, options?: Plug
         output.args,
         config,
         directory,
-        getEffectiveAllowRead(config),
-        getEffectiveAllowWrite(config),
+        config.filesystem.allowRead,
+        config.filesystem.allowWrite,
       );
       for (const decision of decisions) {
         enforcePermission(input.callID, decision);
@@ -1530,7 +1496,8 @@ const plugin: Plugin = async ({ client, directory }: PluginInput, options?: Plug
       // the after-the-fact toast.
       const serverTrapOutput = state.trapLines.join('\n');
       const combinedOutput = serverTrapOutput ? outputText + '\n' + serverTrapOutput : outputText;
-      const errors = parseLandstripTraps(combinedOutput).filter(
+      const traps = parseLandstripTraps(combinedOutput);
+      const errors = traps.filter(
         (trap: LandstripTrap) => !(trap.kind === 'filesystem' && trap.state === 'query'),
       );
       if (errors.length > 0) {
@@ -1553,21 +1520,18 @@ const plugin: Plugin = async ({ client, directory }: PluginInput, options?: Plug
           ?.catch?.(() => undefined);
       }
 
-      const blockedPath = extractBlockedPath(outputText, directory, state.originalCommand);
+      const blockedTrap = traps.find(
+        (trap): trap is Extract<LandstripTrap, { kind: 'filesystem' }> =>
+          trap.kind === 'filesystem' && trap.state === 'query',
+      );
+      const blockedPath = blockedTrap
+        ? canonicalizePath(blockedTrap.path, directory)
+        : extractBlockedPath(outputText, directory, state.originalCommand);
       if (blockedPath) {
-        let blockedOperation: 'read' | 'write' = 'read';
-        for (const trap of errors) {
-          if (trap.kind === 'filesystem') {
-            blockedOperation = trap.operation;
-            break;
-          }
-        }
-        const scope = sessionScopeFor(blockedPath, directory);
-        if (blockedOperation === 'read') sessionAllowedReadPaths.add(scope);
-        else sessionAllowedWritePaths.add(scope);
+        const blockedOperation = blockedTrap?.operation ?? 'read';
         await notifyOnce(
           `blocked:${blockedPath}`,
-          `Sandbox blocked ${blockedOperation} to "${blockedPath}". Added "${scope}" to session allowlist; retry the command.`,
+          `Sandbox blocked ${blockedOperation} to "${blockedPath}". No live TUI presenter was available, so access remains denied.`,
           'warning',
         );
       }
@@ -1597,8 +1561,8 @@ const plugin: Plugin = async ({ client, directory }: PluginInput, options?: Plug
         const config = await activeConfig();
         if (!config) return;
 
-        const effectiveAllowRead = getEffectiveAllowRead(config);
-        const effectiveAllowWrite = getEffectiveAllowWrite(config);
+        const effectiveAllowRead = config.filesystem.allowRead;
+        const effectiveAllowWrite = config.filesystem.allowWrite;
 
         for (const path of extractCandidatePaths(shellCommand)) {
           const readDecision = evaluateReadPermission(path, config, directory, effectiveAllowRead);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-landstrip",
-  "version": "0.18.25",
+  "version": "0.18.27",
   "description": "OS-level AI command sandboxing for OpenCode with Landstrip",
   "keywords": [
     "landlock",
@@ -48,7 +48,7 @@
     "ci:test": "npm test"
   },
   "dependencies": {
-    "@landstrip/landstrip": "^0.18.25",
+    "@landstrip/landstrip": "^0.18.27",
     "@opentui/solid": ">=0.3.4",
     "solid-js": "1.9.12"
   },

package/shared.ts

@@ -517,6 +517,85 @@ export function controlResponseLine(
   return JSON.stringify(response) + '\n';
 }
 
