opencode-landstrip 0.18.33 → 0.18.35

package/README.md

@@ -1,7 +1,6 @@
 # opencode-landstrip
 
-`opencode-landstrip` runs OpenCode AI `bash` calls through
-[`landstrip`](https://github.com/landstrip/landstrip).
+OpenCode plugin that runs AI `bash` calls through Landstrip.
 
 ## Install
 
@@ -13,85 +12,37 @@ opencode plugin install opencode-landstrip
 opencode plugin install opencode-landstrip --global
 ```
 
-A manual installation needs both plugins. Add the server plugin to
-`opencode.json`:
-
-```json
-{
-  "$schema": "https://opencode.ai/config.json",
-  "plugin": ["opencode-landstrip"]
-}
-```
-
-Add the presenter to `tui.json`:
-
-```json
-{
-  "$schema": "https://opencode.ai/config.json",
-  "plugin": ["opencode-landstrip/tui"]
-}
-```
+The installer configures both the server plugin and TUI presenter.
 
 ## Permissions
 
-OpenCode agent permissions authorize tool dispatch. Landstrip sandbox
-permissions authorize filesystem and network access before a tool or while its
-process runs. Agent approval never bypasses a sandbox hard denial.
+OpenCode permissions authorize tool dispatch. Landstrip permissions authorize
+filesystem and network access. Agent approval never bypasses a sandbox hard
+denial, and requests without a live presenter are denied.
 
-The TUI presents one request at a time. OpenCode's native agent prompt has
-priority; Landstrip requests retain FIFO order and are routed to the originating
-root session. Without a live presenter, blocked sandbox requests are denied.
-
-Filesystem approvals may be stored in `.opencode/sandbox.json` for the project
-or `~/.config/opencode/sandbox.json` globally. `/sandbox` displays or toggles the
-policy. It updates the project file when that file defines `enabled`, otherwise
-the global file.
+`/sandbox` displays or toggles the policy. Persistent approvals update
+`.opencode/sandbox.json` or `~/.config/opencode/sandbox.json`.
 
 ## Configuration
 
 Policy merges in this order:
 
-1. bundled [`sandbox.json`](./sandbox.json);
+1. bundled `sandbox.json`;
 2. `~/.config/opencode/sandbox.json`;
 3. `.opencode/sandbox.json`;
 4. plugin options.
 
 Objects merge recursively, arrays combine, and later scalar values replace
-earlier values. The global file is initialized from the bundled policy when it
-does not exist. Programmatic plugin options may be the policy object directly or
-`{ "config": { ... } }`.
-
-| Field                         | Bundled default                                                                                                 |
-| ----------------------------- | --------------------------------------------------------------------------------------------------------------- |
-| `enabled`                     | `true`                                                                                                          |
-| `filesystem.denyRead`         | `["/Users", "/home"]`                                                                                           |
-| `filesystem.allowRead`        | `[".", "~/.gitconfig", "~/.config/git/config", "/dev/null"]`                                                    |
-| `filesystem.allowWrite`       | `[".", "/dev/null"]`                                                                                            |
-| `filesystem.denyWrite`        | `["**/.env", "**/.env.*", "**/*.pem", "**/*.key", ".opencode/sandbox.json", "~/.config/opencode/sandbox.json"]` |
-| `network.allowNetwork`        | `false`                                                                                                         |
-| `network.allowLocalBinding`   | `false`                                                                                                         |
-| `network.allowAllUnixSockets` | `false`                                                                                                         |
-| `network.allowUnixSockets`    | `[]`                                                                                                            |
-| `network.allowedDomains`      | `[]`                                                                                                            |
-| `network.deniedDomains`       | `[]`                                                                                                            |
-
-Filesystem and core network semantics follow the main
-[Landstrip policy](https://github.com/landstrip/landstrip#policy). `allowedDomains`
-and `deniedDomains` are plugin-only fields enforced by its local HTTP/HTTPS proxy.
-
-If `enabled` is true but the Landstrip binary, version, or platform is unusable,
-AI Bash fails closed rather than running without isolation. Set `enabled` to
-false explicitly to allow unsandboxed AI Bash.
-
-## Limits
-
-Only AI `bash` calls are process-sandboxed. Shell-mode commands entered directly
-by the user cannot be replaced through OpenCode's plugin API. They may inherit
-proxy settings and receive policy checks, but they do not have OS isolation.