+export interface TrapSessionHello {
+  kind: 'opencode-landstrip-session';
+  sessionID: string;
+}
+
+export interface SessionAllowances {
+  readPaths: Set<string>;
+  writePaths: Set<string>;
+  targets: Set<string>;
+}
+
+export function trapSessionHelloLine(sessionID: string): string {
+  const normalized = sessionID.trim();
+  if (!normalized) throw new Error('OpenCode session ID must not be empty');
+  const hello: TrapSessionHello = { kind: 'opencode-landstrip-session', sessionID: normalized };
+  return JSON.stringify(hello) + '\n';
+}
+
+export function decodeTrapSessionHello(line: string): TrapSessionHello | null {
+  let value: unknown;
+  try {
+    value = JSON.parse(line);
+  } catch {
+    return null;
+  }
+  if (!isRecord(value) || value.kind !== 'opencode-landstrip-session') return null;
+  if (typeof value.sessionID !== 'string') return null;
+  const sessionID = value.sessionID.trim();
+  return sessionID ? { kind: 'opencode-landstrip-session', sessionID } : null;
+}
+
+export function sessionAllowancesFor(
+  sessions: Map<string, SessionAllowances>,
+  sessionID: string,
+): SessionAllowances {
+  const existing = sessions.get(sessionID);
+  if (existing) return existing;
+  const created: SessionAllowances = {
+    readPaths: new Set(),
+    writePaths: new Set(),
+    targets: new Set(),
+  };
+  sessions.set(sessionID, created);
+  return created;
+}
+
+export function rootSessionIDFor(
+  sourceSessionID: string,
+  session: (sessionID: string) => { parentID?: string } | undefined,
+): string | undefined {
+  let current = sourceSessionID;
+  const seen = new Set<string>();
+  while (!seen.has(current)) {
+    seen.add(current);
+    const value = session(current);
+    if (!value) return undefined;
+    if (!value.parentID) return current;
+    current = value.parentID;
+  }
+  return undefined;
+}
+
+export function nextSandboxPermissionIndex<T extends { sessionID: string }>(
+  queue: readonly T[],
+  routeSessionID: string,
+  blocked: (entry: T) => boolean,
+): number {
+  const entry = queue[0];
+  return entry && entry.sessionID === routeSessionID && !blocked(entry) ? 0 : -1;
+}
+
+export function shouldRenderSandboxPermission(
+  requestSessionID: string,
+  routeSessionID: string,
+  hostPromptActive: boolean,
+): boolean {
+  return requestSessionID === routeSessionID && !hostPromptActive;
+}
+
 // The TUI plugin runs the query-response socket server and publishes its port
 // to a per-directory discovery file; the server plugin reads it to inject the
 // fd-3 redirect. Namespacing by a hash of the realpath keeps concurrent

package/tui.ts

@@ -14,19 +14,25 @@ import type {
 import { RGBA } from '@opentui/core';
 import { useTerminalDimensions } from '@opentui/solid';
 import { Fragment, jsx, jsxs } from '@opentui/solid/jsx-runtime';
-import { createSignal, onCleanup } from 'solid-js';
+import { createSignal, onCleanup, onMount } from 'solid-js';
 
 import {
   controlResponseLine,
+  decodeTrapSessionHello,
   getConfigPaths,
   loadConfig,
   normalizeOptions,
+  nextSandboxPermissionIndex,
   parseLandstripTraps,
   removeDiscoveryFile,
   sessionAllows,
+  sessionAllowancesFor,
   sandboxSummary,
   sessionScopeFor,
+  rootSessionIDFor,
   setSandboxConfigEnabled,
+  shouldRenderSandboxPermission,
+  type SessionAllowances,
   updateForPermission,
   writeConfigFile,
   writeDiscoveryPort,
@@ -49,6 +55,7 @@ interface PermissionPromptProps<Value extends string> {
   options: readonly PromptOption<Value>[];
   onSelect: (value: Value) => void;
   onCancel: () => void;
+  onShow: () => void;
 }
 
 const promptBorderChars = {
@@ -74,6 +81,9 @@ interface FsQueryEntry {
   socket: NetSocket;
   queryId: string;
   operation: 'read' | 'write';
+  sessionID: string;
+  sourceSessionID: string;
+  directory: string;
   path: string;
 }
 
@@ -87,6 +97,9 @@ interface NetworkQueryEntry {
   socket: NetSocket;
   queryId: string;
   operation: string;
+  sessionID: string;
+  sourceSessionID: string;
+  directory: string;
   target: string;
 }
 
@@ -125,6 +138,7 @@ const tui: TuiPlugin = async (api, options, meta) => {
     const theme = api.theme.current;
     const dimensions = useTerminalDimensions();
     const [selected, setSelected] = createSignal(0);
+    onMount(props.onShow);
 
     function move(direction: number): void {
       setSelected((index) => (index + direction + props.options.length) % props.options.length);
@@ -273,28 +287,51 @@ const tui: TuiPlugin = async (api, options, meta) => {
   const resolved = new Set<string>();
   const queue: QueueEntry[] = [];
   const [activeEntry, setActiveEntry] = createSignal<QueueEntry>();
+  const [permissionRevision, setPermissionRevision] = createSignal(0);
   let activeId: string | undefined;
   let refreshSandboxStatus: (() => void) | undefined;
 