-
-See the main [Landstrip documentation](https://github.com/landstrip/landstrip#readme) for platform limits.
-
-## License
-
-`opencode-landstrip` is licensed under `Apache-2.0`. The bundled Landstrip
-package is licensed separately as `Apache-2.0 AND LGPL-2.1-or-later`.
+earlier values. The bundled policy denies sensitive files and network access
+while allowing project writes. See [`sandbox.json`](sandbox.json) for its exact
+defaults.
+
+If sandboxing is enabled but the binary or platform is unusable, AI Bash fails
+closed. Set `enabled` to `false` explicitly to allow unsandboxed AI Bash.
+
+Only AI `bash` calls receive OS isolation; direct user shell commands cannot be
+replaced through OpenCode's plugin API.
+
+## Licensing
+
+[Apache 2.0](../../LICENSE-APACHE-2.0).

package/index.ts

@@ -15,7 +15,7 @@ import {
   isIP,
   type Socket,
 } from 'node:net';
-import { homedir, tmpdir } from 'node:os';
+import { tmpdir } from 'node:os';
 import { basename, dirname, isAbsolute, join, parse, resolve, sep } from 'node:path';
 import { URL } from 'node:url';
 
@@ -23,8 +23,11 @@ import {
   type LandstripTrap,
   type SandboxConfig,
   type SandboxFilesystemConfig,
+  allowsAllDomains,
   controlResponseLine,
   decodeLandstripTrap,
+  domainMatchesAny,
+  expandHomePath,
   extractDomainsFromCommand,
   formatLandstripTraps,
   getConfigPaths,
@@ -104,7 +107,7 @@ for (const [network, prefix] of [
 }
 
 function expandPath(filePath: string, baseDirectory: string): string {
-  const expanded = filePath.replace(/^~(?=$|[/])/, homedir());
+  const expanded = expandHomePath(filePath);
   return resolve(isAbsolute(expanded) ? expanded : join(baseDirectory, expanded));
 }
 
@@ -242,27 +245,6 @@ function resolveFilesystemConfig(
   };
 }
 
-function domainMatchesPattern(domain: string, pattern: string): boolean {
-  const normalizedDomain = domain.toLowerCase();
-  const normalizedPattern = pattern.toLowerCase();
-
-  if (normalizedPattern === '*') return true;
-  if (normalizedPattern.startsWith('*.')) {
-    const base = normalizedPattern.slice(2);
-    return normalizedDomain === base || normalizedDomain.endsWith(`.${base}`);
-  }
-
-  return normalizedDomain === normalizedPattern;
-}
-
-function domainMatchesAny(domain: string, patterns: string[]): boolean {
-  return patterns.some((pattern) => domainMatchesPattern(domain, pattern));
-}
-
-function allowsAllDomains(allowedDomains: string[]): boolean {
-  return allowedDomains.includes('*');
-}
-
 function isDomainAllowed(domain: string, config: SandboxConfig): boolean {
   return (
     config.network.allowNetwork ||

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-landstrip",
-  "version": "0.18.33",
+  "version": "0.18.35",
   "description": "OS-level AI command sandboxing for OpenCode with Landstrip",
   "keywords": [
     "landlock",
@@ -48,7 +48,7 @@
     "ci:test": "npm test"
   },
   "dependencies": {
-    "@landstrip/landstrip": "^0.18.33",
+    "@landstrip/landstrip": "^0.18.35",
     "@opentui/solid": ">=0.3.4",
     "solid-js": "1.9.12"
   },

package/shared.ts

@@ -7,6 +7,38 @@ import {
   type LandstripTrap,
 } from '@landstrip/landstrip';
 
+import {
+  allowsAllDomains,
+  controlResponseLine,
+  decodeLandstripTrap,
+  domainMatchesAny,
+  domainMatchesPattern,
+  expandHomePath,
+  formatLandstripTrap,
+  formatLandstripTraps,
+  isRecord,
+  parseLandstripTraps,
+  pathUnderDirectory,
+  sessionAllows,
+  sessionScopeFor,
+} from '@landstrip/landstrip/shared';
+
+export {
+  allowsAllDomains,
+  controlResponseLine,
+  decodeLandstripTrap,
+  domainMatchesAny,
+  domainMatchesPattern,
+  expandHomePath,
+  formatLandstripTrap,
+  formatLandstripTraps,
+  isRecord,
+  parseLandstripTraps,
+  pathUnderDirectory,
+  sessionAllows,
+  sessionScopeFor,
+};
+
 // Re-exported so index.ts/tui.ts can import the trap/response types from this
 // module alongside the parsing functions that produce/consume them.
 export type { LandstripControlResponse, LandstripTrap };
@@ -15,7 +47,7 @@ import { createHash } from 'node:crypto';
 import { existsSync, mkdirSync, readFileSync, realpathSync, rmSync, writeFileSync } from 'node:fs';
 import { homedir, tmpdir } from 'node:os';
 import { fileURLToPath } from 'node:url';
-import { dirname, isAbsolute, join, relative, sep } from 'node:path';
+import { dirname, join } from 'node:path';
 
 export interface SandboxFilesystemConfig {
   denyRead: string[];
@@ -57,62 +89,6 @@ const LANDSTRIP_PACKAGE_NAMES = new Set([
   '@landstrip/landstrip-win32-arm64',
 ]);
 
-// Breadth-first filesystem approval: a held read/write under a directory tree
-// is approved for the broadest reasonable ancestor (e.g. `~/.cargo`, not each
-// subcrate file), so a single approval covers sibling files under the same tree.
-export function pathUnderDirectory(filePath: string, dir: string): boolean {
-  const child = relative(dir, filePath);
-  return child === '' || (!isAbsolute(child) && child !== '..' && !child.startsWith(`..${sep}`));
-}
-
-export function sessionAllows(prefixes: Set<string>, filePath: string): boolean {
-  for (const prefix of prefixes) {
-    if (pathUnderDirectory(filePath, prefix)) return true;
-  }
-  return false;
-}
-
-// The broadest ancestor worth approving in one click: the immediate child of
-// `$HOME` (e.g. `~/.cargo`) for paths under the user's home, the project root
-// for paths under it, otherwise the containing directory. When the file sits
-// directly on a boundary (so the only ancestor is `$HOME` itself, which would
-// over-broaden), fall back to the exact file so nothing widens silently.
-export function sessionScopeFor(filePath: string, baseDirectory: string): string {
-  const dir = dirname(filePath);
-  const home = homedir();
-  const homeBoundaries = new Set<string>([home]);
-  try {
-    homeBoundaries.add(realpathSync.native(home));
-  } catch {
-    // $HOME not resolvable — fall back to the raw value only.
-  }
-
-  for (const boundary of homeBoundaries) {
-    if (pathUnderDirectory(dir, boundary)) {
-      const first = relative(boundary, dir).split(sep)[0];
-      if (!first) return filePath;
-      return join(boundary, first);
-    }
-  }
-
-  const projectBoundaries = new Set<string>([baseDirectory]);
-  try {
-    projectBoundaries.add(realpathSync.native(baseDirectory));
-  } catch {
-    // Project directory not resolvable — fall back to the raw value only.
-  }
-
-  for (const boundary of projectBoundaries) {
-    if (pathUnderDirectory(dir, boundary)) return boundary;
-  }
-
-  return dir;
-}
-
-export function isRecord(value: unknown): value is Record<string, unknown> {
-  return typeof value === 'object' && value !== null && !Array.isArray(value);
-}
-
 export function list(values: string[]): string {
   return values.join(', ') || '(none)';
 }
@@ -404,112 +380,6 @@ export function updateForPermission(
   return null;
 }
 
-// Landstrip emits one JSON trap per line on its trap fd/file. The `state` field
-// distinguishes a terminal `info` trap from a `query` trap that holds a syscall
-// pending until the host answers with the trap's `query_id`. Parsing lives here
-// so the server hook and the TUI socket handler decode identically.
-const LANDSTRIP_OPERATIONS = new Set<'read' | 'write'>(['read', 'write']);
-
-function isLandstripOperation(value: unknown): value is 'read' | 'write' {
-  return typeof value === 'string' && LANDSTRIP_OPERATIONS.has(value as 'read' | 'write');
-}
-
-// The declarations landstrip ships are compile-time only, so a runtime guard is
-// still required — but it only has to validate the fields actually read below.