-  // Paths the user approved "for session": later queries for the same path are
-  // auto-allowed without a dialog. This lives only in the TUI process — the
-  // server regenerates the policy from on-disk config each run — so it affects
-  // only live socket decisions, not the static policy.
-  const sessionAllowedWritePaths = new Set<string>();
-  const sessionAllowedReadPaths = new Set<string>();
-
-  // Targets the user approved "for session": address:port, since the broker
-  // knows nothing more specific than that at connect/bind time.
-  const sessionAllowedTargets = new Set<string>();
+  const sessionAllowances = new Map<string, SessionAllowances>();
+  const notified = new Set<string>();
 
   // Filesystem and network queries still awaiting a response, so cleanup can
   // release held syscalls instead of letting the child hang.
   const liveQueries = new Set<FsQueryEntry | NetworkQueryEntry>();
 
+  function nativePermissionPending(entry: QueueEntry): boolean {
+    if (api.state.session.permission(entry.sessionID).length > 0) return true;
+    return (
+      entry.sourceSessionID !== entry.sessionID &&
+      api.state.session.permission(entry.sourceSessionID).length > 0
+    );
+  }
+
+  function currentRouteSessionID(): string | undefined {
+    const route = api.route.current;
+    if (route.name !== 'session' || !route.params) return undefined;
+    return typeof route.params.sessionID === 'string' ? route.params.sessionID : undefined;
+  }
+
   function pump(): void {
-    if (activeId !== undefined) return;
-    let next = queue.shift();
-    while (next && resolved.has(next.id)) next = queue.shift();
+    const routeSessionID = currentRouteSessionID();
+    if (!routeSessionID) return;
+
+    const active = activeEntry();
+    if (activeId !== undefined) {
+      if (active?.sessionID === routeSessionID) return;
+      if (active && !resolved.has(active.id)) queue.unshift(active);
+      activeId = undefined;
+      setActiveEntry(undefined);
+    }
+
+    for (let index = queue.length - 1; index >= 0; index -= 1) {
+      const entry = queue[index];
+      if (entry && resolved.has(entry.id)) queue.splice(index, 1);
+    }
+
+    const index = nextSandboxPermissionIndex(queue, routeSessionID, nativePermissionPending);
+    if (index === -1) return;
+    const [next] = queue.splice(index, 1);
     if (!next) return;
     if (next.kind === 'fs-query') showFsQuery(next);
     else showNetworkQuery(next);
@@ -310,6 +347,7 @@ const tui: TuiPlugin = async (api, options, meta) => {
 
   function finishActive(id: string): void {
     resolved.add(id);
+    notified.delete(id);
     if (activeId === id) {
       activeId = undefined;
       setActiveEntry(undefined);
@@ -317,19 +355,39 @@ const tui: TuiPlugin = async (api, options, meta) => {
     queueMicrotask(pump);
   }
 
+  function notifyQuery(entry: QueueEntry): void {
+    if (notified.has(entry.id)) return;
+    notified.add(entry.id);
+    void api.attention
+      .notify({
+        title: `Sandbox ${entry.operation} blocked`,
+        message: entry.kind === 'fs-query' ? entry.path : entry.target,
+        sound: { name: 'permission' },
+        notification: true,
+      })
+      .catch(() => undefined);
+  }
+
   function renderSessionPrompt(props: TuiHostSlotMap['session_prompt']) {
     return jsx(Fragment, {
       get children() {
+        permissionRevision();
+        queueMicrotask(pump);
         const entry = activeEntry();
-        const directory =
-          api.state.session.get(props.session_id)?.directory ||
-          api.state.path.directory ||
-          process.cwd();
-        if (entry?.kind === 'fs-query') {
+        const hostPromptActive =
+          props.visible === false ||
+          Boolean(props.disabled) ||
+          Boolean(entry && nativePermissionPending(entry));
+        const showEntry = Boolean(
+          entry &&
+          shouldRenderSandboxPermission(entry.sessionID, props.session_id, hostPromptActive),
+        );
+
+        if (showEntry && entry?.kind === 'fs-query') {
           const verb = entry.operation === 'read' ? 'Read' : 'Write';
           return jsx(LandstripPermissionPrompt, {
             icon: '→',
-            title: `${verb} ${formatPath(entry.path, directory)}`,
+            title: `${verb} ${formatPath(entry.path, entry.directory)}`,
             options: [
               { label: 'Allow once', value: 'once' },
               { label: 'Allow for session', value: 'session' },
@@ -339,9 +397,10 @@ const tui: TuiPlugin = async (api, options, meta) => {
             ],
             onSelect: (choice: QueryChoice) => resolveFsQuery(entry, choice),
             onCancel: () => resolveFsQuery(entry, 'deny'),
+            onShow: () => notifyQuery(entry),
           });
         }
-        if (entry?.kind === 'net-query') {
+        if (showEntry && entry?.kind === 'net-query') {
           const verb = entry.operation
             ? entry.operation[0]?.toUpperCase() + entry.operation.slice(1)
             : 'Network';
@@ -355,6 +414,7 @@ const tui: TuiPlugin = async (api, options, meta) => {
             ],
             onSelect: (choice: NetworkQueryChoice) => resolveNetworkQuery(entry, choice),
             onCancel: () => resolveNetworkQuery(entry, 'deny'),
+            onShow: () => notifyQuery(entry),
           });
         }
         return api.ui.Prompt({
@@ -380,18 +440,14 @@ const tui: TuiPlugin = async (api, options, meta) => {
     if (resolved.has(entry.id)) return;
     const action = choice === 'deny' ? 'deny' : 'allow';
     const verb = entry.operation === 'read' ? 'Read' : 'Write';
-    const directory = api.state.path.directory || process.cwd();
+    const directory = entry.directory;
     const scope = sessionScopeFor(entry.path, directory);
-    const sessionPaths =
-      entry.operation === 'read' ? sessionAllowedReadPaths : sessionAllowedWritePaths;
+    const allowances = sessionAllowancesFor(sessionAllowances, entry.sessionID);
+    const sessionPaths = entry.operation === 'read' ? allowances.readPaths : allowances.writePaths;
 