-// Deliberately does not validate `state`: a missing or unknown state degrades to
-// "informational", the safe direction. `query_id` must be a string on both
-// filesystem and network traps — landstrip < 0.17 sent a number here, and a
-// numeric id fails landstrip's own deserializer when echoed back, so treating
-// it as undecodable (rather than coercing it) keeps a stale/mismatched trap
-// from ever being answered with a shape the broker would reject.
-function isLandstripTrap(value: unknown): value is LandstripTrap {
-  if (!isRecord(value)) return false;
-
-  switch (value.kind) {
-    case 'filesystem':
-      return (
-        isLandstripOperation(value.operation) &&
-        typeof value.path === 'string' &&
-        typeof value.query_id === 'string'
-      );
-    case 'network':
-      return (
-        typeof value.operation === 'string' &&
-        typeof value.target === 'string' &&
-        typeof value.query_id === 'string'
-      );
-    case 'launch':
-      return typeof value.program === 'string' && typeof value.message === 'string';
-    case 'usage':
-      return typeof value.message === 'string';
-    case 'internal':
-      return typeof value.code === 'string' && typeof value.message === 'string';
-    default:
-      return false;
-  }
-}
-
-export function decodeLandstripTrap(value: unknown): LandstripTrap | null {
-  return isLandstripTrap(value) ? value : null;
-}
-
-export function parseLandstripTraps(output: string): LandstripTrap[] {
-  const traps: LandstripTrap[] = [];
-
-  for (const line of output.split('\n')) {
-    const trimmed = line.trim();
-    if (trimmed.length === 0 || trimmed[0] !== '{') continue;
-
-    let parsed: unknown;
-    try {
-      parsed = JSON.parse(trimmed);
-    } catch {
-      continue;
-    }
-
-    const trap = decodeLandstripTrap(parsed);
-    if (trap) traps.push(trap);
-  }
-
-  return traps;
-}
-
-export function formatLandstripTrap(trap: LandstripTrap): string {
-  switch (trap.kind) {
-    case 'filesystem':
-      return `landstrip: filesystem ${trap.operation} denied (${trap.path})${
-        trap.mechanism ? ` [${trap.mechanism}]` : ''
-      }`;
-    case 'network':
-      return `landstrip: network ${trap.operation} denied (${trap.target})${
-        trap.mechanism ? ` [${trap.mechanism}]` : ''
-      }`;
-    case 'launch':
-      return `landstrip: launch failed (${trap.program})${trap.message ? `: ${trap.message}` : ''}`;
-    case 'usage':
-      return `landstrip: usage error: ${trap.message}`;
-    case 'internal': {
-      const mechanism = trap.mechanism ? ` [${trap.mechanism}]` : '';
-      return `landstrip: ${trap.code}${mechanism}: ${trap.message}`;
-    }
-  }
-}
-
-export function formatLandstripTraps(traps: LandstripTrap[]): string {
-  return traps.map(formatLandstripTrap).join('\n');
-}
-
-// The broker matches an answer to its query by the exact decimal `query_id`
-// string the trap carried. A numeric id fails its deserializer, the line is
-// dropped, and the child's syscall stays suspended.
-export function controlResponseLine(
-  queryId: string,
-  action: LandstripControlResponse['action'],
-): string {
-  const response: LandstripControlResponse = { query_id: queryId, action };
-  return JSON.stringify(response) + '\n';
-}
-
 export interface TrapSessionHello {
   kind: 'opencode-landstrip-session';
   sessionID: string;
@@ -615,16 +485,25 @@ export function discoveryFilePath(baseDirectory: string): string {
 // /sandbox toggles the persisted `enabled` flag. Write it where the setting
 // already lives — the project config if it sets `enabled`, otherwise the global
 // config — and return the scope written so the UI can report it.
+export function sandboxConfigTarget(baseDirectory: string): {
+  scope: 'project' | 'global';
+  path: string;
+} {
+  const { globalPath, projectPath } = getConfigPaths(baseDirectory);
+  const projectConfig = readConfigFile(projectPath);
+  const useProject = projectConfig !== null && projectConfig.enabled !== undefined;
+  return useProject
+    ? { scope: 'project', path: projectPath }
+    : { scope: 'global', path: globalPath };
+}
+
 export function setSandboxConfigEnabled(
   baseDirectory: string,
   enabled: boolean,
 ): 'project' | 'global' {
-  const { globalPath, projectPath } = getConfigPaths(baseDirectory);
-  const projectConfig = readConfigFile(projectPath);
-  const useProject = projectConfig !== null && projectConfig.enabled !== undefined;
-  const target = useProject ? projectPath : globalPath;
-  writeConfigFile(target, { enabled });
-  return useProject ? 'project' : 'global';
+  const target = sandboxConfigTarget(baseDirectory);
+  writeConfigFile(target.path, { enabled });
+  return target.scope;
 }
 
 export function writeDiscoveryPort(baseDirectory: string, port: number): void {

package/tui.ts

@@ -12,7 +12,7 @@ import type {
   TuiSlotPlugin,
 } from '@opencode-ai/plugin/tui';
 import { RGBA } from '@opentui/core';
-import { useTerminalDimensions } from '@opentui/solid';
+import { Portal, useTerminalDimensions } from '@opentui/solid';
 import { Fragment, jsx, jsxs } from '@opentui/solid/jsx-runtime';
 import { createSignal, onCleanup, onMount } from 'solid-js';
 
@@ -27,7 +27,7 @@ import {
   removeDiscoveryFile,
   sessionAllows,
   sessionAllowancesFor,
-  sandboxSummary,
+  sandboxConfigTarget,
   sessionScopeFor,
   rootSessionIDFor,
   setSandboxConfigEnabled,
@@ -118,16 +118,9 @@ function formatPath(input: string, base: string): string {
   return absolute;
 }
 
-function selectedForeground(theme: TuiSlotContext['theme']['current']): RGBA {
-  const resolved = theme as typeof theme & { _hasSelectedListItemText?: boolean };
-  if (resolved._hasSelectedListItemText) return theme.selectedListItemText;
-
-  if (theme.background.a === 0) {
-    const { r, g, b } = theme.warning;
-    const luminance = 0.299 * r + 0.587 * g + 0.114 * b;
-    return luminance > 0.5 ? RGBA.fromInts(0, 0, 0) : RGBA.fromInts(255, 255, 255);
-  }
-  return theme.background;
+function selectedForeground(background: RGBA): RGBA {
+  const luminance = 0.2126 * background.r + 0.7152 * background.g + 0.0722 * background.b;
+  return luminance > 0.5 ? RGBA.fromInts(0, 0, 0) : RGBA.fromInts(255, 255, 255);
 }
 
 const tui: TuiPlugin = async (api, options, meta) => {
@@ -138,6 +131,7 @@ const tui: TuiPlugin = async (api, options, meta) => {
     const theme = api.theme.current;
     const dimensions = useTerminalDimensions();
     const [selected, setSelected] = createSignal(0);
+    const [expanded, setExpanded] = createSignal(false);
     onMount(props.onShow);
 
     function move(direction: number): void {
@@ -152,12 +146,18 @@ const tui: TuiPlugin = async (api, options, meta) => {
     const unregister = api.keymap.registerLayer({
       priority: 1000,
       bindings: [
-        { key: 'left', cmd: () => move(-1) },
-        { key: 'h', cmd: () => move(-1) },
-        { key: 'right', cmd: () => move(1) },
-        { key: 'l', cmd: () => move(1) },
-        { key: 'return', cmd: submit },
-        { key: 'escape', cmd: props.onCancel },
+        { key: 'left', desc: 'Previous permission option', group: 'Sandbox', cmd: () => move(-1) },
+        { key: 'h', desc: 'Previous permission option', group: 'Sandbox', cmd: () => move(-1) },
+        { key: 'right', desc: 'Next permission option', group: 'Sandbox', cmd: () => move(1) },
+        { key: 'l', desc: 'Next permission option', group: 'Sandbox', cmd: () => move(1) },
+        { key: 'return', desc: 'Select permission option', group: 'Sandbox', cmd: submit },
+        { key: 'escape', desc: 'Reject permission', group: 'Sandbox', cmd: props.onCancel },
+        {
+          key: 'ctrl+f',
+          desc: 'Toggle permission prompt fullscreen',
+          group: 'Sandbox',
+          cmd: () => setExpanded((value) => !value),
+        },
       ],
     });
     onCleanup(unregister);
@@ -177,13 +177,126 @@ const tui: TuiPlugin = async (api, options, meta) => {
         },
         children: jsx('text', {
           get fg() {
-            return selected() === index ? selectedForeground(theme) : theme.textMuted;
+            return selected() === index ? selectedForeground(theme.warning) : theme.textMuted;