+    let responseAction: 'allow' | 'deny' = action;
     try {
       if (action === 'allow') {
-        // Breadth-first: seed the session set with the broadest reasonable
-        // ancestor so the still-running command stops prompting for sibling
-        // files under the same tree. 'once' intentionally stays exact-path.
-        if (choice !== 'once') sessionPaths.add(scope);
-
         if (choice === 'project' || choice === 'global') {
           const { globalPath, projectPath } = getConfigPaths(directory);
           const update = updateForPermission({
@@ -400,20 +456,22 @@ const tui: TuiPlugin = async (api, options, meta) => {
           });
           if (update) writeConfigFile(choice === 'project' ? projectPath : globalPath, update);
         }
+        if (choice !== 'once') sessionPaths.add(scope);
       }
+    } catch {
+      responseAction = 'deny';
+    }
 
-      respondQuery(entry.socket, entry.queryId, action);
+    try {
+      respondQuery(entry.socket, entry.queryId, responseAction);
       api.ui.toast({
         title: 'Sandbox',
         message:
-          action === 'deny'
+          responseAction === 'deny'
             ? `${verb} denied: ${entry.path}`
             : `${verb} allowed (${choice}) under ${scope}`,
-        variant: action === 'deny' ? 'warning' : 'success',
+        variant: responseAction === 'deny' ? 'warning' : 'success',
       });
-    } catch {
-      // Persisting failed — still release the held syscall by denying it.
-      respondQuery(entry.socket, entry.queryId, 'deny');
     } finally {
       liveQueries.delete(entry);
       finishActive(entry.id);
@@ -423,20 +481,15 @@ const tui: TuiPlugin = async (api, options, meta) => {
   function showFsQuery(entry: FsQueryEntry): void {
     activeId = entry.id;
     setActiveEntry(entry);
-
-    void api.attention.notify({
-      title: `Sandbox ${entry.operation} blocked`,
-      message: entry.path,
-      sound: { name: 'permission' },
-      notification: true,
-    });
   }
   function resolveNetworkQuery(entry: NetworkQueryEntry, choice: NetworkQueryChoice): void {
     if (resolved.has(entry.id)) return;
     const action = choice === 'deny' ? 'deny' : 'allow';
 
     try {
-      if (action === 'allow' && choice === 'session') sessionAllowedTargets.add(entry.target);
+      if (action === 'allow' && choice === 'session') {
+        sessionAllowancesFor(sessionAllowances, entry.sessionID).targets.add(entry.target);
+      }
 
       respondQuery(entry.socket, entry.queryId, action);
       api.ui.toast({
@@ -456,13 +509,6 @@ const tui: TuiPlugin = async (api, options, meta) => {
   function showNetworkQuery(entry: NetworkQueryEntry): void {
     activeId = entry.id;
     setActiveEntry(entry);
-
-    void api.attention.notify({
-      title: `Sandbox ${entry.operation} blocked`,
-      message: entry.target,
-      sound: { name: 'permission' },
-      notification: true,
-    });
   }
 
   // Query-response socket server (Linux-only — landstrip's socket protocol lives
@@ -481,6 +527,9 @@ const tui: TuiPlugin = async (api, options, meta) => {
       const socketId = ++socketSeq;
       const seen = new Set<string>();
       let buffer = '';
+      let sourceSessionID: string | undefined;
+      let routeSessionID: string | undefined;
+      let sessionDirectory: string | undefined;
 
       socket.on('data', (chunk: string | Buffer) => {
         buffer += chunk.toString();
@@ -494,21 +543,37 @@ const tui: TuiPlugin = async (api, options, meta) => {
           const line = buffer.slice(0, newline);
           buffer = buffer.slice(newline + 1);
 
+          if (!sourceSessionID || !routeSessionID || !sessionDirectory) {
+            const hello = decodeTrapSessionHello(line);
+            const sourceSession = hello ? api.state.session.get(hello.sessionID) : undefined;
+            const rootSession = hello
+              ? rootSessionIDFor(hello.sessionID, (sessionID) => api.state.session.get(sessionID))
+              : undefined;
+            if (!hello || !sourceSession || !rootSession) {
+              socket.destroy();
+              return;
+            }
+            sourceSessionID = hello.sessionID;
+            routeSessionID = rootSession;
+            sessionDirectory = sourceSession.directory || baseDirectory;
+            continue;
+          }
+
+          const allowances = sessionAllowancesFor(sessionAllowances, routeSessionID);
           for (const trap of parseLandstripTraps(line)) {
-            const directory = api.state.path.directory || process.cwd();
             if (trap.kind !== 'filesystem' && trap.kind !== 'network') continue;
             if (trap.state !== 'query') continue;
             if (seen.has(trap.query_id)) continue;
             seen.add(trap.query_id);
 
-            if (!loadConfig(directory, optionOverrides).enabled) {
+            if (!loadConfig(sessionDirectory, optionOverrides).enabled) {
               respondQuery(socket, trap.query_id, 'allow');
               continue;
             }
 
             if (trap.kind === 'filesystem') {
               const sessionPaths =
-                trap.operation === 'read' ? sessionAllowedReadPaths : sessionAllowedWritePaths;
+                trap.operation === 'read' ? allowances.readPaths : allowances.writePaths;
               if (sessionAllows(sessionPaths, trap.path)) {
                 respondQuery(socket, trap.query_id, 'allow');
                 continue;
@@ -521,11 +586,14 @@ const tui: TuiPlugin = async (api, options, meta) => {
                 queryId: trap.query_id,
                 operation: trap.operation,
                 path: trap.path,
+                sessionID: routeSessionID,
+                sourceSessionID,
+                directory: sessionDirectory,
               };
               liveQueries.add(entry);
               enqueueEntry(entry);
             } else {
-              if (sessionAllowedTargets.has(trap.target)) {
+              if (allowances.targets.has(trap.target)) {
                 respondQuery(socket, trap.query_id, 'allow');
                 continue;
               }
@@ -537,6 +605,9 @@ const tui: TuiPlugin = async (api, options, meta) => {
                 queryId: trap.query_id,
                 operation: trap.operation,
                 target: trap.target,
+                sessionID: routeSessionID,
+                sourceSessionID,
+                directory: sessionDirectory,
               };
               liveQueries.add(entry);
               enqueueEntry(entry);
@@ -579,6 +650,18 @@ const tui: TuiPlugin = async (api, options, meta) => {
     });
   }
 
+  const refreshPermissionPresentation = (): void => {
+    queueMicrotask(() => {
+      setPermissionRevision((revision) => revision + 1);
+      pump();
+    });
+  };
+  const unregisterPermissionAsked = api.event.on('permission.asked', refreshPermissionPresentation);
+  const unregisterPermissionReplied = api.event.on(
+    'permission.replied',
+    refreshPermissionPresentation,
+  );
+
   // /sandbox shows the config and toggles the persisted `enabled` flag. The
   // server reads sandbox.json on every tool call, so the toggle takes effect on
   // the next command without any cross-process signalling.
@@ -683,11 +766,15 @@ const tui: TuiPlugin = async (api, options, meta) => {
   }
 
   api.lifecycle.onDispose(() => {
+    unregisterPermissionAsked();
+    unregisterPermissionReplied();
+    sessionAllowances.clear();
     // Deny any still-held queries so the sandboxed children don't hang, then
     // tear down the socket server and drop the discovery file.
     for (const entry of liveQueries) {
       respondQuery(entry.socket, entry.queryId, 'deny');
       liveQueries.delete(entry);
+      finishActive(entry.id);
     }
     for (const socket of sockets) socket.destroy();
     if (socketServer) {