           },
           children: option.label,
         }),
       }),
     );
 
+    const children = [
+      jsxs('box', {
+        gap: 1,
+        paddingLeft: 1,
+        paddingRight: 3,
+        paddingTop: 1,
+        paddingBottom: 1,
+        flexGrow: 1,
+        children: [
+          jsxs('box', {
+            flexDirection: 'column',
+            gap: 0,
+            paddingLeft: 1,
+            flexShrink: 0,
+            children: [
+              jsxs('box', {
+                flexDirection: 'row',
+                gap: 1,
+                flexShrink: 0,
+                children: [
+                  jsx('text', { fg: theme.warning, children: '△' }),
+                  jsx('text', { fg: theme.text, children: 'Permission required' }),
+                ],
+              }),
+              jsxs('box', {
+                flexDirection: 'row',
+                gap: 1,
+                paddingLeft: 2,
+                flexShrink: 0,
+                children: [
+                  jsx('text', { fg: theme.textMuted, flexShrink: 0, children: props.icon }),
+                  jsx('text', { fg: theme.text, wrapMode: 'word', children: props.title }),
+                ],
+              }),
+            ],
+          }),
+        ],
+      }),
+      jsxs('box', {
+        get flexDirection() {
+          return dimensions().width < 80 ? 'column' : 'row';
+        },
+        flexShrink: 0,
+        gap: 1,
+        paddingTop: 1,
+        paddingLeft: 2,
+        paddingRight: 3,
+        paddingBottom: 1,
+        backgroundColor: theme.backgroundElement,
+        get justifyContent() {
+          return dimensions().width < 80 ? 'flex-start' : 'space-between';
+        },
+        get alignItems() {
+          return dimensions().width < 80 ? 'flex-start' : 'center';
+        },
+        children: [
+          jsx('box', {
+            flexDirection: 'row',
+            gap: 1,
+            flexShrink: 0,
+            children: optionButtons,
+          }),
+          jsxs('box', {
+            flexDirection: 'row',
+            gap: 2,
+            flexShrink: 0,
+            children: [
+              jsxs('text', {
+                fg: theme.text,
+                children: [
+                  'ctrl+f ',
+                  jsx('span', {
+                    style: { fg: theme.textMuted },
+                    children: expanded() ? 'minimize' : 'fullscreen',
+                  }),
+                ],
+              }),
+              jsxs('text', {
+                fg: theme.text,
+                children: [
+                  '⇆ ',
+                  jsx('span', { style: { fg: theme.textMuted }, children: 'select' }),
+                ],
+              }),
+              jsxs('text', {
+                fg: theme.text,
+                children: [
+                  'enter ',
+                  jsx('span', { style: { fg: theme.textMuted }, children: 'confirm' }),
+                ],
+              }),
+            ],
+          }),
+        ],
+      }),
+    ];
+
+    if (expanded()) {
+      return Portal({
+        children: jsxs('box', {
+          top: dimensions().height * -1 + 1,
+          bottom: 1,
+          left: 2,
+          right: 2,
+          position: 'absolute',
+          border: ['left'],
+          borderColor: theme.warning,
+          customBorderChars: promptBorderChars,
+          backgroundColor: theme.backgroundPanel,
+          children,
+        }),
+      });
+    }
     return jsxs('box', {
       top: 0,
       maxHeight: 15,
@@ -195,92 +308,7 @@ const tui: TuiPlugin = async (api, options, meta) => {
       borderColor: theme.warning,
       customBorderChars: promptBorderChars,
       backgroundColor: theme.backgroundPanel,
-      children: [
-        jsxs('box', {
-          gap: 1,
-          paddingLeft: 1,
-          paddingRight: 3,
-          paddingTop: 1,
-          paddingBottom: 1,
-          flexGrow: 1,
-          children: [
-            jsxs('box', {
-              flexDirection: 'column',
-              gap: 0,
-              paddingLeft: 1,
-              flexShrink: 0,
-              children: [
-                jsxs('box', {
-                  flexDirection: 'row',
-                  gap: 1,
-                  flexShrink: 0,
-                  children: [
-                    jsx('text', { fg: theme.warning, children: '△' }),
-                    jsx('text', { fg: theme.text, children: 'Permission required' }),
-                  ],
-                }),
-                jsxs('box', {
-                  flexDirection: 'row',
-                  gap: 1,
-                  paddingLeft: 2,
-                  flexShrink: 0,
-                  children: [
-                    jsx('text', { fg: theme.textMuted, flexShrink: 0, children: props.icon }),
-                    jsx('text', { fg: theme.text, wrapMode: 'word', children: props.title }),
-                  ],
-                }),
-              ],
-            }),
-          ],
-        }),
-        jsxs('box', {
-          get flexDirection() {
-            return dimensions().width < 80 ? 'column' : 'row';
-          },
-          flexShrink: 0,
-          gap: 1,
-          paddingTop: 1,
-          paddingLeft: 2,
-          paddingRight: 3,
-          paddingBottom: 1,
-          backgroundColor: theme.backgroundElement,
-          get justifyContent() {
-            return dimensions().width < 80 ? 'flex-start' : 'space-between';
-          },
-          get alignItems() {
-            return dimensions().width < 80 ? 'flex-start' : 'center';
-          },
-          children: [
-            jsx('box', {
-              flexDirection: 'row',
-              gap: 1,
-              flexShrink: 0,
-              children: optionButtons,
-            }),
-            jsxs('box', {
-              flexDirection: 'row',
-              gap: 2,
-              flexShrink: 0,
-              children: [
-                jsxs('text', {
-                  fg: theme.text,
-                  children: [
-                    '⇆ ',
-                    jsx('span', { style: { fg: theme.textMuted }, children: 'select' }),
-                  ],
-                }),
-                jsxs('text', {
-                  fg: theme.text,
-                  children: [
-                    'enter ',
-                    jsx('span', { style: { fg: theme.textMuted }, children: 'confirm' }),
-                  ],
-                }),
-              ],
-            }),
-          ],
-        }),
-      ],
+      children,
     });
   }
 
@@ -662,23 +690,25 @@ const tui: TuiPlugin = async (api, options, meta) => {
     refreshPermissionPresentation,
   );
 
-  // /sandbox shows the config and toggles the persisted `enabled` flag. The
-  // server reads sandbox.json on every tool call, so the toggle takes effect on
-  // the next command without any cross-process signalling.
+  // /sandbox toggles the persisted `enabled` flag. The server reads
+  // sandbox.json on every tool call, so the toggle takes effect on the next
+  // command without any cross-process signalling.
   const showSandbox = () => {
     const directory = api.state.path.directory || process.cwd();
     const config = loadConfig(directory, optionOverrides);
-    const { globalPath, projectPath } = getConfigPaths(directory);
     const next = !config.enabled;
-    const message =
-      sandboxSummary(config, globalPath, projectPath) +
-      `\n\n${next ? 'Enable' : 'Disable'} the sandbox?  (enter = ${next ? 'enable' : 'disable'}, esc = close)`;
+    const target = sandboxConfigTarget(directory);
+    const message = [
+      `Sandbox is ${config.enabled ? 'enabled' : 'disabled'}.`,
+      `Network: ${config.network.allowNetwork ? 'open' : 'proxied'}`,
+      `Change: ${target.scope} config at ${formatPath(target.path, directory)}`,
+    ].join('\n');
 
     // No `clear()` in onConfirm: the host pops the dialog itself, and its
     // `clear()` re-invokes onClose, which would recurse and freeze the TUI.
     api.ui.dialog.replace(() =>
       api.ui.DialogConfirm({
-        title: 'Sandbox',
+        title: next ? 'Enable sandbox?' : 'Disable sandbox?',
         message,
         onConfirm: () => {
           const scope = setSandboxConfigEnabled(directory, next);
@@ -709,18 +739,6 @@ const tui: TuiPlugin = async (api, options, meta) => {
     ],
   });
 
-  api.command?.register(() => [
-    {
-      title: 'Sandbox',
-      value: 'sandbox',
-      description: 'Inspect and toggle the sandbox',
-      category: 'Sandbox',
-      suggested: true,
-      slash: { name: 'sandbox' },
-      onSelect: showSandbox,
-    },
-  ]);
-
   // Persistent status badge in the prompt area.
   try {
     const [sandboxRevision, setSandboxRevision] = createSignal(0);

package/LICENSE

@@ -1,201 +0,0 @@
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright [yyyy] [name of copyright owner]
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.